221 files changed, 2284 insertions, 1432 deletions
diff --git a/Documentation/filesystems/afs.txt b/Documentation/filesystems/afs.txt
index 12ad6c7f4e50..ffef91c4e0d6 100644
--- a/Documentation/filesystems/afs.txt
+++ b/Documentation/filesystems/afs.txt
@@ -23,15 +23,13 @@ it does support include:
 (*) Security (currently only AFS kaserver and KerberosIV tickets).
- (*) File reading.
+ (*) File reading and writing.
 (*) Automounting.
-It does not yet support the following AFS features:
+ (*) Local caching (via fscache).
- (*) Write support.
- (*) Local caching.
+It does not yet support the following AFS features:
 (*) pioctl() system call.
@@ -56,7 +54,7 @@ They permit the debugging messages to be turned on dynamically by manipulating
 the masks in the following files:
        /sys/module/af_rxrpc/parameters/debug
-        /sys/module/afs/parameters/debug
+        /sys/module/kafs/parameters/debug
 =====
@@ -66,9 +64,9 @@ USAGE
 When inserting the driver modules the root cell must be specified along with a
 list of volume location server IP addresses:
-        insmod af_rxrpc.o
+        modprobe af_rxrpc
-        insmod rxkad.o
+        modprobe rxkad
-        insmod kafs.o rootcell=cambridge.redhat.com:172.16.18.73:172.16.18.91
+        modprobe kafs rootcell=cambridge.redhat.com:172.16.18.73:172.16.18.91
 The first module is the AF_RXRPC network protocol driver.  This provides the
 RxRPC remote operation protocol and may also be accessed from userspace.  See:
@@ -81,7 +79,7 @@ is the actual filesystem driver for the AFS filesystem.
 Once the module has been loaded, more modules can be added by the following
 procedure:
-        echo add grand.central.org 18.7.14.88:128.2.191.224 >/proc/fs/afs/cells
+        echo add grand.central.org 18.9.48.14:128.2.203.61:130.237.48.87 >/proc/fs/afs/cells
 Where the parameters to the "add" command are the name of a cell and a list of
 volume location servers within that cell, with the latter separated by colons.
@@ -101,7 +99,7 @@ The name of the volume can be suffixes with ".backup" or ".readonly" to
 specify connection to only volumes of those types.
 The name of the cell is optional, and if not given during a mount, then the
-named volume will be looked up in the cell specified during insmod.
+named volume will be looked up in the cell specified during modprobe.
 Additional cells can be added through /proc (see later section).
@@ -163,14 +161,14 @@ THE CELL DATABASE
 The filesystem maintains an internal database of all the cells it knows and the
 IP addresses of the volume location servers for those cells.  The cell to which
-the system belongs is added to the database when insmod is performed by the
+the system belongs is added to the database when modprobe is performed by the
 "rootcell=" argument or, if compiled in, using a "kafs.rootcell=" argument on
 the kernel command line.
 Further cells can be added by commands similar to the following:
        echo add CELLNAME VLADDR[:VLADDR][:VLADDR]... >/proc/fs/afs/cells
-        echo add grand.central.org 18.7.14.88:128.2.191.224 >/proc/fs/afs/cells
+        echo add grand.central.org 18.9.48.14:128.2.203.61:130.237.48.87 >/proc/fs/afs/cells
 No other cell database operations are available at this time.
@@ -233,7 +231,7 @@ insmod /tmp/kafs.o rootcell=cambridge.redhat.com:172.16.18.91
 mount -t afs \%root.afs. /afs
 mount -t afs \%cambridge.redhat.com:root.cell. /afs/cambridge.redhat.com/
-echo add grand.central.org 18.7.14.88:128.2.191.224 > /proc/fs/afs/cells
+echo add grand.central.org 18.9.48.14:128.2.203.61:130.237.48.87 > /proc/fs/afs/cells
 mount -t afs "#grand.central.org:root.cell." /afs/grand.central.org/
 mount -t afs "#grand.central.org:root.archive." /afs/grand.central.org/archive
 mount -t afs "#grand.central.org:root.contrib." /afs/grand.central.org/contrib
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index fad18f9456e4..ffead13f9443 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -1167,13 +1167,11 @@ CHAPTER 3: PER-PROCESS PARAMETERS
 3.1 /proc/<pid>/oom_adj - Adjust the oom-killer score
 ------------------------------------------------------
-This file can be used to adjust the score used to select which processes should
+This file can be used to adjust the score used to select which processes
-be killed in an out-of-memory situation.  The oom_adj value is a characteristic
+should be killed in an  out-of-memory  situation.  Giving it a high score will
-of the task's mm, so all threads that share an mm with pid will have the same
+increase the likelihood of this process being killed by the oom-killer.  Valid
-oom_adj value.  A high value will increase the likelihood of this process being
+values are in the range -16 to +15, plus the special value -17, which disables
-killed by the oom-killer.  Valid values are in the range -16 to +15 as
+oom-killing altogether for this process.
-explained below and a special value of -17, which disables oom-killing
-altogether for threads sharing pid's mm.
 The process to be killed in an out-of-memory situation is selected among all others
 based on its badness score. This value equals the original memory size of the process
@@ -1187,9 +1185,6 @@ the parent's score if they do not share the same memory. Thus forking servers
 are the prime candidates to be killed. Having only one 'hungry' child will make
 parent less preferable than the child.
-/proc/<pid>/oom_adj cannot be changed for kthreads since they are immune from
-oom-killing already.
 /proc/<pid>/oom_score shows process' current badness score.
 The following heuristics are then applied:
diff --git a/MAINTAINERS b/MAINTAINERS
index 2c4326c0de9a..60299a9a7adb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -904,7 +904,7 @@ F:	drivers/input/misc/ati_remote2.c
 ATLX ETHERNET DRIVERS
 M:      Jay Cliburn <jcliburn@gmail.com>
-M:      Chris Snook <csnook@redhat.com>
+M:      Chris Snook <chris.snook@gmail.com>
 M:      Jie Yang <jie.yang@atheros.com>
 L:      atl1-devel@lists.sourceforge.net
 W:      http://sourceforge.net/projects/atl1
@@ -3429,6 +3429,7 @@ F:	drivers/mfd/
 MULTIMEDIA CARD (MMC), SECURE DIGITAL (SD) AND SDIO SUBSYSTEM
 S:      Orphan
+L:      linux-mmc@vger.kernel.org
 F:      drivers/mmc/
 F:      include/linux/mmc/
@@ -3563,6 +3564,9 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.git
 S:      Maintained
 F:      net/
 F:      include/net/
+F:      include/linux/in.h
+F:      include/linux/net.h
+F:      include/linux/netdevice.h
 NETWORKING [IPv4/IPv6]
 M:      "David S. Miller" <davem@davemloft.net>
@@ -3598,6 +3602,8 @@ W:	http://www.linuxfoundation.org/en/Net
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.git
 S:      Odd Fixes
 F:      drivers/net/
+F:      include/linux/if_*
+F:      include/linux/*device.h
 NETXEN (1/10) GbE SUPPORT
 M:      Dhananjay Phadke <dhananjay@netxen.com>
@@ -3804,7 +3810,7 @@ W:	http://open-osd.org
 T:      git git://git.open-osd.org/open-osd.git
 S:      Maintained
 F:      drivers/scsi/osd/
-F:      drivers/include/scsi/osd_*
+F:      include/scsi/osd_*
 F:      fs/exofs/
 P54 WIRELESS DRIVER
diff --git a/Makefile b/Makefile
index abcfa85f8f82..9c87e60d169c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 31
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Man-Eating Seals of Antiquity
 # *DOCUMENTATION*
diff --git a/REPORTING-BUGS b/REPORTING-BUGS
index ab0c56630a8c..55a6074ccbb7 100644
--- a/REPORTING-BUGS
+++ b/REPORTING-BUGS
@@ -15,7 +15,10 @@ worry too much about getting the wrong person. If you are unsure send it
 to the person responsible for the code relevant to what you were doing.
 If it occurs repeatably try and describe how to recreate it. That is
 worth even more than the oops itself.  The list of maintainers and
-mailing lists is in the MAINTAINERS file in this directory.
+mailing lists is in the MAINTAINERS file in this directory.  If you
+know the file name that causes the problem you can use the following
+command in this directory to find some of the maintainers of that file:
+     perl scripts/get_maintainer.pl -f <filename>
      If it is a security bug, please copy the Security Contact listed
 in the MAINTAINERS file.  They can help coordinate bugfix and disclosure.
diff --git a/arch/arm/configs/kirkwood_defconfig b/arch/arm/configs/kirkwood_defconfig
index 0a1abb978d7e..af74cc2de8b6 100644
--- a/arch/arm/configs/kirkwood_defconfig
+++ b/arch/arm/configs/kirkwood_defconfig
@@ -629,7 +629,7 @@ CONFIG_SCSI_LOWLEVEL=y
 CONFIG_ATA=y
 # CONFIG_ATA_NONSTANDARD is not set
 CONFIG_SATA_PMP=y
-# CONFIG_SATA_AHCI is not set
+CONFIG_SATA_AHCI=y
 # CONFIG_SATA_SIL24 is not set
 CONFIG_ATA_SFF=y
 # CONFIG_SATA_SVW is not set
diff --git a/arch/arm/mach-kirkwood/ts219-setup.c b/arch/arm/mach-kirkwood/ts219-setup.c
index 01aa213c0a6f..ec1a64f263d2 100644
--- a/arch/arm/mach-kirkwood/ts219-setup.c
+++ b/arch/arm/mach-kirkwood/ts219-setup.c
@@ -206,6 +206,15 @@ static void __init qnap_ts219_init(void)
 }
+static int __init ts219_pci_init(void)
+{
+   if (machine_is_ts219())
+           kirkwood_pcie_init();
+   return 0;
+}
+subsys_initcall(ts219_pci_init);
 MACHINE_START(TS219, "QNAP TS-119/TS-219")
        /* Maintainer: Martin Michlmayr <tbm@cyrius.com> */
        .phys_io        = KIRKWOOD_REGS_PHYS_BASE,
diff --git a/arch/arm/plat-orion/include/plat/gpio.h b/arch/arm/plat-orion/include/plat/gpio.h
index 9646a94ed3d0..07c430fdc9ef 100644
--- a/arch/arm/plat-orion/include/plat/gpio.h
+++ b/arch/arm/plat-orion/include/plat/gpio.h
@@ -11,6 +11,8 @@
 #ifndef __PLAT_GPIO_H
 #define __PLAT_GPIO_H
+#include <linux/init.h>
 /*
 * GENERIC_GPIO primitives.
 */
diff --git a/arch/avr32/boards/favr-32/setup.c b/arch/avr32/boards/favr-32/setup.c
index 46c9b0a224cf..75f19f47fb2f 100644
--- a/arch/avr32/boards/favr-32/setup.c
+++ b/arch/avr32/boards/favr-32/setup.c
@@ -72,6 +72,10 @@ static struct ads7846_platform_data ads7843_data = {
        .debounce_max           = 20,
        .debounce_rep           = 4,
        .debounce_tol           = 5,
+        .keep_vref_on           = true,
+        .settle_delay_usecs     = 500,
+        .penirq_recheck_delay_usecs = 100,
 };
 static struct spi_board_info __initdata spi1_board_info[] = {
diff --git a/arch/avr32/lib/memcpy.S b/arch/avr32/lib/memcpy.S
index 0abb26142b64..c2ca49d705af 100644
--- a/arch/avr32/lib/memcpy.S
+++ b/arch/avr32/lib/memcpy.S
@@ -24,8 +24,8 @@ memcpy:
        brne    1f
        /* At this point, "from" is word-aligned */
-2:      sub     r10, 4
+2:      mov     r9, r12
-        mov     r9, r12
+5:      sub     r10, 4
        brlt    4f
 3:      ld.w    r8, r11++
@@ -49,6 +49,7 @@ memcpy:
        /* Handle unaligned "from" pointer */
 1:      sub     r10, 4
+        movlt   r9, r12
        brlt    4b
        add     r10, r9
        lsl     r9, 2
@@ -59,4 +60,13 @@ memcpy:
        st.b    r12++, r8
        ld.ub   r8, r11++
        st.b    r12++, r8
-        rjmp    2b
+        mov     r8, r12
+        add     pc, pc, r9
+        sub     r8, 1
+        nop
+        sub     r8, 1
+        nop
+        sub     r8, 1
+        nop
+        mov     r9, r8
+        rjmp    5b
diff --git a/arch/microblaze/configs/mmu_defconfig b/arch/microblaze/configs/mmu_defconfig
index bd0b85ec38f5..09c32962b66f 100644
--- a/arch/microblaze/configs/mmu_defconfig
+++ b/arch/microblaze/configs/mmu_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30-rc6
+# Linux kernel version: 2.6.31-rc6
-# Fri May 22 10:02:33 2009
+# Tue Aug 18 11:00:02 2009
 #
 CONFIG_MICROBLAZE=y
 # CONFIG_SWAP is not set
@@ -18,7 +18,11 @@ CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_GENERIC_GPIO=y
+CONFIG_GENERIC_CSUM=y
+# CONFIG_PCI is not set
+CONFIG_NO_DMA=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 #
 # General setup
@@ -59,8 +63,8 @@ CONFIG_INITRAMFS_ROOT_GID=0
 CONFIG_RD_GZIP=y
 # CONFIG_RD_BZIP2 is not set
 # CONFIG_RD_LZMA is not set
-CONFIG_INITRAMFS_COMPRESSION_NONE=y
+# CONFIG_INITRAMFS_COMPRESSION_NONE is not set
-# CONFIG_INITRAMFS_COMPRESSION_GZIP is not set
+CONFIG_INITRAMFS_COMPRESSION_GZIP=y
 # CONFIG_INITRAMFS_COMPRESSION_BZIP2 is not set
 # CONFIG_INITRAMFS_COMPRESSION_LZMA is not set
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
@@ -71,7 +75,6 @@ CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
-# CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_HOTPLUG is not set
 CONFIG_PRINTK=y
 CONFIG_BUG=y
@@ -84,13 +87,22 @@ CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 # CONFIG_SHMEM is not set
 CONFIG_AIO=y
+#
+# Performance Counters
+#
 CONFIG_VM_EVENT_COUNTERS=y
+# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_COMPAT_BRK=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
+#
+# GCOV-based kernel profiling
+#
 # CONFIG_SLOW_WORK is not set
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
@@ -102,7 +114,7 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_BLOCK=y
-# CONFIG_LBD is not set
+CONFIG_LBDAF=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
@@ -194,9 +206,9 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-CONFIG_UNEVICTABLE_LRU=y
 CONFIG_HAVE_MLOCK=y
 CONFIG_HAVE_MLOCKED_PAGE_BIT=y
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 #
 # Exectuable file formats
@@ -262,6 +274,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
@@ -325,7 +338,6 @@ CONFIG_MISC_DEVICES=y
 # CONFIG_ATA is not set
 # CONFIG_MD is not set
 CONFIG_NETDEVICES=y
-CONFIG_COMPAT_NET_DEV_OPS=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -344,7 +356,7 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
-# CONFIG_B44 is not set
+# CONFIG_KS8842 is not set
 CONFIG_NETDEV_1000=y
 CONFIG_NETDEV_10000=y
@@ -410,6 +422,11 @@ CONFIG_LEGACY_PTY_COUNT=256
 # CONFIG_TCG_TPM is not set
 # CONFIG_I2C is not set
 # CONFIG_SPI is not set
+#
+# PPS support
+#
+# CONFIG_PPS is not set
 CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_GPIOLIB is not set
 # CONFIG_W1 is not set
@@ -418,12 +435,6 @@ CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_THERMAL is not set
 # CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
-CONFIG_SSB_POSSIBLE=y
-#
-# Sonics Silicon Backplane
-#
-# CONFIG_SSB is not set
 #
 # Multifunction device drivers
@@ -433,22 +444,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_HTC_PASIC3 is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_REGULATOR is not set
+# CONFIG_MEDIA_SUPPORT is not set
-#
-# Multimedia devices
-#
-#
-# Multimedia core support
-#
-# CONFIG_VIDEO_DEV is not set
-# CONFIG_DVB_CORE is not set
-# CONFIG_VIDEO_MEDIA is not set
-#
-# Multimedia drivers
-#
-# CONFIG_DAB is not set
 #
 # Graphics support
@@ -469,9 +465,12 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
-# CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
+#
+# TI VLYNQ
+#
 # CONFIG_STAGING is not set
 #
@@ -485,12 +484,15 @@ CONFIG_EXT2_FS=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
-CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
@@ -678,6 +680,7 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_SYSCTL_SYSCALL_CHECK is not set
 # CONFIG_PAGE_POISONING is not set
 # CONFIG_SAMPLES is not set
+# CONFIG_KMEMCHECK is not set
 CONFIG_EARLY_PRINTK=y
 CONFIG_HEART_BEAT=y
 CONFIG_DEBUG_BOOTMEM=y
@@ -793,6 +796,5 @@ CONFIG_ZLIB_INFLATE=y
 CONFIG_DECOMPRESS_GZIP=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
-CONFIG_HAS_DMA=y
 CONFIG_HAVE_LMB=y
 CONFIG_NLATTR=y
diff --git a/arch/microblaze/configs/nommu_defconfig b/arch/microblaze/configs/nommu_defconfig
index 4ef6af0a8f31..8b638615a972 100644
--- a/arch/microblaze/configs/nommu_defconfig
+++ b/arch/microblaze/configs/nommu_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30-rc5
+# Linux kernel version: 2.6.31-rc6
-# Mon May 11 09:01:02 2009
+# Tue Aug 18 10:35:30 2009
 #
 CONFIG_MICROBLAZE=y
 # CONFIG_SWAP is not set
@@ -17,9 +17,12 @@ CONFIG_GENERIC_TIME=y
 # CONFIG_GENERIC_TIME_VSYSCALL is not set
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
+CONFIG_GENERIC_GPIO=y
+CONFIG_GENERIC_CSUM=y
 # CONFIG_PCI is not set
-# CONFIG_NO_DMA is not set
+CONFIG_NO_DMA=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 #
 # General setup
@@ -64,7 +67,6 @@ CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
-# CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_HOTPLUG is not set
 CONFIG_PRINTK=y
 CONFIG_BUG=y
@@ -76,13 +78,23 @@ CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_AIO=y
+#
+# Performance Counters
+#
 CONFIG_VM_EVENT_COUNTERS=y
+# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_COMPAT_BRK=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_GCOV_KERNEL is not set
 # CONFIG_SLOW_WORK is not set
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
@@ -95,7 +107,7 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_BLOCK=y
-# CONFIG_LBD is not set
+CONFIG_LBDAF=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
@@ -156,8 +168,16 @@ CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="console=ttyUL0,115200"
 # CONFIG_CMDLINE_FORCE is not set
 CONFIG_OF=y
-CONFIG_OF_DEVICE=y
 CONFIG_PROC_DEVICETREE=y
+#
+# Advanced setup
+#
+#
+# Default settings for advanced configuration options are used
+#
+CONFIG_KERNEL_START=0x90000000
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
 # CONFIG_DISCONTIGMEM_MANUAL is not set
@@ -169,7 +189,7 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-CONFIG_UNEVICTABLE_LRU=y
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_NOMMU_INITIAL_TRIM_EXCESS=1
 #
@@ -237,6 +257,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
@@ -254,7 +275,11 @@ CONFIG_WIRELESS=y
 CONFIG_WIRELESS_OLD_REGULATORY=y
 # CONFIG_WIRELESS_EXT is not set
 # CONFIG_LIB80211 is not set
-# CONFIG_MAC80211 is not set
+#
+# CFG80211 needs to be enabled for MAC80211
+#
+CONFIG_MAC80211_DEFAULT_PS_VALUE=0
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
@@ -353,6 +378,7 @@ CONFIG_MTD_UCLINUX=y
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
+CONFIG_OF_DEVICE=y
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_COW_COMMON is not set
@@ -364,6 +390,7 @@ CONFIG_BLK_DEV_RAM_SIZE=4096
 # CONFIG_BLK_DEV_XIP is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
+# CONFIG_XILINX_SYSACE is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_C2PORT is not set
@@ -383,7 +410,6 @@ CONFIG_MISC_DEVICES=y
 # CONFIG_ATA is not set
 # CONFIG_MD is not set
 CONFIG_NETDEVICES=y
-CONFIG_COMPAT_NET_DEV_OPS=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -402,7 +428,7 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
-# CONFIG_B44 is not set
+# CONFIG_KS8842 is not set
 CONFIG_NETDEV_1000=y
 CONFIG_NETDEV_10000=y
@@ -463,23 +489,25 @@ CONFIG_HW_RANDOM=y
 # CONFIG_HW_RANDOM_TIMERIOMEM is not set
 # CONFIG_RTC is not set
 # CONFIG_GEN_RTC is not set
+# CONFIG_XILINX_HWICAP is not set
 # CONFIG_R3964 is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_TCG_TPM is not set
 # CONFIG_I2C is not set
 # CONFIG_SPI is not set
+#
+# PPS support
+#
+# CONFIG_PPS is not set
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+# CONFIG_GPIOLIB is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
 # CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
-CONFIG_SSB_POSSIBLE=y
-#
-# Sonics Silicon Backplane
-#
-# CONFIG_SSB is not set
 #
 # Multifunction device drivers
@@ -489,22 +517,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_HTC_PASIC3 is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_REGULATOR is not set
+# CONFIG_MEDIA_SUPPORT is not set
-#
-# Multimedia devices
-#
-#
-# Multimedia core support
-#
-# CONFIG_VIDEO_DEV is not set
-# CONFIG_DVB_CORE is not set
-# CONFIG_VIDEO_MEDIA is not set
-#
-# Multimedia drivers
-#
-CONFIG_DAB=y
 #
 # Graphics support
@@ -520,9 +533,10 @@ CONFIG_VIDEO_OUTPUT_CONTROL=y
 # CONFIG_DISPLAY_SUPPORT is not set
 # CONFIG_SOUND is not set
 CONFIG_USB_SUPPORT=y
-# CONFIG_USB_ARCH_HAS_HCD is not set
+CONFIG_USB_ARCH_HAS_HCD=y
 # CONFIG_USB_ARCH_HAS_OHCI is not set
 # CONFIG_USB_ARCH_HAS_EHCI is not set
+# CONFIG_USB is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OTG_BLACKLIST_HUB is not set
@@ -543,9 +557,12 @@ CONFIG_USB_SUPPORT=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
-# CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
+#
+# TI VLYNQ
+#
 # CONFIG_STAGING is not set
 #
@@ -558,12 +575,15 @@ CONFIG_EXT2_FS=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
-CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
@@ -813,6 +833,5 @@ CONFIG_GENERIC_FIND_LAST_BIT=y
 CONFIG_ZLIB_INFLATE=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
-CONFIG_HAS_DMA=y
 CONFIG_HAVE_LMB=y
 CONFIG_NLATTR=y
diff --git a/arch/microblaze/include/asm/hardirq.h b/arch/microblaze/include/asm/hardirq.h
index 41e1e1aa36ac..cd1ac9aad56c 100644
--- a/arch/microblaze/include/asm/hardirq.h
+++ b/arch/microblaze/include/asm/hardirq.h
@@ -12,8 +12,6 @@
 /* should be defined in each interrupt controller driver */
 extern unsigned int get_irq(struct pt_regs *regs);
-#define ack_bad_irq ack_bad_irq
-void ack_bad_irq(unsigned int irq);
 #include <asm-generic/hardirq.h>
 #endif /* _ASM_MICROBLAZE_HARDIRQ_H */
diff --git a/arch/microblaze/kernel/intc.c b/arch/microblaze/kernel/intc.c
index b15605299a57..6eea6f92b84e 100644
--- a/arch/microblaze/kernel/intc.c
+++ b/arch/microblaze/kernel/intc.c
@@ -12,6 +12,7 @@
 #include <linux/irq.h>
 #include <asm/page.h>
 #include <linux/io.h>
+#include <linux/bug.h>
 #include <asm/prom.h>
 #include <asm/irq.h>
@@ -130,6 +131,7 @@ void __init init_IRQ(void)
                if (intc)
                        break;
        }
+        BUG_ON(!intc);
        intc_baseaddr = *(int *) of_get_property(intc, "reg", NULL);
        intc_baseaddr = (unsigned long) ioremap(intc_baseaddr, PAGE_SIZE);
diff --git a/arch/microblaze/kernel/irq.c b/arch/microblaze/kernel/irq.c
index f688ee93e3b9..7d5ddd62d4d2 100644
--- a/arch/microblaze/kernel/irq.c
+++ b/arch/microblaze/kernel/irq.c
@@ -30,15 +30,6 @@ unsigned int irq_of_parse_and_map(struct device_node *dev, int index)
 }
 EXPORT_SYMBOL_GPL(irq_of_parse_and_map);
-/*
- * 'what should we do if we get a hw irq event on an illegal vector'.
- * each architecture has to answer this themselves.
- */
-void ack_bad_irq(unsigned int irq)
-{
-        printk(KERN_WARNING "unexpected IRQ trap at vector %02x\n", irq);
-}
 static u32 concurrent_irq;
 void do_IRQ(struct pt_regs *regs)
diff --git a/arch/microblaze/kernel/syscall_table.S b/arch/microblaze/kernel/syscall_table.S
index 216db817beb6..457216097dfd 100644
--- a/arch/microblaze/kernel/syscall_table.S
+++ b/arch/microblaze/kernel/syscall_table.S
@@ -313,7 +313,7 @@ ENTRY(sys_call_table)
        .long sys_fchmodat
        .long sys_faccessat
        .long sys_ni_syscall /* pselect6 */
-        .long sys_ni_syscall /* sys_ppoll */
+        .long sys_ppoll
        .long sys_unshare               /* 310 */
        .long sys_set_robust_list
        .long sys_get_robust_list
diff --git a/arch/microblaze/kernel/timer.c b/arch/microblaze/kernel/timer.c
index bdfa2f9f0c81..5499deae7fa6 100644
--- a/arch/microblaze/kernel/timer.c
+++ b/arch/microblaze/kernel/timer.c
@@ -22,6 +22,7 @@
 #include <linux/clocksource.h>
 #include <linux/clockchips.h>
 #include <linux/io.h>
+#include <linux/bug.h>
 #include <asm/cpuinfo.h>
 #include <asm/setup.h>
 #include <asm/prom.h>
@@ -234,6 +235,7 @@ void __init time_init(void)
                if (timer)
                        break;
        }
+        BUG_ON(!timer);
        timer_baseaddr = *(int *) of_get_property(timer, "reg", NULL);
        timer_baseaddr = (unsigned long) ioremap(timer_baseaddr, PAGE_SIZE);
diff --git a/arch/microblaze/mm/init.c b/arch/microblaze/mm/init.c
index 8d92c4efe9a4..f207f1a94dbc 100644
--- a/arch/microblaze/mm/init.c
+++ b/arch/microblaze/mm/init.c
@@ -130,13 +130,13 @@ void __init setup_memory(void)
         * (in case the address isn't page-aligned).
         */
 #ifndef CONFIG_MMU
-        map_size = init_bootmem_node(NODE_DATA(0), PFN_UP(TOPHYS((u32)_end)),
+        map_size = init_bootmem_node(NODE_DATA(0), PFN_UP(TOPHYS((u32)klimit)),
                                        min_low_pfn, max_low_pfn);
 #else
        map_size = init_bootmem_node(&contig_page_data,
-                PFN_UP(TOPHYS((u32)_end)), min_low_pfn, max_low_pfn);
+                PFN_UP(TOPHYS((u32)klimit)), min_low_pfn, max_low_pfn);
 #endif
-        lmb_reserve(PFN_UP(TOPHYS((u32)_end)) << PAGE_SHIFT, map_size);
+        lmb_reserve(PFN_UP(TOPHYS((u32)klimit)) << PAGE_SHIFT, map_size);
        /* free bootmem is whole main memory */
        free_bootmem(memory_start, memory_size);
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 9717717c6fea..cbb897bc50bd 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -154,6 +154,20 @@ static int __init condev_setup(char *str)
 __setup("condev=", condev_setup);
+static void __init set_preferred_console(void)
+{
+        if (MACHINE_IS_KVM) {
+                add_preferred_console("hvc", 0, NULL);
+                s390_virtio_console_init();
+                return;
+        }
+        if (CONSOLE_IS_3215 || CONSOLE_IS_SCLP)
+                add_preferred_console("ttyS", 0, NULL);
+        if (CONSOLE_IS_3270)
+                add_preferred_console("tty3270", 0, NULL);
+}
 static int __init conmode_setup(char *str)
 {
 #if defined(CONFIG_SCLP_CONSOLE) || defined(CONFIG_SCLP_VT220_CONSOLE)
@@ -168,6 +182,7 @@ static int __init conmode_setup(char *str)
        if (strncmp(str, "3270", 5) == 0)
                SET_CONSOLE_3270;
 #endif
+        set_preferred_console();
        return 1;
 }
@@ -780,9 +795,6 @@ static void __init setup_hwcaps(void)
 void __init
 setup_arch(char **cmdline_p)
 {
-        /* set up preferred console */
-        add_preferred_console("ttyS", 0, NULL);
        /*
         * print what head.S has found out about the machine
         */
@@ -802,11 +814,9 @@ setup_arch(char **cmdline_p)
        if (MACHINE_IS_VM)
                pr_info("Linux is running as a z/VM "
                        "guest operating system in 64-bit mode\n");
-        else if (MACHINE_IS_KVM) {
+        else if (MACHINE_IS_KVM)
                pr_info("Linux is running under KVM in 64-bit mode\n");
-                add_preferred_console("hvc", 0, NULL);
+        else
-                s390_virtio_console_init();
-        } else
                pr_info("Linux is running natively in 64-bit mode\n");
 #endif /* CONFIG_64BIT */
@@ -851,6 +861,7 @@ setup_arch(char **cmdline_p)
        /* Setup default console */
        conmode_default();
+        set_preferred_console();
        /* Setup zfcpdump support */
        setup_zfcpdump(console_devno);
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index 8fed45a2fb85..15456a0773bf 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -238,7 +238,7 @@ static struct platform_device ceu1_device = {
        },
 };
-/* KEYSC */
+/* KEYSC in SoC (Needs SW33-2 set to ON) */
 static struct sh_keysc_info keysc_info = {
        .mode = SH_KEYSC_MODE_1,
        .scan_timing = 10,
@@ -255,12 +255,13 @@ static struct sh_keysc_info keysc_info = {
 static struct resource keysc_resources[] = {
        [0] = {
-                .start  = 0x1a204000,
+                .name   = "KEYSC",
-                .end    = 0x1a20400f,
+                .start  = 0x044b0000,
+                .end    = 0x044b000f,
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
-                .start  = IRQ0_KEY,
+                .start  = 79,
                .flags  = IORESOURCE_IRQ,
        },
 };
diff --git a/arch/sh/kernel/cpu/shmobile/sleep.S b/arch/sh/kernel/cpu/shmobile/sleep.S
index 5d888ef53d82..baf2d7d46b05 100644
--- a/arch/sh/kernel/cpu/shmobile/sleep.S
+++ b/arch/sh/kernel/cpu/shmobile/sleep.S
@@ -26,8 +26,30 @@ ENTRY(sh_mobile_standby)
        tst     #SUSP_SH_SF, r0
        bt      skip_set_sf
+#ifdef CONFIG_CPU_SUBTYPE_SH7724
+        /* DBSC: put memory in self-refresh mode */
-        /* SDRAM: disable power down and put in self-refresh mode */
+        mov.l   dben_reg, r4
+        mov.l   dben_data0, r1
+        mov.l   r1, @r4
+        mov.l   dbrfpdn0_reg, r4
+        mov.l   dbrfpdn0_data0, r1
+        mov.l   r1, @r4
+        mov.l   dbcmdcnt_reg, r4
+        mov.l   dbcmdcnt_data0, r1
+        mov.l   r1, @r4
+        mov.l   dbcmdcnt_reg, r4
+        mov.l   dbcmdcnt_data1, r1
+        mov.l   r1, @r4
+        mov.l   dbrfpdn0_reg, r4
+        mov.l   dbrfpdn0_data1, r1
+        mov.l   r1, @r4
+#else
+        /* SBSC: disable power down and put in self-refresh mode */
        mov.l   1f, r4
        mov.l   2f, r1
        mov.l   @r4, r2
@@ -35,6 +57,7 @@ ENTRY(sh_mobile_standby)
        mov.l   3f, r3
        and     r3, r2
        mov.l   r2, @r4
+#endif
 skip_set_sf:
        tst     #SUSP_SH_SLEEP, r0
@@ -84,7 +107,36 @@ done_sleep:
        tst     #SUSP_SH_SF, r0
        bt      skip_restore_sf
-        /* SDRAM: set auto-refresh mode */
+#ifdef CONFIG_CPU_SUBTYPE_SH7724
+        /* DBSC: put memory in auto-refresh mode */
+        mov.l   dbrfpdn0_reg, r4
+        mov.l   dbrfpdn0_data0, r1
+        mov.l   r1, @r4
+        /* sleep 140 ns */
+        nop
+        nop
+        nop
+        nop
+        mov.l   dbcmdcnt_reg, r4
+        mov.l   dbcmdcnt_data0, r1
+        mov.l   r1, @r4
+        mov.l   dbcmdcnt_reg, r4
+        mov.l   dbcmdcnt_data1, r1
+        mov.l   r1, @r4
+        mov.l   dben_reg, r4
+        mov.l   dben_data1, r1
+        mov.l   r1, @r4
+        mov.l   dbrfpdn0_reg, r4
+        mov.l   dbrfpdn0_data2, r1
+        mov.l   r1, @r4
+#else
+        /* SBSC: set auto-refresh mode */
        mov.l   1f, r4
        mov.l   @r4, r2
        mov.l   4f, r3
@@ -98,15 +150,29 @@ done_sleep:
        add     r4, r3
        or      r2, r3
        mov.l   r3, @r1
+#endif
 skip_restore_sf:
        rts
         nop
        .balign 4
+#ifdef CONFIG_CPU_SUBTYPE_SH7724
+dben_reg:       .long   0xfd000010 /* DBEN */
+dben_data0:     .long   0
+dben_data1:     .long   1
+dbrfpdn0_reg:   .long   0xfd000040 /* DBRFPDN0 */
+dbrfpdn0_data0: .long   0
+dbrfpdn0_data1: .long   1
+dbrfpdn0_data2: .long   0x00010000
+dbcmdcnt_reg:   .long   0xfd000014 /* DBCMDCNT */
+dbcmdcnt_data0: .long   2
+dbcmdcnt_data1: .long   4
+#else
 1:      .long   0xfe400008 /* SDCR0 */
 2:      .long   0x00000400
 3:      .long   0xffff7fff
 4:      .long   0xfffffbff
+#endif
 5:      .long   0xa4150020 /* STBCR */
 6:      .long   0xfe40001c /* RTCOR */
 7:      .long   0xfe400018 /* RTCNT */
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index fa44eaf8d897..3691907a43b4 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -1499,7 +1499,7 @@ void __init setup_per_cpu_areas(void)
        dyn_size = pcpur_size - static_size - PERCPU_MODULE_RESERVE;
-        ptrs_size = PFN_ALIGN(num_possible_cpus() * sizeof(pcpur_ptrs[0]));
+        ptrs_size = PFN_ALIGN(nr_cpu_ids * sizeof(pcpur_ptrs[0]));
        pcpur_ptrs = alloc_bootmem(ptrs_size);
        for_each_possible_cpu(cpu) {
@@ -1514,7 +1514,7 @@ void __init setup_per_cpu_areas(void)
        /* allocate address and map */
        vm.flags = VM_ALLOC;
-        vm.size = num_possible_cpus() * PCPU_CHUNK_SIZE;
+        vm.size = nr_cpu_ids * PCPU_CHUNK_SIZE;
        vm_area_register_early(&vm, PCPU_CHUNK_SIZE);
        for_each_possible_cpu(cpu) {
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index e2ff504b4ddc..f8ed0658404c 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -4,7 +4,7 @@
 # create a compressed vmlinux image from the original vmlinux
 #
-targets := vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma head_$(BITS).o misc.o piggy.o
+targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma head_$(BITS).o misc.o piggy.o
 KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
 KBUILD_CFLAGS += -fno-strict-aliasing -fPIC
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 3cc06e3fceb8..16748077559a 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -2,6 +2,7 @@
 #define _ASM_X86_PGTABLE_H
 #include <asm/page.h>
+#include <asm/e820.h>
 #include <asm/pgtable_types.h>
@@ -269,10 +270,17 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
 #define canon_pgprot(p) __pgprot(massage_pgprot(p))
-static inline int is_new_memtype_allowed(unsigned long flags,
+static inline int is_new_memtype_allowed(u64 paddr, unsigned long size,
-                                                unsigned long new_flags)
+                                         unsigned long flags,
+                                         unsigned long new_flags)
 {
        /*
+         * PAT type is always WB for ISA. So no need to check.
+         */
+        if (is_ISA_range(paddr, paddr + size - 1))
+                return 1;
+        /*
         * Certain new memtypes are not allowed with certain
         * requested memtype:
         * - request is uncached, return cannot be write-back
diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
index bddd44f2f0ab..80e2984f521c 100644
--- a/arch/x86/include/asm/uv/uv_bau.h
+++ b/arch/x86/include/asm/uv/uv_bau.h
@@ -133,7 +133,7 @@ struct bau_msg_payload {
 * see table 4.2.3.0.1 in broacast_assist spec.
