89 files changed, 1252 insertions, 668 deletions

diff --git a/Documentation/cgroups/cgroups.txt b/Documentation/cgroups/cgroups.txt
index 455d4e6d346d..0b33bfe7dde9 100644
--- a/Documentation/cgroups/cgroups.txt
+++ b/Documentation/cgroups/cgroups.txt
@@ -227,7 +227,14 @@ as the path relative to the root of the cgroup file system.
 Each cgroup is represented by a directory in the cgroup file system
 containing the following files describing that cgroup:
 
- - tasks: list of tasks (by pid) attached to that cgroup
+ - tasks: list of tasks (by pid) attached to that cgroup.  This list
+   is not guaranteed to be sorted.  Writing a thread id into this file
+   moves the thread into this cgroup.
+ - cgroup.procs: list of tgids in the cgroup.  This list is not
+   guaranteed to be sorted or free of duplicate tgids, and userspace
+   should sort/uniquify the list if this property is required.
+   Writing a tgid into this file moves all threads with that tgid into
+   this cgroup.
  - notify_on_release flag: run the release agent on exit?
  - release_agent: the path to use for release notifications (this file
    exists in the top cgroup only)
@@ -374,7 +381,7 @@ Now you want to do something with this cgroup.
 
 In this directory you can find several files:
 # ls
-notify_on_release tasks
+cgroup.procs notify_on_release tasks
 (plus whatever files added by the attached subsystems)
 
 Now attach your shell to this cgroup:
diff --git a/Documentation/isdn/INTERFACE.CAPI b/Documentation/isdn/INTERFACE.CAPI
index 686e107923ec..5fe8de5cc727 100644
--- a/Documentation/isdn/INTERFACE.CAPI
+++ b/Documentation/isdn/INTERFACE.CAPI
@@ -60,10 +60,9 @@ open() operation on regular files or character devices.
 
 After a successful return from register_appl(), CAPI messages from the
 application may be passed to the driver for the device via calls to the
-send_message() callback function. The CAPI message to send is stored in the
-data portion of an skb. Conversely, the driver may call Kernel CAPI's
-capi_ctr_handle_message() function to pass a received CAPI message to Kernel
-CAPI for forwarding to an application, specifying its ApplID.
+send_message() callback function. Conversely, the driver may call Kernel
+CAPI's capi_ctr_handle_message() function to pass a received CAPI message to
+Kernel CAPI for forwarding to an application, specifying its ApplID.
 
 Deregistration requests (CAPI operation CAPI_RELEASE) from applications are
 forwarded as calls to the release_appl() callback function, passing the same
@@ -142,6 +141,7 @@ u16  (*send_message)(struct capi_ctr *ctrlr, struct sk_buff *skb)
         to accepting or queueing the message. Errors occurring during the
         actual processing of the message should be signaled with an
         appropriate reply message.
+        May be called in process or interrupt context.
         Calls to this function are not serialized by Kernel CAPI, ie. it must
         be prepared to be re-entered.
 
@@ -154,7 +154,8 @@ read_proc_t *ctr_read_proc
         system entry, /proc/capi/controllers/<n>; will be called with a
         pointer to the device's capi_ctr structure as the last (data) argument
 
-Note: Callback functions are never called in interrupt context.
+Note: Callback functions except send_message() are never called in interrupt
+context.
 
 - to be filled in before calling capi_ctr_ready():
 
@@ -171,14 +172,40 @@ u8 serial[CAPI_SERIAL_LEN]
         value to return for CAPI_GET_SERIAL
 
 
-4.3 The _cmsg Structure
+4.3 SKBs
+
+CAPI messages are passed between Kernel CAPI and the driver via send_message()
+and capi_ctr_handle_message(), stored in the data portion of a socket buffer
+(skb).  Each skb contains a single CAPI message coded according to the CAPI 2.0
+standard.
+
+For the data transfer messages, DATA_B3_REQ and DATA_B3_IND, the actual
+payload data immediately follows the CAPI message itself within the same skb.
+The Data and Data64 parameters are not used for processing. The Data64
+parameter may be omitted by setting the length field of the CAPI message to 22
+instead of 30.
+
+
+4.4 The _cmsg Structure
 
 (declared in <linux/isdn/capiutil.h>)
 
 The _cmsg structure stores the contents of a CAPI 2.0 message in an easily
-accessible form. It contains members for all possible CAPI 2.0 parameters, of
-which only those appearing in the message type currently being processed are
-actually used. Unused members should be set to zero.
+accessible form. It contains members for all possible CAPI 2.0 parameters,
+including subparameters of the Additional Info and B Protocol structured
+parameters, with the following exceptions:
+
+* second Calling party number (CONNECT_IND)
+
+* Data64 (DATA_B3_REQ and DATA_B3_IND)
+
+* Sending complete (subparameter of Additional Info, CONNECT_REQ and INFO_REQ)
+
+* Global Configuration (subparameter of B Protocol, CONNECT_REQ, CONNECT_RESP
+  and SELECT_B_PROTOCOL_REQ)
+
+Only those parameters appearing in the message type currently being processed
+are actually used. Unused members should be set to zero.
 
 Members are named after the CAPI 2.0 standard names of the parameters they
 represent. See <linux/isdn/capiutil.h> for the exact spelling. Member data
@@ -190,18 +217,19 @@ u16         for CAPI parameters of type 'word'
 
 u32         for CAPI parameters of type 'dword'
 
-_cstruct    for CAPI parameters of type 'struct' not containing any
-            variably-sized (struct) subparameters (eg. 'Called Party Number')
+_cstruct    for CAPI parameters of type 'struct'
             The member is a pointer to a buffer containing the parameter in
             CAPI encoding (length + content). It may also be NULL, which will
             be taken to represent an empty (zero length) parameter.
+            Subparameters are stored in encoded form within the content part.
 
-_cmstruct   for CAPI parameters of type 'struct' containing 'struct'
-            subparameters ('Additional Info' and 'B Protocol')
+_cmstruct   alternative representation for CAPI parameters of type 'struct'
+            (used only for the 'Additional Info' and 'B Protocol' parameters)
             The representation is a single byte containing one of the values:
-            CAPI_DEFAULT: the parameter is empty
-            CAPI_COMPOSE: the values of the subparameters are stored
-            individually in the corresponding _cmsg structure members
+            CAPI_DEFAULT: The parameter is empty/absent.
+            CAPI_COMPOSE: The parameter is present.
+            Subparameter values are stored individually in the corresponding
+            _cmsg structure members.
 
 Functions capi_cmsg2message() and capi_message2cmsg() are provided to convert
 messages between their transport encoding described in the CAPI 2.0 standard
@@ -297,3 +325,26 @@ char *capi_cmd2str(u8 Command, u8 Subcommand)
         be NULL if the command/subcommand is not one of those defined in the
         CAPI 2.0 standard.
 
+
+7. Debugging
+
+The module kernelcapi has a module parameter showcapimsgs controlling some
+debugging output produced by the module. It can only be set when the module is
+loaded, via a parameter "showcapimsgs=<n>" to the modprobe command, either on
+the command line or in the configuration file.
+
+If the lowest bit of showcapimsgs is set, kernelcapi logs controller and
+application up and down events.
+
+In addition, every registered CAPI controller has an associated traceflag
+parameter controlling how CAPI messages sent from and to tha controller are
+logged. The traceflag parameter is initialized with the value of the
+showcapimsgs parameter when the controller is registered, but can later be
+changed via the MANUFACTURER_REQ command KCAPI_CMD_TRACE.
+
+If the value of traceflag is non-zero, CAPI messages are logged.
+DATA_B3 messages are only logged if the value of traceflag is > 2.
+
+If the lowest bit of traceflag is set, only the command/subcommand and message
+length are logged. Otherwise, kernelcapi logs a readable representation of
+the entire message.
diff --git a/Documentation/networking/pktgen.txt b/Documentation/networking/pktgen.txt
index c6cf4a3c16e0..61bb645d50e0 100644
--- a/Documentation/networking/pktgen.txt
+++ b/Documentation/networking/pktgen.txt
@@ -90,6 +90,11 @@ Examples:
  pgset "dstmac 00:00:00:00:00:00"    sets MAC destination address
  pgset "srcmac 00:00:00:00:00:00"    sets MAC source address
 
+ pgset "queue_map_min 0" Sets the min value of tx queue interval
+ pgset "queue_map_max 7" Sets the max value of tx queue interval, for multiqueue devices
+                         To select queue 1 of a given device,
+                         use queue_map_min=1 and queue_map_max=1
+
  pgset "src_mac_count 1" Sets the number of MACs we'll range through.  
                          The 'minimum' MAC is what you set with srcmac.
 
@@ -101,6 +106,9 @@ Examples:
                               IPDST_RND, UDPSRC_RND,
                               UDPDST_RND, MACSRC_RND, MACDST_RND 
                               MPLS_RND, VID_RND, SVID_RND
+                              QUEUE_MAP_RND # queue map random
+                              QUEUE_MAP_CPU # queue map mirrors smp_processor_id()
+
 
  pgset "udp_src_min 9"   set UDP source port min, If < udp_src_max, then
                          cycle through the port range.
diff --git a/Documentation/vm/ksm.txt b/Documentation/vm/ksm.txt
index 72a22f65960e..262d8e6793a3 100644
--- a/Documentation/vm/ksm.txt
+++ b/Documentation/vm/ksm.txt
@@ -52,15 +52,15 @@ The KSM daemon is controlled by sysfs files in /sys/kernel/mm/ksm/,
 readable by all but writable only by root:
 
 max_kernel_pages - set to maximum number of kernel pages that KSM may use
-                   e.g. "echo 2000 > /sys/kernel/mm/ksm/max_kernel_pages"
+                   e.g. "echo 100000 > /sys/kernel/mm/ksm/max_kernel_pages"
                    Value 0 imposes no limit on the kernel pages KSM may use;
                    but note that any process using MADV_MERGEABLE can cause
                    KSM to allocate these pages, unswappable until it exits.
-                   Default: 2000 (chosen for demonstration purposes)
+                   Default: quarter of memory (chosen to not pin too much)
 
 pages_to_scan    - how many present pages to scan before ksmd goes to sleep
-                   e.g. "echo 200 > /sys/kernel/mm/ksm/pages_to_scan"
-                   Default: 200 (chosen for demonstration purposes)
+                   e.g. "echo 100 > /sys/kernel/mm/ksm/pages_to_scan"
+                   Default: 100 (chosen for demonstration purposes)
 
 sleep_millisecs  - how many milliseconds ksmd should sleep before next scan
                    e.g. "echo 20 > /sys/kernel/mm/ksm/sleep_millisecs"
@@ -70,7 +70,8 @@ run              - set 0 to stop ksmd from running but keep merged pages,
                    set 1 to run ksmd e.g. "echo 1 > /sys/kernel/mm/ksm/run",
                    set 2 to stop ksmd and unmerge all pages currently merged,
                          but leave mergeable areas registered for next run
-                   Default: 1 (for immediate use by apps which register)
+                   Default: 0 (must be changed to 1 to activate KSM,
+                               except if CONFIG_SYSFS is disabled)
 
 The effectiveness of KSM and MADV_MERGEABLE is shown in /sys/kernel/mm/ksm/:
 
@@ -86,4 +87,4 @@ pages_volatile embraces several different kinds of activity, but a high
 proportion there would also indicate poor use of madvise MADV_MERGEABLE.
 
 Izik Eidus,
-Hugh Dickins, 30 July 2009
+Hugh Dickins, 24 Sept 2009
diff --git a/Documentation/vm/page-types.c b/Documentation/vm/page-types.c
index fa1a30d9e9d5..3ec4f2a22585 100644
--- a/Documentation/vm/page-types.c
+++ b/Documentation/vm/page-types.c
@@ -2,7 +2,10 @@
  * page-types: Tool for querying page flags
  *
  * Copyright (C) 2009 Intel corporation
- * Copyright (C) 2009 Wu Fengguang <fengguang.wu@intel.com>
+ *
+ * Authors: Wu Fengguang <fengguang.wu@intel.com>
+ *
+ * Released under the General Public License (GPL).
  */
 
 #define _LARGEFILE64_SOURCE
@@ -69,7 +72,9 @@
 #define KPF_COMPOUND_TAIL       16
 #define KPF_HUGE                17
 #define KPF_UNEVICTABLE         18
+#define KPF_HWPOISON            19
 #define KPF_NOPAGE              20
+#define KPF_KSM                 21
 
 /* [32-] kernel hacking assistances */
 #define KPF_RESERVED            32
@@ -116,7 +121,9 @@ static char *page_flag_names[] = {
         [KPF_COMPOUND_TAIL]     = "T:compound_tail",
         [KPF_HUGE]              = "G:huge",
         [KPF_UNEVICTABLE]       = "u:unevictable",
+        [KPF_HWPOISON]          = "X:hwpoison",
         [KPF_NOPAGE]            = "n:nopage",
+        [KPF_KSM]               = "x:ksm",
 
         [KPF_RESERVED]          = "r:reserved",
         [KPF_MLOCKED]           = "m:mlocked",
@@ -152,9 +159,6 @@ static unsigned long	opt_size[MAX_ADDR_RANGES];
 static int              nr_vmas;
 static unsigned long    pg_start[MAX_VMAS];
 static unsigned long    pg_end[MAX_VMAS];
-static unsigned long    voffset;
-
-static int              pagemap_fd;
 
 #define MAX_BIT_FILTERS 64
 static int              nr_bit_filters;
@@ -163,9 +167,16 @@ static uint64_t		opt_bits[MAX_BIT_FILTERS];
 
 static int              page_size;
 
-#define PAGES_BATCH     (64 << 10)      /* 64k pages */
+static int              pagemap_fd;
 static int              kpageflags_fd;
 
+static int              opt_hwpoison;
+static int              opt_unpoison;
+
+static char             *hwpoison_debug_fs = "/debug/hwpoison";
+static int              hwpoison_inject_fd;
+static int              hwpoison_forget_fd;
+
 #define HASH_SHIFT      13
 #define HASH_SIZE       (1 << HASH_SHIFT)
 #define HASH_MASK       (HASH_SIZE - 1)
@@ -207,6 +218,74 @@ static void fatal(const char *x, ...)
         exit(EXIT_FAILURE);
 }
 
+int checked_open(const char *pathname, int flags)
+{
+        int fd = open(pathname, flags);
+
+        if (fd < 0) {
+                perror(pathname);
+                exit(EXIT_FAILURE);
+        }
+
+        return fd;
+}
+
+/*
+ * pagemap/kpageflags routines
+ */
+
+static unsigned long do_u64_read(int fd, char *name,
+                                 uint64_t *buf,
+                                 unsigned long index,
+                                 unsigned long count)
+{
+        long bytes;
+
+        if (index > ULONG_MAX / 8)
+                fatal("index overflow: %lu\n", index);
+
+        if (lseek(fd, index * 8, SEEK_SET) < 0) {
+                perror(name);
+                exit(EXIT_FAILURE);
+        }
+
+        bytes = read(fd, buf, count * 8);
+        if (bytes < 0) {
+                perror(name);
+                exit(EXIT_FAILURE);
+        }
+        if (bytes % 8)
+                fatal("partial read: %lu bytes\n", bytes);
+
+        return bytes / 8;
+}
+
+static unsigned long kpageflags_read(uint64_t *buf,
+                                     unsigned long index,
+                                     unsigned long pages)
+{
+        return do_u64_read(kpageflags_fd, PROC_KPAGEFLAGS, buf, index, pages);
+}
+
+static unsigned long pagemap_read(uint64_t *buf,
+                                  unsigned long index,
+                                  unsigned long pages)
+{
+        return do_u64_read(pagemap_fd, "/proc/pid/pagemap", buf, index, pages);
+}
+
+static unsigned long pagemap_pfn(uint64_t val)
+{
+        unsigned long pfn;
+
+        if (val & PM_PRESENT)
+                pfn = PM_PFRAME(val);
+        else
+                pfn = 0;
+
+        return pfn;
+}
+
 
 /*
  * page flag names
@@ -255,7 +334,8 @@ static char *page_flag_longname(uint64_t flags)
  * page list and summary
  */
 
-static void show_page_range(unsigned long offset, uint64_t flags)
+static void show_page_range(unsigned long voffset,
+                            unsigned long offset, uint64_t flags)
 {
         static uint64_t      flags0;
         static unsigned long voff;
@@ -281,7 +361,8 @@ static void show_page_range(unsigned long offset, uint64_t flags)
         count  = 1;
 }
 
-static void show_page(unsigned long offset, uint64_t flags)
+static void show_page(unsigned long voffset,
+                      unsigned long offset, uint64_t flags)
 {
         if (opt_pid)
                 printf("%lx\t", voffset);
@@ -362,6 +443,62 @@ static uint64_t well_known_flags(uint64_t flags)
         return flags;
 }
 
+static uint64_t kpageflags_flags(uint64_t flags)
+{
+        flags = expand_overloaded_flags(flags);
+
+        if (!opt_raw)
+                flags = well_known_flags(flags);
+
+        return flags;
+}
+
+/*
+ * page actions
+ */
+
+static void prepare_hwpoison_fd(void)
+{
+        char buf[100];
+
+        if (opt_hwpoison && !hwpoison_inject_fd) {
+                sprintf(buf, "%s/corrupt-pfn", hwpoison_debug_fs);
+                hwpoison_inject_fd = checked_open(buf, O_WRONLY);
+        }
+
+        if (opt_unpoison && !hwpoison_forget_fd) {
+                sprintf(buf, "%s/renew-pfn", hwpoison_debug_fs);
+                hwpoison_forget_fd = checked_open(buf, O_WRONLY);
+        }
+}
+
+static int hwpoison_page(unsigned long offset)
+{
+        char buf[100];
+        int len;
+
+        len = sprintf(buf, "0x%lx\n", offset);
+        len = write(hwpoison_inject_fd, buf, len);
+        if (len < 0) {
+                perror("hwpoison inject");
+                return len;
+        }
+        return 0;
+}
+
+static int unpoison_page(unsigned long offset)
+{
+        char buf[100];
+        int len;
+
+        len = sprintf(buf, "0x%lx\n", offset);
+        len = write(hwpoison_forget_fd, buf, len);
+        if (len < 0) {
+                perror("hwpoison forget");
+                return len;
+        }
+        return 0;
+}
 
 /*
  * page frame walker
@@ -394,104 +531,83 @@ static int hash_slot(uint64_t flags)
         exit(EXIT_FAILURE);
 }
 
-static void add_page(unsigned long offset, uint64_t flags)
+static void add_page(unsigned long voffset,
+                     unsigned long offset, uint64_t flags)
 {
-        flags = expand_overloaded_flags(flags);
-
-        if (!opt_raw)
-                flags = well_known_flags(flags);
+        flags = kpageflags_flags(flags);
 
         if (!bit_mask_ok(flags))
                 return;
 
+        if (opt_hwpoison)
+                hwpoison_page(offset);
+        if (opt_unpoison)
+                unpoison_page(offset);
+
         if (opt_list == 1)
-                show_page_range(offset, flags);
+                show_page_range(voffset, offset, flags);
         else if (opt_list == 2)
-                show_page(offset, flags);
+                show_page(voffset, offset, flags);
 
         nr_pages[hash_slot(flags)]++;
         total_pages++;
 }
 
-static void walk_pfn(unsigned long index, unsigned long count)
+#define KPAGEFLAGS_BATCH        (64 << 10)      /* 64k pages */
+static void walk_pfn(unsigned long voffset,
+                     unsigned long index,
+                     unsigned long count)
 {
+        uint64_t buf[KPAGEFLAGS_BATCH];
         unsigned long batch;
-        unsigned long n;
+        unsigned long pages;
         unsigned long i;
 
