101 files changed, 989 insertions, 697 deletions

diff --git a/Documentation/ioctl/cdrom.txt b/Documentation/ioctl/cdrom.txt
index 62d4af44ec4a..59df81c8da2b 100644
--- a/Documentation/ioctl/cdrom.txt
+++ b/Documentation/ioctl/cdrom.txt
@@ -271,14 +271,14 @@ CDROMCLOSETRAY			pendant of CDROMEJECT
 
         usage:
 
-          ioctl(fd, CDROMEJECT, 0);
+          ioctl(fd, CDROMCLOSETRAY, 0);
 
         inputs:         none
 
         outputs:        none
 
         error returns:
-          ENOSYS        cd drive not capable of ejecting
+          ENOSYS        cd drive not capable of closing the tray
           EBUSY         other processes are accessing drive, or door is locked
 
         notes:
diff --git a/MAINTAINERS b/MAINTAINERS
index 42ebbfdc350b..3596d1782264 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1984,7 +1984,7 @@ S:	Maintained
 I2C/SMBUS STUB DRIVER
 P:      Mark M. Hoffman
 M:      mhoffman@lightlink.com
-L:      lm-sensors@lm-sensors.org
+L:      i2c@lm-sensors.org
 S:      Maintained
 
 I2C SUBSYSTEM
@@ -3726,7 +3726,7 @@ S:	Maintained
 SIS 96X I2C/SMBUS DRIVER
 P:      Mark M. Hoffman
 M:      mhoffman@lightlink.com
-L:      lm-sensors@lm-sensors.org
+L:      i2c@lm-sensors.org
 S:      Maintained
 
 SIS FRAMEBUFFER DRIVER
diff --git a/Makefile b/Makefile
index cab896a97296..1d03c1644ddb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 27
-EXTRAVERSION = -rc7
+EXTRAVERSION = -rc8
 NAME = Rotary Wombat
 
 # *DOCUMENTATION*
diff --git a/arch/arm/kernel/kgdb.c b/arch/arm/kernel/kgdb.c
index aaffaecffcd1..ba8ccfede964 100644
--- a/arch/arm/kernel/kgdb.c
+++ b/arch/arm/kernel/kgdb.c
@@ -111,8 +111,6 @@ int kgdb_arch_handle_exception(int exception_vector, int signo,
         case 'D':
         case 'k':
         case 'c':
-                kgdb_contthread = NULL;
-
                 /*
                  * Try to read optional parameter, pc unchanged if no parm.
                  * If this was a compiled breakpoint, we need to move
diff --git a/arch/arm/mach-pxa/time.c b/arch/arm/mach-pxa/time.c
index 67e18509d7bf..b0d6b32654cf 100644
--- a/arch/arm/mach-pxa/time.c
+++ b/arch/arm/mach-pxa/time.c
@@ -17,9 +17,9 @@
 #include <linux/interrupt.h>
 #include <linux/clockchips.h>
 #include <linux/sched.h>
+#include <linux/cnt32_to_63.h>
 
 #include <asm/div64.h>
-#include <asm/cnt32_to_63.h>
 #include <asm/mach/irq.h>
 #include <asm/mach/time.h>
 #include <mach/pxa-regs.h>
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index 1362994c78aa..b422526f6d8b 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -18,9 +18,9 @@
 #include <linux/ioport.h>
 #include <linux/sched.h>        /* just for sched_clock() - funny that */
 #include <linux/platform_device.h>
+#include <linux/cnt32_to_63.h>
 
 #include <asm/div64.h>
-#include <asm/cnt32_to_63.h>
 #include <mach/hardware.h>
 #include <asm/system.h>
 #include <asm/pgtable.h>
diff --git a/arch/arm/mach-versatile/core.c b/arch/arm/mach-versatile/core.c
index d75e795c893e..b638f10411e8 100644
--- a/arch/arm/mach-versatile/core.c
+++ b/arch/arm/mach-versatile/core.c
@@ -28,8 +28,8 @@
 #include <linux/amba/clcd.h>
 #include <linux/clocksource.h>
 #include <linux/clockchips.h>
+#include <linux/cnt32_to_63.h>
 
-#include <asm/cnt32_to_63.h>
 #include <asm/system.h>
 #include <mach/hardware.h>
 #include <asm/io.h>
diff --git a/arch/ia64/include/asm/sections.h b/arch/ia64/include/asm/sections.h
index f66799891036..1a873b36a4a1 100644
--- a/arch/ia64/include/asm/sections.h
+++ b/arch/ia64/include/asm/sections.h
@@ -11,6 +11,9 @@
 #include <asm-generic/sections.h>
 
 extern char __per_cpu_start[], __per_cpu_end[], __phys_per_cpu_start[];
+#ifdef  CONFIG_SMP
+extern char __cpu0_per_cpu[];
+#endif
 extern char __start___vtop_patchlist[], __end___vtop_patchlist[];
 extern char __start___rse_patchlist[], __end___rse_patchlist[];
 extern char __start___mckinley_e9_bundles[], __end___mckinley_e9_bundles[];
diff --git a/arch/ia64/kernel/head.S b/arch/ia64/kernel/head.S
index 8bdea8eb62e3..66e491d8baac 100644
--- a/arch/ia64/kernel/head.S
+++ b/arch/ia64/kernel/head.S
@@ -367,16 +367,17 @@ start_ap:
         ;;
 #else
 (isAP)  br.few 2f
-        mov r20=r19
-        sub r19=r19,r18
+        movl r20=__cpu0_per_cpu
         ;;
         shr.u r18=r18,3
 1:
-        ld8 r21=[r20],8;;
-        st8[r19]=r21,8
+        ld8 r21=[r19],8;;
+        st8[r20]=r21,8
         adds r18=-1,r18;;
         cmp4.lt p7,p6=0,r18
 (p7)    br.cond.dptk.few 1b
+        mov r19=r20
+        ;;
 2:
 #endif
         tpa r19=r19
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index de71da811cd6..10a7d47e8510 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -215,9 +215,6 @@ SECTIONS
   /* Per-cpu data: */
   percpu : { } :percpu
   . = ALIGN(PERCPU_PAGE_SIZE);
-#ifdef  CONFIG_SMP
-  . = . + PERCPU_PAGE_SIZE;     /* cpu0 per-cpu space */
-#endif
   __phys_per_cpu_start = .;
   .data.percpu PERCPU_ADDR : AT(__phys_per_cpu_start - LOAD_OFFSET)
         {
@@ -233,6 +230,11 @@ SECTIONS
   data : { } :data
   .data : AT(ADDR(.data) - LOAD_OFFSET)
         {
+#ifdef  CONFIG_SMP
+  . = ALIGN(PERCPU_PAGE_SIZE);
+                __cpu0_per_cpu = .;
+  . = . + PERCPU_PAGE_SIZE;     /* cpu0 per-cpu space */
+#endif
                 DATA_DATA
                 *(.data1)
                 *(.gnu.linkonce.d*)
diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
index e566ff43884a..0ee085efbe29 100644
--- a/arch/ia64/mm/contig.c
+++ b/arch/ia64/mm/contig.c
@@ -163,7 +163,7 @@ per_cpu_init (void)
          * get_zeroed_page().
          */
         if (first_time) {
-                void *cpu0_data = __phys_per_cpu_start - PERCPU_PAGE_SIZE;
+                void *cpu0_data = __cpu0_per_cpu;
 
                 first_time=0;
 
diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
index 78026aabaa7f..d8c5fcd89e5b 100644
--- a/arch/ia64/mm/discontig.c
+++ b/arch/ia64/mm/discontig.c
@@ -144,7 +144,7 @@ static void *per_cpu_node_setup(void *cpu_data, int node)
 
         for_each_possible_early_cpu(cpu) {
                 if (cpu == 0) {
-                        void *cpu0_data = __phys_per_cpu_start - PERCPU_PAGE_SIZE;
+                        void *cpu0_data = __cpu0_per_cpu;
                         __per_cpu_offset[cpu] = (char*)cpu0_data -
                                 __per_cpu_start;
                 } else if (node == node_cpuid[cpu].nid) {
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index a5f864c445b2..f57113f1f892 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -216,10 +216,6 @@ config MEMORY_SIZE
         default "01000000" if PLAT_M32104UT
         default "00800000" if PLAT_OAKS32R
 
-config NOHIGHMEM
-        bool
-        default y
-
 config ARCH_DISCONTIGMEM_ENABLE
         bool "Internal RAM Support"
         depends on CHIP_M32700 || CHIP_M32102 || CHIP_VDEC2 || CHIP_OPSP || CHIP_M32104
@@ -410,11 +406,7 @@ config PCI_DIRECT
 source "drivers/pci/Kconfig"
 
 config ISA
-        bool "ISA support"
-        help
-          Find out whether you have ISA slots on your motherboard.  ISA is the
-          name of a bus system, i.e. the way the CPU talks to the other stuff
-          inside your box.  If you have ISA, say Y, otherwise N.
+        bool
 
 source "drivers/pcmcia/Kconfig"
 
diff --git a/arch/m32r/kernel/entry.S b/arch/m32r/kernel/entry.S
index d4eaa2fd1818..612d35b082a6 100644
--- a/arch/m32r/kernel/entry.S
+++ b/arch/m32r/kernel/entry.S
@@ -143,7 +143,7 @@ ret_from_intr:
         and3    r4, r4, #0x8000         ; check BSM bit
 #endif
         beqz    r4, resume_kernel
-ENTRY(resume_userspace)
+resume_userspace:
         DISABLE_INTERRUPTS(r4)          ; make sure we don't miss an interrupt
                                         ; setting need_resched or sigpending
                                         ; between sampling and the iret
diff --git a/arch/m32r/kernel/head.S b/arch/m32r/kernel/head.S
index dab7436d7bbe..40180778a5c7 100644
--- a/arch/m32r/kernel/head.S
+++ b/arch/m32r/kernel/head.S
@@ -29,7 +29,6 @@ __INITDATA
         .global _end
 ENTRY(stext)
 ENTRY(_stext)
-ENTRY(startup_32)
         /* Setup up the stack pointer */
         LDIMM   (r0, spi_stack_top)
         LDIMM   (r1, spu_stack_top)
diff --git a/arch/m32r/kernel/irq.c b/arch/m32r/kernel/irq.c
index d0c5b0b7da2f..2aeae4670098 100644
--- a/arch/m32r/kernel/irq.c
+++ b/arch/m32r/kernel/irq.c
@@ -22,9 +22,6 @@
 #include <linux/module.h>
 #include <asm/uaccess.h>
 
-atomic_t irq_err_count;
-atomic_t irq_mis_count;
-
 /*
  * Generic, controller-independent functions:
  */
@@ -63,9 +60,6 @@ int show_interrupts(struct seq_file *p, void *v)
                 seq_putc(p, '\n');
 skip:
                 spin_unlock_irqrestore(&irq_desc[i].lock, flags);
-        } else if (i == NR_IRQS) {
-                seq_printf(p, "ERR: %10u\n", atomic_read(&irq_err_count));
-                seq_printf(p, "MIS: %10u\n", atomic_read(&irq_mis_count));
         }
         return 0;
 }
diff --git a/arch/m32r/kernel/m32r_ksyms.c b/arch/m32r/kernel/m32r_ksyms.c
index 16bcb189a383..22624b51d4d3 100644
--- a/arch/m32r/kernel/m32r_ksyms.c
+++ b/arch/m32r/kernel/m32r_ksyms.c
@@ -14,6 +14,7 @@
 #include <asm/delay.h>
 #include <asm/irq.h>
 #include <asm/tlbflush.h>
+#include <asm/pgtable.h>
 
 /* platform dependent support */
 EXPORT_SYMBOL(boot_cpu_data);
@@ -65,6 +66,7 @@ EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(clear_page);
 EXPORT_SYMBOL(strlen);
+EXPORT_SYMBOL(empty_zero_page);
 
 EXPORT_SYMBOL(_inb);
 EXPORT_SYMBOL(_inw);
diff --git a/arch/m32r/kernel/process.c b/arch/m32r/kernel/process.c
index a689e2978b6e..5be4faaf5b1c 100644
--- a/arch/m32r/kernel/process.c
+++ b/arch/m32r/kernel/process.c
@@ -35,8 +35,6 @@
 
 #include <linux/err.h>
 
-static int hlt_counter=0;
-
 /*
  * Return saved PC of a blocked thread.
  */
@@ -48,31 +46,16 @@ unsigned long thread_saved_pc(struct task_struct *tsk)
 /*
  * Powermanagement idle function, if any..
  */
-void (*pm_idle)(void) = NULL;
-EXPORT_SYMBOL(pm_idle);
+static void (*pm_idle)(void) = NULL;
 
 void (*pm_power_off)(void) = NULL;
 EXPORT_SYMBOL(pm_power_off);
 
-void disable_hlt(void)
-{
-        hlt_counter++;
-}
-
-EXPORT_SYMBOL(disable_hlt);
-
-void enable_hlt(void)
-{
-        hlt_counter--;
-}
-
-EXPORT_SYMBOL(enable_hlt);
-
 /*
  * We use this is we don't have any better
  * idle routine..
  */
-void default_idle(void)
+static void default_idle(void)
 {
         /* M32R_FIXME: Please use "cpu_sleep" mode.  */
         cpu_relax();
@@ -260,15 +243,6 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long spu,
         return 0;
 }
 
-/*
- * Capture the user space registers if the task is not running (in user space)
- */
-int dump_task_regs(struct task_struct *tsk, elf_gregset_t *regs)
-{
-        /* M32R_FIXME */
-        return 1;
-}
-
 asmlinkage int sys_fork(unsigned long r0, unsigned long r1, unsigned long r2,
         unsigned long r3, unsigned long r4, unsigned long r5, unsigned long r6,
         struct pt_regs regs)
diff --git a/arch/m32r/kernel/smp.c b/arch/m32r/kernel/smp.c
index 7577f971ea4e..929e5c9d3ad9 100644
--- a/arch/m32r/kernel/smp.c
+++ b/arch/m32r/kernel/smp.c
@@ -84,7 +84,7 @@ void smp_send_timer(void);
 void smp_ipi_timer_interrupt(struct pt_regs *);
 void smp_local_timer_interrupt(void);
 
-void send_IPI_allbutself(int, int);
+static void send_IPI_allbutself(int, int);
 static void send_IPI_mask(cpumask_t, int, int);
 unsigned long send_IPI_mask_phys(cpumask_t, int, int);
 
@@ -722,7 +722,7 @@ void smp_local_timer_interrupt(void)
  * ---------- --- --------------------------------------------------------
  *
  *==========================================================================*/
-void send_IPI_allbutself(int ipi_num, int try)
+static void send_IPI_allbutself(int ipi_num, int try)
 {
         cpumask_t cpumask;
 
diff --git a/arch/m32r/kernel/time.c b/arch/m32r/kernel/time.c
index 994cc1556355..6ea017727cce 100644
--- a/arch/m32r/kernel/time.c
+++ b/arch/m32r/kernel/time.c
@@ -34,7 +34,6 @@
 #include <asm/hw_irq.h>
 
 #ifdef CONFIG_SMP
-extern void send_IPI_allbutself(int, int);
 extern void smp_local_timer_interrupt(void);
 #endif
 
@@ -188,7 +187,7 @@ static long last_rtc_update = 0;
  * timer_interrupt() needs to keep up the real-time clock,
  * as well as call the "do_timer()" routine every clocktick
  */
-irqreturn_t timer_interrupt(int irq, void *dev_id)
+static irqreturn_t timer_interrupt(int irq, void *dev_id)
 {
 #ifndef CONFIG_SMP
         profile_tick(CPU_PROFILING);
@@ -228,7 +227,7 @@ irqreturn_t timer_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-struct irqaction irq0 = {
+static struct irqaction irq0 = {
         .handler = timer_interrupt,
         .flags = IRQF_DISABLED,
         .mask = CPU_MASK_NONE,
diff --git a/arch/m32r/kernel/traps.c b/arch/m32r/kernel/traps.c
index 46159a4e644b..03b14e55cd89 100644
--- a/arch/m32r/kernel/traps.c
+++ b/arch/m32r/kernel/traps.c
@@ -61,7 +61,7 @@ extern unsigned long	eit_vector[];
         ((unsigned long)func - (unsigned long)eit_vector - entry*4)/4 \
         + 0xff000000UL
 
-void    set_eit_vector_entries(void)
+static void set_eit_vector_entries(void)
 {
         extern void default_eit_handler(void);
         extern void system_call(void);
@@ -121,9 +121,9 @@ void __init trap_init(void)
         cpu_init();
 }
 
-int kstack_depth_to_print = 24;
+static int kstack_depth_to_print = 24;
 
-void show_trace(struct task_struct *task, unsigned long *stack)
+static void show_trace(struct task_struct *task, unsigned long *stack)
 {
         unsigned long addr;
 
@@ -224,7 +224,7 @@ bad:
         printk("\n");
 }
 
-DEFINE_SPINLOCK(die_lock);
+static DEFINE_SPINLOCK(die_lock);
 
 void die(const char * str, struct pt_regs * regs, long err)
 {
diff --git a/arch/m32r/lib/delay.c b/arch/m32r/lib/delay.c
index 59bfc34e0d9f..ced549be80f5 100644
--- a/arch/m32r/lib/delay.c
+++ b/arch/m32r/lib/delay.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/param.h>
+#include <linux/module.h>
 #ifdef CONFIG_SMP
 #include <linux/sched.h>
 #include <asm/current.h>
@@ -121,3 +122,4 @@ void __ndelay(unsigned long nsecs)
 {
         __const_udelay(nsecs * 0x00005);  /* 2**32 / 1000000000 (rounded up) */
 }
+EXPORT_SYMBOL(__ndelay);
diff --git a/arch/mips/au1000/common/gpio.c b/arch/mips/au1000/common/gpio.c
index b485d94ce8a5..e660ddd611c4 100644
--- a/arch/mips/au1000/common/gpio.c
+++ b/arch/mips/au1000/common/gpio.c
@@ -48,7 +48,7 @@ static void au1xxx_gpio2_write(unsigned gpio, int value)
 {
         gpio -= AU1XXX_GPIO_BASE;
 
