152 files changed, 918 insertions, 613 deletions
diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 8b0563633442..43e89b1537d9 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -134,8 +134,6 @@ dvb/
        - info on Linux Digital Video Broadcast (DVB) subsystem.
 early-userspace/
        - info about initramfs, klibc, and userspace early during boot.
-ecryptfs.txt
-        - docs on eCryptfs: stacked cryptographic filesystem for Linux.
 eisa.txt
        - info on EISA bus support.
 exception.txt
diff --git a/Documentation/ManagementStyle b/Documentation/ManagementStyle
index cbbebfb51ffe..49a8efa5afeb 100644
--- a/Documentation/ManagementStyle
+++ b/Documentation/ManagementStyle
@@ -166,7 +166,7 @@ To solve this problem, you really only have two options:
 The option of being unfailingly polite really doesn't exist. Nobody will
 trust somebody who is so clearly hiding his true character.
-(*) Paul Simon sang "Fifty Ways to Lose Your Lover", because quite
+(*) Paul Simon sang "Fifty Ways to Leave Your Lover", because quite
 frankly, "A Million Ways to Tell a Developer He Is a D*ckhead" doesn't
 scan nearly as well.  But I'm sure he thought about it. 
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 397575880dc4..a30dd4480ad4 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -126,7 +126,7 @@ the reviewers time and will get your patch rejected, probably
 without even being read.
 At a minimum you should check your patches with the patch style
-checker prior to submission (scripts/patchcheck.pl).  You should
+checker prior to submission (scripts/checkpatch.pl).  You should
 be able to justify all violations that remain in your patch.
diff --git a/Documentation/filesystems/00-INDEX b/Documentation/filesystems/00-INDEX
index 571785887a4f..59db1bca7027 100644
--- a/Documentation/filesystems/00-INDEX
+++ b/Documentation/filesystems/00-INDEX
@@ -32,6 +32,8 @@ directory-locking
        - info about the locking scheme used for directory operations.
 dlmfs.txt
        - info on the userspace interface to the OCFS2 DLM.
+ecryptfs.txt
+        - docs on eCryptfs: stacked cryptographic filesystem for Linux.
 ext2.txt
        - info, mount options and specifications for the Ext2 filesystem.
 ext3.txt
diff --git a/Documentation/filesystems/ocfs2.txt b/Documentation/filesystems/ocfs2.txt
index 8ccf0c1b58ed..ed55238023a9 100644
--- a/Documentation/filesystems/ocfs2.txt
+++ b/Documentation/filesystems/ocfs2.txt
@@ -28,11 +28,7 @@ Manish Singh  <manish.singh@oracle.com>
 Caveats
 =======
 Features which OCFS2 does not support yet:
-        - sparse files
        - extended attributes
-        - shared writable mmap
-        - loopback is supported, but data written will not
-          be cluster coherent.
        - quotas
        - cluster aware flock
        - cluster aware lockf
@@ -57,3 +53,12 @@ nointr			Do not allow signals to interrupt cluster
 atime_quantum=60(*)     OCFS2 will not update atime unless this number
                        of seconds has passed since the last update.
                        Set to zero to always update atime.
+data=ordered    (*)     All data are forced directly out to the main file
+                        system prior to its metadata being committed to the
+                        journal.
+data=writeback          Data ordering is not preserved, data may be written
+                        into the main file system after its metadata has been
+                        committed to the journal.
+preferred_slot=0(*)     During mount, try to use this filesystem slot first. If
+                        it is in use by another node, the first empty one found
+                        will be chosen. Invalid values will be ignored.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index b41cde31d112..586b6f85d4e0 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1,5 +1,5 @@
-                          Kernel Parameters
+                          Kernel Parameters
-                          ~~~~~~~~~~~~~~~~~
+                          ~~~~~~~~~~~~~~~~~
 The following is a consolidated list of the kernel parameters as implemented
 (mostly) by the __setup() macro and sorted into English Dictionary order
@@ -468,9 +468,6 @@ and is between 256 and 4096 characters. It is defined in the file
                        Format:
                        <first_slot>,<last_slot>,<port>,<enum_bit>[,<debug>]
-        cpia_pp=        [HW,PPT]
-                        Format: { parport<nr> | auto | none }
        crashkernel=nn[KMG]@ss[KMG]
                        [KNL] Reserve a chunk of physical memory to
                        hold a kernel to switch to with kexec on panic.
@@ -1465,7 +1462,7 @@ and is between 256 and 4096 characters. It is defined in the file
        reboot=         [BUGS=X86-32,BUGS=ARM,BUGS=IA-64] Rebooting mode
                        Format: <reboot_mode>[,<reboot_mode2>[,...]]
-                        See arch/*/kernel/reboot.c or arch/*/kernel/process.c                   
+                        See arch/*/kernel/reboot.c or arch/*/kernel/process.c
        reserve=        [KNL,BUGS] Force the kernel to ignore some iomem area
@@ -1553,12 +1550,12 @@ and is between 256 and 4096 characters. It is defined in the file
        selinux_compat_net =
                        [SELINUX] Set initial selinux_compat_net flag value.
-                        Format: { "0" | "1" }
+                        Format: { "0" | "1" }
-                        0 -- use new secmark-based packet controls
+                        0 -- use new secmark-based packet controls
-                        1 -- use legacy packet controls
+                        1 -- use legacy packet controls
-                        Default value is 0 (preferred).
+                        Default value is 0 (preferred).
-                        Value can be changed at runtime via
+                        Value can be changed at runtime via
-                        /selinux/compat_net.
+                        /selinux/compat_net.
        serialnumber    [BUGS=X86-32]
@@ -1957,7 +1954,7 @@ and is between 256 and 4096 characters. It is defined in the file
        norandmaps      Don't use address space randomization
                        Equivalent to echo 0 > /proc/sys/kernel/randomize_va_space
-        unwind_debug=N  N > 0 will enable dwarf2 unwinder debugging
+        unwind_debug=N  N > 0 will enable dwarf2 unwinder debugging
                        This is useful to get more information why
                        you got a "dwarf2 unwinder stuck"
diff --git a/Documentation/networking/multiqueue.txt b/Documentation/networking/multiqueue.txt
index 00b60cce2224..ea5a42e8f79f 100644
--- a/Documentation/networking/multiqueue.txt
+++ b/Documentation/networking/multiqueue.txt
@@ -58,9 +58,13 @@ software, so it's a straight round-robin qdisc.  It uses the same syntax and
 classification priomap that sch_prio uses, so it should be intuitive to
 configure for people who've used sch_prio.
-The PRIO qdisc naturally plugs into a multiqueue device.  If PRIO has been
+In order to utilitize the multiqueue features of the qdiscs, the network
-built with NET_SCH_PRIO_MQ, then upon load, it will make sure the number of
+device layer needs to enable multiple queue support.  This can be done by
-bands requested is equal to the number of queues on the hardware.  If they
+selecting NETDEVICES_MULTIQUEUE under Drivers.
+The PRIO qdisc naturally plugs into a multiqueue device.  If
+NETDEVICES_MULTIQUEUE is selected, then on qdisc load, the number of
+bands requested is compared to the number of queues on the hardware.  If they
 are equal, it sets a one-to-one mapping up between the queues and bands.  If
 they're not equal, it will not load the qdisc.  This is the same behavior
 for RR.  Once the association is made, any skb that is classified will have
diff --git a/Documentation/video4linux/cx2341x/fw-encoder-api.txt b/Documentation/video4linux/cx2341x/fw-encoder-api.txt
index 5dd3109a8b3f..5a27af2ee1c6 100644
--- a/Documentation/video4linux/cx2341x/fw-encoder-api.txt
+++ b/Documentation/video4linux/cx2341x/fw-encoder-api.txt
@@ -407,8 +407,10 @@ Description
                u32 length;             // Length of this frame
                u32 offset_low;         // Offset in the file of the
                u32 offset_high;        // start of this frame
-                u32 mask1;              // Bits 0-1 are the type mask:
+                u32 mask1;              // Bits 0-2 are the type mask:
                                        // 1=I, 2=P, 4=B
+                                        // 0=End of Program Index, other fields
+                                        //   are invalid.
                u32 pts;                // The PTS of the frame
                u32 mask2;              // Bit 0 is bit 32 of the pts.
        };
diff --git a/arch/arm/mach-realview/realview_eb.c b/arch/arm/mach-realview/realview_eb.c
index 3dba666151db..ecec2f85c4cd 100644
--- a/arch/arm/mach-realview/realview_eb.c
+++ b/arch/arm/mach-realview/realview_eb.c
@@ -165,7 +165,7 @@ static void __init gic_init_irq(void)
 #endif
        gic_dist_init(0, __io_address(REALVIEW_GIC_DIST_BASE), 29);
        gic_cpu_init(0, __io_address(REALVIEW_GIC_CPU_BASE));
-#ifdef CONFIG_REALVIEW_MPCORE
+#if defined(CONFIG_REALVIEW_MPCORE) && !defined(CONFIG_REALVIEW_MPCORE_REVB)
        gic_dist_init(1, __io_address(REALVIEW_GIC1_DIST_BASE), 64);
        gic_cpu_init(1, __io_address(REALVIEW_GIC1_CPU_BASE));
        gic_cascade_irq(1, IRQ_EB_IRQ1);
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 04ddab2bd876..eea3f50743d5 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -323,6 +323,7 @@ static int __init vfp_init(void)
         * we just need to read the VFPSID register.
         */
        vfp_vector = vfp_testing_entry;
+        barrier();
        vfpsid = fmrx(FPSID);
        barrier();
        vfp_vector = vfp_null_entry;
diff --git a/arch/h8300/Kconfig.debug b/arch/h8300/Kconfig.debug
index 554efe604a08..996d97e953b0 100644
--- a/arch/h8300/Kconfig.debug
+++ b/arch/h8300/Kconfig.debug
@@ -59,7 +59,7 @@ config BLKDEV_RESERVE
        help
          Reserved BLKDEV area.
-config CONFIG_BLKDEV_RESERVE_ADDRESS
+config BLKDEV_RESERVE_ADDRESS
        hex 'start address'
        depends on BLKDEV_RESERVE
        help
diff --git a/arch/i386/kernel/cpu/intel_cacheinfo.c b/arch/i386/kernel/cpu/intel_cacheinfo.c
index d5a456d27d82..db6c25aa5776 100644
--- a/arch/i386/kernel/cpu/intel_cacheinfo.c
+++ b/arch/i386/kernel/cpu/intel_cacheinfo.c
@@ -515,7 +515,7 @@ static int __cpuinit detect_cache_attributes(unsigned int cpu)
        cpuid4_info[cpu] = kzalloc(
            sizeof(struct _cpuid4_info) * num_cache_leaves, GFP_KERNEL);
-        if (unlikely(cpuid4_info[cpu] == NULL))
+        if (cpuid4_info[cpu] == NULL)
                return -ENOMEM;
        oldmask = current->cpus_allowed;
@@ -748,6 +748,8 @@ static void __cpuinit cache_remove_dev(struct sys_device * sys_dev)
        unsigned int cpu = sys_dev->id;
        unsigned long i;
+        if (cpuid4_info[cpu] == NULL)
+                return;
        for (i = 0; i < num_cache_leaves; i++) {
                cache_remove_shared_cpu_map(cpu, i);
                kobject_unregister(&(INDEX_KOBJECT_PTR(cpu,i)->kobj));
diff --git a/arch/i386/mach-generic/Makefile b/arch/i386/mach-generic/Makefile
index 77fbc9f64fbc..6914485c0d85 100644
--- a/arch/i386/mach-generic/Makefile
+++ b/arch/i386/mach-generic/Makefile
@@ -2,6 +2,6 @@
 # Makefile for the generic architecture
 #
-EXTRA_CFLAGS    += -I../kernel
+EXTRA_CFLAGS    := -Iarch/i386/kernel
 obj-y                           := probe.o summit.o bigsmp.o es7000.o default.o ../mach-es7000/
diff --git a/arch/i386/mach-voyager/Makefile b/arch/i386/mach-voyager/Makefile
index f24d29651318..33b74cf0dd22 100644
--- a/arch/i386/mach-voyager/Makefile
+++ b/arch/i386/mach-voyager/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the linux kernel.
 #
-EXTRA_CFLAGS    += -I../kernel
+EXTRA_CFLAGS    := -Iarch/i386/kernel
 obj-y                   := setup.o voyager_basic.o voyager_thread.o
 obj-$(CONFIG_SMP)       += voyager_smp.o voyager_cat.o
diff --git a/arch/i386/mm/highmem.c b/arch/i386/mm/highmem.c
index ad8d86cc683e..1c3bf95f7356 100644
--- a/arch/i386/mm/highmem.c
+++ b/arch/i386/mm/highmem.c
@@ -34,17 +34,16 @@ void *kmap_atomic_prot(struct page *page, enum km_type type, pgprot_t prot)
        /* even !CONFIG_PREEMPT needs this, for in_atomic in do_page_fault */
        pagefault_disable();
-        idx = type + KM_TYPE_NR*smp_processor_id();
-        BUG_ON(!pte_none(*(kmap_pte-idx)));
        if (!PageHighMem(page))
                return page_address(page);
+        idx = type + KM_TYPE_NR*smp_processor_id();
        vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+        BUG_ON(!pte_none(*(kmap_pte-idx)));
        set_pte(kmap_pte-idx, mk_pte(page, prot));
        arch_flush_lazy_mmu_mode();
-        return (void*) vaddr;
+        return (void *)vaddr;
 }
 void *kmap_atomic(struct page *page, enum km_type type)
diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
index 665db063a40a..8434f2323b87 100644
--- a/arch/i386/pci/irq.c
+++ b/arch/i386/pci/irq.c
@@ -550,6 +550,7 @@ static __init int intel_router_probe(struct irq_router *r, struct pci_dev *route
                case PCI_DEVICE_ID_INTEL_ICH9_3:
                case PCI_DEVICE_ID_INTEL_ICH9_4:
                case PCI_DEVICE_ID_INTEL_ICH9_5:
+                case PCI_DEVICE_ID_INTEL_TOLAPAI_0:
                        r->name = "PIIX/ICH";
                        r->get = pirq_piix_get;
                        r->set = pirq_piix_set;
diff --git a/arch/i386/pci/pcbios.c b/arch/i386/pci/pcbios.c
index 5f5193401bea..10ac8c316c46 100644
--- a/arch/i386/pci/pcbios.c
+++ b/arch/i386/pci/pcbios.c
@@ -412,7 +412,7 @@ struct irq_routing_options {
        u16 segment;
 } __attribute__((packed));
-struct irq_routing_table * __devinit pcibios_get_irq_routing_table(void)
+struct irq_routing_table * pcibios_get_irq_routing_table(void)
 {
        struct irq_routing_options opt;
        struct irq_routing_table *rt = NULL;
diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
index e162ee685d20..918f5dbeaef6 100644
--- a/arch/m68k/kernel/entry.S
+++ b/arch/m68k/kernel/entry.S
@@ -735,4 +735,14 @@ sys_call_table:
        .long sys_tee
        .long sys_vmsplice
        .long sys_move_pages            /* 310 */
+        .long sys_sched_setaffinity
+        .long sys_sched_getaffinity
+        .long sys_kexec_load
+        .long sys_getcpu
+        .long sys_epoll_pwait           /* 315 */
+        .long sys_utimensat
+        .long sys_signalfd
+        .long sys_timerfd
+        .long sys_eventfd
+        .long sys_fallocate             /* 320 */
diff --git a/arch/m68knommu/kernel/syscalltable.S b/arch/m68knommu/kernel/syscalltable.S
index 4603f4f3c935..9620093514bc 100644
--- a/arch/m68knommu/kernel/syscalltable.S
+++ b/arch/m68knommu/kernel/syscalltable.S
@@ -329,6 +329,16 @@ ENTRY(sys_call_table)
        .long sys_tee
        .long sys_vmsplice
        .long sys_move_pages            /* 310 */
+        .long sys_sched_setaffinity
+        .long sys_sched_getaffinity
+        .long sys_kexec_load
+        .long sys_getcpu
+        .long sys_epoll_pwait           /* 315 */
+        .long sys_utimensat
+        .long sys_signalfd
+        .long sys_timerfd
+        .long sys_eventfd
+        .long sys_fallocate             /* 320 */
        .rept NR_syscalls-(.-sys_call_table)/4
                .long sys_ni_syscall
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 06448a9656dc..3e004161ebd5 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -199,7 +199,14 @@ static inline void check_wait(void)
                if ((c->processor_id & 0xff) <= 0x64)
                        break;
-                cpu_wait = r4k_wait;
+                /*
+                 * Another rev is incremeting c0_count at a reduced clock
+                 * rate while in WAIT mode.  So we basically have the choice
+                 * between using the cp0 timer as clocksource or avoiding
+                 * the WAIT instruction.  Until more details are known,
+                 * disable the use of WAIT for 20Kc entirely.
+                   cpu_wait = r4k_wait;
+                 */
                break;
        case CPU_RM9000:
                if ((c->processor_id & 0x00ff) >= 0x40)
diff --git a/arch/mips/kernel/rtlx.c b/arch/mips/kernel/rtlx.c
index aab89e97abb5..1ba00c15505b 100644
--- a/arch/mips/kernel/rtlx.c
+++ b/arch/mips/kernel/rtlx.c
@@ -56,8 +56,6 @@ static struct chan_waitqueues {
        struct mutex mutex;
 } channel_wqs[RTLX_CHANNELS];
-static struct irqaction irq;
-static int irq_num;
 static struct vpe_notifications notify;
 static int sp_stopping = 0;
@@ -111,7 +109,7 @@ static void __used dump_rtlx(void)
 static int rtlx_init(struct rtlx_info *rtlxi)
 {
        if (rtlxi->id != RTLX_ID) {
-                printk(KERN_ERR "no valid RTLX id at 0x%p 0x%x\n", rtlxi, rtlxi->id);
+                printk(KERN_ERR "no valid RTLX id at 0x%p 0x%lx\n", rtlxi, rtlxi->id);
                return -ENOEXEC;
        }
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 53d7a977193c..118be24224f2 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -375,7 +375,7 @@ EXPORT(sysn32_call_table)
        PTR     sys_mkdirat
        PTR     sys_mknodat
        PTR     sys_fchownat
-        PTR     sys_futimesat                   /* 6255 */
+        PTR     compat_sys_futimesat            /* 6255 */
        PTR     sys_newfstatat
        PTR     sys_unlinkat
        PTR     sys_renameat
diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
index d48d1d5bea0a..9a5596bf8571 100644
--- a/arch/mips/kernel/time.c
+++ b/arch/mips/kernel/time.c
@@ -16,6 +16,7 @@
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/param.h>
+#include <linux/profile.h>
 #include <linux/time.h>
 #include <linux/timex.h>
 #include <linux/smp.h>
diff --git a/arch/mips/mips-boards/malta/malta_int.c b/arch/mips/mips-boards/malta/malta_int.c
index 97aeb8c4e601..b73f21823c5e 100644
--- a/arch/mips/mips-boards/malta/malta_int.c
+++ b/arch/mips/mips-boards/malta/malta_int.c
@@ -256,7 +256,7 @@ asmlinkage void plat_irq_dispatch(void)
        if (irq == MIPSCPU_INT_I8259A)
                malta_hw0_irqdispatch();
-        else if (irq > 0)
+        else if (irq >= 0)
                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
        else
                spurious_interrupt();
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index 09d91505b90c..5240432e6d1d 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -8,6 +8,7 @@
 * Kevin D. Kissell, kevink@mips.com and Carsten Langgaard, carstenl@mips.com
 * Copyright (C) 2000 MIPS Technologies, Inc.  All rights reserved.
 */
+#include <linux/bug.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/signal.h>
@@ -132,6 +133,8 @@ void *kmap_coherent(struct page *page, unsigned long addr)
        pte_t pte;
        int tlbidx;
+        BUG_ON(Page_dcache_dirty(page));
        inc_preempt_count();
        idx = (addr >> PAGE_SHIFT) & (FIX_N_COLOURS - 1);
 #ifdef CONFIG_MIPS_MT_SMTC
@@ -208,7 +211,7 @@ void copy_user_highpage(struct page *to, struct page *from,
        void *vfrom, *vto;
        vto = kmap_atomic(to, KM_USER1);
-        if (cpu_has_dc_aliases) {
+        if (cpu_has_dc_aliases && !Page_dcache_dirty(from)) {
                vfrom = kmap_coherent(from, vaddr);
                copy_page(vto, vfrom);
                kunmap_coherent();
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 9cb39644b6f1..6c425b052442 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -58,6 +58,21 @@ static __init int __maybe_unused r10000_llsc_war(void)
 }
 /*
+ * Found by experiment: At least some revisions of the 4kc throw under
+ * some circumstances a machine check exception, triggered by invalid
+ * values in the index register.  Delaying the tlbp instruction until
+ * after the next branch,  plus adding an additional nop in front of
+ * tlbwi/tlbwr avoids the invalid index register values. Nobody knows
+ * why; it's not an issue caused by the core RTL.