-        if (index > ULONG_MAX / KPF_BYTES)
-                fatal("index overflow: %lu\n", index);
-
-        lseek(kpageflags_fd, index * KPF_BYTES, SEEK_SET);
-
         while (count) {
-                uint64_t kpageflags_buf[KPF_BYTES * PAGES_BATCH];
-
-                batch = min_t(unsigned long, count, PAGES_BATCH);
-                n = read(kpageflags_fd, kpageflags_buf, batch * KPF_BYTES);
-                if (n == 0)
+                batch = min_t(unsigned long, count, KPAGEFLAGS_BATCH);
+                pages = kpageflags_read(buf, index, batch);
+                if (pages == 0)
                         break;
-                if (n < 0) {
-                        perror(PROC_KPAGEFLAGS);
-                        exit(EXIT_FAILURE);
-                }
 
-                if (n % KPF_BYTES != 0)
-                        fatal("partial read: %lu bytes\n", n);
-                n = n / KPF_BYTES;
+                for (i = 0; i < pages; i++)
+                        add_page(voffset + i, index + i, buf[i]);
 
-                for (i = 0; i < n; i++)
-                        add_page(index + i, kpageflags_buf[i]);
-
-                index += batch;
-                count -= batch;
+                index += pages;
+                count -= pages;
         }
 }
 
-
-#define PAGEMAP_BATCH   4096
-static unsigned long task_pfn(unsigned long pgoff)
+#define PAGEMAP_BATCH   (64 << 10)
+static void walk_vma(unsigned long index, unsigned long count)
 {
-        static uint64_t buf[PAGEMAP_BATCH];
-        static unsigned long start;
-        static long count;
-        uint64_t pfn;
+        uint64_t buf[PAGEMAP_BATCH];
+        unsigned long batch;
+        unsigned long pages;
+        unsigned long pfn;
+        unsigned long i;
 
-        if (pgoff < start || pgoff >= start + count) {
-                if (lseek64(pagemap_fd,
-                            (uint64_t)pgoff * PM_ENTRY_BYTES,
-                            SEEK_SET) < 0) {
-                        perror("pagemap seek");
-                        exit(EXIT_FAILURE);
-                }
-                count = read(pagemap_fd, buf, sizeof(buf));
-                if (count == 0)
-                        return 0;
-                if (count < 0) {
-                        perror("pagemap read");
-                        exit(EXIT_FAILURE);
-                }
-                if (count % PM_ENTRY_BYTES) {
-                        fatal("pagemap read not aligned.\n");
-                        exit(EXIT_FAILURE);
-                }
-                count /= PM_ENTRY_BYTES;
-                start = pgoff;
-        }
+        while (count) {
+                batch = min_t(unsigned long, count, PAGEMAP_BATCH);
+                pages = pagemap_read(buf, index, batch);
+                if (pages == 0)
+                        break;
 
-        pfn = buf[pgoff - start];
-        if (pfn & PM_PRESENT)
-                pfn = PM_PFRAME(pfn);
-        else
-                pfn = 0;
+                for (i = 0; i < pages; i++) {
+                        pfn = pagemap_pfn(buf[i]);
+                        if (pfn)
+                                walk_pfn(index + i, pfn, 1);
+                }
 
-        return pfn;
+                index += pages;
+                count -= pages;
+        }
 }
 
 static void walk_task(unsigned long index, unsigned long count)
 {
-        int i = 0;
         const unsigned long end = index + count;
+        unsigned long start;
+        int i = 0;
 
         while (index < end) {
 
@@ -501,15 +617,11 @@ static void walk_task(unsigned long index, unsigned long count)
                 if (pg_start[i] >= end)
                         return;
 
-                voffset = max_t(unsigned long, pg_start[i], index);
-                index   = min_t(unsigned long, pg_end[i], end);
+                start = max_t(unsigned long, pg_start[i], index);
+                index = min_t(unsigned long, pg_end[i], end);
 
-                assert(voffset < index);
-                for (; voffset < index; voffset++) {
-                        unsigned long pfn = task_pfn(voffset);
-                        if (pfn)
-                                walk_pfn(pfn, 1);
-                }
+                assert(start < index);
+                walk_vma(start, index - start);
         }
 }
 
@@ -527,18 +639,14 @@ static void walk_addr_ranges(void)
 {
         int i;
 
-        kpageflags_fd = open(PROC_KPAGEFLAGS, O_RDONLY);
-        if (kpageflags_fd < 0) {
-                perror(PROC_KPAGEFLAGS);
-                exit(EXIT_FAILURE);
-        }
+        kpageflags_fd = checked_open(PROC_KPAGEFLAGS, O_RDONLY);
 
         if (!nr_addr_ranges)
                 add_addr_range(0, ULONG_MAX);
 
         for (i = 0; i < nr_addr_ranges; i++)
                 if (!opt_pid)
-                        walk_pfn(opt_offset[i], opt_size[i]);
+                        walk_pfn(0, opt_offset[i], opt_size[i]);
                 else
                         walk_task(opt_offset[i], opt_size[i]);
 
@@ -575,6 +683,8 @@ static void usage(void)
 "            -l|--list                 Show page details in ranges\n"
 "            -L|--list-each            Show page details one by one\n"
 "            -N|--no-summary           Don't show summay info\n"
+"            -X|--hwpoison             hwpoison pages\n"
+"            -x|--unpoison             unpoison pages\n"
 "            -h|--help                 Show this usage message\n"
 "addr-spec:\n"
 "            N                         one page at offset N (unit: pages)\n"
@@ -624,11 +734,7 @@ static void parse_pid(const char *str)
         opt_pid = parse_number(str);
 
         sprintf(buf, "/proc/%d/pagemap", opt_pid);
-        pagemap_fd = open(buf, O_RDONLY);
-        if (pagemap_fd < 0) {
-                perror(buf);
-                exit(EXIT_FAILURE);
-        }
+        pagemap_fd = checked_open(buf, O_RDONLY);
 
         sprintf(buf, "/proc/%d/maps", opt_pid);
         file = fopen(buf, "r");
@@ -788,6 +894,8 @@ static struct option opts[] = {
         { "list"      , 0, NULL, 'l' },
         { "list-each" , 0, NULL, 'L' },
         { "no-summary", 0, NULL, 'N' },
+        { "hwpoison"  , 0, NULL, 'X' },
+        { "unpoison"  , 0, NULL, 'x' },
         { "help"      , 0, NULL, 'h' },
         { NULL        , 0, NULL, 0 }
 };
@@ -799,7 +907,7 @@ int main(int argc, char *argv[])
         page_size = getpagesize();
 
         while ((c = getopt_long(argc, argv,
-                                "rp:f:a:b:lLNh", opts, NULL)) != -1) {
+                                "rp:f:a:b:lLNXxh", opts, NULL)) != -1) {
                 switch (c) {
                 case 'r':
                         opt_raw = 1;
@@ -825,6 +933,14 @@ int main(int argc, char *argv[])
                 case 'N':
                         opt_no_summary = 1;
                         break;
+                case 'X':
+                        opt_hwpoison = 1;
+                        prepare_hwpoison_fd();
+                        break;
+                case 'x':
+                        opt_unpoison = 1;
+                        prepare_hwpoison_fd();
+                        break;
                 case 'h':
                         usage();
                         exit(0);
@@ -844,7 +960,7 @@ int main(int argc, char *argv[])
         walk_addr_ranges();
 
         if (opt_list == 1)
-                show_page_range(0, 0);  /* drain the buffer */
+                show_page_range(0, 0, 0);  /* drain the buffer */
 
         if (opt_no_summary)
                 return 0;
diff --git a/Documentation/vm/pagemap.txt b/Documentation/vm/pagemap.txt
index 600a304a828c..df09b9650a81 100644
--- a/Documentation/vm/pagemap.txt
+++ b/Documentation/vm/pagemap.txt
@@ -57,7 +57,9 @@ There are three components to pagemap:
     16. COMPOUND_TAIL
     16. HUGE
     18. UNEVICTABLE
+    19. HWPOISON
     20. NOPAGE
+    21. KSM
 
 Short descriptions to the page flags:
 
@@ -86,9 +88,15 @@ Short descriptions to the page flags:
 17. HUGE
     this is an integral part of a HugeTLB page
 
+19. HWPOISON
+    hardware detected memory corruption on this page: don't touch the data!
+
 20. NOPAGE
     no page frame exists at the requested address
 
+21. KSM
+    identical memory pages dynamically shared between one or more processes
+
     [IO related page flags]
  1. ERROR     IO error occurred
  3. UPTODATE  page has up-to-date data
diff --git a/MAINTAINERS b/MAINTAINERS
index 09a2028bab7f..e1da925b38c8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3643,6 +3643,13 @@ F:	Documentation/blockdev/nbd.txt
 F:      drivers/block/nbd.c
 F:      include/linux/nbd.h
 
+NETWORK DROP MONITOR
+M:      Neil Horman <nhorman@tuxdriver.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+W:      https://fedorahosted.org/dropwatch/
+F:      net/core/drop_monitor.c
+
 NETWORKING [GENERAL]
 M:      "David S. Miller" <davem@davemloft.net>
 L:      netdev@vger.kernel.org
@@ -3973,6 +3980,7 @@ F:	drivers/block/paride/
 PARISC ARCHITECTURE
 M:      Kyle McMartin <kyle@mcmartin.ca>
 M:      Helge Deller <deller@gmx.de>
+M:      "James E.J. Bottomley" <jejb@parisc-linux.org>
 L:      linux-parisc@vger.kernel.org
 W:      http://www.parisc-linux.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kyle/parisc-2.6.git
diff --git a/arch/arm/mach-omap2/clock34xx.c b/arch/arm/mach-omap2/clock34xx.c
index fafcd32e6907..489556eecbd1 100644
--- a/arch/arm/mach-omap2/clock34xx.c
+++ b/arch/arm/mach-omap2/clock34xx.c
@@ -338,6 +338,13 @@ static struct omap_clk omap34xx_clks[] = {
  */
 #define SDRC_MPURATE_LOOPS              96
 
+/*
+ * DPLL5_FREQ_FOR_USBHOST: USBHOST and USBTLL are the only clocks
+ * that are sourced by DPLL5, and both of these require this clock
+ * to be at 120 MHz for proper operation.
+ */
+#define DPLL5_FREQ_FOR_USBHOST          120000000
+
 /**
  * omap3430es2_clk_ssi_find_idlest - return CM_IDLEST info for SSI
  * @clk: struct clk * being enabled
@@ -1056,6 +1063,28 @@ void omap2_clk_prepare_for_reboot(void)
 #endif
 }
 
+static void omap3_clk_lock_dpll5(void)
+{
+        struct clk *dpll5_clk;
+        struct clk *dpll5_m2_clk;
+
+        dpll5_clk = clk_get(NULL, "dpll5_ck");
+        clk_set_rate(dpll5_clk, DPLL5_FREQ_FOR_USBHOST);
+        clk_enable(dpll5_clk);
+
+        /* Enable autoidle to allow it to enter low power bypass */
+        omap3_dpll_allow_idle(dpll5_clk);
+
+        /* Program dpll5_m2_clk divider for no division */
+        dpll5_m2_clk = clk_get(NULL, "dpll5_m2_ck");
+        clk_enable(dpll5_m2_clk);
+        clk_set_rate(dpll5_m2_clk, DPLL5_FREQ_FOR_USBHOST);
+
+        clk_disable(dpll5_m2_clk);
+        clk_disable(dpll5_clk);
+        return;
+}
+
 /* REVISIT: Move this init stuff out into clock.c */
 
 /*
@@ -1148,6 +1177,12 @@ int __init omap2_clk_init(void)
          */
         clk_enable_init_clocks();
 
+        /*
+         * Lock DPLL5 and put it in autoidle.
+         */
+        if (omap_rev() >= OMAP3430_REV_ES2_0)
+                omap3_clk_lock_dpll5();
+
         /* Avoid sleeping during omap2_clk_prepare_for_reboot() */
         /* REVISIT: not yet ready for 343x */
 #if 0
diff --git a/arch/arm/mach-omap2/pm-debug.c b/arch/arm/mach-omap2/pm-debug.c
index 1b4c1600f8d8..2fc4d6abbd0a 100644
--- a/arch/arm/mach-omap2/pm-debug.c
+++ b/arch/arm/mach-omap2/pm-debug.c
@@ -541,7 +541,7 @@ static int __init pm_dbg_init(void)
                 printk(KERN_ERR "%s: only OMAP3 supported\n", __func__);
                 return -ENODEV;
         }
-                
+
         d = debugfs_create_dir("pm_debug", NULL);
         if (IS_ERR(d))
                 return PTR_ERR(d);
@@ -551,7 +551,7 @@ static int __init pm_dbg_init(void)
         (void) debugfs_create_file("time", S_IRUGO,
                 d, (void *)DEBUG_FILE_TIMERS, &debug_fops);
 
-        pwrdm_for_each(pwrdms_setup, (void *)d);
+        pwrdm_for_each_nolock(pwrdms_setup, (void *)d);
 
         pm_dbg_dir = debugfs_create_dir("registers", d);
         if (IS_ERR(pm_dbg_dir))
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 0ff5a6c53aa0..378c2f618358 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -51,97 +51,112 @@ static void (*_omap_sram_idle)(u32 *addr, int save_state);
 
 static struct powerdomain *mpu_pwrdm;
 
-/* PRCM Interrupt Handler for wakeups */
-static irqreturn_t prcm_interrupt_handler (int irq, void *dev_id)
+/*
+ * PRCM Interrupt Handler Helper Function
+ *
+ * The purpose of this function is to clear any wake-up events latched
+ * in the PRCM PM_WKST_x registers. It is possible that a wake-up event
+ * may occur whilst attempting to clear a PM_WKST_x register and thus
+ * set another bit in this register. A while loop is used to ensure
+ * that any peripheral wake-up events occurring while attempting to
+ * clear the PM_WKST_x are detected and cleared.
+ */
+static int prcm_clear_mod_irqs(s16 module, u8 regs)
 {
-        u32 wkst, irqstatus_mpu;
-        u32 fclk, iclk;
-
-        /* WKUP */
-        wkst = prm_read_mod_reg(WKUP_MOD, PM_WKST);
+        u32 wkst, fclk, iclk, clken;
+        u16 wkst_off = (regs == 3) ? OMAP3430ES2_PM_WKST3 : PM_WKST1;
+        u16 fclk_off = (regs == 3) ? OMAP3430ES2_CM_FCLKEN3 : CM_FCLKEN1;
+        u16 iclk_off = (regs == 3) ? CM_ICLKEN3 : CM_ICLKEN1;
+        u16 grpsel_off = (regs == 3) ?
+                OMAP3430ES2_PM_MPUGRPSEL3 : OMAP3430_PM_MPUGRPSEL;
+        int c = 0;
+
+        wkst = prm_read_mod_reg(module, wkst_off);
+        wkst &= prm_read_mod_reg(module, grpsel_off);
         if (wkst) {
-                iclk = cm_read_mod_reg(WKUP_MOD, CM_ICLKEN);
-                fclk = cm_read_mod_reg(WKUP_MOD, CM_FCLKEN);
-                cm_set_mod_reg_bits(wkst, WKUP_MOD, CM_ICLKEN);
-                cm_set_mod_reg_bits(wkst, WKUP_MOD, CM_FCLKEN);
-                prm_write_mod_reg(wkst, WKUP_MOD, PM_WKST);
-                while (prm_read_mod_reg(WKUP_MOD, PM_WKST))
-                        cpu_relax();
-                cm_write_mod_reg(iclk, WKUP_MOD, CM_ICLKEN);
-                cm_write_mod_reg(fclk, WKUP_MOD, CM_FCLKEN);
+                iclk = cm_read_mod_reg(module, iclk_off);
+                fclk = cm_read_mod_reg(module, fclk_off);
+                while (wkst) {
+                        clken = wkst;
+                        cm_set_mod_reg_bits(clken, module, iclk_off);
+                        /*
+                         * For USBHOST, we don't know whether HOST1 or
+                         * HOST2 woke us up, so enable both f-clocks
+                         */
+                        if (module == OMAP3430ES2_USBHOST_MOD)
+                                clken |= 1 << OMAP3430ES2_EN_USBHOST2_SHIFT;
+                        cm_set_mod_reg_bits(clken, module, fclk_off);
+                        prm_write_mod_reg(wkst, module, wkst_off);
+                        wkst = prm_read_mod_reg(module, wkst_off);
+                        c++;
+                }
+                cm_write_mod_reg(iclk, module, iclk_off);
+                cm_write_mod_reg(fclk, module, fclk_off);
         }
 
-        /* CORE */
-        wkst = prm_read_mod_reg(CORE_MOD, PM_WKST1);
-        if (wkst) {
-                iclk = cm_read_mod_reg(CORE_MOD, CM_ICLKEN1);
-                fclk = cm_read_mod_reg(CORE_MOD, CM_FCLKEN1);
-                cm_set_mod_reg_bits(wkst, CORE_MOD, CM_ICLKEN1);
-                cm_set_mod_reg_bits(wkst, CORE_MOD, CM_FCLKEN1);
-                prm_write_mod_reg(wkst, CORE_MOD, PM_WKST1);
-                while (prm_read_mod_reg(CORE_MOD, PM_WKST1))
-                        cpu_relax();
-                cm_write_mod_reg(iclk, CORE_MOD, CM_ICLKEN1);
-                cm_write_mod_reg(fclk, CORE_MOD, CM_FCLKEN1);
-        }
-        wkst = prm_read_mod_reg(CORE_MOD, OMAP3430ES2_PM_WKST3);
-        if (wkst) {
-                iclk = cm_read_mod_reg(CORE_MOD, CM_ICLKEN3);
-                fclk = cm_read_mod_reg(CORE_MOD, OMAP3430ES2_CM_FCLKEN3);
-                cm_set_mod_reg_bits(wkst, CORE_MOD, CM_ICLKEN3);
-                cm_set_mod_reg_bits(wkst, CORE_MOD, OMAP3430ES2_CM_FCLKEN3);
-                prm_write_mod_reg(wkst, CORE_MOD, OMAP3430ES2_PM_WKST3);
-                while (prm_read_mod_reg(CORE_MOD, OMAP3430ES2_PM_WKST3))
-                        cpu_relax();
-                cm_write_mod_reg(iclk, CORE_MOD, CM_ICLKEN3);
-                cm_write_mod_reg(fclk, CORE_MOD, OMAP3430ES2_CM_FCLKEN3);
-        }
+        return c;
+}
 