 */
 struct bau_msg_header {
-        unsigned int dest_subnodeid:6;  /* must be zero */
+        unsigned int dest_subnodeid:6;  /* must be 0x10, for the LB */
        /* bits 5:0 */
        unsigned int base_dest_nodeid:15; /* nasid>>1 (pnode) of */
        /* bits 20:6 */                   /* first bit in node_map */
diff --git a/arch/x86/kernel/apic/ipi.c b/arch/x86/kernel/apic/ipi.c
index dbf5445727a9..6ef00ba4c886 100644
--- a/arch/x86/kernel/apic/ipi.c
+++ b/arch/x86/kernel/apic/ipi.c
@@ -106,6 +106,9 @@ void default_send_IPI_mask_logical(const struct cpumask *cpumask, int vector)
        unsigned long mask = cpumask_bits(cpumask)[0];
        unsigned long flags;
+        if (WARN_ONCE(!mask, "empty IPI mask"))
+                return;
        local_irq_save(flags);
        WARN_ON(mask & ~cpumask_bits(cpu_online_mask)[0]);
        __default_send_IPI_dest_field(mask, vector, apic->dest_logical);
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 832e908adcb5..601159374e87 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -46,7 +46,7 @@ static int early_get_nodeid(void)
        return node_id.s.node_id;
 }
-static int uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+static int __init uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
 {
        if (!strcmp(oem_id, "SGI")) {
                if (!strcmp(oem_table_id, "UVL"))
@@ -253,7 +253,7 @@ static void uv_send_IPI_self(int vector)
        apic_write(APIC_SELF_IPI, vector);
 }
-struct apic apic_x2apic_uv_x = {
+struct apic __refdata apic_x2apic_uv_x = {
        .name                           = "UV large system",
        .probe                          = NULL,
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index 3efcb2b96a15..c1f253dac155 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -7,6 +7,10 @@ ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_common.o = -pg
 endif
+# Make sure load_percpu_segment has no stackprotector
+nostackp := $(call cc-option, -fno-stack-protector)
+CFLAGS_common.o         := $(nostackp)
 obj-y                   := intel_cacheinfo.o addon_cpuid_features.o
 obj-y                   += proc.o capflags.o powerflags.o common.o
 obj-y                   += vmware.o hypervisor.o
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 1cfb623ce11c..01213048f62f 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1226,8 +1226,13 @@ static void mce_init(void)
 }
 /* Add per CPU specific workarounds here */
-static void mce_cpu_quirks(struct cpuinfo_x86 *c)
+static int mce_cpu_quirks(struct cpuinfo_x86 *c)
 {
+        if (c->x86_vendor == X86_VENDOR_UNKNOWN) {
+                pr_info("MCE: unknown CPU type - not enabling MCE support.\n");
+                return -EOPNOTSUPP;
+        }
        /* This should be disabled by the BIOS, but isn't always */
        if (c->x86_vendor == X86_VENDOR_AMD) {
                if (c->x86 == 15 && banks > 4) {
@@ -1273,11 +1278,20 @@ static void mce_cpu_quirks(struct cpuinfo_x86 *c)
                if ((c->x86 > 6 || (c->x86 == 6 && c->x86_model >= 0xe)) &&
                        monarch_timeout < 0)
                        monarch_timeout = USEC_PER_SEC;
+                /*
+                 * There are also broken BIOSes on some Pentium M and
+                 * earlier systems:
+                 */
+                if (c->x86 == 6 && c->x86_model <= 13 && mce_bootlog < 0)
+                        mce_bootlog = 0;
        }
        if (monarch_timeout < 0)
                monarch_timeout = 0;
        if (mce_bootlog != 0)
                mce_panic_timeout = 30;
+        return 0;
 }
 static void __cpuinit mce_ancient_init(struct cpuinfo_x86 *c)
@@ -1338,11 +1352,10 @@ void __cpuinit mcheck_init(struct cpuinfo_x86 *c)
        if (!mce_available(c))
                return;
-        if (mce_cap_init() < 0) {
+        if (mce_cap_init() < 0 || mce_cpu_quirks(c) < 0) {
                mce_disabled = 1;
                return;
        }
-        mce_cpu_quirks(c);
        machine_check_vector = do_machine_check;
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index 8bc64cfbe936..5957a93e5173 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -116,11 +116,14 @@ static int therm_throt_process(int curr)
                       cpu, __get_cpu_var(thermal_throttle_count));
                add_taint(TAINT_MACHINE_CHECK);
-        } else if (was_throttled) {
+                return 1;
+        }
+        if (was_throttled) {
                printk(KERN_INFO "CPU%d: Temperature/speed normal\n", cpu);
+                return 1;
        }
-        return 1;
+        return 0;
 }
 #ifdef CONFIG_SYSFS
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 0d98a01cbdb2..cc827ac9e8d3 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -261,9 +261,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
 * which will be freed later
 */
-#ifndef CONFIG_HOTPLUG_CPU
+__CPUINIT
-.section .init.text,"ax",@progbits
-#endif
 #ifdef CONFIG_SMP
 ENTRY(startup_32_smp)
@@ -602,11 +600,7 @@ ignore_int:
 #endif
        iret
-#ifndef CONFIG_HOTPLUG_CPU
-        __CPUINITDATA
-#else
        __REFDATA
-#endif
 .align 4
 ENTRY(initial_code)
        .long i386_start_kernel
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index 29a3eef7cf4a..07d81916f212 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -165,7 +165,7 @@ static ssize_t __init setup_pcpu_lpage(size_t static_size, bool chosen)
        if (!chosen) {
                size_t vm_size = VMALLOC_END - VMALLOC_START;
-                size_t tot_size = num_possible_cpus() * PMD_SIZE;
+                size_t tot_size = nr_cpu_ids * PMD_SIZE;
                /* on non-NUMA, embedding is better */
                if (!pcpu_need_numa())
@@ -199,7 +199,7 @@ static ssize_t __init setup_pcpu_lpage(size_t static_size, bool chosen)
        dyn_size = pcpul_size - static_size - PERCPU_FIRST_CHUNK_RESERVE;
        /* allocate pointer array and alloc large pages */
-        map_size = PFN_ALIGN(num_possible_cpus() * sizeof(pcpul_map[0]));
+        map_size = PFN_ALIGN(nr_cpu_ids * sizeof(pcpul_map[0]));
        pcpul_map = alloc_bootmem(map_size);
        for_each_possible_cpu(cpu) {
@@ -228,7 +228,7 @@ static ssize_t __init setup_pcpu_lpage(size_t static_size, bool chosen)
        /* allocate address and map */
        pcpul_vm.flags = VM_ALLOC;
-        pcpul_vm.size = num_possible_cpus() * PMD_SIZE;
+        pcpul_vm.size = nr_cpu_ids * PMD_SIZE;
        vm_area_register_early(&pcpul_vm, PMD_SIZE);
        for_each_possible_cpu(cpu) {
@@ -250,8 +250,8 @@ static ssize_t __init setup_pcpu_lpage(size_t static_size, bool chosen)
                                     PMD_SIZE, pcpul_vm.addr, NULL);
        /* sort pcpul_map array for pcpu_lpage_remapped() */
-        for (i = 0; i < num_possible_cpus() - 1; i++)
+        for (i = 0; i < nr_cpu_ids - 1; i++)
-                for (j = i + 1; j < num_possible_cpus(); j++)
+                for (j = i + 1; j < nr_cpu_ids; j++)
                        if (pcpul_map[i].ptr > pcpul_map[j].ptr) {
                                struct pcpul_ent tmp = pcpul_map[i];
                                pcpul_map[i] = pcpul_map[j];
@@ -288,7 +288,7 @@ void *pcpu_lpage_remapped(void *kaddr)
 {
        void *pmd_addr = (void *)((unsigned long)kaddr & PMD_MASK);
        unsigned long offset = (unsigned long)kaddr & ~PMD_MASK;
-        int left = 0, right = num_possible_cpus() - 1;
+        int left = 0, right = nr_cpu_ids - 1;
        int pos;
        /* pcpul in use at all? */
@@ -377,7 +377,7 @@ static ssize_t __init setup_pcpu_4k(size_t static_size)
        pcpu4k_nr_static_pages = PFN_UP(static_size);
        /* unaligned allocations can't be freed, round up to page size */
-        pages_size = PFN_ALIGN(pcpu4k_nr_static_pages * num_possible_cpus()
+        pages_size = PFN_ALIGN(pcpu4k_nr_static_pages * nr_cpu_ids
                               * sizeof(pcpu4k_pages[0]));
        pcpu4k_pages = alloc_bootmem(pages_size);
diff --git a/arch/x86/kernel/tlb_uv.c b/arch/x86/kernel/tlb_uv.c
index 8ccabb8a2f6a..77b9689f8edb 100644
--- a/arch/x86/kernel/tlb_uv.c
+++ b/arch/x86/kernel/tlb_uv.c
@@ -744,6 +744,7 @@ uv_activation_descriptor_init(int node, int pnode)
                 * note that base_dest_nodeid is actually a nasid.
                 */
                ad2->header.base_dest_nodeid = uv_partition_base_pnode << 1;
+                ad2->header.dest_subnodeid = 0x10; /* the LB */
                ad2->header.command = UV_NET_ENDPOINT_INTD;
                ad2->header.int_both = 1;
                /*
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 78d185d797de..9fc178255c04 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -46,11 +46,10 @@ PHDRS {
        data PT_LOAD FLAGS(7);          /* RWE */
 #ifdef CONFIG_X86_64
        user PT_LOAD FLAGS(7);          /* RWE */
-        data.init PT_LOAD FLAGS(7);     /* RWE */
 #ifdef CONFIG_SMP
        percpu PT_LOAD FLAGS(7);        /* RWE */
 #endif
-        data.init2 PT_LOAD FLAGS(7);    /* RWE */
+        init PT_LOAD FLAGS(7);          /* RWE */
 #endif
        note PT_NOTE FLAGS(0);          /* ___ */
 }
@@ -103,65 +102,43 @@ SECTIONS
                __stop___ex_table = .;
        } :text = 0x9090
-        RODATA
+        RO_DATA(PAGE_SIZE)
        /* Data */
-        . = ALIGN(PAGE_SIZE);
        .data : AT(ADDR(.data) - LOAD_OFFSET) {
                /* Start of data section */
                _sdata = .;
-                DATA_DATA
-                CONSTRUCTORS
+                /* init_task */
-        } :data
+                INIT_TASK_DATA(THREAD_SIZE)
 #ifdef CONFIG_X86_32
-        /* 32 bit has nosave before _edata */
+                /* 32 bit has nosave before _edata */
-        . = ALIGN(PAGE_SIZE);
+                NOSAVE_DATA
-        .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
-                __nosave_begin = .;
-                *(.data.nosave)
-                . = ALIGN(PAGE_SIZE);
-                __nosave_end = .;
-        }
 #endif
-        . = ALIGN(PAGE_SIZE);
+                PAGE_ALIGNED_DATA(PAGE_SIZE)
-        .data.page_aligned : AT(ADDR(.data.page_aligned) - LOAD_OFFSET) {
-                *(.data.page_aligned)
                *(.data.idt)
-        }
-#ifdef CONFIG_X86_32
+                CACHELINE_ALIGNED_DATA(CONFIG_X86_L1_CACHE_BYTES)
-        . = ALIGN(32);
-#else
-        . = ALIGN(PAGE_SIZE);
-        . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
-#endif
-        .data.cacheline_aligned :
-                AT(ADDR(.data.cacheline_aligned) - LOAD_OFFSET) {
-                *(.data.cacheline_aligned)
-        }
-        /* rarely changed data like cpu maps */
+                DATA_DATA
-#ifdef CONFIG_X86_32
+                CONSTRUCTORS
-        . = ALIGN(32);
-#else
+                /* rarely changed data like cpu maps */
-        . = ALIGN(CONFIG_X86_INTERNODE_CACHE_BYTES);
+                READ_MOSTLY_DATA(CONFIG_X86_INTERNODE_CACHE_BYTES)
-#endif
-        .data.read_mostly : AT(ADDR(.data.read_mostly) - LOAD_OFFSET) {
-                *(.data.read_mostly)
                /* End of data section */
                _edata = .;
-        }
+        } :data
 #ifdef CONFIG_X86_64
 #define VSYSCALL_ADDR (-10*1024*1024)
-#define VSYSCALL_PHYS_ADDR ((LOADADDR(.data.read_mostly) + \
+#define VSYSCALL_PHYS_ADDR ((LOADADDR(.data) + SIZEOF(.data) + \
-                            SIZEOF(.data.read_mostly) + 4095) & ~(4095))
+                            PAGE_SIZE - 1) & ~(PAGE_SIZE - 1))
-#define VSYSCALL_VIRT_ADDR ((ADDR(.data.read_mostly) + \
+#define VSYSCALL_VIRT_ADDR ((ADDR(.data) + SIZEOF(.data) + \
-                            SIZEOF(.data.read_mostly) + 4095) & ~(4095))
+                            PAGE_SIZE - 1) & ~(PAGE_SIZE - 1))
 #define VLOAD_OFFSET (VSYSCALL_ADDR - VSYSCALL_PHYS_ADDR)
 #define VLOAD(x) (ADDR(x) - VLOAD_OFFSET)
@@ -227,35 +204,29 @@ SECTIONS
 #endif /* CONFIG_X86_64 */
-        /* init_task */
+        /* Init code and data - will be freed after init */
-        . = ALIGN(THREAD_SIZE);
+        . = ALIGN(PAGE_SIZE);
-        .data.init_task : AT(ADDR(.data.init_task) - LOAD_OFFSET) {
+        .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
-                *(.data.init_task)
+                __init_begin = .; /* paired with __init_end */
        }
-#ifdef CONFIG_X86_64
-         :data.init
-#endif
+#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
        /*
-         * smp_locks might be freed after init
+         * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
-         * start/end must be page aligned
+         * output PHDR, so the next output section - .init.text - should
+         * start another segment - init.
         */
-        . = ALIGN(PAGE_SIZE);
+        PERCPU_VADDR(0, :percpu)
-        .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
+#endif
-                __smp_locks = .;
-                *(.smp_locks)
-                __smp_locks_end = .;
-                . = ALIGN(PAGE_SIZE);
-        }
-        /* Init code and data - will be freed after init */
-        . = ALIGN(PAGE_SIZE);
        .init.text : AT(ADDR(.init.text) - LOAD_OFFSET) {
-                __init_begin = .; /* paired with __init_end */
                _sinittext = .;
                INIT_TEXT
                _einittext = .;
        }
+#ifdef CONFIG_X86_64
+        :init
+#endif
        .init.data : AT(ADDR(.init.data) - LOAD_OFFSET) {
                INIT_DATA
@@ -326,17 +297,7 @@ SECTIONS
        }
 #endif
-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
+#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
-        /*
-         * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
-         * output PHDR, so the next output section - __data_nosave - should
-         * start another section data.init2.  Also, pda should be at the head of
-         * percpu area.  Preallocate it and define the percpu offset symbol
-         * so that it can be accessed as a percpu variable.
-         */
-        . = ALIGN(PAGE_SIZE);
-        PERCPU_VADDR(0, :percpu)
-#else
        PERCPU(PAGE_SIZE)
 #endif
@@ -347,15 +308,22 @@ SECTIONS
                __init_end = .;
        }
+        /*
+         * smp_locks might be freed after init
+         * start/end must be page aligned
+         */
+        . = ALIGN(PAGE_SIZE);
+        .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
+                __smp_locks = .;
+                *(.smp_locks)
+                __smp_locks_end = .;
+                . = ALIGN(PAGE_SIZE);
+        }
 #ifdef CONFIG_X86_64
        .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
-                . = ALIGN(PAGE_SIZE);
+                NOSAVE_DATA
-                __nosave_begin = .;
+        }
-                *(.data.nosave)
-                . = ALIGN(PAGE_SIZE);
-                __nosave_end = .;
-        } :data.init2
-        /* use another section data.init2, see PERCPU_VADDR() above */
 #endif
        /* BSS */
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 6176fe8f29e0..ea56b8cbb6a6 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -796,7 +796,7 @@ int __init reserve_bootmem_generic(unsigned long phys, unsigned long len,
                return ret;
 #else
-        reserve_bootmem(phys, len, BOOTMEM_DEFAULT);
+        reserve_bootmem(phys, len, flags);
 #endif
        if (phys+len <= MAX_DMA_PFN*PAGE_SIZE) {
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index e6718bb28065..352aa9e927e2 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -623,7 +623,8 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
                return ret;
        if (flags != want_flags) {
-                if (strict_prot || !is_new_memtype_allowed(want_flags, flags)) {
+                if (strict_prot ||
+                    !is_new_memtype_allowed(paddr, size, want_flags, flags)) {
                        free_memtype(paddr, paddr + size);
                        printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
                                " for %Lx-%Lx, got %s\n",
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 821e97017e95..c814e144a3f0 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -183,18 +183,17 @@ static void flush_tlb_others_ipi(const struct cpumask *cpumask,
        f->flush_mm = mm;
        f->flush_va = va;
-        cpumask_andnot(to_cpumask(f->flush_cpumask),
+        if (cpumask_andnot(to_cpumask(f->flush_cpumask), cpumask, cpumask_of(smp_processor_id()))) {
-                       cpumask, cpumask_of(smp_processor_id()));
+                /*
+                 * We have to send the IPI only to
-        /*
+                 * CPUs affected.
-         * We have to send the IPI only to
+                 */
-         * CPUs affected.
+                apic->send_IPI_mask(to_cpumask(f->flush_cpumask),
-         */
+                              INVALIDATE_TLB_VECTOR_START + sender);
-        apic->send_IPI_mask(to_cpumask(f->flush_cpumask),
-                      INVALIDATE_TLB_VECTOR_START + sender);
-        while (!cpumask_empty(to_cpumask(f->flush_cpumask)))
+                while (!cpumask_empty(to_cpumask(f->flush_cpumask)))
-                cpu_relax();
+                        cpu_relax();
+        }
        f->flush_mm = NULL;
        f->flush_va = 0;
diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
index 172438f86a02..7410640db173 100644
--- a/arch/x86/xen/Makefile
+++ b/arch/x86/xen/Makefile
@@ -5,6 +5,10 @@ CFLAGS_REMOVE_time.o = -pg
 CFLAGS_REMOVE_irq.o = -pg
 endif
+# Make sure early boot has no stackprotector
+nostackp := $(call cc-option, -fno-stack-protector)
+CFLAGS_enlighten.o              := $(nostackp)
 obj-y           := enlighten.o setup.o multicalls.o mmu.o irq.o \
                        time.o xen-asm.o xen-asm_$(BITS).o \
                        grant-table.o suspend.o
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 0a1700a2be9c..e90540a46a0b 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -974,10 +974,6 @@ asmlinkage void __init xen_start_kernel(void)
        xen_domain_type = XEN_PV_DOMAIN;
-        BUG_ON(memcmp(xen_start_info->magic, "xen-3", 5) != 0);
-        xen_setup_features();
        /* Install Xen paravirt ops */
        pv_info = xen_info;
        pv_init_ops = xen_init_ops;
@@ -986,8 +982,15 @@ asmlinkage void __init xen_start_kernel(void)
        pv_apic_ops = xen_apic_ops;
        pv_mmu_ops = xen_mmu_ops;
-        xen_init_irq_ops();
+#ifdef CONFIG_X86_64
+        /*
+         * Setup percpu state.  We only need to do this for 64-bit
+         * because 32-bit already has %fs set properly.
+         */
+        load_percpu_segment(0);
+#endif
+        xen_init_irq_ops();
        xen_init_cpuid_mask();
 #ifdef CONFIG_X86_LOCAL_APIC
@@ -997,6 +1000,8 @@ asmlinkage void __init xen_start_kernel(void)
        set_xen_basic_apic_ops();
 #endif
+        xen_setup_features();
        if (xen_feature(XENFEAT_mmu_pt_update_preserve_ad)) {
                pv_mmu_ops.ptep_modify_prot_start = xen_ptep_modify_prot_start;
                pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
@@ -1004,13 +1009,6 @@ asmlinkage void __init xen_start_kernel(void)
        machine_ops = xen_machine_ops;
-#ifdef CONFIG_X86_64
-        /*
-         * Setup percpu state.  We only need to do this for 64-bit
-         * because 32-bit already has %fs set properly.
-         */
-        load_percpu_segment(0);
-#endif
        /*
         * The only reliable way to retain the initial address of the
         * percpu gdt_page is to remember it here, so we can go and
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index 1733d3439ad2..e48af9f79219 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -508,8 +508,9 @@ static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
 *      be obtained while the delayed work queue halt ensures that no more
 *      data is fed to the ldisc.
 *
- *      In order to wait for any existing references to complete see
+ *      You need to do a 'flush_scheduled_work()' (outside the ldisc_mutex)
- *      tty_ldisc_wait_idle.
+ *      in order to make sure any currently executing ldisc work is also
+ *      flushed.
 */
 static int tty_ldisc_halt(struct tty_struct *tty)
@@ -753,11 +754,14 @@ void tty_ldisc_hangup(struct tty_struct *tty)
         * N_TTY.
         */
        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
+                /* Make sure the old ldisc is quiescent */
+                tty_ldisc_halt(tty);
+                flush_scheduled_work();
                /* Avoid racing set_ldisc or tty_ldisc_release */
                mutex_lock(&tty->ldisc_mutex);
                if (tty->ldisc) {       /* Not yet closed */
                        /* Switch back to N_TTY */
-                        tty_ldisc_halt(tty);
                        tty_ldisc_reinit(tty);
                        /* At this point we have a closed ldisc and we want to
                           reopen it. We could defer this to the next open but
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 2964f5f4a7ef..6b3e0c2f33e2 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -40,6 +40,7 @@ struct sh_cmt_priv {
        struct platform_device *pdev;
        unsigned long flags;
+        unsigned long flags_suspend;
        unsigned long match_value;
        unsigned long next_match_value;
        unsigned long max_match_value;
@@ -667,11 +668,38 @@ static int __devexit sh_cmt_remove(struct platform_device *pdev)
        return -EBUSY; /* cannot unregister clockevent and clocksource */
 }
+static int sh_cmt_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_cmt_priv *p = platform_get_drvdata(pdev);
+        /* save flag state and stop CMT channel */
+        p->flags_suspend = p->flags;
+        sh_cmt_stop(p, p->flags);
+        return 0;
+}
+static int sh_cmt_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_cmt_priv *p = platform_get_drvdata(pdev);
+        /* start CMT channel from saved state */
+        sh_cmt_start(p, p->flags_suspend);
+        return 0;
+}
+static struct dev_pm_ops sh_cmt_dev_pm_ops = {
+        .suspend = sh_cmt_suspend,
+        .resume = sh_cmt_resume,
+};
 static struct platform_driver sh_cmt_device_driver = {
        .probe          = sh_cmt_probe,
        .remove         = __devexit_p(sh_cmt_remove),
        .driver         = {
                .name   = "sh_cmt",
+                .pm     = &sh_cmt_dev_pm_ops,
        }
 };
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 33be210d6723..2f631c75f704 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -258,31 +258,6 @@ void *drm_mode_object_find(struct drm_device *dev, uint32_t id, uint32_t type)
 EXPORT_SYMBOL(drm_mode_object_find);
 /**
- * drm_crtc_from_fb - find the CRTC structure associated with an fb
- * @dev: DRM device
- * @fb: framebuffer in question
- *
- * LOCKING:
- * Caller must hold mode_config lock.
- *
- * Find CRTC in the mode_config structure that matches @fb.
- *
- * RETURNS:
- * Pointer to the CRTC or NULL if it wasn't found.
- */
-struct drm_crtc *drm_crtc_from_fb(struct drm_device *dev,
-                                  struct drm_framebuffer *fb)
-{
-        struct drm_crtc *crtc;
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->fb == fb)
-                        return crtc;
-        }
-        return NULL;
-}
-/**
 * drm_framebuffer_init - initialize a framebuffer
 * @dev: DRM device
 *
@@ -328,11 +303,20 @@ void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
 {
        struct drm_device *dev = fb->dev;
        struct drm_crtc *crtc;
+        struct drm_mode_set set;
+        int ret;
        /* remove from any CRTC */
        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->fb == fb)
+                if (crtc->fb == fb) {
-                        crtc->fb = NULL;
+                        /* should turn off the crtc */
+                        memset(&set, 0, sizeof(struct drm_mode_set));
+                        set.crtc = crtc;
+                        set.fb = NULL;
+                        ret = crtc->funcs->set_config(&set);
+                        if (ret)
+                                DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
+                }
        }
        drm_mode_object_put(dev, &fb->base);
@@ -1511,7 +1495,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
        set.mode = mode;
        set.connectors = connector_set;
        set.num_connectors = crtc_req->count_connectors;
-        set.fb =fb;
+        set.fb = fb;
        ret = crtc->funcs->set_config(&set);
 out:
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 80cc6d06d61b..7f2728bbc16c 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -502,12 +502,40 @@ static int add_detailed_info(struct drm_connector *connector,
                struct detailed_non_pixel *data = &timing->data.other_data;
                struct drm_display_mode *newmode;
-                /* EDID up to and including 1.2 may put monitor info here */
+                /* X server check is version 1.1 or higher */
-                if (edid->version == 1 && edid->revision < 3)
+                if (edid->version == 1 && edid->revision >= 1 &&
-                        continue;
+                    !timing->pixel_clock) {
+                        /* Other timing or info */
-                /* Detailed mode timing */
+                        switch (data->type) {
-                if (timing->pixel_clock) {
+                        case EDID_DETAIL_MONITOR_SERIAL:
+                                break;
+                        case EDID_DETAIL_MONITOR_STRING:
+                                break;
+                        case EDID_DETAIL_MONITOR_RANGE:
+                                /* Get monitor range data */
+                                break;
+                        case EDID_DETAIL_MONITOR_NAME:
+                                break;
+                        case EDID_DETAIL_MONITOR_CPDATA:
+                                break;
+                        case EDID_DETAIL_STD_MODES:
+                                /* Five modes per detailed section */
+                                for (j = 0; j < 5; i++) {
+                                        struct std_timing *std;
+                                        struct drm_display_mode *newmode;
+                                        std = &data->data.timings[j];
+                                        newmode = drm_mode_std(dev, std);
+                                        if (newmode) {
+                                                drm_mode_probed_add(connector, newmode);
+                                                modes++;
+                                        }
+                                }
+                                break;
+                        default:
+                                break;
+                        }
+                } else {
                        newmode = drm_mode_detailed(dev, edid, timing, quirks);
                        if (!newmode)
                                continue;
@@ -518,38 +546,6 @@ static int add_detailed_info(struct drm_connector *connector,
                        drm_mode_probed_add(connector, newmode);
                        modes++;
-                        continue;
-                }
-                /* Other timing or info */
-                switch (data->type) {
-                case EDID_DETAIL_MONITOR_SERIAL:
-                        break;
-                case EDID_DETAIL_MONITOR_STRING:
-                        break;
-                case EDID_DETAIL_MONITOR_RANGE:
-                        /* Get monitor range data */
-                        break;
-                case EDID_DETAIL_MONITOR_NAME:
-                        break;
-                case EDID_DETAIL_MONITOR_CPDATA:
-                        break;
-                case EDID_DETAIL_STD_MODES:
-                        /* Five modes per detailed section */
-                        for (j = 0; j < 5; i++) {
-                                struct std_timing *std;
-                                struct drm_display_mode *newmode;
-                                std = &data->data.timings[j];
-                                newmode = drm_mode_std(dev, std);
-                                if (newmode) {
-                                        drm_mode_probed_add(connector, newmode);
-                                        modes++;
-                                }
-                        }
-                        break;
-                default:
-                        break;
                }
        }
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 85ec31b3ff00..f7a615b80c70 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -22,44 +22,50 @@
 #define to_drm_minor(d) container_of(d, struct drm_minor, kdev)
 #define to_drm_connector(d) container_of(d, struct drm_connector, kdev)
+static struct device_type drm_sysfs_device_minor = {
+        .name = "drm_minor"
+};
 /**
- * drm_sysfs_suspend - DRM class suspend hook
+ * drm_class_suspend - DRM class suspend hook
 * @dev: Linux device to suspend
 * @state: power state to enter
 *
 * Just figures out what the actual struct drm_device associated with
 * @dev is and calls its suspend hook, if present.
 */
-static int drm_sysfs_suspend(struct device *dev, pm_message_t state)
+static int drm_class_suspend(struct device *dev, pm_message_t state)
 {
-        struct drm_minor *drm_minor = to_drm_minor(dev);
+        if (dev->type == &drm_sysfs_device_minor) {
-        struct drm_device *drm_dev = drm_minor->dev;
+                struct drm_minor *drm_minor = to_drm_minor(dev);
+                struct drm_device *drm_dev = drm_minor->dev;
-        if (drm_minor->type == DRM_MINOR_LEGACY &&
-            !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
+                if (drm_minor->type == DRM_MINOR_LEGACY &&
-            drm_dev->driver->suspend)
+                    !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
-                return drm_dev->driver->suspend(drm_dev, state);
+                    drm_dev->driver->suspend)
+                        return drm_dev->driver->suspend(drm_dev, state);
+        }
        return 0;
 }
 /**
- * drm_sysfs_resume - DRM class resume hook
+ * drm_class_resume - DRM class resume hook
 * @dev: Linux device to resume
 *
 * Just figures out what the actual struct drm_device associated with
 * @dev is and calls its resume hook, if present.
 */
-static int drm_sysfs_resume(struct device *dev)
+static int drm_class_resume(struct device *dev)
 {
-        struct drm_minor *drm_minor = to_drm_minor(dev);
+        if (dev->type == &drm_sysfs_device_minor) {
-        struct drm_device *drm_dev = drm_minor->dev;
+                struct drm_minor *drm_minor = to_drm_minor(dev);
+                struct drm_device *drm_dev = drm_minor->dev;
-        if (drm_minor->type == DRM_MINOR_LEGACY &&
-            !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
+                if (drm_minor->type == DRM_MINOR_LEGACY &&
-            drm_dev->driver->resume)
+                    !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
-                return drm_dev->driver->resume(drm_dev);
+                    drm_dev->driver->resume)
+                        return drm_dev->driver->resume(drm_dev);
+        }
        return 0;
 }
@@ -99,8 +105,8 @@ struct class *drm_sysfs_create(struct module *owner, char *name)
                goto err_out;
        }
-        class->suspend = drm_sysfs_suspend;
+        class->suspend = drm_class_suspend;
-        class->resume = drm_sysfs_resume;
+        class->resume = drm_class_resume;
        err = class_create_file(class, &class_attr_version);
        if (err)
@@ -480,6 +486,7 @@ int drm_sysfs_device_add(struct drm_minor *minor)
        minor->kdev.class = drm_class;
        minor->kdev.release = drm_sysfs_device_release;
        minor->kdev.devt = minor->device;
+        minor->kdev.type = &drm_sysfs_device_minor;
        if (minor->type == DRM_MINOR_CONTROL)
                minor_str = "controlD%d";
        else if (minor->type == DRM_MINOR_RENDER)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index f1ba8ff41130..68e728e8be4d 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -254,6 +254,72 @@ void r100_mc_fini(struct radeon_device *rdev)
 /*
+ * Interrupts
+ */
+int r100_irq_set(struct radeon_device *rdev)
+{
+        uint32_t tmp = 0;
+        if (rdev->irq.sw_int) {
+                tmp |= RADEON_SW_INT_ENABLE;
+        }
+        if (rdev->irq.crtc_vblank_int[0]) {
+                tmp |= RADEON_CRTC_VBLANK_MASK;
+        }
+        if (rdev->irq.crtc_vblank_int[1]) {
+                tmp |= RADEON_CRTC2_VBLANK_MASK;
+        }
+        WREG32(RADEON_GEN_INT_CNTL, tmp);
+        return 0;
+}
+static inline uint32_t r100_irq_ack(struct radeon_device *rdev)
+{
+        uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
+        uint32_t irq_mask = RADEON_SW_INT_TEST | RADEON_CRTC_VBLANK_STAT |
+                RADEON_CRTC2_VBLANK_STAT;
+        if (irqs) {
+                WREG32(RADEON_GEN_INT_STATUS, irqs);
+        }
+        return irqs & irq_mask;
+}
+int r100_irq_process(struct radeon_device *rdev)
+{
+        uint32_t status;
+        status = r100_irq_ack(rdev);
+        if (!status) {
+                return IRQ_NONE;
+        }
+        while (status) {
+                /* SW interrupt */
+                if (status & RADEON_SW_INT_TEST) {
+                        radeon_fence_process(rdev);
+                }
+                /* Vertical blank interrupts */
+                if (status & RADEON_CRTC_VBLANK_STAT) {
+                        drm_handle_vblank(rdev->ddev, 0);
+                }
+                if (status & RADEON_CRTC2_VBLANK_STAT) {
+                        drm_handle_vblank(rdev->ddev, 1);
+                }
+                status = r100_irq_ack(rdev);
+        }
+        return IRQ_HANDLED;
+}
+u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc)
+{
+        if (crtc == 0)
+                return RREG32(RADEON_CRTC_CRNT_FRAME);
+        else
+                return RREG32(RADEON_CRTC2_CRNT_FRAME);
+}
+/*
 * Fence emission
 */
 void r100_fence_ring_emit(struct radeon_device *rdev,
@@ -1025,6 +1091,16 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                        tmp |= tile_flags;
                        ib[idx] = tmp;
                        break;
+                case RADEON_RB3D_ZPASS_ADDR:
+                        r = r100_cs_packet_next_reloc(p, &reloc);
+                        if (r) {
+                                DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                          idx, reg);
+                                r100_cs_dump_packet(p, pkt);
+                                return r;
+                        }
+                        ib[idx] = ib_chunk->kdata[idx] + ((u32)reloc->lobj.gpu_offset);
+                        break;
                default:
                        /* FIXME: we don't want to allow anyothers packet */
                        break;
@@ -1556,26 +1632,6 @@ void r100_pll_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
        r100_pll_errata_after_data(rdev);
 }
-uint32_t r100_mm_rreg(struct radeon_device *rdev, uint32_t reg)
-{
-        if (reg < 0x10000)
-                return readl(((void __iomem *)rdev->rmmio) + reg);
-        else {
-                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
-                return readl(((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
-        }
-}
-void r100_mm_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
-{
-        if (reg < 0x10000)
-                writel(v, ((void __iomem *)rdev->rmmio) + reg);
-        else {
-                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
-                writel(v, ((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
-        }
-}
 int r100_init(struct radeon_device *rdev)
 {
        return 0;
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 9c8d41534a5d..053f4ec397f7 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -83,8 +83,8 @@ void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev)
                WREG32_PCIE(RADEON_PCIE_TX_GART_CNTL, tmp | RADEON_PCIE_TX_GART_INVALIDATE_TLB);
                (void)RREG32_PCIE(RADEON_PCIE_TX_GART_CNTL);
                WREG32_PCIE(RADEON_PCIE_TX_GART_CNTL, tmp);
-                mb();
        }
+        mb();
 }
 int rv370_pcie_gart_enable(struct radeon_device *rdev)
@@ -448,6 +448,7 @@ void r300_gpu_init(struct radeon_device *rdev)
                /* rv350,rv370,rv380 */
                rdev->num_gb_pipes = 1;
        }
+        rdev->num_z_pipes = 1;
        gb_tile_config = (R300_ENABLE_TILING | R300_TILE_SIZE_16);
        switch (rdev->num_gb_pipes) {
        case 2:
@@ -486,7 +487,8 @@ void r300_gpu_init(struct radeon_device *rdev)
                printk(KERN_WARNING "Failed to wait MC idle while "
                       "programming pipes. Bad things might happen.\n");
        }
-        DRM_INFO("radeon: %d pipes initialized.\n", rdev->num_gb_pipes);
+        DRM_INFO("radeon: %d quad pipes, %d Z pipes initialized.\n",
+                 rdev->num_gb_pipes, rdev->num_z_pipes);
 }
 int r300_ga_reset(struct radeon_device *rdev)
@@ -593,27 +595,6 @@ void r300_vram_info(struct radeon_device *rdev)
 /*
- * Indirect registers accessor
- */
-uint32_t rv370_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
-{
-        uint32_t r;
-        WREG8(RADEON_PCIE_INDEX, ((reg) & 0xff));
-        (void)RREG32(RADEON_PCIE_INDEX);
-        r = RREG32(RADEON_PCIE_DATA);
-        return r;
-}
-void rv370_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
-{
-        WREG8(RADEON_PCIE_INDEX, ((reg) & 0xff));
-        (void)RREG32(RADEON_PCIE_INDEX);
-        WREG32(RADEON_PCIE_DATA, (v));
-        (void)RREG32(RADEON_PCIE_DATA);
-}
-/*
 * PCIE Lanes
 */
@@ -1403,6 +1384,21 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                tmp = (ib_chunk->kdata[idx] >> 22) & 0xF;
                track->textures[i].txdepth = tmp;
                break;
+        case R300_ZB_ZPASS_ADDR:
+                r = r100_cs_packet_next_reloc(p, &reloc);
+                if (r) {
+                        DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                        idx, reg);
+                        r100_cs_dump_packet(p, pkt);
+                        return r;
+                }
+                ib[idx] = ib_chunk->kdata[idx] + ((u32)reloc->lobj.gpu_offset);
+                break;
+        case 0x4be8:
+                /* valid register only on RV530 */
+                if (p->rdev->family == CHIP_RV530)
+                        break;
+                /* fallthrough do not move */
        default:
                printk(KERN_ERR "Forbidden register 0x%04X in cs at %d\n",
                       reg, idx);
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index dea497a979f2..97426a6f370f 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -165,7 +165,18 @@ void r420_pipes_init(struct radeon_device *rdev)
                printk(KERN_WARNING "Failed to wait GUI idle while "
                       "programming pipes. Bad things might happen.\n");
        }
-        DRM_INFO("radeon: %d pipes initialized.\n", rdev->num_gb_pipes);
+        if (rdev->family == CHIP_RV530) {
+                tmp = RREG32(RV530_GB_PIPE_SELECT2);
+                if ((tmp & 3) == 3)
+                        rdev->num_z_pipes = 2;
+                else
+                        rdev->num_z_pipes = 1;
+        } else
+                rdev->num_z_pipes = 1;
+        DRM_INFO("radeon: %d quad pipes, %d z pipes initialized.\n",
+                 rdev->num_gb_pipes, rdev->num_z_pipes);
 }
 void r420_gpu_init(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r500_reg.h b/drivers/gpu/drm/radeon/r500_reg.h
index 036691b38cb7..e1d5e0331e19 100644
--- a/drivers/gpu/drm/radeon/r500_reg.h
+++ b/drivers/gpu/drm/radeon/r500_reg.h
@@ -350,6 +350,7 @@
 #define AVIVO_D1CRTC_BLANK_CONTROL                              0x6084
 #define AVIVO_D1CRTC_INTERLACE_CONTROL                          0x6088
 #define AVIVO_D1CRTC_INTERLACE_STATUS                           0x608c
+#define AVIVO_D1CRTC_FRAME_COUNT                                0x60a4
 #define AVIVO_D1CRTC_STEREO_CONTROL                             0x60c4
 /* master controls */
@@ -438,14 +439,15 @@
 #       define AVIVO_DC_LB_DISP1_END_ADR_SHIFT  4
 #       define AVIVO_DC_LB_DISP1_END_ADR_MASK   0x7ff
-#define R500_DxMODE_INT_MASK 0x6540
-#define R500_D1MODE_INT_MASK (1<<0)
-#define R500_D2MODE_INT_MASK (1<<8)
 #define AVIVO_D1MODE_DATA_FORMAT                0x6528
 #       define AVIVO_D1MODE_INTERLEAVE_EN       (1 << 0)
 #define AVIVO_D1MODE_DESKTOP_HEIGHT             0x652C
+#define AVIVO_D1MODE_VBLANK_STATUS              0x6534
+#       define AVIVO_VBLANK_ACK                 (1 << 4)
 #define AVIVO_D1MODE_VLINE_START_END            0x6538
+#define AVIVO_DxMODE_INT_MASK                   0x6540
+#       define AVIVO_D1MODE_INT_MASK            (1 << 0)
+#       define AVIVO_D2MODE_INT_MASK            (1 << 8)
 #define AVIVO_D1MODE_VIEWPORT_START             0x6580
 #define AVIVO_D1MODE_VIEWPORT_SIZE              0x6584
 #define AVIVO_D1MODE_EXT_OVERSCAN_LEFT_RIGHT    0x6588
@@ -475,6 +477,7 @@
 #define AVIVO_D2CRTC_BLANK_CONTROL                              0x6884
 #define AVIVO_D2CRTC_INTERLACE_CONTROL                          0x6888
 #define AVIVO_D2CRTC_INTERLACE_STATUS                           0x688c
+#define AVIVO_D2CRTC_FRAME_COUNT                                0x68a4
 #define AVIVO_D2CRTC_STEREO_CONTROL                             0x68c4
 #define AVIVO_D2GRPH_ENABLE                                     0x6900
@@ -497,6 +500,7 @@
 #define AVIVO_D2CUR_SIZE                        0x6c10
 #define AVIVO_D2CUR_POSITION                    0x6c14
+#define AVIVO_D2MODE_VBLANK_STATUS              0x6d34
 #define AVIVO_D2MODE_VLINE_START_END            0x6d38
 #define AVIVO_D2MODE_VIEWPORT_START             0x6d80
 #define AVIVO_D2MODE_VIEWPORT_SIZE              0x6d84
@@ -748,4 +752,8 @@
 #       define AVIVO_I2C_EN                                                     (1 << 0)
 #       define AVIVO_I2C_RESET                                          (1 << 8)
+#define AVIVO_DISP_INTERRUPT_STATUS                             0x7edc
+#       define AVIVO_D1_VBLANK_INTERRUPT                        (1 << 4)
+#       define AVIVO_D2_VBLANK_INTERRUPT                        (1 << 5)
 #endif
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 09fb0b6ec7dd..ebd6b0f7bdff 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -177,7 +177,6 @@ void r520_gpu_init(struct radeon_device *rdev)
         */
        /* workaround for RV530 */
        if (rdev->family == CHIP_RV530) {
-                WREG32(0x4124, 1);
                WREG32(0x4128, 0xFF);
        }
        r420_pipes_init(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b1d945b8ed6c..b519fb2fecbb 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -242,6 +242,7 @@ int radeon_object_pin(struct radeon_object *robj, uint32_t domain,
                      uint64_t *gpu_addr);
 void radeon_object_unpin(struct radeon_object *robj);
 int radeon_object_wait(struct radeon_object *robj);
+int radeon_object_busy_domain(struct radeon_object *robj, uint32_t *cur_placement);
 int radeon_object_evict_vram(struct radeon_device *rdev);
 int radeon_object_mmap(struct radeon_object *robj, uint64_t *offset);
 void radeon_object_force_delete(struct radeon_device *rdev);
@@ -574,6 +575,7 @@ struct radeon_asic {
        void (*ring_start)(struct radeon_device *rdev);
        int (*irq_set)(struct radeon_device *rdev);
        int (*irq_process)(struct radeon_device *rdev);
+        u32 (*get_vblank_counter)(struct radeon_device *rdev, int crtc);
        void (*fence_ring_emit)(struct radeon_device *rdev, struct radeon_fence *fence);
        int (*cs_parse)(struct radeon_cs_parser *p);
        int (*copy_blit)(struct radeon_device *rdev,
@@ -653,6 +655,7 @@ struct radeon_device {
        int                             usec_timeout;
        enum radeon_pll_errata          pll_errata;
        int                             num_gb_pipes;
+        int                             num_z_pipes;
        int                             disp_priority;
        /* BIOS */
        uint8_t                         *bios;
@@ -666,14 +669,11 @@ struct radeon_device {
        resource_size_t                 rmmio_base;
        resource_size_t                 rmmio_size;
        void                            *rmmio;
-        radeon_rreg_t                   mm_rreg;
-        radeon_wreg_t                   mm_wreg;
        radeon_rreg_t                   mc_rreg;
        radeon_wreg_t                   mc_wreg;
        radeon_rreg_t                   pll_rreg;
        radeon_wreg_t                   pll_wreg;
-        radeon_rreg_t                   pcie_rreg;
+        uint32_t                        pcie_reg_mask;
-        radeon_wreg_t                   pcie_wreg;
        radeon_rreg_t                   pciep_rreg;
        radeon_wreg_t                   pciep_wreg;
        struct radeon_clock             clock;
@@ -705,22 +705,42 @@ int radeon_device_init(struct radeon_device *rdev,
 void radeon_device_fini(struct radeon_device *rdev);
 int radeon_gpu_wait_for_idle(struct radeon_device *rdev);
+static inline uint32_t r100_mm_rreg(struct radeon_device *rdev, uint32_t reg)
+{
+        if (reg < 0x10000)
+                return readl(((void __iomem *)rdev->rmmio) + reg);
+        else {
+                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
+                return readl(((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
+        }
+}
+static inline void r100_mm_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
+{
+        if (reg < 0x10000)
+                writel(v, ((void __iomem *)rdev->rmmio) + reg);
+        else {
+                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
+                writel(v, ((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
+        }
+}
 /*
 * Registers read & write functions.