+ *
+ */
+static __init int __attribute__((unused)) m4kc_tlbp_war(void)
+{
+        return (current_cpu_data.processor_id & 0xffff00) ==
+               (PRID_COMP_MIPS | PRID_IMP_4KC);
+}
+/*
 * A little micro-assembler, intended for TLB refill handler
 * synthesizing. It is intentionally kept simple, does only support
 * a subset of instructions, and does not try to hide pipeline effects
@@ -894,6 +909,8 @@ static __init void build_tlb_write_entry(u32 **p, struct label **l,
        case CPU_20KC:
        case CPU_25KF:
        case CPU_LOONGSON2:
+                if (m4kc_tlbp_war())
+                        i_nop(p);
                tlbw(p);
                break;
@@ -1705,7 +1722,8 @@ build_r4000_tlbchange_handler_head(u32 **p, struct label **l,
        l_smp_pgtable_change(l, *p);
 # endif
        iPTE_LW(p, l, pte, ptr); /* get even pte */
-        build_tlb_probe_entry(p);
+        if (!m4kc_tlbp_war())
+                build_tlb_probe_entry(p);
 }
 static void __init
@@ -1747,6 +1765,8 @@ static void __init build_r4000_tlb_load_handler(void)
        build_r4000_tlbchange_handler_head(&p, &l, &r, K0, K1);
        build_pte_present(&p, &l, &r, K0, K1, label_nopage_tlbl);
+        if (m4kc_tlbp_war())
+                build_tlb_probe_entry(&p);
        build_make_valid(&p, &r, K0, K1);
        build_r4000_tlbchange_handler_tail(&p, &l, &r, K0, K1);
@@ -1781,6 +1801,8 @@ static void __init build_r4000_tlb_store_handler(void)
        build_r4000_tlbchange_handler_head(&p, &l, &r, K0, K1);
        build_pte_writable(&p, &l, &r, K0, K1, label_nopage_tlbs);
+        if (m4kc_tlbp_war())
+                build_tlb_probe_entry(&p);
        build_make_write(&p, &r, K0, K1);
        build_r4000_tlbchange_handler_tail(&p, &l, &r, K0, K1);
@@ -1815,6 +1837,8 @@ static void __init build_r4000_tlb_modify_handler(void)
        build_r4000_tlbchange_handler_head(&p, &l, &r, K0, K1);
        build_pte_modifiable(&p, &l, &r, K0, K1, label_nopage_tlbm);
+        if (m4kc_tlbp_war())
+                build_tlb_probe_entry(&p);
        /* Present and writable bits set, set accessed and dirty bits. */
        build_make_write(&p, &r, K0, K1);
        build_r4000_tlbchange_handler_tail(&p, &l, &r, K0, K1);
diff --git a/arch/mips/sgi-ip22/ip22-platform.c b/arch/mips/sgi-ip22/ip22-platform.c
index 78b608d2d4e1..28ffec8e5d1a 100644
--- a/arch/mips/sgi-ip22/ip22-platform.c
+++ b/arch/mips/sgi-ip22/ip22-platform.c
@@ -150,8 +150,8 @@ static int __init sgiseeq_devinit(void)
                return res;
        /* Second HPC is missing? */
-        if (ip22_is_fullhouse() ||
+        if (!ip22_is_fullhouse() ||
-            !get_dbe(tmp, (unsigned int *)&hpc3c1->pbdma[1]))
+            get_dbe(tmp, (unsigned int *)&hpc3c1->pbdma[1]))
                return 0;
        sgimc->giopar |= SGIMC_GIOPAR_MASTEREXP1 | SGIMC_GIOPAR_EXP164 |
diff --git a/arch/mips/sgi-ip22/ip22-time.c b/arch/mips/sgi-ip22/ip22-time.c
index 8e88a442b22a..de3d01823ad5 100644
--- a/arch/mips/sgi-ip22/ip22-time.c
+++ b/arch/mips/sgi-ip22/ip22-time.c
@@ -114,8 +114,8 @@ static unsigned long dosample(void)
        } while (msb);
        /* Stop the counter. */
-        writeb(sgint->tcword, (SGINT_TCWORD_CNT2 | SGINT_TCWORD_CALL |
+        writeb(SGINT_TCWORD_CNT2 | SGINT_TCWORD_CALL | SGINT_TCWORD_MSWST,
-                               SGINT_TCWORD_MSWST));
+               &sgint->tcword);
        /*
         * Return the difference, this is how far the r4k counter increments
         * for every 1/HZ seconds. We round off the nearest 1 MHz of master
diff --git a/arch/powerpc/kernel/legacy_serial.c b/arch/powerpc/kernel/legacy_serial.c
index cea8045ba40b..90fa11c72e1c 100644
--- a/arch/powerpc/kernel/legacy_serial.c
+++ b/arch/powerpc/kernel/legacy_serial.c
@@ -493,7 +493,7 @@ static int __init serial_dev_init(void)
        return platform_device_register(&serial_device);
 }
-arch_initcall(serial_dev_init);
+device_initcall(serial_dev_init);
 /*
diff --git a/arch/powerpc/platforms/85xx/mpc8544_ds.c b/arch/powerpc/platforms/85xx/mpc8544_ds.c
index 0f834d8be444..48983bc56d46 100644
--- a/arch/powerpc/platforms/85xx/mpc8544_ds.c
+++ b/arch/powerpc/platforms/85xx/mpc8544_ds.c
@@ -178,7 +178,9 @@ define_machine(mpc8544_ds) {
        .probe                  = mpc8544_ds_probe,
        .setup_arch             = mpc8544_ds_setup_arch,
        .init_IRQ               = mpc8544_ds_pic_init,
+#ifdef CONFIG_PCI
        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
+#endif
        .get_irq                = mpic_get_irq,
        .restart                = mpc85xx_restart,
        .calibrate_decr         = generic_calibrate_decr,
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_cds.c b/arch/powerpc/platforms/85xx/mpc85xx_cds.c
index 6a171e9abf7d..2d4cb7847604 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_cds.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_cds.c
@@ -351,10 +351,10 @@ define_machine(mpc85xx_cds) {
        .get_irq        = mpic_get_irq,
 #ifdef CONFIG_PCI
        .restart        = mpc85xx_cds_restart,
+        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
 #else
        .restart        = mpc85xx_restart,
 #endif
        .calibrate_decr = generic_calibrate_decr,
        .progress       = udbg_progress,
-        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
 };
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_mds.c b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
index be25ecd911ba..7ca7e676f1c4 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_mds.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
@@ -207,5 +207,7 @@ define_machine(mpc85xx_mds) {
        .restart        = mpc85xx_restart,
        .calibrate_decr = generic_calibrate_decr,
        .progress       = udbg_progress,
+#ifdef CONFIG_PCI
        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
+#endif
 };
diff --git a/arch/powerpc/platforms/86xx/mpc86xx_hpcn.c b/arch/powerpc/platforms/86xx/mpc86xx_hpcn.c
index 56b27caf7a27..47aafa76c933 100644
--- a/arch/powerpc/platforms/86xx/mpc86xx_hpcn.c
+++ b/arch/powerpc/platforms/86xx/mpc86xx_hpcn.c
@@ -250,5 +250,7 @@ define_machine(mpc86xx_hpcn) {
        .time_init              = mpc86xx_time_init,
        .calibrate_decr         = generic_calibrate_decr,
        .progress               = udbg_progress,
+#ifdef CONFIG_PCI
        .pcibios_fixup_bus      = fsl_pcibios_fixup_bus,
+#endif
 };
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index cfc249741592..19d4628edf79 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -285,6 +285,7 @@ config AXON_RAM
 config FSL_ULI1575
        bool
        default n
+        select GENERIC_ISA_DMA
        help
          Supports for the ULI1575 PCIe south bridge that exists on some
          Freescale reference boards. The boards all use the ULI in pretty
diff --git a/arch/powerpc/sysdev/cpm2_common.c b/arch/powerpc/sysdev/cpm2_common.c
index 924412974795..c827715a5090 100644
--- a/arch/powerpc/sysdev/cpm2_common.c
+++ b/arch/powerpc/sysdev/cpm2_common.c
@@ -102,7 +102,7 @@ cpm_setbrg(uint brg, uint rate)
                brg -= 4;
        }
        bp += brg;
-        *bp = ((BRG_UART_CLK / rate) << 1) | CPM_BRG_EN;
+        out_be32(bp, (((BRG_UART_CLK / rate) - 1) << 1) | CPM_BRG_EN);
        cpm2_unmap(bp);
 }
diff --git a/arch/ppc/kernel/head_8xx.S b/arch/ppc/kernel/head_8xx.S
index 944c35c24278..eb8d26f87362 100644
--- a/arch/ppc/kernel/head_8xx.S
+++ b/arch/ppc/kernel/head_8xx.S
@@ -495,9 +495,7 @@ LoadLargeDTLB:
        lwz     r11, 4(r0)
        lwz     r12, 16(r0)
-#ifdef CONFIG_8xx_CPU6
        lwz     r3, 8(r0)
-#endif
        rfi
 /* This is the data TLB error on the MPC8xx.  This could be due to
diff --git a/arch/sparc64/kernel/pci.c b/arch/sparc64/kernel/pci.c
index 139b4cff8019..e8dac81d8a0d 100644
--- a/arch/sparc64/kernel/pci.c
+++ b/arch/sparc64/kernel/pci.c
@@ -744,7 +744,7 @@ static void __devinit pci_of_scan_bus(struct pci_pbm_info *pbm,
 {
        struct device_node *child;
        const u32 *reg;
-        int reglen, devfn;
+        int reglen, devfn, prev_devfn;
        struct pci_dev *dev;
        if (ofpci_verbose)
@@ -752,14 +752,25 @@ static void __devinit pci_of_scan_bus(struct pci_pbm_info *pbm,
                       node->full_name, bus->number);
        child = NULL;
+        prev_devfn = -1;
        while ((child = of_get_next_child(node, child)) != NULL) {
                if (ofpci_verbose)
                        printk("  * %s\n", child->full_name);
                reg = of_get_property(child, "reg", &reglen);
                if (reg == NULL || reglen < 20)
                        continue;
                devfn = (reg[0] >> 8) & 0xff;
+                /* This is a workaround for some device trees
+                 * which list PCI devices twice.  On the V100
+                 * for example, device number 3 is listed twice.
+                 * Once as "pm" and once again as "lomp".
+                 */
+                if (devfn == prev_devfn)
+                        continue;
+                prev_devfn = devfn;
                /* create a new pci_dev for this device */
                dev = of_create_pci_dev(pbm, child, bus, devfn, 0);
                if (!dev)
diff --git a/arch/x86_64/vdso/vclock_gettime.c b/arch/x86_64/vdso/vclock_gettime.c
index 17f6a00de712..5b54cdfb2b07 100644
--- a/arch/x86_64/vdso/vclock_gettime.c
+++ b/arch/x86_64/vdso/vclock_gettime.c
@@ -34,10 +34,11 @@ static long vdso_fallback_gettime(long clock, struct timespec *ts)
 static inline long vgetns(void)
 {
+        long v;
        cycles_t (*vread)(void);
        vread = gtod->clock.vread;
-        return ((vread() - gtod->clock.cycle_last) * gtod->clock.mult) >>
+        v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
-                gtod->clock.shift;
+        return (v * gtod->clock.mult) >> gtod->clock.shift;
 }
 static noinline int do_realtime(struct timespec *ts)
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index a15845c164f2..ed39313c4085 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -1075,12 +1075,6 @@ void blk_queue_end_tag(struct request_queue *q, struct request *rq)
                 */
                return;
-        if (unlikely(!__test_and_clear_bit(tag, bqt->tag_map))) {
-                printk(KERN_ERR "%s: attempt to clear non-busy tag (%d)\n",
-                       __FUNCTION__, tag);
-                return;
-        }
        list_del_init(&rq->queuelist);
        rq->cmd_flags &= ~REQ_QUEUED;
        rq->tag = -1;
@@ -1090,6 +1084,19 @@ void blk_queue_end_tag(struct request_queue *q, struct request *rq)
                       __FUNCTION__, tag);
        bqt->tag_index[tag] = NULL;
+        /*
+         * We use test_and_clear_bit's memory ordering properties here.
+         * The tag_map bit acts as a lock for tag_index[bit], so we need
+         * a barrer before clearing the bit (precisely: release semantics).
+         * Could use clear_bit_unlock when it is merged.
+         */
+        if (unlikely(!test_and_clear_bit(tag, bqt->tag_map))) {
+                printk(KERN_ERR "%s: attempt to clear non-busy tag (%d)\n",
+                       __FUNCTION__, tag);
+                return;
+        }
        bqt->busy--;
 }
@@ -1136,6 +1143,10 @@ int blk_queue_start_tag(struct request_queue *q, struct request *rq)
                        return 1;
        } while (test_and_set_bit(tag, bqt->tag_map));
+        /*
+         * We rely on test_and_set_bit providing lock memory ordering semantics
+         * (could use test_and_set_bit_lock when it is merged).
+         */
        rq->cmd_flags |= REQ_QUEUED;
        rq->tag = tag;
diff --git a/drivers/ata/pata_ali.c b/drivers/ata/pata_ali.c
index 94e5edc12ac9..71bdc3b3189c 100644
--- a/drivers/ata/pata_ali.c
+++ b/drivers/ata/pata_ali.c
@@ -48,6 +48,13 @@ static struct dmi_system_id cable_dmi_table[] = {
                        DMI_MATCH(DMI_BOARD_VERSION, "OmniBook N32N-736"),
                },
        },
+        {
+                .ident = "Toshiba Satelite S1800-814",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "S1800-814"),
+                },
+        },
        { }
 };
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 92bf868ca056..504a95d888b2 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -17,8 +17,8 @@
 */
-#define DAC960_DriverVersion                    "2.5.48"
+#define DAC960_DriverVersion                    "2.5.49"
-#define DAC960_DriverDate                       "14 May 2006"
+#define DAC960_DriverDate                       "21 Aug 2007"
 #include <linux/module.h>
@@ -1165,9 +1165,9 @@ static bool DAC960_V1_EnableMemoryMailboxInterface(DAC960_Controller_T
  int i;
  
-  if (pci_set_dma_mask(Controller->PCIDevice, DAC690_V1_PciDmaMask))
+  if (pci_set_dma_mask(Controller->PCIDevice, DMA_32BIT_MASK))
        return DAC960_Failure(Controller, "DMA mask out of range");
-  Controller->BounceBufferLimit = DAC690_V1_PciDmaMask;
+  Controller->BounceBufferLimit = DMA_32BIT_MASK;
  if ((hw_type == DAC960_PD_Controller) || (hw_type == DAC960_P_Controller)) {
    CommandMailboxesSize =  0;
@@ -1368,9 +1368,12 @@ static bool DAC960_V2_EnableMemoryMailboxInterface(DAC960_Controller_T
  dma_addr_t    CommandMailboxDMA;
  DAC960_V2_CommandStatus_T CommandStatus;
-  if (pci_set_dma_mask(Controller->PCIDevice, DAC690_V2_PciDmaMask))
+        if (!pci_set_dma_mask(Controller->PCIDevice, DMA_64BIT_MASK))
-        return DAC960_Failure(Controller, "DMA mask out of range");
+                Controller->BounceBufferLimit = DMA_64BIT_MASK;
-  Controller->BounceBufferLimit = DAC690_V2_PciDmaMask;
+        else if (!pci_set_dma_mask(Controller->PCIDevice, DMA_32BIT_MASK))
+                Controller->BounceBufferLimit = DMA_32BIT_MASK;
+        else
+                return DAC960_Failure(Controller, "DMA mask out of range");
  /* This is a temporary dma mapping, used only in the scope of this function */
  CommandMailbox = pci_alloc_consistent(PCI_Device,
diff --git a/drivers/block/DAC960.h b/drivers/block/DAC960.h
index f5e2436c39aa..85fa9bb63759 100644
--- a/drivers/block/DAC960.h
+++ b/drivers/block/DAC960.h
@@ -61,13 +61,6 @@
 #define DAC960_V2_MaxPhysicalDevices            272
 /*
-  Define the pci dma mask supported by DAC960 V1 and V2 Firmware Controlers
- */
-#define DAC690_V1_PciDmaMask    0xffffffff
-#define DAC690_V2_PciDmaMask    0xffffffffffffffffULL
-/*
  Define a 32/64 bit I/O Address data type.
 */
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 59b054810ed0..98a9cdeaffb6 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -691,15 +691,18 @@ static void hci_usb_rx_complete(struct urb *urb)
                                        urb->iso_frame_desc[i].offset,
                                        urb->iso_frame_desc[i].actual_length);
        
-                        if (!urb->iso_frame_desc[i].status)
+                        if (!urb->iso_frame_desc[i].status) {
+                                husb->hdev->stat.byte_rx += urb->iso_frame_desc[i].actual_length;
                                hci_recv_fragment(husb->hdev, _urb->type, 
                                        urb->transfer_buffer + urb->iso_frame_desc[i].offset,
                                        urb->iso_frame_desc[i].actual_length);
+                        }
                }
 #else
                ;
 #endif
        } else {
+                husb->hdev->stat.byte_rx += count;
                err = hci_recv_fragment(husb->hdev, _urb->type, urb->transfer_buffer, count);
                if (err < 0) { 
                        BT_ERR("%s corrupted packet: type %d count %d",
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 2c9ca2c64628..7c69bf259caa 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -506,6 +506,11 @@ static void intel_i830_init_gtt_entries(void)
                        break;
                }
        } else {
+                /* G33's GTT stolen memory is separate from gfx data
+                 * stolen memory.
+                 */
+                if (IS_G33)
+                        size = 0;
                switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
                case I855_GMCH_GMS_STOLEN_1M:
                        gtt_entries = MB(1) - KB(size);
@@ -914,6 +919,7 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
        struct aper_size_info_fixed *size;
        int num_entries;
        u32 temp, temp2;
+        int gtt_map_size = 256 * 1024;
        size = agp_bridge->current_size;
        page_order = size->page_order;
@@ -923,7 +929,9 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
        pci_read_config_dword(intel_private.pcidev, I915_MMADDR, &temp);
        pci_read_config_dword(intel_private.pcidev, I915_PTEADDR,&temp2);
-        intel_private.gtt = ioremap(temp2, 256 * 1024);
+        if (IS_G33)
+            gtt_map_size = 1024 * 1024; /* 1M on G33 */
+        intel_private.gtt = ioremap(temp2, gtt_map_size);
        if (!intel_private.gtt)
                return -ENOMEM;
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index 3423e9ee6481..4a8969cef315 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -796,14 +796,14 @@ int n_tty_ioctl(struct tty_struct * tty, struct file * file,
                                retval = inq_canon(tty);
                        return put_user(retval, (unsigned int __user *) arg);
                case TIOCGLCKTRMIOS:
-                        if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked))
+                        if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios_locked))
                                return -EFAULT;
                        return 0;
                case TIOCSLCKTRMIOS:
                        if (!capable(CAP_SYS_ADMIN))
                                return -EPERM;
-                        if (user_termios_to_kernel_termios(real_tty->termios_locked, (struct termios __user *) arg))
+                        if (user_termios_to_kernel_termios_1(real_tty->termios_locked, (struct termios __user *) arg))
                                return -EFAULT;
                        return 0;
diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
index 3bba224cb55d..6eb434749cd5 100644
--- a/drivers/edac/e752x_edac.c
+++ b/drivers/edac/e752x_edac.c
@@ -967,7 +967,7 @@ static int e752x_probe1(struct pci_dev *pdev, int dev_idx)
        if (!force_function_unhide && !(stat8 & (1 << 5))) {
                printk(KERN_INFO "Contact your BIOS vendor to see if the "
                        "E752x error registers can be safely un-hidden\n");
-                return -ENOMEM;
+                return -ENODEV;
        }
        stat8 |= (1 << 5);
        pci_write_config_byte(pdev, E752X_DEVPRES1, stat8);
diff --git a/drivers/edac/edac_core.h b/drivers/edac/edac_core.h
index 4e6bad15c4ba..e80af67664cc 100644
--- a/drivers/edac/edac_core.h
+++ b/drivers/edac/edac_core.h
@@ -75,7 +75,7 @@ extern int edac_debug_level;
 #define edac_debug_printk(level, fmt, arg...)                            \
        do {                                                             \
                if (level <= edac_debug_level)                           \
-                        edac_printk(KERN_EMERG, EDAC_DEBUG, fmt, ##arg); \
+                        edac_printk(KERN_DEBUG, EDAC_DEBUG, fmt, ##arg); \
        } while(0)
 #define debugf0( ... ) edac_debug_printk(0, __VA_ARGS__ )
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 7adb61bad6ad..4200251ff635 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -781,7 +781,7 @@ endif
 config BLK_DEV_IDE_PMAC
        bool "Builtin PowerMac IDE support"
-        depends on PPC_PMAC && IDE=y
+        depends on PPC_PMAC && IDE=y && BLK_DEV_IDE=y
        help
          This driver provides support for the built-in IDE controller on
          most of the recent Apple Power Macintoshes and PowerBooks.
@@ -946,7 +946,7 @@ config BLK_DEV_Q40IDE
 config BLK_DEV_MPC8xx_IDE
        bool "MPC8xx IDE support"
-        depends on 8xx && IDE=y && BLK_DEV_IDE=y
+        depends on 8xx && IDE=y && BLK_DEV_IDE=y && !PPC_MERGE
        select IDE_GENERIC
        help
          This option provides support for IDE on Motorola MPC8xx Systems.
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index f4cd2700cae5..646a54e233d3 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -615,8 +615,7 @@ u8 eighty_ninty_three (ide_drive_t *drive)
        if (hwif->cbl != ATA_CBL_PATA80 && !ivb)
                goto no_80w;
-        /* Check for SATA but only if we are ATA5 or higher */
+        if (ide_dev_is_sata(id))
-        if (id->hw_config == 0 && (id->major_rev_num & 0x7FE0))
                return 1;
        /*
diff --git a/drivers/ide/pci/alim15x3.c b/drivers/ide/pci/alim15x3.c
index 025689de50e9..11ecb618007c 100644
--- a/drivers/ide/pci/alim15x3.c
+++ b/drivers/ide/pci/alim15x3.c
@@ -596,6 +596,13 @@ static struct dmi_system_id cable_dmi_table[] = {
                        DMI_MATCH(DMI_BOARD_VERSION, "OmniBook N32N-736"),
                },
        },
+        {
+                .ident = "Toshiba Satellite S1800-814",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "S1800-814"),
+                },
+        },
        { }
 };
diff --git a/drivers/ide/pci/hpt366.c b/drivers/ide/pci/hpt366.c
index 2cd74c345a6c..39f1c89f7c86 100644
--- a/drivers/ide/pci/hpt366.c
+++ b/drivers/ide/pci/hpt366.c
@@ -1,5 +1,5 @@
 /*
- * linux/drivers/ide/pci/hpt366.c               Version 1.10    Jun 29, 2007
+ * linux/drivers/ide/pci/hpt366.c               Version 1.12    Aug 19, 2007
 *
 * Copyright (C) 1999-2003              Andre Hedrick <andre@linux-ide.org>
 * Portions Copyright (C) 2001          Sun Microsystems, Inc.
@@ -68,7 +68,8 @@
 *   HPT37x chip family; save space by introducing the separate transfer mode
 *   table in which the mode lookup is done
 * - use f_CNT value saved by  the HighPoint BIOS as reading it directly gives
- *   the wrong PCI frequency since DPLL has already been calibrated by BIOS
+ *   the wrong PCI frequency since DPLL has already been calibrated by BIOS;
+ *   read it only from the function 0 of HPT374 chips
 * - fix the hotswap code:  it caused RESET- to glitch when tristating the bus,
 *   and for HPT36x the obsolete HDIO_TRISTATE_HWIF handler was called instead
 * - pass to init_chipset() handlers a copy of the IDE PCI device structure as
@@ -113,6 +114,7 @@
 *   unify HPT36x/37x timing setup code and the speedproc handlers by joining
 *   the register setting lists into the table indexed by the clock selected
 * - set the correct hwif->ultra_mask for each individual chip
+ * - add UltraDMA mode filtering for the HPT37[24] based SATA cards
 *      Sergei Shtylyov, <sshtylyov@ru.mvista.com> or <source@mvista.com>
 */
@@ -517,42 +519,44 @@ static int check_in_drive_list(ide_drive_t *drive, const char **list)
 }
 /*
- *      Note for the future; the SATA hpt37x we must set
+ * The Marvell bridge chips used on the HighPoint SATA cards do not seem
- *      either PIO or UDMA modes 0,4,5
+ * to support the UltraDMA modes 1, 2, and 3 as well as any MWDMA modes...