-        /* PER */
-        wkst = prm_read_mod_reg(OMAP3430_PER_MOD, PM_WKST);
-        if (wkst) {
-                iclk = cm_read_mod_reg(OMAP3430_PER_MOD, CM_ICLKEN);
-                fclk = cm_read_mod_reg(OMAP3430_PER_MOD, CM_FCLKEN);
-                cm_set_mod_reg_bits(wkst, OMAP3430_PER_MOD, CM_ICLKEN);
-                cm_set_mod_reg_bits(wkst, OMAP3430_PER_MOD, CM_FCLKEN);
-                prm_write_mod_reg(wkst, OMAP3430_PER_MOD, PM_WKST);
-                while (prm_read_mod_reg(OMAP3430_PER_MOD, PM_WKST))
-                        cpu_relax();
-                cm_write_mod_reg(iclk, OMAP3430_PER_MOD, CM_ICLKEN);
-                cm_write_mod_reg(fclk, OMAP3430_PER_MOD, CM_FCLKEN);
-        }
+static int _prcm_int_handle_wakeup(void)
+{
+        int c;
 
+        c = prcm_clear_mod_irqs(WKUP_MOD, 1);
+        c += prcm_clear_mod_irqs(CORE_MOD, 1);
+        c += prcm_clear_mod_irqs(OMAP3430_PER_MOD, 1);
         if (omap_rev() > OMAP3430_REV_ES1_0) {
-                /* USBHOST */
-                wkst = prm_read_mod_reg(OMAP3430ES2_USBHOST_MOD, PM_WKST);
-                if (wkst) {
-                        iclk = cm_read_mod_reg(OMAP3430ES2_USBHOST_MOD,
-                                               CM_ICLKEN);
-                        fclk = cm_read_mod_reg(OMAP3430ES2_USBHOST_MOD,
-                                               CM_FCLKEN);
-                        cm_set_mod_reg_bits(wkst, OMAP3430ES2_USBHOST_MOD,
-                                            CM_ICLKEN);
-                        cm_set_mod_reg_bits(wkst, OMAP3430ES2_USBHOST_MOD,
-                                            CM_FCLKEN);
-                        prm_write_mod_reg(wkst, OMAP3430ES2_USBHOST_MOD,
-                                          PM_WKST);
-                        while (prm_read_mod_reg(OMAP3430ES2_USBHOST_MOD,
-                                                PM_WKST))
-                                cpu_relax();
-                        cm_write_mod_reg(iclk, OMAP3430ES2_USBHOST_MOD,
-                                         CM_ICLKEN);
-                        cm_write_mod_reg(fclk, OMAP3430ES2_USBHOST_MOD,
-                                         CM_FCLKEN);
-                }
+                c += prcm_clear_mod_irqs(CORE_MOD, 3);
+                c += prcm_clear_mod_irqs(OMAP3430ES2_USBHOST_MOD, 1);
         }
 
-        irqstatus_mpu = prm_read_mod_reg(OCP_MOD,
-                                         OMAP3_PRM_IRQSTATUS_MPU_OFFSET);
-        prm_write_mod_reg(irqstatus_mpu, OCP_MOD,
-                          OMAP3_PRM_IRQSTATUS_MPU_OFFSET);
+        return c;
+}
+
+/*
+ * PRCM Interrupt Handler
+ *
+ * The PRM_IRQSTATUS_MPU register indicates if there are any pending
+ * interrupts from the PRCM for the MPU. These bits must be cleared in
+ * order to clear the PRCM interrupt. The PRCM interrupt handler is
+ * implemented to simply clear the PRM_IRQSTATUS_MPU in order to clear
+ * the PRCM interrupt. Please note that bit 0 of the PRM_IRQSTATUS_MPU
+ * register indicates that a wake-up event is pending for the MPU and
+ * this bit can only be cleared if the all the wake-up events latched
+ * in the various PM_WKST_x registers have been cleared. The interrupt
+ * handler is implemented using a do-while loop so that if a wake-up
+ * event occurred during the processing of the prcm interrupt handler
+ * (setting a bit in the corresponding PM_WKST_x register and thus
+ * preventing us from clearing bit 0 of the PRM_IRQSTATUS_MPU register)
+ * this would be handled.
+ */
+static irqreturn_t prcm_interrupt_handler (int irq, void *dev_id)
+{
+        u32 irqstatus_mpu;
+        int c = 0;
+
+        do {
+                irqstatus_mpu = prm_read_mod_reg(OCP_MOD,
+                                        OMAP3_PRM_IRQSTATUS_MPU_OFFSET);
+
+                if (irqstatus_mpu & (OMAP3430_WKUP_ST | OMAP3430_IO_ST)) {
+                        c = _prcm_int_handle_wakeup();
+
+                        /*
+                         * Is the MPU PRCM interrupt handler racing with the
+                         * IVA2 PRCM interrupt handler ?
+                         */
+                        WARN(c == 0, "prcm: WARNING: PRCM indicated MPU wakeup "
+                             "but no wakeup sources are marked\n");
+                } else {
+                        /* XXX we need to expand our PRCM interrupt handler */
+                        WARN(1, "prcm: WARNING: PRCM interrupt received, but "
+                             "no code to handle it (%08x)\n", irqstatus_mpu);
+                }
+
+                prm_write_mod_reg(irqstatus_mpu, OCP_MOD,
+                                        OMAP3_PRM_IRQSTATUS_MPU_OFFSET);
 
-        while (prm_read_mod_reg(OCP_MOD, OMAP3_PRM_IRQSTATUS_MPU_OFFSET))
-                cpu_relax();
+        } while (prm_read_mod_reg(OCP_MOD, OMAP3_PRM_IRQSTATUS_MPU_OFFSET));
 
         return IRQ_HANDLED;
 }
@@ -624,6 +639,16 @@ static void __init prcm_setup_regs(void)
         prm_write_mod_reg(OMAP3430_IO_EN | OMAP3430_WKUP_EN,
                           OCP_MOD, OMAP3_PRM_IRQENABLE_MPU_OFFSET);
 
+        /* Enable GPIO wakeups in PER */
+        prm_write_mod_reg(OMAP3430_EN_GPIO2 | OMAP3430_EN_GPIO3 |
+                          OMAP3430_EN_GPIO4 | OMAP3430_EN_GPIO5 |
+                          OMAP3430_EN_GPIO6, OMAP3430_PER_MOD, PM_WKEN);
+        /* and allow them to wake up MPU */
+        prm_write_mod_reg(OMAP3430_GRPSEL_GPIO2 | OMAP3430_EN_GPIO3 |
+                          OMAP3430_GRPSEL_GPIO4 | OMAP3430_EN_GPIO5 |
+                          OMAP3430_GRPSEL_GPIO6,
+                          OMAP3430_PER_MOD, OMAP3430_PM_MPUGRPSEL);
+
         /* Don't attach IVA interrupts */
         prm_write_mod_reg(0, WKUP_MOD, OMAP3430_PM_IVAGRPSEL);
         prm_write_mod_reg(0, CORE_MOD, OMAP3430_PM_IVAGRPSEL1);
diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c
index 2594cbff3947..f00289abd30f 100644
--- a/arch/arm/mach-omap2/powerdomain.c
+++ b/arch/arm/mach-omap2/powerdomain.c
@@ -273,35 +273,50 @@ struct powerdomain *pwrdm_lookup(const char *name)
 }
 
 /**
- * pwrdm_for_each - call function on each registered clockdomain
+ * pwrdm_for_each_nolock - call function on each registered clockdomain
  * @fn: callback function *
  *
  * Call the supplied function for each registered powerdomain.  The
  * callback function can return anything but 0 to bail out early from
- * the iterator.  The callback function is called with the pwrdm_rwlock
- * held for reading, so no powerdomain structure manipulation
- * functions should be called from the callback, although hardware
- * powerdomain control functions are fine.  Returns the last return
- * value of the callback function, which should be 0 for success or
- * anything else to indicate failure; or -EINVAL if the function
- * pointer is null.
+ * the iterator.  Returns the last return value of the callback function, which
+ * should be 0 for success or anything else to indicate failure; or -EINVAL if
+ * the function pointer is null.
  */
-int pwrdm_for_each(int (*fn)(struct powerdomain *pwrdm, void *user),
-                        void *user)
+int pwrdm_for_each_nolock(int (*fn)(struct powerdomain *pwrdm, void *user),
+                                void *user)
 {
         struct powerdomain *temp_pwrdm;
-        unsigned long flags;
         int ret = 0;
 
         if (!fn)
                 return -EINVAL;
 
-        read_lock_irqsave(&pwrdm_rwlock, flags);
         list_for_each_entry(temp_pwrdm, &pwrdm_list, node) {
                 ret = (*fn)(temp_pwrdm, user);
                 if (ret)
                         break;
         }
+
+        return ret;
+}
+
+/**
+ * pwrdm_for_each - call function on each registered clockdomain
+ * @fn: callback function *
+ *
+ * This function is the same as 'pwrdm_for_each_nolock()', but keeps the
+ * &pwrdm_rwlock locked for reading, so no powerdomain structure manipulation
+ * functions should be called from the callback, although hardware powerdomain
+ * control functions are fine.
+ */
+int pwrdm_for_each(int (*fn)(struct powerdomain *pwrdm, void *user),
+                        void *user)
+{
+        unsigned long flags;
+        int ret;
+
+        read_lock_irqsave(&pwrdm_rwlock, flags);
+        ret = pwrdm_for_each_nolock(fn, user);
         read_unlock_irqrestore(&pwrdm_rwlock, flags);
 
         return ret;
diff --git a/arch/arm/plat-omap/include/mach/cpu.h b/arch/arm/plat-omap/include/mach/cpu.h
index 11e73d9e8928..f129efb3075e 100644
--- a/arch/arm/plat-omap/include/mach/cpu.h
+++ b/arch/arm/plat-omap/include/mach/cpu.h
@@ -303,32 +303,21 @@ IS_OMAP_TYPE(3430, 0x3430)
 #define cpu_is_omap2430()               0
 #define cpu_is_omap3430()               0
 
-#if defined(MULTI_OMAP1)
-# if defined(CONFIG_ARCH_OMAP730)
-#  undef  cpu_is_omap730
-#  define cpu_is_omap730()              is_omap730()
-# endif
-# if defined(CONFIG_ARCH_OMAP850)
-#  undef  cpu_is_omap850
-#  define cpu_is_omap850()              is_omap850()
-# endif
-#else
-# if defined(CONFIG_ARCH_OMAP730)
-#  undef  cpu_is_omap730
-#  define cpu_is_omap730()              1
-# endif
-#endif
-#else
-# if defined(CONFIG_ARCH_OMAP850)
-#  undef  cpu_is_omap850
-#  define cpu_is_omap850()              1
-# endif
-#endif
-
 /*
  * Whether we have MULTI_OMAP1 or not, we still need to distinguish
- * between 330 vs. 1510 and 1611B/5912 vs. 1710.
+ * between 730 vs 850, 330 vs. 1510 and 1611B/5912 vs. 1710.
  */
+
+#if defined(CONFIG_ARCH_OMAP730)
+# undef  cpu_is_omap730
+# define cpu_is_omap730()               is_omap730()
+#endif
+
+#if defined(CONFIG_ARCH_OMAP850)
+# undef  cpu_is_omap850
+# define cpu_is_omap850()               is_omap850()
+#endif
+
 #if defined(CONFIG_ARCH_OMAP15XX)
 # undef  cpu_is_omap310
 # undef  cpu_is_omap1510
@@ -433,3 +422,5 @@ IS_OMAP_TYPE(3430, 0x3430)
 
 int omap_chip_is(struct omap_chip_id oci);
 void omap2_check_revision(void);
+
+#endif
diff --git a/arch/arm/plat-omap/include/mach/powerdomain.h b/arch/arm/plat-omap/include/mach/powerdomain.h
index 6271d8556a40..fa6461423bd0 100644
--- a/arch/arm/plat-omap/include/mach/powerdomain.h
+++ b/arch/arm/plat-omap/include/mach/powerdomain.h
@@ -135,6 +135,8 @@ struct powerdomain *pwrdm_lookup(const char *name);
 
 int pwrdm_for_each(int (*fn)(struct powerdomain *pwrdm, void *user),
                         void *user);
+int pwrdm_for_each_nolock(int (*fn)(struct powerdomain *pwrdm, void *user),
+                        void *user);
 
 int pwrdm_add_clkdm(struct powerdomain *pwrdm, struct clockdomain *clkdm);
 int pwrdm_del_clkdm(struct powerdomain *pwrdm, struct clockdomain *clkdm);
diff --git a/arch/arm/plat-omap/iovmm.c b/arch/arm/plat-omap/iovmm.c
index 57f7122a0919..dc3fac3dd0ea 100644
--- a/arch/arm/plat-omap/iovmm.c
+++ b/arch/arm/plat-omap/iovmm.c
@@ -47,7 +47,7 @@
  *      'va':   mpu virtual address
  *
  *      'c':    contiguous memory area
- *      'd':    dicontiguous memory area
+ *      'd':    discontiguous memory area
  *      'a':    anonymous memory allocation
  *      '()':   optional feature
  *
@@ -363,8 +363,9 @@ void *da_to_va(struct iommu *obj, u32 da)
                 goto out;
         }
         va = area->va;
-        mutex_unlock(&obj->mmap_lock);
 out:
+        mutex_unlock(&obj->mmap_lock);
+
         return va;
 }
 EXPORT_SYMBOL_GPL(da_to_va);
@@ -398,7 +399,7 @@ static inline void sgtable_drain_vmalloc(struct sg_table *sgt)
 {
         /*
          * Actually this is not necessary at all, just exists for
-         * consistency of the code readibility.
+         * consistency of the code readability.
          */
         BUG_ON(!sgt);
 }
@@ -434,7 +435,7 @@ static inline void sgtable_drain_kmalloc(struct sg_table *sgt)
 {
         /*
          * Actually this is not necessary at all, just exists for
-         * consistency of the code readibility
+         * consistency of the code readability
          */
         BUG_ON(!sgt);
 }
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index 925f64711c37..75d1f26e5b17 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -270,7 +270,8 @@ void * omap_sram_push(void * start, unsigned long size)
         omap_sram_ceil -= size;
         omap_sram_ceil = ROUND_DOWN(omap_sram_ceil, sizeof(void *));
         memcpy((void *)omap_sram_ceil, start, size);
-        flush_icache_range((unsigned long)start, (unsigned long)(start + size));
+        flush_icache_range((unsigned long)omap_sram_ceil,
+                (unsigned long)(omap_sram_ceil + size));
 
         return (void *)omap_sram_ceil;
 }
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index f388dc68f605..524d9352f17e 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -18,6 +18,7 @@ config PARISC
         select BUG
         select HAVE_PERF_EVENTS
         select GENERIC_ATOMIC64 if !64BIT
+        select HAVE_ARCH_TRACEHOOK
         help
           The PA-RISC microprocessor is designed by Hewlett-Packard and used
           in many of their workstations & servers (HP9000 700 and 800 series,
diff --git a/arch/parisc/include/asm/fixmap.h b/arch/parisc/include/asm/fixmap.h
index de3fe3a18229..6fec4d4a1a18 100644
--- a/arch/parisc/include/asm/fixmap.h
+++ b/arch/parisc/include/asm/fixmap.h
@@ -21,9 +21,9 @@
 #define KERNEL_MAP_END          (TMPALIAS_MAP_START)
 
 #ifndef __ASSEMBLY__
-extern void *vmalloc_start;
+extern void *parisc_vmalloc_start;
 #define PCXL_DMA_MAP_SIZE       (8*1024*1024)
-#define VMALLOC_START           ((unsigned long)vmalloc_start)
+#define VMALLOC_START           ((unsigned long)parisc_vmalloc_start)
 #define VMALLOC_END             (KERNEL_MAP_END)
 #endif /*__ASSEMBLY__*/
 
diff --git a/arch/parisc/include/asm/hardirq.h b/arch/parisc/include/asm/hardirq.h
index ce93133d5112..0d68184a76cb 100644
--- a/arch/parisc/include/asm/hardirq.h
+++ b/arch/parisc/include/asm/hardirq.h
@@ -1,29 +1,11 @@
 /* hardirq.h: PA-RISC hard IRQ support.
  *
  * Copyright (C) 2001 Matthew Wilcox <matthew@wil.cx>
- *
- * The locking is really quite interesting.  There's a cpu-local
- * count of how many interrupts are being handled, and a global
- * lock.  An interrupt can only be serviced if the global lock
- * is free.  You can't be sure no more interrupts are being
- * serviced until you've acquired the lock and then checked
- * all the per-cpu interrupt counts are all zero.  It's a specialised
- * br_lock, and that's exactly how Sparc does it.  We don't because
- * it's more locking for us.  This way is lock-free in the interrupt path.
  */
 
 #ifndef _PARISC_HARDIRQ_H
 #define _PARISC_HARDIRQ_H
 
-#include <linux/threads.h>
-#include <linux/irq.h>
-
-typedef struct {
-        unsigned long __softirq_pending; /* set_bit is used on this */
-} ____cacheline_aligned irq_cpustat_t;
-
-#include <linux/irq_cpustat.h>  /* Standard mappings for irq_cpustat_t above */
-
-void ack_bad_irq(unsigned int irq);
+#include <asm-generic/hardirq.h>
 
 #endif /* _PARISC_HARDIRQ_H */
diff --git a/arch/parisc/include/asm/ptrace.h b/arch/parisc/include/asm/ptrace.h
index 302f68dc889c..aead40b16dd8 100644
--- a/arch/parisc/include/asm/ptrace.h
+++ b/arch/parisc/include/asm/ptrace.h
@@ -59,8 +59,11 @@ void user_enable_block_step(struct task_struct *task);
 #define user_mode(regs)                 (((regs)->iaoq[0] & 3) ? 1 : 0)
 #define user_space(regs)                (((regs)->iasq[1] != 0) ? 1 : 0)
 #define instruction_pointer(regs)       ((regs)->iaoq[0] & ~3)
+#define user_stack_pointer(regs)        ((regs)->gr[30])
 unsigned long profile_pc(struct pt_regs *);
 extern void show_regs(struct pt_regs *);
-#endif
+
+
+#endif /* __KERNEL__ */
 
 #endif
diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
new file mode 100644
index 000000000000..8bdfd2c8c39f
--- /dev/null
+++ b/arch/parisc/include/asm/syscall.h
@@ -0,0 +1,40 @@
+/* syscall.h */
+
+#ifndef _ASM_PARISC_SYSCALL_H_
+#define _ASM_PARISC_SYSCALL_H_
+
+#include <linux/err.h>
+#include <asm/ptrace.h>
+
+static inline long syscall_get_nr(struct task_struct *tsk,
+                                  struct pt_regs *regs)
+{
+        return regs->gr[20];
+}
+
+static inline void syscall_get_arguments(struct task_struct *tsk,
+                                         struct pt_regs *regs, unsigned int i,
+                                         unsigned int n, unsigned long *args)
+{
+        BUG_ON(i);
+
+        switch (n) {
+        case 6:
+                args[5] = regs->gr[21];
+        case 5:
+                args[4] = regs->gr[22];
+        case 4:
+                args[3] = regs->gr[23];
+        case 3:
+                args[2] = regs->gr[24];
+        case 2:
+                args[1] = regs->gr[25];
+        case 1:
+                args[0] = regs->gr[26];
+                break;
+        default:
+                BUG();
+        }
+}
+
+#endif /*_ASM_PARISC_SYSCALL_H_*/
diff --git a/arch/parisc/include/asm/thread_info.h b/arch/parisc/include/asm/thread_info.h
index ac775a76bff7..7ecc1039cfed 100644
--- a/arch/parisc/include/asm/thread_info.h
+++ b/arch/parisc/include/asm/thread_info.h
@@ -32,6 +32,11 @@ struct thread_info {
 #define init_thread_info        (init_thread_union.thread_info)
 #define init_stack              (init_thread_union.stack)
 