 */
 #define RREG8(reg) readb(((void __iomem *)rdev->rmmio) + (reg))
 #define WREG8(reg, v) writeb(v, ((void __iomem *)rdev->rmmio) + (reg))
-#define RREG32(reg) rdev->mm_rreg(rdev, (reg))
+#define RREG32(reg) r100_mm_rreg(rdev, (reg))
-#define WREG32(reg, v) rdev->mm_wreg(rdev, (reg), (v))
+#define WREG32(reg, v) r100_mm_wreg(rdev, (reg), (v))
 #define REG_SET(FIELD, v) (((v) << FIELD##_SHIFT) & FIELD##_MASK)
 #define REG_GET(FIELD, v) (((v) << FIELD##_SHIFT) & FIELD##_MASK)
 #define RREG32_PLL(reg) rdev->pll_rreg(rdev, (reg))
 #define WREG32_PLL(reg, v) rdev->pll_wreg(rdev, (reg), (v))
 #define RREG32_MC(reg) rdev->mc_rreg(rdev, (reg))
 #define WREG32_MC(reg, v) rdev->mc_wreg(rdev, (reg), (v))
-#define RREG32_PCIE(reg) rdev->pcie_rreg(rdev, (reg))
+#define RREG32_PCIE(reg) rv370_pcie_rreg(rdev, (reg))
-#define WREG32_PCIE(reg, v) rdev->pcie_wreg(rdev, (reg), (v))
+#define WREG32_PCIE(reg, v) rv370_pcie_wreg(rdev, (reg), (v))
 #define WREG32_P(reg, val, mask)                                \
        do {                                                    \
                uint32_t tmp_ = RREG32(reg);                    \
@@ -736,6 +756,24 @@ int radeon_gpu_wait_for_idle(struct radeon_device *rdev);
                WREG32_PLL(reg, tmp_);                          \
        } while (0)
+/*
+ * Indirect registers accessor
+ */
+static inline uint32_t rv370_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
+{
+        uint32_t r;
+        WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
+        r = RREG32(RADEON_PCIE_DATA);
+        return r;
+}
+static inline void rv370_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
+{
+        WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
+        WREG32(RADEON_PCIE_DATA, (v));
+}
 void r100_pll_errata_after_index(struct radeon_device *rdev);
@@ -862,6 +900,7 @@ static inline void radeon_ring_write(struct radeon_device *rdev, uint32_t v)
 #define radeon_ring_start(rdev) (rdev)->asic->ring_start((rdev))
 #define radeon_irq_set(rdev) (rdev)->asic->irq_set((rdev))
 #define radeon_irq_process(rdev) (rdev)->asic->irq_process((rdev))
+#define radeon_get_vblank_counter(rdev, crtc) (rdev)->asic->get_vblank_counter((rdev), (crtc))
 #define radeon_fence_ring_emit(rdev, fence) (rdev)->asic->fence_ring_emit((rdev), (fence))
 #define radeon_copy_blit(rdev, s, d, np, f) (rdev)->asic->copy_blit((rdev), (s), (d), (np), (f))
 #define radeon_copy_dma(rdev, s, d, np, f) (rdev)->asic->copy_dma((rdev), (s), (d), (np), (f))
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 9a75876e0c3b..7ca6c13569b5 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -49,6 +49,7 @@ void r100_vram_info(struct radeon_device *rdev);
 int r100_gpu_reset(struct radeon_device *rdev);
 int r100_mc_init(struct radeon_device *rdev);
 void r100_mc_fini(struct radeon_device *rdev);
+u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc);
 int r100_wb_init(struct radeon_device *rdev);
 void r100_wb_fini(struct radeon_device *rdev);
 int r100_gart_enable(struct radeon_device *rdev);
@@ -96,6 +97,7 @@ static struct radeon_asic r100_asic = {
        .ring_start = &r100_ring_start,
        .irq_set = &r100_irq_set,
        .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
        .fence_ring_emit = &r100_fence_ring_emit,
        .cs_parse = &r100_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -156,6 +158,7 @@ static struct radeon_asic r300_asic = {
        .ring_start = &r300_ring_start,
        .irq_set = &r100_irq_set,
        .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -196,6 +199,7 @@ static struct radeon_asic r420_asic = {
        .ring_start = &r300_ring_start,
        .irq_set = &r100_irq_set,
        .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -243,6 +247,7 @@ static struct radeon_asic rs400_asic = {
        .ring_start = &r300_ring_start,
        .irq_set = &r100_irq_set,
        .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -266,6 +271,8 @@ void rs600_vram_info(struct radeon_device *rdev);
 int rs600_mc_init(struct radeon_device *rdev);
 void rs600_mc_fini(struct radeon_device *rdev);
 int rs600_irq_set(struct radeon_device *rdev);
+int rs600_irq_process(struct radeon_device *rdev);
+u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc);
 int rs600_gart_enable(struct radeon_device *rdev);
 void rs600_gart_disable(struct radeon_device *rdev);
 void rs600_gart_tlb_flush(struct radeon_device *rdev);
@@ -291,7 +298,8 @@ static struct radeon_asic rs600_asic = {
        .cp_disable = &r100_cp_disable,
        .ring_start = &r300_ring_start,
        .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -308,6 +316,7 @@ static struct radeon_asic rs600_asic = {
 /*
 * rs690,rs740
 */
+int rs690_init(struct radeon_device *rdev);
 void rs690_errata(struct radeon_device *rdev);
 void rs690_vram_info(struct radeon_device *rdev);
 int rs690_mc_init(struct radeon_device *rdev);
@@ -316,7 +325,7 @@ uint32_t rs690_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs690_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 void rs690_bandwidth_update(struct radeon_device *rdev);
 static struct radeon_asic rs690_asic = {
-        .init = &r300_init,
+        .init = &rs690_init,
        .errata = &rs690_errata,
        .vram_info = &rs690_vram_info,
        .gpu_reset = &r300_gpu_reset,
@@ -333,7 +342,8 @@ static struct radeon_asic rs690_asic = {
        .cp_disable = &r100_cp_disable,
        .ring_start = &r300_ring_start,
        .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -381,8 +391,9 @@ static struct radeon_asic rv515_asic = {
        .cp_fini = &r100_cp_fini,
        .cp_disable = &r100_cp_disable,
        .ring_start = &rv515_ring_start,
-        .irq_set = &r100_irq_set,
+        .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -423,8 +434,9 @@ static struct radeon_asic r520_asic = {
        .cp_fini = &r100_cp_fini,
        .cp_disable = &r100_cp_disable,
        .ring_start = &rv515_ring_start,
-        .irq_set = &r100_irq_set,
+        .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index afc4db280b94..2a027e00762a 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -685,23 +685,15 @@ static const uint32_t default_tvdac_adj[CHIP_LAST] = {
        0x00780000,             /* rs480 */
 };
-static struct radeon_encoder_tv_dac
+static void radeon_legacy_get_tv_dac_info_from_table(struct radeon_device *rdev,
-    *radeon_legacy_get_tv_dac_info_from_table(struct radeon_device *rdev)
+                                                     struct radeon_encoder_tv_dac *tv_dac)
 {
-        struct radeon_encoder_tv_dac *tv_dac = NULL;
-        tv_dac = kzalloc(sizeof(struct radeon_encoder_tv_dac), GFP_KERNEL);
-        if (!tv_dac)
-                return NULL;
        tv_dac->ps2_tvdac_adj = default_tvdac_adj[rdev->family];
        if ((rdev->flags & RADEON_IS_MOBILITY) && (rdev->family == CHIP_RV250))
                tv_dac->ps2_tvdac_adj = 0x00880000;
        tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
        tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+        return;
-        return tv_dac;
 }
 struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
@@ -713,19 +705,18 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
        uint16_t dac_info;
        uint8_t rev, bg, dac;
        struct radeon_encoder_tv_dac *tv_dac = NULL;
+        int found = 0;
+        tv_dac = kzalloc(sizeof(struct radeon_encoder_tv_dac), GFP_KERNEL);
+        if (!tv_dac)
+                return NULL;
        if (rdev->bios == NULL)
-                return radeon_legacy_get_tv_dac_info_from_table(rdev);
+                goto out;
        /* first check TV table */
        dac_info = combios_get_table_offset(dev, COMBIOS_TV_INFO_TABLE);
        if (dac_info) {
-                tv_dac =
-                    kzalloc(sizeof(struct radeon_encoder_tv_dac), GFP_KERNEL);
-                if (!tv_dac)
-                        return NULL;
                rev = RBIOS8(dac_info + 0x3);
                if (rev > 4) {
                        bg = RBIOS8(dac_info + 0xc) & 0xf;
@@ -739,6 +730,7 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                        bg = RBIOS8(dac_info + 0x10) & 0xf;
                        dac = RBIOS8(dac_info + 0x11) & 0xf;
                        tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
+                        found = 1;
                } else if (rev > 1) {
                        bg = RBIOS8(dac_info + 0xc) & 0xf;
                        dac = (RBIOS8(dac_info + 0xc) >> 4) & 0xf;
@@ -751,22 +743,15 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                        bg = RBIOS8(dac_info + 0xe) & 0xf;
                        dac = (RBIOS8(dac_info + 0xe) >> 4) & 0xf;
                        tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
+                        found = 1;
                }
                tv_dac->tv_std = radeon_combios_get_tv_info(encoder);
+        }
-        } else {
+        if (!found) {
                /* then check CRT table */
                dac_info =
                    combios_get_table_offset(dev, COMBIOS_CRT_INFO_TABLE);
                if (dac_info) {
-                        tv_dac =
-                            kzalloc(sizeof(struct radeon_encoder_tv_dac),
-                                    GFP_KERNEL);
-                        if (!tv_dac)
-                                return NULL;
                        rev = RBIOS8(dac_info) & 0x3;
                        if (rev < 2) {
                                bg = RBIOS8(dac_info + 0x3) & 0xf;
@@ -775,6 +760,7 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                                    (bg << 16) | (dac << 20);
                                tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
                                tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+                                found = 1;
                        } else {
                                bg = RBIOS8(dac_info + 0x4) & 0xf;
                                dac = RBIOS8(dac_info + 0x5) & 0xf;
@@ -782,13 +768,17 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                                    (bg << 16) | (dac << 20);
                                tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
                                tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+                                found = 1;
                        }
                } else {
                        DRM_INFO("No TV DAC info found in BIOS\n");
-                        return radeon_legacy_get_tv_dac_info_from_table(rdev);
                }
        }
+out:
+        if (!found) /* fallback to defaults */
+                radeon_legacy_get_tv_dac_info_from_table(rdev, tv_dac);
        return tv_dac;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index d8356827ef17..7a52c461145c 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -406,6 +406,15 @@ static void radeon_init_pipes(drm_radeon_private_t *dev_priv)
 {
        uint32_t gb_tile_config, gb_pipe_sel = 0;
+        if ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV530) {
+                uint32_t z_pipe_sel = RADEON_READ(RV530_GB_PIPE_SELECT2);
+                if ((z_pipe_sel & 3) == 3)
+                        dev_priv->num_z_pipes = 2;
+                else
+                        dev_priv->num_z_pipes = 1;
+        } else
+                dev_priv->num_z_pipes = 1;
        /* RS4xx/RS6xx/R4xx/R5xx */
        if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R420) {
                gb_pipe_sel = RADEON_READ(R400_GB_PIPE_SELECT);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 9ff6dcb97f9d..7693f7c67bd3 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -225,25 +225,18 @@ void radeon_invalid_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 void radeon_register_accessor_init(struct radeon_device *rdev)
 {
-        rdev->mm_rreg = &r100_mm_rreg;
-        rdev->mm_wreg = &r100_mm_wreg;
        rdev->mc_rreg = &radeon_invalid_rreg;
        rdev->mc_wreg = &radeon_invalid_wreg;
        rdev->pll_rreg = &radeon_invalid_rreg;
        rdev->pll_wreg = &radeon_invalid_wreg;
-        rdev->pcie_rreg = &radeon_invalid_rreg;
-        rdev->pcie_wreg = &radeon_invalid_wreg;
        rdev->pciep_rreg = &radeon_invalid_rreg;
        rdev->pciep_wreg = &radeon_invalid_wreg;
        /* Don't change order as we are overridding accessor. */
        if (rdev->family < CHIP_RV515) {
-                rdev->pcie_rreg = &rv370_pcie_rreg;
+                rdev->pcie_reg_mask = 0xff;
-                rdev->pcie_wreg = &rv370_pcie_wreg;
+        } else {
-        }
+                rdev->pcie_reg_mask = 0x7ff;
-        if (rdev->family >= CHIP_RV515) {
-                rdev->pcie_rreg = &rv515_pcie_rreg;
-                rdev->pcie_wreg = &rv515_pcie_wreg;
        }
        /* FIXME: not sure here */
        if (rdev->family <= CHIP_R580) {
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 3933f8216a34..6fa32dac4e97 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -100,9 +100,10 @@
 * 1.28- Add support for VBL on CRTC2
 * 1.29- R500 3D cmd buffer support
 * 1.30- Add support for occlusion queries
+ * 1.31- Add support for num Z pipes from GET_PARAM
 */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            30
+#define DRIVER_MINOR            31
 #define DRIVER_PATCHLEVEL       0
 /*
@@ -329,6 +330,7 @@ typedef struct drm_radeon_private {
        resource_size_t fb_aper_offset;
        int num_gb_pipes;
+        int num_z_pipes;
        int track_flush;
        drm_local_map_t *mmio;
@@ -689,6 +691,7 @@ extern void r600_page_table_cleanup(struct drm_device *dev, struct drm_ati_pciga
 /* pipe config regs */
 #define R400_GB_PIPE_SELECT             0x402c
+#define RV530_GB_PIPE_SELECT2           0x4124
 #define R500_DYN_SCLK_PWMEM_PIPE        0x000d /* PLL */
 #define R300_GB_TILE_CONFIG             0x4018
 #       define R300_ENABLE_TILING       (1 << 0)
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 3206c0ad7b6c..ec383edf5f38 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -574,6 +574,8 @@ int radeonfb_create(struct radeon_device *rdev,
                goto out_unref;
        }
+        memset_io(fbptr, 0, aligned_size);
        strcpy(info->fix.id, "radeondrmfb");
        info->fix.type = FB_TYPE_PACKED_PIXELS;
        info->fix.visual = FB_VISUAL_TRUECOLOR;
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index cded5180c752..d880edf254db 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -262,8 +262,34 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *filp)
 {
-        /* FIXME: implement */
+        struct drm_radeon_gem_busy *args = data;
-        return 0;
+        struct drm_gem_object *gobj;
+        struct radeon_object *robj;
+        int r;
+        uint32_t cur_placement;
+        gobj = drm_gem_object_lookup(dev, filp, args->handle);
+        if (gobj == NULL) {
+                return -EINVAL;
+        }
+        robj = gobj->driver_private;
+        r = radeon_object_busy_domain(robj, &cur_placement);
+        switch (cur_placement) {
+        case TTM_PL_VRAM:
+                args->domain = RADEON_GEM_DOMAIN_VRAM;
+                break;
+        case TTM_PL_TT:
+                args->domain = RADEON_GEM_DOMAIN_GTT;
+                break;
+        case TTM_PL_SYSTEM:
+                args->domain = RADEON_GEM_DOMAIN_CPU;
+        default:
+                break;
+        }
+        mutex_lock(&dev->struct_mutex);
+        drm_gem_object_unreference(gobj);
+        mutex_unlock(&dev->struct_mutex);
+        return r;
 }
 int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index 491d569deb0e..9805e4b6ca1b 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -32,60 +32,6 @@
 #include "radeon.h"
 #include "atom.h"
-static inline uint32_t r100_irq_ack(struct radeon_device *rdev)
-{
-        uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
-        uint32_t irq_mask = RADEON_SW_INT_TEST;
-        if (irqs) {
-                WREG32(RADEON_GEN_INT_STATUS, irqs);
-        }
-        return irqs & irq_mask;
-}
-int r100_irq_set(struct radeon_device *rdev)
-{
-        uint32_t tmp = 0;
-        if (rdev->irq.sw_int) {
-                tmp |= RADEON_SW_INT_ENABLE;
-        }
-        /* Todo go through CRTC and enable vblank int or not */
-        WREG32(RADEON_GEN_INT_CNTL, tmp);
-        return 0;
-}
-int r100_irq_process(struct radeon_device *rdev)
-{
-        uint32_t status;
-        status = r100_irq_ack(rdev);
-        if (!status) {
-                return IRQ_NONE;
-        }
-        while (status) {
-                /* SW interrupt */
-                if (status & RADEON_SW_INT_TEST) {
-                        radeon_fence_process(rdev);
-                }
-                status = r100_irq_ack(rdev);
-        }
-        return IRQ_HANDLED;
-}
-int rs600_irq_set(struct radeon_device *rdev)
-{
-        uint32_t tmp = 0;
-        if (rdev->irq.sw_int) {
-                tmp |= RADEON_SW_INT_ENABLE;
-        }
-        WREG32(RADEON_GEN_INT_CNTL, tmp);
-        /* Todo go through CRTC and enable vblank int or not */
-        WREG32(R500_DxMODE_INT_MASK, 0);
-        return 0;
-}
 irqreturn_t radeon_driver_irq_handler_kms(DRM_IRQ_ARGS)
 {
        struct drm_device *dev = (struct drm_device *) arg;
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 3357110e30ce..dce09ada32bc 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -95,6 +95,9 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
        case RADEON_INFO_NUM_GB_PIPES:
                value = rdev->num_gb_pipes;
                break;
+        case RADEON_INFO_NUM_Z_PIPES:
+                value = rdev->num_z_pipes;
+                break;
        default:
                DRM_DEBUG("Invalid request %d\n", info->request);
                return -EINVAL;
@@ -141,19 +144,42 @@ void radeon_driver_preclose_kms(struct drm_device *dev,
 */
 u32 radeon_get_vblank_counter_kms(struct drm_device *dev, int crtc)
 {
-        /* FIXME: implement */
+        struct radeon_device *rdev = dev->dev_private;
-        return 0;
+        if (crtc < 0 || crtc > 1) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return -EINVAL;
+        }
+        return radeon_get_vblank_counter(rdev, crtc);
 }
 int radeon_enable_vblank_kms(struct drm_device *dev, int crtc)
 {
-        /* FIXME: implement */
+        struct radeon_device *rdev = dev->dev_private;
-        return 0;
+        if (crtc < 0 || crtc > 1) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return -EINVAL;
+        }
+        rdev->irq.crtc_vblank_int[crtc] = true;
+        return radeon_irq_set(rdev);
 }
 void radeon_disable_vblank_kms(struct drm_device *dev, int crtc)
 {
-        /* FIXME: implement */
+        struct radeon_device *rdev = dev->dev_private;
+        if (crtc < 0 || crtc > 1) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return;
+        }
+        rdev->irq.crtc_vblank_int[crtc] = false;
+        radeon_irq_set(rdev);
 }
@@ -295,5 +321,6 @@ struct drm_ioctl_desc radeon_ioctls_kms[] = {
        DRM_IOCTL_DEF(DRM_RADEON_INFO, radeon_info_ioctl, DRM_AUTH),
        DRM_IOCTL_DEF(DRM_RADEON_GEM_SET_TILING, radeon_gem_set_tiling_ioctl, DRM_AUTH),
        DRM_IOCTL_DEF(DRM_RADEON_GEM_GET_TILING, radeon_gem_get_tiling_ioctl, DRM_AUTH),
+        DRM_IOCTL_DEF(DRM_RADEON_GEM_BUSY, radeon_gem_busy_ioctl, DRM_AUTH),
 };
 int radeon_max_kms_ioctl = DRM_ARRAY_SIZE(radeon_ioctls_kms);
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index 7d06dc98a42a..0da72f18fd3a 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -310,10 +310,13 @@ void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
                                                                         RADEON_CRTC_DISP_REQ_EN_B));
                        WREG32_P(RADEON_CRTC_EXT_CNTL, 0, ~mask);
                }
+                drm_vblank_post_modeset(dev, radeon_crtc->crtc_id);
+                radeon_crtc_load_lut(crtc);
                break;
        case DRM_MODE_DPMS_STANDBY:
        case DRM_MODE_DPMS_SUSPEND:
        case DRM_MODE_DPMS_OFF:
+                drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
                if (radeon_crtc->crtc_id)
                        WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~mask);
                else {
@@ -323,10 +326,6 @@ void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
                }
                break;
        }
-        if (mode != DRM_MODE_DPMS_OFF) {
-                radeon_crtc_load_lut(crtc);
-        }
 }
 /* properly set crtc bpp when using atombios */
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 34d0f58eb944..9322675ef6d0 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -1066,6 +1066,7 @@ radeon_add_legacy_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t
        switch (radeon_encoder->encoder_id) {
        case ENCODER_OBJECT_ID_INTERNAL_LVDS:
+                encoder->possible_crtcs = 0x1;
                drm_encoder_init(dev, encoder, &radeon_legacy_lvds_enc_funcs, DRM_MODE_ENCODER_LVDS);
                drm_encoder_helper_add(encoder, &radeon_legacy_lvds_helper_funcs);
                if (rdev->is_atom_bios)
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index e98cae3bf4a6..b85fb83d7ae8 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -316,6 +316,25 @@ int radeon_object_wait(struct radeon_object *robj)
        return r;
 }
+int radeon_object_busy_domain(struct radeon_object *robj, uint32_t *cur_placement)
+{
+        int r = 0;
+        r = radeon_object_reserve(robj, true);
+        if (unlikely(r != 0)) {
+                DRM_ERROR("radeon: failed to reserve object for waiting.\n");
+                return r;
+        }
+        spin_lock(&robj->tobj.lock);
+        *cur_placement = robj->tobj.mem.mem_type;
+        if (robj->tobj.sync_obj) {
+                r = ttm_bo_wait(&robj->tobj, true, true, true);
+        }
+        spin_unlock(&robj->tobj.lock);
+        radeon_object_unreserve(robj);
+        return r;
+}
 int radeon_object_evict_vram(struct radeon_device *rdev)
 {
        if (rdev->flags & RADEON_IS_IGP) {
diff --git a/drivers/gpu/drm/radeon/radeon_reg.h b/drivers/gpu/drm/radeon/radeon_reg.h
index e1b618574461..4df43f62c678 100644
--- a/drivers/gpu/drm/radeon/radeon_reg.h
+++ b/drivers/gpu/drm/radeon/radeon_reg.h
@@ -982,12 +982,15 @@
 #       define RS400_TMDS2_PLLRST           (1 << 1)
 #define RADEON_GEN_INT_CNTL                 0x0040
+#       define RADEON_CRTC_VBLANK_MASK          (1 << 0)
+#       define RADEON_CRTC2_VBLANK_MASK         (1 << 9)
 #       define RADEON_SW_INT_ENABLE             (1 << 25)
 #define RADEON_GEN_INT_STATUS               0x0044
-#       define RADEON_VSYNC_INT_AK          (1 <<  2)
+#       define AVIVO_DISPLAY_INT_STATUS         (1 << 0)
-#       define RADEON_VSYNC_INT             (1 <<  2)
+#       define RADEON_CRTC_VBLANK_STAT          (1 << 0)
-#       define RADEON_VSYNC2_INT_AK         (1 <<  6)
+#       define RADEON_CRTC_VBLANK_STAT_ACK      (1 << 0)
-#       define RADEON_VSYNC2_INT            (1 <<  6)
+#       define RADEON_CRTC2_VBLANK_STAT         (1 << 9)
+#       define RADEON_CRTC2_VBLANK_STAT_ACK     (1 << 9)
 #       define RADEON_SW_INT_FIRE               (1 << 26)
 #       define RADEON_SW_INT_TEST               (1 << 25)
 #       define RADEON_SW_INT_TEST_ACK           (1 << 25)
@@ -2334,6 +2337,9 @@
 #       define RADEON_RE_WIDTH_SHIFT        0
 #       define RADEON_RE_HEIGHT_SHIFT       16
+#define RADEON_RB3D_ZPASS_DATA 0x3290
+#define RADEON_RB3D_ZPASS_ADDR 0x3294
 #define RADEON_SE_CNTL                      0x1c4c
 #       define RADEON_FFACE_CULL_CW          (0 <<  0)
 #       define RADEON_FFACE_CULL_CCW         (1 <<  0)
@@ -3568,4 +3574,6 @@
 #define RADEON_SCRATCH_REG4             0x15f0
 #define RADEON_SCRATCH_REG5             0x15f4
+#define RV530_GB_PIPE_SELECT2           0x4124
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 46645f3e0328..2882f40d5ec5 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -3081,6 +3081,9 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
        case RADEON_PARAM_NUM_GB_PIPES:
                value = dev_priv->num_gb_pipes;
                break;
+        case RADEON_PARAM_NUM_Z_PIPES:
+                value = dev_priv->num_z_pipes;
+                break;
        default:
                DRM_DEBUG("Invalid parameter %d\n", param->param);
                return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index bbea6dee4a94..7e8ce983a908 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -240,6 +240,88 @@ void rs600_mc_fini(struct radeon_device *rdev)
 /*
+ * Interrupts
+ */
+int rs600_irq_set(struct radeon_device *rdev)
+{
+        uint32_t tmp = 0;
+        uint32_t mode_int = 0;
+        if (rdev->irq.sw_int) {
+                tmp |= RADEON_SW_INT_ENABLE;
+        }
+        if (rdev->irq.crtc_vblank_int[0]) {
+                tmp |= AVIVO_DISPLAY_INT_STATUS;
+                mode_int |= AVIVO_D1MODE_INT_MASK;
+        }
+        if (rdev->irq.crtc_vblank_int[1]) {
+                tmp |= AVIVO_DISPLAY_INT_STATUS;
+                mode_int |= AVIVO_D2MODE_INT_MASK;
+        }
+        WREG32(RADEON_GEN_INT_CNTL, tmp);
+        WREG32(AVIVO_DxMODE_INT_MASK, mode_int);
+        return 0;
+}
+static inline uint32_t rs600_irq_ack(struct radeon_device *rdev, u32 *r500_disp_int)
+{
+        uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
+        uint32_t irq_mask = RADEON_SW_INT_TEST;
+        if (irqs & AVIVO_DISPLAY_INT_STATUS) {
+                *r500_disp_int = RREG32(AVIVO_DISP_INTERRUPT_STATUS);
+                if (*r500_disp_int & AVIVO_D1_VBLANK_INTERRUPT) {
+                        WREG32(AVIVO_D1MODE_VBLANK_STATUS, AVIVO_VBLANK_ACK);
+                }
+                if (*r500_disp_int & AVIVO_D2_VBLANK_INTERRUPT) {
+                        WREG32(AVIVO_D2MODE_VBLANK_STATUS, AVIVO_VBLANK_ACK);
+                }
+        } else {
+                *r500_disp_int = 0;
+        }
+        if (irqs) {
+                WREG32(RADEON_GEN_INT_STATUS, irqs);
+        }
+        return irqs & irq_mask;
+}
+int rs600_irq_process(struct radeon_device *rdev)
+{
+        uint32_t status;
+        uint32_t r500_disp_int;
+        status = rs600_irq_ack(rdev, &r500_disp_int);
+        if (!status && !r500_disp_int) {
+                return IRQ_NONE;
+        }
+        while (status || r500_disp_int) {
+                /* SW interrupt */
+                if (status & RADEON_SW_INT_TEST) {
+                        radeon_fence_process(rdev);
+                }
+                /* Vertical blank interrupts */
+                if (r500_disp_int & AVIVO_D1_VBLANK_INTERRUPT) {
+                        drm_handle_vblank(rdev->ddev, 0);
+                }
+                if (r500_disp_int & AVIVO_D2_VBLANK_INTERRUPT) {
+                        drm_handle_vblank(rdev->ddev, 1);
+                }
+                status = rs600_irq_ack(rdev, &r500_disp_int);
+        }
+        return IRQ_HANDLED;
+}
+u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc)
+{
+        if (crtc == 0)
+                return RREG32(AVIVO_D1CRTC_FRAME_COUNT);
+        else
+                return RREG32(AVIVO_D2CRTC_FRAME_COUNT);
+}
+/*
 * Global GPU functions
 */
 void rs600_disable_vga(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 839595b00728..bc6b7c5339bc 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -652,3 +652,68 @@ void rs690_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
        WREG32(RS690_MC_DATA, v);
        WREG32(RS690_MC_INDEX, RS690_MC_INDEX_WR_ACK);
 }
+static const unsigned rs690_reg_safe_bm[219] = {
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0x17FF1FFF,0xFFFFFFFC,0xFFFFFFFF,0xFF30FFBF,
+        0xFFFFFFF8,0xC3E6FFFF,0xFFFFF6DF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFF03F,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFEFCE,0xF00EBFFF,0x007C0000,
+        0xF0000078,0xFF000009,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFF7FF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFC78,0xFFFFFFFF,0xFFFFFFFE,0xFFFFFFFF,
+        0x38FF8F50,0xFFF88082,0xF000000C,0xFAE009FF,
+        0x0000FFFF,0xFFFFFFFF,0xFFFFFFFF,0x00000000,
+        0x00000000,0x0000C100,0x00000000,0x00000000,
+        0x00000000,0x00000000,0x00000000,0x00000000,
+        0x00000000,0xFFFF0000,0xFFFFFFFF,0xFF80FFFF,
+        0x00000000,0x00000000,0x00000000,0x00000000,
+        0x0003FC01,0xFFFFFFF8,0xFE800B19,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+};
+int rs690_init(struct radeon_device *rdev)
+{
+        rdev->config.r300.reg_safe_bm = rs690_reg_safe_bm;
+        rdev->config.r300.reg_safe_bm_size = ARRAY_SIZE(rs690_reg_safe_bm);
+        return 0;
+}
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index fd8f3ca716ea..31a7f668ae5a 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -400,25 +400,6 @@ void rv515_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
        WREG32(MC_IND_INDEX, 0);
 }
-uint32_t rv515_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
-{
-        uint32_t r;
-        WREG32(PCIE_INDEX, ((reg) & 0x7ff));
-        (void)RREG32(PCIE_INDEX);
-        r = RREG32(PCIE_DATA);
-        return r;
-}
-void rv515_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
-{
-        WREG32(PCIE_INDEX, ((reg) & 0x7ff));
-        (void)RREG32(PCIE_INDEX);
-        WREG32(PCIE_DATA, (v));
-        (void)RREG32(PCIE_DATA);
-}
 /*
 * Debugfs info
 */
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index d258b02aef44..827da0858136 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -674,7 +674,14 @@ omap_i2c_isr(int this_irq, void *dev_id)
                err = 0;
 complete:
-                omap_i2c_write_reg(dev, OMAP_I2C_STAT_REG, stat);
+                /*
+                 * Ack the stat in one go, but [R/X]DR and [R/X]RDY should be
+                 * acked after the data operation is complete.
+                 * Ref: TRM SWPU114Q Figure 18-31
+                 */
+                omap_i2c_write_reg(dev, OMAP_I2C_STAT_REG, stat &
+                                ~(OMAP_I2C_STAT_RRDY | OMAP_I2C_STAT_RDR |
+                                OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
                if (stat & OMAP_I2C_STAT_NACK) {
                        err |= OMAP_I2C_STAT_NACK;
@@ -687,6 +694,9 @@ complete:
                }
                if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK |
                                        OMAP_I2C_STAT_AL)) {
+                        omap_i2c_ack_stat(dev, stat &
+                                (OMAP_I2C_STAT_RRDY | OMAP_I2C_STAT_RDR |
+                                OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
                        omap_i2c_complete_cmd(dev, err);
                        return IRQ_HANDLED;
                }
@@ -774,7 +784,7 @@ complete:
                                 * memory to the I2C interface.
                                 */
-                                if (cpu_is_omap34xx()) {
+                                if (dev->rev <= OMAP_I2C_REV_ON_3430) {
                                                while (!(stat & OMAP_I2C_STAT_XUDF)) {
                                                        if (stat & (OMAP_I2C_STAT_NACK | OMAP_I2C_STAT_AL)) {
                                                                omap_i2c_ack_stat(dev, stat & (OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
diff --git a/drivers/i2c/busses/i2c-stu300.c b/drivers/i2c/busses/i2c-stu300.c
index 182e711318ba..d2728a28a8db 100644
--- a/drivers/i2c/busses/i2c-stu300.c
+++ b/drivers/i2c/busses/i2c-stu300.c
@@ -117,7 +117,8 @@ enum stu300_error {
        STU300_ERROR_NONE = 0,
        STU300_ERROR_ACKNOWLEDGE_FAILURE,
        STU300_ERROR_BUS_ERROR,
-        STU300_ERROR_ARBITRATION_LOST
+        STU300_ERROR_ARBITRATION_LOST,
+        STU300_ERROR_UNKNOWN
 };
 /* timeout waiting for the controller to respond */
@@ -127,7 +128,7 @@ enum stu300_error {
 * The number of address send athemps tried before giving up.
 * If the first one failes it seems like 5 to 8 attempts are required.
 */
-#define NUM_ADDR_RESEND_ATTEMPTS 10
+#define NUM_ADDR_RESEND_ATTEMPTS 12
 /* I2C clock speed, in Hz 0-400kHz*/
 static unsigned int scl_frequency = 100000;
@@ -149,6 +150,7 @@ module_param(scl_frequency, uint,  0644);
 * @msg_index: index of current message
 * @msg_len: length of current message
 */
 struct stu300_dev {
        struct platform_device  *pdev;
        struct i2c_adapter      adapter;
@@ -188,6 +190,27 @@ static inline u32 stu300_r8(void __iomem *address)
        return readl(address) & 0x000000FFU;
 }
+static void stu300_irq_enable(struct stu300_dev *dev)
+{
+        u32 val;
+        val = stu300_r8(dev->virtbase + I2C_CR);
+        val |= I2C_CR_INTERRUPT_ENABLE;
+        /* Twice paranoia (possible HW glitch) */
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+}
+static void stu300_irq_disable(struct stu300_dev *dev)
+{
+        u32 val;
+        val = stu300_r8(dev->virtbase + I2C_CR);
+        val &= ~I2C_CR_INTERRUPT_ENABLE;
+        /* Twice paranoia (possible HW glitch) */
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+}
 /*
 * Tells whether a certain event or events occurred in
 * response to a command. The events represent states in
@@ -196,9 +219,10 @@ static inline u32 stu300_r8(void __iomem *address)
 * documentation and can only be treated as abstract state
 * machine states.
 *
- * @ret 0 = event has not occurred, any other value means
+ * @ret 0 = event has not occurred or unknown error, any
- * the event occurred.
+ * other value means the correct event occurred or an error.
 */
 static int stu300_event_occurred(struct stu300_dev *dev,
                                   enum stu300_event mr_event) {
        u32 status1;
@@ -206,11 +230,28 @@ static int stu300_event_occurred(struct stu300_dev *dev,
        /* What event happened? */
        status1 = stu300_r8(dev->virtbase + I2C_SR1);
        if (!(status1 & I2C_SR1_EVF_IND))
                /* No event at all */
                return 0;
        status2 = stu300_r8(dev->virtbase + I2C_SR2);
+        /* Block any multiple interrupts */
+        stu300_irq_disable(dev);
+        /* Check for errors first */
+        if (status2 & I2C_SR2_AF_IND) {
+                dev->cmd_err = STU300_ERROR_ACKNOWLEDGE_FAILURE;
+                return 1;
+        } else if (status2 & I2C_SR2_BERR_IND) {
+                dev->cmd_err = STU300_ERROR_BUS_ERROR;
+                return 1;
+        } else if (status2 & I2C_SR2_ARLO_IND) {
+                dev->cmd_err = STU300_ERROR_ARBITRATION_LOST;
+                return 1;
+        }
        switch (mr_event) {
        case STU300_EVENT_1:
                if (status1 & I2C_SR1_ADSL_IND)
@@ -221,10 +262,6 @@ static int stu300_event_occurred(struct stu300_dev *dev,
        case STU300_EVENT_7:
        case STU300_EVENT_8:
                if (status1 & I2C_SR1_BTF_IND) {
-                        if (status2 & I2C_SR2_AF_IND)
-                                dev->cmd_err = STU300_ERROR_ACKNOWLEDGE_FAILURE;
-                        else if (status2 & I2C_SR2_BERR_IND)
-                                dev->cmd_err = STU300_ERROR_BUS_ERROR;
                        return 1;
                }
                break;
@@ -240,8 +277,6 @@ static int stu300_event_occurred(struct stu300_dev *dev,
        case STU300_EVENT_6:
                if (status2 & I2C_SR2_ENDAD_IND) {
                        /* First check for any errors */
-                        if (status2 & I2C_SR2_AF_IND)
-                                dev->cmd_err = STU300_ERROR_ACKNOWLEDGE_FAILURE;
                        return 1;
                }
                break;
@@ -252,8 +287,15 @@ static int stu300_event_occurred(struct stu300_dev *dev,
        default:
                break;
        }
-        if (status2 & I2C_SR2_ARLO_IND)
+        /* If we get here, we're on thin ice.
-                dev->cmd_err = STU300_ERROR_ARBITRATION_LOST;
+         * Here we are in a status where we have
+         * gotten a response that does not match
+         * what we requested.
+         */
+        dev->cmd_err = STU300_ERROR_UNKNOWN;
+        dev_err(&dev->pdev->dev,
+                "Unhandled interrupt! %d sr1: 0x%x sr2: 0x%x\n",
+                mr_event, status1, status2);
        return 0;
 }
@@ -262,21 +304,20 @@ static irqreturn_t stu300_irh(int irq, void *data)
        struct stu300_dev *dev = data;
        int res;
+        /* Just make sure that the block is clocked */
+        clk_enable(dev->clk);
        /* See if this was what we were waiting for */
        spin_lock(&dev->cmd_issue_lock);
-        if (dev->cmd_event != STU300_EVENT_NONE) {
-                res = stu300_event_occurred(dev, dev->cmd_event);
+        res = stu300_event_occurred(dev, dev->cmd_event);
-                if (res || dev->cmd_err != STU300_ERROR_NONE) {
+        if (res || dev->cmd_err != STU300_ERROR_NONE)
-                        u32 val;
+                complete(&dev->cmd_complete);
-                        complete(&dev->cmd_complete);
-                        /* Block any multiple interrupts */
-                        val = stu300_r8(dev->virtbase + I2C_CR);
-                        val &= ~I2C_CR_INTERRUPT_ENABLE;
-                        stu300_wr8(val, dev->virtbase + I2C_CR);
-                }
-        }
        spin_unlock(&dev->cmd_issue_lock);
+        clk_disable(dev->clk);
        return IRQ_HANDLED;
 }
@@ -308,7 +349,6 @@ static int stu300_start_and_await_event(struct stu300_dev *dev,
        stu300_wr8(cr_value, dev->virtbase + I2C_CR);
        ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                        STU300_TIMEOUT);
        if (ret < 0) {
                dev_err(&dev->pdev->dev,
                       "wait_for_completion_interruptible_timeout() "
@@ -342,7 +382,6 @@ static int stu300_await_event(struct stu300_dev *dev,
                                enum stu300_event mr_event)
 {
        int ret;
-        u32 val;
        if (unlikely(irqs_disabled())) {
                /* TODO: implement polling for this case if need be. */
@@ -354,36 +393,18 @@ static int stu300_await_event(struct stu300_dev *dev,
        /* Is it already here? */
        spin_lock_irq(&dev->cmd_issue_lock);
        dev->cmd_err = STU300_ERROR_NONE;
-        if (stu300_event_occurred(dev, mr_event)) {
-                spin_unlock_irq(&dev->cmd_issue_lock);
-                goto exit_await_check_err;
-        }
-        init_completion(&dev->cmd_complete);
-        dev->cmd_err = STU300_ERROR_NONE;
        dev->cmd_event = mr_event;
-        /* Turn on the I2C interrupt for current operation */
+        init_completion(&dev->cmd_complete);
-        val = stu300_r8(dev->virtbase + I2C_CR);
-        val |= I2C_CR_INTERRUPT_ENABLE;
-        stu300_wr8(val, dev->virtbase + I2C_CR);
-        /* Twice paranoia (possible HW glitch) */
-        stu300_wr8(val, dev->virtbase + I2C_CR);
-        /* Check again: is it already here? */
+        /* Turn on the I2C interrupt for current operation */
-        if (unlikely(stu300_event_occurred(dev, mr_event))) {
+        stu300_irq_enable(dev);
-                /* Disable IRQ again. */
-                val &= ~I2C_CR_INTERRUPT_ENABLE;
-                stu300_wr8(val, dev->virtbase + I2C_CR);
-                spin_unlock_irq(&dev->cmd_issue_lock);
-                goto exit_await_check_err;
-        }
        /* Unlock the command block and wait for the event to occur */
        spin_unlock_irq(&dev->cmd_issue_lock);
        ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                        STU300_TIMEOUT);
        if (ret < 0) {
                dev_err(&dev->pdev->dev,
                       "wait_for_completion_interruptible_timeout()"
@@ -401,7 +422,6 @@ static int stu300_await_event(struct stu300_dev *dev,
                return -ETIMEDOUT;
        }
- exit_await_check_err:
        if (dev->cmd_err != STU300_ERROR_NONE) {
                if (mr_event != STU300_EVENT_6) {
                        dev_err(&dev->pdev->dev, "controller "
@@ -457,18 +477,19 @@ struct stu300_clkset {
 };
 static const struct stu300_clkset stu300_clktable[] = {
-        { 0, 0xFFU },
+        { 0,         0xFFU },
-        { 2500000, I2C_OAR2_FR_25_10MHZ },
+        { 2500000,   I2C_OAR2_FR_25_10MHZ },
-        { 10000000, I2C_OAR2_FR_10_1667MHZ },
+        { 10000000,  I2C_OAR2_FR_10_1667MHZ },
-        { 16670000, I2C_OAR2_FR_1667_2667MHZ },
+        { 16670000,  I2C_OAR2_FR_1667_2667MHZ },
-        { 26670000, I2C_OAR2_FR_2667_40MHZ },
+        { 26670000,  I2C_OAR2_FR_2667_40MHZ },
-        { 40000000, I2C_OAR2_FR_40_5333MHZ },
+        { 40000000,  I2C_OAR2_FR_40_5333MHZ },
-        { 53330000, I2C_OAR2_FR_5333_66MHZ },
+        { 53330000,  I2C_OAR2_FR_5333_66MHZ },
-        { 66000000, I2C_OAR2_FR_66_80MHZ },
+        { 66000000,  I2C_OAR2_FR_66_80MHZ },
-        { 80000000, I2C_OAR2_FR_80_100MHZ },
+        { 80000000,  I2C_OAR2_FR_80_100MHZ },
        { 100000000, 0xFFU },
 };
 static int stu300_set_clk(struct stu300_dev *dev, unsigned long clkrate)
 {
@@ -494,10 +515,10 @@ static int stu300_set_clk(struct stu300_dev *dev, unsigned long clkrate)
        if (dev->speed > 100000)
                /* Fast Mode I2C */
-                val = ((clkrate/dev->speed)-9)/3;
+                val = ((clkrate/dev->speed) - 9)/3 + 1;
        else
                /* Standard Mode I2C */
-                val = ((clkrate/dev->speed)-7)/2;
+                val = ((clkrate/dev->speed) - 7)/2 + 1;
        /* According to spec the divider must be > 2 */
        if (val < 0x002) {
@@ -557,6 +578,7 @@ static int stu300_init_hw(struct stu300_dev *dev)
         */
        clkrate = clk_get_rate(dev->clk);
        ret = stu300_set_clk(dev, clkrate);
        if (ret)
                return ret;
        /*
@@ -641,7 +663,6 @@ static int stu300_xfer_msg(struct i2c_adapter *adap,
        int attempts = 0;
        struct stu300_dev *dev = i2c_get_adapdata(adap);
        clk_enable(dev->clk);
        /* Remove this if (0) to trace each and every message. */
@@ -715,14 +736,15 @@ static int stu300_xfer_msg(struct i2c_adapter *adap,
        if (attempts < NUM_ADDR_RESEND_ATTEMPTS && attempts > 0) {
                dev_dbg(&dev->pdev->dev, "managed to get address "
-                       "through after %d attempts\n", attempts);
+                        "through after %d attempts\n", attempts);
        } else if (attempts == NUM_ADDR_RESEND_ATTEMPTS) {
                dev_dbg(&dev->pdev->dev, "I give up, tried %d times "
-                       "to resend address.\n",
+                        "to resend address.\n",
-                       NUM_ADDR_RESEND_ATTEMPTS);
+                        NUM_ADDR_RESEND_ATTEMPTS);
                goto exit_disable;
        }
        if (msg->flags & I2C_M_RD) {
                /* READ: we read the actual bytes one at a time */
                for (i = 0; i < msg->len; i++) {
@@ -804,8 +826,10 @@ static int stu300_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 {
        int ret = -1;
        int i;
        struct stu300_dev *dev = i2c_get_adapdata(adap);
        dev->msg_len = num;
        for (i = 0; i < num; i++) {
                /*
                 * Another driver appears to send stop for each message,
@@ -817,6 +841,7 @@ static int stu300_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
                dev->msg_index = i;
                ret = stu300_xfer_msg(adap, &msgs[i], (i == (num - 1)));
                if (ret != 0) {
                        num = ret;
                        break;
@@ -845,6 +870,7 @@ stu300_probe(struct platform_device *pdev)
        struct resource *res;
        int bus_nr;
        int ret = 0;
+        char clk_name[] = "I2C0";
        dev = kzalloc(sizeof(struct stu300_dev), GFP_KERNEL);
        if (!dev) {
@@ -854,7 +880,8 @@ stu300_probe(struct platform_device *pdev)
        }
        bus_nr = pdev->id;
-        dev->clk = clk_get(&pdev->dev, NULL);
+        clk_name[3] += (char)bus_nr;
+        dev->clk = clk_get(&pdev->dev, clk_name);
        if (IS_ERR(dev->clk)) {
                ret = PTR_ERR(dev->clk);
                dev_err(&pdev->dev, "could not retrieve i2c bus clock\n");
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 4cfd084fa897..9a1d55b74d7a 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -456,8 +456,11 @@ static int joydev_ioctl_common(struct joydev *joydev,
                                unsigned int cmd, void __user *argp)
 {
        struct input_dev *dev = joydev->handle.dev;
+        size_t len;
        int i, j;
+        const char *name;
+        /* Process fixed-sized commands. */
        switch (cmd) {
        case JS_SET_CAL:
@@ -499,9 +502,22 @@ static int joydev_ioctl_common(struct joydev *joydev,
                return copy_to_user(argp, joydev->corr,
                        sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0;
-        case JSIOCSAXMAP:
+        }
-                if (copy_from_user(joydev->abspam, argp,
-                                   sizeof(__u8) * (ABS_MAX + 1)))
+        /*
+         * Process variable-sized commands (the axis and button map commands
+         * are considered variable-sized to decouple them from the values of
+         * ABS_MAX and KEY_MAX).