 */
 static u8 hpt3xx_udma_filter(ide_drive_t *drive)
 {
-        struct hpt_info *info   = pci_get_drvdata(HWIF(drive)->pci_dev);
+        ide_hwif_t *hwif        = HWIF(drive);
-        u8 mask;
+        struct hpt_info *info   = pci_get_drvdata(hwif->pci_dev);
+        u8 mask                 = hwif->ultra_mask;
        switch (info->chip_type) {
-        case HPT370A:
-                if (!HPT370_ALLOW_ATA100_5 ||
-                    check_in_drive_list(drive, bad_ata100_5))
-                        return 0x1f;
-                else
-                        return 0x3f;
-        case HPT370:
-                if (!HPT370_ALLOW_ATA100_5 ||
-                    check_in_drive_list(drive, bad_ata100_5))
-                        mask = 0x1f;
-                else
-                        mask = 0x3f;
-                break;
        case HPT36x:
                if (!HPT366_ALLOW_ATA66_4 ||
                    check_in_drive_list(drive, bad_ata66_4))
-                        mask = 0x0f;
+                        mask = ATA_UDMA3;
-                else
-                        mask = 0x1f;
                if (!HPT366_ALLOW_ATA66_3 ||
                    check_in_drive_list(drive, bad_ata66_3))
-                        mask = 0x07;
+                        mask = ATA_UDMA2;
+                break;
+        case HPT370:
+                if (!HPT370_ALLOW_ATA100_5 ||
+                    check_in_drive_list(drive, bad_ata100_5))
+                        mask = ATA_UDMA4;
                break;
+        case HPT370A:
+                if (!HPT370_ALLOW_ATA100_5 ||
+                    check_in_drive_list(drive, bad_ata100_5))
+                        return ATA_UDMA4;
+        case HPT372 :
+        case HPT372A:
+        case HPT372N:
+        case HPT374 :
+                if (ide_dev_is_sata(drive->id))
+                        mask &= ~0x0e;
+                /* Fall thru */
        default:
-                return 0x7f;
+                return mask;
        }
        return check_in_drive_list(drive, bad_ata33) ? 0x00 : mask;
@@ -981,6 +985,7 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev, const cha
        struct hpt_info *info   = kmalloc(sizeof(struct hpt_info), GFP_KERNEL);
        unsigned long io_base   = pci_resource_start(dev, 4);
        u8 pci_clk,  dpll_clk   = 0;    /* PCI and DPLL clock in MHz */
+        u8 chip_type;
        enum ata_clock  clock;
        if (info == NULL) {
@@ -992,7 +997,8 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev, const cha
         * Copy everything from a static "template" structure
         * to just allocated per-chip hpt_info structure.
         */
-        *info = *(struct hpt_info *)pci_get_drvdata(dev);
+        memcpy(info, pci_get_drvdata(dev), sizeof(struct hpt_info));
+        chip_type = info->chip_type;
        pci_write_config_byte(dev, PCI_CACHE_LINE_SIZE, (L1_CACHE_BYTES / 4));
        pci_write_config_byte(dev, PCI_LATENCY_TIMER, 0x78);
@@ -1002,7 +1008,7 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev, const cha
        /*
         * First, try to estimate the PCI clock frequency...
         */
-        if (info->chip_type >= HPT370) {
+        if (chip_type >= HPT370) {
                u8  scr1  = 0;
                u16 f_cnt = 0;
                u32 temp  = 0;
@@ -1016,7 +1022,7 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev, const cha
                 * HighPoint does this for HPT372A.
                 * NOTE: This register is only writeable via I/O space.
                 */
-                if (info->chip_type == HPT372A)
+                if (chip_type == HPT372A)
                        outb(0x0e, io_base + 0x9c);
                /*
@@ -1034,13 +1040,28 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev, const cha
                 * First try reading the register in which the HighPoint BIOS
                 * saves f_CNT value before  reprogramming the DPLL from its
                 * default setting (which differs for the various chips).
-                 * NOTE: This register is only accessible via I/O space.
                 *
-                 * In case the signature check fails, we'll have to resort to
+                 * NOTE: This register is only accessible via I/O space;
-                 * reading the f_CNT register itself in hopes that nobody has
+                 * HPT374 BIOS only saves it for the function 0, so we have to
-                 * touched the DPLL yet...
+                 * always read it from there -- no need to check the result of
+                 * pci_get_slot() for the function 0 as the whole device has
+                 * been already "pinned" (via function 1) in init_setup_hpt374()
+                 */
+                if (chip_type == HPT374 && (PCI_FUNC(dev->devfn) & 1)) {
+                        struct pci_dev  *dev1 = pci_get_slot(dev->bus,
+                                                             dev->devfn - 1);
+                        unsigned long io_base = pci_resource_start(dev1, 4);
+                        temp =  inl(io_base + 0x90);
+                        pci_dev_put(dev1);
+                } else
+                        temp =  inl(io_base + 0x90);
+                /*
+                 * In case the signature check fails, we'll have to
+                 * resort to reading the f_CNT register itself in hopes
+                 * that nobody has touched the DPLL yet...
                 */
-                temp = inl(io_base + 0x90);
                if ((temp & 0xFFFFF000) != 0xABCDE000) {
                        int i;
@@ -1120,7 +1141,7 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev, const cha
         * We also  don't like using  the DPLL because this causes glitches
         * on PRST-/SRST- when the state engine gets reset...
         */
-        if (info->chip_type >= HPT374 || info->settings[clock] == NULL) {
+        if (chip_type >= HPT374 || info->settings[clock] == NULL) {
                u16 f_low, delta = pci_clk < 50 ? 2 : 4;
                int adjust;
@@ -1190,7 +1211,7 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev, const cha
        /* Point to this chip's own instance of the hpt_info structure. */
        pci_set_drvdata(dev, info);
-        if (info->chip_type >= HPT370) {
+        if (chip_type >= HPT370) {
                u8  mcr1, mcr4;
                /*
@@ -1209,7 +1230,7 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev, const cha
         * the MISC. register to stretch the UltraDMA Tss timing.
         * NOTE: This register is only writeable via I/O space.
         */
-        if (info->chip_type == HPT371N && clock == ATA_CLOCK_66MHZ)
+        if (chip_type == HPT371N && clock == ATA_CLOCK_66MHZ)
                outb(inb(io_base + 0x9c) | 0x04, io_base + 0x9c);
@@ -1218,25 +1239,24 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev, const cha
 static void __devinit init_hwif_hpt366(ide_hwif_t *hwif)
 {
-        struct pci_dev  *dev            = hwif->pci_dev;
+        struct pci_dev  *dev    = hwif->pci_dev;
-        struct hpt_info *info           = pci_get_drvdata(dev);
+        struct hpt_info *info   = pci_get_drvdata(dev);
-        int serialize                   = HPT_SERIALIZE_IO;
+        int serialize           = HPT_SERIALIZE_IO;
-        u8  scr1 = 0, ata66             = hwif->channel ? 0x01 : 0x02;
+        u8  scr1 = 0, ata66     = hwif->channel ? 0x01 : 0x02;
-        u8  chip_type                   = info->chip_type;
+        u8  chip_type           = info->chip_type;
-        u8  new_mcr, old_mcr            = 0;
+        u8  new_mcr, old_mcr    = 0;
        /* Cache the channel's MISC. control registers' offset */
-        hwif->select_data               = hwif->channel ? 0x54 : 0x50;
+        hwif->select_data       = hwif->channel ? 0x54 : 0x50;
-        hwif->tuneproc                  = &hpt3xx_tune_drive;
+        hwif->tuneproc          = &hpt3xx_tune_drive;
-        hwif->speedproc                 = &hpt3xx_tune_chipset;
+        hwif->speedproc         = &hpt3xx_tune_chipset;
-        hwif->quirkproc                 = &hpt3xx_quirkproc;
+        hwif->quirkproc         = &hpt3xx_quirkproc;
-        hwif->intrproc                  = &hpt3xx_intrproc;
+        hwif->intrproc          = &hpt3xx_intrproc;
-        hwif->maskproc                  = &hpt3xx_maskproc;
+        hwif->maskproc          = &hpt3xx_maskproc;
-        hwif->busproc                   = &hpt3xx_busproc;
+        hwif->busproc           = &hpt3xx_busproc;
-        if (chip_type <= HPT370A)
+        hwif->udma_filter       = &hpt3xx_udma_filter;
-                hwif->udma_filter       = &hpt3xx_udma_filter;
        /*
         * HPT3xxN chips have some complications:
@@ -1486,19 +1506,19 @@ static int __devinit init_setup_hpt366(struct pci_dev *dev, ide_pci_device_t *d)
                d->host_flags |= IDE_HFLAG_SINGLE;
                d->enablebits[0].mask = d->enablebits[0].val = 0x10;
-                d->udma_mask = HPT366_ALLOW_ATA66_3 ?
+                d->udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ?
-                              (HPT366_ALLOW_ATA66_4 ? 0x1f : 0x0f) : 0x07;
+                               ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2;
                break;
        case 3:
        case 4:
-                d->udma_mask = HPT370_ALLOW_ATA100_5 ? 0x3f : 0x1f;
+                d->udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4;
                break;
        default:
                rev = 6;
                /* fall thru */
        case 5:
        case 6:
-                d->udma_mask = HPT372_ALLOW_ATA133_6 ? 0x7f : 0x3f;
+                d->udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5;
                break;
        }
@@ -1559,7 +1579,7 @@ static ide_pci_device_t hpt366_chipsets[] __devinitdata = {
                .init_dma       = init_dma_hpt366,
                .autodma        = AUTODMA,
                .enablebits     = {{0x50,0x04,0x04}, {0x54,0x04,0x04}},
-                .udma_mask      = HPT372_ALLOW_ATA133_6 ? 0x7f : 0x3f,
+                .udma_mask      = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
                .bootable       = OFF_BOARD,
                .extra          = 240,
                .pio_mask       = ATA_PIO4,
@@ -1571,7 +1591,7 @@ static ide_pci_device_t hpt366_chipsets[] __devinitdata = {
                .init_dma       = init_dma_hpt366,
                .autodma        = AUTODMA,
                .enablebits     = {{0x50,0x04,0x04}, {0x54,0x04,0x04}},
-                .udma_mask      = HPT302_ALLOW_ATA133_6 ? 0x7f : 0x3f,
+                .udma_mask      = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
                .bootable       = OFF_BOARD,
                .extra          = 240,
                .pio_mask       = ATA_PIO4,
@@ -1583,7 +1603,7 @@ static ide_pci_device_t hpt366_chipsets[] __devinitdata = {
                .init_dma       = init_dma_hpt366,
                .autodma        = AUTODMA,
                .enablebits     = {{0x50,0x04,0x04}, {0x54,0x04,0x04}},
-                .udma_mask      = HPT371_ALLOW_ATA133_6 ? 0x7f : 0x3f,
+                .udma_mask      = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
                .bootable       = OFF_BOARD,
                .extra          = 240,
                .pio_mask       = ATA_PIO4,
@@ -1595,7 +1615,7 @@ static ide_pci_device_t hpt366_chipsets[] __devinitdata = {
                .init_dma       = init_dma_hpt366,
                .autodma        = AUTODMA,
                .enablebits     = {{0x50,0x04,0x04}, {0x54,0x04,0x04}},
-                .udma_mask      = 0x3f,
+                .udma_mask      = ATA_UDMA5,
                .bootable       = OFF_BOARD,
                .extra          = 240,
                .pio_mask       = ATA_PIO4,
@@ -1607,7 +1627,7 @@ static ide_pci_device_t hpt366_chipsets[] __devinitdata = {
                .init_dma       = init_dma_hpt366,
                .autodma        = AUTODMA,
                .enablebits     = {{0x50,0x04,0x04}, {0x54,0x04,0x04}},
-                .udma_mask      = HPT372_ALLOW_ATA133_6 ? 0x7f : 0x3f,
+                .udma_mask      = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
                .bootable       = OFF_BOARD,
                .extra          = 240,
                .pio_mask       = ATA_PIO4,
diff --git a/drivers/ide/pci/pdc202xx_new.c b/drivers/ide/pci/pdc202xx_new.c
index f6db2f37efad..7b0e479c355c 100644
--- a/drivers/ide/pci/pdc202xx_new.c
+++ b/drivers/ide/pci/pdc202xx_new.c
@@ -9,7 +9,7 @@
 *  Split from:
 *  linux/drivers/ide/pdc202xx.c        Version 0.35    Mar. 30, 2002
 *  Copyright (C) 1998-2002             Andre Hedrick <andre@linux-ide.org>
- *  Copyright (C) 2005-2006             MontaVista Software, Inc.
+ *  Copyright (C) 2005-2007             MontaVista Software, Inc.
 *  Portions Copyright (C) 1999 Promise Technology, Inc.
 *  Author: Frank Tiernan (frankt@promise.com)
 *  Released under terms of General Public License
@@ -341,7 +341,7 @@ static long __devinit detect_pll_input_clock(unsigned long dma_base)
         */
        usec_elapsed = (end_time.tv_sec - start_time.tv_sec) * 1000000 +
                (end_time.tv_usec - start_time.tv_usec);
-        pll_input = ((start_count - end_count) & 0x3ffffff) / 10 *
+        pll_input = ((start_count - end_count) & 0x3fffffff) / 10 *
                (10000000 / usec_elapsed);
        DBG("start[%ld] end[%ld]\n", start_count, end_count);
@@ -535,7 +535,7 @@ static int __devinit init_setup_pdc20270(struct pci_dev *dev,
            (dev->bus->self->device == PCI_DEVICE_ID_DEC_21150)) {
                if (PCI_SLOT(dev->devfn) & 2)
                        return -ENODEV;
-                d->extra = 0;
                while ((findev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, findev)) != NULL) {
                        if ((findev->vendor == dev->vendor) &&
                            (findev->device == dev->device) &&
@@ -544,7 +544,8 @@ static int __devinit init_setup_pdc20270(struct pci_dev *dev,
                                        findev->irq = dev->irq;
                                }
                                ret = ide_setup_pci_devices(dev, findev, d);
-                                pci_dev_put(findev);
+                                if (ret < 0)
+                                        pci_dev_put(findev);
                                return ret;
                        }
                }
diff --git a/drivers/ide/pci/via82cxxx.c b/drivers/ide/pci/via82cxxx.c
index 8c539381d622..a7be7795e6af 100644
--- a/drivers/ide/pci/via82cxxx.c
+++ b/drivers/ide/pci/via82cxxx.c
@@ -1,6 +1,6 @@
 /*
 *
- * Version 3.46
+ * Version 3.47
 *
 * VIA IDE driver for Linux. Supported southbridges:
 *
@@ -430,19 +430,26 @@ static struct dmi_system_id cable_dmi_table[] = {
        { }
 };
-static int via_cable_override(void)
+static int via_cable_override(struct pci_dev *pdev)
 {
        /* Systems by DMI */
        if (dmi_check_system(cable_dmi_table))
                return 1;
+        /* Arima W730-K8/Targa Visionary 811/... */
+        if (pdev->subsystem_vendor == 0x161F &&
+            pdev->subsystem_device == 0x2032)
+                return 1;
        return 0;
 }
 static u8 __devinit via82cxxx_cable_detect(ide_hwif_t *hwif)
 {
-        struct via82cxxx_dev *vdev = pci_get_drvdata(hwif->pci_dev);
+        struct pci_dev *pdev = hwif->pci_dev;
+        struct via82cxxx_dev *vdev = pci_get_drvdata(pdev);
-        if (via_cable_override())
+        if (via_cable_override(pdev))
                return ATA_CBL_PATA40_SHORT;
        if ((vdev->via_80w >> hwif->channel) & 1)
diff --git a/drivers/ide/ppc/mpc8xx.c b/drivers/ide/ppc/mpc8xx.c
index 8859fe2f5ac2..dab79afa9b22 100644
--- a/drivers/ide/ppc/mpc8xx.c
+++ b/drivers/ide/ppc/mpc8xx.c
@@ -32,7 +32,6 @@
 #include <asm/mpc8xx.h>
 #include <asm/mmu.h>
 #include <asm/processor.h>
-#include <asm/residual.h>
 #include <asm/io.h>
 #include <asm/pgtable.h>
 #include <asm/ide.h>
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index 30e596c0f120..1129f8c30840 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -816,19 +816,15 @@ static int __init ide_scan_pcidev(struct pci_dev *dev)
        struct list_head *l;
        struct pci_driver *d;
        
-        list_for_each(l, &ide_pci_drivers)
+        list_for_each(l, &ide_pci_drivers) {
-        {
                d = list_entry(l, struct pci_driver, node);
-                if(d->id_table)
+                if (d->id_table) {
-                {
+                        const struct pci_device_id *id = pci_match_id(d->id_table,
-                        const struct pci_device_id *id = pci_match_id(d->id_table, dev);
+                                                                      dev);
-                        if(id != NULL)
+                        if (id != NULL && d->probe(dev, id) >= 0) {
-                        {
+                                dev->driver = d;
-                                if(d->probe(dev, id) >= 0)
+                                pci_dev_get(dev);
-                                {
+                                return 1;
-                                        dev->driver = d;
-                                        return 1;
-                                }
                        }
                }
        }
@@ -851,15 +847,13 @@ void __init ide_scan_pcibus (int scan_direction)
        struct list_head *l, *n;
        pre_init = 0;
-        if (!scan_direction) {
+        if (!scan_direction)
-                while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
+                while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL)
                        ide_scan_pcidev(dev);
-                }
+        else
-        } else {
+                while ((dev = pci_get_device_reverse(PCI_ANY_ID, PCI_ANY_ID, dev))
-                while ((dev = pci_get_device_reverse(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
+                       != NULL)
                        ide_scan_pcidev(dev);
-                }
-        }
        
        /*
         *      Hand the drivers over to the PCI layer now we
@@ -869,12 +863,9 @@ void __init ide_scan_pcibus (int scan_direction)
        list_for_each_safe(l, n, &ide_pci_drivers) {
                list_del(l);
                d = list_entry(l, struct pci_driver, node);
-                if (__pci_register_driver(d, d->driver.owner,
+                if (__pci_register_driver(d, d->driver.owner, d->driver.mod_name))
-                                        d->driver.mod_name)) {
+                        printk(KERN_ERR "%s: failed to register driver for %s\n",
-                        printk(KERN_ERR "%s: failed to register driver "
+                               __FUNCTION__, d->driver.mod_name);
-                                        "for %s\n", __FUNCTION__,
-                                         d->driver.mod_name);
-                }
        }
 }
 #endif
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 702a526cf45b..f8fe42148093 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -211,6 +211,16 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
                },
        },
        {
+                /*
+                 * Like DV4017EA does not raise AUXERR for errors on MUX ports.