+/* how to get the thread information struct from C */
+#define current_thread_info()   ((struct thread_info *)mfctl(30))
+
+#endif /* !__ASSEMBLY */
+
 /* thread information allocation */
 
 #define THREAD_SIZE_ORDER            2
@@ -40,11 +45,6 @@ struct thread_info {
 #define THREAD_SIZE             (PAGE_SIZE << THREAD_SIZE_ORDER)
 #define THREAD_SHIFT            (PAGE_SHIFT + THREAD_SIZE_ORDER)
 
-/* how to get the thread information struct from C */
-#define current_thread_info()   ((struct thread_info *)mfctl(30))
-
-#endif /* !__ASSEMBLY */
-
 #define PREEMPT_ACTIVE_BIT      28
 #define PREEMPT_ACTIVE          (1 << PREEMPT_ACTIVE_BIT)
 
@@ -60,6 +60,8 @@ struct thread_info {
 #define TIF_RESTORE_SIGMASK     6       /* restore saved signal mask */
 #define TIF_FREEZE              7       /* is freezing for suspend */
 #define TIF_NOTIFY_RESUME       8       /* callback before returning to user */
+#define TIF_SINGLESTEP          9       /* single stepping? */
+#define TIF_BLOCKSTEP           10      /* branch stepping? */
 
 #define _TIF_SYSCALL_TRACE      (1 << TIF_SYSCALL_TRACE)
 #define _TIF_SIGPENDING         (1 << TIF_SIGPENDING)
@@ -69,6 +71,8 @@ struct thread_info {
 #define _TIF_RESTORE_SIGMASK    (1 << TIF_RESTORE_SIGMASK)
 #define _TIF_FREEZE             (1 << TIF_FREEZE)
 #define _TIF_NOTIFY_RESUME      (1 << TIF_NOTIFY_RESUME)
+#define _TIF_SINGLESTEP         (1 << TIF_SINGLESTEP)
+#define _TIF_BLOCKSTEP          (1 << TIF_BLOCKSTEP)
 
 #define _TIF_USER_WORK_MASK     (_TIF_SIGPENDING | _TIF_NOTIFY_RESUME | \
                                  _TIF_NEED_RESCHED | _TIF_RESTORE_SIGMASK)
diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c
index 699cf8ef2118..fcd3c707bf12 100644
--- a/arch/parisc/kernel/asm-offsets.c
+++ b/arch/parisc/kernel/asm-offsets.c
@@ -270,8 +270,8 @@ int main(void)
         DEFINE(DTLB_OFF_COUNT, offsetof(struct pdc_cache_info, dt_off_count));
         DEFINE(DTLB_LOOP, offsetof(struct pdc_cache_info, dt_loop));
         BLANK();
-        DEFINE(PA_BLOCKSTEP_BIT, 31-PT_BLOCKSTEP_BIT);
-        DEFINE(PA_SINGLESTEP_BIT, 31-PT_SINGLESTEP_BIT);
+        DEFINE(TIF_BLOCKSTEP_PA_BIT, 31-TIF_BLOCKSTEP);
+        DEFINE(TIF_SINGLESTEP_PA_BIT, 31-TIF_SINGLESTEP);
         BLANK();
         DEFINE(ASM_PMD_SHIFT, PMD_SHIFT);
         DEFINE(ASM_PGDIR_SHIFT, PGDIR_SHIFT);
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 8c4712b74dc1..3a44f7f704fa 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -2047,12 +2047,13 @@ syscall_do_signal:
         b,n     syscall_check_sig
 
 syscall_restore:
-        /* Are we being ptraced? */
         LDREG   TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1
 
-        ldw     TASK_PTRACE(%r1), %r19
-        bb,<    %r19,31,syscall_restore_rfi
-        nop
+        /* Are we being ptraced? */
+        ldw     TASK_FLAGS(%r1),%r19
+        ldi     (_TIF_SINGLESTEP|_TIF_BLOCKSTEP),%r2
+        and,COND(=)     %r19,%r2,%r0
+        b,n     syscall_restore_rfi
 
         ldo     TASK_PT_FR31(%r1),%r19             /* reload fpregs */
         rest_fp %r19
@@ -2113,16 +2114,16 @@ syscall_restore_rfi:
         ldi     0x0b,%r20                          /* Create new PSW */
         depi    -1,13,1,%r20                       /* C, Q, D, and I bits */
 
-        /* The values of PA_SINGLESTEP_BIT and PA_BLOCKSTEP_BIT are
-         * set in include/linux/ptrace.h and converted to PA bitmap
+        /* The values of SINGLESTEP_BIT and BLOCKSTEP_BIT are
+         * set in thread_info.h and converted to PA bitmap
          * numbers in asm-offsets.c */
 
-        /* if ((%r19.PA_SINGLESTEP_BIT)) { %r20.27=1} */
-        extru,= %r19,PA_SINGLESTEP_BIT,1,%r0
+        /* if ((%r19.SINGLESTEP_BIT)) { %r20.27=1} */
+        extru,= %r19,TIF_SINGLESTEP_PA_BIT,1,%r0
         depi    -1,27,1,%r20                       /* R bit */
 
-        /* if ((%r19.PA_BLOCKSTEP_BIT)) { %r20.7=1} */
-        extru,= %r19,PA_BLOCKSTEP_BIT,1,%r0
+        /* if ((%r19.BLOCKSTEP_BIT)) { %r20.7=1} */
+        extru,= %r19,TIF_BLOCKSTEP_PA_BIT,1,%r0
         depi    -1,7,1,%r20                        /* T bit */
 
         STREG   %r20,TASK_PT_PSW(%r1)
diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
index 330f536a9324..2e7610cb33d5 100644
--- a/arch/parisc/kernel/irq.c
+++ b/arch/parisc/kernel/irq.c
@@ -423,8 +423,3 @@ void __init init_IRQ(void)
         set_eiem(cpu_eiem);     /* EIEM : enable all external intr */
 
 }
-
-void ack_bad_irq(unsigned int irq)
-{
-        printk(KERN_WARNING "unexpected IRQ %d\n", irq);
-}
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index 61ee0eec4e69..212074653df7 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -893,7 +893,7 @@ int module_finalize(const Elf_Ehdr *hdr,
          * ourselves */
         for (i = 1; i < hdr->e_shnum; i++) {
                 if(sechdrs[i].sh_type == SHT_SYMTAB
-                   && (sechdrs[i].sh_type & SHF_ALLOC)) {
+                   && (sechdrs[i].sh_flags & SHF_ALLOC)) {
                         int strindex = sechdrs[i].sh_link;
                         /* FIXME: AWFUL HACK
                          * The cast is to drop the const from
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 927db3668b6f..c4f49e45129d 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -13,6 +13,7 @@
 #include <linux/smp.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
+#include <linux/tracehook.h>
 #include <linux/user.h>
 #include <linux/personality.h>
 #include <linux/security.h>
@@ -35,7 +36,8 @@
  */
 void ptrace_disable(struct task_struct *task)
 {
-        task->ptrace &= ~(PT_SINGLESTEP|PT_BLOCKSTEP);
+        clear_tsk_thread_flag(task, TIF_SINGLESTEP);
+        clear_tsk_thread_flag(task, TIF_BLOCKSTEP);
 
         /* make sure the trap bits are not set */
         pa_psw(task)->r = 0;
@@ -55,8 +57,8 @@ void user_disable_single_step(struct task_struct *task)
 
 void user_enable_single_step(struct task_struct *task)
 {
-        task->ptrace &= ~PT_BLOCKSTEP;
-        task->ptrace |= PT_SINGLESTEP;
+        clear_tsk_thread_flag(task, TIF_BLOCKSTEP);
+        set_tsk_thread_flag(task, TIF_SINGLESTEP);
 
         if (pa_psw(task)->n) {
                 struct siginfo si;
@@ -98,8 +100,8 @@ void user_enable_single_step(struct task_struct *task)
 
 void user_enable_block_step(struct task_struct *task)
 {
-        task->ptrace &= ~PT_SINGLESTEP;
-        task->ptrace |= PT_BLOCKSTEP;
+        clear_tsk_thread_flag(task, TIF_SINGLESTEP);
+        set_tsk_thread_flag(task, TIF_BLOCKSTEP);
 
         /* Enable taken branch trap. */
         pa_psw(task)->r = 0;
@@ -263,22 +265,20 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
 }
 #endif
 
+long do_syscall_trace_enter(struct pt_regs *regs)
+{
+        if (test_thread_flag(TIF_SYSCALL_TRACE) &&
+            tracehook_report_syscall_entry(regs))
+                return -1L;
+
+        return regs->gr[20];
+}
 
-void syscall_trace(void)
+void do_syscall_trace_exit(struct pt_regs *regs)
 {
-        if (!test_thread_flag(TIF_SYSCALL_TRACE))
-                return;
-        if (!(current->ptrace & PT_PTRACED))
-                return;
-        ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
-                                 ? 0x80 : 0));
-        /*
-         * this isn't the same as continuing with a signal, but it will do
-         * for normal use.  strace only continues with a signal if the
-         * stopping signal is not SIGTRAP.  -brl
-         */
-        if (current->exit_code) {
-                send_sig(current->exit_code, current, 1);
-                current->exit_code = 0;
-        }
+        int stepping = test_thread_flag(TIF_SINGLESTEP) ||
+                test_thread_flag(TIF_BLOCKSTEP);
+
+        if (stepping || test_thread_flag(TIF_SYSCALL_TRACE))
+                tracehook_report_syscall_exit(regs, stepping);
 }
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 8eb3c63c407a..e8467e4aa8d1 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -21,6 +21,7 @@
 #include <linux/errno.h>
 #include <linux/wait.h>
 #include <linux/ptrace.h>
+#include <linux/tracehook.h>
 #include <linux/unistd.h>
 #include <linux/stddef.h>
 #include <linux/compat.h>
@@ -34,7 +35,6 @@
 #include <asm/asm-offsets.h>
 
 #ifdef CONFIG_COMPAT
-#include <linux/compat.h>
 #include "signal32.h"
 #endif
 
@@ -468,6 +468,9 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
                 sigaddset(&current->blocked,sig);
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
+
+        tracehook_signal_handler(sig, info, ka, regs, 0);
+
         return 1;
 }
 
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index 59fc1a43ec3e..f5f96021caa0 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -288,18 +288,23 @@ tracesys:
         STREG   %r18,PT_GR18(%r2)
         /* Finished saving things for the debugger */
 
-        ldil    L%syscall_trace,%r1
+        copy    %r2,%r26
+        ldil    L%do_syscall_trace_enter,%r1
         ldil    L%tracesys_next,%r2
-        be      R%syscall_trace(%sr7,%r1)
+        be      R%do_syscall_trace_enter(%sr7,%r1)
         ldo     R%tracesys_next(%r2),%r2
         
-tracesys_next:  
+tracesys_next:
+        /* do_syscall_trace_enter either returned the syscallno, or -1L,
+         *  so we skip restoring the PT_GR20 below, since we pulled it from
+         *  task->thread.regs.gr[20] above.
+         */
+        copy    %ret0,%r20
         ldil    L%sys_call_table,%r1
         ldo     R%sys_call_table(%r1), %r19
 
         ldo     -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1      /* get task ptr */
         LDREG   TI_TASK(%r1), %r1
-        LDREG   TASK_PT_GR20(%r1), %r20
         LDREG   TASK_PT_GR26(%r1), %r26         /* Restore the users args */
         LDREG   TASK_PT_GR25(%r1), %r25
         LDREG   TASK_PT_GR24(%r1), %r24
@@ -336,7 +341,8 @@ tracesys_exit:
 #ifdef CONFIG_64BIT
         ldo     -16(%r30),%r29                  /* Reference param save area */
 #endif
-        bl      syscall_trace, %r2
+        ldo     TASK_REGS(%r1),%r26
+        bl      do_syscall_trace_exit,%r2
         STREG   %r28,TASK_PT_GR28(%r1)          /* save return value now */
         ldo     -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1      /* get task ptr */
         LDREG   TI_TASK(%r1), %r1
@@ -353,12 +359,12 @@ tracesys_exit:
 
 tracesys_sigexit:
         ldo     -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1      /* get task ptr */
-        LDREG   0(%r1), %r1
+        LDREG   TI_TASK(%r1), %r1
 #ifdef CONFIG_64BIT
         ldo     -16(%r30),%r29                  /* Reference param save area */
 #endif
-        bl      syscall_trace, %r2
-        nop
+        bl      do_syscall_trace_exit,%r2
+        ldo     TASK_REGS(%r1),%r26
 
         ldil    L%syscall_exit_rfi,%r1
         be,n    R%syscall_exit_rfi(%sr7,%r1)
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 775be2791bc2..fda4baa059b5 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -28,6 +28,7 @@
 #include <asm/cache.h>
 #include <asm/page.h>
 #include <asm/asm-offsets.h>
+#include <asm/thread_info.h>
         
 /* ld script to make hppa Linux kernel */
 #ifndef CONFIG_64BIT
@@ -134,6 +135,15 @@ SECTIONS
         __init_begin = .;
         INIT_TEXT_SECTION(16384)
         INIT_DATA_SECTION(16)
+        /* we have to discard exit text and such at runtime, not link time */
+        .exit.text :
+        {
+                EXIT_TEXT
+        }
+        .exit.data :
+        {
+                EXIT_DATA
+        }
 
         PERCPU(PAGE_SIZE)
         . = ALIGN(PAGE_SIZE);
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index d5aca31fddbb..13b6e3e59b99 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -434,8 +434,8 @@ void mark_rodata_ro(void)
 #define SET_MAP_OFFSET(x) ((void *)(((unsigned long)(x) + VM_MAP_OFFSET) \
                                      & ~(VM_MAP_OFFSET-1)))
 
-void *vmalloc_start __read_mostly;
-EXPORT_SYMBOL(vmalloc_start);
+void *parisc_vmalloc_start __read_mostly;
+EXPORT_SYMBOL(parisc_vmalloc_start);
 
 #ifdef CONFIG_PA11
 unsigned long pcxl_dma_start __read_mostly;
@@ -496,13 +496,14 @@ void __init mem_init(void)
 #ifdef CONFIG_PA11
         if (hppa_dma_ops == &pcxl_dma_ops) {
                 pcxl_dma_start = (unsigned long)SET_MAP_OFFSET(MAP_START);
-                vmalloc_start = SET_MAP_OFFSET(pcxl_dma_start + PCXL_DMA_MAP_SIZE);
+                parisc_vmalloc_start = SET_MAP_OFFSET(pcxl_dma_start
+                                                + PCXL_DMA_MAP_SIZE);
         } else {
                 pcxl_dma_start = 0;
-                vmalloc_start = SET_MAP_OFFSET(MAP_START);
+                parisc_vmalloc_start = SET_MAP_OFFSET(MAP_START);
         }
 #else
-        vmalloc_start = SET_MAP_OFFSET(MAP_START);
+        parisc_vmalloc_start = SET_MAP_OFFSET(MAP_START);
 #endif
 
         printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, %dk reserved, %dk data, %dk init)\n",
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index 60ab75104da9..1c129211302d 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -217,7 +217,7 @@ static const struct agp_bridge_driver parisc_agp_driver = {
         .configure              = parisc_agp_configure,
         .fetch_size             = parisc_agp_fetch_size,
         .tlb_flush              = parisc_agp_tlbflush,
-        .mask_memory            = parisc_agp_page_mask_memory,
+        .mask_memory            = parisc_agp_mask_memory,
         .masks                  = parisc_agp_masks,
         .agp_enable             = parisc_agp_enable,
         .cache_flush            = global_cache_flush,
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index abf4a2529f80..60697909ebdb 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -227,7 +227,8 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
  * cn_proc_mcast_ctl
  * @data: message sent from userspace via the connector
  */
-static void cn_proc_mcast_ctl(struct cn_msg *msg)
+static void cn_proc_mcast_ctl(struct cn_msg *msg,
+                              struct netlink_skb_parms *nsp)
 {
         enum proc_cn_mcast_op *mc_op = NULL;
         int err = 0;
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 4e551e63b6dc..4f4ac82382f7 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -15,8 +15,8 @@ module_param(ecc_enable_override, int, 0644);
 
 /* Lookup table for all possible MC control instances */
 struct amd64_pvt;
-static struct mem_ctl_info *mci_lookup[MAX_NUMNODES];
-static struct amd64_pvt *pvt_lookup[MAX_NUMNODES];
+static struct mem_ctl_info *mci_lookup[EDAC_MAX_NUMNODES];
+static struct amd64_pvt *pvt_lookup[EDAC_MAX_NUMNODES];
 
 /*
  * See F2x80 for K8 and F2x[1,0]80 for Fam10 and later. The table below is only
@@ -189,7 +189,10 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci, u32 *bw)
 /* Map from a CSROW entry to the mask entry that operates on it */
 static inline u32 amd64_map_to_dcs_mask(struct amd64_pvt *pvt, int csrow)
 {
-        return csrow >> (pvt->num_dcsm >> 3);
+        if (boot_cpu_data.x86 == 0xf && pvt->ext_model < OPTERON_CPU_REV_F)
+                return csrow;
+        else
+                return csrow >> 1;
 }
 
 /* return the 'base' address the i'th CS entry of the 'dct' DRAM controller */
@@ -279,29 +282,26 @@ static struct mem_ctl_info *find_mc_by_sys_addr(struct mem_ctl_info *mci,
         intlv_en = pvt->dram_IntlvEn[0];
 
         if (intlv_en == 0) {
-                for (node_id = 0; ; ) {
+                for (node_id = 0; node_id < DRAM_REG_COUNT; node_id++) {
                         if (amd64_base_limit_match(pvt, sys_addr, node_id))
-                                break;
-
-                        if (++node_id >= DRAM_REG_COUNT)
-                                goto err_no_match;
+                                goto found;
                 }
-                goto found;
+                goto err_no_match;
         }
 
-        if (unlikely((intlv_en != (0x01 << 8)) &&
-                     (intlv_en != (0x03 << 8)) &&
-                     (intlv_en != (0x07 << 8)))) {
+        if (unlikely((intlv_en != 0x01) &&
+                     (intlv_en != 0x03) &&
+                     (intlv_en != 0x07))) {
                 amd64_printk(KERN_WARNING, "junk value of 0x%x extracted from "
                              "IntlvEn field of DRAM Base Register for node 0: "
-                             "This probably indicates a BIOS bug.\n", intlv_en);
+                             "this probably indicates a BIOS bug.\n", intlv_en);
                 return NULL;
         }
 
         bits = (((u32) sys_addr) >> 12) & intlv_en;
 
         for (node_id = 0; ; ) {
-                if ((pvt->dram_limit[node_id] & intlv_en) == bits)
+                if ((pvt->dram_IntlvSel[node_id] & intlv_en) == bits)
                         break;  /* intlv_sel field matches */
 
                 if (++node_id >= DRAM_REG_COUNT)
@@ -311,10 +311,10 @@ static struct mem_ctl_info *find_mc_by_sys_addr(struct mem_ctl_info *mci,
         /* sanity test for sys_addr */
         if (unlikely(!amd64_base_limit_match(pvt, sys_addr, node_id))) {
                 amd64_printk(KERN_WARNING,
-                          "%s(): sys_addr 0x%lx falls outside base/limit "
-                          "address range for node %d with node interleaving "
-                          "enabled.\n", __func__, (unsigned long)sys_addr,
-                          node_id);
+                             "%s(): sys_addr 0x%llx falls outside base/limit "
+                             "address range for node %d with node interleaving "
+                             "enabled.\n",
+                             __func__, sys_addr, node_id);
                 return NULL;
         }
 