+         */
+        switch (cmd & ~IOCSIZE_MASK) {
+        case (JSIOCSAXMAP & ~IOCSIZE_MASK):
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
+                /*
+                 * FIXME: we should not copy into our axis map before
+                 * validating the data.
+                 */
+                if (copy_from_user(joydev->abspam, argp, len))
                        return -EFAULT;
                for (i = 0; i < joydev->nabs; i++) {
@@ -511,13 +527,17 @@ static int joydev_ioctl_common(struct joydev *joydev,
                }
                return 0;
-        case JSIOCGAXMAP:
+        case (JSIOCGAXMAP & ~IOCSIZE_MASK):
-                return copy_to_user(argp, joydev->abspam,
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
-                        sizeof(__u8) * (ABS_MAX + 1)) ? -EFAULT : 0;
+                return copy_to_user(argp, joydev->abspam, len) ? -EFAULT : 0;
-        case JSIOCSBTNMAP:
+        case (JSIOCSBTNMAP & ~IOCSIZE_MASK):
-                if (copy_from_user(joydev->keypam, argp,
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
-                                   sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)))
+                /*
+                 * FIXME: we should not copy into our keymap before
+                 * validating the data.
+                 */
+                if (copy_from_user(joydev->keypam, argp, len))
                        return -EFAULT;
                for (i = 0; i < joydev->nkey; i++) {
@@ -529,25 +549,19 @@ static int joydev_ioctl_common(struct joydev *joydev,
                return 0;
-        case JSIOCGBTNMAP:
+        case (JSIOCGBTNMAP & ~IOCSIZE_MASK):
-                return copy_to_user(argp, joydev->keypam,
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
-                        sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)) ? -EFAULT : 0;
+                return copy_to_user(argp, joydev->keypam, len) ? -EFAULT : 0;
-        default:
+        case JSIOCGNAME(0):
-                if ((cmd & ~IOCSIZE_MASK) == JSIOCGNAME(0)) {
+                name = dev->name;
-                        int len;
+                if (!name)
-                        const char *name = dev->name;
+                        return 0;
-                        if (!name)
+                len = min_t(size_t, _IOC_SIZE(cmd), strlen(name) + 1);
-                                return 0;
+                return copy_to_user(argp, name, len) ? -EFAULT : len;
-                        len = strlen(name) + 1;
-                        if (len > _IOC_SIZE(cmd))
-                                len = _IOC_SIZE(cmd);
-                        if (copy_to_user(argp, name, len))
-                                return -EFAULT;
-                        return len;
-                }
        }
        return -EINVAL;
 }
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index baabf8302645..f6c688cae334 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -74,6 +74,7 @@ static struct iforce_device iforce_device[] = {
        { 0x05ef, 0x8884, "AVB Mag Turbo Force",                        btn_avb_wheel, abs_wheel, ff_iforce },
        { 0x05ef, 0x8888, "AVB Top Shot Force Feedback Racing Wheel",   btn_avb_tw, abs_wheel, ff_iforce }, //?
        { 0x061c, 0xc0a4, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce }, //?
+        { 0x061c, 0xc084, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce },
        { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback",       btn_wheel, abs_wheel, ff_iforce }, //?
        { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel",      btn_wheel, abs_wheel, ff_iforce }, //?
        { 0x06f8, 0x0004, "Gullemot Jet Leader 3D",                     btn_joystick, abs_joystick, ff_iforce }, //?
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index f83185aeb511..9f289d8f52c6 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -223,6 +223,7 @@ static struct usb_device_id iforce_usb_ids [] = {
        { USB_DEVICE(0x05ef, 0x8884) },         /* AVB Mag Turbo Force */
        { USB_DEVICE(0x05ef, 0x8888) },         /* AVB Top Shot FFB Racing Wheel */
        { USB_DEVICE(0x061c, 0xc0a4) },         /* ACT LABS Force RS */
+        { USB_DEVICE(0x061c, 0xc084) },         /* ACT LABS Force RS */
        { USB_DEVICE(0x06f8, 0x0001) },         /* Guillemot Race Leader Force Feedback */
        { USB_DEVICE(0x06f8, 0x0004) },         /* Guillemot Force Feedback Racing Wheel */
        { USB_DEVICE(0x06f8, 0xa302) },         /* Guillemot Jet Leader 3D */
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index a9d5031b855e..ea30c983a33e 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -388,6 +388,32 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
        return result;
 }
+static int wacom_query_tablet_data(struct usb_interface *intf)
+{
+        unsigned char *rep_data;
+        int limit = 0;
+        int error;
+        rep_data = kmalloc(2, GFP_KERNEL);
+        if (!rep_data)
+                return -ENOMEM;
+        do {
+                rep_data[0] = 2;
+                rep_data[1] = 2;
+                error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
+                                        2, rep_data, 2);
+                if (error >= 0)
+                        error = usb_get_report(intf,
+                                                WAC_HID_FEATURE_REPORT, 2,
+                                                rep_data, 2);
+        } while ((error < 0 || rep_data[1] != 2) && limit++ < 5);
+        kfree(rep_data);
+        return error < 0 ? error : 0;
+}
 static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
        struct usb_device *dev = interface_to_usbdev(intf);
@@ -398,7 +424,6 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
        struct wacom_features *features;
        struct input_dev *input_dev;
        int error = -ENOMEM;
-        char rep_data[2], limit = 0;
        struct hid_descriptor *hid_desc;
        wacom = kzalloc(sizeof(struct wacom), GFP_KERNEL);
@@ -489,20 +514,10 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
        /*
         * Ask the tablet to report tablet data if it is not a Tablet PC.
-         * Repeat until it succeeds
+         * Note that if query fails it is not a hard failure.
         */
-        if (wacom_wac->features->type != TABLETPC) {
+        if (wacom_wac->features->type != TABLETPC)
-                do {
+                wacom_query_tablet_data(intf);
-                        rep_data[0] = 2;
-                        rep_data[1] = 2;
-                        error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
-                                                2, rep_data, 2);
-                        if (error >= 0)
-                                error = usb_get_report(intf,
-                                                WAC_HID_FEATURE_REPORT, 2,
-                                                rep_data, 2);
-                } while ((error < 0 || rep_data[1] != 2) && limit++ < 5);
-        }
        usb_set_intfdata(intf, wacom);
        return 0;
diff --git a/drivers/input/touchscreen/ucb1400_ts.c b/drivers/input/touchscreen/ucb1400_ts.c
index 6954f5500108..3a7a58222f83 100644
--- a/drivers/input/touchscreen/ucb1400_ts.c
+++ b/drivers/input/touchscreen/ucb1400_ts.c
@@ -170,11 +170,11 @@ static void ucb1400_handle_pending_irq(struct ucb1400_ts *ucb)
        ucb1400_reg_write(ucb->ac97, UCB_IE_CLEAR, isr);
        ucb1400_reg_write(ucb->ac97, UCB_IE_CLEAR, 0);
-        if (isr & UCB_IE_TSPX) {
+        if (isr & UCB_IE_TSPX)
                ucb1400_ts_irq_disable(ucb->ac97);
-                enable_irq(ucb->irq);
+        else
-        } else
+                dev_dbg(&ucb->ts_idev->dev, "ucb1400: unexpected IE_STATUS = %#x\n", isr);
-                printk(KERN_ERR "ucb1400: unexpected IE_STATUS = %#x\n", isr);
+        enable_irq(ucb->irq);
 }
 static int ucb1400_ts_thread(void *_ucb)
@@ -345,6 +345,7 @@ static int ucb1400_ts_detect_irq(struct ucb1400_ts *ucb)
 static int ucb1400_ts_probe(struct platform_device *dev)
 {
        int error, x_res, y_res;
+        u16 fcsr;
        struct ucb1400_ts *ucb = dev->dev.platform_data;
        ucb->ts_idev = input_allocate_device();
@@ -382,6 +383,14 @@ static int ucb1400_ts_probe(struct platform_device *dev)
        ucb->ts_idev->evbit[0]          = BIT_MASK(EV_ABS) | BIT_MASK(EV_KEY);
        ucb->ts_idev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
+        /*
+         * Enable ADC filter to prevent horrible jitter on Colibri.
+         * This also further reduces jitter on boards where ADCSYNC
+         * pin is connected.
+         */
+        fcsr = ucb1400_reg_read(ucb->ac97, UCB_FCSR);
+        ucb1400_reg_write(ucb->ac97, UCB_FCSR, fcsr | UCB_FCSR_AVE);
        ucb1400_adc_enable(ucb->ac97);
        x_res = ucb1400_ts_read_xres(ucb);
        y_res = ucb1400_ts_read_yres(ucb);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 103f2d33fa89..9dd872000cec 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4364,6 +4364,7 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                if (mode == 1)
                        set_disk_ro(disk, 1);
                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                err = 0;
        }
 out:
        mutex_unlock(&mddev->open_mutex);
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index 7ad972229db4..0d9d4bc9c762 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -61,7 +61,7 @@ static void orion_nand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
        buf64 = (uint64_t *)buf;
        while (i < len/8) {
                uint64_t x;
-                asm ("ldrd\t%0, [%1]" : "=r" (x) : "r" (io_base));
+                asm volatile ("ldrd\t%0, [%1]" : "=&r" (x) : "r" (io_base));
                buf64[i++] = x;
        }
        i *= 8;
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index c20416850948..45675889850b 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -235,6 +235,7 @@ enum vortex_chips {
        CH_3C900B_FL,
        CH_3C905_1,
        CH_3C905_2,
+        CH_3C905B_TX,
        CH_3C905B_1,
        CH_3C905B_2,
@@ -307,6 +308,8 @@ static struct vortex_chip_info {
         PCI_USES_MASTER, IS_BOOMERANG|HAS_MII|EEPROM_RESET, 64, },
        {"3c905 Boomerang 100baseT4",
         PCI_USES_MASTER, IS_BOOMERANG|HAS_MII|EEPROM_RESET, 64, },
+        {"3C905B-TX Fast Etherlink XL PCI",
+         PCI_USES_MASTER, IS_CYCLONE|HAS_NWAY|HAS_HWCKSM|EXTRA_PREAMBLE, 128, },
        {"3c905B Cyclone 100baseTx",
         PCI_USES_MASTER, IS_CYCLONE|HAS_NWAY|HAS_HWCKSM|EXTRA_PREAMBLE, 128, },
@@ -389,6 +392,7 @@ static struct pci_device_id vortex_pci_tbl[] = {
        { 0x10B7, 0x900A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C900B_FL },
        { 0x10B7, 0x9050, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905_1 },
        { 0x10B7, 0x9051, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905_2 },
+        { 0x10B7, 0x9054, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_TX },
        { 0x10B7, 0x9055, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_1 },
        { 0x10B7, 0x9058, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_2 },
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 50efde11ea6c..d0dbbf39349a 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -515,7 +515,7 @@ rx_status_loop:
                dma_addr_t mapping;
                struct sk_buff *skb, *new_skb;
                struct cp_desc *desc;
-                unsigned buflen;
+                const unsigned buflen = cp->rx_buf_sz;
                skb = cp->rx_skb[rx_tail];
                BUG_ON(!skb);
@@ -549,8 +549,7 @@ rx_status_loop:
                        pr_debug("%s: rx slot %d status 0x%x len %d\n",
                               dev->name, rx_tail, status, len);
-                buflen = cp->rx_buf_sz + NET_IP_ALIGN;
+                new_skb = netdev_alloc_skb(dev, buflen + NET_IP_ALIGN);
-                new_skb = netdev_alloc_skb(dev, buflen);
                if (!new_skb) {
                        dev->stats.rx_dropped++;
                        goto rx_next;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 5f6509a5f640..5ce7cbabd7a7 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1727,12 +1727,14 @@ config KS8842
        tristate "Micrel KSZ8842"
        depends on HAS_IOMEM
        help
-          This platform driver is for Micrel KSZ8842 chip.
+          This platform driver is for Micrel KSZ8842 / KS8842
+          2-port ethernet switch chip (managed, VLAN, QoS).
 config KS8851
       tristate "Micrel KS8851 SPI"
       depends on SPI
       select MII
+        select CRC32
       help
         SPI driver for Micrel KS8851 SPI attached network chip.
diff --git a/drivers/net/arm/w90p910_ether.c b/drivers/net/arm/w90p910_ether.c
index 616fb7985a34..ddd231cb54b7 100644
--- a/drivers/net/arm/w90p910_ether.c
+++ b/drivers/net/arm/w90p910_ether.c
@@ -1080,7 +1080,7 @@ static struct platform_driver w90p910_ether_driver = {
        .probe          = w90p910_ether_probe,
        .remove         = __devexit_p(w90p910_ether_remove),
        .driver         = {
-                .name   = "w90p910-emc",
+                .name   = "nuc900-emc",
                .owner  = THIS_MODULE,
        },
 };
@@ -1101,5 +1101,5 @@ module_exit(w90p910_ether_exit);
 MODULE_AUTHOR("Wan ZongShun <mcuos.com@gmail.com>");
 MODULE_DESCRIPTION("w90p910 MAC driver!");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:w90p910-emc");
+MODULE_ALIAS("platform:nuc900-emc");
diff --git a/drivers/net/atl1c/atl1c_ethtool.c b/drivers/net/atl1c/atl1c_ethtool.c
index 607007d75b6f..00d11b480af3 100644
--- a/drivers/net/atl1c/atl1c_ethtool.c
+++ b/drivers/net/atl1c/atl1c_ethtool.c
@@ -232,11 +232,11 @@ static void atl1c_get_drvinfo(struct net_device *netdev,
 {
        struct atl1c_adapter *adapter = netdev_priv(netdev);
-        strncpy(drvinfo->driver,  atl1c_driver_name, sizeof(drvinfo->driver));
+        strlcpy(drvinfo->driver,  atl1c_driver_name, sizeof(drvinfo->driver));
-        strncpy(drvinfo->version, atl1c_driver_version,
+        strlcpy(drvinfo->version, atl1c_driver_version,
                sizeof(drvinfo->version));
-        strncpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
+        strlcpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
-        strncpy(drvinfo->bus_info, pci_name(adapter->pdev),
+        strlcpy(drvinfo->bus_info, pci_name(adapter->pdev),
                sizeof(drvinfo->bus_info));
        drvinfo->n_stats = 0;
        drvinfo->testinfo_len = 0;
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 94d7325caf4f..8bca12f71390 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -3378,11 +3378,11 @@ static void atl1_get_drvinfo(struct net_device *netdev,
 {
        struct atl1_adapter *adapter = netdev_priv(netdev);
-        strncpy(drvinfo->driver, ATLX_DRIVER_NAME, sizeof(drvinfo->driver));
+        strlcpy(drvinfo->driver, ATLX_DRIVER_NAME, sizeof(drvinfo->driver));
-        strncpy(drvinfo->version, ATLX_DRIVER_VERSION,
+        strlcpy(drvinfo->version, ATLX_DRIVER_VERSION,
                sizeof(drvinfo->version));
-        strncpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
+        strlcpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
-        strncpy(drvinfo->bus_info, pci_name(adapter->pdev),
+        strlcpy(drvinfo->bus_info, pci_name(adapter->pdev),
                sizeof(drvinfo->bus_info));
        drvinfo->eedump_len = ATL1_EEDUMP_LEN;
 }
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 36d4d377ec2f..bafca672ea7d 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -952,9 +952,10 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
        int rc = NETDEV_TX_OK;
        dma_addr_t mapping;
        u32 len, entry, ctrl;
+        unsigned long flags;
        len = skb->len;
-        spin_lock_irq(&bp->lock);
+        spin_lock_irqsave(&bp->lock, flags);
        /* This is a hard error, log it. */
        if (unlikely(TX_BUFFS_AVAIL(bp) < 1)) {
@@ -1027,7 +1028,7 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dev->trans_start = jiffies;
 out_unlock:
-        spin_unlock_irq(&bp->lock);
+        spin_unlock_irqrestore(&bp->lock, flags);
        return rc;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index b70cc99962fc..06b901152d44 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -399,9 +399,11 @@ static int bnx2_unregister_cnic(struct net_device *dev)
        struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
        struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
+        mutex_lock(&bp->cnic_lock);
        cp->drv_state = 0;
        bnapi->cnic_present = 0;
        rcu_assign_pointer(bp->cnic_ops, NULL);
+        mutex_unlock(&bp->cnic_lock);
        synchronize_rcu();
        return 0;
 }
@@ -429,13 +431,13 @@ bnx2_cnic_stop(struct bnx2 *bp)
        struct cnic_ops *c_ops;
        struct cnic_ctl_info info;
-        rcu_read_lock();
+        mutex_lock(&bp->cnic_lock);
-        c_ops = rcu_dereference(bp->cnic_ops);
+        c_ops = bp->cnic_ops;
        if (c_ops) {
                info.cmd = CNIC_CTL_STOP_CMD;
                c_ops->cnic_ctl(bp->cnic_data, &info);
        }
-        rcu_read_unlock();
+        mutex_unlock(&bp->cnic_lock);
 }
 static void
@@ -444,8 +446,8 @@ bnx2_cnic_start(struct bnx2 *bp)
        struct cnic_ops *c_ops;
        struct cnic_ctl_info info;
-        rcu_read_lock();
+        mutex_lock(&bp->cnic_lock);
-        c_ops = rcu_dereference(bp->cnic_ops);
+        c_ops = bp->cnic_ops;
        if (c_ops) {
                if (!(bp->flags & BNX2_FLAG_USING_MSIX)) {
                        struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
@@ -455,7 +457,7 @@ bnx2_cnic_start(struct bnx2 *bp)
                info.cmd = CNIC_CTL_START_CMD;
                c_ops->cnic_ctl(bp->cnic_data, &info);
        }
-        rcu_read_unlock();
+        mutex_unlock(&bp->cnic_lock);
 }
 #else
@@ -7663,6 +7665,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
        spin_lock_init(&bp->phy_lock);
        spin_lock_init(&bp->indirect_lock);
+#ifdef BCM_CNIC
+        mutex_init(&bp->cnic_lock);
+#endif
        INIT_WORK(&bp->reset_task, bnx2_reset_task);
        dev->base_addr = dev->mem_start = pci_resource_start(pdev, 0);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index f1edfaa9e56a..a4f12fd0ecd2 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6902,6 +6902,7 @@ struct bnx2 {
        u32                     idle_chk_status_idx;
 #ifdef BCM_CNIC
+        struct mutex            cnic_lock;
        struct cnic_eth_dev     cnic_eth_dev;
 #endif
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 9e4283aff828..e1a4f8214239 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -611,11 +611,18 @@ nla_put_failure:
        return -EMSGSIZE;
 }
+static int can_newlink(struct net_device *dev,
+                       struct nlattr *tb[], struct nlattr *data[])
+{
+        return -EOPNOTSUPP;
+}
 static struct rtnl_link_ops can_link_ops __read_mostly = {
        .kind           = "can",
        .maxtype        = IFLA_CAN_MAX,
        .policy         = can_policy,
        .setup          = can_setup,
+        .newlink        = can_newlink,
        .changelink     = can_changelink,
        .fill_info      = can_fill_info,
        .fill_xstats    = can_fill_xstats,
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4869d77cbe91..74c342959b7b 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -138,6 +138,16 @@ static struct cnic_dev *cnic_from_netdev(struct net_device *netdev)
        return NULL;
 }
+static inline void ulp_get(struct cnic_ulp_ops *ulp_ops)
+{
+        atomic_inc(&ulp_ops->ref_count);
+}
+static inline void ulp_put(struct cnic_ulp_ops *ulp_ops)
+{
+        atomic_dec(&ulp_ops->ref_count);
+}
 static void cnic_ctx_wr(struct cnic_dev *dev, u32 cid_addr, u32 off, u32 val)
 {
        struct cnic_local *cp = dev->cnic_priv;
@@ -358,6 +368,7 @@ int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
        }
        read_unlock(&cnic_dev_lock);
+        atomic_set(&ulp_ops->ref_count, 0);
        rcu_assign_pointer(cnic_ulp_tbl[ulp_type], ulp_ops);
        mutex_unlock(&cnic_lock);
@@ -379,6 +390,8 @@ int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 int cnic_unregister_driver(int ulp_type)
 {
        struct cnic_dev *dev;
+        struct cnic_ulp_ops *ulp_ops;
+        int i = 0;
        if (ulp_type >= MAX_CNIC_ULP_TYPE) {
                printk(KERN_ERR PFX "cnic_unregister_driver: Bad type %d\n",
@@ -386,7 +399,8 @@ int cnic_unregister_driver(int ulp_type)
                return -EINVAL;
        }
        mutex_lock(&cnic_lock);
-        if (!cnic_ulp_tbl[ulp_type]) {
+        ulp_ops = cnic_ulp_tbl[ulp_type];
+        if (!ulp_ops) {
                printk(KERN_ERR PFX "cnic_unregister_driver: Type %d has not "
                                    "been registered\n", ulp_type);
                goto out_unlock;
@@ -411,6 +425,14 @@ int cnic_unregister_driver(int ulp_type)
        mutex_unlock(&cnic_lock);
        synchronize_rcu();
+        while ((atomic_read(&ulp_ops->ref_count) != 0) && (i < 20)) {
+                msleep(100);
+                i++;
+        }
+        if (atomic_read(&ulp_ops->ref_count) != 0)
+                printk(KERN_WARNING PFX "%s: Failed waiting for ref count to go"
+                                        " to zero.\n", dev->netdev->name);
        return 0;
 out_unlock:
@@ -466,6 +488,7 @@ EXPORT_SYMBOL(cnic_register_driver);
 static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
 {
        struct cnic_local *cp = dev->cnic_priv;
+        int i = 0;
        if (ulp_type >= MAX_CNIC_ULP_TYPE) {
                printk(KERN_ERR PFX "cnic_unregister_device: Bad type %d\n",
@@ -486,6 +509,15 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
        synchronize_rcu();
+        while (test_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[ulp_type]) &&
+               i < 20) {
+                msleep(100);
+                i++;
+        }
+        if (test_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[ulp_type]))
+                printk(KERN_WARNING PFX "%s: Failed waiting for ULP up call"
+                                        " to complete.\n", dev->netdev->name);
        return 0;
 }
 EXPORT_SYMBOL(cnic_unregister_driver);
@@ -1076,18 +1108,23 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
        if (cp->cnic_uinfo)
                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
-        rcu_read_lock();
        for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops)
+                ulp_ops = cp->ulp_ops[if_type];
+                if (!ulp_ops) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
                if (test_and_clear_bit(ULP_F_START, &cp->ulp_flags[if_type]))
                        ulp_ops->cnic_stop(cp->ulp_handle[if_type]);
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
        }
-        rcu_read_unlock();
 }
 static void cnic_ulp_start(struct cnic_dev *dev)
@@ -1095,18 +1132,23 @@ static void cnic_ulp_start(struct cnic_dev *dev)
        struct cnic_local *cp = dev->cnic_priv;
        int if_type;
-        rcu_read_lock();
        for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->cnic_start)
+                ulp_ops = cp->ulp_ops[if_type];
+                if (!ulp_ops || !ulp_ops->cnic_start) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
                if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[if_type]))
                        ulp_ops->cnic_start(cp->ulp_handle[if_type]);
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
        }
-        rcu_read_unlock();
 }
 static int cnic_ctl(void *data, struct cnic_ctl_info *info)
@@ -1116,22 +1158,18 @@ static int cnic_ctl(void *data, struct cnic_ctl_info *info)
        switch (info->cmd) {
        case CNIC_CTL_STOP_CMD:
                cnic_hold(dev);
-                mutex_lock(&cnic_lock);
                cnic_ulp_stop(dev);
                cnic_stop_hw(dev);
-                mutex_unlock(&cnic_lock);
                cnic_put(dev);
                break;
        case CNIC_CTL_START_CMD:
                cnic_hold(dev);
-                mutex_lock(&cnic_lock);
                if (!cnic_start_hw(dev))
                        cnic_ulp_start(dev);
-                mutex_unlock(&cnic_lock);
                cnic_put(dev);
                break;
        default:
@@ -1145,19 +1183,23 @@ static void cnic_ulp_init(struct cnic_dev *dev)
        int i;
        struct cnic_local *cp = dev->cnic_priv;
-        rcu_read_lock();
        for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->cnic_init)
+                ulp_ops = cnic_ulp_tbl[i];
+                if (!ulp_ops || !ulp_ops->cnic_init) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                ulp_get(ulp_ops);
+                mutex_unlock(&cnic_lock);
                if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[i]))
                        ulp_ops->cnic_init(dev);
+                ulp_put(ulp_ops);
        }
-        rcu_read_unlock();
 }
 static void cnic_ulp_exit(struct cnic_dev *dev)
@@ -1165,19 +1207,23 @@ static void cnic_ulp_exit(struct cnic_dev *dev)
        int i;
        struct cnic_local *cp = dev->cnic_priv;
-        rcu_read_lock();
        for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->cnic_exit)
+                ulp_ops = cnic_ulp_tbl[i];
+                if (!ulp_ops || !ulp_ops->cnic_exit) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                ulp_get(ulp_ops);
+                mutex_unlock(&cnic_lock);
                if (test_and_clear_bit(ULP_F_INIT, &cp->ulp_flags[i]))
                        ulp_ops->cnic_exit(dev);
+                ulp_put(ulp_ops);
        }
-        rcu_read_unlock();
 }
 static int cnic_cm_offload_pg(struct cnic_sock *csk)
@@ -2393,21 +2439,45 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        return 0;
 }
-static int cnic_start_hw(struct cnic_dev *dev)
+static int cnic_register_netdev(struct cnic_dev *dev)
 {
        struct cnic_local *cp = dev->cnic_priv;
        struct cnic_eth_dev *ethdev = cp->ethdev;
        int err;
-        if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+        if (!ethdev)
-                return -EALREADY;
+                return -ENODEV;
+        if (ethdev->drv_state & CNIC_DRV_STATE_REGD)
+                return 0;
        err = ethdev->drv_register_cnic(dev->netdev, cp->cnic_ops, dev);
-        if (err) {
+        if (err)
                printk(KERN_ERR PFX "%s: register_cnic failed\n",
                       dev->netdev->name);
-                goto err2;
-        }
+        return err;
+}
+static void cnic_unregister_netdev(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
+        if (!ethdev)
+                return;
+        ethdev->drv_unregister_cnic(dev->netdev);
+}
+static int cnic_start_hw(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
+        int err;
+        if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+                return -EALREADY;
        dev->regview = ethdev->io_base;
        cp->chip_id = ethdev->chip_id;
@@ -2438,18 +2508,13 @@ static int cnic_start_hw(struct cnic_dev *dev)
        return 0;
 err1:
-        ethdev->drv_unregister_cnic(dev->netdev);
        cp->free_resc(dev);
        pci_dev_put(dev->pcidev);
-err2:
        return err;
 }
 static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
 {
-        struct cnic_local *cp = dev->cnic_priv;
-        struct cnic_eth_dev *ethdev = cp->ethdev;
        cnic_disable_bnx2_int_sync(dev);
        cnic_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
@@ -2461,8 +2526,6 @@ static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
        cnic_setup_5709_context(dev, 0);
        cnic_free_irq(dev);
-        ethdev->drv_unregister_cnic(dev->netdev);
        cnic_free_resc(dev);
 }
@@ -2543,7 +2606,7 @@ static struct cnic_dev *init_bnx2_cnic(struct net_device *dev)
        probe = symbol_get(bnx2_cnic_probe);
        if (probe) {
                ethdev = (*probe)(dev);
-                symbol_put_addr(probe);
+                symbol_put(bnx2_cnic_probe);
        }
        if (!ethdev)
                return NULL;
@@ -2646,10 +2709,12 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
                else if (event == NETDEV_UNREGISTER)
                        cnic_ulp_exit(dev);
                else if (event == NETDEV_UP) {
-                        mutex_lock(&cnic_lock);
+                        if (cnic_register_netdev(dev) != 0) {
+                                cnic_put(dev);
+                                goto done;
+                        }
                        if (!cnic_start_hw(dev))
                                cnic_ulp_start(dev);
-                        mutex_unlock(&cnic_lock);
                }
                rcu_read_lock();
@@ -2668,10 +2733,9 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
                rcu_read_unlock();
                if (event == NETDEV_GOING_DOWN) {
-                        mutex_lock(&cnic_lock);
                        cnic_ulp_stop(dev);
                        cnic_stop_hw(dev);
-                        mutex_unlock(&cnic_lock);
+                        cnic_unregister_netdev(dev);
                } else if (event == NETDEV_UNREGISTER) {
                        write_lock(&cnic_dev_lock);
                        list_del_init(&dev->list);
@@ -2703,6 +2767,7 @@ static void cnic_release(void)
                }
                cnic_ulp_exit(dev);
+                cnic_unregister_netdev(dev);
                list_del_init(&dev->list);
                cnic_free_dev(dev);
        }
diff --git a/drivers/net/cnic.h b/drivers/net/cnic.h
index 5192d4a9df5a..a94b302bb464 100644
--- a/drivers/net/cnic.h
+++ b/drivers/net/cnic.h
@@ -176,6 +176,7 @@ struct cnic_local {
        unsigned long ulp_flags[MAX_CNIC_ULP_TYPE];
 #define ULP_F_INIT      0
 #define ULP_F_START     1
+#define ULP_F_CALL_PENDING      2
        struct cnic_ulp_ops *ulp_ops[MAX_CNIC_ULP_TYPE];
        /* protected by ulp_lock */
diff --git a/drivers/net/cnic_if.h b/drivers/net/cnic_if.h
index d1bce27ee99e..a49235739eef 100644
--- a/drivers/net/cnic_if.h
+++ b/drivers/net/cnic_if.h
@@ -290,6 +290,7 @@ struct cnic_ulp_ops {
        void (*iscsi_nl_send_msg)(struct cnic_dev *dev, u32 msg_type,
                                  char *data, u16 data_size);
        struct module *owner;
+        atomic_t ref_count;
 };
 extern int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops);
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 41b648a67fec..3a6735dc9f6a 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1899,7 +1899,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
                                nic->ru_running = RU_SUSPENDED;
                pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
                                               sizeof(struct rfd),
-                                               PCI_DMA_BIDIRECTIONAL);
+                                               PCI_DMA_FROMDEVICE);
                return -ENODATA;
        }
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index d56c7473144a..99df2abf82a9 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -338,10 +338,7 @@ static s32 e1000_init_nvm_params_ich8lan(struct e1000_hw *hw)
 {
        struct e1000_nvm_info *nvm = &hw->nvm;
        struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
-        union ich8_hws_flash_status hsfsts;
+        u32 gfpreg, sector_base_addr, sector_end_addr;
-        u32 gfpreg;
-        u32 sector_base_addr;
-        u32 sector_end_addr;
        u16 i;
        /* Can't read flash registers if the register set isn't mapped. */
@@ -375,20 +372,6 @@ static s32 e1000_init_nvm_params_ich8lan(struct e1000_hw *hw)
        /* Adjust to word count */
        nvm->flash_bank_size /= sizeof(u16);
-        /*
-         * Make sure the flash bank size does not overwrite the 4k
-         * sector ranges. We may have 64k allotted to us but we only care
-         * about the first 2 4k sectors. Therefore, if we have anything less
-         * than 64k set in the HSFSTS register, we will reduce the bank size
-         * down to 4k and let the rest remain unused. If berasesz == 3, then
-         * we are working in 64k mode. Otherwise we are not.
-         */
-        if (nvm->flash_bank_size > E1000_ICH8_SHADOW_RAM_WORDS) {
-                hsfsts.regval = er16flash(ICH_FLASH_HSFSTS);
-                if (hsfsts.hsf_status.berasesz != 3)
-                        nvm->flash_bank_size = E1000_ICH8_SHADOW_RAM_WORDS;
-        }
        nvm->word_size = E1000_ICH8_SHADOW_RAM_WORDS;
        /* Clear shadow ram */
@@ -594,8 +577,8 @@ static DEFINE_MUTEX(nvm_mutex);
 **/
 static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
 {
-        u32 extcnf_ctrl;
+        u32 extcnf_ctrl, timeout = PHY_CFG_TIMEOUT;
-        u32 timeout = PHY_CFG_TIMEOUT;
+        s32 ret_val = 0;
        might_sleep();
@@ -603,28 +586,46 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
        while (timeout) {
                extcnf_ctrl = er32(EXTCNF_CTRL);
+                if (!(extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG))
+                        break;
-                if (!(extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)) {
+                mdelay(1);
-                        extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
+                timeout--;
-                        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        }
+        if (!timeout) {
+                hw_dbg(hw, "SW/FW/HW has locked the resource for too long.\n");
+                ret_val = -E1000_ERR_CONFIG;
+                goto out;
+        }
+        timeout = PHY_CFG_TIMEOUT * 2;
+        extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
+        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        while (timeout) {
+                extcnf_ctrl = er32(EXTCNF_CTRL);
+                if (extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)
+                        break;
-                        extcnf_ctrl = er32(EXTCNF_CTRL);
-                        if (extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)
-                                break;
-                }
                mdelay(1);
                timeout--;
        }
        if (!timeout) {
-                hw_dbg(hw, "FW or HW has locked the resource for too long.\n");
+                hw_dbg(hw, "Failed to acquire the semaphore.\n");
                extcnf_ctrl &= ~E1000_EXTCNF_CTRL_SWFLAG;
                ew32(EXTCNF_CTRL, extcnf_ctrl);
-                mutex_unlock(&nvm_mutex);
+                ret_val = -E1000_ERR_CONFIG;
-                return -E1000_ERR_CONFIG;
+                goto out;
        }
-        return 0;
+out:
+        if (ret_val)
+                mutex_unlock(&nvm_mutex);
+        return ret_val;
 }
 /**
@@ -1306,7 +1307,7 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
        struct e1000_nvm_info *nvm = &hw->nvm;
        struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
        u32 act_offset;
-        s32 ret_val;
+        s32 ret_val = 0;
        u32 bank = 0;
        u16 i, word;
@@ -1321,12 +1322,15 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                goto out;
        ret_val = e1000_valid_nvm_bank_detect_ich8lan(hw, &bank);
-        if (ret_val)
+        if (ret_val) {
-                goto release;
+                hw_dbg(hw, "Could not detect valid bank, assuming bank 0\n");
+                bank = 0;
+        }
        act_offset = (bank) ? nvm->flash_bank_size : 0;
        act_offset += offset;
+        ret_val = 0;
        for (i = 0; i < words; i++) {
                if ((dev_spec->shadow_ram) &&
                    (dev_spec->shadow_ram[offset+i].modified)) {
@@ -1341,7 +1345,6 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                }
        }
-release:
        e1000_release_swflag_ich8lan(hw);
 out:
@@ -1592,7 +1595,6 @@ static s32 e1000_write_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
 {
        struct e1000_nvm_info *nvm = &hw->nvm;
        struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
-        s32 ret_val;
        u16 i;
        if ((offset >= nvm->word_size) || (words > nvm->word_size - offset) ||
@@ -1601,17 +1603,11 @@ static s32 e1000_write_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                return -E1000_ERR_NVM;
        }
-        ret_val = e1000_acquire_swflag_ich8lan(hw);
-        if (ret_val)
-                return ret_val;
        for (i = 0; i < words; i++) {
                dev_spec->shadow_ram[offset+i].modified = 1;
                dev_spec->shadow_ram[offset+i].value = data[i];
        }
-        e1000_release_swflag_ich8lan(hw);
        return 0;
 }
@@ -1652,8 +1648,8 @@ static s32 e1000_update_nvm_checksum_ich8lan(struct e1000_hw *hw)
         */
        ret_val =  e1000_valid_nvm_bank_detect_ich8lan(hw, &bank);
        if (ret_val) {
-                e1000_release_swflag_ich8lan(hw);
+                hw_dbg(hw, "Could not detect valid bank, assuming bank 0\n");
-                goto out;
+                bank = 0;
        }
        if (bank == 0) {
@@ -2039,12 +2035,8 @@ static s32 e1000_erase_flash_bank_ich8lan(struct e1000_hw *hw, u32 bank)
                iteration = 1;
                break;
        case 2:
-                if (hw->mac.type == e1000_ich9lan) {
+                sector_size = ICH_FLASH_SEG_SIZE_8K;
-                        sector_size = ICH_FLASH_SEG_SIZE_8K;
+                iteration = 1;
-                        iteration = flash_bank_size / ICH_FLASH_SEG_SIZE_8K;
-                } else {
-                        return -E1000_ERR_NVM;
-                }
                break;
        case 3:
                sector_size = ICH_FLASH_SEG_SIZE_64K;
@@ -2056,7 +2048,7 @@ static s32 e1000_erase_flash_bank_ich8lan(struct e1000_hw *hw, u32 bank)
        /* Start with the base address, then add the sector offset. */
        flash_linear_addr = hw->nvm.flash_base_addr;
-        flash_linear_addr += (bank) ? (sector_size * iteration) : 0;
+        flash_linear_addr += (bank) ? flash_bank_size : 0;
        for (j = 0; j < iteration ; j++) {
                do {
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 63415bb6f48f..fa92a683aefd 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4538,8 +4538,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
                /* Allow time for pending master requests to run */
                e1000e_disable_pcie_master(&adapter->hw);
-                if ((adapter->flags2 & FLAG2_HAS_PHY_WAKEUP) &&
+                if (adapter->flags2 & FLAG2_HAS_PHY_WAKEUP) {
-                    !(hw->mac.ops.check_mng_mode(hw))) {
                        /* enable wakeup by the PHY */
                        retval = e1000_init_phy_wakeup(adapter, wufc);
                        if (retval)
@@ -4557,7 +4556,8 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
        *enable_wake = !!wufc;
        /* make sure adapter isn't asleep if manageability is enabled */
-        if (adapter->flags & FLAG_MNG_PT_ENABLED)
+        if ((adapter->flags & FLAG_MNG_PT_ENABLED) ||
+            (hw->mac.ops.check_mng_mode(hw)))
                *enable_wake = true;
        if (adapter->hw.phy.type == e1000_phy_igp_3)
@@ -4670,14 +4670,6 @@ static int e1000_resume(struct pci_dev *pdev)
                return err;
        }
-        /* AER (Advanced Error Reporting) hooks */
-        err = pci_enable_pcie_error_reporting(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
-                                    "0x%x\n", err);
-                /* non-fatal, continue */
-        }
        pci_set_master(pdev);
        pci_enable_wake(pdev, PCI_D3hot, 0);
@@ -4990,6 +4982,14 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        if (err)
                goto err_pci_reg;
+        /* AER (Advanced Error Reporting) hooks */
+        err = pci_enable_pcie_error_reporting(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
+                        "0x%x\n", err);
+                /* non-fatal, continue */
+        }
        pci_set_master(pdev);
        /* PCI config space info */
        err = pci_save_state(pdev);
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index d4b98074b1b7..c9fd82d3a80d 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -285,6 +285,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct fec_enet_private *fep = netdev_priv(dev);
        struct bufdesc *bdp;
+        void *bufaddr;
        unsigned short  status;
        unsigned long flags;
@@ -312,7 +313,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        status &= ~BD_ENET_TX_STATS;
        /* Set buffer length and buffer pointer */
-        bdp->cbd_bufaddr = __pa(skb->data);
+        bufaddr = skb->data;
        bdp->cbd_datlen = skb->len;
        /*
@@ -320,11 +321,11 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         * 4-byte boundaries. Use bounce buffers to copy data
         * and get it aligned. Ugh.