+                 */
+                .ident = "HP Pavilion DV4270ca",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EH476UA#ABL)"),
+                },
+        },
+        {
                .ident = "Toshiba P10",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 06b05dd22485..c2eea2767e10 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -1040,7 +1040,7 @@ static void __devinit i8042_register_ports(void)
        }
 }
-static void __devinit i8042_unregister_ports(void)
+static void __devexit i8042_unregister_ports(void)
 {
        int i;
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index b407028ffc59..741f6c6f1e50 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -767,7 +767,7 @@ static int usbtouch_probe(struct usb_interface *intf,
                         le16_to_cpu(udev->descriptor.idProduct));
        usb_make_path(udev, usbtouch->phys, sizeof(usbtouch->phys));
-        strlcpy(usbtouch->phys, "/input0", sizeof(usbtouch->phys));
+        strlcat(usbtouch->phys, "/input0", sizeof(usbtouch->phys));
        input_dev->name = usbtouch->name;
        input_dev->phys = usbtouch->phys;
diff --git a/drivers/kvm/kvm.h b/drivers/kvm/kvm.h
index 3ac9cbce3369..336be86c6f5a 100644
--- a/drivers/kvm/kvm.h
+++ b/drivers/kvm/kvm.h
@@ -619,7 +619,7 @@ unsigned long segment_base(u16 selector);
 void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
                       const u8 *old, const u8 *new, int bytes);
 int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva);
-void kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu);
+void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu);
 int kvm_mmu_load(struct kvm_vcpu *vcpu);
 void kvm_mmu_unload(struct kvm_vcpu *vcpu);
@@ -628,11 +628,15 @@ int kvm_hypercall(struct kvm_vcpu *vcpu, struct kvm_run *run);
 static inline int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t gva,
                                     u32 error_code)
 {
-        if (unlikely(vcpu->kvm->n_free_mmu_pages < KVM_MIN_FREE_MMU_PAGES))
-                kvm_mmu_free_some_pages(vcpu);
        return vcpu->mmu.page_fault(vcpu, gva, error_code);
 }
+static inline void kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
+{
+        if (unlikely(vcpu->kvm->n_free_mmu_pages < KVM_MIN_FREE_MMU_PAGES))
+                __kvm_mmu_free_some_pages(vcpu);
+}
 static inline int kvm_mmu_reload(struct kvm_vcpu *vcpu)
 {
        if (likely(vcpu->mmu.root_hpa != INVALID_PAGE))
diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index 1a87ba9d5156..23965aa5ee78 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -273,12 +273,14 @@ static int mmu_topup_memory_caches(struct kvm_vcpu *vcpu)
        int r;
        r = __mmu_topup_memory_caches(vcpu, GFP_NOWAIT);
+        kvm_mmu_free_some_pages(vcpu);
        if (r < 0) {
                spin_unlock(&vcpu->kvm->lock);
                kvm_arch_ops->vcpu_put(vcpu);
                r = __mmu_topup_memory_caches(vcpu, GFP_KERNEL);
                kvm_arch_ops->vcpu_load(vcpu);
                spin_lock(&vcpu->kvm->lock);
+                kvm_mmu_free_some_pages(vcpu);
        }
        return r;
 }
@@ -1208,7 +1210,7 @@ int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva)
        return kvm_mmu_unprotect_page(vcpu, gpa >> PAGE_SHIFT);
 }
-void kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
+void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
 {
        while (vcpu->kvm->n_free_mmu_pages < KVM_REFILL_PAGES) {
                struct kvm_mmu_page *page;
@@ -1218,7 +1220,6 @@ void kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
                kvm_mmu_zap_page(vcpu->kvm, page);
        }
 }
-EXPORT_SYMBOL_GPL(kvm_mmu_free_some_pages);
 static void free_mmu_pages(struct kvm_vcpu *vcpu)
 {
diff --git a/drivers/lguest/lguest.c b/drivers/lguest/lguest.c
index 6e135ac0834f..ee1c6d05c3d3 100644
--- a/drivers/lguest/lguest.c
+++ b/drivers/lguest/lguest.c
@@ -964,11 +964,12 @@ __init void lguest_init(void *boot)
 {
        /* Copy boot parameters first: the Launcher put the physical location
         * in %esi, and head.S converted that to a virtual address and handed
-         * it to us. */
+         * it to us.  We use "__memcpy" because "memcpy" sometimes tries to do
-        memcpy(&boot_params, boot, PARAM_SIZE);
+         * tricky things to go faster, and we're not ready for that. */
+        __memcpy(&boot_params, boot, PARAM_SIZE);
        /* The boot parameters also tell us where the command-line is: save
         * that, too. */
-        memcpy(boot_command_line, __va(boot_params.hdr.cmd_line_ptr),
+        __memcpy(boot_command_line, __va(boot_params.hdr.cmd_line_ptr),
               COMMAND_LINE_SIZE);
        /* We're under lguest, paravirt is enabled, and we're running at
diff --git a/drivers/md/dm-bio-list.h b/drivers/md/dm-bio-list.h
index 16ee3b018b3a..3f7b827649e3 100644
--- a/drivers/md/dm-bio-list.h
+++ b/drivers/md/dm-bio-list.h
@@ -9,6 +9,8 @@
 #include <linux/bio.h>
+#ifdef CONFIG_BLOCK
 struct bio_list {
        struct bio *head;
        struct bio *tail;
@@ -106,4 +108,5 @@ static inline struct bio *bio_list_get(struct bio_list *bl)
        return bio;
 }
+#endif /* CONFIG_BLOCK */
 #endif
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2aff4be35dc4..4d63773ee73a 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2541,7 +2541,7 @@ static void handle_stripe_expansion(raid5_conf_t *conf, struct stripe_head *sh,
        struct dma_async_tx_descriptor *tx = NULL;
        clear_bit(STRIPE_EXPAND_SOURCE, &sh->state);
        for (i = 0; i < sh->disks; i++)
-                if (i != sh->pd_idx && (r6s && i != r6s->qd_idx)) {
+                if (i != sh->pd_idx && (!r6s || i != r6s->qd_idx)) {
                        int dd_idx, pd_idx, j;
                        struct stripe_head *sh2;
@@ -2574,7 +2574,8 @@ static void handle_stripe_expansion(raid5_conf_t *conf, struct stripe_head *sh,
                        set_bit(R5_UPTODATE, &sh2->dev[dd_idx].flags);
                        for (j = 0; j < conf->raid_disks; j++)
                                if (j != sh2->pd_idx &&
-                                    (r6s && j != r6s->qd_idx) &&
+                                    (!r6s || j != raid6_next_disk(sh2->pd_idx,
+                                                                 sh2->disks)) &&
                                    !test_bit(R5_Expanded, &sh2->dev[j].flags))
                                        break;
                        if (j == conf->raid_disks) {
@@ -2583,12 +2584,12 @@ static void handle_stripe_expansion(raid5_conf_t *conf, struct stripe_head *sh,
                        }
                        release_stripe(sh2);
-                        /* done submitting copies, wait for them to complete */
-                        if (i + 1 >= sh->disks) {
-                                async_tx_ack(tx);
-                                dma_wait_for_async_tx(tx);
-                        }
                }
+        /* done submitting copies, wait for them to complete */
+        if (tx) {
+                async_tx_ack(tx);
+                dma_wait_for_async_tx(tx);
+        }
 }
 /*
@@ -2855,7 +2856,7 @@ static void handle_stripe5(struct stripe_head *sh)
                sh->disks = conf->raid_disks;
                sh->pd_idx = stripe_to_pdidx(sh->sector, conf,
                        conf->raid_disks);
-                s.locked += handle_write_operations5(sh, 0, 1);
+                s.locked += handle_write_operations5(sh, 1, 1);
        } else if (s.expanded &&
                !test_bit(STRIPE_OP_POSTXOR, &sh->ops.pending)) {
                clear_bit(STRIPE_EXPAND_READY, &sh->state);
diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
index 317a2a3f9cc1..da7a6b591a67 100644
--- a/drivers/media/video/cx88/cx88-mpeg.c
+++ b/drivers/media/video/cx88/cx88-mpeg.c
@@ -580,7 +580,7 @@ struct cx8802_dev * cx8802_get_device(struct inode *inode)
        list_for_each(list,&cx8802_devlist) {
                h = list_entry(list, struct cx8802_dev, devlist);
-                if (h->mpeg_dev->minor == minor)
+                if (h->mpeg_dev && h->mpeg_dev->minor == minor)
                        return h;
        }
diff --git a/drivers/media/video/ivtv/ivtv-fileops.c b/drivers/media/video/ivtv/ivtv-fileops.c
index 5dd519caf81d..0285c4a830eb 100644
--- a/drivers/media/video/ivtv/ivtv-fileops.c
+++ b/drivers/media/video/ivtv/ivtv-fileops.c
@@ -190,7 +190,9 @@ static void ivtv_update_pgm_info(struct ivtv *itv)
                int idx = (itv->pgm_info_write_idx + i) % itv->pgm_info_num;
                struct v4l2_enc_idx_entry *e = itv->pgm_info + idx;
                u32 addr = itv->pgm_info_offset + 4 + idx * 24;
-                const int mapping[] = { V4L2_ENC_IDX_FRAME_P, V4L2_ENC_IDX_FRAME_I, V4L2_ENC_IDX_FRAME_B, 0 };
+                const int mapping[8] = { -1, V4L2_ENC_IDX_FRAME_I, V4L2_ENC_IDX_FRAME_P, -1,
+                        V4L2_ENC_IDX_FRAME_B, -1, -1, -1 };
+                                        // 1=I, 2=P, 4=B
                e->offset = read_enc(addr + 4) + ((u64)read_enc(addr + 8) << 32);
                if (e->offset > itv->mpg_data_received) {
@@ -199,7 +201,7 @@ static void ivtv_update_pgm_info(struct ivtv *itv)
                e->offset += itv->vbi_data_inserted;
                e->length = read_enc(addr);
                e->pts = read_enc(addr + 16) + ((u64)(read_enc(addr + 20) & 1) << 32);
-                e->flags = mapping[read_enc(addr + 12) & 3];
+                e->flags = mapping[read_enc(addr + 12) & 7];
                i++;
        }
        itv->pgm_info_write_idx = (itv->pgm_info_write_idx + i) % itv->pgm_info_num;
diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
index 5977a79619c2..dfe0aedc60fd 100644
--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -1099,14 +1099,21 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, struct file *filp, unsigned int cmd, void
        case VIDIOC_G_ENC_INDEX: {
                struct v4l2_enc_idx *idx = arg;
+                struct v4l2_enc_idx_entry *e = idx->entry;
+                int entries;
                int i;
-                idx->entries = (itv->pgm_info_write_idx + IVTV_MAX_PGM_INDEX - itv->pgm_info_read_idx) %
+                entries = (itv->pgm_info_write_idx + IVTV_MAX_PGM_INDEX - itv->pgm_info_read_idx) %
                                        IVTV_MAX_PGM_INDEX;
-                if (idx->entries > V4L2_ENC_IDX_ENTRIES)
+                if (entries > V4L2_ENC_IDX_ENTRIES)
-                        idx->entries = V4L2_ENC_IDX_ENTRIES;
+                        entries = V4L2_ENC_IDX_ENTRIES;
-                for (i = 0; i < idx->entries; i++) {
+                idx->entries = 0;
-                        idx->entry[i] = itv->pgm_info[(itv->pgm_info_read_idx + i) % IVTV_MAX_PGM_INDEX];
+                for (i = 0; i < entries; i++) {
+                        *e = itv->pgm_info[(itv->pgm_info_read_idx + i) % IVTV_MAX_PGM_INDEX];
+                        if ((e->flags & V4L2_ENC_IDX_FRAME_MASK) <= V4L2_ENC_IDX_FRAME_B) {
+                                idx->entries++;
+                                e++;
+                        }
                }
                itv->pgm_info_read_idx = (itv->pgm_info_read_idx + idx->entries) % IVTV_MAX_PGM_INDEX;
                break;
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index 3d81966d8c42..931b274bffca 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -1243,7 +1243,7 @@ static int pwc_video_close(struct inode *inode, struct file *file)
                                PWC_ERROR("Failed to power down camera (%d)\n", i);
                }
                pdev->vopen--;
-                PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", i);
+                PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", pdev->vopen);
        } else {
                pwc_cleanup(pdev);
                /* Free memory (don't set pdev to 0 just yet) */
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 8ec83bd70094..25ec16810818 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -1537,18 +1537,18 @@ struct saa7134_board saa7134_boards[] = {
                },{
                        .name = name_comp1,
                        .vmux = 0,
-                        .amux = LINE2,
+                        .amux = LINE1,
-                        .gpio = 0x00,
+                        .gpio = 0x02,
                },{
                        .name = name_comp2,
                        .vmux = 3,
-                        .amux = LINE2,
+                        .amux = LINE1,
-                        .gpio = 0x00,
+                        .gpio = 0x02,
                },{
                        .name = name_svideo,
                        .vmux = 8,
-                        .amux = LINE2,
+                        .amux = LINE1,
-                        .gpio = 0x00,
+                        .gpio = 0x02,
                }},
                .radio = {
                        .name = name_radio,
diff --git a/drivers/media/video/saa7191.c b/drivers/media/video/saa7191.c
index 8615a6081a5d..b4018cce3285 100644
--- a/drivers/media/video/saa7191.c
+++ b/drivers/media/video/saa7191.c
@@ -130,7 +130,7 @@ static int saa7191_write_reg(struct i2c_client *client, u8 reg,
 /* the first byte of data must be the first subaddress number (register) */
 static int saa7191_write_block(struct i2c_client *client,
-                               u8 length, u8 *data)
+                               u8 length, const u8 *data)
 {
        int i;
        int ret;
@@ -592,7 +592,7 @@ static int saa7191_attach(struct i2c_adapter *adap, int addr, int kind)
        if (err)
                goto out_free_decoder;
-        err = saa7191_write_block(client, sizeof(initseq), (u8 *)initseq);
+        err = saa7191_write_block(client, sizeof(initseq), initseq);
        if (err) {
                printk(KERN_ERR "SAA7191 initialization failed\n");
                goto out_detach_client;
diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
index bfebd2fa7ada..955ea60583b5 100644
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -941,7 +941,7 @@ static int __exit at91_mci_remove(struct platform_device *pdev)
        host = mmc_priv(mmc);
-        if (host->present != -1) {
+        if (host->board->det_pin) {
                device_init_wakeup(&pdev->dev, 0);
                free_irq(host->board->det_pin, host);
                cancel_delayed_work(&host->mmc->detect);
@@ -972,7 +972,7 @@ static int at91_mci_suspend(struct platform_device *pdev, pm_message_t state)
        struct at91mci_host *host = mmc_priv(mmc);
        int ret = 0;
-        if (device_may_wakeup(&pdev->dev))
+        if (host->board->det_pin && device_may_wakeup(&pdev->dev))
                enable_irq_wake(host->board->det_pin);
        if (mmc)
@@ -987,7 +987,7 @@ static int at91_mci_resume(struct platform_device *pdev)
        struct at91mci_host *host = mmc_priv(mmc);
        int ret = 0;
-        if (device_may_wakeup(&pdev->dev))
+        if (host->board->det_pin && device_may_wakeup(&pdev->dev))
                disable_irq_wake(host->board->det_pin);
        if (mmc)
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 58740428dd07..9034a05734ef 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.80"
+#define DRV_MODULE_VERSION      "3.81"
-#define DRV_MODULE_RELDATE      "August 2, 2007"
+#define DRV_MODULE_RELDATE      "September 5, 2007"
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -7127,6 +7127,10 @@ static int tg3_open(struct net_device *dev)
                } else if (pci_enable_msi(tp->pdev) == 0) {
                        u32 msi_mode;
+                        /* Hardware bug - MSI won't work if INTX disabled. */
+                        if (tp->tg3_flags2 & TG3_FLG2_5780_CLASS)
+                                pci_intx(tp->pdev, 1);
                        msi_mode = tr32(MSGINT_MODE);
                        tw32(MSGINT_MODE, msi_mode | MSGINT_MODE_ENABLE);
                        tp->tg3_flags2 |= TG3_FLG2_USING_MSI;
@@ -12172,6 +12176,11 @@ static int tg3_resume(struct pci_dev *pdev)
        if (err)
                return err;
+        /* Hardware bug - MSI won't work if INTX disabled. */
+        if ((tp->tg3_flags2 & TG3_FLG2_5780_CLASS) &&
+            (tp->tg3_flags2 & TG3_FLG2_USING_MSI))
+                pci_intx(tp->pdev, 1);
        netif_device_attach(dev);
        tg3_full_lock(tp, 0);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 27e00b2d7b5b..171ca712e523 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -285,7 +285,7 @@ static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom)
        }
 }
-void __devinit pci_read_bridge_bases(struct pci_bus *child)
+void pci_read_bridge_bases(struct pci_bus *child)
 {
        struct pci_dev *dev = child->self;
        u8 io_base_lo, io_limit_lo;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 2d40f437b9fc..7dcaa09b3c20 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -972,8 +972,8 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, k8t_sound_ho
 *
 * The SMBus PCI Device can be activated by setting a bit in the ICH LPC 
 * bridge. Unfortunately, this device has no subvendor/subdevice ID. So it 
- * becomes necessary to do this tweak in two steps -- I've chosen the Host
+ * becomes necessary to do this tweak in two steps -- the chosen trigger
- * bridge as trigger.
+ * is either the Host bridge (preferred) or on-board VGA controller.
 *
 * Note that we used to unhide the SMBus that way on Toshiba laptops
 * (Satellite A40 and Tecra M2) but then found that the thermal management
@@ -1070,6 +1070,14 @@ static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
                        case 0x0058: /* Compaq Evo N620c */
                                asus_hides_smbus = 1;
                        }
+                else if (dev->device == PCI_DEVICE_ID_INTEL_82810_IG3)
+                        switch(dev->subsystem_device) {
+                        case 0xB16C: /* Compaq Deskpro EP 401963-001 (PCA# 010174) */
+                                /* Motherboard doesn't have Host bridge
+                                 * subvendor/subdevice IDs, therefore checking
+                                 * its on-board VGA controller */
+                                asus_hides_smbus = 1;
+                        }
        }
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82845_HB,   asus_hides_smbus_hostbridge );
@@ -1082,6 +1090,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82855PM_HB,	as
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82855GM_HB, asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82915GM_HB, asus_hides_smbus_hostbridge );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82810_IG3,  asus_hides_smbus_hostbridge );
 static void asus_hides_smbus_lpc(struct pci_dev *dev)
 {
        u16 val;
@@ -1099,12 +1109,14 @@ static void asus_hides_smbus_lpc(struct pci_dev *dev)
                        printk(KERN_INFO "PCI: Enabled i801 SMBus device\n");
        }
 }
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801AA_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801DB_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801BA_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801CA_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801CA_12, asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801DB_12, asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801EB_0,  asus_hides_smbus_lpc );
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801AA_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801DB_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801BA_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801CA_0,  asus_hides_smbus_lpc );
diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
index 90755d4cdb9f..6b0cf0c2a088 100644
--- a/drivers/pnp/quirks.c
+++ b/drivers/pnp/quirks.c
@@ -107,108 +107,6 @@ static void quirk_sb16audio_resources(struct pnp_dev *dev)
                       "pnp: SB audio device quirk - increasing port range\n");
 }
-static int quirk_smc_fir_enabled(struct pnp_dev *dev)
-{
-        unsigned long firbase;
-        u8 bank, high, low, chip;
-        if (!pnp_port_valid(dev, 1))
-                return 0;
-        firbase = pnp_port_start(dev, 1);
-        /* Select register bank 3 */
-        bank = inb(firbase + 7);
-        bank &= 0xf0;
-        bank |= 3;
-        outb(bank, firbase + 7);
-        high = inb(firbase + 0);
-        low = inb(firbase + 1);
-        chip = inb(firbase + 2);
-        /* This corresponds to the check in smsc_ircc_present() */
-        if (high == 0x10 && low == 0xb8 && (chip == 0xf1 || chip == 0xf2))
-                return 1;
-        return 0;
-}
-static void quirk_smc_enable(struct pnp_dev *dev)
-{
-        struct resource fir, sir, irq;
-        pnp_activate_dev(dev);
-        if (quirk_smc_fir_enabled(dev))
-                return;
-        /*
-         * Sometimes the BIOS claims the device is enabled, but it reports
-         * the wrong FIR resources or doesn't properly configure ISA or LPC
-         * bridges on the way to the device.
-         *
-         * HP nc6000 and nc8000/nw8000 laptops have known problems like
-         * this.  Fortunately, they do fix things up if we auto-configure
-         * the device using its _PRS and _SRS methods.
-         */
-        dev_err(&dev->dev, "%s not responding at SIR 0x%lx, FIR 0x%lx; "
-                "auto-configuring\n", dev->id->id,
-                (unsigned long)pnp_port_start(dev, 0),
-                (unsigned long)pnp_port_start(dev, 1));
-        pnp_disable_dev(dev);
-        pnp_init_resource_table(&dev->res);
-        pnp_auto_config_dev(dev);
-        pnp_activate_dev(dev);
-        if (quirk_smc_fir_enabled(dev)) {
-                dev_err(&dev->dev, "responds at SIR 0x%lx, FIR 0x%lx\n",
-                        (unsigned long)pnp_port_start(dev, 0),
-                        (unsigned long)pnp_port_start(dev, 1));
-                return;
-        }
-        /*
-         * The Toshiba Portege 4000 _CRS reports the FIR region first,
-         * followed by the SIR region.  The BIOS will configure the bridge,
-         * but only if we call _SRS with SIR first, then FIR.  It also
-         * reports the IRQ as active high, when it is really active low.
-         */
-        dev_err(&dev->dev, "not responding at SIR 0x%lx, FIR 0x%lx; "
-                "swapping SIR/FIR and reconfiguring\n",
-                (unsigned long)pnp_port_start(dev, 0),
-                (unsigned long)pnp_port_start(dev, 1));
-        /*
-         * Clear IORESOURCE_AUTO so pnp_activate_dev() doesn't reassign
-         * these resources any more.