@@ -377,7 +377,7 @@ static int input_addr_to_csrow(struct mem_ctl_info *mci, u64 input_addr)
          * base/mask register pair, test the condition shown near the start of
          * section 3.5.4 (p. 84, BKDG #26094, K8, revA-E).
          */
-        for (csrow = 0; csrow < CHIPSELECT_COUNT; csrow++) {
+        for (csrow = 0; csrow < pvt->cs_count; csrow++) {
 
                 /* This DRAM chip select is disabled on this node */
                 if ((pvt->dcsb0[csrow] & K8_DCSB_CS_ENABLE) == 0)
@@ -734,7 +734,7 @@ static void find_csrow_limits(struct mem_ctl_info *mci, int csrow,
         u64 base, mask;
 
         pvt = mci->pvt_info;
-        BUG_ON((csrow < 0) || (csrow >= CHIPSELECT_COUNT));
+        BUG_ON((csrow < 0) || (csrow >= pvt->cs_count));
 
         base = base_from_dct_base(pvt, csrow);
         mask = mask_from_dct_mask(pvt, csrow);
@@ -962,35 +962,27 @@ err_reg:
  */
 static void amd64_set_dct_base_and_mask(struct amd64_pvt *pvt)
 {
-        if (pvt->ext_model >= OPTERON_CPU_REV_F) {
+
+        if (boot_cpu_data.x86 == 0xf && pvt->ext_model < OPTERON_CPU_REV_F) {
+                pvt->dcsb_base          = REV_E_DCSB_BASE_BITS;
+                pvt->dcsm_mask          = REV_E_DCSM_MASK_BITS;
+                pvt->dcs_mask_notused   = REV_E_DCS_NOTUSED_BITS;
+                pvt->dcs_shift          = REV_E_DCS_SHIFT;
+                pvt->cs_count           = 8;
+                pvt->num_dcsm           = 8;
+        } else {
                 pvt->dcsb_base          = REV_F_F1Xh_DCSB_BASE_BITS;
                 pvt->dcsm_mask          = REV_F_F1Xh_DCSM_MASK_BITS;
                 pvt->dcs_mask_notused   = REV_F_F1Xh_DCS_NOTUSED_BITS;
                 pvt->dcs_shift          = REV_F_F1Xh_DCS_SHIFT;
 
-                switch (boot_cpu_data.x86) {
-                case 0xf:
-                        pvt->num_dcsm = REV_F_DCSM_COUNT;
-                        break;
-
-                case 0x10:
-                        pvt->num_dcsm = F10_DCSM_COUNT;
-                        break;
-
-                case 0x11:
-                        pvt->num_dcsm = F11_DCSM_COUNT;
-                        break;
-
-                default:
-                        amd64_printk(KERN_ERR, "Unsupported family!\n");
-                        break;
+                if (boot_cpu_data.x86 == 0x11) {
+                        pvt->cs_count = 4;
+                        pvt->num_dcsm = 2;
+                } else {
+                        pvt->cs_count = 8;
+                        pvt->num_dcsm = 4;
                 }
-        } else {
-                pvt->dcsb_base          = REV_E_DCSB_BASE_BITS;
-                pvt->dcsm_mask          = REV_E_DCSM_MASK_BITS;
-                pvt->dcs_mask_notused   = REV_E_DCS_NOTUSED_BITS;
-                pvt->dcs_shift          = REV_E_DCS_SHIFT;
-                pvt->num_dcsm           = REV_E_DCSM_COUNT;
         }
 }
 
@@ -1003,7 +995,7 @@ static void amd64_read_dct_base_mask(struct amd64_pvt *pvt)
 
         amd64_set_dct_base_and_mask(pvt);
 
-        for (cs = 0; cs < CHIPSELECT_COUNT; cs++) {
+        for (cs = 0; cs < pvt->cs_count; cs++) {
                 reg = K8_DCSB0 + (cs * 4);
                 err = pci_read_config_dword(pvt->dram_f2_ctl, reg,
                                                 &pvt->dcsb0[cs]);
@@ -1130,7 +1122,7 @@ static void k8_read_dram_base_limit(struct amd64_pvt *pvt, int dram)
                 debugf0("Reading K8_DRAM_BASE_LOW failed\n");
 
         /* Extract parts into separate data entries */
-        pvt->dram_base[dram] = ((u64) low & 0xFFFF0000) << 8;
+        pvt->dram_base[dram] = ((u64) low & 0xFFFF0000) << 24;
         pvt->dram_IntlvEn[dram] = (low >> 8) & 0x7;
         pvt->dram_rw_en[dram] = (low & 0x3);
 
@@ -1143,7 +1135,7 @@ static void k8_read_dram_base_limit(struct amd64_pvt *pvt, int dram)
          * Extract parts into separate data entries. Limit is the HIGHEST memory
          * location of the region, so lower 24 bits need to be all ones
          */
-        pvt->dram_limit[dram] = (((u64) low & 0xFFFF0000) << 8) | 0x00FFFFFF;
+        pvt->dram_limit[dram] = (((u64) low & 0xFFFF0000) << 24) | 0x00FFFFFF;
         pvt->dram_IntlvSel[dram] = (low >> 8) & 0x7;
         pvt->dram_DstNode[dram] = (low & 0x7);
 }
@@ -1193,7 +1185,7 @@ static void k8_map_sysaddr_to_csrow(struct mem_ctl_info *mci,
          * different from the node that detected the error.
          */
         src_mci = find_mc_by_sys_addr(mci, SystemAddress);
-        if (src_mci) {
+        if (!src_mci) {
                 amd64_mc_printk(mci, KERN_ERR,
                              "failed to map error address 0x%lx to a node\n",
                              (unsigned long)SystemAddress);
@@ -1376,8 +1368,8 @@ static void f10_read_dram_base_limit(struct amd64_pvt *pvt, int dram)
 
         pvt->dram_IntlvEn[dram] = (low_base >> 8) & 0x7;
 
-        pvt->dram_base[dram] = (((((u64) high_base & 0x000000FF) << 32) |
-                                ((u64) low_base & 0xFFFF0000))) << 8;
+        pvt->dram_base[dram] = (((u64)high_base & 0x000000FF) << 40) |
+                               (((u64)low_base  & 0xFFFF0000) << 24);
 
         low_offset = K8_DRAM_LIMIT_LOW + (dram << 3);
         high_offset = F10_DRAM_LIMIT_HIGH + (dram << 3);
@@ -1398,9 +1390,9 @@ static void f10_read_dram_base_limit(struct amd64_pvt *pvt, int dram)
          * Extract address values and form a LIMIT address. Limit is the HIGHEST
          * memory location of the region, so low 24 bits need to be all ones.
          */
-        low_limit |= 0x0000FFFF;
-        pvt->dram_limit[dram] =
-                ((((u64) high_limit << 32) + (u64) low_limit) << 8) | (0xFF);
+        pvt->dram_limit[dram] = (((u64)high_limit & 0x000000FF) << 40) |
+                                (((u64) low_limit & 0xFFFF0000) << 24) |
+                                0x00FFFFFF;
 }
 
 static void f10_read_dram_ctl_register(struct amd64_pvt *pvt)
@@ -1566,7 +1558,7 @@ static int f10_lookup_addr_in_dct(u32 in_addr, u32 nid, u32 cs)
 
         debugf1("InputAddr=0x%x  channelselect=%d\n", in_addr, cs);
 
-        for (csrow = 0; csrow < CHIPSELECT_COUNT; csrow++) {
+        for (csrow = 0; csrow < pvt->cs_count; csrow++) {
 
                 cs_base = amd64_get_dct_base(pvt, cs, csrow);
                 if (!(cs_base & K8_DCSB_CS_ENABLE))
@@ -2497,7 +2489,7 @@ err_reg:
  * NOTE: CPU Revision Dependent code
  *
  * Input:
- *      @csrow_nr ChipSelect Row Number (0..CHIPSELECT_COUNT-1)
+ *      @csrow_nr ChipSelect Row Number (0..pvt->cs_count-1)
  *      k8 private pointer to -->
  *                      DRAM Bank Address mapping register
  *                      node_id
@@ -2577,7 +2569,7 @@ static int amd64_init_csrows(struct mem_ctl_info *mci)
                 (pvt->nbcfg & K8_NBCFG_ECC_ENABLE) ? "Enabled" : "Disabled"
                 );
 
-        for (i = 0; i < CHIPSELECT_COUNT; i++) {
+        for (i = 0; i < pvt->cs_count; i++) {
                 csrow = &mci->csrows[i];
 
                 if ((pvt->dcsb0[i] & K8_DCSB_CS_ENABLE) == 0) {
@@ -2988,7 +2980,7 @@ static int amd64_init_2nd_stage(struct amd64_pvt *pvt)
                 goto err_exit;
 
         ret = -ENOMEM;
-        mci = edac_mc_alloc(0, CHIPSELECT_COUNT, pvt->channel_count, node_id);
+        mci = edac_mc_alloc(0, pvt->cs_count, pvt->channel_count, node_id);
         if (!mci)
                 goto err_exit;
 
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index 8ea07e2715dc..c6f359a85207 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -132,6 +132,8 @@
 #define EDAC_AMD64_VERSION              " Ver: 3.2.0 " __DATE__
 #define EDAC_MOD_STR                    "amd64_edac"
 
+#define EDAC_MAX_NUMNODES               8
+
 /* Extended Model from CPUID, for CPU Revision numbers */
 #define OPTERON_CPU_LE_REV_C            0
 #define OPTERON_CPU_REV_D               1
@@ -142,7 +144,7 @@
 #define OPTERON_CPU_REV_FA              5
 
 /* Hardware limit on ChipSelect rows per MC and processors per system */
-#define CHIPSELECT_COUNT                8
+#define MAX_CS_COUNT                    8
 #define DRAM_REG_COUNT                  8
 
 
@@ -193,7 +195,6 @@
  */
 #define REV_E_DCSB_BASE_BITS            (0xFFE0FE00ULL)
 #define REV_E_DCS_SHIFT                 4
-#define REV_E_DCSM_COUNT                8
 
 #define REV_F_F1Xh_DCSB_BASE_BITS       (0x1FF83FE0ULL)
 #define REV_F_F1Xh_DCS_SHIFT            8
@@ -204,9 +205,6 @@
  */
 #define REV_F_DCSB_BASE_BITS            (0x1FF83FE0ULL)
 #define REV_F_DCS_SHIFT                 8
-#define REV_F_DCSM_COUNT                4
-#define F10_DCSM_COUNT                  4
-#define F11_DCSM_COUNT                  2
 
 /* DRAM CS Mask Registers */
 #define K8_DCSM0                        0x60
@@ -374,13 +372,11 @@ enum {
 
 #define SET_NB_DRAM_INJECTION_WRITE(word, bits)  \
                                         (BIT(((word) & 0xF) + 20) | \
-                                        BIT(17) |  \
-                                        ((bits) & 0xF))
+                                        BIT(17) | bits)
 
 #define SET_NB_DRAM_INJECTION_READ(word, bits)  \
                                         (BIT(((word) & 0xF) + 20) | \
-                                        BIT(16) |  \
-                                        ((bits) & 0xF))
+                                        BIT(16) |  bits)
 
 #define K8_NBCAP                        0xE8
 #define K8_NBCAP_CORES                  (BIT(12)|BIT(13))
@@ -445,12 +441,12 @@ struct amd64_pvt {
         u32 dbam1;              /* DRAM Base Address Mapping reg for DCT1 */
 
         /* DRAM CS Base Address Registers F2x[1,0][5C:40] */
-        u32 dcsb0[CHIPSELECT_COUNT];
-        u32 dcsb1[CHIPSELECT_COUNT];
+        u32 dcsb0[MAX_CS_COUNT];
+        u32 dcsb1[MAX_CS_COUNT];
 
         /* DRAM CS Mask Registers F2x[1,0][6C:60] */
-        u32 dcsm0[CHIPSELECT_COUNT];
-        u32 dcsm1[CHIPSELECT_COUNT];
+        u32 dcsm0[MAX_CS_COUNT];
+        u32 dcsm1[MAX_CS_COUNT];
 
         /*
          * Decoded parts of DRAM BASE and LIMIT Registers
@@ -470,6 +466,7 @@ struct amd64_pvt {
          */
         u32 dcsb_base;          /* DCSB base bits */
         u32 dcsm_mask;          /* DCSM mask bits */
+        u32 cs_count;           /* num chip selects (== num DCSB registers) */
         u32 num_dcsm;           /* Number of DCSM registers */
         u32 dcs_mask_notused;   /* DCSM notused mask bits */
         u32 dcs_shift;          /* DCSB and DCSM shift value */
diff --git a/drivers/edac/amd64_edac_inj.c b/drivers/edac/amd64_edac_inj.c
index d3675b76b3a7..29f1f7a612d9 100644
--- a/drivers/edac/amd64_edac_inj.c
+++ b/drivers/edac/amd64_edac_inj.c
@@ -1,5 +1,11 @@
 #include "amd64_edac.h"
 
+static ssize_t amd64_inject_section_show(struct mem_ctl_info *mci, char *buf)
+{
+        struct amd64_pvt *pvt = mci->pvt_info;
+        return sprintf(buf, "0x%x\n", pvt->injection.section);
+}
+
 /*
  * store error injection section value which refers to one of 4 16-byte sections
  * within a 64-byte cacheline
@@ -15,12 +21,26 @@ static ssize_t amd64_inject_section_store(struct mem_ctl_info *mci,
 
         ret = strict_strtoul(data, 10, &value);
         if (ret != -EINVAL) {
+
+                if (value > 3) {
+                        amd64_printk(KERN_WARNING,
+                                     "%s: invalid section 0x%lx\n",
+                                     __func__, value);
+                        return -EINVAL;
+                }
+
                 pvt->injection.section = (u32) value;
                 return count;
         }
         return ret;
 }
 
+static ssize_t amd64_inject_word_show(struct mem_ctl_info *mci, char *buf)
+{
+        struct amd64_pvt *pvt = mci->pvt_info;
+        return sprintf(buf, "0x%x\n", pvt->injection.word);
+}
+
 /*
  * store error injection word value which refers to one of 9 16-bit word of the
  * 16-byte (128-bit + ECC bits) section
@@ -37,14 +57,25 @@ static ssize_t amd64_inject_word_store(struct mem_ctl_info *mci,
         ret = strict_strtoul(data, 10, &value);
         if (ret != -EINVAL) {
 
-                value = (value <= 8) ? value : 0;
-                pvt->injection.word = (u32) value;
+                if (value > 8) {
+                        amd64_printk(KERN_WARNING,
+                                     "%s: invalid word 0x%lx\n",
+                                     __func__, value);
+                        return -EINVAL;
+                }
 
+                pvt->injection.word = (u32) value;
                 return count;
         }
         return ret;
 }
 
+static ssize_t amd64_inject_ecc_vector_show(struct mem_ctl_info *mci, char *buf)
+{
+        struct amd64_pvt *pvt = mci->pvt_info;
+        return sprintf(buf, "0x%x\n", pvt->injection.bit_map);
+}
+
 /*
  * store 16 bit error injection vector which enables injecting errors to the
  * corresponding bit within the error injection word above. When used during a
@@ -60,8 +91,14 @@ static ssize_t amd64_inject_ecc_vector_store(struct mem_ctl_info *mci,
         ret = strict_strtoul(data, 16, &value);
         if (ret != -EINVAL) {
 
-                pvt->injection.bit_map = (u32) value & 0xFFFF;
+                if (value & 0xFFFF0000) {
+                        amd64_printk(KERN_WARNING,
+                                     "%s: invalid EccVector: 0x%lx\n",
+                                     __func__, value);
+                        return -EINVAL;
+                }
 
+                pvt->injection.bit_map = (u32) value;
                 return count;
         }
         return ret;
@@ -147,7 +184,7 @@ struct mcidev_sysfs_attribute amd64_inj_attrs[] = {
                         .name = "inject_section",
                         .mode = (S_IRUGO | S_IWUSR)
                 },
-                .show = NULL,
+                .show = amd64_inject_section_show,
                 .store = amd64_inject_section_store,
         },
         {
@@ -155,7 +192,7 @@ struct mcidev_sysfs_attribute amd64_inj_attrs[] = {
                         .name = "inject_word",
                         .mode = (S_IRUGO | S_IWUSR)
                 },
-                .show = NULL,
+                .show = amd64_inject_word_show,
                 .store = amd64_inject_word_store,
         },
         {
@@ -163,7 +200,7 @@ struct mcidev_sysfs_attribute amd64_inj_attrs[] = {
                         .name = "inject_ecc_vector",
                         .mode = (S_IRUGO | S_IWUSR)
                 },
-                .show = NULL,
+                .show = amd64_inject_ecc_vector_show,
                 .store = amd64_inject_ecc_vector_store,
         },
         {
diff --git a/drivers/hwmon/lis3lv02d_spi.c b/drivers/hwmon/lis3lv02d_spi.c
index ecd739534f6a..82b16808a274 100644
--- a/drivers/hwmon/lis3lv02d_spi.c
+++ b/drivers/hwmon/lis3lv02d_spi.c
@@ -83,7 +83,8 @@ static int __devexit lis302dl_spi_remove(struct spi_device *spi)
         struct lis3lv02d *lis3 = spi_get_drvdata(spi);
         lis3lv02d_joystick_disable();
         lis3lv02d_poweroff(lis3);
-        return 0;
+
+        return lis3lv02d_remove_fs(&lis3_dev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 4d76ba473097..63c53d65e875 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1046,6 +1046,15 @@ static void ide_port_init_devices(ide_hwif_t *hwif)
                 if (port_ops && port_ops->init_dev)
                         port_ops->init_dev(drive);
         }
+
+        ide_port_for_each_dev(i, drive, hwif) {
+                /*
+                 * default to PIO Mode 0 before we figure out
+                 * the most suited mode for the attached device
+                 */
+                if (port_ops && port_ops->set_pio_mode)
+                        port_ops->set_pio_mode(drive, 0);
+        }
 }
 
 static void ide_init_port(ide_hwif_t *hwif, unsigned int port,
diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
index afca22beaadf..3b88eba04c9c 100644
--- a/drivers/ide/sis5513.c
+++ b/drivers/ide/sis5513.c
@@ -2,7 +2,7 @@
  * Copyright (C) 1999-2000      Andre Hedrick <andre@linux-ide.org>
  * Copyright (C) 2002           Lionel Bouton <Lionel.Bouton@inet6.fr>, Maintainer
  * Copyright (C) 2003           Vojtech Pavlik <vojtech@suse.cz>
- * Copyright (C) 2007           Bartlomiej Zolnierkiewicz
+ * Copyright (C) 2007-2009      Bartlomiej Zolnierkiewicz
  *
  * May be copied or modified under the terms of the GNU General Public License
  *
@@ -281,11 +281,13 @@ static void config_drive_art_rwp(ide_drive_t *drive)
 
         pci_read_config_byte(dev, 0x4b, &reg4bh);
 