-        gpio2->output = (GPIO2_OUTPUT_ENABLE_MASK << gpio) | (value << gpio);
+        gpio2->output = (GPIO2_OUTPUT_ENABLE_MASK << gpio) | ((!!value) << gpio);
 }
 
 static int au1xxx_gpio2_direction_input(unsigned gpio)
@@ -61,7 +61,8 @@ static int au1xxx_gpio2_direction_input(unsigned gpio)
 static int au1xxx_gpio2_direction_output(unsigned gpio, int value)
 {
         gpio -= AU1XXX_GPIO_BASE;
-        gpio2->dir = (0x01 << gpio) | (value << gpio);
+        gpio2->dir |= 0x01 << gpio;
+        gpio2->output = (GPIO2_OUTPUT_ENABLE_MASK << gpio) | ((!!value) << gpio);
         return 0;
 }
 
@@ -90,6 +91,7 @@ static int au1xxx_gpio1_direction_input(unsigned gpio)
 static int au1xxx_gpio1_direction_output(unsigned gpio, int value)
 {
         gpio1->trioutclr = (0x01 & gpio);
+        au1xxx_gpio1_write(gpio, value);
         return 0;
 }
 
diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
index 8f6d58ede33c..6e152c80cd4a 100644
--- a/arch/mips/kernel/kgdb.c
+++ b/arch/mips/kernel/kgdb.c
@@ -236,8 +236,7 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
 
                 atomic_set(&kgdb_cpu_doing_single_step, -1);
                 if (remcom_in_buffer[0] == 's')
-                        if (kgdb_contthread)
-                                atomic_set(&kgdb_cpu_doing_single_step, cpu);
+                        atomic_set(&kgdb_cpu_doing_single_step, cpu);
 
                 return 0;
         }
diff --git a/arch/mips/pci/Makefile b/arch/mips/pci/Makefile
index 15e01aec37fd..c8c32f417b6c 100644
--- a/arch/mips/pci/Makefile
+++ b/arch/mips/pci/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_SOC_TX3927)	+= ops-tx3927.o
 obj-$(CONFIG_PCI_VR41XX)        += ops-vr41xx.o pci-vr41xx.o
 obj-$(CONFIG_MARKEINS)          += ops-emma2rh.o pci-emma2rh.o fixup-emma2rh.o
 obj-$(CONFIG_PCI_TX4927)        += ops-tx4927.o
+obj-$(CONFIG_BCM47XX)           += pci-bcm47xx.o
 
 #
 # These are still pretty much in the old state, watch, go blind.
diff --git a/arch/mips/pci/pci-bcm47xx.c b/arch/mips/pci/pci-bcm47xx.c
new file mode 100644
index 000000000000..bea9b6cdfdbf
--- /dev/null
+++ b/arch/mips/pci/pci-bcm47xx.c
@@ -0,0 +1,60 @@
+/*
+ *  Copyright (C) 2008 Aurelien Jarno <aurelien@aurel32.net>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/ssb/ssb.h>
+
+int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+{
+        return 0;
+}
+
+int pcibios_plat_dev_init(struct pci_dev *dev)
+{
+        int res;
+        u8 slot, pin;
+
+        res = ssb_pcibios_plat_dev_init(dev);
+        if (res < 0) {
+                printk(KERN_ALERT "PCI: Failed to init device %s\n",
+                       pci_name(dev));
+                return res;
+        }
+
+        pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
+        slot = PCI_SLOT(dev->devfn);
+        res = ssb_pcibios_map_irq(dev, slot, pin);
+
+        /* IRQ-0 and IRQ-1 are software interrupts. */
+        if (res < 2) {
+                printk(KERN_ALERT "PCI: Failed to map IRQ of device %s\n",
+                       pci_name(dev));
+                return res;
+        }
+
+        dev->irq = res;
+        return 0;
+}
+
diff --git a/arch/mips/pci/pci-ip27.c b/arch/mips/pci/pci-ip27.c
index bd78368c82bf..f97ab1461012 100644
--- a/arch/mips/pci/pci-ip27.c
+++ b/arch/mips/pci/pci-ip27.c
@@ -143,25 +143,47 @@ int __cpuinit bridge_probe(nasid_t nasid, int widget_id, int masterwid)
  */
 int __devinit pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
+        return 0;
+}
+
+/* Most MIPS systems have straight-forward swizzling needs.  */
+static inline u8 bridge_swizzle(u8 pin, u8 slot)
+{
+        return (((pin - 1) + slot) % 4) + 1;
+}
+
+static inline struct pci_dev *bridge_root_dev(struct pci_dev *dev)
+{
+        while (dev->bus->parent) {
+                /* Move up the chain of bridges. */
+                dev = dev->bus->self;
+        }
+
+        return dev;
+}
+
+/* Do platform specific device initialization at pci_enable_device() time */
+int pcibios_plat_dev_init(struct pci_dev *dev)
+{
         struct bridge_controller *bc = BRIDGE_CONTROLLER(dev->bus);
-        int irq = bc->pci_int[slot];
+        struct pci_dev *rdev = bridge_root_dev(dev);
+        int slot = PCI_SLOT(rdev->devfn);
+        int irq;
 
+        irq = bc->pci_int[slot];
         if (irq == -1) {
-                irq = bc->pci_int[slot] = request_bridge_irq(bc);
+                irq = request_bridge_irq(bc);
                 if (irq < 0)
-                        panic("Can't allocate interrupt for PCI device %s\n",
-                              pci_name(dev));
+                        return irq;
+
+                bc->pci_int[slot] = irq;
         }
 
         irq_to_bridge[irq] = bc;
         irq_to_slot[irq] = slot;
 
-        return irq;
-}
+        dev->irq = irq;
 
-/* Do platform specific device initialization at pci_enable_device() time */
-int pcibios_plat_dev_init(struct pci_dev *dev)
-{
         return 0;
 }
 
diff --git a/arch/mn10300/kernel/irq.c b/arch/mn10300/kernel/irq.c
index 761c434a2488..56c64ccc9c21 100644
--- a/arch/mn10300/kernel/irq.c
+++ b/arch/mn10300/kernel/irq.c
@@ -20,22 +20,8 @@ EXPORT_SYMBOL(__mn10300_irq_enabled_epsw);
 atomic_t irq_err_count;
 
 /*
- * MN10300 INTC controller operations
+ * MN10300 interrupt controller operations
  */
-static void mn10300_cpupic_disable(unsigned int irq)
-{
-        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_DETECT;
-        tmp = GxICR(irq);
-}
-
-static void mn10300_cpupic_enable(unsigned int irq)
-{
-        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE;
-        tmp = GxICR(irq);
-}
-
 static void mn10300_cpupic_ack(unsigned int irq)
 {
         u16 tmp;
@@ -60,26 +46,54 @@ static void mn10300_cpupic_mask_ack(unsigned int irq)
 static void mn10300_cpupic_unmask(unsigned int irq)
 {
         u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE | GxICR_DETECT;
+        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE;
         tmp = GxICR(irq);
 }
 
-static void mn10300_cpupic_end(unsigned int irq)
+static void mn10300_cpupic_unmask_clear(unsigned int irq)
 {
+        /* the MN10300 PIC latches its interrupt request bit, even after the
+         * device has ceased to assert its interrupt line and the interrupt
+         * channel has been disabled in the PIC, so for level-triggered
+         * interrupts we need to clear the request bit when we re-enable */
         u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE;
+        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE | GxICR_DETECT;
         tmp = GxICR(irq);
 }
 
-static struct irq_chip mn10300_cpu_pic = {
-        .name           = "cpu",
-        .disable        = mn10300_cpupic_disable,
-        .enable         = mn10300_cpupic_enable,
+/*
+ * MN10300 PIC level-triggered IRQ handling.
+ *
+ * The PIC has no 'ACK' function per se.  It is possible to clear individual
+ * channel latches, but each latch relatches whether or not the channel is
+ * masked, so we need to clear the latch when we unmask the channel.
+ *
+ * Also for this reason, we don't supply an ack() op (it's unused anyway if
+ * mask_ack() is provided), and mask_ack() just masks.
+ */
+static struct irq_chip mn10300_cpu_pic_level = {
+        .name           = "cpu_l",
+        .disable        = mn10300_cpupic_mask,
+        .enable         = mn10300_cpupic_unmask_clear,
+        .ack            = NULL,
+        .mask           = mn10300_cpupic_mask,
+        .mask_ack       = mn10300_cpupic_mask,
+        .unmask         = mn10300_cpupic_unmask_clear,
+};
+
+/*
+ * MN10300 PIC edge-triggered IRQ handling.
+ *
+ * We use the latch clearing function of the PIC as the 'ACK' function.
+ */
+static struct irq_chip mn10300_cpu_pic_edge = {
+        .name           = "cpu_e",
+        .disable        = mn10300_cpupic_mask,
+        .enable         = mn10300_cpupic_unmask,
         .ack            = mn10300_cpupic_ack,
         .mask           = mn10300_cpupic_mask,
         .mask_ack       = mn10300_cpupic_mask_ack,
         .unmask         = mn10300_cpupic_unmask,
-        .end            = mn10300_cpupic_end,
 };
 
 /*
@@ -114,7 +128,8 @@ void set_intr_level(int irq, u16 level)
  */
 void set_intr_postackable(int irq)
 {
-        set_irq_handler(irq, handle_level_irq);
+        set_irq_chip_and_handler(irq, &mn10300_cpu_pic_level,
+                                 handle_level_irq);
 }
 
 /*
@@ -126,8 +141,12 @@ void __init init_IRQ(void)
 
         for (irq = 0; irq < NR_IRQS; irq++)
                 if (irq_desc[irq].chip == &no_irq_type)
-                        set_irq_chip_and_handler(irq, &mn10300_cpu_pic,
-                                                 handle_edge_irq);
+                        /* due to the PIC latching interrupt requests, even
+                         * when the IRQ is disabled, IRQ_PENDING is superfluous
+                         * and we can use handle_level_irq() for edge-triggered
+                         * interrupts */
+                        set_irq_chip_and_handler(irq, &mn10300_cpu_pic_edge,
+                                                 handle_level_irq);
         unit_init_IRQ();
 }
 
diff --git a/arch/mn10300/kernel/time.c b/arch/mn10300/kernel/time.c
index babb7c2ac377..e4606586f94c 100644
--- a/arch/mn10300/kernel/time.c
+++ b/arch/mn10300/kernel/time.c
@@ -1,6 +1,6 @@
 /* MN10300 Low level time management
  *
- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
+ * Copyright (C) 2007-2008 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
  * - Derived from arch/i386/kernel/time.c
  *
@@ -16,6 +16,7 @@
 #include <linux/init.h>
 #include <linux/smp.h>
 #include <linux/profile.h>
+#include <linux/cnt32_to_63.h>
 #include <asm/irq.h>
 #include <asm/div64.h>
 #include <asm/processor.h>
@@ -40,27 +41,54 @@ static struct irqaction timer_irq = {
         .name           = "timer",
 };
 
+static unsigned long sched_clock_multiplier;
+
 /*
  * scheduler clock - returns current time in nanosec units.
  */
 unsigned long long sched_clock(void)
 {
         union {
-                unsigned long long l;
-                u32 w[2];
-        } quot;
+                unsigned long long ll;
+                unsigned l[2];
+        } tsc64, result;
+        unsigned long tsc, tmp;
+        unsigned product[3]; /* 96-bit intermediate value */
+
+        /* read the TSC value
+         */
+        tsc = 0 - get_cycles(); /* get_cycles() counts down */
 
-        quot.w[0] = mn10300_last_tsc - get_cycles();
-        quot.w[1] = 1000000000;
+        /* expand to 64-bits.
+         * - sched_clock() must be called once a minute or better or the
+         *   following will go horribly wrong - see cnt32_to_63()
+         */
+        tsc64.ll = cnt32_to_63(tsc) & 0x7fffffffffffffffULL;
 
-        asm("mulu %2,%3,%0,%1"
-            : "=r"(quot.w[1]), "=r"(quot.w[0])
-            : "0"(quot.w[1]), "1"(quot.w[0])
+        /* scale the 64-bit TSC value to a nanosecond value via a 96-bit
+         * intermediate
+         */
+        asm("mulu       %2,%0,%3,%0     \n"     /* LSW * mult ->  0:%3:%0 */
+            "mulu       %2,%1,%2,%1     \n"     /* MSW * mult -> %2:%1:0 */
+            "add        %3,%1           \n"
+            "addc       0,%2            \n"     /* result in %2:%1:%0 */
+            : "=r"(product[0]), "=r"(product[1]), "=r"(product[2]), "=r"(tmp)
+            :  "0"(tsc64.l[0]),  "1"(tsc64.l[1]),  "2"(sched_clock_multiplier)
             : "cc");
 
-        do_div(quot.l, MN10300_TSCCLK);
+        result.l[0] = product[1] << 16 | product[0] >> 16;
+        result.l[1] = product[2] << 16 | product[1] >> 16;
 
-        return quot.l;
+        return result.ll;
+}
+
+/*
+ * initialise the scheduler clock
+ */
+static void __init mn10300_sched_clock_init(void)
+{
+        sched_clock_multiplier =
+                __muldiv64u(NSEC_PER_SEC, 1 << 16, MN10300_TSCCLK);
 }
 
 /*
@@ -128,4 +156,6 @@ void __init time_init(void)
         /* start the watchdog timer */
         watchdog_go();
 #endif
+
+        mn10300_sched_clock_init();
 }
diff --git a/arch/mn10300/unit-asb2303/unit-init.c b/arch/mn10300/unit-asb2303/unit-init.c
index 14b2c817cff8..70e8cb4ea266 100644
--- a/arch/mn10300/unit-asb2303/unit-init.c
+++ b/arch/mn10300/unit-asb2303/unit-init.c
@@ -51,7 +51,7 @@ void __init unit_init_IRQ(void)
                 switch (GET_XIRQ_TRIGGER(extnum)) {
                 case XIRQ_TRIGGER_HILEVEL:
                 case XIRQ_TRIGGER_LOWLEVEL:
-                        set_irq_handler(XIRQ2IRQ(extnum), handle_level_irq);
+                        set_intr_postackable(XIRQ2IRQ(extnum));
                         break;
                 default:
                         break;
diff --git a/arch/mn10300/unit-asb2305/unit-init.c b/arch/mn10300/unit-asb2305/unit-init.c
index 6a352414a358..72812a9439ac 100644
--- a/arch/mn10300/unit-asb2305/unit-init.c
+++ b/arch/mn10300/unit-asb2305/unit-init.c
@@ -52,7 +52,7 @@ void __init unit_init_IRQ(void)
                 switch (GET_XIRQ_TRIGGER(extnum)) {
                 case XIRQ_TRIGGER_HILEVEL:
                 case XIRQ_TRIGGER_LOWLEVEL:
-                        set_irq_handler(XIRQ2IRQ(extnum), handle_level_irq);
+                        set_intr_postackable(XIRQ2IRQ(extnum));
                         break;
                 default:
                         break;
diff --git a/arch/powerpc/boot/dts/holly.dts b/arch/powerpc/boot/dts/holly.dts
index f87fe7b9ced9..c6e11ebecebb 100644
--- a/arch/powerpc/boot/dts/holly.dts
+++ b/arch/powerpc/boot/dts/holly.dts
@@ -133,61 +133,61 @@
                         reg = <0x00007400 0x00000400>;
                         big-endian;
                 };
+        };
 