-         */
-        fir = dev->res.port_resource[0];
-        sir = dev->res.port_resource[1];
-        fir.flags &= ~IORESOURCE_AUTO;
-        sir.flags &= ~IORESOURCE_AUTO;
-        irq = dev->res.irq_resource[0];
-        irq.flags &= ~IORESOURCE_AUTO;
-        irq.flags &= ~IORESOURCE_BITS;
-        irq.flags |= IORESOURCE_IRQ_LOWEDGE;
-        pnp_disable_dev(dev);
-        dev->res.port_resource[0] = sir;
-        dev->res.port_resource[1] = fir;
-        dev->res.irq_resource[0] = irq;
-        pnp_activate_dev(dev);
-        if (quirk_smc_fir_enabled(dev)) {
-                dev_err(&dev->dev, "responds at SIR 0x%lx, FIR 0x%lx\n",
-                        (unsigned long)pnp_port_start(dev, 0),
-                        (unsigned long)pnp_port_start(dev, 1));
-                return;
-        }
-        dev_err(&dev->dev, "giving up; try \"smsc-ircc2.nopnp\" and "
-                "email bjorn.helgaas@hp.com\n");
-}
 /*
 *  PnP Quirks
 *  Cards or devices that need some tweaking due to incomplete resource info
@@ -229,7 +127,6 @@ static struct pnp_fixup pnp_fixups[] = {
        {"CTL0043", quirk_sb16audio_resources},
        {"CTL0044", quirk_sb16audio_resources},
        {"CTL0045", quirk_sb16audio_resources},
-        {"SMCf010", quirk_smc_enable},
        {""}
 };
diff --git a/drivers/rtc/rtc-v3020.c b/drivers/rtc/rtc-v3020.c
index 3b58d3d5d38a..a6b572978dc0 100644
--- a/drivers/rtc/rtc-v3020.c
+++ b/drivers/rtc/rtc-v3020.c
@@ -26,6 +26,7 @@
 #include <linux/types.h>
 #include <linux/bcd.h>
 #include <linux/rtc-v3020.h>
+#include <linux/delay.h>
 #include <asm/io.h>
@@ -47,6 +48,7 @@ static void v3020_set_reg(struct v3020 *chip, unsigned char address,
        for (i = 0; i < 4; i++) {
                writel((tmp & 1) << chip->leftshift, chip->ioaddress);
                tmp >>= 1;
+                udelay(1);
        }
        /* Commands dont have data */
@@ -54,6 +56,7 @@ static void v3020_set_reg(struct v3020 *chip, unsigned char address,
                for (i = 0; i < 8; i++) {
                        writel((data & 1) << chip->leftshift, chip->ioaddress);
                        data >>= 1;
+                        udelay(1);
                }
        }
 }
@@ -66,12 +69,14 @@ static unsigned char v3020_get_reg(struct v3020 *chip, unsigned char address)
        for (i = 0; i < 4; i++) {
                writel((address & 1) << chip->leftshift, chip->ioaddress);
                address >>= 1;
+                udelay(1);
        }
        for (i = 0; i < 8; i++) {
                data >>= 1;
                if (readl(chip->ioaddress) & (1 << chip->leftshift))
                        data |= 0x80;
+                udelay(1);
        }
        return data;
@@ -95,7 +100,7 @@ static int v3020_read_time(struct device *dev, struct rtc_time *dt)
        tmp = v3020_get_reg(chip, V3020_MONTH_DAY);
        dt->tm_mday     = BCD2BIN(tmp);
        tmp = v3020_get_reg(chip, V3020_MONTH);
-        dt->tm_mon      = BCD2BIN(tmp);
+        dt->tm_mon    = BCD2BIN(tmp) - 1;
        tmp = v3020_get_reg(chip, V3020_WEEK_DAY);
        dt->tm_wday     = BCD2BIN(tmp);
        tmp = v3020_get_reg(chip, V3020_YEAR);
@@ -135,7 +140,7 @@ static int v3020_set_time(struct device *dev, struct rtc_time *dt)
        v3020_set_reg(chip, V3020_MINUTES,      BIN2BCD(dt->tm_min));
        v3020_set_reg(chip, V3020_HOURS,        BIN2BCD(dt->tm_hour));
        v3020_set_reg(chip, V3020_MONTH_DAY,    BIN2BCD(dt->tm_mday));
-        v3020_set_reg(chip, V3020_MONTH,        BIN2BCD(dt->tm_mon));
+        v3020_set_reg(chip, V3020_MONTH,     BIN2BCD(dt->tm_mon + 1));
        v3020_set_reg(chip, V3020_WEEK_DAY,     BIN2BCD(dt->tm_wday));
        v3020_set_reg(chip, V3020_YEAR,         BIN2BCD(dt->tm_year % 100));
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index ab5ec1feaf4e..90aa53fc4f3e 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -1503,7 +1503,7 @@ zfcp_gid_pn_buffers_alloc(struct zfcp_gid_pn_data **gid_pn, mempool_t *pool)
                        data->ct.pool = pool;
                }
        } else {
-                data = kmalloc(sizeof(struct zfcp_gid_pn_data), GFP_ATOMIC);
+                data = kmem_cache_alloc(zfcp_data.gid_pn_cache, GFP_ATOMIC);
        }
        if (NULL == data)
@@ -1531,7 +1531,7 @@ static void zfcp_gid_pn_buffers_free(struct zfcp_gid_pn_data *gid_pn)
        if (gid_pn->ct.pool)
                mempool_free(gid_pn, gid_pn->ct.pool);
        else
-                kfree(gid_pn);
+                kmem_cache_free(zfcp_data.gid_pn_cache, gid_pn);
 }
 /**
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index 81daa8204bfe..c6899efdc8f6 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -640,13 +640,9 @@ int
 zfcp_qdio_sbals_from_scsicmnd(struct zfcp_fsf_req *fsf_req,
                              unsigned long sbtype, struct scsi_cmnd *scsi_cmnd)
 {
-        if (scsi_sg_count(scsi_cmnd))
+        return zfcp_qdio_sbals_from_sg(fsf_req, sbtype, scsi_sglist(scsi_cmnd),
-                return zfcp_qdio_sbals_from_sg(fsf_req, sbtype,
+                                       scsi_sg_count(scsi_cmnd),
-                                               scsi_sglist(scsi_cmnd),
+                                       ZFCP_MAX_SBALS_PER_REQ);
-                                               scsi_sg_count(scsi_cmnd),
-                                               ZFCP_MAX_SBALS_PER_REQ);
-        else
-                return 0;
 }
 /**
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 0acf6db0a08d..ad7eb4a9261c 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -764,7 +764,9 @@ zfcp_reset_fc_host_stats(struct Scsi_Host *shost)
                return;
        ret = zfcp_fsf_exchange_port_data(NULL, adapter, data);
-        if (ret == 0) {
+        if (ret) {
+                kfree(data);
+        } else {
                adapter->stats_reset = jiffies/HZ;
                old_data = adapter->stats_reset_data;
                adapter->stats_reset_data = data; /* finally freed in
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 5606d1e62978..efceed451b46 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -737,12 +737,19 @@ check_mgmt:
                 */
                conn->ctask = list_entry(conn->xmitqueue.next,
                                         struct iscsi_cmd_task, running);
-                if (conn->ctask->state == ISCSI_TASK_PENDING) {
+                switch (conn->ctask->state) {
+                case ISCSI_TASK_ABORTING:
+                        break;
+                case ISCSI_TASK_PENDING:
                        iscsi_prep_scsi_cmd_pdu(conn->ctask);
                        conn->session->tt->init_cmd_task(conn->ctask);
+                        /* fall through */
+                default:
+                        conn->ctask->state = ISCSI_TASK_RUNNING;
+                        break;
                }
-                conn->ctask->state = ISCSI_TASK_RUNNING;
                list_move_tail(conn->xmitqueue.next, &conn->run_list);
                rc = iscsi_xmit_ctask(conn);
                if (rc)
                        goto again;
@@ -1049,7 +1056,9 @@ static int iscsi_exec_abort_task(struct scsi_cmnd *sc,
        ctask->mtask = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)hdr,
                                            NULL, 0);
        if (!ctask->mtask) {
+                spin_unlock_bh(&session->lock);
                iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+                spin_lock_bh(&session->lock)
                debug_scsi("abort sent failure [itt 0x%x]\n", ctask->itt);
                return -EPERM;
        }
@@ -1066,6 +1075,7 @@ static int iscsi_exec_abort_task(struct scsi_cmnd *sc,
                debug_scsi("abort set timeout [itt 0x%x]\n", ctask->itt);
        }
        spin_unlock_bh(&session->lock);
+        mutex_unlock(&session->eh_mutex);
        scsi_queue_work(session->host, &conn->xmitwork);
        /*
@@ -1083,6 +1093,7 @@ static int iscsi_exec_abort_task(struct scsi_cmnd *sc,
        if (signal_pending(current))
                flush_signals(current);
        del_timer_sync(&conn->tmabort_timer);
+        mutex_lock(&session->eh_mutex);
        spin_lock_bh(&session->lock);
        return 0;
 }
@@ -1158,31 +1169,45 @@ static void fail_command(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask,
        __iscsi_put_ctask(ctask);
 }
+static void iscsi_suspend_tx(struct iscsi_conn *conn)
+{
+        set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
+        scsi_flush_work(conn->session->host);
+}
+static void iscsi_start_tx(struct iscsi_conn *conn)
+{
+        clear_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
+        scsi_queue_work(conn->session->host, &conn->xmitwork);
+}
 int iscsi_eh_abort(struct scsi_cmnd *sc)
 {
+        struct Scsi_Host *host = sc->device->host;
+        struct iscsi_session *session = iscsi_hostdata(host->hostdata);
        struct iscsi_cmd_task *ctask;
        struct iscsi_conn *conn;
-        struct iscsi_session *session;
        int rc;
+        mutex_lock(&session->eh_mutex);
+        spin_lock_bh(&session->lock);
        /*
         * if session was ISCSI_STATE_IN_RECOVERY then we may not have
         * got the command.
         */
        if (!sc->SCp.ptr) {
                debug_scsi("sc never reached iscsi layer or it completed.\n");
+                spin_unlock_bh(&session->lock);
+                mutex_unlock(&session->eh_mutex);
                return SUCCESS;
        }
        ctask = (struct iscsi_cmd_task *)sc->SCp.ptr;
        conn = ctask->conn;
-        session = conn->session;
        conn->eh_abort_cnt++;
        debug_scsi("aborting [sc %p itt 0x%x]\n", sc, ctask->itt);
-        spin_lock_bh(&session->lock);
        /*
         * If we are not logged in or we have started a new session
         * then let the host reset code handle this
@@ -1219,6 +1244,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
        switch (conn->tmabort_state) {
        case TMABORT_SUCCESS:
                spin_unlock_bh(&session->lock);
+                iscsi_suspend_tx(conn);
                /*
                 * clean up task if aborted. grab the recv lock as a writer
                 */
@@ -1227,11 +1253,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
                fail_command(conn, ctask, DID_ABORT << 16);
                spin_unlock(&session->lock);
                write_unlock_bh(conn->recv_lock);
-                /*
+                iscsi_start_tx(conn);
-                 * make sure xmit thread is not still touching the
-                 * ctask/scsi_cmnd
-                 */
-                scsi_flush_work(session->host);
                goto success_unlocked;
        case TMABORT_NOT_FOUND:
                if (!ctask->sc) {
@@ -1251,12 +1273,14 @@ success:
        spin_unlock_bh(&session->lock);
 success_unlocked:
        debug_scsi("abort success [sc %lx itt 0x%x]\n", (long)sc, ctask->itt);
+        mutex_unlock(&session->eh_mutex);
        return SUCCESS;
 failed:
        spin_unlock_bh(&session->lock);
 failed_unlocked:
        debug_scsi("abort failed [sc %lx itt 0x%x]\n", (long)sc, ctask->itt);
+        mutex_unlock(&session->eh_mutex);
        return FAILED;
 }
 EXPORT_SYMBOL_GPL(iscsi_eh_abort);
@@ -1403,6 +1427,7 @@ iscsi_session_setup(struct iscsi_transport *iscsit,
        session->max_cmdsn = initial_cmdsn + 1;
        session->max_r2t = 1;
        session->tt = iscsit;
+        mutex_init(&session->eh_mutex);
        /* initialize SCSI PDU commands pool */
        if (iscsi_pool_init(&session->cmdpool, session->cmds_max,
@@ -1736,9 +1761,22 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
 {
        int old_stop_stage;
+        mutex_lock(&session->eh_mutex);
        spin_lock_bh(&session->lock);
        if (conn->stop_stage == STOP_CONN_TERM) {
                spin_unlock_bh(&session->lock);
+                mutex_unlock(&session->eh_mutex);
+                return;
+        }
+        /*
+         * The LLD either freed/unset the lock on us, or userspace called
+         * stop but did not create a proper connection (connection was never
+         * bound or it was unbound then stop was called).
+         */
+        if (!conn->recv_lock) {
+                spin_unlock_bh(&session->lock);
+                mutex_unlock(&session->eh_mutex);
                return;
        }
@@ -1755,9 +1793,9 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
        old_stop_stage = conn->stop_stage;
        conn->stop_stage = flag;
        conn->c_stage = ISCSI_CONN_STOPPED;
-        set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
        spin_unlock_bh(&session->lock);
-        scsi_flush_work(session->host);
+        iscsi_suspend_tx(conn);
        write_lock_bh(conn->recv_lock);
        set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
@@ -1786,6 +1824,7 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
        fail_all_commands(conn);
        flush_control_queues(session, conn);
        spin_unlock_bh(&session->lock);
+        mutex_unlock(&session->eh_mutex);
 }
 void iscsi_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 563d18f4ff50..c6680348b648 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -2050,21 +2050,18 @@ qla25xx_fw_dump_failed:
 void
 qla2x00_dump_regs(scsi_qla_host_t *ha)
 {
+        int i;
        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+        struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24;
+        uint16_t __iomem *mbx_reg;
+        mbx_reg = IS_FWI2_CAPABLE(ha) ? &reg24->mailbox0:
+            MAILBOX_REG(ha, reg, 0);
        printk("Mailbox registers:\n");
-        printk("scsi(%ld): mbox 0 0x%04x \n",
+        for (i = 0; i < 6; i++)
-            ha->host_no, RD_MAILBOX_REG(ha, reg, 0));
+                printk("scsi(%ld): mbox %d 0x%04x \n", ha->host_no, i,
-        printk("scsi(%ld): mbox 1 0x%04x \n",
+                    RD_REG_WORD(mbx_reg++));
-            ha->host_no, RD_MAILBOX_REG(ha, reg, 1));
-        printk("scsi(%ld): mbox 2 0x%04x \n",
-            ha->host_no, RD_MAILBOX_REG(ha, reg, 2));
-        printk("scsi(%ld): mbox 3 0x%04x \n",
-            ha->host_no, RD_MAILBOX_REG(ha, reg, 3));
-        printk("scsi(%ld): mbox 4 0x%04x \n",
-            ha->host_no, RD_MAILBOX_REG(ha, reg, 4));
-        printk("scsi(%ld): mbox 5 0x%04x \n",
-            ha->host_no, RD_MAILBOX_REG(ha, reg, 5));
 }
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 27ae3a532a55..c1964866a423 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -1502,7 +1502,6 @@ typedef struct {
        uint8_t node_name[WWN_SIZE];
        uint8_t port_name[WWN_SIZE];
        uint8_t fabric_port_name[WWN_SIZE];
-        uint16_t fp_speeds;
        uint16_t fp_speed;
 } sw_info_t;
diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
index b06cbb8580d3..a7e23583f899 100644
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -295,6 +295,8 @@ qla2x00_gid_pt(scsi_qla_host_t *ha, sw_info_t *list)
                        list[i].d_id.b.domain = gid_data->port_id[0];
                        list[i].d_id.b.area = gid_data->port_id[1];
                        list[i].d_id.b.al_pa = gid_data->port_id[2];
+                        memset(list[i].fabric_port_name, 0, WWN_SIZE);
+                        list[i].fp_speed = PORT_SPEED_UNKNOWN;
                        /* Last one exit. */
                        if (gid_data->control_byte & BIT_7) {
@@ -1707,8 +1709,6 @@ qla2x00_gfpn_id(scsi_qla_host_t *ha, sw_info_t *list)
        for (i = 0; i < MAX_FIBRE_DEVICES; i++) {
                /* Issue GFPN_ID */
-                memset(list[i].fabric_port_name, 0, WWN_SIZE);
                /* Prepare common MS IOCB */
                ms_pkt = ha->isp_ops->prep_ms_iocb(ha, GFPN_ID_REQ_SIZE,
                    GFPN_ID_RSP_SIZE);
@@ -1821,8 +1821,6 @@ qla2x00_gpsc(scsi_qla_host_t *ha, sw_info_t *list)
        for (i = 0; i < MAX_FIBRE_DEVICES; i++) {
                /* Issue GFPN_ID */
-                list[i].fp_speeds = list[i].fp_speed = 0;
                /* Prepare common MS IOCB */
                ms_pkt = qla24xx_prep_ms_fm_iocb(ha, GPSC_REQ_SIZE,
                    GPSC_RSP_SIZE);
@@ -1858,9 +1856,21 @@ qla2x00_gpsc(scsi_qla_host_t *ha, sw_info_t *list)
                        }
                        rval = QLA_FUNCTION_FAILED;
                } else {
-                        /* Save portname */
+                        /* Save port-speed */
-                        list[i].fp_speeds = ct_rsp->rsp.gpsc.speeds;
+                        switch (be16_to_cpu(ct_rsp->rsp.gpsc.speed)) {
-                        list[i].fp_speed = ct_rsp->rsp.gpsc.speed;
+                        case BIT_15:
+                                list[i].fp_speed = PORT_SPEED_1GB;
+                                break;
+                        case BIT_14:
+                                list[i].fp_speed = PORT_SPEED_2GB;
+                                break;
+                        case BIT_13:
+                                list[i].fp_speed = PORT_SPEED_4GB;
+                                break;
+                        case BIT_11:
+                                list[i].fp_speed = PORT_SPEED_8GB;
+                                break;
+                        }
                        DEBUG2_3(printk("scsi(%ld): GPSC ext entry - "
                            "fpn %02x%02x%02x%02x%02x%02x%02x%02x speeds=%04x "
@@ -1873,8 +1883,8 @@ qla2x00_gpsc(scsi_qla_host_t *ha, sw_info_t *list)
                            list[i].fabric_port_name[5],
                            list[i].fabric_port_name[6],
                            list[i].fabric_port_name[7],
-                            be16_to_cpu(list[i].fp_speeds),
+                            be16_to_cpu(ct_rsp->rsp.gpsc.speeds),
-                            be16_to_cpu(list[i].fp_speed)));
+                            be16_to_cpu(ct_rsp->rsp.gpsc.speed)));
                }
                /* Last device exit. */
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 374abe19b547..1a058ec9bd0c 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2079,17 +2079,7 @@ qla2x00_configure_local_loop(scsi_qla_host_t *ha)
                }
                /* Base iIDMA settings on HBA port speed. */
-                switch (ha->link_data_rate) {
+                fcport->fp_speed = ha->link_data_rate;
-                case PORT_SPEED_1GB:
-                        fcport->fp_speed = cpu_to_be16(BIT_15);
-                        break;
-                case PORT_SPEED_2GB:
-                        fcport->fp_speed = cpu_to_be16(BIT_14);
-                        break;
-                case PORT_SPEED_4GB:
-                        fcport->fp_speed = cpu_to_be16(BIT_13);
-                        break;
-                }
                qla2x00_update_fcport(ha, fcport);
@@ -2130,38 +2120,25 @@ static void
 qla2x00_iidma_fcport(scsi_qla_host_t *ha, fc_port_t *fcport)
 {
 #define LS_UNKNOWN      2
-        static char *link_speeds[5] = { "1", "2", "?", "4" };
+        static char *link_speeds[5] = { "1", "2", "?", "4", "8" };
        int rval;
-        uint16_t port_speed, mb[6];
+        uint16_t mb[6];
        if (!IS_IIDMA_CAPABLE(ha))
                return;
-        switch (be16_to_cpu(fcport->fp_speed)) {
+        if (fcport->fp_speed == PORT_SPEED_UNKNOWN) {
-        case BIT_15:
-                port_speed = PORT_SPEED_1GB;
-                break;
-        case BIT_14:
-                port_speed = PORT_SPEED_2GB;
-                break;
-        case BIT_13:
-                port_speed = PORT_SPEED_4GB;
-                break;
-        default:
                DEBUG2(printk("scsi(%ld): %02x%02x%02x%02x%02x%02x%02x%02x -- "
-                    "unsupported FM port operating speed (%04x).\n",
+                    "unsupported FM port operating speed.\n",
                    ha->host_no, fcport->port_name[0], fcport->port_name[1],
                    fcport->port_name[2], fcport->port_name[3],
                    fcport->port_name[4], fcport->port_name[5],
-                    fcport->port_name[6], fcport->port_name[7],
+                    fcport->port_name[6], fcport->port_name[7]));
-                    be16_to_cpu(fcport->fp_speed)));
-                port_speed = PORT_SPEED_UNKNOWN;
-                break;
-        }
-        if (port_speed == PORT_SPEED_UNKNOWN)
                return;
+        }
-        rval = qla2x00_set_idma_speed(ha, fcport->loop_id, port_speed, mb);
+        rval = qla2x00_set_idma_speed(ha, fcport->loop_id, fcport->fp_speed,
+            mb);
        if (rval != QLA_SUCCESS) {
                DEBUG2(printk("scsi(%ld): Unable to adjust iIDMA "
                    "%02x%02x%02x%02x%02x%02x%02x%02x -- %04x %x %04x %04x.\n",
@@ -2169,12 +2146,12 @@ qla2x00_iidma_fcport(scsi_qla_host_t *ha, fc_port_t *fcport)
                    fcport->port_name[2], fcport->port_name[3],
                    fcport->port_name[4], fcport->port_name[5],
                    fcport->port_name[6], fcport->port_name[7], rval,
-                    port_speed, mb[0], mb[1]));
+                    fcport->fp_speed, mb[0], mb[1]));
        } else {
                DEBUG2(qla_printk(KERN_INFO, ha,
                    "iIDMA adjusted to %s GB/s on "
                    "%02x%02x%02x%02x%02x%02x%02x%02x.\n",
-                    link_speeds[port_speed], fcport->port_name[0],
+                    link_speeds[fcport->fp_speed], fcport->port_name[0],
                    fcport->port_name[1], fcport->port_name[2],
                    fcport->port_name[3], fcport->port_name[4],
                    fcport->port_name[5], fcport->port_name[6],
@@ -3354,7 +3331,8 @@ qla2x00_restart_isp(scsi_qla_host_t *ha)
                        spin_lock_irqsave(&ha->hardware_lock, flags);
-                        if (!IS_QLA24XX(ha) && !IS_QLA54XX(ha)) {
+                        if (!IS_QLA24XX(ha) && !IS_QLA54XX(ha) &&
+                            !IS_QLA25XX(ha)) {
                                /*
                                 * Disable SRAM, Instruction RAM and GP RAM
                                 * parity.
@@ -3370,7 +3348,8 @@ qla2x00_restart_isp(scsi_qla_host_t *ha)
                        spin_lock_irqsave(&ha->hardware_lock, flags);
-                        if (!IS_QLA24XX(ha) && !IS_QLA54XX(ha)) {
+                        if (!IS_QLA24XX(ha) && !IS_QLA54XX(ha) &&
+                            !IS_QLA25XX(ha)) {
                                /* Enable proper parity */
                                if (IS_QLA2300(ha))
                                        /* SRAM parity */
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 50539da467bf..eecae9905ece 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -490,6 +490,7 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                set_bit(REGISTER_FC4_NEEDED, &ha->dpc_flags);
                ha->flags.gpsc_supported = 1;
+                ha->flags.management_server_logged_in = 0;
                break;
        case MBA_CHG_IN_CONNECTION:     /* Change in connection mode */
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 93c0c7e4f08f..acca898ce0a2 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1564,7 +1564,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        struct Scsi_Host *host;
        scsi_qla_host_t *ha;
        unsigned long   flags = 0;
-        char pci_info[20];
+        char pci_info[30];
        char fw_str[30];
        struct scsi_host_template *sht;
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index dd1f8ceb79c4..18095b9b76f4 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
 * Driver version
 */
-#define QLA2XXX_VERSION      "8.02.00-k2"
+#define QLA2XXX_VERSION      "8.02.00-k3"
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    2
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 64ff6a5f6afd..81b52b7cca21 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -611,7 +611,7 @@ config SERIAL_BFIN
 config SERIAL_BFIN_CONSOLE
        bool "Console on Blackfin serial port"
-        depends on SERIAL_BFIN
+        depends on SERIAL_BFIN=y
        select SERIAL_CORE_CONSOLE
 choice
@@ -832,10 +832,10 @@ config SERIAL_MUX
            4. Change the kernel command console parameter to: console=ttyB0
 config SERIAL_MUX_CONSOLE
-        bool "Support for console on serial MUX"
+        bool "Support for console on serial MUX"
-        depends on SERIAL_MUX
+        depends on SERIAL_MUX=y
        select SERIAL_CORE_CONSOLE
-        default y
+        default y
 config PDC_CONSOLE
        bool "PDC software console support"
diff --git a/drivers/serial/sb1250-duart.c b/drivers/serial/sb1250-duart.c
index 201253755011..2d6c08b3dbcf 100644
--- a/drivers/serial/sb1250-duart.c
+++ b/drivers/serial/sb1250-duart.c
@@ -58,6 +58,12 @@
 #define SBD_CTRLREGS(line)      A_BCM1480_DUART_CTRLREG((line), 0)
 #define SBD_INT(line)           (K_BCM1480_INT_UART_0 + (line))
+#define DUART_CHANREG_SPACING   BCM1480_DUART_CHANREG_SPACING
+#define R_DUART_IMRREG(line)    R_BCM1480_DUART_IMRREG(line)
+#define R_DUART_INCHREG(line)   R_BCM1480_DUART_INCHREG(line)
+#define R_DUART_ISRREG(line)    R_BCM1480_DUART_ISRREG(line)
 #elif defined(CONFIG_SIBYTE_SB1250) || defined(CONFIG_SIBYTE_BCM112X)
 #include <asm/sibyte/sb1250_regs.h>
 #include <asm/sibyte/sb1250_int.h>
diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c
index fcbf1b8a5264..32cda77b31cd 100644
--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -384,11 +384,8 @@ irqreturn_t mpc83xx_spi_irq(s32 irq, void *context_data)
        mpc83xx_spi->count -= 1;
        if (mpc83xx_spi->count) {
-                if (mpc83xx_spi->tx) {
+                u32 word = mpc83xx_spi->get_tx(mpc83xx_spi);
-                        u32 word = mpc83xx_spi->get_tx(mpc83xx_spi);
+                mpc83xx_spi_write_reg(&mpc83xx_spi->base->transmit, word);
-                        mpc83xx_spi_write_reg(&mpc83xx_spi->base->transmit,
-                                              word);
-                }
        } else {
                complete(&mpc83xx_spi->done);
        }
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index a1ad11d0c47c..63b1243a9139 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -60,7 +60,7 @@ ssize_t usb_store_new_id(struct usb_dynids *dynids,
        dynid->id.match_flags = USB_DEVICE_ID_MATCH_DEVICE;
        spin_lock(&dynids->lock);
-        list_add_tail(&dynids->list, &dynid->node);
+        list_add_tail(&dynid->node, &dynids->list);
        spin_unlock(&dynids->lock);
        if (get_driver(driver)) {
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 9e467118dc94..ebf3dc20110a 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -28,10 +28,16 @@
 * devices is broken...