         */
-        if (bdp->cbd_bufaddr & FEC_ALIGNMENT) {
+        if (((unsigned long) bufaddr) & FEC_ALIGNMENT) {
                unsigned int index;
                index = bdp - fep->tx_bd_base;
                memcpy(fep->tx_bounce[index], (void *)skb->data, skb->len);
-                bdp->cbd_bufaddr = __pa(fep->tx_bounce[index]);
+                bufaddr = fep->tx_bounce[index];
        }
        /* Save skb pointer */
@@ -336,7 +337,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Push the data cache so the CPM does not get stale memory
         * data.
         */
-        bdp->cbd_bufaddr = dma_map_single(&dev->dev, skb->data,
+        bdp->cbd_bufaddr = dma_map_single(&dev->dev, bufaddr,
                        FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index cc786333d95c..c40113f58963 100644
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -309,6 +309,7 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct mpc52xx_fec_priv *priv = netdev_priv(dev);
        struct bcom_fec_bd *bd;
+        unsigned long flags;
        if (bcom_queue_full(priv->tx_dmatsk)) {
                if (net_ratelimit())
@@ -316,7 +317,7 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                return NETDEV_TX_BUSY;
        }
-        spin_lock_irq(&priv->lock);
+        spin_lock_irqsave(&priv->lock, flags);
        dev->trans_start = jiffies;
        bd = (struct bcom_fec_bd *)
@@ -332,7 +333,7 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                netif_stop_queue(dev);
        }
-        spin_unlock_irq(&priv->lock);
+        spin_unlock_irqrestore(&priv->lock, flags);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index f8ffcbf0bc39..e212f2c5448b 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -936,6 +936,7 @@ int startup_gfar(struct net_device *dev)
        struct gfar __iomem *regs = priv->regs;
        int err = 0;
        u32 rctrl = 0;
+        u32 tctrl = 0;
        u32 attrs = 0;
        gfar_write(&regs->imask, IMASK_INIT_CLEAR);
@@ -1111,11 +1112,19 @@ int startup_gfar(struct net_device *dev)
                rctrl |= RCTRL_PADDING(priv->padding);
        }
+        /* keep vlan related bits if it's enabled */
+        if (priv->vlgrp) {
+                rctrl |= RCTRL_VLEX | RCTRL_PRSDEP_INIT;
+                tctrl |= TCTRL_VLINS;
+        }
        /* Init rctrl based on our settings */
        gfar_write(&priv->regs->rctrl, rctrl);
        if (dev->features & NETIF_F_IP_CSUM)
-                gfar_write(&priv->regs->tctrl, TCTRL_INIT_CSUM);
+                tctrl |= TCTRL_INIT_CSUM;
+        gfar_write(&priv->regs->tctrl, tctrl);
        /* Set the extraction length and index */
        attrs = ATTRELI_EL(priv->rx_stash_size) |
@@ -1450,7 +1459,6 @@ static void gfar_vlan_rx_register(struct net_device *dev,
                /* Enable VLAN tag extraction */
                tempval = gfar_read(&priv->regs->rctrl);
-                tempval |= RCTRL_VLEX;
                tempval |= (RCTRL_VLEX | RCTRL_PRSDEP_INIT);
                gfar_write(&priv->regs->rctrl, tempval);
        } else {
diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c
index beb84213b671..f0f890803710 100644
--- a/drivers/net/ibm_newemac/core.c
+++ b/drivers/net/ibm_newemac/core.c
@@ -1305,6 +1305,8 @@ static int emac_close(struct net_device *ndev)
        free_irq(dev->emac_irq, dev);
+        netif_carrier_off(ndev);
        return 0;
 }
diff --git a/drivers/net/irda/pxaficp_ir.c b/drivers/net/irda/pxaficp_ir.c
index 3376a4f39e0a..77d10edefd25 100644
--- a/drivers/net/irda/pxaficp_ir.c
+++ b/drivers/net/irda/pxaficp_ir.c
@@ -803,9 +803,6 @@ static const struct net_device_ops pxa_irda_netdev_ops = {
        .ndo_stop               = pxa_irda_stop,
        .ndo_start_xmit         = pxa_irda_hard_xmit,
        .ndo_do_ioctl           = pxa_irda_ioctl,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
 };
 static int pxa_irda_probe(struct platform_device *pdev)
@@ -830,6 +827,7 @@ static int pxa_irda_probe(struct platform_device *pdev)
        if (!dev)
                goto err_mem_3;
+        SET_NETDEV_DEV(dev, &pdev->dev);
        si = netdev_priv(dev);
        si->dev = &pdev->dev;
        si->pdata = pdev->dev.platform_data;
diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c
index d0883835b0c6..fe4f2b2bff96 100644
--- a/drivers/net/irda/w83977af_ir.c
+++ b/drivers/net/irda/w83977af_ir.c
@@ -115,7 +115,7 @@ static int __init w83977af_init(void)
        IRDA_DEBUG(0, "%s()\n", __func__ );
-        for (i=0; (io[i] < 2000) && (i < ARRAY_SIZE(dev_self)); i++) {
+        for (i=0; i < ARRAY_SIZE(dev_self) && io[i] < 2000; i++) {
                if (w83977af_open(i, io[i], irq[i], dma[i]) == 0)
                        return 0;
        }
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index e11d83d5852b..2c4dc8221dcd 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -136,6 +136,8 @@ struct ixgbe_ring {
        u8 queue_index; /* needed for multiqueue queue management */
+#define IXGBE_RING_RX_PS_ENABLED                (u8)(1)
+        u8 flags;                       /* per ring feature flags */
        u16 head;
        u16 tail;
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 79144e950a34..dff8dfac7ed9 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1948,6 +1948,7 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                              struct ethtool_coalesce *ec)
 {
        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_q_vector *q_vector;
        int i;
        if (ec->tx_max_coalesced_frames_irq)
@@ -1982,14 +1983,24 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                adapter->itr_setting = 0;
        }
-        for (i = 0; i < adapter->num_msix_vectors - NON_Q_VECTORS; i++) {
+        /* MSI/MSIx Interrupt Mode */
-                struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
+        if (adapter->flags &
-                if (q_vector->txr_count && !q_vector->rxr_count)
+            (IXGBE_FLAG_MSIX_ENABLED | IXGBE_FLAG_MSI_ENABLED)) {
-                        /* tx vector gets half the rate */
+                int num_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
-                        q_vector->eitr = (adapter->eitr_param >> 1);
+                for (i = 0; i < num_vectors; i++) {
-                else
+                        q_vector = adapter->q_vector[i];
-                        /* rx only or mixed */
+                        if (q_vector->txr_count && !q_vector->rxr_count)
-                        q_vector->eitr = adapter->eitr_param;
+                                /* tx vector gets half the rate */
+                                q_vector->eitr = (adapter->eitr_param >> 1);
+                        else
+                                /* rx only or mixed */
+                                q_vector->eitr = adapter->eitr_param;
+                        ixgbe_write_eitr(q_vector);
+                }
+        /* Legacy Interrupt Mode */
+        } else {
+                q_vector = adapter->q_vector[0];
+                q_vector->eitr = adapter->eitr_param;
                ixgbe_write_eitr(q_vector);
        }
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index fa9f24e23683..28cf104e36cc 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -336,7 +336,7 @@ int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
                /* return 0 to bypass going to ULD for DDPed data */
                if (fcstat == IXGBE_RXDADV_STAT_FCSTAT_DDP)
                        rc = 0;
-                else
+                else if (ddp->len)
                        rc = ddp->len;
        }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 110c65ab5cb5..77b0381a2b5c 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -492,12 +492,12 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
        skb_record_rx_queue(skb, ring->queue_index);
        if (!(adapter->flags & IXGBE_FLAG_IN_NETPOLL)) {
-                if (adapter->vlgrp && is_vlan && (tag != 0))
+                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
                        vlan_gro_receive(napi, adapter->vlgrp, tag, skb);
                else
                        napi_gro_receive(napi, skb);
        } else {
-                if (adapter->vlgrp && is_vlan && (tag != 0))
+                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
                        vlan_hwaccel_rx(skb, adapter->vlgrp, tag);
                else
                        netif_rx(skb);
@@ -585,7 +585,7 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                rx_desc = IXGBE_RX_DESC_ADV(*rx_ring, i);
                if (!bi->page_dma &&
-                    (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)) {
+                    (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)) {
                        if (!bi->page) {
                                bi->page = alloc_page(GFP_ATOMIC);
                                if (!bi->page) {
@@ -629,7 +629,7 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                }
                /* Refresh the desc even if buffer_addrs didn't change because
                 * each write-back erases this info. */
-                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                        rx_desc->read.pkt_addr = cpu_to_le64(bi->page_dma);
                        rx_desc->read.hdr_addr = cpu_to_le64(bi->dma);
                } else {
@@ -726,7 +726,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        break;
                (*work_done)++;
-                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                        hdr_info = le16_to_cpu(ixgbe_get_hdr_info(rx_desc));
                        len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
                               IXGBE_RXDADV_HDRBUFLEN_SHIFT;
@@ -798,7 +798,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        rx_ring->stats.packets++;
                        rx_ring->stats.bytes += skb->len;
                } else {
-                        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                                rx_buffer_info->skb = next_buffer->skb;
                                rx_buffer_info->dma = next_buffer->dma;
                                next_buffer->skb = skb;
@@ -1898,46 +1898,19 @@ static void ixgbe_configure_tx(struct ixgbe_adapter *adapter)
 #define IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT 2
-static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter, int index)
+static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
+                                   struct ixgbe_ring *rx_ring)
 {
-        struct ixgbe_ring *rx_ring;
        u32 srrctl;
-        int queue0 = 0;
+        int index;
-        unsigned long mask;
        struct ixgbe_ring_feature *feature = adapter->ring_feature;
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+        index = rx_ring->reg_idx;
-                if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
+        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
-                        int dcb_i = feature[RING_F_DCB].indices;
+                unsigned long mask;
-                        if (dcb_i == 8)
-                                queue0 = index >> 4;
-                        else if (dcb_i == 4)
-                                queue0 = index >> 5;
-                        else
-                                dev_err(&adapter->pdev->dev, "Invalid DCB "
-                                        "configuration\n");
-#ifdef IXGBE_FCOE
-                        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
-                                struct ixgbe_ring_feature *f;
-                                rx_ring = &adapter->rx_ring[queue0];
-                                f = &adapter->ring_feature[RING_F_FCOE];
-                                if ((queue0 == 0) && (index > rx_ring->reg_idx))
-                                        queue0 = f->mask + index -
-                                                 rx_ring->reg_idx - 1;
-                        }
-#endif /* IXGBE_FCOE */
-                } else {
-                        queue0 = index;
-                }
-        } else {
                mask = (unsigned long) feature[RING_F_RSS].mask;
-                queue0 = index & mask;
                index = index & mask;
        }
-        rx_ring = &adapter->rx_ring[queue0];
        srrctl = IXGBE_READ_REG(&adapter->hw, IXGBE_SRRCTL(index));
        srrctl &= ~IXGBE_SRRCTL_BSIZEHDR_MASK;
@@ -1946,7 +1919,7 @@ static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter, int index)
        srrctl |= (IXGBE_RX_HDR_SIZE << IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT) &
                  IXGBE_SRRCTL_BSIZEHDR_MASK;
-        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
 #if (PAGE_SIZE / 2) > IXGBE_MAX_RXBUFFER
                srrctl |= IXGBE_MAX_RXBUFFER >> IXGBE_SRRCTL_BSIZEPKT_SHIFT;
 #else
@@ -2002,6 +1975,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
 {
        u64 rdba;
        struct ixgbe_hw *hw = &adapter->hw;
+        struct ixgbe_ring *rx_ring;
        struct net_device *netdev = adapter->netdev;
        int max_frame = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
        int i, j;
@@ -2018,11 +1992,6 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
        /* Decide whether to use packet split mode or not */
        adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
-#ifdef IXGBE_FCOE
-        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
-                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
-#endif /* IXGBE_FCOE */
        /* Set the RX buffer length according to the mode */
        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
                rx_buf_len = IXGBE_RX_HDR_SIZE;
@@ -2070,29 +2039,35 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
         * the Base and Length of the Rx Descriptor Ring
         */
        for (i = 0; i < adapter->num_rx_queues; i++) {
-                rdba = adapter->rx_ring[i].dma;
+                rx_ring = &adapter->rx_ring[i];
-                j = adapter->rx_ring[i].reg_idx;
+                rdba = rx_ring->dma;
+                j = rx_ring->reg_idx;
                IXGBE_WRITE_REG(hw, IXGBE_RDBAL(j), (rdba & DMA_BIT_MASK(32)));
                IXGBE_WRITE_REG(hw, IXGBE_RDBAH(j), (rdba >> 32));
                IXGBE_WRITE_REG(hw, IXGBE_RDLEN(j), rdlen);
                IXGBE_WRITE_REG(hw, IXGBE_RDH(j), 0);
                IXGBE_WRITE_REG(hw, IXGBE_RDT(j), 0);
-                adapter->rx_ring[i].head = IXGBE_RDH(j);
+                rx_ring->head = IXGBE_RDH(j);
-                adapter->rx_ring[i].tail = IXGBE_RDT(j);
+                rx_ring->tail = IXGBE_RDT(j);
-                adapter->rx_ring[i].rx_buf_len = rx_buf_len;
+                rx_ring->rx_buf_len = rx_buf_len;
+                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)
+                        rx_ring->flags |= IXGBE_RING_RX_PS_ENABLED;
 #ifdef IXGBE_FCOE
                if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
                        struct ixgbe_ring_feature *f;
                        f = &adapter->ring_feature[RING_F_FCOE];
-                        if ((rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE) &&
+                        if ((i >= f->mask) && (i < f->mask + f->indices)) {
-                            (i >= f->mask) && (i < f->mask + f->indices))
+                                rx_ring->flags &= ~IXGBE_RING_RX_PS_ENABLED;
-                                adapter->rx_ring[i].rx_buf_len =
+                                if (rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE)
-                                        IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                                        rx_ring->rx_buf_len =
+                                                IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                        }
                }
 #endif /* IXGBE_FCOE */
-                ixgbe_configure_srrctl(adapter, j);
+                ixgbe_configure_srrctl(adapter, rx_ring);
        }
        if (hw->mac.type == ixgbe_mac_82598EB) {
@@ -2168,7 +2143,8 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                /* Enable 82599 HW-RSC */
                for (i = 0; i < adapter->num_rx_queues; i++) {
-                        j = adapter->rx_ring[i].reg_idx;
+                        rx_ring = &adapter->rx_ring[i];
+                        j = rx_ring->reg_idx;
                        rscctrl = IXGBE_READ_REG(hw, IXGBE_RSCCTL(j));
                        rscctrl |= IXGBE_RSCCTL_RSCEN;
                        /*
@@ -2176,7 +2152,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                         * total size of max desc * buf_len is not greater
                         * than 65535
                         */
-                        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
 #if (MAX_SKB_FRAGS > 16)
                                rscctrl |= IXGBE_RSCCTL_MAXDESC_16;
 #elif (MAX_SKB_FRAGS > 8)
diff --git a/drivers/net/ixp2000/ixpdev.c b/drivers/net/ixp2000/ixpdev.c
index 2a0174b62e96..92fb8235c766 100644
--- a/drivers/net/ixp2000/ixpdev.c
+++ b/drivers/net/ixp2000/ixpdev.c
@@ -41,6 +41,7 @@ static int ixpdev_xmit(struct sk_buff *skb, struct net_device *dev)
        struct ixpdev_priv *ip = netdev_priv(dev);
        struct ixpdev_tx_desc *desc;
        int entry;
+        unsigned long flags;
        if (unlikely(skb->len > PAGE_SIZE)) {
                /* @@@ Count drops.  */
@@ -63,11 +64,11 @@ static int ixpdev_xmit(struct sk_buff *skb, struct net_device *dev)
        dev->trans_start = jiffies;
-        local_irq_disable();
+        local_irq_save(flags);
        ip->tx_queue_entries++;
        if (ip->tx_queue_entries == TX_BUF_COUNT_PER_CHAN)
                netif_stop_queue(dev);
-        local_irq_enable();
+        local_irq_restore(flags);
        return 0;
 }
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index 5b5c25368d1e..e3601cf3f931 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -620,6 +620,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dma_addr_t mapping;
        unsigned int len, entry;
        u32 ctrl;
+        unsigned long flags;
 #ifdef DEBUG
        int i;
@@ -635,12 +636,12 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
 #endif
        len = skb->len;
-        spin_lock_irq(&bp->lock);
+        spin_lock_irqsave(&bp->lock, flags);
        /* This is a hard error, log it. */
        if (TX_BUFFS_AVAIL(bp) < 1) {
                netif_stop_queue(dev);
-                spin_unlock_irq(&bp->lock);
+                spin_unlock_irqrestore(&bp->lock, flags);
                dev_err(&bp->pdev->dev,
                        "BUG! Tx Ring full when queue awake!\n");
                dev_dbg(&bp->pdev->dev, "tx_head = %u, tx_tail = %u\n",
@@ -674,7 +675,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
        if (TX_BUFFS_AVAIL(bp) < 1)
                netif_stop_queue(dev);
-        spin_unlock_irq(&bp->lock);
+        spin_unlock_irqrestore(&bp->lock, flags);
        dev->trans_start = jiffies;
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 91bdfdfd431f..3ac0404d0d11 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -506,8 +506,9 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                                 PCI_DMA_FROMDEVICE);
        }
        /* Adjust size of last fragment to match actual length */
-        skb_frags_rx[nr - 1].size = length -
+        if (nr > 0)
-                priv->frag_info[nr - 1].frag_prefix_size;
+                skb_frags_rx[nr - 1].size = length -
+                        priv->frag_info[nr - 1].frag_prefix_size;
        return nr;
 fail:
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 5a88b3f57693..62208401c4df 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -437,6 +437,7 @@ static inline void mlx4_en_xmit_poll(struct mlx4_en_priv *priv, int tx_ind)
 {
        struct mlx4_en_cq *cq = &priv->tx_cq[tx_ind];
        struct mlx4_en_tx_ring *ring = &priv->tx_ring[tx_ind];
+        unsigned long flags;
        /* If we don't have a pending timer, set one up to catch our recent
           post in case the interface becomes idle */
@@ -445,9 +446,9 @@ static inline void mlx4_en_xmit_poll(struct mlx4_en_priv *priv, int tx_ind)
        /* Poll the CQ every mlx4_en_TX_MODER_POLL packets */
        if ((++ring->poll_cnt & (MLX4_EN_TX_POLL_MODER - 1)) == 0)
-                if (spin_trylock_irq(&ring->comp_lock)) {
+                if (spin_trylock_irqsave(&ring->comp_lock, flags)) {
                        mlx4_en_process_tx_cq(priv->dev, cq);
-                        spin_unlock_irq(&ring->comp_lock);
+                        spin_unlock_irqrestore(&ring->comp_lock, flags);
                }
 }
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index f86e05047d19..a9c1fcca5e75 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -1254,7 +1254,7 @@ struct netxen_adapter {
        u8 mc_enabled;
        u8 max_mc_count;
        u8 rss_supported;
-        u8 resv2;
+        u8 link_changed;
        u32 resv3;
        u8 has_link_events;
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 7acf204e38c9..5d3343ef3d86 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,13 +184,6 @@ void netxen_free_sw_resources(struct netxen_adapter *adapter)
        kfree(recv_ctx->rds_rings);
 skip_rds:
-        if (recv_ctx->sds_rings == NULL)
-                goto skip_sds;
-        for(ring = 0; ring < adapter->max_sds_rings; ring++)
-                recv_ctx->sds_rings[ring].consumer = 0;
-skip_sds:
        if (adapter->tx_ring == NULL)
                return;
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 3cd8cfcf627b..28f270f5ac78 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -94,10 +94,6 @@ static struct pci_device_id netxen_pci_tbl[] __devinitdata = {
 MODULE_DEVICE_TABLE(pci, netxen_pci_tbl);
-static struct workqueue_struct *netxen_workq;
-#define SCHEDULE_WORK(tp)       queue_work(netxen_workq, tp)
-#define FLUSH_SCHEDULED_WORK()  flush_workqueue(netxen_workq)
 static void netxen_watchdog(unsigned long);
 static uint32_t crb_cmd_producer[4] = {
@@ -171,6 +167,8 @@ netxen_free_sds_rings(struct netxen_recv_context *recv_ctx)
 {
        if (recv_ctx->sds_rings != NULL)
                kfree(recv_ctx->sds_rings);
+        recv_ctx->sds_rings = NULL;
 }
 static int
@@ -193,6 +191,21 @@ netxen_napi_add(struct netxen_adapter *adapter, struct net_device *netdev)
 }
 static void
+netxen_napi_del(struct netxen_adapter *adapter)
+{
+        int ring;
+        struct nx_host_sds_ring *sds_ring;
+        struct netxen_recv_context *recv_ctx = &adapter->recv_ctx;
+        for (ring = 0; ring < adapter->max_sds_rings; ring++) {
+                sds_ring = &recv_ctx->sds_rings[ring];
+                netif_napi_del(&sds_ring->napi);
+        }
+        netxen_free_sds_rings(&adapter->recv_ctx);
+}
+static void
 netxen_napi_enable(struct netxen_adapter *adapter)
 {
        int ring;
@@ -260,7 +273,7 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
        change = 0;
        shift = NXRD32(adapter, CRB_DMA_SHIFT);
-        if (shift >= 32)
+        if (shift > 32)
                return 0;
        if (NX_IS_REVISION_P3(adapter->ahw.revision_id) && (shift > 9))
@@ -272,7 +285,7 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
                old_mask = pdev->dma_mask;
                old_cmask = pdev->dev.coherent_dma_mask;
-                mask = (1ULL<<(32+shift)) - 1;
+                mask = DMA_BIT_MASK(32+shift);
                err = pci_set_dma_mask(pdev, mask);
                if (err)
@@ -880,7 +893,6 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
        spin_unlock(&adapter->tx_clean_lock);
        del_timer_sync(&adapter->watchdog_timer);
-        FLUSH_SCHEDULED_WORK();
 }
@@ -894,10 +906,12 @@ netxen_nic_attach(struct netxen_adapter *adapter)
        struct nx_host_tx_ring *tx_ring;
        err = netxen_init_firmware(adapter);
-        if (err != 0) {
+        if (err)
-                printk(KERN_ERR "Failed to init firmware\n");
+                return err;
-                return -EIO;
-        }
+        err = netxen_napi_add(adapter, netdev);
+        if (err)
+                return err;
        if (adapter->fw_major < 4)
                adapter->max_rds_rings = 3;
@@ -961,6 +975,7 @@ netxen_nic_detach(struct netxen_adapter *adapter)
        netxen_free_hw_resources(adapter);
        netxen_release_rx_buffers(adapter);
        netxen_nic_free_irq(adapter);
+        netxen_napi_del(adapter);
        netxen_free_sw_resources(adapter);
        adapter->is_up = 0;
@@ -1105,9 +1120,6 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        netdev->irq = adapter->msix_entries[0].vector;
-        if (netxen_napi_add(adapter, netdev))
-                goto err_out_disable_msi;
        init_timer(&adapter->watchdog_timer);
        adapter->watchdog_timer.function = &netxen_watchdog;
        adapter->watchdog_timer.data = (unsigned long)adapter;
@@ -1177,6 +1189,9 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
        unregister_netdev(netdev);
+        cancel_work_sync(&adapter->watchdog_task);
+        cancel_work_sync(&adapter->tx_timeout_task);
        if (adapter->is_up == NETXEN_ADAPTER_UP_MAGIC) {
                netxen_nic_detach(adapter);
        }
@@ -1185,7 +1200,6 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
                netxen_free_adapter_offload(adapter);
        netxen_teardown_intr(adapter);
-        netxen_free_sds_rings(&adapter->recv_ctx);
        netxen_cleanup_pci_map(adapter);
@@ -1211,6 +1225,9 @@ netxen_nic_suspend(struct pci_dev *pdev, pm_message_t state)
        if (netif_running(netdev))
                netxen_nic_down(adapter, netdev);
+        cancel_work_sync(&adapter->watchdog_task);
+        cancel_work_sync(&adapter->tx_timeout_task);
        if (adapter->is_up == NETXEN_ADAPTER_UP_MAGIC)
                netxen_nic_detach(adapter);
@@ -1549,11 +1566,6 @@ static int netxen_nic_check_temp(struct netxen_adapter *adapter)
                       "%s: Device temperature %d degrees C exceeds"
                       " maximum allowed. Hardware has been shut down.\n",
                       netdev->name, temp_val);
-                netif_device_detach(netdev);
-                netxen_nic_down(adapter, netdev);
-                netxen_nic_detach(adapter);
                rv = 1;
        } else if (temp_state == NX_TEMP_WARN) {
                if (adapter->temp == NX_TEMP_NORMAL) {
@@ -1587,10 +1599,7 @@ void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup)
                        netif_carrier_off(netdev);
                        netif_stop_queue(netdev);
                }
+                adapter->link_changed = !adapter->has_link_events;
-                if (!adapter->has_link_events)
-                        netxen_nic_set_link_parameters(adapter);
        } else if (!adapter->ahw.linkup && linkup) {
                printk(KERN_INFO "%s: %s NIC Link is up\n",
                       netxen_nic_driver_name, netdev->name);
@@ -1599,9 +1608,7 @@ void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup)
                        netif_carrier_on(netdev);
                        netif_wake_queue(netdev);
                }
+                adapter->link_changed = !adapter->has_link_events;
-                if (!adapter->has_link_events)
-                        netxen_nic_set_link_parameters(adapter);
        }
 }
@@ -1628,11 +1635,36 @@ static void netxen_nic_handle_phy_intr(struct netxen_adapter *adapter)
        netxen_advert_link_change(adapter, linkup);
 }
+static void netxen_nic_thermal_shutdown(struct netxen_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        netif_device_detach(netdev);
+        netxen_nic_down(adapter, netdev);
+        netxen_nic_detach(adapter);
+}
 static void netxen_watchdog(unsigned long v)
 {
        struct netxen_adapter *adapter = (struct netxen_adapter *)v;
-        SCHEDULE_WORK(&adapter->watchdog_task);
+        if (netxen_nic_check_temp(adapter))
+                goto do_sched;
+        if (!adapter->has_link_events) {
+                netxen_nic_handle_phy_intr(adapter);
+                if (adapter->link_changed)
+                        goto do_sched;
+        }
+        if (netif_running(adapter->netdev))
+                mod_timer(&adapter->watchdog_timer, jiffies + 2 * HZ);
+        return;
+do_sched:
+        schedule_work(&adapter->watchdog_task);
 }
 void netxen_watchdog_task(struct work_struct *work)
@@ -1640,11 +1672,13 @@ void netxen_watchdog_task(struct work_struct *work)
        struct netxen_adapter *adapter =
                container_of(work, struct netxen_adapter, watchdog_task);
-        if (netxen_nic_check_temp(adapter))
+        if (adapter->temp == NX_TEMP_PANIC) {
+                netxen_nic_thermal_shutdown(adapter);
                return;
+        }
-        if (!adapter->has_link_events)
+        if (adapter->link_changed)
-                netxen_nic_handle_phy_intr(adapter);
+                netxen_nic_set_link_parameters(adapter);
        if (netif_running(adapter->netdev))
                mod_timer(&adapter->watchdog_timer, jiffies + 2 * HZ);
@@ -1652,9 +1686,8 @@ void netxen_watchdog_task(struct work_struct *work)
 static void netxen_tx_timeout(struct net_device *netdev)
 {
-        struct netxen_adapter *adapter = (struct netxen_adapter *)
+        struct netxen_adapter *adapter = netdev_priv(netdev);
-                                                netdev_priv(netdev);
+        schedule_work(&adapter->tx_timeout_task);
-        SCHEDULE_WORK(&adapter->tx_timeout_task);
 }
 static void netxen_tx_timeout_task(struct work_struct *work)
@@ -1811,9 +1844,6 @@ static int __init netxen_init_module(void)
 {
        printk(KERN_INFO "%s\n", netxen_nic_driver_string);
-        if ((netxen_workq = create_singlethread_workqueue("netxen")) == NULL)
-                return -ENOMEM;
        return pci_register_driver(&netxen_driver);
 }
@@ -1822,7 +1852,6 @@ module_init(netxen_init_module);
 static void __exit netxen_exit_module(void)
 {
        pci_unregister_driver(&netxen_driver);
-        destroy_workqueue(netxen_workq);
 }
 module_exit(netxen_exit_module);
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index a646a445fda9..23e1a0750fe0 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1839,7 +1839,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        lp->chip_version = chip_version;
        lp->msg_enable = pcnet32_debug;
        if ((cards_found >= MAX_UNITS)
-            || (options[cards_found] > sizeof(options_mapping)))
+            || (options[cards_found] >= sizeof(options_mapping)))
                lp->options = PCNET32_PORT_ASEL;
        else
                lp->options = options_mapping[options[cards_found]];
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 1c70e999cc50..9da1fa12a67c 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -196,21 +196,23 @@ static void PRINT_PKT(u_char *buf, int length)
 /* this enables an interrupt in the interrupt mask register */
 #define SMC_ENABLE_INT(lp, x) do {                                      \
        unsigned char mask;                                             \
-        spin_lock_irq(&lp->lock);                                       \
+        unsigned long smc_enable_flags;                                 \
+        spin_lock_irqsave(&lp->lock, smc_enable_flags);                 \
        mask = SMC_GET_INT_MASK(lp);                                    \
        mask |= (x);                                                    \
        SMC_SET_INT_MASK(lp, mask);                                     \
-        spin_unlock_irq(&lp->lock);                                     \
+        spin_unlock_irqrestore(&lp->lock, smc_enable_flags);            \
 } while (0)
 /* this disables an interrupt from the interrupt mask register */
 #define SMC_DISABLE_INT(lp, x) do {                                     \
        unsigned char mask;                                             \
-        spin_lock_irq(&lp->lock);                                       \
+        unsigned long smc_disable_flags;                                \
+        spin_lock_irqsave(&lp->lock, smc_disable_flags);                \
        mask = SMC_GET_INT_MASK(lp);                                    \
        mask &= ~(x);                                                   \
        SMC_SET_INT_MASK(lp, mask);                                     \
-        spin_unlock_irq(&lp->lock);                                     \
+        spin_unlock_irqrestore(&lp->lock, smc_disable_flags);           \
 } while (0)
 /*
@@ -520,21 +522,21 @@ static inline void  smc_rcv(struct net_device *dev)
 * any other concurrent access and C would always interrupt B. But life
 * isn't that easy in a SMP world...