-                pci@1000 {
-                        device_type = "pci";
-                        compatible = "tsi109-pci", "tsi108-pci";
-                        #interrupt-cells = <1>;
-                        #size-cells = <2>;
-                        #address-cells = <3>;
-                        reg = <0x00001000 0x00001000>;
-                        bus-range = <0x0 0x0>;
-                        /*----------------------------------------------------+
-                        | PCI memory range.
-                        | 01 denotes I/O space
-                        | 02 denotes 32-bit memory space
-                        +----------------------------------------------------*/
-                        ranges = <0x02000000 0x00000000 0x40000000 0x40000000 0x00000000 0x10000000
-                                  0x01000000 0x00000000 0x00000000 0x7e000000 0x00000000 0x00010000>;
-                        clock-frequency = <133333332>;
-                        interrupt-parent = <&MPIC>;
+        pci@c0001000 {
+                device_type = "pci";
+                compatible = "tsi109-pci", "tsi108-pci";
+                #interrupt-cells = <1>;
+                #size-cells = <2>;
+                #address-cells = <3>;
+                reg = <0xc0001000 0x00001000>;
+                bus-range = <0x0 0x0>;
+                /*----------------------------------------------------+
+                | PCI memory range.
+                | 01 denotes I/O space
+                | 02 denotes 32-bit memory space
+                +----------------------------------------------------*/
+                ranges = <0x02000000 0x00000000 0x40000000 0x40000000 0x00000000 0x10000000
+                          0x01000000 0x00000000 0x00000000 0x7e000000 0x00000000 0x00010000>;
+                clock-frequency = <133333332>;
+                interrupt-parent = <&MPIC>;
+                interrupts = <0x17 0x2>;
+                interrupt-map-mask = <0xf800 0x0 0x0 0x7>;
+                /*----------------------------------------------------+
+                | The INTA, INTB, INTC, INTD are shared.
+                +----------------------------------------------------*/
+                interrupt-map = <
+                        0x800 0x0 0x0 0x1 &RT0 0x24 0x0
+                        0x800 0x0 0x0 0x2 &RT0 0x25 0x0
+                        0x800 0x0 0x0 0x3 &RT0 0x26 0x0
+                        0x800 0x0 0x0 0x4 &RT0 0x27 0x0
+
+                        0x1000 0x0 0x0 0x1 &RT0 0x25 0x0
+                        0x1000 0x0 0x0 0x2 &RT0 0x26 0x0
+                        0x1000 0x0 0x0 0x3 &RT0 0x27 0x0
+                        0x1000 0x0 0x0 0x4 &RT0 0x24 0x0
+
+                        0x1800 0x0 0x0 0x1 &RT0 0x26 0x0
+                        0x1800 0x0 0x0 0x2 &RT0 0x27 0x0
+                        0x1800 0x0 0x0 0x3 &RT0 0x24 0x0
+                        0x1800 0x0 0x0 0x4 &RT0 0x25 0x0
+
+                        0x2000 0x0 0x0 0x1 &RT0 0x27 0x0
+                        0x2000 0x0 0x0 0x2 &RT0 0x24 0x0
+                        0x2000 0x0 0x0 0x3 &RT0 0x25 0x0
+                        0x2000 0x0 0x0 0x4 &RT0 0x26 0x0
+                        >;
+
+                RT0: router@1180 {
+                        device_type = "pic-router";
+                        interrupt-controller;
+                        big-endian;
+                        clock-frequency = <0>;
+                        #address-cells = <0>;
+                        #interrupt-cells = <2>;
                         interrupts = <0x17 0x2>;
-                        interrupt-map-mask = <0xf800 0x0 0x0 0x7>;
-                        /*----------------------------------------------------+
-                        | The INTA, INTB, INTC, INTD are shared.
-                        +----------------------------------------------------*/
-                        interrupt-map = <
-                                0x800 0x0 0x0 0x1 &RT0 0x24 0x0
-                                0x800 0x0 0x0 0x2 &RT0 0x25 0x0
-                                0x800 0x0 0x0 0x3 &RT0 0x26 0x0
-                                0x800 0x0 0x0 0x4 &RT0 0x27 0x0
-
-                                0x1000 0x0 0x0 0x1 &RT0 0x25 0x0
-                                0x1000 0x0 0x0 0x2 &RT0 0x26 0x0
-                                0x1000 0x0 0x0 0x3 &RT0 0x27 0x0
-                                0x1000 0x0 0x0 0x4 &RT0 0x24 0x0
-
-                                0x1800 0x0 0x0 0x1 &RT0 0x26 0x0
-                                0x1800 0x0 0x0 0x2 &RT0 0x27 0x0
-                                0x1800 0x0 0x0 0x3 &RT0 0x24 0x0
-                                0x1800 0x0 0x0 0x4 &RT0 0x25 0x0
-
-                                0x2000 0x0 0x0 0x1 &RT0 0x27 0x0
-                                0x2000 0x0 0x0 0x2 &RT0 0x24 0x0
-                                0x2000 0x0 0x0 0x3 &RT0 0x25 0x0
-                                0x2000 0x0 0x0 0x4 &RT0 0x26 0x0
-                                >;
-
-                        RT0: router@1180 {
-                                device_type = "pic-router";
-                                interrupt-controller;
-                                big-endian;
-                                clock-frequency = <0>;
-                                #address-cells = <0>;
-                                #interrupt-cells = <2>;
-                                interrupts = <0x17 0x2>;
-                                interrupt-parent = <&MPIC>;
-                        };
+                        interrupt-parent = <&MPIC>;
                 };
         };
 
diff --git a/arch/powerpc/kernel/idle.c b/arch/powerpc/kernel/idle.c
index d308a9f70f1b..31982d05d81a 100644
--- a/arch/powerpc/kernel/idle.c
+++ b/arch/powerpc/kernel/idle.c
@@ -34,11 +34,7 @@
 #include <asm/smp.h>
 
 #ifdef CONFIG_HOTPLUG_CPU
-/* this is used for software suspend, and that shuts down
- * CPUs even while the system is still booting... */
-#define cpu_should_die()        (cpu_is_offline(smp_processor_id()) && \
-                                   (system_state == SYSTEM_RUNNING     \
-                                 || system_state == SYSTEM_BOOTING))
+#define cpu_should_die()        cpu_is_offline(smp_processor_id())
 #else
 #define cpu_should_die()        0
 #endif
diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
index b4fdf2f2743c..fe8f71dd0b3f 100644
--- a/arch/powerpc/kernel/kgdb.c
+++ b/arch/powerpc/kernel/kgdb.c
@@ -347,9 +347,8 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
                         linux_regs->msr |= MSR_SE;
 #endif
                         kgdb_single_step = 1;
-                        if (kgdb_contthread)
-                                atomic_set(&kgdb_cpu_doing_single_step,
-                                           raw_smp_processor_id());
+                        atomic_set(&kgdb_cpu_doing_single_step,
+                                   raw_smp_processor_id());
                 }
                 return 0;
         }
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index f47f0eb886b8..8282a2139681 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -69,6 +69,9 @@ static int gdb_x86vector = -1;
  */
 void pt_regs_to_gdb_regs(unsigned long *gdb_regs, struct pt_regs *regs)
 {
+#ifndef CONFIG_X86_32
+        u32 *gdb_regs32 = (u32 *)gdb_regs;
+#endif
         gdb_regs[GDB_AX]        = regs->ax;
         gdb_regs[GDB_BX]        = regs->bx;
         gdb_regs[GDB_CX]        = regs->cx;
@@ -76,9 +79,9 @@ void pt_regs_to_gdb_regs(unsigned long *gdb_regs, struct pt_regs *regs)
         gdb_regs[GDB_SI]        = regs->si;
         gdb_regs[GDB_DI]        = regs->di;
         gdb_regs[GDB_BP]        = regs->bp;
-        gdb_regs[GDB_PS]        = regs->flags;
         gdb_regs[GDB_PC]        = regs->ip;
 #ifdef CONFIG_X86_32
+        gdb_regs[GDB_PS]        = regs->flags;
         gdb_regs[GDB_DS]        = regs->ds;
         gdb_regs[GDB_ES]        = regs->es;
         gdb_regs[GDB_CS]        = regs->cs;
@@ -94,6 +97,9 @@ void pt_regs_to_gdb_regs(unsigned long *gdb_regs, struct pt_regs *regs)
         gdb_regs[GDB_R13]       = regs->r13;
         gdb_regs[GDB_R14]       = regs->r14;
         gdb_regs[GDB_R15]       = regs->r15;
+        gdb_regs32[GDB_PS]      = regs->flags;
+        gdb_regs32[GDB_CS]      = regs->cs;
+        gdb_regs32[GDB_SS]      = regs->ss;
 #endif
         gdb_regs[GDB_SP]        = regs->sp;
 }
@@ -112,6 +118,9 @@ void pt_regs_to_gdb_regs(unsigned long *gdb_regs, struct pt_regs *regs)
  */
 void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
 {
+#ifndef CONFIG_X86_32
+        u32 *gdb_regs32 = (u32 *)gdb_regs;
+#endif
         gdb_regs[GDB_AX]        = 0;
         gdb_regs[GDB_BX]        = 0;
         gdb_regs[GDB_CX]        = 0;
@@ -129,8 +138,10 @@ void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
         gdb_regs[GDB_FS]        = 0xFFFF;
         gdb_regs[GDB_GS]        = 0xFFFF;
 #else
-        gdb_regs[GDB_PS]        = *(unsigned long *)(p->thread.sp + 8);
-        gdb_regs[GDB_PC]        = 0;
+        gdb_regs32[GDB_PS]      = *(unsigned long *)(p->thread.sp + 8);
+        gdb_regs32[GDB_CS]      = __KERNEL_CS;
+        gdb_regs32[GDB_SS]      = __KERNEL_DS;
+        gdb_regs[GDB_PC]        = p->thread.ip;
         gdb_regs[GDB_R8]        = 0;
         gdb_regs[GDB_R9]        = 0;
         gdb_regs[GDB_R10]       = 0;
@@ -153,6 +164,9 @@ void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
  */
 void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
 {
+#ifndef CONFIG_X86_32
+        u32 *gdb_regs32 = (u32 *)gdb_regs;
+#endif
         regs->ax                = gdb_regs[GDB_AX];
         regs->bx                = gdb_regs[GDB_BX];
         regs->cx                = gdb_regs[GDB_CX];
@@ -160,9 +174,9 @@ void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
         regs->si                = gdb_regs[GDB_SI];
         regs->di                = gdb_regs[GDB_DI];
         regs->bp                = gdb_regs[GDB_BP];
-        regs->flags             = gdb_regs[GDB_PS];
         regs->ip                = gdb_regs[GDB_PC];
 #ifdef CONFIG_X86_32
+        regs->flags             = gdb_regs[GDB_PS];
         regs->ds                = gdb_regs[GDB_DS];
         regs->es                = gdb_regs[GDB_ES];
         regs->cs                = gdb_regs[GDB_CS];
@@ -175,6 +189,9 @@ void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
         regs->r13               = gdb_regs[GDB_R13];
         regs->r14               = gdb_regs[GDB_R14];
         regs->r15               = gdb_regs[GDB_R15];
+        regs->flags             = gdb_regs32[GDB_PS];
+        regs->cs                = gdb_regs32[GDB_CS];
+        regs->ss                = gdb_regs32[GDB_SS];
 #endif
 }
 
@@ -378,10 +395,8 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
                 if (remcomInBuffer[0] == 's') {
                         linux_regs->flags |= X86_EFLAGS_TF;
                         kgdb_single_step = 1;
-                        if (kgdb_contthread) {
-                                atomic_set(&kgdb_cpu_doing_single_step,
-                                           raw_smp_processor_id());
-                        }
+                        atomic_set(&kgdb_cpu_doing_single_step,
+                                   raw_smp_processor_id());
                 }
 
                 get_debugreg(dr6, 6);
@@ -466,9 +481,15 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
 
         case DIE_DEBUG:
                 if (atomic_read(&kgdb_cpu_doing_single_step) ==
-                        raw_smp_processor_id() &&
-                        user_mode(regs))
-                        return single_step_cont(regs, args);
+                    raw_smp_processor_id()) {
+                        if (user_mode(regs))
+                                return single_step_cont(regs, args);
+                        break;
+                } else if (test_thread_flag(TIF_SINGLESTEP))
+                        /* This means a user thread is single stepping
+                         * a system call which should be ignored
+                         */
+                        return NOTIFY_DONE;
                 /* fall through */
         default:
                 if (user_mode(regs))
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 4b3cfdf54216..31f40b24bf5d 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -55,6 +55,7 @@
 #include <asm/tlbflush.h>
 #include <asm/cpu.h>
 #include <asm/kdebug.h>
+#include <asm/idle.h>
 
 asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
 
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 1e1f3f3757ae..14601dc05e41 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -309,6 +309,8 @@ static void nv_nf2_freeze(struct ata_port *ap);
 static void nv_nf2_thaw(struct ata_port *ap);
 static void nv_ck804_freeze(struct ata_port *ap);
 static void nv_ck804_thaw(struct ata_port *ap);
+static int nv_hardreset(struct ata_link *link, unsigned int *class,
+                        unsigned long deadline);
 static int nv_adma_slave_config(struct scsi_device *sdev);
 static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
 static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
@@ -403,28 +405,45 @@ static struct scsi_host_template nv_swncq_sht = {
         .slave_configure        = nv_swncq_slave_config,
 };
 
-static struct ata_port_operations nv_generic_ops = {
+/* OSDL bz3352 reports that some nv controllers can't determine device
+ * signature reliably and nv_hardreset is implemented to work around
+ * the problem.  This was reported on nf3 and it's unclear whether any
+ * other controllers are affected.  However, the workaround has been
+ * applied to all variants and there isn't much to gain by trying to
+ * find out exactly which ones are affected at this point especially
+ * because NV has moved over to ahci for newer controllers.
+ */
+static struct ata_port_operations nv_common_ops = {
         .inherits               = &ata_bmdma_port_ops,
-        .hardreset              = ATA_OP_NULL,
+        .hardreset              = nv_hardreset,
         .scr_read               = nv_scr_read,
         .scr_write              = nv_scr_write,
 };
 
+/* OSDL bz11195 reports that link doesn't come online after hardreset
+ * on generic nv's and there have been several other similar reports
+ * on linux-ide.  Disable hardreset for generic nv's.
+ */
+static struct ata_port_operations nv_generic_ops = {
+        .inherits               = &nv_common_ops,
+        .hardreset              = ATA_OP_NULL,
+};
+
 static struct ata_port_operations nv_nf2_ops = {
-        .inherits               = &nv_generic_ops,
+        .inherits               = &nv_common_ops,
         .freeze                 = nv_nf2_freeze,
         .thaw                   = nv_nf2_thaw,
 };
 
 static struct ata_port_operations nv_ck804_ops = {
-        .inherits               = &nv_generic_ops,
+        .inherits               = &nv_common_ops,
         .freeze                 = nv_ck804_freeze,
         .thaw                   = nv_ck804_thaw,
         .host_stop              = nv_ck804_host_stop,
 };
 
 static struct ata_port_operations nv_adma_ops = {
-        .inherits               = &nv_generic_ops,
+        .inherits               = &nv_common_ops,
 
         .check_atapi_dma        = nv_adma_check_atapi_dma,
         .sff_tf_read            = nv_adma_tf_read,
@@ -448,7 +467,7 @@ static struct ata_port_operations nv_adma_ops = {
 };
 
 static struct ata_port_operations nv_swncq_ops = {
-        .inherits               = &nv_generic_ops,
+        .inherits               = &nv_common_ops,
 
         .qc_defer               = ata_std_qc_defer,
         .qc_prep                = nv_swncq_qc_prep,
@@ -1586,6 +1605,21 @@ static void nv_mcp55_thaw(struct ata_port *ap)
         ata_sff_thaw(ap);
 }
 
+static int nv_hardreset(struct ata_link *link, unsigned int *class,
+                        unsigned long deadline)
+{
+        int rc;
+
+        /* SATA hardreset fails to retrieve proper device signature on
+         * some controllers.  Request follow up SRST.  For more info,
+         * see http://bugzilla.kernel.org/show_bug.cgi?id=3352
+         */
+        rc = sata_sff_hardreset(link, class, deadline);
+        if (rc)
+                return rc;
+        return -EAGAIN;
+}
+
 static void nv_adma_error_handler(struct ata_port *ap)
 {
         struct nv_adma_port_priv *pp = ap->private_data;
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 6a010681ecf3..29ae99817c60 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -104,6 +104,9 @@ static struct usb_device_id blacklist_table[] = {
         /* Broadcom BCM2046 */
         { USB_DEVICE(0x0a5c, 0x2151), .driver_info = BTUSB_RESET },
 
+        /* Apple MacBook Pro with Broadcom chip */
+        { USB_DEVICE(0x05ac, 0x820f), .driver_info = BTUSB_RESET },
+
         /* IBM/Lenovo ThinkPad with Broadcom chip */
         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
         { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
@@ -169,6 +172,7 @@ static struct usb_device_id blacklist_table[] = {
 struct btusb_data {
         struct hci_dev       *hdev;
         struct usb_device    *udev;
+        struct usb_interface *intf;
         struct usb_interface *isoc;
 
         spinlock_t lock;
@@ -516,7 +520,7 @@ static int btusb_open(struct hci_dev *hdev)
 
         err = btusb_submit_intr_urb(hdev);
         if (err < 0) {
-                clear_bit(BTUSB_INTR_RUNNING, &hdev->flags);
+                clear_bit(BTUSB_INTR_RUNNING, &data->flags);
                 clear_bit(HCI_RUNNING, &hdev->flags);
         }
 
@@ -532,8 +536,10 @@ static int btusb_close(struct hci_dev *hdev)
         if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
                 return 0;
 
+        cancel_work_sync(&data->work);
+
         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
-        usb_kill_anchored_urbs(&data->intr_anchor);
+        usb_kill_anchored_urbs(&data->isoc_anchor);
 
         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
         usb_kill_anchored_urbs(&data->bulk_anchor);
@@ -821,6 +827,7 @@ static int btusb_probe(struct usb_interface *intf,
         }
 
         data->udev = interface_to_usbdev(intf);
+        data->intf = intf;
 
         spin_lock_init(&data->lock);
 
@@ -889,7 +896,7 @@ static int btusb_probe(struct usb_interface *intf,
 
         if (data->isoc) {
                 err = usb_driver_claim_interface(&btusb_driver,
-                                                        data->isoc, NULL);
+                                                        data->isoc, data);
                 if (err < 0) {
                         hci_free_dev(hdev);
                         kfree(data);
@@ -921,13 +928,22 @@ static void btusb_disconnect(struct usb_interface *intf)
 
         hdev = data->hdev;
 
-        if (data->isoc)
-                usb_driver_release_interface(&btusb_driver, data->isoc);
+        __hci_dev_hold(hdev);
 
-        usb_set_intfdata(intf, NULL);
+        usb_set_intfdata(data->intf, NULL);
+
+        if (data->isoc)
+                usb_set_intfdata(data->isoc, NULL);
 
         hci_unregister_dev(hdev);
 
+        if (intf == data->isoc)
+                usb_driver_release_interface(&btusb_driver, data->intf);
+        else if (data->isoc)
+                usb_driver_release_interface(&btusb_driver, data->isoc);
+
+        __hci_dev_put(hdev);
+
         hci_free_dev(hdev);
 }
 
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index daeb8f766971..e4dce8709541 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -695,13 +695,23 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
 {
         struct tty_driver *p, *res = NULL;
         int tty_line = 0;
+        int len;
         char *str;
 
+        for (str = name; *str; str++)
+                if ((*str >= '0' && *str <= '9') || *str == ',')
+                        break;
+        if (!*str)
+                return NULL;
+
+        len = str - name;
+        tty_line = simple_strtoul(str, &str, 10);
+
         mutex_lock(&tty_mutex);
         /* Search through the tty devices to look for a match */
         list_for_each_entry(p, &tty_drivers, tty_drivers) {
-                str = name + strlen(p->name);
-                tty_line = simple_strtoul(str, &str, 10);
+                if (strncmp(name, p->name, len) != 0)
+                        continue;
                 if (*str == ',')
                         str++;
                 if (*str == '\0')
diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
index 22f6d5c00d80..0e7b1c6724aa 100644
--- a/drivers/i2c/busses/i2c-powermac.c
+++ b/drivers/i2c/busses/i2c-powermac.c
@@ -180,7 +180,7 @@ static const struct i2c_algorithm i2c_powermac_algorithm = {
 };
 