 */
 static const struct usb_device_id usb_quirk_list[] = {
+        /* CBM - Flash disk */
+        { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
        /* HP 5300/5370C scanner */
        { USB_DEVICE(0x03f0, 0x0701), .driver_info = USB_QUIRK_STRING_FETCH_255 },
        /* Hewlett-Packard PhotoSmart 720 / PhotoSmart 935 (storage) */
        { USB_DEVICE(0x03f0, 0x4002), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+        /* SGS Thomson Microelectronics 4in1 card reader */
+        { USB_DEVICE(0x0483, 0x0321), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
        /* Acer Peripherals Inc. (now BenQ Corp.) Prisa 640BU */
        { USB_DEVICE(0x04a5, 0x207e), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
        /* Benq S2W 3300U */
@@ -66,6 +72,19 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
        /* Ultima Electronics Corp.*/
        { USB_DEVICE(0x05d8, 0x4005), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+        /* Genesys USB-to-IDE */
+        { USB_DEVICE(0x0503, 0x0702), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+        /* USB Graphical LCD - EEH Datalink GmbH */
+        { USB_DEVICE(0x060c, 0x04eb), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+        /* INTEL VALUE SSD */
+        { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* M-Systems Flash Disk Pioneers */
+        { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
        /* Agfa Snapscan1212u */
        { USB_DEVICE(0x06bd, 0x2061), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
        /* Seagate RSS LLC */
@@ -87,6 +106,12 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x0fca, 0x0004), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
        { USB_DEVICE(0x0fca, 0x0006), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+        /* Apple iPhone */
+        { USB_DEVICE(0x05ac, 0x1290), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
+        /* SKYMEDI USB_DRIVE */
+        { USB_DEVICE(0x1516, 0x8628), .driver_info = USB_QUIRK_RESET_RESUME },
        { }  /* terminating entry must be last */
 };
@@ -127,4 +152,10 @@ void usb_detect_quirks(struct usb_device *udev)
        /* do any special quirk handling here if needed */
        if (udev->quirks & USB_QUIRK_NO_AUTOSUSPEND)
                usb_autosuspend_quirk(udev);
+        /* By default, disable autosuspend for all non-hubs */
+#ifdef  CONFIG_USB_SUSPEND
+        if (udev->descriptor.bDeviceClass != USB_CLASS_HUB)
+                udev->autosuspend_delay = -1;
+#endif
 }
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index 9cd98e73dc1d..ce4d2e09633d 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -1691,14 +1691,12 @@ static int gs_setup_class(struct usb_gadget *gadget,
        switch (ctrl->bRequest) {
        case USB_CDC_REQ_SET_LINE_CODING:
-                ret = min(wLength,
+                /* FIXME Submit req to read the data; have its completion
-                        (u16)sizeof(struct usb_cdc_line_coding));
+                 * handler copy that data to port->port_line_coding (iff
-                if (port) {
+                 * it's valid) and maybe pass it on.  Until then, fail.
-                        spin_lock(&port->port_lock);
+                 */
-                        memcpy(&port->port_line_coding, req->buf, ret);
+                printk(KERN_WARNING "gs_setup: set_line_coding "
-                        spin_unlock(&port->port_lock);
+                                "unuspported\n");
-                }
-                ret = 0;
                break;
        case USB_CDC_REQ_GET_LINE_CODING:
@@ -1713,11 +1711,18 @@ static int gs_setup_class(struct usb_gadget *gadget,
                break;
        case USB_CDC_REQ_SET_CONTROL_LINE_STATE:
-                ret = 0;
+                /* FIXME Submit req to read the data; have its completion
+                 * handler use that to set the state (iff it's valid) and
+                 * maybe pass it on.  Until then, fail.
+                 */
+                printk(KERN_WARNING "gs_setup: set_control_line_state "
+                                "unuspported\n");
                break;
        default:
-                printk(KERN_ERR "gs_setup: unknown class request, type=%02x, request=%02x, value=%04x, index=%04x, length=%d\n",
+                printk(KERN_ERR "gs_setup: unknown class request, "
+                                "type=%02x, request=%02x, value=%04x, "
+                                "index=%04x, length=%d\n",
                        ctrl->bRequestType, ctrl->bRequest,
                        wValue, wIndex, wLength);
                break;
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 9f37ba44c132..b64ca91d9b02 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3404,6 +3404,7 @@ static void sisusb_disconnect(struct usb_interface *intf)
 }
 static struct usb_device_id sisusb_table [] = {
+        { USB_DEVICE(0x0711, 0x0550) },
        { USB_DEVICE(0x0711, 0x0900) },
        { USB_DEVICE(0x0711, 0x0901) },
        { USB_DEVICE(0x0711, 0x0902) },
diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
index c08a38402b93..a47a24f8820d 100644
--- a/drivers/usb/serial/bus.c
+++ b/drivers/usb/serial/bus.c
@@ -138,7 +138,7 @@ static void free_dynids(struct usb_serial_driver *drv)
 static struct driver_attribute drv_attrs[] = {
        __ATTR_NULL,
 };
-static inline void free_dynids(struct usb_driver *drv)
+static inline void free_dynids(struct usb_serial_driver *drv)
 {
 }
 #endif
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1370c423d7c2..2d045857b181 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -568,6 +568,7 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(ELEKTOR_VID, ELEKTOR_FT323R_PID) },
        { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
+        { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
        { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
                .driver_info = (kernel_ulong_t)&ftdi_olimex_quirk },
        { },                                    /* Optional parameter entry */
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index c70e1de6389e..b57b90ae9f9d 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -534,6 +534,14 @@
 #define OLIMEX_VID                      0x15BA
 #define OLIMEX_ARM_USB_OCD_PID          0x0003
+/*
+ * The Mobility Lab (TML)
+ * Submitted by Pierre Castella
+ */
+#define TML_VID                 0x1B91  /* Vendor ID */
+#define TML_USB_SERIAL_PID      0x0064  /* USB - Serial Converter */
 /* Commands */
 #define FTDI_SIO_RESET          0 /* Reset the port */
 #define FTDI_SIO_MODEM_CTRL     1 /* Set the modem control register */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 4cb3c165742b..a18659e0700c 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -108,6 +108,7 @@ static int  option_send_setup(struct usb_serial_port *port);
 #define HUAWEI_VENDOR_ID                        0x12D1
 #define HUAWEI_PRODUCT_E600                     0x1001
 #define HUAWEI_PRODUCT_E220                     0x1003
+#define HUAWEI_PRODUCT_E220BIS                  0x1004
 #define NOVATELWIRELESS_VENDOR_ID               0x1410
 #define DELL_VENDOR_ID                          0x413C
@@ -158,6 +159,7 @@ static struct usb_device_id option_ids[] = {
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_KOI_NETWORK) },
        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220) },
+        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220BIS) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1100) }, /* Novatel Merlin XS620/S640 */
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1110) }, /* Novatel Merlin S620 */
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1120) }, /* Novatel Merlin EX720 */
@@ -176,6 +178,7 @@ static struct usb_device_id option_ids[] = {
        { USB_DEVICE(DELL_VENDOR_ID, 0x8117) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO ExpressCard == Novatel Merlin XV620 CDMA/EV-DO */
        { USB_DEVICE(DELL_VENDOR_ID, 0x8118) }, /* Dell Wireless 5510 Mobile Broadband HSDPA ExpressCard == Novatel Merlin XU870 HSDPA/3G */
        { USB_DEVICE(DELL_VENDOR_ID, 0x8128) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite E720 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, 0x8137) }, /* Dell Wireless HSDPA 5520 */
        { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },
        { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
        { USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_1) },
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index 833ada47fc54..64f3f66a7a35 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -817,21 +817,6 @@ static int oti6858_ioctl(struct usb_serial_port *port, struct file *file,
                                __FUNCTION__, port->number, cmd, arg);
        switch (cmd) {
-                case TCGETS:
-                        if (kernel_termios_to_user_termios((struct ktermios __user *)arg,
-                                                           port->tty->termios))
-                                return -EFAULT;
-                        return 0;
-                case TCSETS:
-                case TCSETSW:   /* FIXME: this is not the same! */
-                case TCSETSF:   /* FIXME: this is not the same! */
-                        if (user_termios_to_kernel_termios(port->tty->termios,
-                                                (struct ktermios __user *)arg))
-                                return -EFAULT;
-                        oti6858_set_termios(port, NULL);
-                        return 0;
                case TCFLSH:
                        /* FIXME */
                        return 0;
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 47e56079925d..1ba19eaa1970 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -285,15 +285,10 @@ static int device_reset(struct scsi_cmnd *srb)
        US_DEBUGP("%s called\n", __FUNCTION__);
-        result = usb_autopm_get_interface(us->pusb_intf);
+        /* lock the device pointers and do the reset */
-        if (result == 0) {
+        mutex_lock(&(us->dev_mutex));
+        result = us->transport_reset(us);
-                /* lock the device pointers and do the reset */
+        mutex_unlock(&us->dev_mutex);
-                mutex_lock(&(us->dev_mutex));
-                result = us->transport_reset(us);
-                mutex_unlock(&us->dev_mutex);
-                usb_autopm_put_interface(us->pusb_intf);
-        }
        return result < 0 ? FAILED : SUCCESS;
 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 2d92ce31018f..c6b78ba815ea 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -348,6 +348,13 @@ UNUSUAL_DEV(  0x04b0, 0x0411, 0x0100, 0x0101,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_FIX_CAPACITY),
+/* Reported by Ortwin Glueck <odi@odi.ch> */
+UNUSUAL_DEV(  0x04b0, 0x0413, 0x0110, 0x0110,
+                "NIKON",
+                "NIKON DSC D40",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY),
 /* BENQ DC5330
 * Reported by Manuel Fombuena <mfombuena@ya.com> and
 * Frank Copeland <fjc@thingy.apana.org.au> */
@@ -897,6 +904,22 @@ UNUSUAL_DEV(  0x069b, 0x3004, 0x0001, 0x0001,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_FIX_CAPACITY ),
+/* Reported by Massimiliano Ghilardi <massimiliano.ghilardi@gmail.com>
+ * This USB MP3/AVI player device fails and disconnects if more than 128
+ * sectors (64kB) are read/written in a single command, and may be present
+ * at least in the following products:
+ *   "Magnex Digital Video Panel DVP 1800"
+ *   "MP4 AIGO 4GB SLOT SD"
+ *   "Teclast TL-C260 MP3"
+ *   "i.Meizu PMP MP3/MP4"
+ *   "Speed MV8 MP4 Audio Player"
+ */
+UNUSUAL_DEV(  0x071b, 0x3203, 0x0100, 0x0100,
+                "RockChip",
+                "ROCK MP3",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64),
 /* Reported by Olivier Blondeau <zeitoun@gmail.com> */
 UNUSUAL_DEV(  0x0727, 0x0306, 0x0100, 0x0100,
                "ATMEL",
@@ -1393,6 +1416,13 @@ UNUSUAL_DEV(  0x0fce, 0xe030, 0x0000, 0x0000,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_FIX_CAPACITY | US_FL_IGNORE_RESIDUE ),
+/* Reported by Ricardo Barberis <ricardo@dattatec.com> */
+UNUSUAL_DEV(  0x0fce, 0xe092, 0x0000, 0x0000,
+                "Sony Ericsson",
+                "P1i",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE ),
 /* Reported by Emmanuel Vasilakis <evas@forthnet.gr> */
 UNUSUAL_DEV(  0x0fce, 0xe031, 0x0000, 0x0000,
                "Sony Ericsson",
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 25e557d4fe6b..59181667066c 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -184,14 +184,16 @@ static int storage_suspend(struct usb_interface *iface, pm_message_t message)
 {
        struct us_data *us = usb_get_intfdata(iface);
-        US_DEBUGP("%s\n", __FUNCTION__);
        /* Wait until no command is running */
        mutex_lock(&us->dev_mutex);
+        US_DEBUGP("%s\n", __FUNCTION__);
        if (us->suspend_resume_hook)
                (us->suspend_resume_hook)(us, US_SUSPEND);
+        /* When runtime PM is working, we'll set a flag to indicate
+         * whether we should autoresume when a SCSI request arrives. */
        mutex_unlock(&us->dev_mutex);
        return 0;
 }
@@ -200,11 +202,13 @@ static int storage_resume(struct usb_interface *iface)
 {
        struct us_data *us = usb_get_intfdata(iface);
-        US_DEBUGP("%s\n", __FUNCTION__);
+        mutex_lock(&us->dev_mutex);
+        US_DEBUGP("%s\n", __FUNCTION__);
        if (us->suspend_resume_hook)
                (us->suspend_resume_hook)(us, US_RESUME);
+        mutex_unlock(&us->dev_mutex);
        return 0;
 }
@@ -302,7 +306,6 @@ static int usb_stor_control_thread(void * __us)
 {
        struct us_data *us = (struct us_data *)__us;
        struct Scsi_Host *host = us_to_host(us);
-        int autopm_rc;
        for(;;) {
                US_DEBUGP("*** thread sleeping.\n");
@@ -311,9 +314,6 @@ static int usb_stor_control_thread(void * __us)
                        
                US_DEBUGP("*** thread awakened.\n");
-                /* Autoresume the device */
-                autopm_rc = usb_autopm_get_interface(us->pusb_intf);
                /* lock the device pointers */
                mutex_lock(&(us->dev_mutex));
@@ -372,12 +372,6 @@ static int usb_stor_control_thread(void * __us)
                        us->srb->result = SAM_STAT_GOOD;
                }
-                /* Did the autoresume fail? */
-                else if (autopm_rc < 0) {
-                        US_DEBUGP("Could not wake device\n");
-                        us->srb->result = DID_ERROR << 16;
-                }
                /* we've got a command, let's do it! */
                else {
                        US_DEBUG(usb_stor_show_command(us->srb));
@@ -420,10 +414,6 @@ SkipForAbort:
                /* unlock the device pointers */
                mutex_unlock(&us->dev_mutex);
-                /* Start an autosuspend */
-                if (autopm_rc == 0)
-                        usb_autopm_put_interface(us->pusb_intf);
        } /* for (;;) */
        /* Wait until we are told to stop */
@@ -941,7 +931,6 @@ retry:
                /* Should we unbind if no devices were detected? */
        }
-        usb_autopm_put_interface(us->pusb_intf);
        complete_and_exit(&us->scanning_done, 0);
 }
@@ -1027,7 +1016,6 @@ static int storage_probe(struct usb_interface *intf,
                goto BadDevice;
        }
-        usb_autopm_get_interface(intf); /* dropped in the scanning thread */
        wake_up_process(th);
        return 0;
@@ -1065,7 +1053,6 @@ static struct usb_driver usb_storage_driver = {
        .pre_reset =    storage_pre_reset,
        .post_reset =   storage_post_reset,
        .id_table =     storage_usb_ids,
-        .supports_autosuspend = 1,
 };
 static int __init usb_stor_init(void)
diff --git a/drivers/video/aty/ati_ids.h b/drivers/video/aty/ati_ids.h
index 685a754991c6..dca2eb8f2dde 100644
--- a/drivers/video/aty/ati_ids.h
+++ b/drivers/video/aty/ati_ids.h
@@ -192,6 +192,12 @@
 #define PCI_CHIP_RS300_5835             0x5835
 #define PCI_CHIP_RS300_5836             0x5836
 #define PCI_CHIP_RS300_5837             0x5837
+#define PCI_CHIP_RS480_5955             0x5955
+#define PCI_CHIP_RV280_5960             0x5960
+#define PCI_CHIP_RV280_5961             0x5961
+#define PCI_CHIP_RV280_5962             0x5962
+#define PCI_CHIP_RV280_5964             0x5964
+#define PCI_CHIP_RS482_5975             0x5975
 #define PCI_CHIP_RV370_5B60             0x5B60
 #define PCI_CHIP_RV370_5B61             0x5B61
 #define PCI_CHIP_RV370_5B62             0x5B62
@@ -200,14 +206,8 @@
 #define PCI_CHIP_RV370_5B65             0x5B65
 #define PCI_CHIP_RV370_5B66             0x5B66
 #define PCI_CHIP_RV370_5B67             0x5B67
-#define PCI_CHIP_RV280_5960             0x5960
-#define PCI_CHIP_RV280_5961             0x5961
-#define PCI_CHIP_RV280_5962             0x5962
-#define PCI_CHIP_RV280_5964             0x5964
-#define PCI_CHIP_RS485_5975             0x5975
 #define PCI_CHIP_RV280_5C61             0x5C61
 #define PCI_CHIP_RV280_5C63             0x5C63
 #define PCI_CHIP_R423_5D57              0x5D57
 #define PCI_CHIP_RS350_7834             0x7834
 #define PCI_CHIP_RS350_7835             0x7835
-#define PCI_CHIP_RS480_5955             0x5955
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 47ca62fe7c3e..4b747bdaeea6 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -102,6 +102,7 @@
 static struct pci_device_id radeonfb_pci_table[] = {
        /* Radeon Xpress 200m */
        CHIP_DEF(PCI_CHIP_RS480_5955,   RS480,  CHIP_HAS_CRTC2 | CHIP_IS_IGP | CHIP_IS_MOBILITY),
+        CHIP_DEF(PCI_CHIP_RS482_5975,   RS480,  CHIP_HAS_CRTC2 | CHIP_IS_IGP | CHIP_IS_MOBILITY),
        /* Mobility M6 */
        CHIP_DEF(PCI_CHIP_RADEON_LY,    RV100,  CHIP_HAS_CRTC2 | CHIP_IS_MOBILITY),
        CHIP_DEF(PCI_CHIP_RADEON_LZ,    RV100,  CHIP_HAS_CRTC2 | CHIP_IS_MOBILITY),
@@ -153,8 +154,6 @@ static struct pci_device_id radeonfb_pci_table[] = {
        /* Mobility 9200 (M9+) */
        CHIP_DEF(PCI_CHIP_RV280_5C61,   RV280,  CHIP_HAS_CRTC2 | CHIP_IS_MOBILITY),
        CHIP_DEF(PCI_CHIP_RV280_5C63,   RV280,  CHIP_HAS_CRTC2 | CHIP_IS_MOBILITY),
-        /*Mobility Xpress 200 */
-        CHIP_DEF(PCI_CHIP_RS485_5975,   R300,   CHIP_HAS_CRTC2 | CHIP_IS_IGP | CHIP_IS_MOBILITY),
        /* 9200 */
        CHIP_DEF(PCI_CHIP_RV280_5960,   RV280,  CHIP_HAS_CRTC2),
        CHIP_DEF(PCI_CHIP_RV280_5961,   RV280,  CHIP_HAS_CRTC2),
@@ -1285,7 +1284,8 @@ static void radeon_write_pll_regs(struct radeonfb_info *rinfo, struct radeon_reg
        if (rinfo->family == CHIP_FAMILY_R300 ||
            rinfo->family == CHIP_FAMILY_RS300 ||
            rinfo->family == CHIP_FAMILY_R350 ||
-            rinfo->family == CHIP_FAMILY_RV350) {
+            rinfo->family == CHIP_FAMILY_RV350 ||
+            rinfo->family == CHIP_FAMILY_RV380 ) {
                if (mode->ppll_ref_div & R300_PPLL_REF_DIV_ACC_MASK) {
                        /* When restoring console mode, use saved PPLL_REF_DIV
                         * setting.
diff --git a/drivers/video/intelfb/intelfbhw.c b/drivers/video/intelfb/intelfbhw.c
index 16bc8d75e36e..b21d0dec9283 100644
--- a/drivers/video/intelfb/intelfbhw.c
+++ b/drivers/video/intelfb/intelfbhw.c
@@ -924,10 +924,10 @@ calc_pll_params(int index, int clock, u32 *retm1, u32 *retm2, u32 *retn, u32 *re
                        if (m > pll->max_m)
                                m = pll->max_m - 1;
                        for (testm = m - 1; testm <= m; testm++) {
-                                f_out = calc_vclock3(index, m, n, p);
+                                f_out = calc_vclock3(index, testm, n, p);
                                if (splitm(index, testm, &m1, &m2)) {
-                                        WRN_MSG("cannot split m = %d\n", m);
+                                        WRN_MSG("cannot split m = %d\n",
-                                        n++;
+                                                testm);
                                        continue;
                                }
                                if (clock > f_out)
diff --git a/fs/Kconfig b/fs/Kconfig
index 58a0650293e1..f9eed6d79066 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -441,9 +441,6 @@ config OCFS2_FS
          Note: Features which OCFS2 does not support yet:
                  - extended attributes
-                  - shared writeable mmap
-                  - loopback is supported, but data written will not
-                    be cluster coherent.
                  - quotas
                  - cluster aware flock
                  - Directory change notification (F_NOTIFY)
diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c
index a3684dcc76e7..6f8c96fb29eb 100644
--- a/fs/afs/mntpt.c
+++ b/fs/afs/mntpt.c
@@ -235,8 +235,8 @@ static void *afs_mntpt_follow_link(struct dentry *dentry, struct nameidata *nd)
        err = do_add_mount(newmnt, nd, MNT_SHRINKABLE, &afs_vfsmounts);
        switch (err) {
        case 0:
-                mntput(nd->mnt);
                dput(nd->dentry);
+                mntput(nd->mnt);
                nd->mnt = newmnt;
                nd->dentry = dget(newmnt->mnt_root);
                schedule_delayed_work(&afs_mntpt_expiry_timer,
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 22cfdd61c060..9537316a0714 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -2578,8 +2578,11 @@ static int ext3_release_dquot(struct dquot *dquot)
        handle = ext3_journal_start(dquot_to_inode(dquot),
                                        EXT3_QUOTA_DEL_BLOCKS(dquot->dq_sb));
-        if (IS_ERR(handle))
+        if (IS_ERR(handle)) {
+                /* Release dquot anyway to avoid endless cycle in dqput() */
+                dquot_release(dquot);
                return PTR_ERR(handle);
+        }
        ret = dquot_release(dquot);
        err = ext3_journal_stop(handle);
        if (!ret)
@@ -2712,6 +2715,12 @@ static ssize_t ext3_quota_write(struct super_block *sb, int type,
        struct buffer_head *bh;
        handle_t *handle = journal_current_handle();
+        if (!handle) {
+                printk(KERN_WARNING "EXT3-fs: Quota write (off=%Lu, len=%Lu)"
+                        " cancelled because transaction is not started.\n",
+                        (unsigned long long)off, (unsigned long long)len);
+                return -EIO;
+        }
        mutex_lock_nested(&inode->i_mutex, I_MUTEX_QUOTA);
        while (towrite > 0) {
                tocopy = sb->s_blocksize - offset < towrite ?