 */
-#define smc_special_trylock(lock)                                       \
+#define smc_special_trylock(lock, flags)                                \
 ({                                                                      \
        int __ret;                                                      \
-        local_irq_disable();                                            \
+        local_irq_save(flags);                                          \
        __ret = spin_trylock(lock);                                     \
        if (!__ret)                                                     \
-                local_irq_enable();                                     \
+                local_irq_restore(flags);                               \
        __ret;                                                          \
 })
-#define smc_special_lock(lock)          spin_lock_irq(lock)
+#define smc_special_lock(lock, flags)           spin_lock_irq(lock, flags)
-#define smc_special_unlock(lock)        spin_unlock_irq(lock)
+#define smc_special_unlock(lock, flags)         spin_unlock_irqrestore(lock, flags)
 #else
-#define smc_special_trylock(lock)       (1)
+#define smc_special_trylock(lock, flags)        (1)
-#define smc_special_lock(lock)          do { } while (0)
+#define smc_special_lock(lock, flags)           do { } while (0)
-#define smc_special_unlock(lock)        do { } while (0)
+#define smc_special_unlock(lock, flags) do { } while (0)
 #endif
 /*
@@ -548,10 +550,11 @@ static void smc_hardware_send_pkt(unsigned long data)
        struct sk_buff *skb;
        unsigned int packet_no, len;
        unsigned char *buf;
+        unsigned long flags;
        DBG(3, "%s: %s\n", dev->name, __func__);
-        if (!smc_special_trylock(&lp->lock)) {
+        if (!smc_special_trylock(&lp->lock, flags)) {
                netif_stop_queue(dev);
                tasklet_schedule(&lp->tx_task);
                return;
@@ -559,7 +562,7 @@ static void smc_hardware_send_pkt(unsigned long data)
        skb = lp->pending_tx_skb;
        if (unlikely(!skb)) {
-                smc_special_unlock(&lp->lock);
+                smc_special_unlock(&lp->lock, flags);
                return;
        }
        lp->pending_tx_skb = NULL;
@@ -569,7 +572,7 @@ static void smc_hardware_send_pkt(unsigned long data)
                printk("%s: Memory allocation failed.\n", dev->name);
                dev->stats.tx_errors++;
                dev->stats.tx_fifo_errors++;
-                smc_special_unlock(&lp->lock);
+                smc_special_unlock(&lp->lock, flags);
                goto done;
        }
@@ -608,7 +611,7 @@ static void smc_hardware_send_pkt(unsigned long data)
        /* queue the packet for TX */
        SMC_SET_MMU_CMD(lp, MC_ENQUEUE);
-        smc_special_unlock(&lp->lock);
+        smc_special_unlock(&lp->lock, flags);
        dev->trans_start = jiffies;
        dev->stats.tx_packets++;
@@ -633,6 +636,7 @@ static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
        struct smc_local *lp = netdev_priv(dev);
        void __iomem *ioaddr = lp->base;
        unsigned int numPages, poll_count, status;
+        unsigned long flags;
        DBG(3, "%s: %s\n", dev->name, __func__);
@@ -658,7 +662,7 @@ static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                return 0;
        }
-        smc_special_lock(&lp->lock);
+        smc_special_lock(&lp->lock, flags);
        /* now, try to allocate the memory */
        SMC_SET_MMU_CMD(lp, MC_ALLOC | numPages);
@@ -676,7 +680,7 @@ static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        } while (--poll_count);
-        smc_special_unlock(&lp->lock);
+        smc_special_unlock(&lp->lock, flags);
        lp->pending_tx_skb = skb;
        if (!poll_count) {
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index 99a63649f4fc..4cf9a6588751 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -652,8 +652,9 @@ tulip_start_xmit(struct sk_buff *skb, struct net_device *dev)
        int entry;
        u32 flag;
        dma_addr_t mapping;
+        unsigned long flags;
-        spin_lock_irq(&tp->lock);
+        spin_lock_irqsave(&tp->lock, flags);
        /* Calculate the next Tx descriptor entry. */
        entry = tp->cur_tx % TX_RING_SIZE;
@@ -688,7 +689,7 @@ tulip_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Trigger an immediate transmit demand. */
        iowrite32(0, tp->base_addr + CSR1);
-        spin_unlock_irq(&tp->lock);
+        spin_unlock_irqrestore(&tp->lock, flags);
        dev->trans_start = jiffies;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 027f7aba26af..42b6c6319bc2 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1048,20 +1048,15 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
        return err;
 }
-static int tun_get_iff(struct net *net, struct file *file, struct ifreq *ifr)
+static int tun_get_iff(struct net *net, struct tun_struct *tun,
+                       struct ifreq *ifr)
 {
-        struct tun_struct *tun = tun_get(file);
-        if (!tun)
-                return -EBADFD;
        DBG(KERN_INFO "%s: tun_get_iff\n", tun->dev->name);
        strcpy(ifr->ifr_name, tun->dev->name);
        ifr->ifr_flags = tun_flags(tun);
-        tun_put(tun);
        return 0;
 }
@@ -1105,8 +1100,8 @@ static int set_offload(struct net_device *dev, unsigned long arg)
        return 0;
 }
-static int tun_chr_ioctl(struct inode *inode, struct file *file,
+static long tun_chr_ioctl(struct file *file, unsigned int cmd,
-                         unsigned int cmd, unsigned long arg)
+                          unsigned long arg)
 {
        struct tun_file *tfile = file->private_data;
        struct tun_struct *tun;
@@ -1128,34 +1123,32 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                                (unsigned int __user*)argp);
        }
+        rtnl_lock();
        tun = __tun_get(tfile);
        if (cmd == TUNSETIFF && !tun) {
-                int err;
                ifr.ifr_name[IFNAMSIZ-1] = '\0';
-                rtnl_lock();
+                ret = tun_set_iff(tfile->net, file, &ifr);
-                err = tun_set_iff(tfile->net, file, &ifr);
-                rtnl_unlock();
-                if (err)
+                if (ret)
-                        return err;
+                        goto unlock;
                if (copy_to_user(argp, &ifr, sizeof(ifr)))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                return 0;
+                goto unlock;
        }
+        ret = -EBADFD;
        if (!tun)
-                return -EBADFD;
+                goto unlock;
        DBG(KERN_INFO "%s: tun_chr_ioctl cmd %d\n", tun->dev->name, cmd);
        ret = 0;
        switch (cmd) {
        case TUNGETIFF:
-                ret = tun_get_iff(current->nsproxy->net_ns, file, &ifr);
+                ret = tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
                if (ret)
                        break;
@@ -1201,7 +1194,6 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
        case TUNSETLINK:
                /* Only allow setting the type when the interface is down */
-                rtnl_lock();
                if (tun->dev->flags & IFF_UP) {
                        DBG(KERN_INFO "%s: Linktype set failed because interface is up\n",
                                tun->dev->name);
@@ -1211,7 +1203,6 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                        DBG(KERN_INFO "%s: linktype set to %d\n", tun->dev->name, tun->dev->type);
                        ret = 0;
                }
-                rtnl_unlock();
                break;
 #ifdef TUN_DEBUG
@@ -1220,9 +1211,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                break;
 #endif
        case TUNSETOFFLOAD:
-                rtnl_lock();
                ret = set_offload(tun->dev, arg);
-                rtnl_unlock();
                break;
        case TUNSETTXFILTER:
@@ -1230,9 +1219,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                ret = -EINVAL;
                if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
                        break;
-                rtnl_lock();
                ret = update_filter(&tun->txflt, (void __user *)arg);
-                rtnl_unlock();
                break;
        case SIOCGIFHWADDR:
@@ -1248,9 +1235,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                DBG(KERN_DEBUG "%s: set hw address: %pM\n",
                        tun->dev->name, ifr.ifr_hwaddr.sa_data);
-                rtnl_lock();
                ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
-                rtnl_unlock();
                break;
        case TUNGETSNDBUF:
@@ -1273,7 +1258,10 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                break;
        };
-        tun_put(tun);
+unlock:
+        rtnl_unlock();
+        if (tun)
+                tun_put(tun);
        return ret;
 }
@@ -1361,7 +1349,7 @@ static const struct file_operations tun_fops = {
        .write = do_sync_write,
        .aio_write = tun_chr_aio_write,
        .poll   = tun_chr_poll,
-        .ioctl  = tun_chr_ioctl,
+        .unlocked_ioctl = tun_chr_ioctl,
        .open   = tun_chr_open,
        .release = tun_chr_close,
        .fasync = tun_chr_fasync
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 3b957e6412ee..8a7b8c7bd781 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3111,10 +3111,11 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        u8 __iomem *bd;                 /* BD pointer */
        u32 bd_status;
        u8 txQ = 0;
+        unsigned long flags;
        ugeth_vdbg("%s: IN", __func__);
-        spin_lock_irq(&ugeth->lock);
+        spin_lock_irqsave(&ugeth->lock, flags);
        dev->stats.tx_bytes += skb->len;
@@ -3171,7 +3172,7 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        uccf = ugeth->uccf;
        out_be16(uccf->p_utodr, UCC_FAST_TOD);
 #endif
-        spin_unlock_irq(&ugeth->lock);
+        spin_unlock_irqrestore(&ugeth->lock, flags);
        return 0;
 }
diff --git a/drivers/net/usb/pegasus.h b/drivers/net/usb/pegasus.h
index c7467823cd1c..f968c834ff63 100644
--- a/drivers/net/usb/pegasus.h
+++ b/drivers/net/usb/pegasus.h
@@ -250,6 +250,8 @@ PEGASUS_DEV( "IO DATA USB ET/TX", VENDOR_IODATA, 0x0904,
                DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "IO DATA USB ET/TX-S", VENDOR_IODATA, 0x0913,
                DEFAULT_GPIO_RESET | PEGASUS_II )
+PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x092a,
+                DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "Kingston KNU101TX Ethernet", VENDOR_KINGSTON, 0x000a,
                DEFAULT_GPIO_RESET)
 PEGASUS_DEV( "LANEED USB Ethernet LD-USB/TX", VENDOR_LANEED, 0x4002,
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 88c30a58b4bd..934f7671650a 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -1218,6 +1218,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
        struct rhine_private *rp = netdev_priv(dev);
        void __iomem *ioaddr = rp->base;
        unsigned entry;
+        unsigned long flags;
        /* Caution: the write order is important here, set the field
           with the "ownership" bits last. */
@@ -1261,7 +1262,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
                cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
        /* lock eth irq */
-        spin_lock_irq(&rp->lock);
+        spin_lock_irqsave(&rp->lock, flags);
        wmb();
        rp->tx_ring[entry].tx_status = cpu_to_le32(DescOwn);
        wmb();
@@ -1280,7 +1281,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
        dev->trans_start = jiffies;
-        spin_unlock_irq(&rp->lock);
+        spin_unlock_irqrestore(&rp->lock, flags);
        if (debug > 4) {
                printk(KERN_DEBUG "%s: Transmit frame #%d queued in slot %d.\n",
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 3ba35956327a..cee08a1e497a 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1778,7 +1778,7 @@ static void velocity_error(struct velocity_info *vptr, int status)
                         *       mode
                         */
                        if (vptr->rev_id < REV_ID_VT3216_A0) {
-                                if (vptr->mii_status | VELOCITY_DUPLEX_FULL)
+                                if (vptr->mii_status & VELOCITY_DUPLEX_FULL)
                                        BYTE_REG_BITS_ON(TCR_TB2BDIS, &regs->TCR);
                                else
                                        BYTE_REG_BITS_OFF(TCR_TB2BDIS, &regs->TCR);
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 9d38cf60a0db..88c3d8573869 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -1967,13 +1967,14 @@ static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
        int ret;
        mutex_lock(&ar->mutex);
-        if ((param) && !(queue > __AR9170_NUM_TXQ)) {
+        if (queue < __AR9170_NUM_TXQ) {
                memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
                       param, sizeof(*param));
                ret = ar9170_set_qos(ar);
-        } else
+        } else {
                ret = -EINVAL;
+        }
        mutex_unlock(&ar->mutex);
        return ret;
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 754b1f8d8da9..007eb85fc67e 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -598,11 +598,15 @@ static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
        err = request_firmware(&aru->init_values, "ar9170-1.fw",
                               &aru->udev->dev);
+        if (err) {
+                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                return err;
+        }
        err = request_firmware(&aru->firmware, "ar9170-2.fw", &aru->udev->dev);
        if (err) {
                release_firmware(aru->init_values);
-                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                dev_err(&aru->udev->dev, "firmware file not found.\n");
                return err;
        }
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 44c29b3f6728..6dcac73b4d29 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
                        };
                        u8 channel;
-                        while (channel_index < IPW_SCAN_CHANNELS) {
+                        while (channel_index < IPW_SCAN_CHANNELS - 1) {
                                channel =
                                    priv->speed_scan[priv->speed_scan_pos];
                                if (channel == 0) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index d6997371c27e..b9b374119033 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,7 +1,6 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 #include <linux/types.h>
-#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -44,21 +43,21 @@ static int get_common_rates(struct lbs_private *priv,
        u16 *rates_size)
 {
        u8 *card_rates = lbs_bg_rates;
+        size_t num_card_rates = sizeof(lbs_bg_rates);
        int ret = 0, i, j;
-        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
+        u8 tmp[30];
        size_t tmp_size = 0;
        /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
+        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
-                for (j = 0; j < *rates_size && rates[j]; j++) {
+                for (j = 0; rates[j] && (j < *rates_size); j++) {
                        if (rates[j] == card_rates[i])
                                tmp[tmp_size++] = card_rates[i];
                }
        }
        lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
-                        ARRAY_SIZE(lbs_bg_rates));
        lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
        lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
@@ -70,7 +69,10 @@ static int get_common_rates(struct lbs_private *priv,
                lbs_pr_alert("Previously set fixed data rate %#x isn't "
                       "compatible with the network.\n", priv->cur_rate);
                ret = -1;
+                goto done;
        }
+        ret = 0;
 done:
        memset(rates, 0, *rates_size);
        *rates_size = min_t(int, tmp_size, *rates_size);
@@ -320,7 +322,7 @@ static int lbs_associate(struct lbs_private *priv,
        rates = (struct mrvl_ie_rates_param_set *) pos;
        rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
        memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
+        tmplen = MAX_RATES;
        if (get_common_rates(priv, rates->rates, &tmplen)) {
                ret = -1;
                goto done;
@@ -596,7 +598,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
        /* Copy Data rates from the rates recorded in scan response */
        memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
        memcpy(cmd.bss.rates, bss->rates, ratesize);
        if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index 0a2e29140add..c8a1998d4744 100644
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -56,8 +56,8 @@ struct rxpd {
                        u8 bss_type;
                        /* BSS number */
                        u8 bss_num;
-                } bss;
+                } __attribute__ ((packed)) bss;
-        } u;
+        } __attribute__ ((packed)) u;
        /* SNR */
        u8 snr;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index a263d5c84c08..83967afe0821 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -261,7 +261,7 @@ struct mwl8k_vif {
         */
 };
-#define MWL8K_VIF(_vif) (struct mwl8k_vif *)(&((_vif)->drv_priv))
+#define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
 static const struct ieee80211_channel mwl8k_channels[] = {
        { .center_freq = 2412, .hw_value = 1, },
@@ -1012,6 +1012,8 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
                rmb();
                skb = rxq->rx_skb[rxq->rx_head];
+                if (skb == NULL)
+                        break;
                rxq->rx_skb[rxq->rx_head] = NULL;
                rxq->rx_head = (rxq->rx_head + 1) % MWL8K_RX_DESCS;
@@ -1591,6 +1593,9 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
        timeout = wait_for_completion_timeout(&cmd_wait,
                                msecs_to_jiffies(MWL8K_CMD_TIMEOUT_MS));
+        pci_unmap_single(priv->pdev, dma_addr, dma_size,
+                                        PCI_DMA_BIDIRECTIONAL);
        result = &cmd->result;
        if (!timeout) {
                spin_lock_irq(&priv->fw_lock);
@@ -1610,8 +1615,6 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
                               *result);
        }
-        pci_unmap_single(priv->pdev, dma_addr, dma_size,
-                                        PCI_DMA_BIDIRECTIONAL);
        return rc;
 }
@@ -1654,18 +1657,18 @@ static int mwl8k_cmd_get_hw_spec(struct ieee80211_hw *hw)
        memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
        cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
        cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rx_desc_dma);
-        cmd->num_tx_queues = MWL8K_TX_QUEUES;
+        cmd->num_tx_queues = cpu_to_le32(MWL8K_TX_QUEUES);
        for (i = 0; i < MWL8K_TX_QUEUES; i++)
                cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].tx_desc_dma);
-        cmd->num_tx_desc_per_queue = MWL8K_TX_DESCS;
+        cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
-        cmd->total_rx_desc = MWL8K_RX_DESCS;
+        cmd->total_rx_desc = cpu_to_le32(MWL8K_RX_DESCS);
        rc = mwl8k_post_cmd(hw, &cmd->header);
        if (!rc) {
                SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
                priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
-                priv->fw_rev = cmd->fw_rev;
+                priv->fw_rev = le32_to_cpu(cmd->fw_rev);
                priv->hw_rev = cmd->hw_rev;
                priv->region_code = le16_to_cpu(cmd->region_code);
        }
@@ -3216,15 +3219,19 @@ static int mwl8k_configure_filter_wt(struct work_struct *wt)
        struct dev_addr_list *mclist = worker->mclist;
        struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_vif *mv_vif;
        int rc = 0;
        if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
                if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
                        rc = mwl8k_cmd_set_pre_scan(hw);
                else {
-                        mv_vif = MWL8K_VIF(priv->vif);
+                        u8 *bssid;
-                        rc = mwl8k_cmd_set_post_scan(hw, mv_vif->bssid);
+                        bssid = "\x00\x00\x00\x00\x00\x00";
+                        if (priv->vif != NULL)
+                                bssid = MWL8K_VIF(priv->vif)->bssid;
+                        rc = mwl8k_cmd_set_post_scan(hw, bssid);
                }
        }
@@ -3726,6 +3733,8 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
        ieee80211_stop_queues(hw);
+        ieee80211_unregister_hw(hw);
        /* Remove tx reclaim tasklet */
        tasklet_kill(&priv->tx_reclaim_task);
@@ -3739,8 +3748,6 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
        for (i = 0; i < MWL8K_TX_QUEUES; i++)
                mwl8k_txq_reclaim(hw, i, 1);
-        ieee80211_unregister_hw(hw);
        for (i = 0; i < MWL8K_TX_QUEUES; i++)
                mwl8k_txq_deinit(hw, i);
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 632fac86a308..b3946272c72e 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc)
        int err = 0;
        u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
-        if ((key < 0) || (key > 4))
+        if ((key < 0) || (key >= 4))
                return -EINVAL;
        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index a498dde024e1..49c9e2c1433d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -849,13 +849,15 @@ struct rt2x00_dev {
 static inline void rt2x00_rf_read(struct rt2x00_dev *rt2x00dev,
                                  const unsigned int word, u32 *data)
 {
-        *data = rt2x00dev->rf[word];
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        *data = rt2x00dev->rf[word - 1];
 }
 static inline void rt2x00_rf_write(struct rt2x00_dev *rt2x00dev,
                                   const unsigned int word, u32 data)
 {
-        rt2x00dev->rf[word] = data;
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        rt2x00dev->rf[word - 1] = data;
 }
 /*
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 294250e294dd..87a95588a8e3 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -869,6 +869,9 @@ static int rtl8187b_init_hw(struct ieee80211_hw *dev)
        priv->aifsn[3] = 3; /* AIFSN[AC_BE] */
        rtl818x_iowrite8(priv, &priv->map->ACM_CONTROL, 0);
+        /* ENEDCA flag must always be set, transmit issues? */
+        rtl818x_iowrite8(priv, &priv->map->MSR, RTL818X_MSR_ENEDCA);
        return 0;
 }
@@ -1173,13 +1176,16 @@ static void rtl8187_bss_info_changed(struct ieee80211_hw *dev,
                        rtl818x_iowrite8(priv, &priv->map->BSSID[i],
                                         info->bssid[i]);
+                if (priv->is_rtl8187b)
+                        reg = RTL818X_MSR_ENEDCA;
+                else
+                        reg = 0;
                if (is_valid_ether_addr(info->bssid)) {
-                        reg = RTL818X_MSR_INFRA;
+                        reg |= RTL818X_MSR_INFRA;
-                        if (priv->is_rtl8187b)
-                                reg |= RTL818X_MSR_ENEDCA;
                        rtl818x_iowrite8(priv, &priv->map->MSR, reg);
                } else {
-                        reg = RTL818X_MSR_NO_LINK;
+                        reg |= RTL818X_MSR_NO_LINK;
                        rtl818x_iowrite8(priv, &priv->map->MSR, reg);
                }
diff --git a/drivers/net/yellowfin.c b/drivers/net/yellowfin.c
index a07580138e81..c2fd6187773f 100644
--- a/drivers/net/yellowfin.c
+++ b/drivers/net/yellowfin.c
@@ -346,7 +346,7 @@ static int netdev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 static int yellowfin_open(struct net_device *dev);
 static void yellowfin_timer(unsigned long data);
 static void yellowfin_tx_timeout(struct net_device *dev);
-static void yellowfin_init_ring(struct net_device *dev);
+static int yellowfin_init_ring(struct net_device *dev);
 static int yellowfin_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t yellowfin_interrupt(int irq, void *dev_instance);
 static int yellowfin_rx(struct net_device *dev);
@@ -573,19 +573,24 @@ static int yellowfin_open(struct net_device *dev)
 {
        struct yellowfin_private *yp = netdev_priv(dev);
        void __iomem *ioaddr = yp->base;
-        int i;
+        int i, ret;
        /* Reset the chip. */
        iowrite32(0x80000000, ioaddr + DMACtrl);
-        i = request_irq(dev->irq, &yellowfin_interrupt, IRQF_SHARED, dev->name, dev);
+        ret = request_irq(dev->irq, &yellowfin_interrupt, IRQF_SHARED, dev->name, dev);
-        if (i) return i;
+        if (ret)
+                return ret;
        if (yellowfin_debug > 1)
                printk(KERN_DEBUG "%s: yellowfin_open() irq %d.\n",
                           dev->name, dev->irq);
-        yellowfin_init_ring(dev);
+        ret = yellowfin_init_ring(dev);
+        if (ret) {
+                free_irq(dev->irq, dev);
+                return ret;
+        }
        iowrite32(yp->rx_ring_dma, ioaddr + RxPtr);
        iowrite32(yp->tx_ring_dma, ioaddr + TxPtr);
@@ -725,10 +730,10 @@ static void yellowfin_tx_timeout(struct net_device *dev)
 }
 /* Initialize the Rx and Tx rings, along with various 'dev' bits. */
-static void yellowfin_init_ring(struct net_device *dev)
+static int yellowfin_init_ring(struct net_device *dev)
 {
        struct yellowfin_private *yp = netdev_priv(dev);
-        int i;
+        int i, j;
        yp->tx_full = 0;
        yp->cur_rx = yp->cur_tx = 0;
@@ -753,6 +758,11 @@ static void yellowfin_init_ring(struct net_device *dev)
                yp->rx_ring[i].addr = cpu_to_le32(pci_map_single(yp->pci_dev,
                        skb->data, yp->rx_buf_sz, PCI_DMA_FROMDEVICE));
        }
+        if (i != RX_RING_SIZE) {
+                for (j = 0; j < i; j++)
+                        dev_kfree_skb(yp->rx_skbuff[j]);
+                return -ENOMEM;
+        }
        yp->rx_ring[i-1].dbdma_cmd = cpu_to_le32(CMD_STOP);
        yp->dirty_rx = (unsigned int)(i - RX_RING_SIZE);
@@ -769,8 +779,6 @@ static void yellowfin_init_ring(struct net_device *dev)
        yp->tx_ring[--i].dbdma_cmd = cpu_to_le32(CMD_STOP | BRANCH_ALWAYS);
 #else
 {
-        int j;
        /* Tx ring needs a pair of descriptors, the second for the status. */
        for (i = 0; i < TX_RING_SIZE; i++) {
                j = 2*i;
@@ -805,7 +813,7 @@ static void yellowfin_init_ring(struct net_device *dev)
 }
 #endif
        yp->tx_tail_desc = &yp->tx_status[0];
-        return;
+        return 0;
 }
 static int yellowfin_start_xmit(struct sk_buff *skb, struct net_device *dev)
diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
index 37c84e3b8be0..81c753a617ab 100644
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -120,6 +120,9 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
    for (i = ARRAY_SIZE(cards)-1; i >= 0; i--)
        if (z->id == cards[i].id)
            break;
+    if (i < 0)
+        return -ENODEV;
    board = z->resource.start;
    ioaddr = board+cards[i].offset;
    dev = alloc_ei_netdev();
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index d76c4c85367e..f99bc7f089f1 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -508,7 +508,7 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev)
                        return error;
        }
-        return pci_dev->state_saved ? pci_restore_state(pci_dev) : 0;
+        return pci_restore_state(pci_dev);
 }
 static void pci_pm_default_resume_noirq(struct pci_dev *pci_dev)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index dbd0f947f497..7b70312181d7 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -846,6 +846,8 @@ pci_restore_state(struct pci_dev *dev)
        int i;
        u32 val;
+        if (!dev->state_saved)
+                return 0;
        /* PCI Express register must be restored first */
        pci_restore_pcie_state(dev);
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 749836668655..3f62dd50bbbe 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2135,9 +2135,9 @@ static int dasd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
        struct dasd_device *base;
        block = bdev->bd_disk->private_data;
-        base = block->base;
        if (!block)
                return -ENODEV;
+        base = block->base;
        if (!base->discipline ||
            !base->discipline->fill_geometry)
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 3c57c1a18bb8..d593bc76afe3 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -772,10 +772,8 @@ static struct ccw_device * io_subchannel_create_ccwdev(struct subchannel *sch)
        cdev = io_subchannel_allocate_dev(sch);
        if (!IS_ERR(cdev)) {
                ret = io_subchannel_initialize_dev(sch, cdev);
-                if (ret) {
+                if (ret)
-                        kfree(cdev);
                        cdev = ERR_PTR(ret);
-                }
        }
        return cdev;
 }
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index f3da592f7bcc..35a13867495e 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -119,6 +119,64 @@ _base_fault_reset_work(struct work_struct *work)
        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 }
+/**
+ * mpt2sas_base_start_watchdog - start the fault_reset_work_q
+ * @ioc: pointer to scsi command object
+ * Context: sleep.
+ *
+ * Return nothing.
+ */
+void
+mpt2sas_base_start_watchdog(struct MPT2SAS_ADAPTER *ioc)
+{
+        unsigned long    flags;
+        if (ioc->fault_reset_work_q)
+                return;
+        /* initialize fault polling */
+        INIT_DELAYED_WORK(&ioc->fault_reset_work, _base_fault_reset_work);
+        snprintf(ioc->fault_reset_work_q_name,
+            sizeof(ioc->fault_reset_work_q_name), "poll_%d_status", ioc->id);
+        ioc->fault_reset_work_q =
+                create_singlethread_workqueue(ioc->fault_reset_work_q_name);
+        if (!ioc->fault_reset_work_q) {
+                printk(MPT2SAS_ERR_FMT "%s: failed (line=%d)\n",
+                    ioc->name, __func__, __LINE__);
+                        return;
+        }
+        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+        if (ioc->fault_reset_work_q)
+                queue_delayed_work(ioc->fault_reset_work_q,
+                    &ioc->fault_reset_work,
+                    msecs_to_jiffies(FAULT_POLLING_INTERVAL));
+        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+}
+/**
+ * mpt2sas_base_stop_watchdog - stop the fault_reset_work_q
+ * @ioc: pointer to scsi command object
+ * Context: sleep.
+ *
+ * Return nothing.
+ */
+void
+mpt2sas_base_stop_watchdog(struct MPT2SAS_ADAPTER *ioc)
+{
+        unsigned long    flags;
+        struct workqueue_struct *wq;
+        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+        wq = ioc->fault_reset_work_q;
+        ioc->fault_reset_work_q = NULL;
+        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+        if (wq) {
+                if (!cancel_delayed_work(&ioc->fault_reset_work))
+                        flush_workqueue(wq);
+                destroy_workqueue(wq);
+        }
+}
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
 /**
 * _base_sas_ioc_info - verbose translation of the ioc status
@@ -440,6 +498,10 @@ _base_sas_log_info(struct MPT2SAS_ADAPTER *ioc , u32 log_info)
        if (sas_loginfo.dw.bus_type != 3 /*SAS*/)
                return;
+        /* each nexus loss loginfo */
+        if (log_info == 0x31170000)
+                return;
        /* eat the loginfos associated with task aborts */
        if (ioc->ignore_loginfos && (log_info == 30050000 || log_info ==
            0x31140000 || log_info == 0x31130000))
@@ -1109,7 +1171,6 @@ mpt2sas_base_map_resources(struct MPT2SAS_ADAPTER *ioc)
                }
        }
-        pci_set_drvdata(pdev, ioc->shost);
        _base_mask_interrupts(ioc);
        r = _base_enable_msix(ioc);
        if (r)
@@ -1132,7 +1193,6 @@ mpt2sas_base_map_resources(struct MPT2SAS_ADAPTER *ioc)
        ioc->pci_irq = -1;
        pci_release_selected_regions(ioc->pdev, ioc->bars);
        pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
        return r;
 }
@@ -3191,7 +3251,6 @@ mpt2sas_base_free_resources(struct MPT2SAS_ADAPTER *ioc)
        ioc->chip_phys = 0;
        pci_release_selected_regions(ioc->pdev, ioc->bars);
        pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
        return;
 }
@@ -3205,7 +3264,6 @@ int
 mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
 {
        int r, i;
-        unsigned long    flags;
        dinitprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
            __func__));
@@ -3214,6 +3272,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
        if (r)
                return r;
+        pci_set_drvdata(ioc->pdev, ioc->shost);
        r = _base_make_ioc_ready(ioc, CAN_SLEEP, SOFT_RESET);
        if (r)
                goto out_free_resources;
@@ -3288,23 +3347,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
        if (r)
                goto out_free_resources;
-        /* initialize fault polling */
+        mpt2sas_base_start_watchdog(ioc);
-        INIT_DELAYED_WORK(&ioc->fault_reset_work, _base_fault_reset_work);
-        snprintf(ioc->fault_reset_work_q_name,
-            sizeof(ioc->fault_reset_work_q_name), "poll_%d_status", ioc->id);
-        ioc->fault_reset_work_q =
-                create_singlethread_workqueue(ioc->fault_reset_work_q_name);
-        if (!ioc->fault_reset_work_q) {
-                printk(MPT2SAS_ERR_FMT "%s: failed (line=%d)\n",
-                    ioc->name, __func__, __LINE__);
-                        goto out_free_resources;
-        }
-        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-        if (ioc->fault_reset_work_q)
-                queue_delayed_work(ioc->fault_reset_work_q,
-                    &ioc->fault_reset_work,
-                    msecs_to_jiffies(FAULT_POLLING_INTERVAL));
-        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
        return 0;
 out_free_resources:
@@ -3312,6 +3355,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
        ioc->remove_host = 1;
        mpt2sas_base_free_resources(ioc);
        _base_release_memory_pools(ioc);
+        pci_set_drvdata(ioc->pdev, NULL);
        kfree(ioc->tm_cmds.reply);
        kfree(ioc->transport_cmds.reply);
        kfree(ioc->config_cmds.reply);
@@ -3337,22 +3381,14 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
 void
 mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc)
 {
-        unsigned long    flags;
-        struct workqueue_struct *wq;
        dexitprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
            __func__));
-        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+        mpt2sas_base_stop_watchdog(ioc);
-        wq = ioc->fault_reset_work_q;
-        ioc->fault_reset_work_q = NULL;
-        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
-        if (!cancel_delayed_work(&ioc->fault_reset_work))
-                flush_workqueue(wq);
-        destroy_workqueue(wq);
        mpt2sas_base_free_resources(ioc);
        _base_release_memory_pools(ioc);
+        pci_set_drvdata(ioc->pdev, NULL);
        kfree(ioc->pfacts);
        kfree(ioc->ctl_cmds.reply);
        kfree(ioc->base_cmds.reply);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.h b/drivers/scsi/mpt2sas/mpt2sas_base.h
index 286c185fa9e4..acdcff150a35 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
@@ -69,10 +69,10 @@
 #define MPT2SAS_DRIVER_NAME             "mpt2sas"
 #define MPT2SAS_AUTHOR  "LSI Corporation <DL-MPTFusionLinux@lsi.com>"
 #define MPT2SAS_DESCRIPTION     "LSI MPT Fusion SAS 2.0 Device Driver"
-#define MPT2SAS_DRIVER_VERSION          "01.100.03.00"
+#define MPT2SAS_DRIVER_VERSION          "01.100.04.00"
 #define MPT2SAS_MAJOR_VERSION           01
 #define MPT2SAS_MINOR_VERSION           100
-#define MPT2SAS_BUILD_VERSION           03
+#define MPT2SAS_BUILD_VERSION           04
 #define MPT2SAS_RELEASE_VERSION         00
 /*
@@ -673,6 +673,8 @@ typedef void (*MPT_CALLBACK)(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 VF_ID,
 /* base shared API */
 extern struct list_head mpt2sas_ioc_list;
+void mpt2sas_base_start_watchdog(struct MPT2SAS_ADAPTER *ioc);
+void mpt2sas_base_stop_watchdog(struct MPT2SAS_ADAPTER *ioc);
 int mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc);
 void mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_config.c b/drivers/scsi/mpt2sas/mpt2sas_config.c
index 58cfb97846f7..6ddee161beb3 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_config.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_config.c
@@ -236,17 +236,25 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
        Mpi2ConfigRequest_t *config_request;
        int r;
        u8 retry_count;
-        u8 issue_reset;
+        u8 issue_host_reset = 0;
        u16 wait_state_count;
+        mutex_lock(&ioc->config_cmds.mutex);
        if (ioc->config_cmds.status != MPT2_CMD_NOT_USED) {
                printk(MPT2SAS_ERR_FMT "%s: config_cmd in use\n",
                    ioc->name, __func__);
+                mutex_unlock(&ioc->config_cmds.mutex);
                return -EAGAIN;
        }
        retry_count = 0;
 retry_config:
+        if (retry_count) {
+                if (retry_count > 2) /* attempt only 2 retries */
+                        return -EFAULT;
+                printk(MPT2SAS_INFO_FMT "%s: attempting retry (%d)\n",
+                    ioc->name, __func__, retry_count);
+        }
        wait_state_count = 0;
        ioc_state = mpt2sas_base_get_iocstate(ioc, 1);
        while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) {
@@ -254,8 +262,8 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
                        printk(MPT2SAS_ERR_FMT
                            "%s: failed due to ioc not operational\n",
                            ioc->name, __func__);
-                        ioc->config_cmds.status = MPT2_CMD_NOT_USED;
+                        r = -EFAULT;
-                        return -EFAULT;
+                        goto out;
                }
                ssleep(1);
                ioc_state = mpt2sas_base_get_iocstate(ioc, 1);
@@ -271,8 +279,8 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
        if (!smid) {
                printk(MPT2SAS_ERR_FMT "%s: failed obtaining a smid\n",
                    ioc->name, __func__);
-                ioc->config_cmds.status = MPT2_CMD_NOT_USED;
+                r = -EAGAIN;
-                return -EAGAIN;
+                goto out;
        }
        r = 0;
@@ -292,9 +300,15 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
                    ioc->name, __func__);
                _debug_dump_mf(mpi_request,
                    sizeof(Mpi2ConfigRequest_t)/4);
-                if (!(ioc->config_cmds.status & MPT2_CMD_RESET))
+                retry_count++;
-                        issue_reset = 1;
+                if (ioc->config_cmds.smid == smid)
-                goto issue_host_reset;
+                        mpt2sas_base_free_smid(ioc, smid);
+                if ((ioc->shost_recovery) ||
+                    (ioc->config_cmds.status & MPT2_CMD_RESET))
+                        goto retry_config;
+                issue_host_reset = 1;
+                r = -EFAULT;
+                goto out;
        }
        if (ioc->config_cmds.status & MPT2_CMD_REPLY_VALID)
                memcpy(mpi_reply, ioc->config_cmds.reply,
@@ -302,21 +316,13 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
        if (retry_count)
                printk(MPT2SAS_INFO_FMT "%s: retry completed!!\n",
                    ioc->name, __func__);
+out:
        ioc->config_cmds.status = MPT2_CMD_NOT_USED;
-        return r;
+        mutex_unlock(&ioc->config_cmds.mutex);
+        if (issue_host_reset)
- issue_host_reset:
-        if (issue_reset)
                mpt2sas_base_hard_reset_handler(ioc, CAN_SLEEP,
                    FORCE_BIG_HAMMER);
-        ioc->config_cmds.status = MPT2_CMD_NOT_USED;
+        return r;
-        if (!retry_count) {
-                printk(MPT2SAS_INFO_FMT "%s: attempting retry\n",
-                    ioc->name, __func__);
-                retry_count++;
-                goto retry_config;
-        }
-        return -EFAULT;
 }
 /**
@@ -375,7 +381,6 @@ mpt2sas_config_get_manufacturing_pg0(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2ManufacturingPage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -417,7 +422,6 @@ mpt2sas_config_get_manufacturing_pg0(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -438,7 +442,6 @@ mpt2sas_config_get_bios_pg2(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2BiosPage2_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -480,7 +483,6 @@ mpt2sas_config_get_bios_pg2(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -501,7 +503,6 @@ mpt2sas_config_get_bios_pg3(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2BiosPage3_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -543,7 +544,6 @@ mpt2sas_config_get_bios_pg3(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -564,7 +564,6 @@ mpt2sas_config_get_iounit_pg0(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2IOUnitPage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -606,7 +605,6 @@ mpt2sas_config_get_iounit_pg0(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -627,7 +625,6 @@ mpt2sas_config_get_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2IOUnitPage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -669,7 +666,6 @@ mpt2sas_config_get_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -690,7 +686,6 @@ mpt2sas_config_set_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
        mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_HEADER;
@@ -732,7 +727,6 @@ mpt2sas_config_set_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -753,7 +747,6 @@ mpt2sas_config_get_ioc_pg8(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2IOCPage8_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -795,7 +788,6 @@ mpt2sas_config_get_ioc_pg8(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -818,7 +810,6 @@ mpt2sas_config_get_sas_device_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasDevicePage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -863,7 +854,6 @@ mpt2sas_config_get_sas_device_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -886,7 +876,6 @@ mpt2sas_config_get_sas_device_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasDevicePage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -931,7 +920,6 @@ mpt2sas_config_get_sas_device_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -953,7 +941,6 @@ mpt2sas_config_get_number_hba_phys(struct MPT2SAS_ADAPTER *ioc, u8 *num_phys)
        Mpi2ConfigReply_t mpi_reply;
        Mpi2SasIOUnitPage0_t config_page;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
        mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_HEADER;
@@ -1002,7 +989,6 @@ mpt2sas_config_get_number_hba_phys(struct MPT2SAS_ADAPTER *ioc, u8 *num_phys)
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1026,8 +1012,6 @@ mpt2sas_config_get_sas_iounit_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        Mpi2ConfigRequest_t mpi_request;
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sz);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1070,7 +1054,6 @@ mpt2sas_config_get_sas_iounit_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1095,7 +1078,6 @@ mpt2sas_config_get_sas_iounit_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sz);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1138,7 +1120,6 @@ mpt2sas_config_get_sas_iounit_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1161,7 +1142,6 @@ mpt2sas_config_get_expander_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2ExpanderPage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1206,7 +1186,6 @@ mpt2sas_config_get_expander_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1230,7 +1209,6 @@ mpt2sas_config_get_expander_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2ExpanderPage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1277,7 +1255,6 @@ mpt2sas_config_get_expander_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1300,7 +1277,6 @@ mpt2sas_config_get_enclosure_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasEnclosurePage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1345,7 +1321,6 @@ mpt2sas_config_get_enclosure_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1367,7 +1342,6 @@ mpt2sas_config_get_phy_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasPhyPage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1413,7 +1387,6 @@ mpt2sas_config_get_phy_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1435,7 +1408,6 @@ mpt2sas_config_get_phy_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasPhyPage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1481,7 +1453,6 @@ mpt2sas_config_get_phy_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1505,7 +1476,6 @@ mpt2sas_config_get_raid_volume_pg1(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2RaidVolPage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1548,7 +1518,6 @@ mpt2sas_config_get_raid_volume_pg1(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1572,7 +1541,6 @@ mpt2sas_config_get_number_pds(struct MPT2SAS_ADAPTER *ioc, u16 handle,
        struct config_request mem;
        u16 ioc_status;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        *num_pds = 0;
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1620,7 +1588,6 @@ mpt2sas_config_get_number_pds(struct MPT2SAS_ADAPTER *ioc, u16 handle,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1645,7 +1612,6 @@ mpt2sas_config_get_raid_volume_pg0(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        memset(config_page, 0, sz);
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1687,7 +1653,6 @@ mpt2sas_config_get_raid_volume_pg0(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1711,7 +1676,6 @@ mpt2sas_config_get_phys_disk_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        memset(config_page, 0, sizeof(Mpi2RaidPhysDiskPage0_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1754,7 +1718,6 @@ mpt2sas_config_get_phys_disk_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1778,7 +1741,6 @@ mpt2sas_config_get_volume_handle(struct MPT2SAS_ADAPTER *ioc, u16 pd_handle,
        struct config_request mem;
        u16 ioc_status;
-        mutex_lock(&ioc->config_cmds.mutex);
        *volume_handle = 0;
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1842,7 +1804,6 @@ mpt2sas_config_get_volume_handle(struct MPT2SAS_ADAPTER *ioc, u16 pd_handle,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 2a01a5f2a84d..2e9a4445596f 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -2767,6 +2767,10 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
        char *desc_ioc_state = NULL;
        char *desc_scsi_status = NULL;
        char *desc_scsi_state = ioc->tmp_string;
+        u32 log_info = le32_to_cpu(mpi_reply->IOCLogInfo);
+        if (log_info == 0x31170000)
+                return;
        switch (ioc_status) {
        case MPI2_IOCSTATUS_SUCCESS:
@@ -3426,7 +3430,7 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
        __le64 sas_address;
        int i;
        unsigned long flags;
-        struct _sas_port *mpt2sas_port;
+        struct _sas_port *mpt2sas_port = NULL;
        int rc = 0;
        if (!handle)
@@ -3518,12 +3522,20 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
                    &expander_pg1, i, handle))) {
                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
                            ioc->name, __FILE__, __LINE__, __func__);
-                        continue;
+                        rc = -1;
+                        goto out_fail;
                }
                sas_expander->phy[i].handle = handle;
                sas_expander->phy[i].phy_id = i;
-                mpt2sas_transport_add_expander_phy(ioc, &sas_expander->phy[i],
-                    expander_pg1, sas_expander->parent_dev);
+                if ((mpt2sas_transport_add_expander_phy(ioc,
+                    &sas_expander->phy[i], expander_pg1,
+                    sas_expander->parent_dev))) {
+                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                            ioc->name, __FILE__, __LINE__, __func__);
+                        rc = -1;
+                        goto out_fail;
+                }
        }
        if (sas_expander->enclosure_handle) {
@@ -3540,8 +3552,9 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 out_fail:
-        if (sas_expander)
+        if (mpt2sas_port)
-                kfree(sas_expander->phy);
+                mpt2sas_transport_port_remove(ioc, sas_expander->sas_address,
+                    sas_expander->parent_handle);
        kfree(sas_expander);
        return rc;
 }
@@ -3663,12 +3676,11 @@ _scsih_add_device(struct MPT2SAS_ADAPTER *ioc, u16 handle, u8 phy_num, u8 is_pd)
        sas_device->hidden_raid_component = is_pd;
        /* get enclosure_logical_id */
-        if (!(mpt2sas_config_get_enclosure_pg0(ioc, &mpi_reply, &enclosure_pg0,
+        if (sas_device->enclosure_handle && !(mpt2sas_config_get_enclosure_pg0(
-           MPI2_SAS_ENCLOS_PGAD_FORM_HANDLE,
+           ioc, &mpi_reply, &enclosure_pg0, MPI2_SAS_ENCLOS_PGAD_FORM_HANDLE,
-           sas_device->enclosure_handle))) {
+           sas_device->enclosure_handle)))
                sas_device->enclosure_logical_id =
                    le64_to_cpu(enclosure_pg0.EnclosureLogicalID);
-        }
        /* get device name */
        sas_device->device_name = le64_to_cpu(sas_device_pg0.DeviceName);
@@ -4250,12 +4262,6 @@ _scsih_sas_volume_add(struct MPT2SAS_ADAPTER *ioc,
        u16 handle = le16_to_cpu(element->VolDevHandle);
        int rc;
-#if 0 /* RAID_HACKS */
-        if (le32_to_cpu(event_data->Flags) &
-            MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG)
-                return;
-#endif
        mpt2sas_config_get_volume_wwid(ioc, handle, &wwid);
        if (!wwid) {
                printk(MPT2SAS_ERR_FMT
@@ -4310,12 +4316,6 @@ _scsih_sas_volume_delete(struct MPT2SAS_ADAPTER *ioc,
        unsigned long flags;
        struct MPT2SAS_TARGET *sas_target_priv_data;
-#if 0 /* RAID_HACKS */
-        if (le32_to_cpu(event_data->Flags) &
-            MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG)
-                return;
-#endif
        spin_lock_irqsave(&ioc->raid_device_lock, flags);
        raid_device = _scsih_raid_device_find_by_handle(ioc, handle);
        spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
@@ -4428,14 +4428,38 @@ _scsih_sas_pd_add(struct MPT2SAS_ADAPTER *ioc,
        struct _sas_device *sas_device;
        unsigned long flags;
        u16 handle = le16_to_cpu(element->PhysDiskDevHandle);
+        Mpi2ConfigReply_t mpi_reply;
+        Mpi2SasDevicePage0_t sas_device_pg0;
+        u32 ioc_status;
        spin_lock_irqsave(&ioc->sas_device_lock, flags);
        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-        if (sas_device)
+        if (sas_device) {
                sas_device->hidden_raid_component = 1;
-        else
+                return;
-                _scsih_add_device(ioc, handle, 0, 1);
+        }
+        if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0,
+            MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) {
+                printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                    ioc->name, __FILE__, __LINE__, __func__);
+                return;
+        }
+        ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+            MPI2_IOCSTATUS_MASK;
+        if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+                printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                    ioc->name, __FILE__, __LINE__, __func__);
+                return;
+        }
+        _scsih_link_change(ioc,
+            le16_to_cpu(sas_device_pg0.ParentDevHandle),
+            handle, sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
+        _scsih_add_device(ioc, handle, 0, 1);
 }
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
@@ -4535,12 +4559,15 @@ _scsih_sas_ir_config_change_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
 {
        Mpi2EventIrConfigElement_t *element;
        int i;
+        u8 foreign_config;
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
        if (ioc->logging_level & MPT_DEBUG_EVENT_WORK_TASK)
                _scsih_sas_ir_config_change_event_debug(ioc, event_data);
 #endif
+        foreign_config = (le32_to_cpu(event_data->Flags) &
+            MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG) ? 1 : 0;
        element = (Mpi2EventIrConfigElement_t *)&event_data->ConfigElement[0];
        for (i = 0; i < event_data->NumElements; i++, element++) {
@@ -4548,11 +4575,13 @@ _scsih_sas_ir_config_change_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
                switch (element->ReasonCode) {
                case MPI2_EVENT_IR_CHANGE_RC_VOLUME_CREATED:
                case MPI2_EVENT_IR_CHANGE_RC_ADDED:
-                        _scsih_sas_volume_add(ioc, element);
+                        if (!foreign_config)
+                                _scsih_sas_volume_add(ioc, element);
                        break;
                case MPI2_EVENT_IR_CHANGE_RC_VOLUME_DELETED:
                case MPI2_EVENT_IR_CHANGE_RC_REMOVED:
-                        _scsih_sas_volume_delete(ioc, element);
+                        if (!foreign_config)
+                                _scsih_sas_volume_delete(ioc, element);
                        break;
                case MPI2_EVENT_IR_CHANGE_RC_PD_CREATED:
                        _scsih_sas_pd_hide(ioc, element);
@@ -4671,6 +4700,9 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
        u32 state;
        struct _sas_device *sas_device;
        unsigned long flags;
+        Mpi2ConfigReply_t mpi_reply;
+        Mpi2SasDevicePage0_t sas_device_pg0;
+        u32 ioc_status;
        if (event_data->ReasonCode != MPI2_EVENT_IR_PHYSDISK_RC_STATE_CHANGED)
                return;
@@ -4687,22 +4719,40 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
        switch (state) {
-#if 0
-        case MPI2_RAID_PD_STATE_OFFLINE:
-                if (sas_device)
-                        _scsih_remove_device(ioc, handle);
-                break;
-#endif
        case MPI2_RAID_PD_STATE_ONLINE:
        case MPI2_RAID_PD_STATE_DEGRADED:
        case MPI2_RAID_PD_STATE_REBUILDING:
        case MPI2_RAID_PD_STATE_OPTIMAL:
-                if (sas_device)
+                if (sas_device) {
                        sas_device->hidden_raid_component = 1;
-                else
+                        return;
-                        _scsih_add_device(ioc, handle, 0, 1);
+                }
+                if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply,
+                    &sas_device_pg0, MPI2_SAS_DEVICE_PGAD_FORM_HANDLE,
+                    handle))) {
+                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                            ioc->name, __FILE__, __LINE__, __func__);
+                        return;
+                }
+                ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+                    MPI2_IOCSTATUS_MASK;
+                if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                            ioc->name, __FILE__, __LINE__, __func__);
+                        return;
+                }
+                _scsih_link_change(ioc,
+                    le16_to_cpu(sas_device_pg0.ParentDevHandle),
+                    handle, sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
+                _scsih_add_device(ioc, handle, 0, 1);
                break;
+        case MPI2_RAID_PD_STATE_OFFLINE:
        case MPI2_RAID_PD_STATE_NOT_CONFIGURED:
        case MPI2_RAID_PD_STATE_NOT_COMPATIBLE:
        case MPI2_RAID_PD_STATE_HOT_SPARE:
@@ -5774,6 +5824,7 @@ _scsih_suspend(struct pci_dev *pdev, pm_message_t state)
        struct MPT2SAS_ADAPTER *ioc = shost_priv(shost);
        u32 device_state;
+        mpt2sas_base_stop_watchdog(ioc);
        flush_scheduled_work();
        scsi_block_requests(shost);
        device_state = pci_choose_state(pdev, state);
@@ -5816,6 +5867,7 @@ _scsih_resume(struct pci_dev *pdev)
        mpt2sas_base_hard_reset_handler(ioc, CAN_SLEEP, SOFT_RESET);
        scsi_unblock_requests(shost);
+        mpt2sas_base_start_watchdog(ioc);
        return 0;
 }
 #endif /* CONFIG_PM */
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index e0d44af4745a..3f3119d760db 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -111,29 +111,32 @@ static int s3c24xx_spi_setupxfer(struct spi_device *spi,
        unsigned int bpw;
        unsigned int hz;
        unsigned int div;
+        unsigned long clk;
        bpw = t ? t->bits_per_word : spi->bits_per_word;
        hz  = t ? t->speed_hz : spi->max_speed_hz;
+        if (!bpw)
+                bpw = 8;
+        if (!hz)
+                hz = spi->max_speed_hz;
        if (bpw != 8) {
                dev_err(&spi->dev, "invalid bits-per-word (%d)\n", bpw);
                return -EINVAL;
        }
-        div = clk_get_rate(hw->clk) / hz;
+        clk = clk_get_rate(hw->clk);
+        div = DIV_ROUND_UP(clk, hz * 2) - 1;
-        /* is clk = pclk / (2 * (pre+1)), or is it
-         *    clk = (pclk * 2) / ( pre + 1) */
-        div /= 2;
-        if (div > 0)
-                div -= 1;
        if (div > 255)
                div = 255;
-        dev_dbg(&spi->dev, "setting pre-scaler to %d (hz %d)\n", div, hz);
+        dev_dbg(&spi->dev, "setting pre-scaler to %d (wanted %d, got %ld)\n",
+                div, hz, clk / (2 * (div + 1)));
        writeb(div, hw->regs + S3C2410_SPPRE);
        spin_lock(&hw->bitbang.lock);
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 8f24564f77b0..07f22b625632 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -481,6 +481,9 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
        /* tell the board code to enable the panel */
        for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
                ch = &priv->ch[k];
+                if (!ch->enabled)
+                        continue;
                board_cfg = &ch->cfg.board_cfg;
                if (board_cfg->display_on)
                        board_cfg->display_on(board_cfg->board_data);
@@ -498,6 +501,8 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
        /* clean up deferred io and ask board code to disable panel */
        for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
                ch = &priv->ch[k];
+                if (!ch->enabled)
+                        continue;
                /* deferred io mode:
                 * flush frame, and wait for frame end interrupt
diff --git a/drivers/watchdog/ar7_wdt.c b/drivers/watchdog/ar7_wdt.c
index 3fe9742c23ca..2f8643efe92c 100644
--- a/drivers/watchdog/ar7_wdt.c
+++ b/drivers/watchdog/ar7_wdt.c
@@ -37,7 +37,7 @@
 #include <linux/uaccess.h>
 #include <asm/addrspace.h>
-#include <asm/ar7/ar7.h>
+#include <asm/mach-ar7/ar7.h>
 #define DRVNAME "ar7_wdt"
 #define LONGNAME "TI AR7 Watchdog Timer"
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 272b9b2bea86..59cba180fe83 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3099,8 +3099,12 @@ static void inode_tree_add(struct inode *inode)
 {
        struct btrfs_root *root = BTRFS_I(inode)->root;
        struct btrfs_inode *entry;
-        struct rb_node **p = &root->inode_tree.rb_node;
+        struct rb_node **p;
-        struct rb_node *parent = NULL;
+        struct rb_node *parent;
+again:
+        p = &root->inode_tree.rb_node;
+        parent = NULL;
        spin_lock(&root->inode_lock);
        while (*p) {
@@ -3108,13 +3112,16 @@ static void inode_tree_add(struct inode *inode)
                entry = rb_entry(parent, struct btrfs_inode, rb_node);
                if (inode->i_ino < entry->vfs_inode.i_ino)
-                        p = &(*p)->rb_left;
+                        p = &parent->rb_left;
                else if (inode->i_ino > entry->vfs_inode.i_ino)
-                        p = &(*p)->rb_right;
+                        p = &parent->rb_right;
                else {
                        WARN_ON(!(entry->vfs_inode.i_state &
                                  (I_WILL_FREE | I_FREEING | I_CLEAR)));
-                        break;
+                        rb_erase(parent, &root->inode_tree);
+                        RB_CLEAR_NODE(parent);
+                        spin_unlock(&root->inode_lock);
+                        goto again;
                }
        }
        rb_link_node(&BTRFS_I(inode)->rb_node, parent, p);
@@ -3126,12 +3133,12 @@ static void inode_tree_del(struct inode *inode)
 {
        struct btrfs_root *root = BTRFS_I(inode)->root;
+        spin_lock(&root->inode_lock);
        if (!RB_EMPTY_NODE(&BTRFS_I(inode)->rb_node)) {
-                spin_lock(&root->inode_lock);
                rb_erase(&BTRFS_I(inode)->rb_node, &root->inode_tree);
-                spin_unlock(&root->inode_lock);
                RB_CLEAR_NODE(&BTRFS_I(inode)->rb_node);
        }
+        spin_unlock(&root->inode_lock);
 }
 static noinline void init_btrfs_i(struct inode *inode)
diff --git a/fs/buffer.c b/fs/buffer.c
index a3ef091a45bd..28f320fac4d4 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1165,8 +1165,11 @@ void mark_buffer_dirty(struct buffer_head *bh)
        if (!test_set_buffer_dirty(bh)) {
                struct page *page = bh->b_page;
-                if (!TestSetPageDirty(page))
+                if (!TestSetPageDirty(page)) {
-                        __set_page_dirty(page, page_mapping(page), 0);
+                        struct address_space *mapping = page_mapping(page);
+                        if (mapping)
+                                __set_page_dirty(page, mapping, 0);
+                }
        }
 }
diff --git a/fs/exec.c b/fs/exec.c
index 4a8849e45b21..fb4f3cdda78c 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -678,8 +678,8 @@ exit:
 }
 EXPORT_SYMBOL(open_exec);
-int kernel_read(struct file *file, unsigned long offset,
+int kernel_read(struct file *file, loff_t offset,
-        char *addr, unsigned long count)
+                char *addr, unsigned long count)
 {
        mm_segment_t old_fs;
        loff_t pos = offset;
diff --git a/fs/ext3/Kconfig b/fs/ext3/Kconfig
index fb3c1a21b135..522b15498f45 100644
--- a/fs/ext3/Kconfig
+++ b/fs/ext3/Kconfig
@@ -29,23 +29,25 @@ config EXT3_FS
          module will be called ext3.