 
-static int i2c_powermac_remove(struct platform_device *dev)
+static int __devexit i2c_powermac_remove(struct platform_device *dev)
 {
         struct i2c_adapter      *adapter = platform_get_drvdata(dev);
         struct pmac_i2c_bus     *bus = i2c_get_adapdata(adapter);
@@ -200,7 +200,7 @@ static int i2c_powermac_remove(struct platform_device *dev)
 }
 
 
-static int __devexit i2c_powermac_probe(struct platform_device *dev)
+static int __devinit i2c_powermac_probe(struct platform_device *dev)
 {
         struct pmac_i2c_bus *bus = dev->dev.platform_data;
         struct device_node *parent = NULL;
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index af4491fa7e34..307d976c9b69 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -583,8 +583,10 @@ static int __init i2c_dev_init(void)
                 goto out;
 
         i2c_dev_class = class_create(THIS_MODULE, "i2c-dev");
-        if (IS_ERR(i2c_dev_class))
+        if (IS_ERR(i2c_dev_class)) {
+                res = PTR_ERR(i2c_dev_class);
                 goto out_unreg_chrdev;
+        }
 
         res = i2c_add_driver(&i2cdev_driver);
         if (res)
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index fc735ab08ff4..8e93a797c93d 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -292,6 +292,20 @@ config IDE_GENERIC
         tristate "generic/default IDE chipset support"
         depends on ALPHA || X86 || IA64 || M32R || MIPS
         help
+          This is the generic IDE driver.  This driver attaches to the
+          fixed legacy ports (e.g. on PCs 0x1f0/0x170, 0x1e8/0x168 and
+          so on).  Please note that if this driver is built into the
+          kernel or loaded before other ATA (IDE or libata) drivers
+          and the controller is located at legacy ports, this driver
+          may grab those ports and thus can prevent the controller
+          specific driver from attaching.
+
+          Also, currently, IDE generic doesn't allow IRQ sharing
+          meaning that the IRQs it grabs won't be available to other
+          controllers sharing those IRQs which usually makes drivers
+          for those controllers fail.  Generally, it's not a good idea
+          to load IDE generic driver on modern systems.
+
           If unsure, say N.
 
 config BLK_DEV_PLATFORM
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 1bce84b56630..3833189144ed 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -2338,7 +2338,7 @@ static void idetape_get_inquiry_results(ide_drive_t *drive)
 {
         idetape_tape_t *tape = drive->driver_data;
         struct ide_atapi_pc pc;
-        char fw_rev[6], vendor_id[10], product_id[18];
+        char fw_rev[4], vendor_id[8], product_id[16];
 
         idetape_create_inquiry_cmd(&pc);
         if (idetape_queue_pc_tail(drive, &pc)) {
@@ -2350,11 +2350,11 @@ static void idetape_get_inquiry_results(ide_drive_t *drive)
         memcpy(product_id, &pc.buf[16], 16);
         memcpy(fw_rev, &pc.buf[32], 4);
 
-        ide_fixstring(vendor_id, 10, 0);
-        ide_fixstring(product_id, 18, 0);
-        ide_fixstring(fw_rev, 6, 0);
+        ide_fixstring(vendor_id, 8, 0);
+        ide_fixstring(product_id, 16, 0);
+        ide_fixstring(fw_rev, 4, 0);
 
-        printk(KERN_INFO "ide-tape: %s <-> %s: %s %s rev %s\n",
+        printk(KERN_INFO "ide-tape: %s <-> %s: %.8s %.16s rev %.4s\n",
                         drive->name, tape->name, vendor_id, product_id, fw_rev);
 }
 
diff --git a/drivers/ide/mips/swarm.c b/drivers/ide/mips/swarm.c
index badf79fc9e3a..39c9ee995857 100644
--- a/drivers/ide/mips/swarm.c
+++ b/drivers/ide/mips/swarm.c
@@ -107,6 +107,7 @@ static int __devinit swarm_ide_probe(struct device *dev)
 
         base = ioremap(offset, size);
 
+        memset(&hw, 0, sizeof(hw));
         for (i = 0; i <= 7; i++)
                 hw.io_ports_array[i] =
                                 (unsigned long)(base + ((0x1f0 + i) << 5));
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 1b1df5cc4113..e9ca3cb57d52 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -404,7 +404,7 @@ static void path_rec_completion(int status,
         struct net_device *dev = path->dev;
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ipoib_ah *ah = NULL;
-        struct ipoib_ah *old_ah;
+        struct ipoib_ah *old_ah = NULL;
         struct ipoib_neigh *neigh, *tn;
         struct sk_buff_head skqueue;
         struct sk_buff *skb;
@@ -428,12 +428,12 @@ static void path_rec_completion(int status,
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        old_ah   = path->ah;
-        path->ah = ah;
-
         if (ah) {
                 path->pathrec = *pathrec;
 
+                old_ah   = path->ah;
+                path->ah = ah;
+
                 ipoib_dbg(priv, "created address handle %p for LID 0x%04x, SL %d\n",
                           ah, be16_to_cpu(pathrec->dlid), pathrec->sl);
 
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 71dd65aa31b6..c2fcf28b4c70 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -63,6 +63,7 @@ struct multipath {
 
         const char *hw_handler_name;
         struct work_struct activate_path;
+        struct pgpath *pgpath_to_activate;
         unsigned nr_priority_groups;
         struct list_head priority_groups;
         unsigned pg_init_required;      /* pg_init needs calling? */
@@ -146,6 +147,7 @@ static struct priority_group *alloc_priority_group(void)
 
 static void free_pgpaths(struct list_head *pgpaths, struct dm_target *ti)
 {
+        unsigned long flags;
         struct pgpath *pgpath, *tmp;
         struct multipath *m = ti->private;
 
@@ -154,6 +156,10 @@ static void free_pgpaths(struct list_head *pgpaths, struct dm_target *ti)
                 if (m->hw_handler_name)
                         scsi_dh_detach(bdev_get_queue(pgpath->path.dev->bdev));
                 dm_put_device(ti, pgpath->path.dev);
+                spin_lock_irqsave(&m->lock, flags);
+                if (m->pgpath_to_activate == pgpath)
+                        m->pgpath_to_activate = NULL;
+                spin_unlock_irqrestore(&m->lock, flags);
                 free_pgpath(pgpath);
         }
 }
@@ -421,6 +427,7 @@ static void process_queued_ios(struct work_struct *work)
                 __choose_pgpath(m);
 
         pgpath = m->current_pgpath;
+        m->pgpath_to_activate = m->current_pgpath;
 
         if ((pgpath && !m->queue_io) ||
             (!pgpath && !m->queue_if_no_path))
@@ -1093,8 +1100,15 @@ static void activate_path(struct work_struct *work)
         int ret;
         struct multipath *m =
                 container_of(work, struct multipath, activate_path);
-        struct dm_path *path = &m->current_pgpath->path;
+        struct dm_path *path;
+        unsigned long flags;
 
+        spin_lock_irqsave(&m->lock, flags);
+        path = &m->pgpath_to_activate->path;
+        m->pgpath_to_activate = NULL;
+        spin_unlock_irqrestore(&m->lock, flags);
+        if (!path)
+                return;
         ret = scsi_dh_activate(bdev_get_queue(path->dev->bdev));
         pg_init_done(path, ret);
 }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index bca448e11878..ace998ce59f6 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -837,12 +837,14 @@ static int dm_merge_bvec(struct request_queue *q,
         struct dm_table *map = dm_get_table(md);
         struct dm_target *ti;
         sector_t max_sectors;
-        int max_size;
+        int max_size = 0;
 
         if (unlikely(!map))
-                return 0;
+                goto out;
 
         ti = dm_table_find_target(map, bvm->bi_sector);
+        if (!dm_target_is_valid(ti))
+                goto out_table;
 
         /*
          * Find maximum amount of I/O that won't need splitting
@@ -861,14 +863,16 @@ static int dm_merge_bvec(struct request_queue *q,
         if (max_size && ti->type->merge)
                 max_size = ti->type->merge(ti, bvm, biovec, max_size);
 
+out_table:
+        dm_table_put(map);
+
+out:
         /*
          * Always allow an entire first page
          */
         if (max_size <= biovec->bv_len && !(bvm->bi_size >> SECTOR_SHIFT))
                 max_size = biovec->bv_len;
 
-        dm_table_put(map);
-
         return max_size;
 }
 
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 10c44d3fe01a..68dc8d9eb24e 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -21,7 +21,7 @@ config MFD_SM501
 
 config MFD_SM501_GPIO
         bool "Export GPIO via GPIO layer"
-        depends on MFD_SM501 && HAVE_GPIO_LIB
+        depends on MFD_SM501 && GPIOLIB
          ---help---
          This option uses the gpio library layer to export the 64 GPIO
          lines on the SM501. The platform data is used to supply the
@@ -29,7 +29,7 @@ config MFD_SM501_GPIO
 
 config MFD_ASIC3
         bool "Support for Compaq ASIC3"
-        depends on GENERIC_HARDIRQS && HAVE_GPIO_LIB && ARM
+        depends on GENERIC_HARDIRQS && GPIOLIB && ARM
          ---help---
           This driver supports the ASIC3 multifunction chip found on many
           PDAs (mainly iPAQ and HTC based ones)
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index bc2a807f210d..ba5aa2008273 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -312,7 +312,6 @@ static int __init asic3_irq_probe(struct platform_device *pdev)
         struct asic3 *asic = platform_get_drvdata(pdev);
         unsigned long clksel = 0;
         unsigned int irq, irq_base;
-        int map_size;
         int ret;
 
         ret = platform_get_irq(pdev, 0);
@@ -534,6 +533,7 @@ static int __init asic3_probe(struct platform_device *pdev)
         struct asic3 *asic;
         struct resource *mem;
         unsigned long clksel;
+        int map_size;
         int ret = 0;
 
         asic = kzalloc(sizeof(struct asic3), GFP_KERNEL);
diff --git a/drivers/net/wireless/ath9k/core.c b/drivers/net/wireless/ath9k/core.c
index c04959357bda..87e37bc39145 100644
--- a/drivers/net/wireless/ath9k/core.c
+++ b/drivers/net/wireless/ath9k/core.c
@@ -795,6 +795,12 @@ int ath_open(struct ath_softc *sc, struct ath9k_channel *initial_chan)
         if (ah->ah_caps.hw_caps & ATH9K_HW_CAP_HT)
                 sc->sc_imask |= ATH9K_INT_CST;
 
+        /* Note: We disable MIB interrupts for now as we don't yet
+         * handle processing ANI, otherwise you will get an interrupt
+         * storm after about 7 hours of usage making the system unusable
+         * with huge latency. Once we do have ANI processing included
+         * we can re-enable this interrupt. */
+#if 0
         /*
          * Enable MIB interrupts when there are hardware phy counters.
          * Note we only do this (at the moment) for station mode.
@@ -802,6 +808,7 @@ int ath_open(struct ath_softc *sc, struct ath9k_channel *initial_chan)
         if (ath9k_hw_phycounters(ah) &&
             ((sc->sc_opmode == ATH9K_M_STA) || (sc->sc_opmode == ATH9K_M_IBSS)))
                 sc->sc_imask |= ATH9K_INT_MIB;
+#endif
         /*
          * Some hardware processes the TIM IE and fires an
          * interrupt when the TIM bit is set.  For hardware
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 45a3b93eed57..bf41887cdd65 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1834,7 +1834,6 @@ clear_risc_ints:
                 WRT_REG_WORD(&reg->isp.hccr, HCCR_CLR_HOST_INT);
         }
         spin_unlock_irq(&ha->hardware_lock);
-        ha->isp_ops->enable_intrs(ha);
 
 fail:
         return ret;
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 26afe44265c7..6d0f0e5f2827 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1740,6 +1740,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         if (ret)
                 goto probe_failed;
 
+        ha->isp_ops->enable_intrs(ha);
+
         scsi_scan_host(host);
 
         qla2x00_alloc_sysfs_attr(ha);
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index 4a1cf6377f6c..905350896725 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -914,6 +914,7 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
                                 ds[i].d_count = sg_dma_len(s);
                         }
                         sg_count -= n;
+                        sg = s;
                 }
         } else {
                 cmd->dataseg[0].d_base = 0;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ff5d56b3ee4d..62307bd794a9 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -852,7 +852,7 @@ static void scsi_end_bidi_request(struct scsi_cmnd *cmd)
 void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 {
         int result = cmd->result;
-        int this_count = scsi_bufflen(cmd);
+        int this_count;
         struct request_queue *q = cmd->device->request_queue;
         struct request *req = cmd->request;
         int error = 0;
@@ -908,6 +908,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
          */
         if (scsi_end_request(cmd, error, good_bytes, result == 0) == NULL)
                 return;
+        this_count = blk_rq_bytes(req);
 
         /* good_bytes = 0, or (inclusive) there were leftovers and
          * result = 0, so scsi_end_request couldn't retry.
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 87ab2443e66d..0ffabf5c0b60 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -471,6 +471,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
 #endif
                         break;
                 case SSB_BUSTYPE_SSB:
+                        dev->dma_mask = &dev->coherent_dma_mask;
                         break;
                 }
 
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index c95295c65045..e83aa5ebe861 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -626,8 +626,7 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
         return NULL;
 
 error:
-        if (fid)
-                p9_client_clunk(fid);
+        p9_client_clunk(fid);
 
         return ERR_PTR(result);
 }
diff --git a/fs/dcache.c b/fs/dcache.c
index 80e93956aced..e7a1a99b7464 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1395,6 +1395,10 @@ struct dentry * __d_lookup(struct dentry * parent, struct qstr * name)
                 if (dentry->d_parent != parent)
                         goto next;
 
+                /* non-existing due to RCU? */
+                if (d_unhashed(dentry))
+                        goto next;
+
                 /*
                  * It is safe to compare names since d_move() cannot
                  * change the qstr (protected by d_lock).
@@ -1410,10 +1414,8 @@ struct dentry * __d_lookup(struct dentry * parent, struct qstr * name)
                                 goto next;
                 }
 
-                if (!d_unhashed(dentry)) {
-                        atomic_inc(&dentry->d_count);
-                        found = dentry;
-                }
+                atomic_inc(&dentry->d_count);
+                found = dentry;
                 spin_unlock(&dentry->d_lock);
                 break;
 next:
diff --git a/fs/exec.c b/fs/exec.c
index 32993beecbe9..cecee501ce78 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -752,11 +752,11 @@ static int exec_mmap(struct mm_struct *mm)
         tsk->active_mm = mm;
         activate_mm(active_mm, mm);
         task_unlock(tsk);
-        mm_update_next_owner(old_mm);
         arch_pick_mmap_layout(mm);
         if (old_mm) {
                 up_read(&old_mm->mmap_sem);
                 BUG_ON(active_mm != old_mm);
+                mm_update_next_owner(old_mm);
                 mmput(old_mm);
                 return 0;
         }
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index b9cb77473758..d7f7645779f2 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -538,7 +538,7 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
                 printk(KERN_DEBUG "\t%d orphan inode numbers:\n", n);
                 for (i = 0; i < n; i++)
                         printk(KERN_DEBUG "\t  ino %llu\n",
-                               le64_to_cpu(orph->inos[i]));
+                               (unsigned long long)le64_to_cpu(orph->inos[i]));
                 break;
         }
         default:
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index 2b267c9a1806..526c01ec8003 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -426,7 +426,7 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
 
         while (1) {
                 dbg_gen("feed '%s', ino %llu, new f_pos %#x",
-                        dent->name, le64_to_cpu(dent->inum),
+                        dent->name, (unsigned long long)le64_to_cpu(dent->inum),
                         key_hash_flash(c, &dent->key));
                 ubifs_assert(dent->ch.sqnum > ubifs_inode(dir)->creat_sqnum);
 
diff --git a/fs/ubifs/find.c b/fs/ubifs/find.c
index e045c8b55423..47814cde2407 100644
--- a/fs/ubifs/find.c
+++ b/fs/ubifs/find.c
@@ -507,7 +507,6 @@ int ubifs_find_free_space(struct ubifs_info *c, int min_space, int *free,
                 rsvd_idx_lebs = 0;
         lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
                c->lst.taken_empty_lebs;
-        ubifs_assert(lebs + c->lst.idx_lebs >= c->min_idx_lebs);
         if (rsvd_idx_lebs < lebs)
                 /*
                  * OK to allocate an empty LEB, but we still don't want to go
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 13f1019c859f..02aba36fe3d4 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -334,15 +334,15 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
 
                 err = move_nodes(c, sleb);
                 if (err)
-                        goto out;
+                        goto out_inc_seq;
 
                 err = gc_sync_wbufs(c);
                 if (err)
-                        goto out;
+                        goto out_inc_seq;
 
                 err = ubifs_change_one_lp(c, lnum, c->leb_size, 0, 0, 0, 0);
                 if (err)
-                        goto out;
+                        goto out_inc_seq;
 
                 /* Allow for races with TNC */
                 c->gced_lnum = lnum;
@@ -369,6 +369,14 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
 out:
         ubifs_scan_destroy(sleb);
         return err;
+
+out_inc_seq:
+        /* We may have moved at least some nodes so allow for races with TNC */
+        c->gced_lnum = lnum;
+        smp_wmb();
+        c->gc_seq += 1;
+        smp_wmb();
+        goto out;
 }
 
 /**
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 7562464ac83f..3f4902060c7a 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1024,14 +1024,13 @@ static int mount_ubifs(struct ubifs_info *c)
                 goto out_dereg;
         }
 
+        sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num, c->vi.vol_id);
         if (!mounted_read_only) {
                 err = alloc_wbufs(c);
                 if (err)
                         goto out_cbuf;
 