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 4550b83ab1c9..3c1397fa83df 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2698,8 +2698,11 @@ static int ext4_release_dquot(struct dquot *dquot)
        handle = ext4_journal_start(dquot_to_inode(dquot),
                                        EXT4_QUOTA_DEL_BLOCKS(dquot->dq_sb));
-        if (IS_ERR(handle))
+        if (IS_ERR(handle)) {
+                /* Release dquot anyway to avoid endless cycle in dqput() */
+                dquot_release(dquot);
                return PTR_ERR(handle);
+        }
        ret = dquot_release(dquot);
        err = ext4_journal_stop(handle);
        if (!ret)
@@ -2832,6 +2835,12 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
        struct buffer_head *bh;
        handle_t *handle = journal_current_handle();
+        if (!handle) {
+                printk(KERN_WARNING "EXT4-fs: Quota write (off=%Lu, len=%Lu)"
+                        " cancelled because transaction is not started.\n",
+                        (unsigned long long)off, (unsigned long long)len);
+                return -EIO;
+        }
        mutex_lock_nested(&inode->i_mutex, I_MUTEX_QUOTA);
        while (towrite > 0) {
                tocopy = sb->s_blocksize - offset < towrite ?
diff --git a/fs/locks.c b/fs/locks.c
index 50857d2d3404..c795eaaf6c4c 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -782,7 +782,7 @@ find_conflict:
        if (request->fl_flags & FL_ACCESS)
                goto out;
        locks_copy_lock(new_fl, request);
-        locks_insert_lock(&inode->i_flock, new_fl);
+        locks_insert_lock(before, new_fl);
        new_fl = NULL;
        error = 0;
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 4f517665c9a0..778a850b4634 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -5602,6 +5602,7 @@ static int ocfs2_do_truncate(struct ocfs2_super *osb,
                                      clusters_to_del;
        spin_unlock(&OCFS2_I(inode)->ip_lock);
        le32_add_cpu(&fe->i_clusters, -clusters_to_del);
+        inode->i_blocks = ocfs2_inode_sector_count(inode);
        status = ocfs2_trim_tree(inode, path, handle, tc,
                                 clusters_to_del, &delete_blk);
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 460d440310f2..50cd8a209012 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -855,6 +855,7 @@ static int ocfs2_alloc_write_ctxt(struct ocfs2_write_ctxt **wcp,
                                  struct ocfs2_super *osb, loff_t pos,
                                  unsigned len, struct buffer_head *di_bh)
 {
+        u32 cend;
        struct ocfs2_write_ctxt *wc;
        wc = kzalloc(sizeof(struct ocfs2_write_ctxt), GFP_NOFS);
@@ -862,7 +863,8 @@ static int ocfs2_alloc_write_ctxt(struct ocfs2_write_ctxt **wcp,
                return -ENOMEM;
        wc->w_cpos = pos >> osb->s_clustersize_bits;
-        wc->w_clen = ocfs2_clusters_for_bytes(osb->sb, len);
+        cend = (pos + len - 1) >> osb->s_clustersize_bits;
+        wc->w_clen = cend - wc->w_cpos + 1;
        get_bh(di_bh);
        wc->w_di_bh = di_bh;
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 4ffa715be09c..7e34e66159c6 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -314,7 +314,6 @@ static int ocfs2_orphan_for_truncate(struct ocfs2_super *osb,
        }
        i_size_write(inode, new_i_size);
-        inode->i_blocks = ocfs2_align_bytes_to_sectors(new_i_size);
        inode->i_ctime = inode->i_mtime = CURRENT_TIME;
        di = (struct ocfs2_dinode *) fe_bh->b_data;
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index f2fc9a795deb..c034b5129c1e 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -81,8 +81,15 @@ static struct dentry *ocfs2_debugfs_root = NULL;
 MODULE_AUTHOR("Oracle");
 MODULE_LICENSE("GPL");
+struct mount_options
+{
+        unsigned long   mount_opt;
+        unsigned int    atime_quantum;
+        signed short    slot;
+};
 static int ocfs2_parse_options(struct super_block *sb, char *options,
-                               unsigned long *mount_opt, s16 *slot,
+                               struct mount_options *mopt,
                               int is_remount);
 static void ocfs2_put_super(struct super_block *sb);
 static int ocfs2_mount_volume(struct super_block *sb);
@@ -367,24 +374,23 @@ static int ocfs2_remount(struct super_block *sb, int *flags, char *data)
 {
        int incompat_features;
        int ret = 0;
-        unsigned long parsed_options;
+        struct mount_options parsed_options;
-        s16 slot;
        struct ocfs2_super *osb = OCFS2_SB(sb);
-        if (!ocfs2_parse_options(sb, data, &parsed_options, &slot, 1)) {
+        if (!ocfs2_parse_options(sb, data, &parsed_options, 1)) {
                ret = -EINVAL;
                goto out;
        }
        if ((osb->s_mount_opt & OCFS2_MOUNT_HB_LOCAL) !=
-            (parsed_options & OCFS2_MOUNT_HB_LOCAL)) {
+            (parsed_options.mount_opt & OCFS2_MOUNT_HB_LOCAL)) {
                ret = -EINVAL;
                mlog(ML_ERROR, "Cannot change heartbeat mode on remount\n");
                goto out;
        }
        if ((osb->s_mount_opt & OCFS2_MOUNT_DATA_WRITEBACK) !=
-            (parsed_options & OCFS2_MOUNT_DATA_WRITEBACK)) {
+            (parsed_options.mount_opt & OCFS2_MOUNT_DATA_WRITEBACK)) {
                ret = -EINVAL;
                mlog(ML_ERROR, "Cannot change data mode on remount\n");
                goto out;
@@ -435,7 +441,9 @@ unlock_osb:
                /* Only save off the new mount options in case of a successful
                 * remount. */
-                osb->s_mount_opt = parsed_options;
+                osb->s_mount_opt = parsed_options.mount_opt;
+                osb->s_atime_quantum = parsed_options.atime_quantum;
+                osb->preferred_slot = parsed_options.slot;
        }
 out:
        return ret;
@@ -547,8 +555,7 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
 {
        struct dentry *root;
        int status, sector_size;
-        unsigned long parsed_opt;
+        struct mount_options parsed_options;
-        s16 slot;
        struct inode *inode = NULL;
        struct ocfs2_super *osb = NULL;
        struct buffer_head *bh = NULL;
@@ -556,14 +563,14 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
        mlog_entry("%p, %p, %i", sb, data, silent);
-        if (!ocfs2_parse_options(sb, data, &parsed_opt, &slot, 0)) {
+        if (!ocfs2_parse_options(sb, data, &parsed_options, 0)) {
                status = -EINVAL;
                goto read_super_error;
        }
        /* for now we only have one cluster/node, make sure we see it
         * in the heartbeat universe */
-        if (parsed_opt & OCFS2_MOUNT_HB_LOCAL) {
+        if (parsed_options.mount_opt & OCFS2_MOUNT_HB_LOCAL) {
                if (!o2hb_check_local_node_heartbeating()) {
                        status = -EINVAL;
                        goto read_super_error;
@@ -585,8 +592,9 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
        }
        brelse(bh);
        bh = NULL;
-        osb->s_mount_opt = parsed_opt;
+        osb->s_mount_opt = parsed_options.mount_opt;
-        osb->preferred_slot = slot;
+        osb->s_atime_quantum = parsed_options.atime_quantum;
+        osb->preferred_slot = parsed_options.slot;
        sb->s_magic = OCFS2_SUPER_MAGIC;
@@ -728,8 +736,7 @@ static struct file_system_type ocfs2_fs_type = {
 static int ocfs2_parse_options(struct super_block *sb,
                               char *options,
-                               unsigned long *mount_opt,
+                               struct mount_options *mopt,
-                               s16 *slot,
                               int is_remount)
 {
        int status;
@@ -738,8 +745,9 @@ static int ocfs2_parse_options(struct super_block *sb,
        mlog_entry("remount: %d, options: \"%s\"\n", is_remount,
                   options ? options : "(none)");
-        *mount_opt = 0;
+        mopt->mount_opt = 0;
-        *slot = OCFS2_INVALID_SLOT;
+        mopt->atime_quantum = OCFS2_DEFAULT_ATIME_QUANTUM;
+        mopt->slot = OCFS2_INVALID_SLOT;
        if (!options) {
                status = 1;
@@ -749,7 +757,6 @@ static int ocfs2_parse_options(struct super_block *sb,
        while ((p = strsep(&options, ",")) != NULL) {
                int token, option;
                substring_t args[MAX_OPT_ARGS];
-                struct ocfs2_super * osb = OCFS2_SB(sb);
                if (!*p)
                        continue;
@@ -757,10 +764,10 @@ static int ocfs2_parse_options(struct super_block *sb,
                token = match_token(p, tokens, args);
                switch (token) {
                case Opt_hb_local:
-                        *mount_opt |= OCFS2_MOUNT_HB_LOCAL;
+                        mopt->mount_opt |= OCFS2_MOUNT_HB_LOCAL;
                        break;
                case Opt_hb_none:
-                        *mount_opt &= ~OCFS2_MOUNT_HB_LOCAL;
+                        mopt->mount_opt &= ~OCFS2_MOUNT_HB_LOCAL;
                        break;
                case Opt_barrier:
                        if (match_int(&args[0], &option)) {
@@ -768,27 +775,27 @@ static int ocfs2_parse_options(struct super_block *sb,
                                goto bail;
                        }
                        if (option)
-                                *mount_opt |= OCFS2_MOUNT_BARRIER;
+                                mopt->mount_opt |= OCFS2_MOUNT_BARRIER;
                        else
-                                *mount_opt &= ~OCFS2_MOUNT_BARRIER;
+                                mopt->mount_opt &= ~OCFS2_MOUNT_BARRIER;
                        break;
                case Opt_intr:
-                        *mount_opt &= ~OCFS2_MOUNT_NOINTR;
+                        mopt->mount_opt &= ~OCFS2_MOUNT_NOINTR;
                        break;
                case Opt_nointr:
-                        *mount_opt |= OCFS2_MOUNT_NOINTR;
+                        mopt->mount_opt |= OCFS2_MOUNT_NOINTR;
                        break;
                case Opt_err_panic:
-                        *mount_opt |= OCFS2_MOUNT_ERRORS_PANIC;
+                        mopt->mount_opt |= OCFS2_MOUNT_ERRORS_PANIC;
                        break;
                case Opt_err_ro:
-                        *mount_opt &= ~OCFS2_MOUNT_ERRORS_PANIC;
+                        mopt->mount_opt &= ~OCFS2_MOUNT_ERRORS_PANIC;
                        break;
                case Opt_data_ordered:
-                        *mount_opt &= ~OCFS2_MOUNT_DATA_WRITEBACK;
+                        mopt->mount_opt &= ~OCFS2_MOUNT_DATA_WRITEBACK;
                        break;
                case Opt_data_writeback:
-                        *mount_opt |= OCFS2_MOUNT_DATA_WRITEBACK;
+                        mopt->mount_opt |= OCFS2_MOUNT_DATA_WRITEBACK;
                        break;
                case Opt_atime_quantum:
                        if (match_int(&args[0], &option)) {
@@ -796,9 +803,7 @@ static int ocfs2_parse_options(struct super_block *sb,
                                goto bail;
                        }
                        if (option >= 0)
-                                osb->s_atime_quantum = option;
+                                mopt->atime_quantum = option;
-                        else
-                                osb->s_atime_quantum = OCFS2_DEFAULT_ATIME_QUANTUM;
                        break;
                case Opt_slot:
                        option = 0;
@@ -807,7 +812,7 @@ static int ocfs2_parse_options(struct super_block *sb,
                                goto bail;
                        }
                        if (option)
-                                *slot = (s16)option;
+                                mopt->slot = (s16)option;
                        break;
                default:
                        mlog(ML_ERROR,
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index a5b0dfd89a17..0e4d37c93eea 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -11,6 +11,7 @@
 #include <linux/string.h>
 #include <linux/stat.h>
 #include <linux/completion.h>
+#include <linux/poll.h>
 #include <linux/file.h>
 #include <linux/limits.h>
 #include <linux/init.h>
@@ -232,7 +233,7 @@ static ssize_t proc_reg_write(struct file *file, const char __user *buf, size_t
 static unsigned int proc_reg_poll(struct file *file, struct poll_table_struct *pts)
 {
        struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
-        unsigned int rv = 0;
+        unsigned int rv = DEFAULT_POLLMASK;
        unsigned int (*poll)(struct file *, struct poll_table_struct *);
        spin_lock(&pde->pde_unload_lock);
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 5b68dd3f191a..a005451930b7 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1915,8 +1915,11 @@ static int reiserfs_release_dquot(struct dquot *dquot)
        ret =
            journal_begin(&th, dquot->dq_sb,
                          REISERFS_QUOTA_DEL_BLOCKS(dquot->dq_sb));
-        if (ret)
+        if (ret) {
+                /* Release dquot anyway to avoid endless cycle in dqput() */
+                dquot_release(dquot);
                goto out;
+        }
        ret = dquot_release(dquot);
        err =
            journal_end(&th, dquot->dq_sb,
@@ -2067,6 +2070,12 @@ static ssize_t reiserfs_quota_write(struct super_block *sb, int type,
        size_t towrite = len;
        struct buffer_head tmp_bh, *bh;
+        if (!current->journal_info) {
+                printk(KERN_WARNING "reiserfs: Quota write (off=%Lu, len=%Lu)"
+                        " cancelled because transaction is not started.\n",
+                        (unsigned long long)off, (unsigned long long)len);
+                return -EIO;
+        }
        mutex_lock_nested(&inode->i_mutex, I_MUTEX_QUOTA);
        while (towrite > 0) {
                tocopy = sb->s_blocksize - offset < towrite ?
@@ -2098,7 +2107,7 @@ static ssize_t reiserfs_quota_write(struct super_block *sb, int type,
                data += tocopy;
                blk++;
        }
-      out:
+out:
        if (len == towrite)
                return err;
        if (inode->i_size < off + len - towrite)
diff --git a/fs/select.c b/fs/select.c
index a974082b0824..46dca31c607a 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -26,8 +26,6 @@
 #include <asm/uaccess.h>
-#define DEFAULT_POLLMASK (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM)
 struct poll_table_page {
        struct poll_table_page * next;
        struct poll_table_entry * entry;
diff --git a/include/asm-generic/termios.h b/include/asm-generic/termios.h
index 3769e6bd63b1..33dca30a3c45 100644
--- a/include/asm-generic/termios.h
+++ b/include/asm-generic/termios.h
@@ -63,6 +63,8 @@ static inline int kernel_termios_to_user_termio(struct termio __user *termio,
 #define user_termios_to_kernel_termios(k, u) copy_from_user(k, u, sizeof(struct termios))
 #define kernel_termios_to_user_termios(u, k) copy_to_user(u, k, sizeof(struct termios))
+#define user_termios_to_kernel_termios_1(k, u) copy_from_user(k, u, sizeof(struct termios))
+#define kernel_termios_to_user_termios_1(u, k) copy_to_user(u, k, sizeof(struct termios))
 #endif  /* __ARCH_TERMIO_GETPUT */
diff --git a/include/asm-m68k/unistd.h b/include/asm-m68k/unistd.h
index fdbb60e6a0d4..a30fe9c64143 100644
--- a/include/asm-m68k/unistd.h
+++ b/include/asm-m68k/unistd.h
@@ -313,10 +313,20 @@
 #define __NR_tee                308
 #define __NR_vmsplice           309
 #define __NR_move_pages         310
+#define __NR_sched_setaffinity  311
+#define __NR_sched_getaffinity  312
+#define __NR_kexec_load         313
+#define __NR_getcpu             314
+#define __NR_epoll_pwait        315
+#define __NR_utimensat          316
+#define __NR_signalfd           317
+#define __NR_timerfd            318
+#define __NR_eventfd            319
+#define __NR_fallocate          320
 #ifdef __KERNEL__
-#define NR_syscalls             311
+#define NR_syscalls             321
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/include/asm-m68knommu/unistd.h b/include/asm-m68knommu/unistd.h
index 82e03195f325..eb1b566793fe 100644
--- a/include/asm-m68knommu/unistd.h
+++ b/include/asm-m68knommu/unistd.h
@@ -314,10 +314,20 @@
 #define __NR_tee                308
 #define __NR_vmsplice           309
 #define __NR_move_pages         310
+#define __NR_sched_setaffinity  311
+#define __NR_sched_getaffinity  312
+#define __NR_kexec_load         313
+#define __NR_getcpu             314
+#define __NR_epoll_pwait        315
+#define __NR_utimensat          316
+#define __NR_signalfd           317
+#define __NR_timerfd            318
+#define __NR_eventfd            319
+#define __NR_fallocate          320
 #ifdef __KERNEL__
-#define NR_syscalls             311
+#define NR_syscalls             321
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/include/asm-mips/mach-generic/ide.h b/include/asm-mips/mach-generic/ide.h
index 2b928577be5d..a77128362a7d 100644
--- a/include/asm-mips/mach-generic/ide.h
+++ b/include/asm-mips/mach-generic/ide.h
@@ -29,6 +29,35 @@
 #define IDE_ARCH_OBSOLETE_DEFAULTS
+static __inline__ int ide_probe_legacy(void)
+{
+#ifdef CONFIG_PCI
+        struct pci_dev *dev;
+        /*
+         * This can be called on the ide_setup() path, super-early in
+         * boot.  But the down_read() will enable local interrupts,
+         * which can cause some machines to crash.  So here we detect
+         * and flag that situation and bail out early.
+         */
+        if (no_pci_devices())
+                return 0;
+        dev = pci_get_class(PCI_CLASS_BRIDGE_EISA << 8, NULL);
+        if (dev)
+                goto found;
+        dev = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, NULL);
+        if (dev)
+                goto found;
+        return 0;
+found:
+        pci_dev_put(dev);
+        return 1;
+#elif defined(CONFIG_EISA) || defined(CONFIG_ISA)
+        return 1;
+#else
+        return 0;
+#endif
+}
 static __inline__ int ide_default_irq(unsigned long base)
 {
        switch (base) {
@@ -45,6 +74,8 @@ static __inline__ int ide_default_irq(unsigned long base)
 static __inline__ unsigned long ide_default_io_base(int index)
 {
+        if (!ide_probe_legacy())
+                return 0;
        /*
         *      If PCI is present then it is not safe to poke around
         *      the other legacy IDE ports. Only 0x1f0 and 0x170 are
diff --git a/include/asm-mips/sibyte/bcm1480_regs.h b/include/asm-mips/sibyte/bcm1480_regs.h
index 2738c1366f66..c34d36b6b8c2 100644
--- a/include/asm-mips/sibyte/bcm1480_regs.h
+++ b/include/asm-mips/sibyte/bcm1480_regs.h
@@ -227,10 +227,15 @@
        (A_BCM1480_DUART(chan) +                                        \
         BCM1480_DUART_CHANREG_SPACING * 3 + (reg))
+#define DUART_IMRISR_SPACING        0x20
+#define DUART_INCHNG_SPACING        0x10
 #define R_BCM1480_DUART_IMRREG(chan)                                    \
        (R_DUART_IMR_A + ((chan) & 1) * DUART_IMRISR_SPACING)
 #define R_BCM1480_DUART_ISRREG(chan)                                    \
        (R_DUART_ISR_A + ((chan) & 1) * DUART_IMRISR_SPACING)
+#define R_BCM1480_DUART_INCHREG(chan)                                   \
+        (R_DUART_IN_CHNG_A + ((chan) & 1) * DUART_INCHNG_SPACING)
 #define A_BCM1480_DUART_IMRREG(chan)                                    \
        (A_BCM1480_DUART_CTRLREG((chan), R_BCM1480_DUART_IMRREG(chan)))
diff --git a/include/linux/aer.h b/include/linux/aer.h
index 509656286e53..bcf236d825e8 100644
--- a/include/linux/aer.h
+++ b/include/linux/aer.h
@@ -15,11 +15,26 @@ extern int pci_disable_pcie_error_reporting(struct pci_dev *dev);
 extern int pci_cleanup_aer_uncorrect_error_status(struct pci_dev *dev);
 extern int pci_cleanup_aer_correct_error_status(struct pci_dev *dev);
 #else
-#define pci_enable_pcie_error_reporting(dev)            (-EINVAL)
+static inline int pci_enable_pcie_error_reporting(struct pci_dev *dev)
-#define pci_find_aer_capability(dev)                    (0)
+{
-#define pci_disable_pcie_error_reporting(dev)           (-EINVAL)
+        return -EINVAL;
-#define pci_cleanup_aer_uncorrect_error_status(dev)     (-EINVAL)
+}
-#define pci_cleanup_aer_correct_error_status(dev)       (-EINVAL)
+static inline int pci_find_aer_capability(struct pci_dev *dev)
+{
+        return 0;
+}
+static inline int pci_disable_pcie_error_reporting(struct pci_dev *dev)
+{
+        return -EINVAL;
+}
+static inline int pci_cleanup_aer_uncorrect_error_status(struct pci_dev *dev)
+{
+        return -EINVAL;
+}
+static inline int pci_cleanup_aer_correct_error_status(struct pci_dev *dev)
+{
+        return -EINVAL;
+}
 #endif
 #endif //_AER_H_
diff --git a/include/linux/ide.h b/include/linux/ide.h
index c792b4fd1588..b9f66c10caa0 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -1378,6 +1378,19 @@ static inline int ide_dev_has_iordy(struct hd_driveid *id)
        return ((id->field_valid & 2) && (id->capability & 8)) ? 1 : 0;
 }
+static inline int ide_dev_is_sata(struct hd_driveid *id)
+{
+        /*
+         * See if word 93 is 0 AND drive is at least ATA-5 compatible
+         * verifying that word 80 by casting it to a signed type --
+         * this trick allows us to filter out the reserved values of
+         * 0x0000 and 0xffff along with the earlier ATA revisions...