+        rw_prefetch = reg4bh & ~(0x11 << drive->dn);
+
         if (drive->media == ide_disk)
-                rw_prefetch = 0x11 << drive->dn;
+                rw_prefetch |= 0x11 << drive->dn;
 
-        if ((reg4bh & (0x11 << drive->dn)) != rw_prefetch)
-                pci_write_config_byte(dev, 0x4b, reg4bh|rw_prefetch);
+        if (reg4bh != rw_prefetch)
+                pci_write_config_byte(dev, 0x4b, rw_prefetch);
 }
 
 static void sis_set_pio_mode(ide_drive_t *drive, const u8 pio)
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 2d8352419c0d..65bf91e16a42 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -603,7 +603,7 @@ static void capi_recv_message(struct capi20_appl *ap, struct sk_buff *skb)
 
         if (CAPIMSG_CMD(skb->data) == CAPI_CONNECT_B3_CONF) {
                 u16 info = CAPIMSG_U16(skb->data, 12); // Info field
-                if (info == 0) {
+                if ((info & 0xff00) == 0) {
                         mutex_lock(&cdev->ncci_list_mtx);
                         capincci_alloc(cdev, CAPIMSG_NCCI(skb->data));
                         mutex_unlock(&cdev->ncci_list_mtx);
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 650120261abf..3e6d17f42a98 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -40,7 +40,7 @@ static int debugmode = 0;
 MODULE_DESCRIPTION("CAPI4Linux: Interface to ISDN4Linux");
 MODULE_AUTHOR("Carsten Paeth");
 MODULE_LICENSE("GPL");
-module_param(debugmode, uint, 0);
+module_param(debugmode, uint, S_IRUGO|S_IWUSR);
 
 /* -------- type definitions ----------------------------------------- */
 
@@ -671,8 +671,8 @@ static void n0(capidrv_contr * card, capidrv_ncci * ncci)
                                  NULL,  /* Useruserdata */   /* $$$$ */
                                  NULL   /* Facilitydataarray */
         );
-        send_message(card, &cmsg);
         plci_change_state(card, ncci->plcip, EV_PLCI_DISCONNECT_REQ);
+        send_message(card, &cmsg);
 
         cmd.command = ISDN_STAT_BHUP;
         cmd.driver = card->myid;
@@ -924,8 +924,8 @@ static void handle_incoming_call(capidrv_contr * card, _cmsg * cmsg)
                  */
                 capi_cmsg_answer(cmsg);
                 cmsg->Reject = 1;       /* ignore */
-                send_message(card, cmsg);
                 plci_change_state(card, plcip, EV_PLCI_CONNECT_REJECT);
+                send_message(card, cmsg);
                 printk(KERN_INFO "capidrv-%d: incoming call %s,%d,%d,%s ignored\n",
                         card->contrnr,
                         cmd.parm.setup.phone,
@@ -974,8 +974,8 @@ static void handle_incoming_call(capidrv_contr * card, _cmsg * cmsg)
         case 2:         /* Call will be rejected. */
                 capi_cmsg_answer(cmsg);
                 cmsg->Reject = 2;       /* reject call, normal call clearing */
-                send_message(card, cmsg);
                 plci_change_state(card, plcip, EV_PLCI_CONNECT_REJECT);
+                send_message(card, cmsg);
                 break;
 
         default:
@@ -983,8 +983,8 @@ static void handle_incoming_call(capidrv_contr * card, _cmsg * cmsg)
                 capi_cmsg_answer(cmsg);
                 cmsg->Reject = 8;       /* reject call,
                                            destination out of order */
-                send_message(card, cmsg);
                 plci_change_state(card, plcip, EV_PLCI_CONNECT_REJECT);
+                send_message(card, cmsg);
                 break;
         }
         return;
@@ -1020,8 +1020,8 @@ static void handle_plci(_cmsg * cmsg)
                 card->bchans[plcip->chan].disconnecting = 1;
                 plci_change_state(card, plcip, EV_PLCI_DISCONNECT_IND);
                 capi_cmsg_answer(cmsg);
-                send_message(card, cmsg);
                 plci_change_state(card, plcip, EV_PLCI_DISCONNECT_RESP);
+                send_message(card, cmsg);
                 break;
 
         case CAPI_DISCONNECT_CONF:      /* plci */
@@ -1078,8 +1078,8 @@ static void handle_plci(_cmsg * cmsg)
 
                 if (card->bchans[plcip->chan].incoming) {
                         capi_cmsg_answer(cmsg);
-                        send_message(card, cmsg);
                         plci_change_state(card, plcip, EV_PLCI_CONNECT_ACTIVE_IND);
+                        send_message(card, cmsg);
                 } else {
                         capidrv_ncci *nccip;
                         capi_cmsg_answer(cmsg);
@@ -1098,13 +1098,14 @@ static void handle_plci(_cmsg * cmsg)
                                                  NULL   /* NCPI */
                         );
                         nccip->msgid = cmsg->Messagenumber;
+                        plci_change_state(card, plcip,
+                                          EV_PLCI_CONNECT_ACTIVE_IND);
+                        ncci_change_state(card, nccip, EV_NCCI_CONNECT_B3_REQ);
                         send_message(card, cmsg);
                         cmd.command = ISDN_STAT_DCONN;
                         cmd.driver = card->myid;
                         cmd.arg = plcip->chan;
                         card->interface.statcallb(&cmd);
-                        plci_change_state(card, plcip, EV_PLCI_CONNECT_ACTIVE_IND);
-                        ncci_change_state(card, nccip, EV_NCCI_CONNECT_B3_REQ);
                 }
                 break;
 
@@ -1193,8 +1194,8 @@ static void handle_ncci(_cmsg * cmsg)
                         goto notfound;
 
                 capi_cmsg_answer(cmsg);
-                send_message(card, cmsg);
                 ncci_change_state(card, nccip, EV_NCCI_CONNECT_B3_ACTIVE_IND);
+                send_message(card, cmsg);
 
                 cmd.command = ISDN_STAT_BCONN;
                 cmd.driver = card->myid;
@@ -1222,8 +1223,8 @@ static void handle_ncci(_cmsg * cmsg)
                                                           0,    /* Reject */
                                                           NULL  /* NCPI */
                                 );
-                                send_message(card, cmsg);
                                 ncci_change_state(card, nccip, EV_NCCI_CONNECT_B3_RESP);
+                                send_message(card, cmsg);
                                 break;
                         }
                         printk(KERN_ERR "capidrv-%d: no mem for ncci, sorry\n",                                                 card->contrnr);
@@ -1299,8 +1300,8 @@ static void handle_ncci(_cmsg * cmsg)
                 card->bchans[nccip->chan].disconnecting = 1;
                 ncci_change_state(card, nccip, EV_NCCI_DISCONNECT_B3_IND);
                 capi_cmsg_answer(cmsg);
-                send_message(card, cmsg);
                 ncci_change_state(card, nccip, EV_NCCI_DISCONNECT_B3_RESP);
+                send_message(card, cmsg);
                 break;
 
         case CAPI_DISCONNECT_B3_CONF:   /* ncci */
@@ -2014,8 +2015,8 @@ static void send_listen(capidrv_contr *card)
                              card->cipmask,
                              card->cipmask2,
                              NULL, NULL);
-        send_message(card, &cmdcmsg);
         listen_change_state(card, EV_LISTEN_REQ);
+        send_message(card, &cmdcmsg);
 }
 
 static void listentimerfunc(unsigned long x)
diff --git a/drivers/isdn/gigaset/asyncdata.c b/drivers/isdn/gigaset/asyncdata.c
index 234cc5d53312..44a58e6f8f65 100644
--- a/drivers/isdn/gigaset/asyncdata.c
+++ b/drivers/isdn/gigaset/asyncdata.c
@@ -334,7 +334,14 @@ static inline int iraw_loop(unsigned char c, unsigned char *src, int numbytes,
         return startbytes - numbytes;
 }
 
-/* process a block of data received from the device
+/**
+ * gigaset_m10x_input() - process a block of data received from the device
+ * @inbuf:      received data and device descriptor structure.
+ *
+ * Called by hardware module {ser,usb}_gigaset with a block of received
+ * bytes. Separates the bytes received over the serial data channel into
+ * user data and command replies (locked/unlocked) according to the
+ * current state of the interface.
  */
 void gigaset_m10x_input(struct inbuf_t *inbuf)
 {
@@ -543,16 +550,17 @@ static struct sk_buff *iraw_encode(struct sk_buff *skb, int head, int tail)
         return iraw_skb;
 }
 
-/* gigaset_send_skb
- * called by common.c to queue an skb for sending
- * and start transmission if necessary
- * parameters:
- *      B Channel control structure
- *      skb
+/**
+ * gigaset_m10x_send_skb() - queue an skb for sending
+ * @bcs:        B channel descriptor structure.
+ * @skb:        data to send.
+ *
+ * Called by i4l.c to encode and queue an skb for sending, and start
+ * transmission if necessary.
+ *
  * Return value:
- *      number of bytes accepted for sending
- *      (skb->len if ok, 0 if out of buffer space)
- *      or error code (< 0, eg. -EINVAL)
+ *      number of bytes accepted for sending (skb->len) if ok,
+ *      error code < 0 (eg. -ENOMEM) on error
  */
 int gigaset_m10x_send_skb(struct bc_state *bcs, struct sk_buff *skb)
 {
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 781c4041f7b0..5ed1d99eb9f3 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -134,6 +134,7 @@ struct bas_cardstate {
 #define BS_ATRDPEND     0x040   /* urb_cmd_in in use */
 #define BS_ATWRPEND     0x080   /* urb_cmd_out in use */
 #define BS_SUSPEND      0x100   /* USB port suspended */
+#define BS_RESETTING    0x200   /* waiting for HD_RESET_INTERRUPT_PIPE_ACK */
 
 
 static struct gigaset_driver *driver = NULL;
@@ -319,6 +320,21 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
         return -EINVAL;
 }
 
+/* set/clear bits in base connection state, return previous state
+ */
+static inline int update_basstate(struct bas_cardstate *ucs,
+                                  int set, int clear)
+{
+        unsigned long flags;
+        int state;
+
+        spin_lock_irqsave(&ucs->lock, flags);
+        state = ucs->basstate;
+        ucs->basstate = (state & ~clear) | set;
+        spin_unlock_irqrestore(&ucs->lock, flags);
+        return state;
+}
+
 /* error_hangup
  * hang up any existing connection because of an unrecoverable error
  * This function may be called from any context and takes care of scheduling
@@ -350,12 +366,9 @@ static inline void error_hangup(struct bc_state *bcs)
  */
 static inline void error_reset(struct cardstate *cs)
 {
-        /* close AT command channel to recover (ignore errors) */
-        req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
-
-        //FIXME try to recover without bothering the user
-        dev_err(cs->dev,
-            "unrecoverable error - please disconnect Gigaset base to reset\n");
+        /* reset interrupt pipe to recover (ignore errors) */
+        update_basstate(cs->hw.bas, BS_RESETTING, 0);
+        req_submit(cs->bcs, HD_RESET_INTERRUPT_PIPE, 0, BAS_TIMEOUT);
 }
 
 /* check_pending
@@ -398,8 +411,13 @@ static void check_pending(struct bas_cardstate *ucs)
         case HD_DEVICE_INIT_ACK:                /* no reply expected */
                 ucs->pending = 0;
                 break;
-        /* HD_READ_ATMESSAGE, HD_WRITE_ATMESSAGE, HD_RESET_INTERRUPTPIPE
-         * are handled separately and should never end up here
+        case HD_RESET_INTERRUPT_PIPE:
+                if (!(ucs->basstate & BS_RESETTING))
+                        ucs->pending = 0;
+                break;
+        /*
+         * HD_READ_ATMESSAGE and HD_WRITE_ATMESSAGE are handled separately
+         * and should never end up here
          */
         default:
                 dev_warn(&ucs->interface->dev,
@@ -449,21 +467,6 @@ static void cmd_in_timeout(unsigned long data)
         error_reset(cs);
 }
 
-/* set/clear bits in base connection state, return previous state
- */
-inline static int update_basstate(struct bas_cardstate *ucs,
-                                  int set, int clear)
-{
-        unsigned long flags;
-        int state;
-
-        spin_lock_irqsave(&ucs->lock, flags);
-        state = ucs->basstate;
-        ucs->basstate = (state & ~clear) | set;
-        spin_unlock_irqrestore(&ucs->lock, flags);
-        return state;
-}
-
 /* read_ctrl_callback
  * USB completion handler for control pipe input
  * called by the USB subsystem in interrupt context
@@ -762,7 +765,8 @@ static void read_int_callback(struct urb *urb)
                 break;
 
         case HD_RESET_INTERRUPT_PIPE_ACK:
-                gig_dbg(DEBUG_USBREQ, "HD_RESET_INTERRUPT_PIPE_ACK");
+                update_basstate(ucs, 0, BS_RESETTING);
+                dev_notice(cs->dev, "interrupt pipe reset\n");
                 break;
 
         case HD_SUSPEND_END:
@@ -1331,28 +1335,24 @@ static void read_iso_tasklet(unsigned long data)
                 rcvbuf = urb->transfer_buffer;
                 totleft = urb->actual_length;
                 for (frame = 0; totleft > 0 && frame < BAS_NUMFRAMES; frame++) {
-                        if (unlikely(urb->iso_frame_desc[frame].status)) {
+                        numbytes = urb->iso_frame_desc[frame].actual_length;
+                        if (unlikely(urb->iso_frame_desc[frame].status))
                                 dev_warn(cs->dev,
-                                         "isochronous read: frame %d: %s\n",
-                                         frame,
+                                         "isochronous read: frame %d[%d]: %s\n",
+                                         frame, numbytes,
                                          get_usb_statmsg(
                                             urb->iso_frame_desc[frame].status));
-                                break;
-                        }
-                        numbytes = urb->iso_frame_desc[frame].actual_length;
-                        if (unlikely(numbytes > BAS_MAXFRAME)) {
+                        if (unlikely(numbytes > BAS_MAXFRAME))
                                 dev_warn(cs->dev,
                                          "isochronous read: frame %d: "
                                          "numbytes (%d) > BAS_MAXFRAME\n",
                                          frame, numbytes);
-                                break;
-                        }
                         if (unlikely(numbytes > totleft)) {
                                 dev_warn(cs->dev,
                                          "isochronous read: frame %d: "
                                          "numbytes (%d) > totleft (%d)\n",
                                          frame, numbytes, totleft);
-                                break;
+                                numbytes = totleft;
                         }
                         offset = urb->iso_frame_desc[frame].offset;
                         if (unlikely(offset + numbytes > BAS_INBUFSIZE)) {
@@ -1361,7 +1361,7 @@ static void read_iso_tasklet(unsigned long data)
                                          "offset (%d) + numbytes (%d) "
                                          "> BAS_INBUFSIZE\n",
                                          frame, offset, numbytes);
-                                break;
+                                numbytes = BAS_INBUFSIZE - offset;
                         }
                         gigaset_isoc_receive(rcvbuf + offset, numbytes, bcs);
                         totleft -= numbytes;
@@ -1433,6 +1433,7 @@ static void req_timeout(unsigned long data)
 
         case HD_CLOSE_ATCHANNEL:
                 dev_err(bcs->cs->dev, "timeout closing AT channel\n");
+                error_reset(bcs->cs);
                 break;
 
         case HD_CLOSE_B2CHANNEL:
@@ -1442,6 +1443,13 @@ static void req_timeout(unsigned long data)
                 error_reset(bcs->cs);
                 break;
 
+        case HD_RESET_INTERRUPT_PIPE:
+                /* error recovery escalation */
+                dev_err(bcs->cs->dev,
+                        "reset interrupt pipe timeout, attempting USB reset\n");
+                usb_queue_reset_device(bcs->cs->hw.bas->interface);
+                break;
+
         default:
                 dev_warn(bcs->cs->dev, "request 0x%02x timed out, clearing\n",
                          pending);
@@ -1934,6 +1942,15 @@ static int gigaset_write_cmd(struct cardstate *cs,
                 goto notqueued;
         }
 
+        /* translate "+++" escape sequence sent as a single separate command
+         * into "close AT channel" command for error recovery
+         * The next command will reopen the AT channel automatically.
+         */
+        if (len == 3 && !memcmp(buf, "+++", 3)) {
+                rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
+                goto notqueued;
+        }
+
         if (len > IF_WRITEBUF)
                 len = IF_WRITEBUF;
         if (!(cb = kmalloc(sizeof(struct cmdbuf_t) + len, GFP_ATOMIC))) {
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index e4141bf8b2f3..33dcd8d72b7c 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -22,6 +22,12 @@
 #define DRIVER_AUTHOR "Hansjoerg Lipp <hjlipp@web.de>, Tilman Schmidt <tilman@imap.cc>, Stefan Eilers"
 #define DRIVER_DESC "Driver for Gigaset 307x"
 
+#ifdef CONFIG_GIGASET_DEBUG
+#define DRIVER_DESC_DEBUG " (debug build)"
+#else
+#define DRIVER_DESC_DEBUG ""
+#endif
+
 /* Module parameters */
 int gigaset_debuglevel = DEBUG_DEFAULT;
 EXPORT_SYMBOL_GPL(gigaset_debuglevel);
@@ -32,6 +38,17 @@ MODULE_PARM_DESC(debug, "debug level");
 #define VALID_MINOR     0x01
 #define VALID_ID        0x02
 
+/**
+ * gigaset_dbg_buffer() - dump data in ASCII and hex for debugging
+ * @level:      debugging level.
+ * @msg:        message prefix.
+ * @len:        number of bytes to dump.
+ * @buf:        data to dump.
+ *
+ * If the current debugging level includes one of the bits set in @level,
+ * @len bytes starting at @buf are logged to dmesg at KERN_DEBUG prio,
+ * prefixed by the text @msg.
+ */
 void gigaset_dbg_buffer(enum debuglevel level, const unsigned char *msg,
                         size_t len, const unsigned char *buf)
 {
@@ -274,6 +291,20 @@ static void clear_events(struct cardstate *cs)
         spin_unlock_irqrestore(&cs->ev_lock, flags);
 }
 
+/**
+ * gigaset_add_event() - add event to device event queue
+ * @cs:         device descriptor structure.
+ * @at_state:   connection state structure.
+ * @type:       event type.
+ * @ptr:        pointer parameter for event.
+ * @parameter:  integer parameter for event.
+ * @arg:        pointer parameter for event.
+ *
+ * Allocate an event queue entry from the device's event queue, and set it up
+ * with the parameters given.
+ *
+ * Return value: added event
+ */
 struct event_t *gigaset_add_event(struct cardstate *cs,
                                   struct at_state_t *at_state, int type,
                                   void *ptr, int parameter, void *arg)
@@ -398,6 +429,15 @@ static void make_invalid(struct cardstate *cs, unsigned mask)
         spin_unlock_irqrestore(&drv->lock, flags);
 }
 