                 /* Create background thread */
-                sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num,
-                        c->vi.vol_id);
                 c->bgt = kthread_create(ubifs_bg_thread, c, c->bgt_name);
                 if (!c->bgt)
                         c->bgt = ERR_PTR(-EINVAL);
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index 7da209ab9378..7634c5970887 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -1476,7 +1476,7 @@ again:
         }
 
         err = fallible_read_node(c, key, &zbr, node);
-        if (maybe_leb_gced(c, zbr.lnum, gc_seq1)) {
+        if (err <= 0 || maybe_leb_gced(c, zbr.lnum, gc_seq1)) {
                 /*
                  * The node may have been GC'ed out from under us so try again
                  * while keeping the TNC mutex locked.
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 00e80df9dd9d..dbd9cef852ec 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -4118,7 +4118,7 @@ xfs_iext_indirect_to_direct(
         ASSERT(nextents <= XFS_LINEAR_EXTS);
         size = nextents * sizeof(xfs_bmbt_rec_t);
 
-        xfs_iext_irec_compact_full(ifp);
+        xfs_iext_irec_compact_pages(ifp);
         ASSERT(ifp->if_real_bytes == XFS_IEXT_BUFSZ);
 
         ep = ifp->if_u1.if_ext_irec->er_extbuf;
@@ -4449,8 +4449,7 @@ xfs_iext_irec_remove(
  * compaction policy is as follows:
  *
  *    Full Compaction: Extents fit into a single page (or inline buffer)
- *    Full Compaction: Extents occupy less than 10% of allocated space
- * Partial Compaction: Extents occupy > 10% and < 50% of allocated space
+ * Partial Compaction: Extents occupy less than 50% of allocated space
  *      No Compaction: Extents occupy at least 50% of allocated space
  */
 void
@@ -4471,8 +4470,6 @@ xfs_iext_irec_compact(
                 xfs_iext_direct_to_inline(ifp, nextents);
         } else if (nextents <= XFS_LINEAR_EXTS) {
                 xfs_iext_indirect_to_direct(ifp);
-        } else if (nextents < (nlists * XFS_LINEAR_EXTS) >> 3) {
-                xfs_iext_irec_compact_full(ifp);
         } else if (nextents < (nlists * XFS_LINEAR_EXTS) >> 1) {
                 xfs_iext_irec_compact_pages(ifp);
         }
@@ -4496,7 +4493,7 @@ xfs_iext_irec_compact_pages(
                 erp_next = erp + 1;
                 if (erp_next->er_extcount <=
                     (XFS_LINEAR_EXTS - erp->er_extcount)) {
-                        memmove(&erp->er_extbuf[erp->er_extcount],
+                        memcpy(&erp->er_extbuf[erp->er_extcount],
                                 erp_next->er_extbuf, erp_next->er_extcount *
                                 sizeof(xfs_bmbt_rec_t));
                         erp->er_extcount += erp_next->er_extcount;
@@ -4516,91 +4513,6 @@ xfs_iext_irec_compact_pages(
 }
 
 /*
- * Fully compact the extent records managed by the indirection array.
- */
-void
-xfs_iext_irec_compact_full(
-        xfs_ifork_t     *ifp)                   /* inode fork pointer */
-{
-        xfs_bmbt_rec_host_t *ep, *ep_next;      /* extent record pointers */
-        xfs_ext_irec_t  *erp, *erp_next;        /* extent irec pointers */
-        int             erp_idx = 0;            /* extent irec index */
-        int             ext_avail;              /* empty entries in ex list */
-        int             ext_diff;               /* number of exts to add */
-        int             nlists;                 /* number of irec's (ex lists) */
-
-        ASSERT(ifp->if_flags & XFS_IFEXTIREC);
-
-        nlists = ifp->if_real_bytes / XFS_IEXT_BUFSZ;
-        erp = ifp->if_u1.if_ext_irec;
-        ep = &erp->er_extbuf[erp->er_extcount];
-        erp_next = erp + 1;
-        ep_next = erp_next->er_extbuf;
-
-        while (erp_idx < nlists - 1) {
-                /*
-                 * Check how many extent records are available in this irec.
-                 * If there is none skip the whole exercise.
-                 */
-                ext_avail = XFS_LINEAR_EXTS - erp->er_extcount;
-                if (ext_avail) {
-
-                        /*
-                         * Copy over as many as possible extent records into
-                         * the previous page.
-                         */
-                        ext_diff = MIN(ext_avail, erp_next->er_extcount);
-                        memcpy(ep, ep_next, ext_diff * sizeof(xfs_bmbt_rec_t));
-                        erp->er_extcount += ext_diff;
-                        erp_next->er_extcount -= ext_diff;
-
-                        /*
-                         * If the next irec is empty now we can simply
-                         * remove it.
-                         */
-                        if (erp_next->er_extcount == 0) {
-                                /*
-                                 * Free page before removing extent record
-                                 * so er_extoffs don't get modified in
-                                 * xfs_iext_irec_remove.
-                                 */
-                                kmem_free(erp_next->er_extbuf);
-                                erp_next->er_extbuf = NULL;
-                                xfs_iext_irec_remove(ifp, erp_idx + 1);
-                                erp = &ifp->if_u1.if_ext_irec[erp_idx];
-                                nlists = ifp->if_real_bytes / XFS_IEXT_BUFSZ;
-
-                        /*
-                         * If the next irec is not empty move up the content
-                         * that has not been copied to the previous page to
-                         * the beggining of this one.
-                         */
-                        } else {
-                                memmove(erp_next->er_extbuf, &ep_next[ext_diff],
-                                        erp_next->er_extcount *
-                                        sizeof(xfs_bmbt_rec_t));
-                                ep_next = erp_next->er_extbuf;
-                                memset(&ep_next[erp_next->er_extcount], 0,
-                                        (XFS_LINEAR_EXTS -
-                                                erp_next->er_extcount) *
-                                        sizeof(xfs_bmbt_rec_t));
-                        }
-                }
-
-                if (erp->er_extcount == XFS_LINEAR_EXTS) {
-                        erp_idx++;
-                        if (erp_idx < nlists)
-                                erp = &ifp->if_u1.if_ext_irec[erp_idx];
-                        else
-                                break;
-                }
-                ep = &erp->er_extbuf[erp->er_extcount];
-                erp_next = erp + 1;
-                ep_next = erp_next->er_extbuf;
-        }
-}
-
-/*
  * This is called to update the er_extoff field in the indirection
  * array when extents have been added or removed from one of the
  * extent lists. erp_idx contains the irec index to begin updating
diff --git a/include/asm-mips/pgtable-32.h b/include/asm-mips/pgtable-32.h
index 4396e9ffd418..55813d6150c7 100644
--- a/include/asm-mips/pgtable-32.h
+++ b/include/asm-mips/pgtable-32.h
@@ -57,7 +57,7 @@ extern int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
 #define PMD_ORDER       1
 #define PTE_ORDER       0
 
-#define PTRS_PER_PGD    ((PAGE_SIZE << PGD_ORDER) / sizeof(pgd_t))
+#define PTRS_PER_PGD    (USER_PTRS_PER_PGD * 2)
 #define PTRS_PER_PTE    ((PAGE_SIZE << PTE_ORDER) / sizeof(pte_t))
 
 #define USER_PTRS_PER_PGD       (0x80000000UL/PGDIR_SIZE)
diff --git a/include/asm-x86/kgdb.h b/include/asm-x86/kgdb.h
index 484c47554f3b..94d63db10365 100644
--- a/include/asm-x86/kgdb.h
+++ b/include/asm-x86/kgdb.h
@@ -39,12 +39,13 @@ enum regnames {
         GDB_FS,                 /* 14 */
         GDB_GS,                 /* 15 */
 };
+#define NUMREGBYTES             ((GDB_GS+1)*4)
 #else /* ! CONFIG_X86_32 */
-enum regnames {
+enum regnames64 {
         GDB_AX,                 /* 0 */
-        GDB_DX,                 /* 1 */
+        GDB_BX,                 /* 1 */
         GDB_CX,                 /* 2 */
-        GDB_BX,                 /* 3 */
+        GDB_DX,                 /* 3 */
         GDB_SI,                 /* 4 */
         GDB_DI,                 /* 5 */
         GDB_BP,                 /* 6 */
@@ -58,18 +59,15 @@ enum regnames {
         GDB_R14,                /* 14 */
         GDB_R15,                /* 15 */
         GDB_PC,                 /* 16 */
-        GDB_PS,                 /* 17 */
 };
-#endif /* CONFIG_X86_32 */
 
-/*
- * Number of bytes of registers:
- */
-#ifdef CONFIG_X86_32
-# define NUMREGBYTES            64
-#else
-# define NUMREGBYTES            ((GDB_PS+1)*8)
-#endif
+enum regnames32 {
+        GDB_PS = 34,
+        GDB_CS,
+        GDB_SS,
+};
+#define NUMREGBYTES             ((GDB_SS+1)*4)
+#endif /* CONFIG_X86_32 */
 
 static inline void arch_kgdb_breakpoint(void)
 {
diff --git a/arch/arm/include/asm/cnt32_to_63.h b/include/linux/cnt32_to_63.h
index 480c873fa746..8c0f9505b48c 100644
--- a/arch/arm/include/asm/cnt32_to_63.h
+++ b/include/linux/cnt32_to_63.h
@@ -1,5 +1,5 @@
 /*
- *  include/asm/cnt32_to_63.h -- extend a 32-bit counter to 63 bits
+ *  Extend a 32-bit counter to 63 bits
  *
  *  Author:     Nicolas Pitre
  *  Created:    December 3, 2006
@@ -10,15 +10,30 @@
  * as published by the Free Software Foundation.
  */
 
-#ifndef __INCLUDE_CNT32_TO_63_H__
-#define __INCLUDE_CNT32_TO_63_H__
+#ifndef __LINUX_CNT32_TO_63_H__
+#define __LINUX_CNT32_TO_63_H__
 
 #include <linux/compiler.h>
-#include <asm/types.h>
+#include <linux/types.h>
 #include <asm/byteorder.h>
 
-/*
- * Prototype: u64 cnt32_to_63(u32 cnt)
+/* this is used only to give gcc a clue about good code generation */
+union cnt32_to_63 {
+        struct {
+#if defined(__LITTLE_ENDIAN)
+                u32 lo, hi;
+#elif defined(__BIG_ENDIAN)
+                u32 hi, lo;
+#endif
+        };
+        u64 val;
+};
+
+
+/**
+ * cnt32_to_63 - Expand a 32-bit counter to a 63-bit counter
+ * @cnt_lo: The low part of the counter
+ *
  * Many hardware clock counters are only 32 bits wide and therefore have
  * a relatively short period making wrap-arounds rather frequent.  This
  * is a problem when implementing sched_clock() for example, where a 64-bit
@@ -51,26 +66,13 @@
  * clear-bit instruction. Otherwise caller must remember to clear the top
  * bit explicitly.
  */
-
-/* this is used only to give gcc a clue about good code generation */
-typedef union {
-        struct {
-#if defined(__LITTLE_ENDIAN)
-                u32 lo, hi;
-#elif defined(__BIG_ENDIAN)
-                u32 hi, lo;
-#endif
-        };
-        u64 val;
-} cnt32_to_63_t;
-
 #define cnt32_to_63(cnt_lo) \
 ({ \
-        static volatile u32 __m_cnt_hi = 0; \
-        cnt32_to_63_t __x; \
+        static volatile u32 __m_cnt_hi; \
+        union cnt32_to_63 __x; \
         __x.hi = __m_cnt_hi; \
         __x.lo = (cnt_lo); \
-        if (unlikely((s32)(__x.hi ^ __x.lo) < 0)) \
+        if (unlikely((s32)(__x.hi ^ __x.lo) < 0)) \
                 __m_cnt_hi = __x.hi = (__x.hi ^ 0x80000000) + (__x.hi >> 31); \
         __x.val; \
 })
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 6d93dce61cbb..2f245fe63bda 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -47,14 +47,22 @@ enum hrtimer_restart {
  *      HRTIMER_CB_IRQSAFE:             Callback may run in hardirq context
  *      HRTIMER_CB_IRQSAFE_NO_RESTART:  Callback may run in hardirq context and
  *                                      does not restart the timer
- *      HRTIMER_CB_IRQSAFE_NO_SOFTIRQ:  Callback must run in hardirq context
- *                                      Special mode for tick emultation
+ *      HRTIMER_CB_IRQSAFE_PERCPU:      Callback must run in hardirq context
+ *                                      Special mode for tick emulation and
+ *                                      scheduler timer. Such timers are per
+ *                                      cpu and not allowed to be migrated on
+ *                                      cpu unplug.
+ *      HRTIMER_CB_IRQSAFE_UNLOCKED:    Callback should run in hardirq context
+ *                                      with timer->base lock unlocked
+ *                                      used for timers which call wakeup to
+ *                                      avoid lock order problems with rq->lock
  */
 enum hrtimer_cb_mode {
         HRTIMER_CB_SOFTIRQ,
         HRTIMER_CB_IRQSAFE,
         HRTIMER_CB_IRQSAFE_NO_RESTART,
-        HRTIMER_CB_IRQSAFE_NO_SOFTIRQ,
+        HRTIMER_CB_IRQSAFE_PERCPU,
+        HRTIMER_CB_IRQSAFE_UNLOCKED,
 };
 
 /*
@@ -67,9 +75,10 @@ enum hrtimer_cb_mode {
  * 0x02         callback function running
  * 0x04         callback pending (high resolution mode)
  *
- * Special case:
+ * Special cases:
  * 0x03         callback function running and enqueued
  *              (was requeued on another CPU)
+ * 0x09         timer was migrated on CPU hotunplug
  * The "callback function running and enqueued" status is only possible on
  * SMP. It happens for example when a posix timer expired and the callback
  * queued a signal. Between dropping the lock which protects the posix timer
@@ -87,6 +96,7 @@ enum hrtimer_cb_mode {
 #define HRTIMER_STATE_ENQUEUED  0x01
 #define HRTIMER_STATE_CALLBACK  0x02
 #define HRTIMER_STATE_PENDING   0x04
+#define HRTIMER_STATE_MIGRATE   0x08
 
 /**
  * struct hrtimer - the basic hrtimer structure
diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index b3d3e27c6299..c3626c0ba9d3 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -596,4 +596,5 @@ int p9_idpool_check(int id, struct p9_idpool *p);
 int p9_error_init(void);
 int p9_errstr2errno(char *, int);
 int p9_trans_fd_init(void);
+void p9_trans_fd_exit(void);
 #endif /* NET_9P_H */
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index 0db3a4038dc0..3ca737120a90 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -26,6 +26,8 @@
 #ifndef NET_9P_TRANSPORT_H
 #define NET_9P_TRANSPORT_H
 
+#include <linux/module.h>
+
 /**
  * enum p9_trans_status - different states of underlying transports
  * @Connected: transport is connected and healthy
@@ -91,9 +93,12 @@ struct p9_trans_module {
         int maxsize;            /* max message size of transport */
         int def;                /* this transport should be default */
         struct p9_trans * (*create)(const char *, char *, int, unsigned char);
+        struct module *owner;
 };
 
 void v9fs_register_trans(struct p9_trans_module *m);
-struct p9_trans_module *v9fs_match_trans(const substring_t *name);
-struct p9_trans_module *v9fs_default_trans(void);
+void v9fs_unregister_trans(struct p9_trans_module *m);
+struct p9_trans_module *v9fs_get_trans_by_name(const substring_t *name);
+struct p9_trans_module *v9fs_get_default_trans(void);
+void v9fs_put_trans(struct p9_trans_module *m);
 #endif /* NET_9P_TRANSPORT_H */
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 24811732bdb2..029a54a02396 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -227,6 +227,9 @@ struct sctp_chunk *sctp_make_abort_violation(const struct sctp_association *,
                                    const struct sctp_chunk *,
                                    const __u8 *,
                                    const size_t );
+struct sctp_chunk *sctp_make_violation_paramlen(const struct sctp_association *,
+                                   const struct sctp_chunk *,
+                                   struct sctp_paramhdr *);
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *,
                                   const struct sctp_transport *,
                                   const void *payload,
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 13932abde159..a0123d75ec9a 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2738,14 +2738,15 @@ void cgroup_fork_callbacks(struct task_struct *child)
  */
 void cgroup_mm_owner_callbacks(struct task_struct *old, struct task_struct *new)
 {
-        struct cgroup *oldcgrp, *newcgrp;
+        struct cgroup *oldcgrp, *newcgrp = NULL;
 
         if (need_mm_owner_callback) {
                 int i;
                 for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                         struct cgroup_subsys *ss = subsys[i];
                         oldcgrp = task_cgroup(old, ss->subsys_id);
-                        newcgrp = task_cgroup(new, ss->subsys_id);
+                        if (new)
+                                newcgrp = task_cgroup(new, ss->subsys_id);
                         if (oldcgrp == newcgrp)
                                 continue;
                         if (ss->mm_owner_changed)
diff --git a/kernel/exit.c b/kernel/exit.c
index 16395644a98f..85a83c831856 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -583,8 +583,6 @@ mm_need_new_owner(struct mm_struct *mm, struct task_struct *p)
          * If there are other users of the mm and the owner (us) is exiting
          * we need to find a new owner to take on the responsibility.
          */
-        if (!mm)
-                return 0;
         if (atomic_read(&mm->mm_users) <= 1)
                 return 0;
         if (mm->owner != p)
@@ -627,6 +625,16 @@ retry:
         } while_each_thread(g, c);
 
         read_unlock(&tasklist_lock);
+        /*
+         * We found no owner yet mm_users > 1: this implies that we are
+         * most likely racing with swapoff (try_to_unuse()) or /proc or
+         * ptrace or page migration (get_task_mm()).  Mark owner as NULL,
+         * so that subsystems can understand the callback and take action.
+         */
+        down_write(&mm->mmap_sem);
+        cgroup_mm_owner_callbacks(mm->owner, NULL);
+        mm->owner = NULL;
+        up_write(&mm->mmap_sem);
         return;
 
 assign_new_owner:
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index b8e4dce80a74..cdec83e722fa 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -672,13 +672,14 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
                          */
                         BUG_ON(timer->function(timer) != HRTIMER_NORESTART);
                         return 1;
-                case HRTIMER_CB_IRQSAFE_NO_SOFTIRQ:
+                case HRTIMER_CB_IRQSAFE_PERCPU:
+                case HRTIMER_CB_IRQSAFE_UNLOCKED:
                         /*
                          * This is solely for the sched tick emulation with
                          * dynamic tick support to ensure that we do not
                          * restart the tick right on the edge and end up with
                          * the tick timer in the softirq ! The calling site
-                         * takes care of this.
+                         * takes care of this. Also used for hrtimer sleeper !
                          */
                         debug_hrtimer_deactivate(timer);
                         return 1;
@@ -1245,7 +1246,8 @@ static void __run_hrtimer(struct hrtimer *timer)
         timer_stats_account_hrtimer(timer);
 
         fn = timer->function;
-        if (timer->cb_mode == HRTIMER_CB_IRQSAFE_NO_SOFTIRQ) {
+        if (timer->cb_mode == HRTIMER_CB_IRQSAFE_PERCPU ||
+            timer->cb_mode == HRTIMER_CB_IRQSAFE_UNLOCKED) {
                 /*
                  * Used for scheduler timers, avoid lock inversion with
                  * rq->lock and tasklist_lock.
@@ -1452,7 +1454,7 @@ void hrtimer_init_sleeper(struct hrtimer_sleeper *sl, struct task_struct *task)
         sl->timer.function = hrtimer_wakeup;
         sl->task = task;
 #ifdef CONFIG_HIGH_RES_TIMERS
-        sl->timer.cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        sl->timer.cb_mode = HRTIMER_CB_IRQSAFE_UNLOCKED;
 #endif
 }
 