+         */
+        if (id->hw_config == 0 && (short)id->major_rev_num >= 0x0020)
+                return 1;
+        return 0;
+}
 u8 ide_dump_status(ide_drive_t *, const char *, u8);
 typedef struct ide_pio_timings_s {
diff --git a/include/linux/input.h b/include/linux/input.h
index cf2b5619aa13..36e00aa6f03b 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -558,6 +558,8 @@ struct input_absinfo {
 #define KEY_BRL_DOT6            0x1f6
 #define KEY_BRL_DOT7            0x1f7
 #define KEY_BRL_DOT8            0x1f8
+#define KEY_BRL_DOT9            0x1f9
+#define KEY_BRL_DOT10           0x1fa
 /* We avoid low common keys in module aliases so they don't get huge. */
 #define KEY_MIN_INTERESTING     KEY_MUTE
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index f592df74b3cf..47160fe378c9 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -34,6 +34,7 @@ extern const char linux_proc_banner[];
 #define ALIGN(x,a)              __ALIGN_MASK(x,(typeof(x))(a)-1)
 #define __ALIGN_MASK(x,mask)    (((x)+(mask))&~(mask))
+#define PTR_ALIGN(p, a)         ((typeof(p))ALIGN((unsigned long)(p), (a)))
 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
diff --git a/include/linux/keyboard.h b/include/linux/keyboard.h
index de76843bbe8a..7ddbc30aa8e7 100644
--- a/include/linux/keyboard.h
+++ b/include/linux/keyboard.h
@@ -437,8 +437,10 @@ extern unsigned short plain_map[NR_KEYS];
 #define K_BRL_DOT6      K(KT_BRL, 6)
 #define K_BRL_DOT7      K(KT_BRL, 7)
 #define K_BRL_DOT8      K(KT_BRL, 8)
+#define K_BRL_DOT9      K(KT_BRL, 9)
+#define K_BRL_DOT10     K(KT_BRL, 10)
-#define NR_BRL          9
+#define NR_BRL          11
 #define MAX_DIACR       256
 #endif
diff --git a/include/linux/leds.h b/include/linux/leds.h
index 421175092ee2..dc1178f6184b 100644
--- a/include/linux/leds.h
+++ b/include/linux/leds.h
@@ -13,6 +13,7 @@
 #define __LINUX_LEDS_H_INCLUDED
 #include <linux/list.h>
+#include <linux/spinlock.h>
 struct device;
 /*
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 0eed0b7ab2df..1dd075eda595 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -88,9 +88,8 @@ struct nf_sockopt_ops
        int (*compat_get)(struct sock *sk, int optval,
                        void __user *user, int *len);
-        /* Number of users inside set() or get(). */
+        /* Use the module struct to lock set/get code in place */
-        unsigned int use;
+        struct module *owner;
-        struct task_struct *cleanup_task;
 };
 /* Each queued (to userspace) skbuff has one of these. */
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index d41747b9fd15..55f307ffbf96 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2293,6 +2293,8 @@
 #define PCI_DEVICE_ID_INTEL_MCH_PC      0x3599
 #define PCI_DEVICE_ID_INTEL_MCH_PC1     0x359a
 #define PCI_DEVICE_ID_INTEL_E7525_MCH   0x359e
+#define PCI_DEVICE_ID_INTEL_TOLAPAI_0   0x5031
+#define PCI_DEVICE_ID_INTEL_TOLAPAI_1   0x5032
 #define PCI_DEVICE_ID_INTEL_82371SB_0   0x7000
 #define PCI_DEVICE_ID_INTEL_82371SB_1   0x7010
 #define PCI_DEVICE_ID_INTEL_82371SB_2   0x7020
diff --git a/include/linux/poll.h b/include/linux/poll.h
index 27690798623f..16d813b364ef 100644
--- a/include/linux/poll.h
+++ b/include/linux/poll.h
@@ -21,6 +21,8 @@
 #define WQUEUES_STACK_ALLOC     (MAX_STACK_ALLOC - FRONTEND_STACK_ALLOC)
 #define N_INLINE_POLL_ENTRIES   (WQUEUES_STACK_ALLOC / sizeof(struct poll_table_entry))
+#define DEFAULT_POLLMASK (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM)
 struct poll_table_struct;
 /* 
diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
index d62847f846c2..17f8f3a2f0a3 100644
--- a/include/media/v4l2-dev.h
+++ b/include/media/v4l2-dev.h
@@ -337,6 +337,9 @@ void *priv;
        struct class_device class_dev; /* sysfs */
 };
+/* Class-dev to video-device */
+#define to_video_device(cd) container_of(cd, struct video_device, class_dev)
 /* Version 2 functions */
 extern int video_register_device(struct video_device *vfd, int type, int nr);
 void video_unregister_device(struct video_device *);
@@ -354,11 +357,9 @@ extern int video_usercopy(struct inode *inode, struct file *file,
                          int (*func)(struct inode *inode, struct file *file,
                                      unsigned int cmd, void *arg));
 #ifdef CONFIG_VIDEO_V4L1_COMPAT
 #include <linux/mm.h>
-#define to_video_device(cd) container_of(cd, struct video_device, class_dev)
 static inline int __must_check
 video_device_create_file(struct video_device *vfd,
                         struct class_device_attribute *attr)
diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
index 007d442412e2..b4b31132618b 100644
--- a/include/scsi/libiscsi.h
+++ b/include/scsi/libiscsi.h
@@ -205,6 +205,13 @@ struct iscsi_queue {
 };
 struct iscsi_session {
+        /*
+         * Syncs up the scsi eh thread with the iscsi eh thread when sending
+         * task management functions. This must be taken before the session
+         * and recv lock.
+         */
+        struct mutex            eh_mutex;
        /* iSCSI session-wide sequencing */
        uint32_t                cmdsn;
        uint32_t                exp_cmdsn;
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index f7921360efad..7e52eb051f22 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -61,10 +61,10 @@ void compat_exit_robust_list(struct task_struct *curr)
        if (fetch_robust_entry(&upending, &pending,
                               &head->list_op_pending, &pip))
                return;
-        if (upending)
+        if (pending)
                handle_futex_death((void __user *)pending + futex_offset, curr, pip);
-        while (compat_ptr(uentry) != &head->list) {
+        while (entry != (struct robust_list __user *) &head->list) {
                /*
                 * A pending lock might already be on the list, so
                 * dont process it twice:
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 9809cc1f33d6..c6a4f8aebeba 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -505,7 +505,7 @@ int call_usermodehelper_pipe(char *path, char **argv, char **envp,
        if (ret < 0)
                goto out;
-        return call_usermodehelper_exec(sub_info, 1);
+        return call_usermodehelper_exec(sub_info, UMH_WAIT_EXEC);
  out:
        call_usermodehelper_freeinfo(sub_info);
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index cd91237dbfe3..de6a2d6b3ebb 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -226,7 +226,7 @@ static void sync_cmos_clock(unsigned long dummy)
 static void notify_cmos_timer(void)
 {
-        if (no_sync_cmos_clock)
+        if (!no_sync_cmos_clock)
                mod_timer(&sync_cmos_timer, jiffies + 1);
 }
diff --git a/mm/slub.c b/mm/slub.c
index 7defe84e6bd0..addb20a6d67d 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -986,7 +986,9 @@ out:
 __setup("slub_debug", setup_slub_debug);
-static void kmem_cache_open_debug_check(struct kmem_cache *s)
+static unsigned long kmem_cache_flags(unsigned long objsize,
+        unsigned long flags, const char *name,
+        void (*ctor)(void *, struct kmem_cache *, unsigned long))
 {
        /*
         * The page->offset field is only 16 bit wide. This is an offset
@@ -1000,19 +1002,21 @@ static void kmem_cache_open_debug_check(struct kmem_cache *s)
         * Debugging or ctor may create a need to move the free
         * pointer. Fail if this happens.
         */
-        if (s->objsize >= 65535 * sizeof(void *)) {
+        if (objsize >= 65535 * sizeof(void *)) {
-                BUG_ON(s->flags & (SLAB_RED_ZONE | SLAB_POISON |
+                BUG_ON(flags & (SLAB_RED_ZONE | SLAB_POISON |
                                SLAB_STORE_USER | SLAB_DESTROY_BY_RCU));
-                BUG_ON(s->ctor);
+                BUG_ON(ctor);
-        }
+        } else {
-        else
                /*
                 * Enable debugging if selected on the kernel commandline.
                 */
                if (slub_debug && (!slub_debug_slabs ||
-                    strncmp(slub_debug_slabs, s->name,
+                    strncmp(slub_debug_slabs, name,
                        strlen(slub_debug_slabs)) == 0))
-                                s->flags |= slub_debug;
+                                flags |= slub_debug;
+        }
+        return flags;
 }
 #else
 static inline void setup_object_debug(struct kmem_cache *s,
@@ -1029,7 +1033,12 @@ static inline int slab_pad_check(struct kmem_cache *s, struct page *page)
 static inline int check_object(struct kmem_cache *s, struct page *page,
                        void *object, int active) { return 1; }
 static inline void add_full(struct kmem_cache_node *n, struct page *page) {}
-static inline void kmem_cache_open_debug_check(struct kmem_cache *s) {}
+static inline unsigned long kmem_cache_flags(unsigned long objsize,
+        unsigned long flags, const char *name,
+        void (*ctor)(void *, struct kmem_cache *, unsigned long))
+{
+        return flags;
+}
 #define slub_debug 0
 #endif
 /*
@@ -2088,9 +2097,8 @@ static int kmem_cache_open(struct kmem_cache *s, gfp_t gfpflags,
        s->name = name;
        s->ctor = ctor;
        s->objsize = size;
-        s->flags = flags;
        s->align = align;
-        kmem_cache_open_debug_check(s);
+        s->flags = kmem_cache_flags(size, flags, name, ctor);
        if (!calculate_sizes(s))
                goto error;
@@ -2660,7 +2668,7 @@ static int slab_unmergeable(struct kmem_cache *s)
 }
 static struct kmem_cache *find_mergeable(size_t size,
-                size_t align, unsigned long flags,
+                size_t align, unsigned long flags, const char *name,
                void (*ctor)(void *, struct kmem_cache *, unsigned long))
 {
        struct kmem_cache *s;
@@ -2674,6 +2682,7 @@ static struct kmem_cache *find_mergeable(size_t size,
        size = ALIGN(size, sizeof(void *));
        align = calculate_alignment(flags, align, size);
        size = ALIGN(size, align);
+        flags = kmem_cache_flags(size, flags, name, NULL);
        list_for_each_entry(s, &slab_caches, list) {
                if (slab_unmergeable(s))
@@ -2682,8 +2691,7 @@ static struct kmem_cache *find_mergeable(size_t size,
                if (size > s->size)
                        continue;
-                if (((flags | slub_debug) & SLUB_MERGE_SAME) !=
+                if ((flags & SLUB_MERGE_SAME) != (s->flags & SLUB_MERGE_SAME))
-                        (s->flags & SLUB_MERGE_SAME))
                                continue;
                /*
                 * Check if alignment is compatible.
@@ -2707,7 +2715,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
        struct kmem_cache *s;
        down_write(&slub_lock);
-        s = find_mergeable(size, align, flags, ctor);
+        s = find_mergeable(size, align, flags, name, ctor);
        if (s) {
                s->refcount++;
                /*
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 63caa414945d..18e3afc964df 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -183,6 +183,7 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 {
        struct sk_buff *skb;
        __le16 param;
+        __u8 flt_type;
        BT_DBG("%s %ld", hdev->name, opt);
@@ -233,11 +234,8 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
        /* Optional initialization */
        /* Clear Event Filters */
-        {
+        flt_type = HCI_FLT_CLEAR_ALL;
-                struct hci_cp_set_event_flt cp;
+        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, 1, &flt_type);
-                cp.flt_type  = HCI_FLT_CLEAR_ALL;
-                hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, sizeof(cp), &cp);
-        }
        /* Page timeout ~20 secs */
        param = cpu_to_le16(0x8000);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 1dae3dfc66a9..5ccea5fbd236 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -37,6 +37,7 @@
 #include <linux/skbuff.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
+#include <linux/compat.h>
 #include <linux/socket.h>
 #include <linux/ioctl.h>
 #include <net/sock.h>
@@ -70,15 +71,15 @@ static struct hci_sec_filter hci_sec_filter = {
        {
                { 0x0 },
                /* OGF_LINK_CTL */
-                { 0xbe000006, 0x00000001, 0x000000, 0x00 },
+                { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
                /* OGF_LINK_POLICY */
-                { 0x00005200, 0x00000000, 0x000000, 0x00 },
+                { 0x00005200, 0x00000000, 0x00000000, 0x00 },
                /* OGF_HOST_CTL */
-                { 0xaab00200, 0x2b402aaa, 0x020154, 0x00 },
+                { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
                /* OGF_INFO_PARAM */
-                { 0x000002be, 0x00000000, 0x000000, 0x00 },
+                { 0x000002be, 0x00000000, 0x00000000, 0x00 },
                /* OGF_STATUS_PARAM */
-                { 0x000000ea, 0x00000000, 0x000000, 0x00 }
+                { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
        }
 };
@@ -342,9 +343,24 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
        if (mask & HCI_CMSG_TSTAMP) {
                struct timeval tv;
+                void *data;
+                int len;
                skb_get_timestamp(skb, &tv);
-                put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(tv), &tv);
+                data = &tv;
+                len = sizeof(tv);
+#ifdef CONFIG_COMPAT
+                if (msg->msg_flags & MSG_CMSG_COMPAT) {
+                        struct compat_timeval ctv;
+                        ctv.tv_sec = tv.tv_sec;
+                        ctv.tv_usec = tv.tv_usec;
+                        data = &ctv;
+                        len = sizeof(ctv);
+                }
+#endif
+                put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
        }
 }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 4169a2a89a39..6018d0e51938 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1513,6 +1513,7 @@ static struct nf_sockopt_ops ebt_sockopts =
        .get_optmin     = EBT_BASE_CTL,
        .get_optmax     = EBT_SO_GET_MAX + 1,
        .get            = do_ebt_get_ctl,
+        .owner          = THIS_MODULE,
 };
 static int __init ebtables_init(void)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index cb056f476126..029b93e246b4 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -450,6 +450,9 @@ int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
        __wsum csum;
        int chunk = skb->len - hlen;
+        if (!chunk)
+                return 0;
        /* Skip filled elements.
         * Pretty silly, look at memcpy_toiovec, though 8)
         */
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index fa6604fcf0e7..8def68209edd 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -814,7 +814,7 @@ static int dn_nl_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                for (ifa = dn_db->ifa_list, dn_idx = 0; ifa;
                     ifa = ifa->ifa_next, dn_idx++) {
                        if (dn_idx < skip_naddr)
-                                goto cont;
+                                continue;
                        if (dn_nl_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
                                              cb->nlh->nlmsg_seq, RTM_NEWADDR,
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5b77bdaa57dd..5dbe5803b7d5 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1193,7 +1193,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
                     ifa = ifa->ifa_next, ip_idx++) {
                        if (ip_idx < s_ip_idx)
-                                goto cont;
+                                continue;
                        if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
                                             cb->nlh->nlmsg_seq,
                                             RTM_NEWADDR, NLM_F_MULTI) <= 0)
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index dbeacd8b0f90..def007ec1d6f 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -836,12 +836,16 @@ static int inet_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
        return inet_diag_get_exact(skb, nlh);
 }
+static DEFINE_MUTEX(inet_diag_mutex);
 static void inet_diag_rcv(struct sock *sk, int len)
 {
        unsigned int qlen = 0;
        do {
+                mutex_lock(&inet_diag_mutex);
                netlink_run_queue(sk, &qlen, &inet_diag_rcv_msg);
+                mutex_unlock(&inet_diag_mutex);
        } while (qlen);
 }
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 902fd578aa3c..f656d41d8d41 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -2339,6 +2339,7 @@ static struct nf_sockopt_ops ip_vs_sockopts = {
        .get_optmin     = IP_VS_BASE_CTL,
        .get_optmax     = IP_VS_SO_GET_MAX+1,
        .get            = do_ip_vs_get_ctl,
+        .owner          = THIS_MODULE,
 };
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index d1149aba9351..29114a9ccd1d 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1161,6 +1161,7 @@ static struct nf_sockopt_ops arpt_sockopts = {
        .get_optmin     = ARPT_BASE_CTL,
        .get_optmax     = ARPT_SO_GET_MAX+1,
        .get            = do_arpt_get_ctl,
+        .owner          = THIS_MODULE,
 };
 static int __init arp_tables_init(void)
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index e1b402c6b855..6486894f450c 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -2296,6 +2296,7 @@ static struct nf_sockopt_ops ipt_sockopts = {
 #ifdef CONFIG_COMPAT
        .compat_get     = compat_do_ipt_get_ctl,
 #endif
+        .owner          = THIS_MODULE,
 };
 static struct xt_match icmp_matchstruct __read_mostly = {
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index d9b5177989c6..f813e02aab30 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -87,14 +87,10 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
        if (iph == NULL)
                return -NF_DROP;
-        /* Never happen */
+        /* Conntrack defragments packets, we might still see fragments
-        if (iph->frag_off & htons(IP_OFFSET)) {
+         * inside ICMP packets though. */
-                if (net_ratelimit()) {
+        if (iph->frag_off & htons(IP_OFFSET))
-                        printk(KERN_ERR "ipv4_get_l4proto: Frag of proto %u\n",
-                        iph->protocol);
-                }
                return -NF_DROP;
-        }
        *dataoff = nhoff + (iph->ihl << 2);
        *protonum = iph->protocol;
@@ -403,6 +399,7 @@ static struct nf_sockopt_ops so_getorigdst = {
        .get_optmin     = SO_ORIGINAL_DST,
        .get_optmax     = SO_ORIGINAL_DST+1,
        .get            = &getorigdst,
+        .owner          = THIS_MODULE,
 };
 struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5dead399fe64..26de3c0ea31e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1427,8 +1427,9 @@ void ip6_flush_pending_frames(struct sock *sk)
        struct sk_buff *skb;
        while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
-                IP6_INC_STATS(ip6_dst_idev(skb->dst),
+                if (skb->dst)
-                              IPSTATS_MIB_OUTDISCARDS);
+                        IP6_INC_STATS(ip6_dst_idev(skb->dst),
+                                      IPSTATS_MIB_OUTDISCARDS);
                kfree_skb(skb);
        }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 0358e6066a4e..73a894a2152c 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -736,7 +736,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                                 * so fail our DAD process
                                 */
                                addrconf_dad_failure(ifp);
-                                goto out;
+                                return;
                        } else {
                                /*
                                 * This is not a dad solicitation.
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index aeda617246b7..cd9df02bb85c 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1462,6 +1462,7 @@ static struct nf_sockopt_ops ip6t_sockopts = {
        .get_optmin     = IP6T_BASE_CTL,
        .get_optmax     = IP6T_SO_GET_MAX+1,
        .get            = do_ip6t_get_ctl,
+        .owner          = THIS_MODULE,
 };
 static struct xt_match icmp6_matchstruct __read_mostly = {
diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c
index 8b8ece750313..e32761ce260c 100644
--- a/net/netfilter/nf_sockopt.c
+++ b/net/netfilter/nf_sockopt.c
@@ -55,18 +55,7 @@ EXPORT_SYMBOL(nf_register_sockopt);
 void nf_unregister_sockopt(struct nf_sockopt_ops *reg)
 {
-        /* No point being interruptible: we're probably in cleanup_module() */
- restart:
        mutex_lock(&nf_sockopt_mutex);
-        if (reg->use != 0) {
-                /* To be woken by nf_sockopt call... */
-                /* FIXME: Stuart Young's name appears gratuitously. */
-                set_current_state(TASK_UNINTERRUPTIBLE);
-                reg->cleanup_task = current;
-                mutex_unlock(&nf_sockopt_mutex);
-                schedule();
-                goto restart;
-        }
        list_del(&reg->list);
        mutex_unlock(&nf_sockopt_mutex);
 }
@@ -86,10 +75,11 @@ static int nf_sockopt(struct sock *sk, int pf, int val,
        list_for_each(i, &nf_sockopts) {
                ops = (struct nf_sockopt_ops *)i;
                if (ops->pf == pf) {
+                        if (!try_module_get(ops->owner))
+                                goto out_nosup;
                        if (get) {
                                if (val >= ops->get_optmin
                                    && val < ops->get_optmax) {
-                                        ops->use++;
                                        mutex_unlock(&nf_sockopt_mutex);
                                        ret = ops->get(sk, val, opt, len);
                                        goto out;
@@ -97,23 +87,20 @@ static int nf_sockopt(struct sock *sk, int pf, int val,
                        } else {
                                if (val >= ops->set_optmin
                                    && val < ops->set_optmax) {
-                                        ops->use++;
                                        mutex_unlock(&nf_sockopt_mutex);
                                        ret = ops->set(sk, val, opt, *len);
                                        goto out;
                                }
                        }
+                        module_put(ops->owner);
                }
        }
+ out_nosup:
        mutex_unlock(&nf_sockopt_mutex);
        return -ENOPROTOOPT;
 out:
-        mutex_lock(&nf_sockopt_mutex);
+        module_put(ops->owner);
-        ops->use--;
-        if (ops->cleanup_task)
-                wake_up_process(ops->cleanup_task);
-        mutex_unlock(&nf_sockopt_mutex);
        return ret;
 }
@@ -144,10 +131,12 @@ static int compat_nf_sockopt(struct sock *sk, int pf, int val,
        list_for_each(i, &nf_sockopts) {
                ops = (struct nf_sockopt_ops *)i;
                if (ops->pf == pf) {
+                        if (!try_module_get(ops->owner))
+                                goto out_nosup;
                        if (get) {
                                if (val >= ops->get_optmin
                                    && val < ops->get_optmax) {
-                                        ops->use++;
                                        mutex_unlock(&nf_sockopt_mutex);
                                        if (ops->compat_get)
                                                ret = ops->compat_get(sk,
@@ -160,7 +149,6 @@ static int compat_nf_sockopt(struct sock *sk, int pf, int val,
                        } else {
                                if (val >= ops->set_optmin
                                    && val < ops->set_optmax) {
-                                        ops->use++;
                                        mutex_unlock(&nf_sockopt_mutex);
                                        if (ops->compat_set)
                                                ret = ops->compat_set(sk,
@@ -171,17 +159,15 @@ static int compat_nf_sockopt(struct sock *sk, int pf, int val,
                                        goto out;
                                }
                        }
+                        module_put(ops->owner);
                }
        }
+ out_nosup:
        mutex_unlock(&nf_sockopt_mutex);
        return -ENOPROTOOPT;
 out:
-        mutex_lock(&nf_sockopt_mutex);
+        module_put(ops->owner);
-        ops->use--;
-        if (ops->cleanup_task)
-                wake_up_process(ops->cleanup_task);
-        mutex_unlock(&nf_sockopt_mutex);
        return ret;
 }
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 12ff5da8160e..1a899924023f 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1592,7 +1592,7 @@ svc_age_temp_sockets(unsigned long closure)
                if (!test_and_set_bit(SK_OLD, &svsk->sk_flags))
                        continue;
-                if (atomic_read(&svsk->sk_inuse) || test_bit(SK_BUSY, &svsk->sk_flags))
+                if (atomic_read(&svsk->sk_inuse) > 1 || test_bit(SK_BUSY, &svsk->sk_flags))
                        continue;
                atomic_inc(&svsk->sk_inuse);
                list_move(le, &to_be_aged);