+/**
+ * gigaset_freecs() - free all associated ressources of a device
+ * @cs:         device descriptor structure.
+ *
+ * Stops all tasklets and timers, unregisters the device from all
+ * subsystems it was registered to, deallocates the device structure
+ * @cs and all structures referenced from it.
+ * Operations on the device should be stopped before calling this.
+ */
 void gigaset_freecs(struct cardstate *cs)
 {
         int i;
@@ -506,7 +546,12 @@ static void gigaset_inbuf_init(struct inbuf_t *inbuf, struct bc_state *bcs,
         inbuf->inputstate = inputstate;
 }
 
-/* append received bytes to inbuf */
+/**
+ * gigaset_fill_inbuf() - append received data to input buffer
+ * @inbuf:      buffer structure.
+ * @src:        received data.
+ * @numbytes:   number of bytes received.
+ */
 int gigaset_fill_inbuf(struct inbuf_t *inbuf, const unsigned char *src,
                        unsigned numbytes)
 {
@@ -606,20 +651,22 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         return NULL;
 }
 
-/* gigaset_initcs
+/**
+ * gigaset_initcs() - initialize device structure
+ * @drv:        hardware driver the device belongs to
+ * @channels:   number of B channels supported by device
+ * @onechannel: !=0 if B channel data and AT commands share one
+ *                  communication channel (M10x),
+ *              ==0 if B channels have separate communication channels (base)
+ * @ignoreframes:       number of frames to ignore after setting up B channel
+ * @cidmode:    !=0: start in CallID mode
+ * @modulename: name of driver module for LL registration
+ *
  * Allocate and initialize cardstate structure for Gigaset driver
  * Calls hardware dependent gigaset_initcshw() function
  * Calls B channel initialization function gigaset_initbcs() for each B channel
- * parameters:
- *      drv             hardware driver the device belongs to
- *      channels        number of B channels supported by device
- *      onechannel      !=0: B channel data and AT commands share one
- *                           communication channel
- *                      ==0: B channels have separate communication channels
- *      ignoreframes    number of frames to ignore after setting up B channel
- *      cidmode         !=0: start in CallID mode
- *      modulename      name of driver module (used for I4L registration)
- * return value:
+ *
+ * Return value:
  *      pointer to cardstate structure
  */
 struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
@@ -837,6 +884,17 @@ static void cleanup_cs(struct cardstate *cs)
 }
 
 
+/**
+ * gigaset_start() - start device operations
+ * @cs:         device descriptor structure.
+ *
+ * Prepares the device for use by setting up communication parameters,
+ * scheduling an EV_START event to initiate device initialization, and
+ * waiting for completion of the initialization.
+ *
+ * Return value:
+ *      1 - success, 0 - error
+ */
 int gigaset_start(struct cardstate *cs)
 {
         unsigned long flags;
@@ -879,9 +937,15 @@ error:
 }
 EXPORT_SYMBOL_GPL(gigaset_start);
 
-/* gigaset_shutdown
- * check if a device is associated to the cardstate structure and stop it
- * return value: 0 if ok, -1 if no device was associated
+/**
+ * gigaset_shutdown() - shut down device operations
+ * @cs:         device descriptor structure.
+ *
+ * Deactivates the device by scheduling an EV_SHUTDOWN event and
+ * waiting for completion of the shutdown.
+ *
+ * Return value:
+ *      0 - success, -1 - error (no device associated)
  */
 int gigaset_shutdown(struct cardstate *cs)
 {
@@ -912,6 +976,13 @@ exit:
 }
 EXPORT_SYMBOL_GPL(gigaset_shutdown);
 
+/**
+ * gigaset_stop() - stop device operations
+ * @cs:         device descriptor structure.
+ *
+ * Stops operations on the device by scheduling an EV_STOP event and
+ * waiting for completion of the shutdown.
+ */
 void gigaset_stop(struct cardstate *cs)
 {
         mutex_lock(&cs->mutex);
@@ -1020,6 +1091,14 @@ struct cardstate *gigaset_get_cs_by_tty(struct tty_struct *tty)
         return gigaset_get_cs_by_minor(tty->index + tty->driver->minor_start);
 }
 
+/**
+ * gigaset_freedriver() - free all associated ressources of a driver
+ * @drv:        driver descriptor structure.
+ *
+ * Unregisters the driver from the system and deallocates the driver
+ * structure @drv and all structures referenced from it.
+ * All devices should be shut down before calling this.
+ */
 void gigaset_freedriver(struct gigaset_driver *drv)
 {
         unsigned long flags;
@@ -1035,14 +1114,16 @@ void gigaset_freedriver(struct gigaset_driver *drv)
 }
 EXPORT_SYMBOL_GPL(gigaset_freedriver);
 
-/* gigaset_initdriver
+/**
+ * gigaset_initdriver() - initialize driver structure
+ * @minor:      First minor number
+ * @minors:     Number of minors this driver can handle
+ * @procname:   Name of the driver
+ * @devname:    Name of the device files (prefix without minor number)
+ *
  * Allocate and initialize gigaset_driver structure. Initialize interface.
- * parameters:
- *      minor           First minor number
- *      minors          Number of minors this driver can handle
- *      procname        Name of the driver
- *      devname         Name of the device files (prefix without minor number)
- * return value:
+ *
+ * Return value:
  *      Pointer to the gigaset_driver structure on success, NULL on failure.
  */
 struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
@@ -1095,6 +1176,13 @@ error:
 }
 EXPORT_SYMBOL_GPL(gigaset_initdriver);
 
+/**
+ * gigaset_blockdriver() - block driver
+ * @drv:        driver descriptor structure.
+ *
+ * Prevents the driver from attaching new devices, in preparation for
+ * deregistration.
+ */
 void gigaset_blockdriver(struct gigaset_driver *drv)
 {
         drv->blocked = 1;
@@ -1110,7 +1198,7 @@ static int __init gigaset_init_module(void)
         if (gigaset_debuglevel == 1)
                 gigaset_debuglevel = DEBUG_DEFAULT;
 
-        pr_info(DRIVER_DESC "\n");
+        pr_info(DRIVER_DESC DRIVER_DESC_DEBUG "\n");
         return 0;
 }
 
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 2d91049571a4..cc768caa38f5 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -207,7 +207,6 @@ struct reply_t gigaset_tab_nocid[] =
         /* leave dle mode */
         {RSP_INIT,      0,  0,SEQ_DLE0,           201, 5, {0},             "^SDLE=0\r"},
         {RSP_OK,      201,201, -1,                202,-1},
-        //{RSP_ZDLE,    202,202,  0,                202, 0, {ACT_ERROR}},//DELETE
         {RSP_ZDLE,    202,202,  0,                  0, 0, {ACT_DLE0}},
         {RSP_NODEV,   200,249, -1,                  0, 0, {ACT_FAKEDLE0}},
         {RSP_ERROR,   200,249, -1,                  0, 0, {ACT_FAILDLE0}},
@@ -265,6 +264,7 @@ struct reply_t gigaset_tab_nocid[] =
         {EV_SHUTDOWN,  -1, -1, -1,                 -1,-1, {ACT_SHUTDOWN}}, //FIXME
 
         /* misc. */
+        {RSP_ERROR,    -1, -1, -1,                 -1, -1, {ACT_ERROR} },
         {RSP_EMPTY,    -1, -1, -1,                 -1,-1, {ACT_DEBUG}}, //FIXME
         {RSP_ZCFGT,    -1, -1, -1,                 -1,-1, {ACT_DEBUG}}, //FIXME
         {RSP_ZCFG,     -1, -1, -1,                 -1,-1, {ACT_DEBUG}}, //FIXME
@@ -328,10 +328,9 @@ struct reply_t gigaset_tab_cid[] =
         {RSP_INIT,     -1, -1,SEQ_HUP,            401, 5, {0},             "+VLS=0\r"}, /* hang up */ //-1,-1?
         {RSP_OK,      401,401, -1,                402, 5},
         {RSP_ZVLS,    402,402,  0,                403, 5},
-        {RSP_ZSAU,    403,403,ZSAU_DISCONNECT_REQ, -1,-1, {ACT_DEBUG}}, /* if not remote hup */
-        //{RSP_ZSAU,    403,403,ZSAU_NULL,          401, 0, {ACT_ERROR}}, //DELETE//FIXME -> DLE0 // should we do this _before_ hanging up for base driver?
-        {RSP_ZSAU,    403,403,ZSAU_NULL,            0, 0, {ACT_DISCONNECT}}, //FIXME -> DLE0 // should we do this _before_ hanging up for base driver?
-        {RSP_NODEV,   401,403, -1,                  0, 0, {ACT_FAKEHUP}}, //FIXME -> DLE0 // should we do this _before_ hanging up for base driver?
+        {RSP_ZSAU,    403, 403, ZSAU_DISCONNECT_REQ, -1, -1, {ACT_DEBUG} },
+        {RSP_ZSAU,    403, 403, ZSAU_NULL,            0,  0, {ACT_DISCONNECT} },
+        {RSP_NODEV,   401, 403, -1,                   0,  0, {ACT_FAKEHUP} },
         {RSP_ERROR,   401,401, -1,                  0, 0, {ACT_ABORTHUP}},
         {EV_TIMEOUT,  401,403, -1,                  0, 0, {ACT_ABORTHUP}},
 
@@ -474,8 +473,13 @@ static int cid_of_response(char *s)
         //FIXME is ;<digit>+ at end of non-CID response really impossible?
 }
 
-/* This function will be called via task queue from the callback handler.
- * We received a modem response and have to handle it..
+/**
+ * gigaset_handle_modem_response() - process received modem response
+ * @cs:         device descriptor structure.
+ *
+ * Called by asyncdata/isocdata if a block of data received from the
+ * device must be processed as a modem command response. The data is
+ * already in the cs structure.
  */
 void gigaset_handle_modem_response(struct cardstate *cs)
 {
@@ -707,6 +711,11 @@ static void disconnect(struct at_state_t **at_state_p)
         if (bcs) {
                 /* B channel assigned: invoke hardware specific handler */
                 cs->ops->close_bchannel(bcs);
+                /* notify LL */
+                if (bcs->chstate & (CHS_D_UP | CHS_NOTIFY_LL)) {
+                        bcs->chstate &= ~(CHS_D_UP | CHS_NOTIFY_LL);
+                        gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DHUP);
+                }
         } else {
                 /* no B channel assigned: just deallocate */
                 spin_lock_irqsave(&cs->lock, flags);
@@ -1429,11 +1438,12 @@ static void do_action(int action, struct cardstate *cs,
                 cs->gotfwver = -1;
                 dev_err(cs->dev, "could not read firmware version.\n");
                 break;
-#ifdef CONFIG_GIGASET_DEBUG
         case ACT_ERROR:
-                *p_genresp = 1;
-                *p_resp_code = RSP_ERROR;
+                gig_dbg(DEBUG_ANY, "%s: ERROR response in ConState %d",
+                        __func__, at_state->ConState);
+                cs->cur_at_seq = SEQ_NONE;
                 break;
+#ifdef CONFIG_GIGASET_DEBUG
         case ACT_TEST:
                 {
                         static int count = 3; //2; //1;
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 9b22f9cf2f33..654489d836cd 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -51,6 +51,12 @@ static int writebuf_from_LL(int driverID, int channel, int ack,
                 return -ENODEV;
         }
         bcs = &cs->bcs[channel];
+
+        /* can only handle linear sk_buffs */
+        if (skb_linearize(skb) < 0) {
+                dev_err(cs->dev, "%s: skb_linearize failed\n", __func__);
+                return -ENOMEM;
+        }
         len = skb->len;
 
         gig_dbg(DEBUG_LLDATA,
@@ -79,6 +85,14 @@ static int writebuf_from_LL(int driverID, int channel, int ack,
         return cs->ops->send_skb(bcs, skb);
 }
 
+/**
+ * gigaset_skb_sent() - acknowledge sending an skb
+ * @bcs:        B channel descriptor structure.
+ * @skb:        sent data.
+ *
+ * Called by hardware module {bas,ser,usb}_gigaset when the data in a
+ * skb has been successfully sent, for signalling completion to the LL.
+ */
 void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb)
 {
         unsigned len;
@@ -455,6 +469,15 @@ int gigaset_isdn_setup_accept(struct at_state_t *at_state)
         return 0;
 }
 
+/**
+ * gigaset_isdn_icall() - signal incoming call
+ * @at_state:   connection state structure.
+ *
+ * Called by main module to notify the LL that an incoming call has been
+ * received. @at_state contains the parameters of the call.
+ *
+ * Return value: call disposition (ICALL_*)
+ */
 int gigaset_isdn_icall(struct at_state_t *at_state)
 {
         struct cardstate *cs = at_state->cs;
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index f33ac27de643..6a8e1384e7bd 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -616,6 +616,15 @@ void gigaset_if_free(struct cardstate *cs)
         tty_unregister_device(drv->tty, cs->minor_index);
 }
 
+/**
+ * gigaset_if_receive() - pass a received block of data to the tty device
+ * @cs:         device descriptor structure.
+ * @buffer:     received data.
+ * @len:        number of bytes received.
+ *
+ * Called by asyncdata/isocdata if a block of data received from the
+ * device must be sent to userspace through the ttyG* device.
+ */
 void gigaset_if_receive(struct cardstate *cs,
                         unsigned char *buffer, size_t len)
 {
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index bed38fcc432b..9f3ef7b4248c 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -429,7 +429,7 @@ static inline int hdlc_buildframe(struct isowbuf_t *iwb,
                 return -EAGAIN;
         }
 
-        dump_bytes(DEBUG_STREAM, "snd data", in, count);
+        dump_bytes(DEBUG_STREAM_DUMP, "snd data", in, count);
 
         /* bitstuff and checksum input data */
         fcs = PPP_INITFCS;
@@ -448,7 +448,6 @@ static inline int hdlc_buildframe(struct isowbuf_t *iwb,
         /* put closing flag and repeat byte for flag idle */
         isowbuf_putflag(iwb);
         end = isowbuf_donewrite(iwb);
-        dump_bytes(DEBUG_STREAM_DUMP, "isowbuf", iwb->data, end + 1);
         return end;
 }
 
@@ -482,6 +481,8 @@ static inline int trans_buildframe(struct isowbuf_t *iwb,
         }
 
         gig_dbg(DEBUG_STREAM, "put %d bytes", count);
+        dump_bytes(DEBUG_STREAM_DUMP, "snd data", in, count);
+
         write = iwb->write;
         do {
                 c = bitrev8(*in++);
@@ -583,7 +584,7 @@ static inline void hdlc_done(struct bc_state *bcs)
                 procskb->tail -= 2;
                 gig_dbg(DEBUG_ISO, "%s: good frame (%d octets)",
                         __func__, procskb->len);
-                dump_bytes(DEBUG_STREAM,
+                dump_bytes(DEBUG_STREAM_DUMP,
                            "rcv data", procskb->data, procskb->len);
                 bcs->hw.bas->goodbytes += procskb->len;
                 gigaset_rcv_skb(procskb, bcs->cs, bcs);
@@ -878,6 +879,8 @@ static inline void trans_receive(unsigned char *src, unsigned count,
                         dobytes--;
                 }
                 if (dobytes == 0) {
+                        dump_bytes(DEBUG_STREAM_DUMP,
+                                   "rcv data", skb->data, skb->len);
                         gigaset_rcv_skb(skb, bcs->cs, bcs);
                         bcs->skb = skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN);
                         if (!skb) {
@@ -973,16 +976,17 @@ void gigaset_isoc_input(struct inbuf_t *inbuf)
 
 /* == data output ========================================================== */
 
-/* gigaset_send_skb
- * called by common.c to queue an skb for sending
- * and start transmission if necessary
- * parameters:
- *      B Channel control structure
- *      skb
- * return value:
- *      number of bytes accepted for sending
- *      (skb->len if ok, 0 if out of buffer space)
- *      or error code (< 0, eg. -EINVAL)
+/**
+ * gigaset_isoc_send_skb() - queue an skb for sending
+ * @bcs:        B channel descriptor structure.
+ * @skb:        data to send.
+ *
+ * Called by i4l.c to queue an skb for sending, and start transmission if
+ * necessary.
+ *
+ * Return value:
+ *      number of bytes accepted for sending (skb->len) if ok,
+ *      error code < 0 (eg. -ENODEV) on error
  */
 int gigaset_isoc_send_skb(struct bc_state *bcs, struct sk_buff *skb)
 {
diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
index e1035c895808..f85dcd536508 100644
--- a/drivers/mmc/core/sdio_cis.c
+++ b/drivers/mmc/core/sdio_cis.c
@@ -29,6 +29,8 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
         unsigned i, nr_strings;
         char **buffer, *string;
 
+        /* Find all null-terminated (including zero length) strings in
+           the TPLLV1_INFO field. Trailing garbage is ignored. */
         buf += 2;
         size -= 2;
 
@@ -39,11 +41,8 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
                 if (buf[i] == 0)
                         nr_strings++;
         }
-
-        if (nr_strings < 4) {
-                printk(KERN_WARNING "SDIO: ignoring broken CISTPL_VERS_1\n");
+        if (nr_strings == 0)
                 return 0;
-        }
 
         size = i;
 
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index fdf5937233fc..04f63c77071d 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -721,7 +721,7 @@ static inline void update_rx_stats(struct net_device *dev, u32 status)
                 ps->rx_errors++;
                 if (status & RX_MISSED_FRAME)
                         ps->rx_missed_errors++;
-                if (status & (RX_OVERLEN | RX_OVERLEN | RX_LEN_ERROR))
+                if (status & (RX_OVERLEN | RX_RUNT | RX_LEN_ERROR))
                         ps->rx_length_errors++;
                 if (status & RX_CRC_ERROR)
                         ps->rx_crc_errors++;
@@ -794,8 +794,6 @@ static int au1000_rx(struct net_device *dev)
                                         printk("rx len error\n");
                                 if (status & RX_U_CNTRL_FRAME)
                                         printk("rx u control frame\n");
-                                if (status & RX_MISSED_FRAME)
-                                        printk("rx miss\n");
                         }
                 }
                 prxd->buff_stat = (u32)(pDB->dma_addr | RX_DMA_ENABLE);
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 79d35d122c08..89876ade5e33 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1129,7 +1129,6 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
         spin_lock_bh(&adapter->mcc_lock);
 
         wrb = wrb_from_mccq(adapter);
-        req = embedded_payload(wrb);
         sge = nonembedded_sgl(wrb);
 
         be_wrb_hdr_prepare(wrb, cmd->size, false, 1);
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index 8b4c2cb9ad62..a86f917f85f4 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -62,7 +62,7 @@ enum {
         MCC_STATUS_QUEUE_FLUSHING = 0x4,
 /* The command is completing with a DMA error */
         MCC_STATUS_DMA_FAILED = 0x5,
-        MCC_STATUS_NOT_SUPPORTED = 0x66
+        MCC_STATUS_NOT_SUPPORTED = 66
 };
 
 #define CQE_STATUS_COMPL_MASK           0xFFFF
diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
index 11445df3dbc0..cda5bf2fc50a 100644
--- a/drivers/net/benet/be_ethtool.c
+++ b/drivers/net/benet/be_ethtool.c
@@ -358,7 +358,7 @@ const struct ethtool_ops be_ethtool_ops = {
         .get_rx_csum = be_get_rx_csum,
         .set_rx_csum = be_set_rx_csum,
         .get_tx_csum = ethtool_op_get_tx_csum,
-        .set_tx_csum = ethtool_op_set_tx_csum,
+        .set_tx_csum = ethtool_op_set_tx_hw_csum,
         .get_sg = ethtool_op_get_sg,
         .set_sg = ethtool_op_set_sg,
         .get_tso = ethtool_op_get_tso,
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 2f9b50156e0c..6d5e81f7046f 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -197,7 +197,7 @@ void netdev_stats_update(struct be_adapter *adapter)
         /* no space available in linux */
         dev_stats->tx_dropped = 0;
 