 config EXT3_DEFAULTS_TO_ORDERED
-        bool "Default to 'data=ordered' in ext3 (legacy option)"
+        bool "Default to 'data=ordered' in ext3"
        depends on EXT3_FS
        help
-          If a filesystem does not explicitly specify a data ordering
+          The journal mode options for ext3 have different tradeoffs
-          mode, and the journal capability allowed it, ext3 used to
+          between when data is guaranteed to be on disk and
-          historically default to 'data=ordered'.
+          performance.  The use of "data=writeback" can cause
+          unwritten data to appear in files after an system crash or
-          That was a rather unfortunate choice, because it leads to all
+          power failure, which can be a security issue.  However,
-          kinds of latency problems, and the 'data=writeback' mode is more
+          "data=ordered" mode can also result in major performance
-          appropriate these days.
+          problems, including seconds-long delays before an fsync()
+          call returns.  For details, see:
-          You should probably always answer 'n' here, and if you really
-          want to use 'data=ordered' mode, set it in the filesystem itself
+          http://ext4.wiki.kernel.org/index.php/Ext3_data_mode_tradeoffs
-          with 'tune2fs -o journal_data_ordered'.
+          If you have been historically happy with ext3's performance,
-          But if you really want to enable the legacy default, you can do
+          data=ordered mode will be a safe choice and you should
-          so by answering 'y' to this question.
+          answer 'y' here.  If you understand the reliability and data
+          privacy issues of data=writeback and are willing to make
+          that trade off, answer 'n'.
 config EXT3_FS_XATTR
        bool "Ext3 extended attributes"
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 524b349c6299..a8d80a7f1105 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -543,6 +543,19 @@ static inline void ext3_show_quota_options(struct seq_file *seq, struct super_bl
 #endif
 }
+static char *data_mode_string(unsigned long mode)
+{
+        switch (mode) {
+        case EXT3_MOUNT_JOURNAL_DATA:
+                return "journal";
+        case EXT3_MOUNT_ORDERED_DATA:
+                return "ordered";
+        case EXT3_MOUNT_WRITEBACK_DATA:
+                return "writeback";
+        }
+        return "unknown";
+}
 /*
 * Show an option if
 *  - it's set to a non-default value OR
@@ -616,13 +629,8 @@ static int ext3_show_options(struct seq_file *seq, struct vfsmount *vfs)
        if (test_opt(sb, NOBH))
                seq_puts(seq, ",nobh");
-        if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_JOURNAL_DATA)
+        seq_printf(seq, ",data=%s", data_mode_string(sbi->s_mount_opt &
-                seq_puts(seq, ",data=journal");
+                                                     EXT3_MOUNT_DATA_FLAGS));
-        else if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_ORDERED_DATA)
-                seq_puts(seq, ",data=ordered");
-        else if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_WRITEBACK_DATA)
-                seq_puts(seq, ",data=writeback");
        if (test_opt(sb, DATA_ERR_ABORT))
                seq_puts(seq, ",data_err=abort");
@@ -1024,12 +1032,18 @@ static int parse_options (char *options, struct super_block *sb,
                datacheck:
                        if (is_remount) {
                                if ((sbi->s_mount_opt & EXT3_MOUNT_DATA_FLAGS)
-                                                != data_opt) {
+                                                == data_opt)
-                                        printk(KERN_ERR
+                                        break;
-                                                "EXT3-fs: cannot change data "
+                                printk(KERN_ERR
-                                                "mode on remount\n");
+                                        "EXT3-fs (device %s): Cannot change "
-                                        return 0;
+                                        "data mode on remount. The filesystem "
-                                }
+                                        "is mounted in data=%s mode and you "
+                                        "try to remount it in data=%s mode.\n",
+                                        sb->s_id,
+                                        data_mode_string(sbi->s_mount_opt &
+                                                        EXT3_MOUNT_DATA_FLAGS),
+                                        data_mode_string(data_opt));
+                                return 0;
                        } else {
                                sbi->s_mount_opt &= ~EXT3_MOUNT_DATA_FLAGS;
                                sbi->s_mount_opt |= data_opt;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 941c8425c10b..cb88dac8ccaa 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -935,26 +935,28 @@ static int can_do_hugetlb_shm(void)
        return capable(CAP_IPC_LOCK) || in_group_p(sysctl_hugetlb_shm_group);
 }
-struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag)
+struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag,
+                                                struct user_struct **user)
 {
        int error = -ENOMEM;
-        int unlock_shm = 0;
        struct file *file;
        struct inode *inode;
        struct dentry *dentry, *root;
        struct qstr quick_string;
-        struct user_struct *user = current_user();
+        *user = NULL;
        if (!hugetlbfs_vfsmount)
                return ERR_PTR(-ENOENT);
        if (!can_do_hugetlb_shm()) {
-                if (user_shm_lock(size, user)) {
+                *user = current_user();
-                        unlock_shm = 1;
+                if (user_shm_lock(size, *user)) {
                        WARN_ONCE(1,
                          "Using mlock ulimits for SHM_HUGETLB deprecated\n");
-                } else
+                } else {
+                        *user = NULL;
                        return ERR_PTR(-EPERM);
+                }
        }
        root = hugetlbfs_vfsmount->mnt_root;
@@ -996,8 +998,10 @@ out_inode:
 out_dentry:
        dput(dentry);
 out_shm_unlock:
-        if (unlock_shm)
+        if (*user) {
-                user_shm_unlock(size, user);
+                user_shm_unlock(size, *user);
+                *user = NULL;
+        }
        return ERR_PTR(error);
 }
diff --git a/fs/libfs.c b/fs/libfs.c
index ddfa89948c3f..dcec3d3ea64f 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -217,7 +217,7 @@ int get_sb_pseudo(struct file_system_type *fs_type, char *name,
                return PTR_ERR(s);
        s->s_flags = MS_NOUSER;
-        s->s_maxbytes = ~0ULL;
+        s->s_maxbytes = MAX_LFS_FILESIZE;
        s->s_blocksize = PAGE_SIZE;
        s->s_blocksize_bits = PAGE_SHIFT;
        s->s_magic = magic;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 65ca8c18476f..1434080aefeb 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1250,8 +1250,8 @@ static void nfs4_state_manager(struct nfs_client *clp)
                                continue;
                }
                /* Initialize or reset the session */
-                if (nfs4_has_session(clp) &&
+                if (test_and_clear_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state)
-                   test_and_clear_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state)) {
+                   && nfs4_has_session(clp)) {
                        if (clp->cl_cons_state == NFS_CS_SESSION_INITING)
                                status = nfs4_initialize_session(clp);
                        else
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 8e2ec43b18f4..151964f0de4c 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -416,8 +416,10 @@ int nilfs_attach_checkpoint(struct nilfs_sb_info *sbi, __u64 cno)
        if (unlikely(err))
                goto failed;
+        down_read(&nilfs->ns_segctor_sem);
        err = nilfs_cpfile_get_checkpoint(nilfs->ns_cpfile, cno, 0, &raw_cp,
                                          &bh_cp);
+        up_read(&nilfs->ns_segctor_sem);
        if (unlikely(err)) {
                if (err == -ENOENT || err == -EINVAL) {
                        printk(KERN_ERR
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index e8adbffc626f..1b9caafb8662 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -253,7 +253,7 @@ nilfs_detach_writer(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 static inline void nilfs_put_sbinfo(struct nilfs_sb_info *sbi)
 {
-        if (!atomic_dec_and_test(&sbi->s_count))
+        if (atomic_dec_and_test(&sbi->s_count))
                kfree(sbi);
 }
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index f9a3e8942669..ab513ddaeff2 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -6851,7 +6851,7 @@ static int ocfs2_do_truncate(struct ocfs2_super *osb,
        }
        status = 0;
 bail:
+        brelse(last_eb_bh);
        mlog_exit(status);
        return status;
 }
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index fcf879ed6930..756f5b0998e0 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -122,7 +122,7 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
         * that still has AST's pending... */
        in_use = !list_empty(&lock->ast_list);
        spin_unlock(&dlm->ast_lock);
-        if (in_use) {
+        if (in_use && !(flags & LKM_CANCEL)) {
               mlog(ML_ERROR, "lockres %.*s: Someone is calling dlmunlock "
                    "while waiting for an ast!", res->lockname.len,
                    res->lockname.name);
@@ -131,7 +131,7 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
        spin_lock(&res->spinlock);
        if (res->state & DLM_LOCK_RES_IN_PROGRESS) {
-                if (master_node) {
+                if (master_node && !(flags & LKM_CANCEL)) {
                        mlog(ML_ERROR, "lockres in progress!\n");
                        spin_unlock(&res->spinlock);
                        return DLM_FORWARD;
diff --git a/fs/ocfs2/ocfs2_lockid.h b/fs/ocfs2/ocfs2_lockid.h
index fcdba091af3d..c212cf5a2bdf 100644
--- a/fs/ocfs2/ocfs2_lockid.h
+++ b/fs/ocfs2/ocfs2_lockid.h
@@ -108,6 +108,7 @@ static char *ocfs2_lock_type_strings[] = {
        [OCFS2_LOCK_TYPE_OPEN] = "Open",
        [OCFS2_LOCK_TYPE_FLOCK] = "Flock",
        [OCFS2_LOCK_TYPE_QINFO] = "Quota",
+        [OCFS2_LOCK_TYPE_NFS_SYNC] = "NFSSync",
        [OCFS2_LOCK_TYPE_ORPHAN_SCAN] = "OrphanScan",
 };
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index bf7742d0ee3b..44f2a5e1d042 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -23,6 +23,7 @@
 #include "sysfile.h"
 #include "dlmglue.h"
 #include "uptodate.h"
+#include "super.h"
 #include "quota.h"
 static struct workqueue_struct *ocfs2_quota_wq = NULL;
@@ -114,6 +115,15 @@ int ocfs2_read_quota_block(struct inode *inode, u64 v_block,
        int rc = 0;
        struct buffer_head *tmp = *bh;
+        if (i_size_read(inode) >> inode->i_sb->s_blocksize_bits <= v_block) {
+                ocfs2_error(inode->i_sb,
+                            "Quota file %llu is probably corrupted! Requested "
+                            "to read block %Lu but file has size only %Lu\n",
+                            (unsigned long long)OCFS2_I(inode)->ip_blkno,
+                            (unsigned long long)v_block,
+                            (unsigned long long)i_size_read(inode));
+                return -EIO;
+        }
        rc = ocfs2_read_virt_blocks(inode, v_block, 1, &tmp, 0,
                                    ocfs2_validate_quota_block);
        if (rc)
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index b0ee0fdf799a..a3f8871d21fd 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1218,13 +1218,17 @@ static void ocfs2_kill_sb(struct super_block *sb)
 {
        struct ocfs2_super *osb = OCFS2_SB(sb);
+        /* Failed mount? */
+        if (!osb || atomic_read(&osb->vol_state) == VOLUME_DISABLED)
+                goto out;
        /* Prevent further queueing of inode drop events */
        spin_lock(&dentry_list_lock);
        ocfs2_set_osb_flag(osb, OCFS2_OSB_DROP_DENTRY_LOCK_IMMED);
        spin_unlock(&dentry_list_lock);
        /* Wait for work to finish and/or remove it */
        cancel_work_sync(&osb->dentry_lock_work);
+out:
        kill_block_super(sb);
 }
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 175db258942f..6f742f6658a9 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1003,12 +1003,7 @@ static ssize_t oom_adjust_read(struct file *file, char __user *buf,
        if (!task)
                return -ESRCH;
-        task_lock(task);
+        oom_adjust = task->oomkilladj;
-        if (task->mm)
-                oom_adjust = task->mm->oom_adj;
-        else
-                oom_adjust = OOM_DISABLE;
-        task_unlock(task);
        put_task_struct(task);
        len = snprintf(buffer, sizeof(buffer), "%i\n", oom_adjust);
@@ -1037,19 +1032,11 @@ static ssize_t oom_adjust_write(struct file *file, const char __user *buf,
        task = get_proc_task(file->f_path.dentry->d_inode);
        if (!task)
                return -ESRCH;
-        task_lock(task);
+        if (oom_adjust < task->oomkilladj && !capable(CAP_SYS_RESOURCE)) {
-        if (!task->mm) {
-                task_unlock(task);
-                put_task_struct(task);
-                return -EINVAL;
-        }
-        if (oom_adjust < task->mm->oom_adj && !capable(CAP_SYS_RESOURCE)) {
-                task_unlock(task);
                put_task_struct(task);
                return -EACCES;
        }
-        task->mm->oom_adj = oom_adjust;
+        task->oomkilladj = oom_adjust;
-        task_unlock(task);
        put_task_struct(task);
        if (end - buffer == 0)
                return -EIO;
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index af4b4826997e..2ba61e18fc8b 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -508,6 +508,7 @@ typedef struct {
 #define DRM_RADEON_INFO                 0x27
 #define DRM_RADEON_GEM_SET_TILING       0x28
 #define DRM_RADEON_GEM_GET_TILING       0x29
+#define DRM_RADEON_GEM_BUSY             0x2a
 #define DRM_IOCTL_RADEON_CP_INIT    DRM_IOW( DRM_COMMAND_BASE + DRM_RADEON_CP_INIT, drm_radeon_init_t)
 #define DRM_IOCTL_RADEON_CP_START   DRM_IO(  DRM_COMMAND_BASE + DRM_RADEON_CP_START)
@@ -548,6 +549,7 @@ typedef struct {
 #define DRM_IOCTL_RADEON_INFO           DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_INFO, struct drm_radeon_info)
 #define DRM_IOCTL_RADEON_SET_TILING     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_SET_TILING, struct drm_radeon_gem_set_tiling)
 #define DRM_IOCTL_RADEON_GET_TILING     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_GET_TILING, struct drm_radeon_gem_get_tiling)
+#define DRM_IOCTL_RADEON_GEM_BUSY       DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_BUSY, struct drm_radeon_gem_busy)
 typedef struct drm_radeon_init {
        enum {
@@ -707,6 +709,7 @@ typedef struct drm_radeon_indirect {
 #define RADEON_PARAM_FB_LOCATION           14   /* FB location */
 #define RADEON_PARAM_NUM_GB_PIPES          15   /* num GB pipes */
 #define RADEON_PARAM_DEVICE_ID             16
+#define RADEON_PARAM_NUM_Z_PIPES           17   /* num Z pipes */
 typedef struct drm_radeon_getparam {
        int param;
@@ -838,7 +841,7 @@ struct drm_radeon_gem_wait_idle {
 struct drm_radeon_gem_busy {
        uint32_t        handle;
-        uint32_t        busy;
+        uint32_t        domain;
 };
 struct drm_radeon_gem_pread {
@@ -895,6 +898,7 @@ struct drm_radeon_cs {
 #define RADEON_INFO_DEVICE_ID           0x00
 #define RADEON_INFO_NUM_GB_PIPES        0x01
+#define RADEON_INFO_NUM_Z_PIPES         0x02
 struct drm_radeon_info {
        uint32_t                request;
diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
index 2878811c6134..756d78b8c1c5 100644
--- a/include/linux/bitmap.h
+++ b/include/linux/bitmap.h
@@ -94,13 +94,13 @@ extern void __bitmap_shift_right(unsigned long *dst,
                        const unsigned long *src, int shift, int bits);
 extern void __bitmap_shift_left(unsigned long *dst,
                        const unsigned long *src, int shift, int bits);
-extern void __bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
+extern int __bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
                        const unsigned long *bitmap2, int bits);
 extern void __bitmap_or(unsigned long *dst, const unsigned long *bitmap1,
                        const unsigned long *bitmap2, int bits);
 extern void __bitmap_xor(unsigned long *dst, const unsigned long *bitmap1,
                        const unsigned long *bitmap2, int bits);
-extern void __bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
+extern int __bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
                        const unsigned long *bitmap2, int bits);
 extern int __bitmap_intersects(const unsigned long *bitmap1,
                        const unsigned long *bitmap2, int bits);
@@ -171,13 +171,12 @@ static inline void bitmap_copy(unsigned long *dst, const unsigned long *src,
        }
 }
-static inline void bitmap_and(unsigned long *dst, const unsigned long *src1,
+static inline int bitmap_and(unsigned long *dst, const unsigned long *src1,
                        const unsigned long *src2, int nbits)
 {
        if (small_const_nbits(nbits))
-                *dst = *src1 & *src2;
+                return (*dst = *src1 & *src2) != 0;
-        else
+        return __bitmap_and(dst, src1, src2, nbits);
-                __bitmap_and(dst, src1, src2, nbits);
 }
 static inline void bitmap_or(unsigned long *dst, const unsigned long *src1,
@@ -198,13 +197,12 @@ static inline void bitmap_xor(unsigned long *dst, const unsigned long *src1,
                __bitmap_xor(dst, src1, src2, nbits);
 }
-static inline void bitmap_andnot(unsigned long *dst, const unsigned long *src1,
+static inline int bitmap_andnot(unsigned long *dst, const unsigned long *src1,
                        const unsigned long *src2, int nbits)
 {
        if (small_const_nbits(nbits))
-                *dst = *src1 & ~(*src2);
+                return (*dst = *src1 & ~(*src2)) != 0;
-        else
+        return __bitmap_andnot(dst, src1, src2, nbits);
-                __bitmap_andnot(dst, src1, src2, nbits);
 }
 static inline void bitmap_complement(unsigned long *dst, const unsigned long *src,
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index c5ac87ca7bc6..796df12091b7 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -43,10 +43,10 @@
 * int cpu_isset(cpu, mask)             true iff bit 'cpu' set in mask
 * int cpu_test_and_set(cpu, mask)      test and set bit 'cpu' in mask
 *
- * void cpus_and(dst, src1, src2)       dst = src1 & src2  [intersection]
+ * int cpus_and(dst, src1, src2)        dst = src1 & src2  [intersection]
 * void cpus_or(dst, src1, src2)        dst = src1 | src2  [union]
 * void cpus_xor(dst, src1, src2)       dst = src1 ^ src2
- * void cpus_andnot(dst, src1, src2)    dst = src1 & ~src2
+ * int cpus_andnot(dst, src1, src2)     dst = src1 & ~src2
 * void cpus_complement(dst, src)       dst = ~src
 *
 * int cpus_equal(mask1, mask2)         Does mask1 == mask2?
@@ -179,10 +179,10 @@ static inline int __cpu_test_and_set(int cpu, cpumask_t *addr)
 }
 #define cpus_and(dst, src1, src2) __cpus_and(&(dst), &(src1), &(src2), NR_CPUS)
-static inline void __cpus_and(cpumask_t *dstp, const cpumask_t *src1p,
+static inline int __cpus_and(cpumask_t *dstp, const cpumask_t *src1p,
                                        const cpumask_t *src2p, int nbits)
 {
-        bitmap_and(dstp->bits, src1p->bits, src2p->bits, nbits);
+        return bitmap_and(dstp->bits, src1p->bits, src2p->bits, nbits);
 }
 #define cpus_or(dst, src1, src2) __cpus_or(&(dst), &(src1), &(src2), NR_CPUS)
@@ -201,10 +201,10 @@ static inline void __cpus_xor(cpumask_t *dstp, const cpumask_t *src1p,
 #define cpus_andnot(dst, src1, src2) \
                                __cpus_andnot(&(dst), &(src1), &(src2), NR_CPUS)
-static inline void __cpus_andnot(cpumask_t *dstp, const cpumask_t *src1p,
+static inline int __cpus_andnot(cpumask_t *dstp, const cpumask_t *src1p,
                                        const cpumask_t *src2p, int nbits)
 {
-        bitmap_andnot(dstp->bits, src1p->bits, src2p->bits, nbits);
+        return bitmap_andnot(dstp->bits, src1p->bits, src2p->bits, nbits);
 }
 #define cpus_complement(dst, src) __cpus_complement(&(dst), &(src), NR_CPUS)
@@ -738,11 +738,11 @@ static inline void cpumask_clear(struct cpumask *dstp)
 * @src1p: the first input
 * @src2p: the second input
 */
-static inline void cpumask_and(struct cpumask *dstp,
+static inline int cpumask_and(struct cpumask *dstp,
                               const struct cpumask *src1p,
                               const struct cpumask *src2p)
 {
-        bitmap_and(cpumask_bits(dstp), cpumask_bits(src1p),
+        return bitmap_and(cpumask_bits(dstp), cpumask_bits(src1p),
                                       cpumask_bits(src2p), nr_cpumask_bits);
 }
@@ -779,11 +779,11 @@ static inline void cpumask_xor(struct cpumask *dstp,
 * @src1p: the first input
 * @src2p: the second input
 */
-static inline void cpumask_andnot(struct cpumask *dstp,
+static inline int cpumask_andnot(struct cpumask *dstp,
                                  const struct cpumask *src1p,
                                  const struct cpumask *src2p)
 {
-        bitmap_andnot(cpumask_bits(dstp), cpumask_bits(src1p),
+        return bitmap_andnot(cpumask_bits(dstp), cpumask_bits(src1p),
                                          cpumask_bits(src2p), nr_cpumask_bits);
 }
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 67888a9e0655..73e9b643e455 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2123,7 +2123,7 @@ extern struct file *do_filp_open(int dfd, const char *pathname,
                int open_flag, int mode, int acc_mode);
 extern int may_open(struct path *, int, int);
-extern int kernel_read(struct file *, unsigned long, char *, unsigned long);
+extern int kernel_read(struct file *, loff_t, char *, unsigned long);
 extern struct file * open_exec(const char *);
 
 /* fs/dcache.c -- generic fs support functions */
diff --git a/include/linux/gen_stats.h b/include/linux/gen_stats.h
index 0ffa41df0ee8..710e901085d0 100644
--- a/include/linux/gen_stats.h
+++ b/include/linux/gen_stats.h
@@ -22,6 +22,11 @@ struct gnet_stats_basic
 {
        __u64   bytes;
        __u32   packets;
+};
+struct gnet_stats_basic_packed
+{
+        __u64   bytes;
+        __u32   packets;
 } __attribute__ ((packed));
 /**
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 2723513a5651..5cbc620bdfe0 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -10,6 +10,7 @@
 #include <asm/tlbflush.h>
 struct ctl_table;
+struct user_struct;
 int PageHuge(struct page *page);
@@ -146,7 +147,8 @@ static inline struct hugetlbfs_sb_info *HUGETLBFS_SB(struct super_block *sb)
 extern const struct file_operations hugetlbfs_file_operations;
 extern struct vm_operations_struct hugetlb_vm_ops;
-struct file *hugetlb_file_setup(const char *name, size_t, int);
+struct file *hugetlb_file_setup(const char *name, size_t size, int acct,
+                                                struct user_struct **user);
 int hugetlb_get_quota(struct address_space *mapping, long delta);
 void hugetlb_put_quota(struct address_space *mapping, long delta);
@@ -168,7 +170,7 @@ static inline void set_file_hugepages(struct file *file)
 #define is_file_hugepages(file)                 0
 #define set_file_hugepages(file)                BUG()
-#define hugetlb_file_setup(name,size,acctflag)  ERR_PTR(-ENOSYS)
+#define hugetlb_file_setup(name,size,acct,user) ERR_PTR(-ENOSYS)
 #endif /* !CONFIG_HUGETLBFS */
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 7acc8439d9b3..0042090a4d70 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -240,8 +240,6 @@ struct mm_struct {
        unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
-        s8 oom_adj;     /* OOM kill score adjustment (bit shift) */
        cpumask_t cpu_vm_mask;
        /* Architecture-specific MM context */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 3ab08e4bb6b8..0f1ea4a66957 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1198,6 +1198,7 @@ struct task_struct {
         * a short time
         */
        unsigned char fpu_counter;
+        s8 oomkilladj; /* OOM kill score adjustment (bit shift). */
 #ifdef CONFIG_BLK_DEV_IO_TRACE
        unsigned int btrace_seq;
 #endif
diff --git a/include/linux/ucb1400.h b/include/linux/ucb1400.h
index ed889f4168f3..ae779bb8cc0f 100644
--- a/include/linux/ucb1400.h
+++ b/include/linux/ucb1400.h
@@ -73,6 +73,10 @@
 #define UCB_ADC_DATA            0x68
 #define UCB_ADC_DAT_VALID       (1 << 15)
+#define UCB_FCSR                0x6c
+#define UCB_FCSR_AVE            (1 << 12)
 #define UCB_ADC_DAT_MASK        0x3ff
 #define UCB_ID                  0x7e
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 565eed8fe496..c05fd717c588 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -16,7 +16,7 @@ struct tcf_common {
        u32                             tcfc_capab;
        int                             tcfc_action;
        struct tcf_t                    tcfc_tm;
-        struct gnet_stats_basic         tcfc_bstats;
+        struct gnet_stats_basic_packed  tcfc_bstats;
        struct gnet_stats_queue         tcfc_qstats;
        struct gnet_stats_rate_est      tcfc_rate_est;
        spinlock_t                      tcfc_lock;
diff --git a/include/net/gen_stats.h b/include/net/gen_stats.h
index d136b5240ef2..c1488553e349 100644
--- a/include/net/gen_stats.h
+++ b/include/net/gen_stats.h
@@ -28,7 +28,7 @@ extern int gnet_stats_start_copy_compat(struct sk_buff *skb, int type,
                                        spinlock_t *lock, struct gnet_dump *d);
 extern int gnet_stats_copy_basic(struct gnet_dump *d,
-                                 struct gnet_stats_basic *b);
+                                 struct gnet_stats_basic_packed *b);
 extern int gnet_stats_copy_rate_est(struct gnet_dump *d,
                                    struct gnet_stats_rate_est *r);
 extern int gnet_stats_copy_queue(struct gnet_dump *d,
@@ -37,14 +37,14 @@ extern int gnet_stats_copy_app(struct gnet_dump *d, void *st, int len);
 extern int gnet_stats_finish_copy(struct gnet_dump *d);
-extern int gen_new_estimator(struct gnet_stats_basic *bstats,
+extern int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                             struct gnet_stats_rate_est *rate_est,
                             spinlock_t *stats_lock, struct nlattr *opt);
-extern void gen_kill_estimator(struct gnet_stats_basic *bstats,
+extern void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                               struct gnet_stats_rate_est *rate_est);
-extern int gen_replace_estimator(struct gnet_stats_basic *bstats,
+extern int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
                                 struct gnet_stats_rate_est *rate_est,
                                 spinlock_t *stats_lock, struct nlattr *opt);
-extern bool gen_estimator_active(const struct gnet_stats_basic *bstats,
+extern bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                                 const struct gnet_stats_rate_est *rate_est);
 #endif
diff --git a/include/net/netfilter/xt_rateest.h b/include/net/netfilter/xt_rateest.h
index 65d594dffbff..ddbf37e19616 100644
--- a/include/net/netfilter/xt_rateest.h
+++ b/include/net/netfilter/xt_rateest.h
@@ -8,7 +8,7 @@ struct xt_rateest {
        spinlock_t                      lock;
        struct gnet_estimator           params;
        struct gnet_stats_rate_est      rstats;
-        struct gnet_stats_basic         bstats;
+        struct gnet_stats_basic_packed  bstats;
 };
 extern struct xt_rateest *xt_rateest_lookup(const char *name);
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 82a3191375f5..7eafb8d54470 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -61,8 +61,8 @@ psched_tdiff_bounded(psched_time_t tv1, psched_time_t tv2, psched_time_t bound)
 }
 struct qdisc_watchdog {
-        struct hrtimer  timer;
+        struct tasklet_hrtimer  timer;
-        struct Qdisc    *qdisc;
+        struct Qdisc            *qdisc;
 };
 extern void qdisc_watchdog_init(struct qdisc_watchdog *wd, struct Qdisc *qdisc);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 964ffa0d8815..5482e9582f55 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -72,7 +72,7 @@ struct Qdisc
         */
        unsigned long           state;
        struct sk_buff_head     q;
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
        struct gnet_stats_queue qstats;
 };
diff --git a/init/main.c b/init/main.c
index 98e679e3494a..11f4f145be3f 100644
--- a/init/main.c
+++ b/init/main.c
@@ -584,8 +584,8 @@ asmlinkage void __init start_kernel(void)
        setup_arch(&command_line);
        mm_init_owner(&init_mm, &init_task);
        setup_command_line(command_line);
-        setup_per_cpu_areas();
        setup_nr_cpu_ids();
+        setup_per_cpu_areas();
        smp_prepare_boot_cpu(); /* arch-specific boot-cpu hooks */
        build_all_zonelists();
diff --git a/ipc/shm.c b/ipc/shm.c
index 15dd238e5338..1bc4701ef4f0 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -174,7 +174,7 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
        shm_unlock(shp);
        if (!is_file_hugepages(shp->shm_file))
                shmem_lock(shp->shm_file, 0, shp->mlock_user);
-        else
+        else if (shp->mlock_user)
                user_shm_unlock(shp->shm_file->f_path.dentry->d_inode->i_size,
                                                shp->mlock_user);
        fput (shp->shm_file);
@@ -369,8 +369,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
                /* hugetlb_file_setup applies strict accounting */
                if (shmflg & SHM_NORESERVE)
                        acctflag = VM_NORESERVE;
-                file = hugetlb_file_setup(name, size, acctflag);
+                file = hugetlb_file_setup(name, size, acctflag,
-                shp->mlock_user = current_user();
+                                                        &shp->mlock_user);
        } else {
                /*
                 * Do not allow no accounting for OVERCOMMIT_NEVER, even
@@ -410,6 +410,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
        return error;
 no_id:
+        if (shp->mlock_user)    /* shmflg & SHM_HUGETLB case */
+                user_shm_unlock(size, shp->mlock_user);
        fput(file);
 no_file:
        security_shm_free(shp);
diff --git a/kernel/fork.c b/kernel/fork.c
index 021e1138556e..144326b7af50 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -426,7 +426,6 @@ static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
        init_rwsem(&mm->mmap_sem);
        INIT_LIST_HEAD(&mm->mmlist);
        mm->flags = (current->mm) ? current->mm->flags : default_dump_filter;
-        mm->oom_adj = (current->mm) ? current->mm->oom_adj : 0;
        mm->core_state = NULL;
        mm->nr_ptes = 0;
        set_mm_counter(mm, file_rss, 0);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index d222515a5a06..0ec9ed831737 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -607,7 +607,6 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                 */
                get_task_struct(t);
                new->thread = t;
-                wake_up_process(t);
        }
        /*
@@ -690,6 +689,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                                (int)(new->flags & IRQF_TRIGGER_MASK));
        }
+        new->irq = irq;
        *old_ptr = new;
        /* Reset broken irq detection when installing new handler */
@@ -707,7 +707,13 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
        spin_unlock_irqrestore(&desc->lock, flags);
-        new->irq = irq;
+        /*
+         * Strictly no need to wake it up, but hung_task complains
+         * when no hard interrupt wakes the thread up.
+         */
+        if (new->thread)
+                wake_up_process(new->thread);
        register_irq_proc(irq, desc);
        new->dir = NULL;
        register_handler_proc(irq, new);
diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c
index 534e20d14d63..36f65e2b8b57 100644
--- a/kernel/perf_counter.c
+++ b/kernel/perf_counter.c
@@ -1503,10 +1503,21 @@ static void perf_counter_enable_on_exec(struct task_struct *task)
 */
 static void __perf_counter_read(void *info)
 {
+        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
        struct perf_counter *counter = info;
        struct perf_counter_context *ctx = counter->ctx;
        unsigned long flags;
+        /*
+         * If this is a task context, we need to check whether it is
+         * the current task context of this cpu.  If not it has been
+         * scheduled out before the smp call arrived.  In that case
+         * counter->count would have been updated to a recent sample
+         * when the counter was scheduled out.
+         */
+        if (ctx->task && cpuctx->task_ctx != ctx)
+                return;
        local_irq_save(flags);
        if (ctx->is_active)
                update_context_time(ctx);
@@ -2008,6 +2019,10 @@ int perf_counter_task_disable(void)
        return 0;
 }
+#ifndef PERF_COUNTER_INDEX_OFFSET
+# define PERF_COUNTER_INDEX_OFFSET 0
+#endif
 static int perf_counter_index(struct perf_counter *counter)
 {
        if (counter->state != PERF_COUNTER_STATE_ACTIVE)
diff --git a/lib/bitmap.c b/lib/bitmap.c
index 35a1f7ff4149..702565821c99 100644
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -179,14 +179,16 @@ void __bitmap_shift_left(unsigned long *dst,
 }
 EXPORT_SYMBOL(__bitmap_shift_left);
-void __bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
+int __bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
                                const unsigned long *bitmap2, int bits)
 {
        int k;
        int nr = BITS_TO_LONGS(bits);
+        unsigned long result = 0;
        for (k = 0; k < nr; k++)
-                dst[k] = bitmap1[k] & bitmap2[k];
+                result |= (dst[k] = bitmap1[k] & bitmap2[k]);
+        return result != 0;
 }
 EXPORT_SYMBOL(__bitmap_and);
@@ -212,14 +214,16 @@ void __bitmap_xor(unsigned long *dst, const unsigned long *bitmap1,
 }
 EXPORT_SYMBOL(__bitmap_xor);
-void __bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
+int __bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
                                const unsigned long *bitmap2, int bits)
 {
        int k;
        int nr = BITS_TO_LONGS(bits);
+        unsigned long result = 0;
        for (k = 0; k < nr; k++)
-                dst[k] = bitmap1[k] & ~bitmap2[k];
+                result |= (dst[k] = bitmap1[k] & ~bitmap2[k]);
+        return result != 0;
 }
 EXPORT_SYMBOL(__bitmap_andnot);
diff --git a/mm/nommu.c b/mm/nommu.c
index 28754c40be98..4bde489ec431 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -919,6 +919,10 @@ static int validate_mmap_request(struct file *file,
                if (!file->f_op->read)
                        capabilities &= ~BDI_CAP_MAP_COPY;
+                /* The file shall have been opened with read permission. */
+                if (!(file->f_mode & FMODE_READ))
+                        return -EACCES;
                if (flags & MAP_SHARED) {
                        /* do checks for writing, appending and locking */
                        if ((prot & PROT_WRITE) &&
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 175a67a78a99..a7b2460e922b 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -58,7 +58,6 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
        unsigned long points, cpu_time, run_time;
        struct mm_struct *mm;
        struct task_struct *child;
-        int oom_adj;
        task_lock(p);
        mm = p->mm;
@@ -66,11 +65,6 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
                task_unlock(p);
                return 0;
        }
-        oom_adj = mm->oom_adj;
-        if (oom_adj == OOM_DISABLE) {
-                task_unlock(p);
-                return 0;
-        }
        /*
         * The memory size of the process is the basis for the badness.
@@ -154,15 +148,15 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
                points /= 8;
        /*
-         * Adjust the score by oom_adj.
+         * Adjust the score by oomkilladj.