@@ -1591,29 +1593,95 @@ static void __cpuinit init_hrtimers_cpu(int cpu)
 
 #ifdef CONFIG_HOTPLUG_CPU
 
-static void migrate_hrtimer_list(struct hrtimer_clock_base *old_base,
-                                struct hrtimer_clock_base *new_base)
+static int migrate_hrtimer_list(struct hrtimer_clock_base *old_base,
+                                struct hrtimer_clock_base *new_base, int dcpu)
 {
         struct hrtimer *timer;
         struct rb_node *node;
+        int raise = 0;
 
         while ((node = rb_first(&old_base->active))) {
                 timer = rb_entry(node, struct hrtimer, node);
                 BUG_ON(hrtimer_callback_running(timer));
                 debug_hrtimer_deactivate(timer);
-                __remove_hrtimer(timer, old_base, HRTIMER_STATE_INACTIVE, 0);
+
+                /*
+                 * Should not happen. Per CPU timers should be
+                 * canceled _before_ the migration code is called
+                 */
+                if (timer->cb_mode == HRTIMER_CB_IRQSAFE_PERCPU) {
+                        __remove_hrtimer(timer, old_base,
+                                         HRTIMER_STATE_INACTIVE, 0);
+                        WARN(1, "hrtimer (%p %p)active but cpu %d dead\n",
+                             timer, timer->function, dcpu);
+                        continue;
+                }
+
+                /*
+                 * Mark it as STATE_MIGRATE not INACTIVE otherwise the
+                 * timer could be seen as !active and just vanish away
+                 * under us on another CPU
+                 */
+                __remove_hrtimer(timer, old_base, HRTIMER_STATE_MIGRATE, 0);
                 timer->base = new_base;
                 /*
                  * Enqueue the timer. Allow reprogramming of the event device
                  */
                 enqueue_hrtimer(timer, new_base, 1);
+
+#ifdef CONFIG_HIGH_RES_TIMERS
+                /*
+                 * Happens with high res enabled when the timer was
+                 * already expired and the callback mode is
+                 * HRTIMER_CB_IRQSAFE_UNLOCKED (hrtimer_sleeper). The
+                 * enqueue code does not move them to the soft irq
+                 * pending list for performance/latency reasons, but
+                 * in the migration state, we need to do that
+                 * otherwise we end up with a stale timer.
+                 */
+                if (timer->state == HRTIMER_STATE_MIGRATE) {
+                        timer->state = HRTIMER_STATE_PENDING;
+                        list_add_tail(&timer->cb_entry,
+                                      &new_base->cpu_base->cb_pending);
+                        raise = 1;
+                }
+#endif
+                /* Clear the migration state bit */
+                timer->state &= ~HRTIMER_STATE_MIGRATE;
+        }
+        return raise;
+}
+
+#ifdef CONFIG_HIGH_RES_TIMERS
+static int migrate_hrtimer_pending(struct hrtimer_cpu_base *old_base,
+                                   struct hrtimer_cpu_base *new_base)
+{
+        struct hrtimer *timer;
+        int raise = 0;
+
+        while (!list_empty(&old_base->cb_pending)) {
+                timer = list_entry(old_base->cb_pending.next,
+                                   struct hrtimer, cb_entry);
+
+                __remove_hrtimer(timer, timer->base, HRTIMER_STATE_PENDING, 0);
+                timer->base = &new_base->clock_base[timer->base->index];
+                list_add_tail(&timer->cb_entry, &new_base->cb_pending);
+                raise = 1;
         }
+        return raise;
+}
+#else
+static int migrate_hrtimer_pending(struct hrtimer_cpu_base *old_base,
+                                   struct hrtimer_cpu_base *new_base)
+{
+        return 0;
 }
+#endif
 
 static void migrate_hrtimers(int cpu)
 {
         struct hrtimer_cpu_base *old_base, *new_base;
-        int i;
+        int i, raise = 0;
 
         BUG_ON(cpu_online(cpu));
         old_base = &per_cpu(hrtimer_bases, cpu);
@@ -1626,14 +1694,21 @@ static void migrate_hrtimers(int cpu)
         spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING);
 
         for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
-                migrate_hrtimer_list(&old_base->clock_base[i],
-                                     &new_base->clock_base[i]);
+                if (migrate_hrtimer_list(&old_base->clock_base[i],
+                                         &new_base->clock_base[i], cpu))
+                        raise = 1;
         }
 
+        if (migrate_hrtimer_pending(old_base, new_base))
+                raise = 1;
+
         spin_unlock(&old_base->lock);
         spin_unlock(&new_base->lock);
         local_irq_enable();
         put_cpu_var(hrtimer_bases);
+
+        if (raise)
+                hrtimer_raise_softirq();
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
diff --git a/kernel/kgdb.c b/kernel/kgdb.c
index eaa21fc9ad1d..25d955dbb989 100644
--- a/kernel/kgdb.c
+++ b/kernel/kgdb.c
@@ -488,7 +488,7 @@ static int write_mem_msg(int binary)
                 if (err)
                         return err;
                 if (CACHE_FLUSH_IS_SAFE)
-                        flush_icache_range(addr, addr + length + 1);
+                        flush_icache_range(addr, addr + length);
                 return 0;
         }
 
@@ -1462,7 +1462,7 @@ acquirelock:
          * Get the passive CPU lock which will hold all the non-primary
          * CPU in a spin state while the debugger is active
          */
-        if (!kgdb_single_step || !kgdb_contthread) {
+        if (!kgdb_single_step) {
                 for (i = 0; i < NR_CPUS; i++)
                         atomic_set(&passive_cpu_wait[i], 1);
         }
@@ -1475,7 +1475,7 @@ acquirelock:
 
 #ifdef CONFIG_SMP
         /* Signal the other CPUs to enter kgdb_wait() */
-        if ((!kgdb_single_step || !kgdb_contthread) && kgdb_do_roundup)
+        if ((!kgdb_single_step) && kgdb_do_roundup)
                 kgdb_roundup_cpus(flags);
 #endif
 
@@ -1494,7 +1494,7 @@ acquirelock:
         kgdb_post_primary_code(ks->linux_regs, ks->ex_vector, ks->err_code);
         kgdb_deactivate_sw_breakpoints();
         kgdb_single_step = 0;
-        kgdb_contthread = NULL;
+        kgdb_contthread = current;
         exception_level = 0;
 
         /* Talk to debugger with gdbserial protocol */
@@ -1508,7 +1508,7 @@ acquirelock:
         kgdb_info[ks->cpu].task = NULL;
         atomic_set(&cpu_in_kgdb[ks->cpu], 0);
 
-        if (!kgdb_single_step || !kgdb_contthread) {
+        if (!kgdb_single_step) {
                 for (i = NR_CPUS-1; i >= 0; i--)
                         atomic_set(&passive_cpu_wait[i], 0);
                 /*
diff --git a/kernel/sched.c b/kernel/sched.c
index 13dd2db9fb2d..ad1962dc0aa2 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -201,7 +201,7 @@ void init_rt_bandwidth(struct rt_bandwidth *rt_b, u64 period, u64 runtime)
         hrtimer_init(&rt_b->rt_period_timer,
                         CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         rt_b->rt_period_timer.function = sched_rt_period_timer;
-        rt_b->rt_period_timer.cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        rt_b->rt_period_timer.cb_mode = HRTIMER_CB_IRQSAFE_UNLOCKED;
 }
 
 static void start_rt_bandwidth(struct rt_bandwidth *rt_b)
@@ -1119,7 +1119,7 @@ static void init_rq_hrtick(struct rq *rq)
 
         hrtimer_init(&rq->hrtick_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         rq->hrtick_timer.function = hrtick;
-        rq->hrtick_timer.cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        rq->hrtick_timer.cb_mode = HRTIMER_CB_IRQSAFE_PERCPU;
 }
 #else
 static inline void hrtick_clear(struct rq *rq)
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 39019b3f7621..cb02324bdb88 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -625,7 +625,7 @@ void tick_setup_sched_timer(void)
          */
         hrtimer_init(&ts->sched_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
         ts->sched_timer.function = tick_sched_timer;
-        ts->sched_timer.cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        ts->sched_timer.cb_mode = HRTIMER_CB_IRQSAFE_PERCPU;
 
         /* Get the next period (per cpu) */
         ts->sched_timer.expires = tick_init_jiffy_update();
diff --git a/kernel/trace/trace_sysprof.c b/kernel/trace/trace_sysprof.c
index bb948e52ce20..db58fb66a135 100644
--- a/kernel/trace/trace_sysprof.c
+++ b/kernel/trace/trace_sysprof.c
@@ -202,7 +202,7 @@ static void start_stack_timer(int cpu)
 
         hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         hrtimer->function = stack_trace_timer_fn;
-        hrtimer->cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        hrtimer->cb_mode = HRTIMER_CB_IRQSAFE_PERCPU;
 
         hrtimer_start(hrtimer, ns_to_ktime(sample_period), HRTIMER_MODE_REL);
 }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c0500e4d3a2f..36896f3eb7f5 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -250,6 +250,14 @@ static struct mem_cgroup *mem_cgroup_from_cont(struct cgroup *cont)
 
 struct mem_cgroup *mem_cgroup_from_task(struct task_struct *p)
 {
+        /*
+         * mm_update_next_owner() may clear mm->owner to NULL
+         * if it races with swapoff, page migration, etc.
+         * So this can be called with p == NULL.
+         */
+        if (unlikely(!p))
+                return NULL;
+
         return container_of(task_subsys_state(p, mem_cgroup_subsys_id),
                                 struct mem_cgroup, css);
 }
@@ -549,6 +557,11 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
         if (likely(!memcg)) {
                 rcu_read_lock();
                 mem = mem_cgroup_from_task(rcu_dereference(mm->owner));
+                if (unlikely(!mem)) {
+                        rcu_read_unlock();
+                        kmem_cache_free(page_cgroup_cache, pc);
+                        return 0;
+                }
                 /*
                  * For every charge from the cgroup, increment reference count
                  */
@@ -801,6 +814,10 @@ int mem_cgroup_shrink_usage(struct mm_struct *mm, gfp_t gfp_mask)
 
         rcu_read_lock();
         mem = mem_cgroup_from_task(rcu_dereference(mm->owner));
+        if (unlikely(!mem)) {
+                rcu_read_unlock();
+                return 0;
+        }
         css_get(&mem->css);
         rcu_read_unlock();
 
diff --git a/net/9p/client.c b/net/9p/client.c
index 2ffe40cf2f01..10e320307ec0 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -75,7 +75,6 @@ static int parse_opts(char *opts, struct p9_client *clnt)
         int option;
         int ret = 0;
 
-        clnt->trans_mod = v9fs_default_trans();
         clnt->dotu = 1;
         clnt->msize = 8192;
 
@@ -108,7 +107,7 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                         clnt->msize = option;
                         break;
                 case Opt_trans:
-                        clnt->trans_mod = v9fs_match_trans(&args[0]);
+                        clnt->trans_mod = v9fs_get_trans_by_name(&args[0]);
                         break;
                 case Opt_legacy:
                         clnt->dotu = 0;
@@ -117,6 +116,10 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                         continue;
                 }
         }
+
+        if (!clnt->trans_mod)
+                clnt->trans_mod = v9fs_get_default_trans();
+
         kfree(options);
         return ret;
 }
@@ -150,6 +153,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
         if (!clnt)
                 return ERR_PTR(-ENOMEM);
 
+        clnt->trans_mod = NULL;
         clnt->trans = NULL;
         spin_lock_init(&clnt->lock);
         INIT_LIST_HEAD(&clnt->fidlist);
@@ -235,6 +239,8 @@ void p9_client_destroy(struct p9_client *clnt)
                 clnt->trans = NULL;
         }
 
+        v9fs_put_trans(clnt->trans_mod);
+
         list_for_each_entry_safe(fid, fidptr, &clnt->fidlist, flist)
                 p9_fid_destroy(fid);
 
diff --git a/net/9p/conv.c b/net/9p/conv.c
index 44547201f5bc..5ad3a3bd73b2 100644
--- a/net/9p/conv.c
+++ b/net/9p/conv.c
@@ -451,8 +451,10 @@ p9_put_data(struct cbuf *bufp, const char *data, int count,
                    unsigned char **pdata)
 {
         *pdata = buf_alloc(bufp, count);
+        if (*pdata == NULL)
+                return -ENOMEM;
         memmove(*pdata, data, count);
-        return count;
+        return 0;
 }
 
 static int
@@ -460,6 +462,8 @@ p9_put_user_data(struct cbuf *bufp, const char __user *data, int count,
                    unsigned char **pdata)
 {
         *pdata = buf_alloc(bufp, count);
+        if (*pdata == NULL)
+                return -ENOMEM;
         return copy_from_user(*pdata, data, count);
 }
 
diff --git a/net/9p/mod.c b/net/9p/mod.c
index bdee1fb7cc62..1084feb24cb0 100644
--- a/net/9p/mod.c
+++ b/net/9p/mod.c
@@ -31,6 +31,7 @@
 #include <linux/parser.h>
 #include <net/9p/transport.h>
 #include <linux/list.h>
+#include <linux/spinlock.h>
 
 #ifdef CONFIG_NET_9P_DEBUG
 unsigned int p9_debug_level = 0;        /* feature-rific global debug level  */
@@ -44,8 +45,8 @@ MODULE_PARM_DESC(debug, "9P debugging level");
  *
  */
 
+static DEFINE_SPINLOCK(v9fs_trans_lock);
 static LIST_HEAD(v9fs_trans_list);
-static struct p9_trans_module *v9fs_default_transport;
 
 /**
  * v9fs_register_trans - register a new transport with 9p
@@ -54,48 +55,87 @@ static struct p9_trans_module *v9fs_default_transport;
  */
 void v9fs_register_trans(struct p9_trans_module *m)
 {
+        spin_lock(&v9fs_trans_lock);
         list_add_tail(&m->list, &v9fs_trans_list);
-        if (m->def)
-                v9fs_default_transport = m;
+        spin_unlock(&v9fs_trans_lock);
 }
 EXPORT_SYMBOL(v9fs_register_trans);
 
 /**
- * v9fs_match_trans - match transport versus registered transports
+ * v9fs_unregister_trans - unregister a 9p transport
+ * @m: the transport to remove
+ *
+ */
+void v9fs_unregister_trans(struct p9_trans_module *m)
+{
+        spin_lock(&v9fs_trans_lock);
+        list_del_init(&m->list);
+        spin_unlock(&v9fs_trans_lock);
+}
+EXPORT_SYMBOL(v9fs_unregister_trans);
+
+/**
+ * v9fs_get_trans_by_name - get transport with the matching name
  * @name: string identifying transport
  *
  */
-struct p9_trans_module *v9fs_match_trans(const substring_t *name)
+struct p9_trans_module *v9fs_get_trans_by_name(const substring_t *name)
 {
-        struct list_head *p;
-        struct p9_trans_module *t = NULL;
-
-        list_for_each(p, &v9fs_trans_list) {
-                t = list_entry(p, struct p9_trans_module, list);
-                if (strncmp(t->name, name->from, name->to-name->from) == 0)
-                        return t;
-        }
-        return NULL;
+        struct p9_trans_module *t, *found = NULL;
+
+        spin_lock(&v9fs_trans_lock);
+
+        list_for_each_entry(t, &v9fs_trans_list, list)
+                if (strncmp(t->name, name->from, name->to-name->from) == 0 &&
+                    try_module_get(t->owner)) {
+                        found = t;
+                        break;
+                }
+
+        spin_unlock(&v9fs_trans_lock);
+        return found;
 }
-EXPORT_SYMBOL(v9fs_match_trans);
+EXPORT_SYMBOL(v9fs_get_trans_by_name);
 
 /**
- * v9fs_default_trans - returns pointer to default transport
+ * v9fs_get_default_trans - get the default transport
  *
  */
 
-struct p9_trans_module *v9fs_default_trans(void)
+struct p9_trans_module *v9fs_get_default_trans(void)
 {
-        if (v9fs_default_transport)
-                return v9fs_default_transport;
-        else if (!list_empty(&v9fs_trans_list))
-                return list_first_entry(&v9fs_trans_list,
-                                        struct p9_trans_module, list);
-        else
-                return NULL;
+        struct p9_trans_module *t, *found = NULL;
+
+        spin_lock(&v9fs_trans_lock);
+
+        list_for_each_entry(t, &v9fs_trans_list, list)
+                if (t->def && try_module_get(t->owner)) {
+                        found = t;
+                        break;
+                }
+
+        if (!found)
+                list_for_each_entry(t, &v9fs_trans_list, list)
+                        if (try_module_get(t->owner)) {
+                                found = t;
+                                break;
+                        }
+
+        spin_unlock(&v9fs_trans_lock);
+        return found;
 }
-EXPORT_SYMBOL(v9fs_default_trans);
+EXPORT_SYMBOL(v9fs_get_default_trans);
 
+/**
+ * v9fs_put_trans - put trans
+ * @m: transport to put
+ *
+ */
+void v9fs_put_trans(struct p9_trans_module *m)
+{
+        if (m)
+                module_put(m->owner);
+}
 
 /**
  * v9fs_init - Initialize module
@@ -120,6 +160,8 @@ static int __init init_p9(void)
 static void __exit exit_p9(void)
 {
         printk(KERN_INFO "Unloading 9P2000 support\n");
+
+        p9_trans_fd_exit();
 }
 
 module_init(init_p9)
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index cdf137af7adc..d652baf5ff91 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -151,7 +151,6 @@ struct p9_mux_poll_task {
  * @trans: reference to transport instance for this connection
  * @tagpool: id accounting for transactions
  * @err: error state
- * @equeue: event wait_q (?)
  * @req_list: accounting for requests which have been sent
  * @unsent_req_list: accounting for requests that haven't been sent
  * @rcall: current response &p9_fcall structure
@@ -178,7 +177,6 @@ struct p9_conn {
         struct p9_trans *trans;
         struct p9_idpool *tagpool;
         int err;
-        wait_queue_head_t equeue;
         struct list_head req_list;
         struct list_head unsent_req_list;
         struct p9_fcall *rcall;
@@ -240,22 +238,6 @@ static int p9_conn_rpcnb(struct p9_conn *m, struct p9_fcall *tc,
 
 static void p9_conn_cancel(struct p9_conn *m, int err);
 
-static int p9_mux_global_init(void)
-{
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(p9_mux_poll_tasks); i++)
-                p9_mux_poll_tasks[i].task = NULL;
-
-        p9_mux_wq = create_workqueue("v9fs");
-        if (!p9_mux_wq) {
-                printk(KERN_WARNING "v9fs: mux: creating workqueue failed\n");
-                return -ENOMEM;
-        }
-
-        return 0;
-}
-
 static u16 p9_mux_get_tag(struct p9_conn *m)
 {
         int tag;
@@ -409,11 +391,11 @@ static void p9_mux_poll_stop(struct p9_conn *m)
 static struct p9_conn *p9_conn_create(struct p9_trans *trans)
 {
         int i, n;
-        struct p9_conn *m, *mtmp;
+        struct p9_conn *m;
 
         P9_DPRINTK(P9_DEBUG_MUX, "transport %p msize %d\n", trans,
                                                                 trans->msize);
-        m = kmalloc(sizeof(struct p9_conn), GFP_KERNEL);
+        m = kzalloc(sizeof(struct p9_conn), GFP_KERNEL);
         if (!m)
                 return ERR_PTR(-ENOMEM);
 
@@ -424,25 +406,14 @@ static struct p9_conn *p9_conn_create(struct p9_trans *trans)
         m->trans = trans;
         m->tagpool = p9_idpool_create();
         if (IS_ERR(m->tagpool)) {
-                mtmp = ERR_PTR(-ENOMEM);
                 kfree(m);
-                return mtmp;
+                return ERR_PTR(-ENOMEM);
         }
 
-        m->err = 0;
-        init_waitqueue_head(&m->equeue);
         INIT_LIST_HEAD(&m->req_list);
         INIT_LIST_HEAD(&m->unsent_req_list);
-        m->rcall = NULL;
-        m->rpos = 0;
-        m->rbuf = NULL;
-        m->wpos = m->wsize = 0;
-        m->wbuf = NULL;
         INIT_WORK(&m->rq, p9_read_work);
         INIT_WORK(&m->wq, p9_write_work);
-        m->wsched = 0;
-        memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
-        m->poll_task = NULL;
         n = p9_mux_poll_start(m);
         if (n) {
                 kfree(m);
@@ -463,10 +434,8 @@ static struct p9_conn *p9_conn_create(struct p9_trans *trans)
         for (i = 0; i < ARRAY_SIZE(m->poll_waddr); i++) {
                 if (IS_ERR(m->poll_waddr[i])) {
                         p9_mux_poll_stop(m);
-                        mtmp = (void *)m->poll_waddr;   /* the error code */
                         kfree(m);
-                        m = mtmp;
-                        break;
+                        return (void *)m->poll_waddr;   /* the error code */
                 }
         }
 
@@ -483,18 +452,13 @@ static void p9_conn_destroy(struct p9_conn *m)
 {
         P9_DPRINTK(P9_DEBUG_MUX, "mux %p prev %p next %p\n", m,
                 m->mux_list.prev, m->mux_list.next);
-        p9_conn_cancel(m, -ECONNRESET);
-
-        if (!list_empty(&m->req_list)) {
-                /* wait until all processes waiting on this session exit */
-                P9_DPRINTK(P9_DEBUG_MUX,
-                        "mux %p waiting for empty request queue\n", m);
-                wait_event_timeout(m->equeue, (list_empty(&m->req_list)), 5000);
-                P9_DPRINTK(P9_DEBUG_MUX, "mux %p request queue empty: %d\n", m,
-                        list_empty(&m->req_list));
-        }
 
         p9_mux_poll_stop(m);
+        cancel_work_sync(&m->rq);
+        cancel_work_sync(&m->wq);
+
+        p9_conn_cancel(m, -ECONNRESET);
+
         m->trans = NULL;
         p9_idpool_destroy(m->tagpool);
         kfree(m);
@@ -840,8 +804,6 @@ static void p9_read_work(struct work_struct *work)
                                         (*req->cb) (req, req->cba);
                                 else
                                         kfree(req->rcall);
-
-                                wake_up(&m->equeue);
                         }
                 } else {
                         if (err >= 0 && rcall->id != P9_RFLUSH)
@@ -908,8 +870,10 @@ static struct p9_req *p9_send_request(struct p9_conn *m,
         else
                 n = p9_mux_get_tag(m);
 
-        if (n < 0)
+        if (n < 0) {
+                kfree(req);
                 return ERR_PTR(-ENOMEM);
+        }
 
         p9_set_tag(tc, n);
 
@@ -984,8 +948,6 @@ static void p9_mux_flush_cb(struct p9_req *freq, void *a)
                         (*req->cb) (req, req->cba);
                 else
                         kfree(req->rcall);
-
-                wake_up(&m->equeue);
         }
 
         kfree(freq->tcall);
@@ -1191,8 +1153,6 @@ void p9_conn_cancel(struct p9_conn *m, int err)
                 else
                         kfree(req->rcall);
         }
-
-        wake_up(&m->equeue);
 }
 
 /**
@@ -1370,7 +1330,6 @@ p9_fd_poll(struct p9_trans *trans, struct poll_table_struct *pt)
 {
         int ret, n;
         struct p9_trans_fd *ts = NULL;
-        mm_segment_t oldfs;
 
         if (trans && trans->status == Connected)
                 ts = trans->priv;
@@ -1384,24 +1343,17 @@ p9_fd_poll(struct p9_trans *trans, struct poll_table_struct *pt)
         if (!ts->wr->f_op || !ts->wr->f_op->poll)
                 return -EIO;
 
-        oldfs = get_fs();
-        set_fs(get_ds());
-
         ret = ts->rd->f_op->poll(ts->rd, pt);
         if (ret < 0)
-                goto end;
+                return ret;
 
         if (ts->rd != ts->wr) {
                 n = ts->wr->f_op->poll(ts->wr, pt);
-                if (n < 0) {
-                        ret = n;
-                        goto end;
-                }
+                if (n < 0)
+                        return n;
                 ret = (ret & ~POLLOUT) | (n & ~POLLIN);
         }
 
-end:
-        set_fs(oldfs);
         return ret;
 }
 
@@ -1629,6 +1581,7 @@ static struct p9_trans_module p9_tcp_trans = {
         .maxsize = MAX_SOCK_BUF,
         .def = 1,
         .create = p9_trans_create_tcp,
+        .owner = THIS_MODULE,
 };
 
 static struct p9_trans_module p9_unix_trans = {
@@ -1636,6 +1589,7 @@ static struct p9_trans_module p9_unix_trans = {
         .maxsize = MAX_SOCK_BUF,
         .def = 0,
         .create = p9_trans_create_unix,
+        .owner = THIS_MODULE,
 };
 
 static struct p9_trans_module p9_fd_trans = {
@@ -1643,14 +1597,20 @@ static struct p9_trans_module p9_fd_trans = {
         .maxsize = MAX_SOCK_BUF,
         .def = 0,
         .create = p9_trans_create_fd,
+        .owner = THIS_MODULE,
 };
 
 int p9_trans_fd_init(void)
 {
-        int ret = p9_mux_global_init();
-        if (ret) {
-                printk(KERN_WARNING "9p: starting mux failed\n");
-                return ret;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(p9_mux_poll_tasks); i++)
+                p9_mux_poll_tasks[i].task = NULL;
+
+        p9_mux_wq = create_workqueue("v9fs");
+        if (!p9_mux_wq) {
+                printk(KERN_WARNING "v9fs: mux: creating workqueue failed\n");
+                return -ENOMEM;
         }
 
         v9fs_register_trans(&p9_tcp_trans);
@@ -1659,4 +1619,12 @@ int p9_trans_fd_init(void)
 
         return 0;
 }
-EXPORT_SYMBOL(p9_trans_fd_init);
+
+void p9_trans_fd_exit(void)
+{
+        v9fs_unregister_trans(&p9_tcp_trans);
+        v9fs_unregister_trans(&p9_unix_trans);
+        v9fs_unregister_trans(&p9_fd_trans);
+
+        destroy_workqueue(p9_mux_wq);
+}
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 42adc052b149..94912e077a55 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -528,6 +528,7 @@ static struct p9_trans_module p9_virtio_trans = {
         .create = p9_virtio_create,
         .maxsize = PAGE_SIZE*16,
         .def = 0,
+        .owner = THIS_MODULE,
 };
 
 /* The standard init function */
@@ -545,6 +546,7 @@ static int __init p9_virtio_init(void)
 static void __exit p9_virtio_cleanup(void)
 {
         unregister_virtio_driver(&p9_virtio_drv);
+        v9fs_unregister_trans(&p9_virtio_trans);
 }
 
 module_init(p9_virtio_init);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1b4fee20fc93..011478e46c40 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -618,7 +618,7 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
                         ];
         } rep;
         struct ip_reply_arg arg;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(skb->dst->dev);
 
         memset(&rep.th, 0, sizeof(struct tcphdr));
         memset(&arg, 0, sizeof(arg));
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 62e39ace0588..26654b26d7fa 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -97,8 +97,6 @@ hbh_mt6(const struct sk_buff *skb, const struct net_device *in,
         hdrlen -= 2;
         if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
                 return ret;
-        } else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
-                pr_debug("Not strict - not implemented");
         } else {
                 pr_debug("Strict ");
                 pr_debug("#%d ", optinfo->optsnr);
@@ -177,6 +175,12 @@ hbh_mt6_check(const char *tablename, const void *entry,
                 pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
                 return false;
         }
+
+        if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
+                pr_debug("ip6t_opts: Not strict - not implemented");
+                return false;
+        }
+
         return true;
 }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9af6115f0f50..63442a1e741c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2688,6 +2688,8 @@ int __init ip6_route_init(void)
         if (ret)
                 goto out_kmem_cache;
 
+        ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
+
         /* Registering of the loopback is done before this portion of code,
          * the loopback reference in rt6_info will not be taken, do it
          * manually for init_net */
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index b585c850a89a..10e22fd48222 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1050,7 +1050,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         struct tcphdr *th = tcp_hdr(skb), *t1;
         struct sk_buff *buff;
         struct flowi fl;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(skb->dst->dev);
         struct sock *ctl_sk = net->ipv6.tcp_sk;
         unsigned int tot_len = sizeof(struct tcphdr);
         __be32 *topt;
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 705959b31e24..d7b54b5bfa69 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -524,7 +524,6 @@ static int iucv_enable(void)
         get_online_cpus();
         for_each_online_cpu(cpu)
                 smp_call_function_single(cpu, iucv_declare_cpu, NULL, 1);
-        preempt_enable();
         if (cpus_empty(iucv_buffer_cpumask))
                 /* No cpu could declare an iucv buffer. */
                 goto out_path;
@@ -547,7 +546,9 @@ out:
  */
 static void iucv_disable(void)
 {
+        get_online_cpus();
         on_each_cpu(iucv_retrieve_cpu, NULL, 1);
+        put_online_cpus();
         kfree(iucv_path_table);
 }
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index d628df97e02e..b7f5a1c353ee 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -73,22 +73,18 @@ static int pfkey_can_dump(struct sock *sk)
         return 0;
 }
 
-static int pfkey_do_dump(struct pfkey_sock *pfk)
+static void pfkey_terminate_dump(struct pfkey_sock *pfk)
 {
-        int rc;
-
-        rc = pfk->dump.dump(pfk);
-        if (rc == -ENOBUFS)
-                return 0;
-
-        pfk->dump.done(pfk);
-        pfk->dump.dump = NULL;
-        pfk->dump.done = NULL;
-        return rc;
+        if (pfk->dump.dump) {
+                pfk->dump.done(pfk);
+                pfk->dump.dump = NULL;
+                pfk->dump.done = NULL;
+        }
 }
 
 static void pfkey_sock_destruct(struct sock *sk)
 {
+        pfkey_terminate_dump(pfkey_sk(sk));
         skb_queue_purge(&sk->sk_receive_queue);
 
         if (!sock_flag(sk, SOCK_DEAD)) {
@@ -310,6 +306,18 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
         return err;
 }
 
+static int pfkey_do_dump(struct pfkey_sock *pfk)
+{
+        int rc;
+
+        rc = pfk->dump.dump(pfk);
+        if (rc == -ENOBUFS)
+                return 0;
+
+        pfkey_terminate_dump(pfk);
+        return rc;
+}
+
 static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig)
 {
         *new = *orig;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index b599cbba4fbe..d68869f966c3 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1012,6 +1012,29 @@ end:
         return retval;
 }
 
+struct sctp_chunk *sctp_make_violation_paramlen(
+        const struct sctp_association *asoc,
+        const struct sctp_chunk *chunk,
+        struct sctp_paramhdr *param)
+{
+        struct sctp_chunk *retval;
+        static const char error[] = "The following parameter had invalid length:";
+        size_t payload_len = sizeof(error) + sizeof(sctp_errhdr_t) +
+                                sizeof(sctp_paramhdr_t);
+
+        retval = sctp_make_abort(asoc, chunk, payload_len);
+        if (!retval)
+                goto nodata;
+
+        sctp_init_cause(retval, SCTP_ERROR_PROTO_VIOLATION,
+                        sizeof(error) + sizeof(sctp_paramhdr_t));
+        sctp_addto_chunk(retval, sizeof(error), error);
+        sctp_addto_param(retval, sizeof(sctp_paramhdr_t), param);
+
+nodata:
+        return retval;
+}
+
 /* Make a HEARTBEAT chunk.  */
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *asoc,
                                   const struct sctp_transport *transport,
@@ -1782,11 +1805,6 @@ static int sctp_process_inv_paramlength(const struct sctp_association *asoc,
                                         const struct sctp_chunk *chunk,
                                         struct sctp_chunk **errp)
 {
-        static const char error[] = "The following parameter had invalid length:";
-        size_t          payload_len = WORD_ROUND(sizeof(error)) +
-                                                sizeof(sctp_paramhdr_t);
-
-
         /* This is a fatal error.  Any accumulated non-fatal errors are
          * not reported.
          */
@@ -1794,14 +1812,7 @@ static int sctp_process_inv_paramlength(const struct sctp_association *asoc,
                 sctp_chunk_free(*errp);
 
         /* Create an error chunk and fill it in with our payload. */
-        *errp = sctp_make_op_error_space(asoc, chunk, payload_len);
-
-        if (*errp) {
-                sctp_init_cause(*errp, SCTP_ERROR_PROTO_VIOLATION,
-                                sizeof(error) + sizeof(sctp_paramhdr_t));
-                sctp_addto_chunk(*errp, sizeof(error), error);
-                sctp_addto_param(*errp, sizeof(sctp_paramhdr_t), param);
-        }
+        *errp = sctp_make_violation_paramlen(asoc, chunk, param);
 
         return 0;
 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 8848d329aa2c..7c622af2ce55 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -119,7 +119,7 @@ static sctp_disposition_t sctp_sf_violation_paramlen(
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
-                                     void *arg,
+                                     void *arg, void *ext,
                                      sctp_cmd_seq_t *commands);
 
 static sctp_disposition_t sctp_sf_violation_ctsn(
@@ -3425,7 +3425,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
         addr_param = (union sctp_addr_param *)hdr->params;
         length = ntohs(addr_param->p.length);
         if (length < sizeof(sctp_paramhdr_t))
-                return sctp_sf_violation_paramlen(ep, asoc, type,
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
                            (void *)addr_param, commands);
 
         /* Verify the ASCONF chunk before processing it. */
@@ -3433,8 +3433,8 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
                             (sctp_paramhdr_t *)((void *)addr_param + length),
                             (void *)chunk->chunk_end,
                             &err_param))
-                return sctp_sf_violation_paramlen(ep, asoc, type,
-                                                  (void *)&err_param, commands);
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                                                  (void *)err_param, commands);
 
         /* ADDIP 5.2 E1) Compare the value of the serial number to the value
          * the endpoint stored in a new association variable
@@ -3542,8 +3542,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
             (sctp_paramhdr_t *)addip_hdr->params,
             (void *)asconf_ack->chunk_end,
             &err_param))
-                return sctp_sf_violation_paramlen(ep, asoc, type,
-                           (void *)&err_param, commands);
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                           (void *)err_param, commands);
 
         if (last_asconf) {
                 addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
@@ -4240,12 +4240,38 @@ static sctp_disposition_t sctp_sf_violation_paramlen(
                                      const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
-                                     void *arg,
-                                     sctp_cmd_seq_t *commands) {
-        static const char err_str[] = "The following parameter had invalid length:";
+                                     void *arg, void *ext,
+                                     sctp_cmd_seq_t *commands)
+{
+        struct sctp_chunk *chunk =  arg;
+        struct sctp_paramhdr *param = ext;
+        struct sctp_chunk *abort = NULL;
 