         */
-        if (oom_adj) {
+        if (p->oomkilladj) {
-                if (oom_adj > 0) {
+                if (p->oomkilladj > 0) {
                        if (!points)
                                points = 1;
-                        points <<= oom_adj;
+                        points <<= p->oomkilladj;
                } else
-                        points >>= -(oom_adj);
+                        points >>= -(p->oomkilladj);
        }
 #ifdef DEBUG
@@ -257,8 +251,11 @@ static struct task_struct *select_bad_process(unsigned long *ppoints,
                        *ppoints = ULONG_MAX;
                }
+                if (p->oomkilladj == OOM_DISABLE)
+                        continue;
                points = badness(p, uptime.tv_sec);
-                if (points > *ppoints) {
+                if (points > *ppoints || !chosen) {
                        chosen = p;
                        *ppoints = points;
                }
@@ -307,7 +304,8 @@ static void dump_tasks(const struct mem_cgroup *mem)
                }
                printk(KERN_INFO "[%5d] %5d %5d %8lu %8lu %3d     %3d %s\n",
                       p->pid, __task_cred(p)->uid, p->tgid, mm->total_vm,
-                       get_mm_rss(mm), (int)task_cpu(p), mm->oom_adj, p->comm);
+                       get_mm_rss(mm), (int)task_cpu(p), p->oomkilladj,
+                       p->comm);
                task_unlock(p);
        } while_each_thread(g, p);
 }
@@ -325,8 +323,11 @@ static void __oom_kill_task(struct task_struct *p, int verbose)
                return;
        }
-        if (!p->mm)
+        if (!p->mm) {
+                WARN_ON(1);
+                printk(KERN_WARNING "tried to kill an mm-less task!\n");
                return;
+        }
        if (verbose)
                printk(KERN_ERR "Killed process %d (%s)\n",
@@ -348,13 +349,28 @@ static int oom_kill_task(struct task_struct *p)
        struct mm_struct *mm;
        struct task_struct *g, *q;
-        task_lock(p);
        mm = p->mm;
-        if (!mm || mm->oom_adj == OOM_DISABLE) {
-                task_unlock(p);
+        /* WARNING: mm may not be dereferenced since we did not obtain its
+         * value from get_task_mm(p).  This is OK since all we need to do is
+         * compare mm to q->mm below.
+         *
+         * Furthermore, even if mm contains a non-NULL value, p->mm may
+         * change to NULL at any time since we do not hold task_lock(p).
+         * However, this is of no concern to us.
+         */
+        if (mm == NULL)
                return 1;
-        }
-        task_unlock(p);
+        /*
+         * Don't kill the process if any threads are set to OOM_DISABLE
+         */
+        do_each_thread(g, q) {
+                if (q->mm == mm && q->oomkilladj == OOM_DISABLE)
+                        return 1;
+        } while_each_thread(g, q);
        __oom_kill_task(p, 1);
        /*
@@ -377,11 +393,10 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
        struct task_struct *c;
        if (printk_ratelimit()) {
-                task_lock(current);
                printk(KERN_WARNING "%s invoked oom-killer: "
-                        "gfp_mask=0x%x, order=%d, oom_adj=%d\n",
+                        "gfp_mask=0x%x, order=%d, oomkilladj=%d\n",
-                        current->comm, gfp_mask, order,
+                        current->comm, gfp_mask, order, current->oomkilladj);
-                        current->mm ? current->mm->oom_adj : OOM_DISABLE);
+                task_lock(current);
                cpuset_print_task_mems_allowed(current);
                task_unlock(current);
                dump_stack();
@@ -394,9 +409,8 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
        /*
         * If the task is already exiting, don't alarm the sysadmin or kill
         * its children or threads, just set TIF_MEMDIE so it can die quickly
-         * if its mm is still attached.
         */
-        if (p->mm && (p->flags & PF_EXITING)) {
+        if (p->flags & PF_EXITING) {
                __oom_kill_task(p, 0);
                return 0;
        }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d052abbe3063..5cc986eb9f6f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2544,7 +2544,6 @@ static void build_zonelists(pg_data_t *pgdat)
        prev_node = local_node;
        nodes_clear(used_mask);
-        memset(node_load, 0, sizeof(node_load));
        memset(node_order, 0, sizeof(node_order));
        j = 0;
@@ -2653,6 +2652,9 @@ static int __build_all_zonelists(void *dummy)
 {
        int nid;
+#ifdef CONFIG_NUMA
+        memset(node_load, 0, sizeof(node_load));
+#endif
        for_each_online_node(nid) {
                pg_data_t *pgdat = NODE_DATA(nid);
diff --git a/mm/percpu.c b/mm/percpu.c
index b70f2acd8853..5fe37842e0ea 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -8,12 +8,12 @@
 *
 * This is percpu allocator which can handle both static and dynamic
 * areas.  Percpu areas are allocated in chunks in vmalloc area.  Each
- * chunk is consisted of num_possible_cpus() units and the first chunk
+ * chunk is consisted of nr_cpu_ids units and the first chunk is used
- * is used for static percpu variables in the kernel image (special
+ * for static percpu variables in the kernel image (special boot time
- * boot time alloc/init handling necessary as these areas need to be
+ * alloc/init handling necessary as these areas need to be brought up
- * brought up before allocation services are running).  Unit grows as
+ * before allocation services are running).  Unit grows as necessary
- * necessary and all units grow or shrink in unison.  When a chunk is
+ * and all units grow or shrink in unison.  When a chunk is filled up,
- * filled up, another chunk is allocated.  ie. in vmalloc area
+ * another chunk is allocated.  ie. in vmalloc area
 *
 *  c0                           c1                         c2
 *  -------------------          -------------------        ------------
@@ -558,7 +558,7 @@ static void pcpu_free_area(struct pcpu_chunk *chunk, int freeme)
 static void pcpu_unmap(struct pcpu_chunk *chunk, int page_start, int page_end,
                       bool flush_tlb)
 {
-        unsigned int last = num_possible_cpus() - 1;
+        unsigned int last = nr_cpu_ids - 1;
        unsigned int cpu;
        /* unmap must not be done on immutable chunk */
@@ -643,7 +643,7 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size,
 */
 static int pcpu_map(struct pcpu_chunk *chunk, int page_start, int page_end)
 {
-        unsigned int last = num_possible_cpus() - 1;
+        unsigned int last = nr_cpu_ids - 1;
        unsigned int cpu;
        int err;
@@ -749,7 +749,7 @@ static struct pcpu_chunk *alloc_pcpu_chunk(void)
        chunk->map[chunk->map_used++] = pcpu_unit_size;
        chunk->page = chunk->page_ar;
-        chunk->vm = get_vm_area(pcpu_chunk_size, GFP_KERNEL);
+        chunk->vm = get_vm_area(pcpu_chunk_size, VM_ALLOC);
        if (!chunk->vm) {
                free_pcpu_chunk(chunk);
                return NULL;
@@ -1067,9 +1067,9 @@ size_t __init pcpu_setup_first_chunk(pcpu_get_page_fn_t get_page_fn,
                                        PFN_UP(size_sum));
        pcpu_unit_size = pcpu_unit_pages << PAGE_SHIFT;
-        pcpu_chunk_size = num_possible_cpus() * pcpu_unit_size;
+        pcpu_chunk_size = nr_cpu_ids * pcpu_unit_size;
        pcpu_chunk_struct_size = sizeof(struct pcpu_chunk)
-                + num_possible_cpus() * pcpu_unit_pages * sizeof(struct page *);
+                + nr_cpu_ids * pcpu_unit_pages * sizeof(struct page *);
        if (dyn_size < 0)
                dyn_size = pcpu_unit_size - static_size - reserved_size;
@@ -1248,7 +1248,7 @@ ssize_t __init pcpu_embed_first_chunk(size_t static_size, size_t reserved_size,
        } else
                pcpue_unit_size = max_t(size_t, pcpue_size, PCPU_MIN_UNIT_SIZE);
-        chunk_size = pcpue_unit_size * num_possible_cpus();
+        chunk_size = pcpue_unit_size * nr_cpu_ids;
        pcpue_ptr = __alloc_bootmem_nopanic(chunk_size, PAGE_SIZE,
                                            __pa(MAX_DMA_ADDRESS));
@@ -1259,12 +1259,15 @@ ssize_t __init pcpu_embed_first_chunk(size_t static_size, size_t reserved_size,
        }
        /* return the leftover and copy */
-        for_each_possible_cpu(cpu) {
+        for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
                void *ptr = pcpue_ptr + cpu * pcpue_unit_size;
-                free_bootmem(__pa(ptr + pcpue_size),
+                if (cpu_possible(cpu)) {
-                             pcpue_unit_size - pcpue_size);
+                        free_bootmem(__pa(ptr + pcpue_size),
-                memcpy(ptr, __per_cpu_load, static_size);
+                                     pcpue_unit_size - pcpue_size);
+                        memcpy(ptr, __per_cpu_load, static_size);
+                } else
+                        free_bootmem(__pa(ptr), pcpue_unit_size);
        }
        /* we're ready, commit */
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index bfbe13786bb4..875eda5dbad7 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1238,6 +1238,7 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
                        return -ENOBUFS;
        *uaddr_len = sizeof(struct sockaddr_at);
+        memset(&sat.sat_zero, 0, sizeof(sat.sat_zero));
        if (peer) {
                if (sk->sk_state != TCP_ESTABLISHED)
diff --git a/net/can/raw.c b/net/can/raw.c
index f4cc44548bda..db3152df7d2b 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -401,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
        if (peer)
                return -EOPNOTSUPP;
+        memset(addr, 0, sizeof(*addr));
        addr->can_family  = AF_CAN;
        addr->can_ifindex = ro->ifindex;
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 78e5bfc454ae..493775f4f2f1 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -81,7 +81,7 @@
 struct gen_estimator
 {
        struct list_head        list;
-        struct gnet_stats_basic *bstats;
+        struct gnet_stats_basic_packed  *bstats;
        struct gnet_stats_rate_est      *rate_est;
        spinlock_t              *stats_lock;
        int                     ewma_log;
@@ -165,7 +165,7 @@ static void gen_add_node(struct gen_estimator *est)
 }
 static
-struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
+struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats,
                                    const struct gnet_stats_rate_est *rate_est)
 {
        struct rb_node *p = est_root.rb_node;
@@ -202,7 +202,7 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
 *
 * NOTE: Called under rtnl_mutex
 */
-int gen_new_estimator(struct gnet_stats_basic *bstats,
+int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                      struct gnet_stats_rate_est *rate_est,
                      spinlock_t *stats_lock,
                      struct nlattr *opt)
@@ -262,7 +262,7 @@ static void __gen_kill_estimator(struct rcu_head *head)
 *
 * NOTE: Called under rtnl_mutex
 */
-void gen_kill_estimator(struct gnet_stats_basic *bstats,
+void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                        struct gnet_stats_rate_est *rate_est)
 {
        struct gen_estimator *e;
@@ -292,7 +292,7 @@ EXPORT_SYMBOL(gen_kill_estimator);
 *
 * Returns 0 on success or a negative error code.
 */
-int gen_replace_estimator(struct gnet_stats_basic *bstats,
+int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
                          struct gnet_stats_rate_est *rate_est,
                          spinlock_t *stats_lock, struct nlattr *opt)
 {
@@ -308,7 +308,7 @@ EXPORT_SYMBOL(gen_replace_estimator);
 *
 * Returns true if estimator is active, and false if not.
 */
-bool gen_estimator_active(const struct gnet_stats_basic *bstats,
+bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                          const struct gnet_stats_rate_est *rate_est)
 {
        ASSERT_RTNL();
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index c3d0ffeac243..8569310268ab 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -106,16 +106,21 @@ gnet_stats_start_copy(struct sk_buff *skb, int type, spinlock_t *lock,
 * if the room in the socket buffer was not sufficient.
 */
 int
-gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic *b)
+gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
 {
        if (d->compat_tc_stats) {
                d->tc_stats.bytes = b->bytes;
                d->tc_stats.packets = b->packets;
        }
-        if (d->tail)
+        if (d->tail) {
-                return gnet_stats_copy(d, TCA_STATS_BASIC, b, sizeof(*b));
+                struct gnet_stats_basic sb;
+                memset(&sb, 0, sizeof(sb));
+                sb.bytes = b->bytes;
+                sb.packets = b->packets;
+                return gnet_stats_copy(d, TCA_STATS_BASIC, &sb, sizeof(sb));
+        }
        return 0;
 }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index df30feb2fc72..1b76eb11deb4 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -319,6 +319,11 @@ static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
                        udelay(USEC_PER_POLL);
                }
+                WARN_ONCE(!irqs_disabled(),
+                        "netpoll_send_skb(): %s enabled interrupts in poll (%pF)\n",
+                        dev->name, ops->ndo_start_xmit);
                local_irq_restore(flags);
        }
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 3281013ce038..1bca9205104e 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1159,6 +1159,7 @@ static void __exit dccp_fini(void)
        kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
        dccp_ackvec_exit();
        dccp_sysctl_exit();
+        percpu_counter_destroy(&dccp_orphan_count);
 }
 module_init(dccp_init);
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 2e1f836d4240..f0bbc57926cd 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -520,6 +520,7 @@ static int econet_getname(struct socket *sock, struct sockaddr *uaddr,
        if (peer)
                return -EOPNOTSUPP;
+        memset(sec, 0, sizeof(*sec));
        mutex_lock(&econet_mutex);
        sk = sock->sk;
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 3bb6bdb1dac1..af661805b9fa 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -136,7 +136,7 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
                unsigned int cmd)
 {
        struct ifreq ifr;
-        int ret = -EINVAL;
+        int ret = -ENOIOCTLCMD;
        struct net_device *dev;
        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
@@ -146,8 +146,10 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
        dev_load(sock_net(sk), ifr.ifr_name);
        dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
-        if (dev->type == ARPHRD_IEEE802154 ||
-            dev->type == ARPHRD_IEEE802154_PHY)
+        if ((dev->type == ARPHRD_IEEE802154 ||
+             dev->type == ARPHRD_IEEE802154_PHY) &&
+            dev->netdev_ops->ndo_do_ioctl)
                ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
        if (!ret && copy_to_user(arg, &ifr, sizeof(struct ifreq)))
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 14d39840dd62..ba8b214dda8f 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -377,6 +377,18 @@ int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
        return ret;
 }
+static int dgram_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        return -EOPNOTSUPP;
+}
+static int dgram_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        return -EOPNOTSUPP;
+}
 struct proto ieee802154_dgram_prot = {
        .name           = "IEEE-802.15.4-MAC",
        .owner          = THIS_MODULE,
@@ -391,5 +403,7 @@ struct proto ieee802154_dgram_prot = {
        .connect        = dgram_connect,
        .disconnect     = dgram_disconnect,
        .ioctl          = dgram_ioctl,
+        .getsockopt     = dgram_getsockopt,
+        .setsockopt     = dgram_setsockopt,
 };
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index fca44d59f97e..9315977c4c61 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -238,6 +238,18 @@ void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb)
        read_unlock(&raw_lock);
 }
+static int raw_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        return -EOPNOTSUPP;
+}
+static int raw_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        return -EOPNOTSUPP;
+}
 struct proto ieee802154_raw_prot = {
        .name           = "IEEE-802.15.4-RAW",
        .owner          = THIS_MODULE,
@@ -250,5 +262,7 @@ struct proto ieee802154_raw_prot = {
        .unhash         = raw_unhash,
        .connect        = raw_connect,
        .disconnect     = raw_disconnect,
+        .getsockopt     = raw_getsockopt,
+        .setsockopt     = raw_setsockopt,
 };
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index cb4a0f4bd5e5..82c11dd10a62 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -951,7 +951,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
                        addend += 4;
        }
        dev->needed_headroom = addend + hlen;
-        mtu -= dev->hard_header_len - addend;
+        mtu -= dev->hard_header_len + addend;
        if (mtu < 68)
                mtu = 68;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index caa0278d30a9..45f9a2a42d56 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -306,8 +306,10 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                    v4addr != htonl(INADDR_ANY) &&
                    chk_addr_ret != RTN_LOCAL &&
                    chk_addr_ret != RTN_MULTICAST &&
-                    chk_addr_ret != RTN_BROADCAST)
+                    chk_addr_ret != RTN_BROADCAST) {
+                        err = -EADDRNOTAVAIL;
                        goto out;
+                }
        } else {
                if (addr_type != IPV6_ADDR_ANY) {
                        struct net_device *dev = NULL;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 80cf29aae096..50b43c57d5d8 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -715,6 +715,7 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
        struct sock *sk = sock->sk;
        struct irda_sock *self = irda_sk(sk);
+        memset(&saddr, 0, sizeof(saddr));
        if (peer) {
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -ENOTCONN;
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 9208cf5f2bd5..c45eee1c0e8d 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -914,6 +914,7 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
        struct llc_sock *llc = llc_sk(sk);
        int rc = 0;
+        memset(&sllc, 0, sizeof(sllc));
        lock_sock(sk);
        if (sock_flag(sk, SOCK_ZAPPED))
                goto out;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 9e5762ad307d..a24e59816b93 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -381,6 +381,14 @@ static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
                &local->hw, queue,
                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        if (!(sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK))
+                return;
+        if (WARN(!sta->ampdu_mlme.tid_tx[tid],
+                 "TID %d gone but expected when splicing aggregates from"
+                 "the pending queue\n", tid))
+                return;
        if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                /* mark queue as pending, it is stopped already */
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ce267565e180..659a42d529e3 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -67,6 +67,8 @@ static DECLARE_WORK(todo_work, key_todo);
 *
 * @key: key to add to do item for
 * @flag: todo flag(s)
+ *
+ * Must be called with IRQs or softirqs disabled.
 */
 static void add_todo(struct ieee80211_key *key, u32 flag)
 {
@@ -140,9 +142,9 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
        ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf);
        if (!ret) {
-                spin_lock(&todo_lock);
+                spin_lock_bh(&todo_lock);
                key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
        }
        if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
@@ -164,12 +166,12 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
        if (!key || !key->local->ops->set_key)
                return;
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
        if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
                return;
        }
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
        sta = get_sta_for_key(key);
        sdata = key->sdata;
@@ -188,9 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                       wiphy_name(key->local->hw.wiphy),
                       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
        key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 }
 static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
@@ -437,14 +439,14 @@ void ieee80211_key_link(struct ieee80211_key *key,
        __ieee80211_key_replace(sdata, sta, old_key, key);
-        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
        /* free old key later */
        add_todo(old_key, KEY_FLAG_TODO_DELETE);
        add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
        if (netif_running(sdata->dev))
                add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 }
 static void __ieee80211_key_free(struct ieee80211_key *key)
@@ -547,7 +549,7 @@ static void __ieee80211_key_todo(void)
         */
        synchronize_rcu();
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
        while (!list_empty(&todo_list)) {
                key = list_first_entry(&todo_list, struct ieee80211_key, todo);
                list_del_init(&key->todo);
@@ -558,7 +560,7 @@ static void __ieee80211_key_todo(void)
                                          KEY_FLAG_TODO_HWACCEL_REMOVE |
                                          KEY_FLAG_TODO_DELETE);
                key->flags &= ~todoflags;
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
                work_done = false;
@@ -591,9 +593,9 @@ static void __ieee80211_key_todo(void)
                WARN_ON(!work_done);
-                spin_lock(&todo_lock);
+                spin_lock_bh(&todo_lock);
        }
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 }
 void ieee80211_key_todo(void)
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index 43f5676b1af4..d80b8192e0d4 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -74,7 +74,7 @@ static unsigned int
 xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
        const struct xt_rateest_target_info *info = par->targinfo;
-        struct gnet_stats_basic *stats = &info->est->bstats;
+        struct gnet_stats_basic_packed *stats = &info->est->bstats;
        spin_lock_bh(&info->est->lock);
        stats->bytes += skb->len;
diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c
index 98fc190e8f0e..390b7d09fe51 100644
--- a/net/netfilter/xt_quota.c
+++ b/net/netfilter/xt_quota.c
@@ -52,7 +52,7 @@ static bool quota_mt_check(const struct xt_mtchk_param *par)
        q->master = kmalloc(sizeof(*q->master), GFP_KERNEL);
        if (q->master == NULL)
-                return -ENOMEM;
+                return false;
        q->master->quota = q->quota;
        return true;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ce51ce012cda..ce1a34b99c23 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -847,6 +847,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
                sax->fsa_ax25.sax25_family = AF_NETROM;
                sax->fsa_ax25.sax25_ndigis = 1;
                sax->fsa_ax25.sax25_call   = nr->user_addr;
+                memset(sax->fsa_digipeater, 0, sizeof(sax->fsa_digipeater));
                sax->fsa_digipeater[0]     = nr->dest_addr;
                *uaddr_len = sizeof(struct full_sockaddr_ax25);
        } else {
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index e943c16552a2..4eb1ac9a7679 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -630,23 +630,23 @@ out:
        return dev;
 }
-static ax25_digi *nr_call_to_digi(int ndigis, ax25_address *digipeaters)
+static ax25_digi *nr_call_to_digi(ax25_digi *digi, int ndigis,
+        ax25_address *digipeaters)
 {
-        static ax25_digi ax25_digi;
        int i;
        if (ndigis == 0)
                return NULL;
        for (i = 0; i < ndigis; i++) {
-                ax25_digi.calls[i]    = digipeaters[i];
+                digi->calls[i]    = digipeaters[i];
-                ax25_digi.repeated[i] = 0;
+                digi->repeated[i] = 0;
        }
-        ax25_digi.ndigi      = ndigis;
+        digi->ndigi      = ndigis;
-        ax25_digi.lastrepeat = -1;
+        digi->lastrepeat = -1;
-        return &ax25_digi;
+        return digi;
 }
 /*
@@ -656,6 +656,7 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
 {
        struct nr_route_struct nr_route;
        struct net_device *dev;
+        ax25_digi digi;
        int ret;
        switch (cmd) {
@@ -673,13 +674,15 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
                        ret = nr_add_node(&nr_route.callsign,
                                nr_route.mnemonic,
                                &nr_route.neighbour,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                dev, nr_route.quality,
                                nr_route.obs_count);
                        break;
                case NETROM_NEIGH:
                        ret = nr_add_neigh(&nr_route.callsign,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                dev, nr_route.quality);
                        break;
                default:
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index b0d6ddd82a9d..c2b77a698695 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -96,7 +96,7 @@ struct net_device *phonet_device_get(struct net *net)
 {
        struct phonet_device_list *pndevs = phonet_device_list(net);
        struct phonet_device *pnd;
-        struct net_device *dev;
+        struct net_device *dev = NULL;
        spin_lock_bh(&pndevs->lock);
        list_for_each_entry(pnd, &pndevs->list, list) {
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index f0a76f6bca71..e5f478ca3d61 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -954,6 +954,7 @@ static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
        struct rose_sock *rose = rose_sk(sk);
        int n;
+        memset(srose, 0, sizeof(*srose));
        if (peer != 0) {
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -ENOTCONN;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 24d17ce9c294..e1c2bf7e9ba4 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -468,8 +468,8 @@ static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 void qdisc_watchdog_init(struct qdisc_watchdog *wd, struct Qdisc *qdisc)
 {
-        hrtimer_init(&wd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        tasklet_hrtimer_init(&wd->timer, qdisc_watchdog,
-        wd->timer.function = qdisc_watchdog;
+                             CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
        wd->qdisc = qdisc;
 }
 EXPORT_SYMBOL(qdisc_watchdog_init);
@@ -485,13 +485,13 @@ void qdisc_watchdog_schedule(struct qdisc_watchdog *wd, psched_time_t expires)
        wd->qdisc->flags |= TCQ_F_THROTTLED;
        time = ktime_set(0, 0);
        time = ktime_add_ns(time, PSCHED_TICKS2NS(expires));
-        hrtimer_start(&wd->timer, time, HRTIMER_MODE_ABS);
+        tasklet_hrtimer_start(&wd->timer, time, HRTIMER_MODE_ABS);
 }
 EXPORT_SYMBOL(qdisc_watchdog_schedule);
 void qdisc_watchdog_cancel(struct qdisc_watchdog *wd)
 {
-        hrtimer_cancel(&wd->timer);
+        tasklet_hrtimer_cancel(&wd->timer);
        wd->qdisc->flags &= ~TCQ_F_THROTTLED;
 }
 EXPORT_SYMBOL(qdisc_watchdog_cancel);
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 2a8b83af7c47..ab82f145f689 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -49,7 +49,7 @@ struct atm_flow_data {
        struct socket           *sock;          /* for closing */
        u32                     classid;        /* x:y type ID */
        int                     ref;            /* reference count */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed  bstats;
        struct gnet_stats_queue qstats;
        struct atm_flow_data    *next;
        struct atm_flow_data    *excess;        /* flow for excess traffic;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 23a167670fd5..81652d6ccd36 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -128,7 +128,7 @@ struct cbq_class
        long                    avgidle;
        long                    deficit;        /* Saved deficit for WRR */
        psched_time_t           penalized;
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
        struct gnet_stats_queue qstats;
        struct gnet_stats_rate_est rate_est;
        struct tc_cbq_xstats    xstats;
@@ -163,7 +163,7 @@ struct cbq_sched_data
        psched_time_t           now_rt;         /* Cached real time */
        unsigned                pmask;
-        struct hrtimer          delay_timer;
+        struct tasklet_hrtimer  delay_timer;
        struct qdisc_watchdog   watchdog;       /* Watchdog timer,
                                                   started when CBQ has
                                                   backlog, but cannot
@@ -503,6 +503,8 @@ static void cbq_ovl_delay(struct cbq_class *cl)
                cl->undertime = q->now + delay;
                if (delay > 0) {
+                        struct hrtimer *ht;
                        sched += delay + cl->penalty;
                        cl->penalized = sched;
                        cl->cpriority = TC_CBQ_MAXPRIO;
@@ -510,12 +512,12 @@ static void cbq_ovl_delay(struct cbq_class *cl)
                        expires = ktime_set(0, 0);
                        expires = ktime_add_ns(expires, PSCHED_TICKS2NS(sched));
-                        if (hrtimer_try_to_cancel(&q->delay_timer) &&
+                        ht = &q->delay_timer.timer;
-                            ktime_to_ns(ktime_sub(
+                        if (hrtimer_try_to_cancel(ht) &&
-                                        hrtimer_get_expires(&q->delay_timer),
+                            ktime_to_ns(ktime_sub(hrtimer_get_expires(ht),
-                                        expires)) > 0)
+                                                  expires)) > 0)
-                                hrtimer_set_expires(&q->delay_timer, expires);
+                                hrtimer_set_expires(ht, expires);
-                        hrtimer_restart(&q->delay_timer);
+                        hrtimer_restart(ht);
                        cl->delayed = 1;
                        cl->xstats.overactions++;
                        return;
@@ -621,7 +623,7 @@ static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
                time = ktime_set(0, 0);
                time = ktime_add_ns(time, PSCHED_TICKS2NS(now + delay));
-                hrtimer_start(&q->delay_timer, time, HRTIMER_MODE_ABS);
+                tasklet_hrtimer_start(&q->delay_timer, time, HRTIMER_MODE_ABS);
        }
        sch->flags &= ~TCQ_F_THROTTLED;
@@ -1214,7 +1216,7 @@ cbq_reset(struct Qdisc* sch)
        q->tx_class = NULL;
        q->tx_borrowed = NULL;
        qdisc_watchdog_cancel(&q->watchdog);
-        hrtimer_cancel(&q->delay_timer);
+        tasklet_hrtimer_cancel(&q->delay_timer);
        q->toplevel = TC_CBQ_MAXLEVEL;
        q->now = psched_get_time();
        q->now_rt = q->now;
@@ -1397,7 +1399,8 @@ static int cbq_init(struct Qdisc *sch, struct nlattr *opt)
        q->link.minidle = -0x7FFFFFFF;
        qdisc_watchdog_init(&q->watchdog, sch);
-        hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        tasklet_hrtimer_init(&q->delay_timer, cbq_undelay,
+                             CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
        q->delay_timer.function = cbq_undelay;
        q->toplevel = TC_CBQ_MAXLEVEL;
        q->now = psched_get_time();
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 7597fe146866..12b2fb04b29b 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -22,7 +22,7 @@ struct drr_class {
        unsigned int                    refcnt;
        unsigned int                    filter_cnt;
-        struct gnet_stats_basic         bstats;
+        struct gnet_stats_basic_packed          bstats;
        struct gnet_stats_queue         qstats;
        struct gnet_stats_rate_est      rate_est;
        struct list_head                alist;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 362c2811b2df..dad0144423da 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -116,7 +116,7 @@ struct hfsc_class
        struct Qdisc_class_common cl_common;
        unsigned int    refcnt;         /* usage count */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
        struct gnet_stats_queue qstats;
        struct gnet_stats_rate_est rate_est;
        unsigned int    level;          /* class level in hierarchy */
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 88cd02626621..ec4d46399d59 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -74,7 +74,7 @@ enum htb_cmode {
 struct htb_class {
        struct Qdisc_class_common common;
        /* general class parameters */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
        struct gnet_stats_queue qstats;
        struct gnet_stats_rate_est rate_est;
        struct tc_htb_xstats xstats;    /* our special stats */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 79cbd47f4df7..a76da657244a 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -160,6 +160,7 @@ static void sctp_proc_exit(void)
                remove_proc_entry("sctp", init_net.proc_net);
        }
 #endif
+        percpu_counter_destroy(&sctp_sockets_allocated);
 }
 /* Private helper to extract ipv4 address and stash them in
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index d401dc8f05ed..e5195c99f71e 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -16,7 +16,7 @@ static inline unsigned int __xfrm6_addr_hash(xfrm_address_t *addr)
 static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        return ntohl(daddr->a4 ^ saddr->a4);
+        return ntohl(daddr->a4 + saddr->a4);
 }
 static inline unsigned int __xfrm6_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
diff --git a/security/Kconfig b/security/Kconfig
index 9c60c346a91d..4c865345caa0 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -114,9 +114,9 @@ config SECURITY_ROOTPLUG
          If you are unsure how to answer this question, answer N.
 config LSM_MMAP_MIN_ADDR
-        int "Low address space for LSM to from user allocation"
+        int "Low address space for LSM to protect from user allocation"
        depends on SECURITY && SECURITY_SELINUX
-        default 65535
+        default 65536
        help
          This is the portion of low virtual memory which should be protected
          from userspace allocation.  Keeping a user from writing to low pages
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 63003a63aaee..46642a19bc78 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -45,9 +45,9 @@ int ima_calc_hash(struct file *file, char *digest)
 {
        struct hash_desc desc;
        struct scatterlist sg[1];
-        loff_t i_size;
+        loff_t i_size, offset = 0;
        char *rbuf;
-        int rc, offset = 0;
+        int rc;
        rc = init_desc(&desc);
        if (rc != 0)
@@ -67,6 +67,8 @@ int ima_calc_hash(struct file *file, char *digest)
                        rc = rbuf_len;
                        break;
                }
+                if (rbuf_len == 0)
+                        break;
                offset += rbuf_len;
                sg_init_one(sg, rbuf, rbuf_len);
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 72cfd47af6b8..9db60d831bb2 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -943,47 +943,24 @@ static int snd_interval_ratden(struct snd_interval *i,
 int snd_interval_list(struct snd_interval *i, unsigned int count, unsigned int *list, unsigned int mask)
 {
        unsigned int k;
-        int changed = 0;
+        struct snd_interval list_range;
        if (!count) {
                i->empty = 1;
                return -EINVAL;
        }
+        snd_interval_any(&list_range);
+        list_range.min = UINT_MAX;
+        list_range.max = 0;
        for (k = 0; k < count; k++) {
                if (mask && !(mask & (1 << k)))
                        continue;
-                if (i->min == list[k] && !i->openmin)
+                if (!snd_interval_test(i, list[k]))
-                        goto _l1;
-                if (i->min < list[k]) {
-                        i->min = list[k];
-                        i->openmin = 0;
-                        changed = 1;
-                        goto _l1;
-                }
-        }
-        i->empty = 1;
-        return -EINVAL;
- _l1:
-        for (k = count; k-- > 0;) {
-                if (mask && !(mask & (1 << k)))
                        continue;
-                if (i->max == list[k] && !i->openmax)
+                list_range.min = min(list_range.min, list[k]);
-                        goto _l2;
+                list_range.max = max(list_range.max, list[k]);
-                if (i->max > list[k]) {
-                        i->max = list[k];
-                        i->openmax = 0;
-                        changed = 1;
-                        goto _l2;
-                }
        }
-        i->empty = 1;
+        return snd_interval_refine(i, &list_range);
-        return -EINVAL;
- _l2:
-        if (snd_interval_checkempty(i)) {
-                i->empty = 1;
-                return -EINVAL;
-        }
-        return changed;
 }
 EXPORT_SYMBOL(snd_interval_list);
diff --git a/sound/pci/ali5451/ali5451.c b/sound/pci/ali5451/ali5451.c
index c551006e2920..76d76c08339b 100644
--- a/sound/pci/ali5451/ali5451.c
+++ b/sound/pci/ali5451/ali5451.c
@@ -310,12 +310,16 @@ static int snd_ali_codec_ready(struct snd_ali *codec,
        unsigned int res;
        
        end_time = jiffies + msecs_to_jiffies(250);
-        do {
+        for (;;) {
                res = snd_ali_5451_peek(codec,port);
                if (!(res & 0x8000))
                        return 0;
+                if (!time_after_eq(end_time, jiffies))
+                        break;
                schedule_timeout_uninterruptible(1);
-        } while (time_after_eq(end_time, jiffies));
+        }
        snd_ali_5451_poke(codec, port, res & ~0x8000);
        snd_printdd("ali_codec_ready: codec is not ready.\n ");
        return -EIO;
@@ -327,15 +331,17 @@ static int snd_ali_stimer_ready(struct snd_ali *codec)
        unsigned long dwChk1,dwChk2;
        
        dwChk1 = snd_ali_5451_peek(codec, ALI_STIMER);
-        dwChk2 = snd_ali_5451_peek(codec, ALI_STIMER);
        end_time = jiffies + msecs_to_jiffies(250);
-        do {
+        for (;;) {
                dwChk2 = snd_ali_5451_peek(codec, ALI_STIMER);
                if (dwChk2 != dwChk1)
                        return 0;
+                if (!time_after_eq(end_time, jiffies))
+                        break;
                schedule_timeout_uninterruptible(1);
-        } while (time_after_eq(end_time, jiffies));
+        }
        snd_printk(KERN_ERR "ali_stimer_read: stimer is not ready.\n");
        return -EIO;
 }
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 3da85caf8af1..403588c6e3f6 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3835,9 +3835,11 @@ static struct hda_verb ad1884a_laptop_verbs[] = {
        /* Port-F (int speaker) mixer - route only from analog mixer */
        {0x0b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
        {0x0b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(1)},
-        /* Port-F pin */
+        /* Port-F (int speaker) pin */
-        {0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
+        {0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
        {0x16, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE},
+        /* required for compaq 6530s/6531s speaker output */
+        {0x1c, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
        /* Port-C pin - internal mic-in */
        {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
        {0x14, AC_VERB_SET_AMP_GAIN_MUTE, 0x7002}, /* raise mic as default */
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index fea976793ae5..6f683e451f2b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -12521,8 +12521,6 @@ static struct snd_pci_quirk alc268_cfg_tbl[] = {
                           ALC268_TOSHIBA),
        SND_PCI_QUIRK(0x1043, 0x1205, "ASUS W7J", ALC268_3ST),
        SND_PCI_QUIRK(0x1170, 0x0040, "ZEPTO", ALC268_ZEPTO),
-        SND_PCI_QUIRK_MASK(0x1179, 0xff00, 0xff00, "TOSHIBA A/Lx05",
-                           ALC268_TOSHIBA),
        SND_PCI_QUIRK(0x14c0, 0x0025, "COMPAL IFL90/JFL-92", ALC268_TOSHIBA),
        SND_PCI_QUIRK(0x152d, 0x0763, "Diverse (CPR2000)", ALC268_ACER),
        SND_PCI_QUIRK(0x152d, 0x0771, "Quanta IL1", ALC267_QUANTA_IL1),
@@ -12530,6 +12528,15 @@ static struct snd_pci_quirk alc268_cfg_tbl[] = {
        {}
 };
+/* Toshiba laptops have no unique PCI SSID but only codec SSID */
+static struct snd_pci_quirk alc268_ssid_cfg_tbl[] = {
+        SND_PCI_QUIRK(0x1179, 0xff0a, "TOSHIBA X-200", ALC268_AUTO),
+        SND_PCI_QUIRK(0x1179, 0xff0e, "TOSHIBA X-200 HDMI", ALC268_AUTO),
+        SND_PCI_QUIRK_MASK(0x1179, 0xff00, 0xff00, "TOSHIBA A/Lx05",
+                           ALC268_TOSHIBA),
+        {}
+};
 static struct alc_config_preset alc268_presets[] = {
        [ALC267_QUANTA_IL1] = {
                .mixers = { alc267_quanta_il1_mixer, alc268_beep_mixer },
@@ -12696,6 +12703,10 @@ static int patch_alc268(struct hda_codec *codec)
                                                  alc268_models,
                                                  alc268_cfg_tbl);
+        if (board_config < 0 || board_config >= ALC268_MODEL_LAST)
+                board_config = snd_hda_check_board_codec_sid_config(codec,
+                        ALC882_MODEL_LAST, alc268_models, alc268_ssid_cfg_tbl);
        if (board_config < 0 || board_config >= ALC268_MODEL_LAST) {
                printk(KERN_INFO "hda_codec: Unknown model for %s, "
                       "trying auto-probe from BIOS...\n", codec->chip_name);
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 456ef6ac12e4..6990cfcb6a38 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -76,6 +76,7 @@ enum {
        STAC_92HD73XX_AUTO,
        STAC_92HD73XX_NO_JD, /* no jack-detection */
        STAC_92HD73XX_REF,
+        STAC_92HD73XX_INTEL,
        STAC_DELL_M6_AMIC,
        STAC_DELL_M6_DMIC,
        STAC_DELL_M6_BOTH,
@@ -1777,6 +1778,7 @@ static const char *stac92hd73xx_models[STAC_92HD73XX_MODELS] = {
        [STAC_92HD73XX_AUTO] = "auto",
        [STAC_92HD73XX_NO_JD] = "no-jd",
        [STAC_92HD73XX_REF] = "ref",
+        [STAC_92HD73XX_INTEL] = "intel",
        [STAC_DELL_M6_AMIC] = "dell-m6-amic",
        [STAC_DELL_M6_DMIC] = "dell-m6-dmic",
        [STAC_DELL_M6_BOTH] = "dell-m6",
@@ -1789,6 +1791,10 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
                                "DFI LanParty", STAC_92HD73XX_REF),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DFI, 0x3101,
                                "DFI LanParty", STAC_92HD73XX_REF),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5002,
+                                "Intel DG45ID", STAC_92HD73XX_INTEL),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5003,
+                                "Intel DG45FC", STAC_92HD73XX_INTEL),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0254,
                                "Dell Studio 1535", STAC_DELL_M6_DMIC),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0255,
diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c
index 6416d3f0c7be..a69e774d0b13 100644
--- a/sound/pci/vx222/vx222_ops.c
+++ b/sound/pci/vx222/vx222_ops.c
@@ -885,10 +885,10 @@ static int vx_input_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem
        struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
        struct snd_vx222 *chip = (struct snd_vx222 *)_chip;
        if (ucontrol->value.integer.value[0] < 0 ||
-            ucontrol->value.integer.value[0] < MIC_LEVEL_MAX)
+            ucontrol->value.integer.value[0] > MIC_LEVEL_MAX)
                return -EINVAL;
        if (ucontrol->value.integer.value[1] < 0 ||
-            ucontrol->value.integer.value[1] < MIC_LEVEL_MAX)
+            ucontrol->value.integer.value[1] > MIC_LEVEL_MAX)
                return -EINVAL;
        mutex_lock(&_chip->mixer_mutex);
        if (chip->input_level[0] != ucontrol->value.integer.value[0] ||
diff --git a/tools/perf/Documentation/Makefile b/tools/perf/Documentation/Makefile
index 5457192e1b41..bdd3b7ecad0a 100644
--- a/tools/perf/Documentation/Makefile
+++ b/tools/perf/Documentation/Makefile
@@ -35,7 +35,7 @@ man7dir=$(mandir)/man7
 # DESTDIR=
 ASCIIDOC=asciidoc
-ASCIIDOC_EXTRA =
+ASCIIDOC_EXTRA = --unsafe
 MANPAGE_XSL = manpage-normal.xsl
 XMLTO_EXTRA =
 INSTALL?=install
diff --git a/tools/perf/Documentation/perf-examples.txt b/tools/perf/Documentation/examples.txt
index 8eb6c489fb15..8eb6c489fb15 100644
--- a/tools/perf/Documentation/perf-examples.txt
+++ b/tools/perf/Documentation/examples.txt
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 1dba568e1941..343e7b14bf01 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -980,6 +980,13 @@ process_fork_event(event_t *event, unsigned long offset, unsigned long head)
                (void *)(long)(event->header.size),
                event->fork.pid, event->fork.ppid);
+        /*
+         * A thread clone will have the same PID for both
+         * parent and child.
+         */
+        if (thread == parent)
+                return 0;
        if (!thread || !parent || thread__fork(thread, parent)) {
                dprintf("problem processing PERF_EVENT_FORK, skipping event.\n");
                return -1;
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 3d051b9cf25f..89a5ddcd1ded 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -219,7 +219,7 @@ static pid_t pid_synthesize_comm_event(pid_t pid, int full)
        snprintf(filename, sizeof(filename), "/proc/%d/status", pid);
        fp = fopen(filename, "r");
-        if (fd == NULL) {
+        if (fp == NULL) {
                /*
                 * We raced with a task exiting - just return:
                 */