-        return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
-                                        sizeof(err_str));
+        if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
+                goto discard;
+
+        /* Make the abort chunk. */
+        abort = sctp_make_violation_paramlen(asoc, chunk, param);
+        if (!abort)
+                goto nomem;
+
+        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+        SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                        SCTP_ERROR(ECONNABORTED));
+        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
+                        SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
+        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+
+discard:
+        sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
+
+        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+
+        return SCTP_DISPOSITION_ABORT;
+nomem:
+        return SCTP_DISPOSITION_NOMEM;
 }
 
 /* Handle a protocol violation when the peer trying to advance the
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index ac25b4c0e982..dc50f1e71f76 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -27,10 +27,14 @@ static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
                 - skb_headroom(skb);
         int ntail = dst->dev->needed_tailroom - skb_tailroom(skb);
 
-        if (nhead > 0 || ntail > 0)
-                return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
-
-        return 0;
+        if (nhead <= 0) {
+                if (ntail <= 0)
+                        return 0;
+                nhead = 0;
+        } else if (ntail < 0)
+                ntail = 0;
+
+        return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
 }
 
 static int xfrm_output_one(struct sk_buff *skb, int err)
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 36b5eedcdc75..3e1057f885c6 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -32,6 +32,7 @@ char *defconfig_file;
 
 static int indent = 1;
 static int valid_stdin = 1;
+static int sync_kconfig;
 static int conf_cnt;
 static char line[128];
 static struct menu *rootEntry;
@@ -65,7 +66,7 @@ static void strip(char *str)
 
 static void check_stdin(void)
 {
-        if (!valid_stdin && input_mode == ask_silent) {
+        if (!valid_stdin) {
                 printf(_("aborted!\n\n"));
                 printf(_("Console input/output is redirected. "));
                 printf(_("Run 'make oldconfig' to update configuration.\n\n"));
@@ -427,43 +428,6 @@ static void check_conf(struct menu *menu)
                 check_conf(child);
 }
 
-static void conf_do_update(void)
-{
-        /* Update until a loop caused no more changes */
-        do {
-                conf_cnt = 0;
-                check_conf(&rootmenu);
-        } while (conf_cnt);
-}
-
-static int conf_silent_update(void)
-{
-        const char *name;
-
-        if (conf_get_changed()) {
-                name = getenv("KCONFIG_NOSILENTUPDATE");
-                if (name && *name) {
-                        fprintf(stderr,
-                        _("\n*** Kernel configuration requires explicit update.\n\n"));
-                        return 1;
-                }
-                conf_do_update();
-        }
-        return 0;
-}
-
-static int conf_update(void)
-{
-        rootEntry = &rootmenu;
-        conf(&rootmenu);
-        if (input_mode == ask_all) {
-                input_mode = ask_silent;
-                valid_stdin = 1;
-        }
-        conf_do_update();
-        return 0;
-}
-
 int main(int ac, char **av)
 {
         int opt;
@@ -477,11 +441,11 @@ int main(int ac, char **av)
         while ((opt = getopt(ac, av, "osdD:nmyrh")) != -1) {
                 switch (opt) {
                 case 'o':
-                        input_mode = ask_new;
+                        input_mode = ask_silent;
                         break;
                 case 's':
                         input_mode = ask_silent;
-                        valid_stdin = isatty(0) && isatty(1) && isatty(2);
+                        sync_kconfig = 1;
                         break;
                 case 'd':
                         input_mode = set_default;
@@ -519,6 +483,19 @@ int main(int ac, char **av)
         name = av[optind];
         conf_parse(name);
         //zconfdump(stdout);
+        if (sync_kconfig) {
+                if (stat(".config", &tmpstat)) {
+                        fprintf(stderr, _("***\n"
+                                "*** You have not yet configured your kernel!\n"
+                                "*** (missing kernel .config file)\n"
+                                "***\n"
+                                "*** Please run some configurator (e.g. \"make oldconfig\" or\n"
+                                "*** \"make menuconfig\" or \"make xconfig\").\n"
+                                "***\n"));
+                        exit(1);
+                }
+        }
+
         switch (input_mode) {
         case set_default:
                 if (!defconfig_file)
@@ -531,16 +508,6 @@ int main(int ac, char **av)
                 }
                 break;
         case ask_silent:
-                if (stat(".config", &tmpstat)) {
-                        printf(_("***\n"
-                                "*** You have not yet configured your kernel!\n"
-                                "*** (missing kernel .config file)\n"
-                                "***\n"
-                                "*** Please run some configurator (e.g. \"make oldconfig\" or\n"
-                                "*** \"make menuconfig\" or \"make xconfig\").\n"
-                                "***\n"));
-                        exit(1);
-                }
         case ask_all:
         case ask_new:
                 conf_read(NULL);
@@ -569,6 +536,19 @@ int main(int ac, char **av)
         default:
                 break;
         }
+
+        if (sync_kconfig) {
+                if (conf_get_changed()) {
+                        name = getenv("KCONFIG_NOSILENTUPDATE");
+                        if (name && *name) {
+                                fprintf(stderr,
+                                        _("\n*** Kernel configuration requires explicit update.\n\n"));
+                                return 1;
+                        }
+                }
+                valid_stdin = isatty(0) && isatty(1) && isatty(2);
+        }
+
         switch (input_mode) {
         case set_no:
                 conf_set_all_new_symbols(def_no);
@@ -585,27 +565,38 @@ int main(int ac, char **av)
         case set_default:
                 conf_set_all_new_symbols(def_default);
                 break;
-        case ask_silent:
         case ask_new:
-                if (conf_silent_update())
-                        exit(1);
-                break;
         case ask_all:
-                if (conf_update())
-                        exit(1);
+                rootEntry = &rootmenu;
+                conf(&rootmenu);
+                input_mode = ask_silent;
+                /* fall through */
+        case ask_silent:
+                /* Update until a loop caused no more changes */
+                do {
+                        conf_cnt = 0;
+                        check_conf(&rootmenu);
+                } while (conf_cnt);
                 break;
         }
 
-        if (conf_write(NULL)) {
-                fprintf(stderr, _("\n*** Error during writing of the kernel configuration.\n\n"));
-                exit(1);
-        }
-        /* ask_silent is used during the build so we shall update autoconf.
-         * All other commands are only used to generate a config.
-         */
-        if (input_mode == ask_silent && conf_write_autoconf()) {
-                fprintf(stderr, _("\n*** Error during writing of the kernel configuration.\n\n"));
-                return 1;
+        if (sync_kconfig) {
+                /* silentoldconfig is used during the build so we shall update autoconf.
+                 * All other commands are only used to generate a config.
+                 */
+                if (conf_get_changed() && conf_write(NULL)) {
+                        fprintf(stderr, _("\n*** Error during writing of the kernel configuration.\n\n"));
+                        exit(1);
+                }
+                if (conf_write_autoconf()) {
+                        fprintf(stderr, _("\n*** Error during update of the kernel configuration.\n\n"));
+                        return 1;
+                }
+        } else {
+                if (conf_write(NULL)) {
+                        fprintf(stderr, _("\n*** Error during writing of the kernel configuration.\n\n"));
+                        exit(1);
+                }
         }
         return 0;
 }
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index df6a188b9930..b91cf241a539 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -222,8 +222,10 @@ load:
                                 continue;
                         if (def == S_DEF_USER) {
                                 sym = sym_find(line + 9);
-                                if (!sym)
+                                if (!sym) {
+                                        sym_add_change_count(1);
                                         break;
+                                }
                         } else {
                                 sym = sym_lookup(line + 9, 0);
                                 if (sym->type == S_UNKNOWN)
@@ -259,8 +261,10 @@ load:
                         }
                         if (def == S_DEF_USER) {
                                 sym = sym_find(line + 7);
-                                if (!sym)
+                                if (!sym) {
+                                        sym_add_change_count(1);
                                         break;
+                                }
                         } else {
                                 sym = sym_lookup(line + 7, 0);
                                 if (sym->type == S_UNKNOWN)
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 9dd9bc73fe1d..ece25c718e95 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -781,7 +781,7 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream,
                 return -ENODEV;
 
         card = pcm->card;
-        down_read(&card->controls_rwsem);
+        read_lock(&card->ctl_files_rwlock);
         list_for_each_entry(kctl, &card->ctl_files, list) {
                 if (kctl->pid == current->pid) {
                         prefer_subdevice = kctl->prefer_pcm_subdevice;
@@ -789,7 +789,7 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream,
                                 break;
                 }
         }
-        up_read(&card->controls_rwsem);
+        read_unlock(&card->ctl_files_rwlock);
 
         switch (stream) {
         case SNDRV_PCM_STREAM_PLAYBACK:
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index c49b9d9e303c..c487025d3457 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1546,16 +1546,10 @@ static int snd_pcm_drop(struct snd_pcm_substream *substream)
         card = substream->pcm->card;
 
         if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
-            runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
+            runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED ||
+            runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
                 return -EBADFD;
 
-        snd_power_lock(card);
-        if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
-                result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
-                if (result < 0)
-                        goto _unlock;
-        }
-
         snd_pcm_stream_lock_irq(substream);
         /* resume pause */
         if (runtime->status->state == SNDRV_PCM_STATE_PAUSED)
@@ -1564,8 +1558,7 @@ static int snd_pcm_drop(struct snd_pcm_substream *substream)
         snd_pcm_stop(substream, SNDRV_PCM_STATE_SETUP);
         /* runtime->control->appl_ptr = runtime->status->hw_ptr; */
         snd_pcm_stream_unlock_irq(substream);
- _unlock:
-        snd_power_unlock(card);
+
         return result;
 }
 
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index f7ea7287c59c..b917a9f981c7 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -418,7 +418,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
         mutex_lock(&rmidi->open_mutex);
         while (1) {
                 subdevice = -1;
-                down_read(&card->controls_rwsem);
+                read_lock(&card->ctl_files_rwlock);
                 list_for_each_entry(kctl, &card->ctl_files, list) {
                         if (kctl->pid == current->pid) {
                                 subdevice = kctl->prefer_rawmidi_subdevice;
@@ -426,7 +426,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
                                         break;
                         }
                 }
-                up_read(&card->controls_rwsem);
+                read_unlock(&card->ctl_files_rwlock);
                 err = snd_rawmidi_kernel_open(rmidi->card, rmidi->device,
                                               subdevice, fflags, rawmidi_file);
                 if (err >= 0)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index ad994fcab725..f3da621f25c5 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1683,8 +1683,8 @@ static struct snd_pci_quirk stac927x_cfg_tbl[] = {
         /* Dell 3 stack systems with verb table in BIOS */
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0227, "Dell Vostro 1400  ", STAC_DELL_BIOS),
-        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022f, "Dell     ", STAC_DELL_BIOS),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022e, "Dell     ", STAC_DELL_BIOS),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022f, "Dell Inspiron 1525", STAC_DELL_3ST),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0242, "Dell     ", STAC_DELL_BIOS),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0243, "Dell     ", STAC_DELL_BIOS),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x02ff, "Dell     ", STAC_DELL_BIOS),
diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
index 9deb8c74fdfd..0bbd94501d7e 100644
--- a/sound/soc/codecs/cs4270.c
+++ b/sound/soc/codecs/cs4270.c
@@ -490,34 +490,7 @@ static int cs4270_mute(struct snd_soc_dai *dai, int mute)
 
 #endif
 
-static int cs4270_i2c_probe(struct i2c_adapter *adap, int addr, int kind);
-
-/*
- * Notify the driver that a new I2C bus has been found.
- *
- * This function is called for each I2C bus in the system.  The function
- * then asks the I2C subsystem to probe that bus at the addresses on which
- * our device (the CS4270) could exist.  If a device is found at one of
- * those addresses, then our probe function (cs4270_i2c_probe) is called.
- */
-static int cs4270_i2c_attach(struct i2c_adapter *adapter)
-{
-        return i2c_probe(adapter, &addr_data, cs4270_i2c_probe);
-}
-
-static int cs4270_i2c_detach(struct i2c_client *client)
-{
-        struct snd_soc_codec *codec = i2c_get_clientdata(client);
-
-        i2c_detach_client(client);
-        codec->control_data = NULL;
-
-        kfree(codec->reg_cache);
-        codec->reg_cache = NULL;
-
-        kfree(client);
-        return 0;
-}
+static int cs4270_i2c_probe(struct i2c_client *, const struct i2c_device_id *);
 
 /* A list of non-DAPM controls that the CS4270 supports */
 static const struct snd_kcontrol_new cs4270_snd_controls[] = {
@@ -525,14 +498,19 @@ static const struct snd_kcontrol_new cs4270_snd_controls[] = {
                 CS4270_VOLA, CS4270_VOLB, 0, 0xFF, 1)
 };
 
+static const struct i2c_device_id cs4270_id[] = {
+        {"cs4270", 0},
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, cs4270_id);
+
 static struct i2c_driver cs4270_i2c_driver = {
         .driver = {
                 .name = "CS4270 I2C",
                 .owner = THIS_MODULE,
         },
-        .id =             I2C_DRIVERID_CS4270,
-        .attach_adapter = cs4270_i2c_attach,
-        .detach_client =  cs4270_i2c_detach,
+        .id_table = cs4270_id,
+        .probe = cs4270_i2c_probe,
 };
 
 /*
@@ -561,11 +539,11 @@ static struct snd_soc_device *cs4270_socdev;
  * Note: snd_soc_new_pcms() must be called before this function can be called,
  * because of snd_ctl_add().
  */
-static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
+static int cs4270_i2c_probe(struct i2c_client *i2c_client,
+        const struct i2c_device_id *id)
 {
         struct snd_soc_device *socdev = cs4270_socdev;
         struct snd_soc_codec *codec = socdev->codec;
-        struct i2c_client *i2c_client = NULL;
         int i;
         int ret = 0;
 
@@ -578,12 +556,6 @@ static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
 
         /* Note: codec_dai->codec is NULL here */
 
-        i2c_client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (!i2c_client) {
-                printk(KERN_ERR "cs4270: could not allocate I2C client\n");
-                return -ENOMEM;
-        }
-
         codec->reg_cache = kzalloc(CS4270_NUMREGS, GFP_KERNEL);
         if (!codec->reg_cache) {
                 printk(KERN_ERR "cs4270: could not allocate register cache\n");
@@ -591,13 +563,6 @@ static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
                 goto error;
         }
 
-        i2c_set_clientdata(i2c_client, codec);
-        strcpy(i2c_client->name, "CS4270");
-
-        i2c_client->driver = &cs4270_i2c_driver;
-        i2c_client->adapter = adapter;
-        i2c_client->addr = addr;
-
         /* Verify that we have a CS4270 */
 
         ret = i2c_smbus_read_byte_data(i2c_client, CS4270_CHIPID);
@@ -612,18 +577,10 @@ static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
                 goto error;
         }
 
-        printk(KERN_INFO "cs4270: found device at I2C address %X\n", addr);
+        printk(KERN_INFO "cs4270: found device at I2C address %X\n",
+                i2c_client->addr);
         printk(KERN_INFO "cs4270: hardware revision %X\n", ret & 0xF);
 
-        /* Tell the I2C layer a new client has arrived */
-
-        ret = i2c_attach_client(i2c_client);
-        if (ret) {
-                printk(KERN_ERR "cs4270: could not attach codec, "
-                        "I2C address %x, error code %i\n", addr, ret);
-                goto error;
-        }
-
         codec->control_data = i2c_client;
         codec->read = cs4270_read_reg_cache;
         codec->write = cs4270_i2c_write;
@@ -648,20 +605,17 @@ static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
                         goto error;
         }
 
+        i2c_set_clientdata(i2c_client, codec);
+
         return 0;
 
 error:
-        if (codec->control_data) {
-                i2c_detach_client(i2c_client);
-                codec->control_data = NULL;
-        }
+        codec->control_data = NULL;
 
         kfree(codec->reg_cache);
         codec->reg_cache = NULL;
         codec->reg_cache_size = 0;
 
-        kfree(i2c_client);
-
         return ret;
 }
 
@@ -727,7 +681,7 @@ static int cs4270_probe(struct platform_device *pdev)
         ret = snd_soc_new_pcms(socdev, SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1);
         if (ret < 0) {
                 printk(KERN_ERR "cs4270: failed to create PCMs\n");
-                return ret;
+                goto error_free_codec;
         }
 
 #ifdef USE_I2C
@@ -736,8 +690,7 @@ static int cs4270_probe(struct platform_device *pdev)
         ret = i2c_add_driver(&cs4270_i2c_driver);
         if (ret) {
                 printk(KERN_ERR "cs4270: failed to attach driver");
-                snd_soc_free_pcms(socdev);
-                return ret;
+                goto error_free_pcms;
         }
 
         /* Did we find a CS4270 on the I2C bus? */
@@ -759,10 +712,23 @@ static int cs4270_probe(struct platform_device *pdev)
         ret = snd_soc_register_card(socdev);
         if (ret < 0) {
                 printk(KERN_ERR "cs4270: failed to register card\n");
-                snd_soc_free_pcms(socdev);
-                return ret;
+                goto error_del_driver;
         }
 
+        return 0;
+
+error_del_driver:
+#ifdef USE_I2C
+        i2c_del_driver(&cs4270_i2c_driver);
+
+error_free_pcms:
+#endif
+        snd_soc_free_pcms(socdev);
+
+error_free_codec:
+        kfree(socdev->codec);
+        socdev->codec = NULL;
+
         return ret;
 }
 
@@ -773,8 +739,7 @@ static int cs4270_remove(struct platform_device *pdev)
         snd_soc_free_pcms(socdev);
 
 #ifdef USE_I2C
-        if (socdev->codec->control_data)
-                i2c_del_driver(&cs4270_i2c_driver);
+        i2c_del_driver(&cs4270_i2c_driver);
 #endif
 
         kfree(socdev->codec);