-        dev_stats->multicast = port_stats->tx_multicastframes;
+        dev_stats->multicast = port_stats->rx_multicast_frames;
         dev_stats->collisions = 0;
 
         /* detailed tx_errors */
@@ -1899,8 +1899,8 @@ static void be_netdev_init(struct net_device *netdev)
         struct be_adapter *adapter = netdev_priv(netdev);
 
         netdev->features |= NETIF_F_SG | NETIF_F_HW_VLAN_RX | NETIF_F_TSO |
-                NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER | NETIF_F_IP_CSUM |
-                NETIF_F_IPV6_CSUM | NETIF_F_GRO;
+                NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER | NETIF_F_HW_CSUM |
+                NETIF_F_GRO;
 
         netdev->flags |= IFF_MULTICAST;
 
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index b53b40ba88a8..d1e0563a67df 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -1803,7 +1803,7 @@ struct e1000_info e1000_82574_info = {
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
         .pba                    = 20,
-        .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
+        .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
         .mac_ops                = &e82571_mac_ops,
         .phy_ops                = &e82_phy_ops_bm,
@@ -1820,7 +1820,7 @@ struct e1000_info e1000_82583_info = {
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
         .pba                    = 20,
-        .max_hw_frame_size      = DEFAULT_JUMBO,
+        .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
         .get_variants           = e1000_get_variants_82571,
         .mac_ops                = &e82571_mac_ops,
         .phy_ops                = &e82_phy_ops_bm,
diff --git a/drivers/net/ethoc.c b/drivers/net/ethoc.c
index b7311bc00258..34d0c69e67f7 100644
--- a/drivers/net/ethoc.c
+++ b/drivers/net/ethoc.c
@@ -19,6 +19,10 @@
 #include <linux/platform_device.h>
 #include <net/ethoc.h>
 
+static int buffer_size = 0x8000; /* 32 KBytes */
+module_param(buffer_size, int, 0);
+MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
+
 /* register offsets */
 #define MODER           0x00
 #define INT_SOURCE      0x04
@@ -167,6 +171,7 @@
  * struct ethoc - driver-private device structure
  * @iobase:     pointer to I/O memory region
  * @membase:    pointer to buffer memory region
+ * @dma_alloc:  dma allocated buffer size
  * @num_tx:     number of send buffers
  * @cur_tx:     last send buffer written
  * @dty_tx:     last buffer actually sent
@@ -185,6 +190,7 @@
 struct ethoc {
         void __iomem *iobase;
         void __iomem *membase;
+        int dma_alloc;
 
         unsigned int num_tx;
         unsigned int cur_tx;
@@ -284,7 +290,7 @@ static int ethoc_init_ring(struct ethoc *dev)
         dev->cur_rx = 0;
 
         /* setup transmission buffers */
-        bd.addr = 0;
+        bd.addr = virt_to_phys(dev->membase);
         bd.stat = TX_BD_IRQ | TX_BD_CRC;
 
         for (i = 0; i < dev->num_tx; i++) {
@@ -295,7 +301,6 @@ static int ethoc_init_ring(struct ethoc *dev)
                 bd.addr += ETHOC_BUFSIZ;
         }
 
-        bd.addr = dev->num_tx * ETHOC_BUFSIZ;
         bd.stat = RX_BD_EMPTY | RX_BD_IRQ;
 
         for (i = 0; i < dev->num_rx; i++) {
@@ -400,8 +405,12 @@ static int ethoc_rx(struct net_device *dev, int limit)
                 if (ethoc_update_rx_stats(priv, &bd) == 0) {
                         int size = bd.stat >> 16;
                         struct sk_buff *skb = netdev_alloc_skb(dev, size);
+
+                        size -= 4; /* strip the CRC */
+                        skb_reserve(skb, 2); /* align TCP/IP header */
+
                         if (likely(skb)) {
-                                void *src = priv->membase + bd.addr;
+                                void *src = phys_to_virt(bd.addr);
                                 memcpy_fromio(skb_put(skb, size), src, size);
                                 skb->protocol = eth_type_trans(skb, dev);
                                 priv->stats.rx_packets++;
@@ -653,9 +662,9 @@ static int ethoc_open(struct net_device *dev)
         if (ret)
                 return ret;
 
-        /* calculate the number of TX/RX buffers */
-        num_bd = (dev->mem_end - dev->mem_start + 1) / ETHOC_BUFSIZ;
-        priv->num_tx = min(min_tx, num_bd / 4);
+        /* calculate the number of TX/RX buffers, maximum 128 supported */
+        num_bd = min(128, (dev->mem_end - dev->mem_start + 1) / ETHOC_BUFSIZ);
+        priv->num_tx = max(min_tx, num_bd / 4);
         priv->num_rx = num_bd - priv->num_tx;
         ethoc_write(priv, TX_BD_NUM, priv->num_tx);
 
@@ -823,7 +832,7 @@ static netdev_tx_t ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
         else
                 bd.stat &= ~TX_BD_PAD;
 
-        dest = priv->membase + bd.addr;
+        dest = phys_to_virt(bd.addr);
         memcpy_toio(dest, skb->data, skb->len);
 
         bd.stat &= ~(TX_BD_STATS | TX_BD_LEN_MASK);
@@ -903,22 +912,19 @@ static int ethoc_probe(struct platform_device *pdev)
 
         /* obtain buffer memory space */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-        if (!res) {
-                dev_err(&pdev->dev, "cannot obtain memory space\n");
-                ret = -ENXIO;
-                goto free;
-        }
-
-        mem = devm_request_mem_region(&pdev->dev, res->start,
+        if (res) {
+                mem = devm_request_mem_region(&pdev->dev, res->start,
                         res->end - res->start + 1, res->name);
-        if (!mem) {
-                dev_err(&pdev->dev, "cannot request memory space\n");
-                ret = -ENXIO;
-                goto free;
+                if (!mem) {
+                        dev_err(&pdev->dev, "cannot request memory space\n");
+                        ret = -ENXIO;
+                        goto free;
+                }
+
+                netdev->mem_start = mem->start;
+                netdev->mem_end   = mem->end;
         }
 
-        netdev->mem_start = mem->start;
-        netdev->mem_end   = mem->end;
 
         /* obtain device IRQ number */
         res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
@@ -933,6 +939,7 @@ static int ethoc_probe(struct platform_device *pdev)
         /* setup driver-private data */
         priv = netdev_priv(netdev);
         priv->netdev = netdev;
+        priv->dma_alloc = 0;
 
         priv->iobase = devm_ioremap_nocache(&pdev->dev, netdev->base_addr,
                         mmio->end - mmio->start + 1);
@@ -942,12 +949,27 @@ static int ethoc_probe(struct platform_device *pdev)
                 goto error;
         }
 
-        priv->membase = devm_ioremap_nocache(&pdev->dev, netdev->mem_start,
-                        mem->end - mem->start + 1);
-        if (!priv->membase) {
-                dev_err(&pdev->dev, "cannot remap memory space\n");
-                ret = -ENXIO;
-                goto error;
+        if (netdev->mem_end) {
+                priv->membase = devm_ioremap_nocache(&pdev->dev,
+                        netdev->mem_start, mem->end - mem->start + 1);
+                if (!priv->membase) {
+                        dev_err(&pdev->dev, "cannot remap memory space\n");
+                        ret = -ENXIO;
+                        goto error;
+                }
+        } else {
+                /* Allocate buffer memory */
+                priv->membase = dma_alloc_coherent(NULL,
+                        buffer_size, (void *)&netdev->mem_start,
+                        GFP_KERNEL);
+                if (!priv->membase) {
+                        dev_err(&pdev->dev, "cannot allocate %dB buffer\n",
+                                buffer_size);
+                        ret = -ENOMEM;
+                        goto error;
+                }
+                netdev->mem_end = netdev->mem_start + buffer_size;
+                priv->dma_alloc = buffer_size;
         }
 
         /* Allow the platform setup code to pass in a MAC address. */
@@ -1034,6 +1056,9 @@ free_mdio:
         kfree(priv->mdio->irq);
         mdiobus_free(priv->mdio);
 free:
+        if (priv->dma_alloc)
+                dma_free_coherent(NULL, priv->dma_alloc, priv->membase,
+                        netdev->mem_start);
         free_netdev(netdev);
 out:
         return ret;
@@ -1059,7 +1084,9 @@ static int ethoc_remove(struct platform_device *pdev)
                         kfree(priv->mdio->irq);
                         mdiobus_free(priv->mdio);
                 }
-
+                if (priv->dma_alloc)
+                        dma_free_coherent(NULL, priv->dma_alloc, priv->membase,
+                                netdev->mem_start);
                 unregister_netdev(netdev);
                 free_netdev(netdev);
         }
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 2ec58dcdb82b..34b04924c8a1 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -330,6 +330,8 @@ static enum ixgbe_media_type ixgbe_get_media_type_82599(struct ixgbe_hw *hw)
 
         switch (hw->device_id) {
         case IXGBE_DEV_ID_82599_KX4:
+        case IXGBE_DEV_ID_82599_KX4_MEZZ:
+        case IXGBE_DEV_ID_82599_COMBO_BACKPLANE:
         case IXGBE_DEV_ID_82599_XAUI_LOM:
                 /* Default device ID is mezzanine card KX/KX4 */
                 media_type = ixgbe_media_type_backplane;
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 28fbb9d281f9..cbb143ca1eb8 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -97,8 +97,12 @@ static struct pci_device_id ixgbe_pci_tbl[] = {
          board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_SFP),
          board_82599 },
+        {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_KX4_MEZZ),
+         board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_CX4),
          board_82599 },
+        {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_COMBO_BACKPLANE),
+         board_82599 },
 
         /* required last entry */
         {0, }
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 7c93e923bf2e..ef4bdd58e016 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -49,9 +49,11 @@
 #define IXGBE_DEV_ID_82598_SR_DUAL_PORT_EM      0x10E1
 #define IXGBE_DEV_ID_82598EB_XF_LR       0x10F4
 #define IXGBE_DEV_ID_82599_KX4           0x10F7
+#define IXGBE_DEV_ID_82599_KX4_MEZZ      0x1514
 #define IXGBE_DEV_ID_82599_CX4           0x10F9
 #define IXGBE_DEV_ID_82599_SFP           0x10FB
 #define IXGBE_DEV_ID_82599_XAUI_LOM      0x10FC
+#define IXGBE_DEV_ID_82599_COMBO_BACKPLANE 0x10F8
 
 /* General Registers */
 #define IXGBE_CTRL      0x00000
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index b5aa974827e5..9b9eab107704 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1714,7 +1714,7 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         /* 4 fragments per cmd des */
         no_of_desc = (frag_count + 3) >> 2;
 
-        if (unlikely(no_of_desc + 2) > netxen_tx_avail(tx_ring)) {
+        if (unlikely(no_of_desc + 2 > netxen_tx_avail(tx_ring))) {
                 netif_stop_queue(netdev);
                 return NETDEV_TX_BUSY;
         }
diff --git a/drivers/net/pasemi_mac_ethtool.c b/drivers/net/pasemi_mac_ethtool.c
index 064a4fe1dd90..28a86224879d 100644
--- a/drivers/net/pasemi_mac_ethtool.c
+++ b/drivers/net/pasemi_mac_ethtool.c
@@ -71,6 +71,9 @@ pasemi_mac_ethtool_get_settings(struct net_device *netdev,
         struct pasemi_mac *mac = netdev_priv(netdev);
         struct phy_device *phydev = mac->phydev;
 
+        if (!phydev)
+                return -EOPNOTSUPP;
+
         return phy_ethtool_gset(phydev, cmd);
 }
 
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 474876c879cb..bd3447f04902 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1754,14 +1754,14 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "Psion Dacom", "Gold Card V34 Ethernet", 0xf5f025c2, 0x338e8155, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "Psion Dacom", "Gold Card V34 Ethernet GSM", 0xf5f025c2, 0x4ae85d35, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "LINKSYS", "PCMLM28", 0xf7cb0b07, 0x66881874, "cis/PCMLM28.cis"),
-        PCMCIA_MFC_DEVICE_CIS_PROD_ID12(0, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "DP83903.cis"),
-        PCMCIA_MFC_DEVICE_CIS_PROD_ID4(0, "NSC MF LAN/Modem", 0x58fc6056, "DP83903.cis"),
-        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(0, 0x0175, 0x0000, "DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_PROD_ID12(0, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "cis/DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_PROD_ID4(0, "NSC MF LAN/Modem", 0x58fc6056, "cis/DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(0, 0x0175, 0x0000, "cis/DP83903.cis"),
         PCMCIA_DEVICE_CIS_MANF_CARD(0xc00f, 0x0002, "cis/LA-PCM.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("KTI", "PE520 PLUS", 0xad180345, 0x9d58d392, "PE520.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID12("NDC", "Ethernet", 0x01c43ae1, 0x00b2e941, "NE2K.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("NDC", "Ethernet", 0x01c43ae1, 0x00b2e941, "cis/NE2K.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("PMX   ", "PE-200", 0x34f3f1c8, 0x10b59f8c, "PE-200.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID12("TAMARACK", "Ethernet", 0xcf434fba, 0x00b2e941, "tamarack.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("TAMARACK", "Ethernet", 0xcf434fba, 0x00b2e941, "cis/tamarack.cis"),
         PCMCIA_DEVICE_PROD_ID12("Ethernet", "CF Size PC Card", 0x00b2e941, 0x43ac239b),
         PCMCIA_DEVICE_PROD_ID123("Fast Ethernet", "CF Size PC Card", "1.0",
                 0xb4be14e3, 0x43ac239b, 0x0877b627),
diff --git a/drivers/net/qlge/qlge.h b/drivers/net/qlge/qlge.h
index 30d5585beeee..3ec6e85587a2 100644
--- a/drivers/net/qlge/qlge.h
+++ b/drivers/net/qlge/qlge.h
@@ -9,6 +9,7 @@
 
 #include <linux/pci.h>
 #include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
 
 /*
  * General definitions...
@@ -135,9 +136,9 @@ enum {
         RST_FO_TFO = (1 << 0),
         RST_FO_RR_MASK = 0x00060000,
         RST_FO_RR_CQ_CAM = 0x00000000,
-        RST_FO_RR_DROP = 0x00000001,
-        RST_FO_RR_DQ = 0x00000002,
-        RST_FO_RR_RCV_FUNC_CQ = 0x00000003,
+        RST_FO_RR_DROP = 0x00000002,
+        RST_FO_RR_DQ = 0x00000004,
+        RST_FO_RR_RCV_FUNC_CQ = 0x00000006,
         RST_FO_FRB = (1 << 12),
         RST_FO_MOP = (1 << 13),
         RST_FO_REG = (1 << 14),
@@ -1477,7 +1478,6 @@ struct ql_adapter {
         u32 mailbox_in;
         u32 mailbox_out;
         struct mbox_params idc_mbc;
-        struct mutex    mpi_mutex;
 
         int tx_ring_size;
         int rx_ring_size;
diff --git a/drivers/net/qlge/qlge_ethtool.c b/drivers/net/qlge/qlge_ethtool.c
index 68f9bd280f86..52073946bce3 100644
--- a/drivers/net/qlge/qlge_ethtool.c
+++ b/drivers/net/qlge/qlge_ethtool.c
@@ -45,7 +45,6 @@ static int ql_update_ring_coalescing(struct ql_adapter *qdev)
         if (!netif_running(qdev->ndev))
                 return status;
 
-        spin_lock(&qdev->hw_lock);
         /* Skip the default queue, and update the outbound handler
          * queues if they changed.
          */
@@ -92,7 +91,6 @@ static int ql_update_ring_coalescing(struct ql_adapter *qdev)
                 }
         }
 exit:
-        spin_unlock(&qdev->hw_lock);
         return status;
 }
 
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 3d0efea32111..61680715cde0 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -34,7 +34,6 @@
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
 #include <linux/skbuff.h>
-#include <linux/rtnetlink.h>
 #include <linux/if_vlan.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
@@ -1926,12 +1925,10 @@ static void ql_vlan_rx_add_vid(struct net_device *ndev, u16 vid)
         status = ql_sem_spinlock(qdev, SEM_MAC_ADDR_MASK);
         if (status)
                 return;
-        spin_lock(&qdev->hw_lock);
         if (ql_set_mac_addr_reg
             (qdev, (u8 *) &enable_bit, MAC_ADDR_TYPE_VLAN, vid)) {
                 QPRINTK(qdev, IFUP, ERR, "Failed to init vlan address.\n");
         }
-        spin_unlock(&qdev->hw_lock);
         ql_sem_unlock(qdev, SEM_MAC_ADDR_MASK);
 }
 
@@ -1945,12 +1942,10 @@ static void ql_vlan_rx_kill_vid(struct net_device *ndev, u16 vid)
         if (status)
                 return;
 
-        spin_lock(&qdev->hw_lock);
         if (ql_set_mac_addr_reg
             (qdev, (u8 *) &enable_bit, MAC_ADDR_TYPE_VLAN, vid)) {
                 QPRINTK(qdev, IFUP, ERR, "Failed to clear vlan address.\n");
         }
-        spin_unlock(&qdev->hw_lock);
         ql_sem_unlock(qdev, SEM_MAC_ADDR_MASK);
 
 }
@@ -2001,15 +1996,17 @@ static irqreturn_t qlge_isr(int irq, void *dev_id)
         /*
          * Check MPI processor activity.
          */
-        if (var & STS_PI) {
+        if ((var & STS_PI) &&
+                (ql_read32(qdev, INTR_MASK) & INTR_MASK_PI)) {
                 /*
                  * We've got an async event or mailbox completion.
                  * Handle it and clear the source of the interrupt.
                  */
                 QPRINTK(qdev, INTR, ERR, "Got MPI processor interrupt.\n");
                 ql_disable_completion_interrupt(qdev, intr_context->intr);
-                queue_delayed_work_on(smp_processor_id(), qdev->workqueue,
-                                      &qdev->mpi_work, 0);
+                ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16));
+                queue_delayed_work_on(smp_processor_id(),
+                                qdev->workqueue, &qdev->mpi_work, 0);
                 work_done++;
         }
 
@@ -3585,7 +3582,6 @@ static void qlge_set_multicast_list(struct net_device *ndev)
         status = ql_sem_spinlock(qdev, SEM_RT_IDX_MASK);
         if (status)
                 return;
-        spin_lock(&qdev->hw_lock);
         /*
          * Set or clear promiscuous mode if a
          * transition is taking place.
@@ -3662,7 +3658,6 @@ static void qlge_set_multicast_list(struct net_device *ndev)
                 }
         }
 exit:
-        spin_unlock(&qdev->hw_lock);
         ql_sem_unlock(qdev, SEM_RT_IDX_MASK);
 }
 
@@ -3682,10 +3677,8 @@ static int qlge_set_mac_address(struct net_device *ndev, void *p)
         status = ql_sem_spinlock(qdev, SEM_MAC_ADDR_MASK);
         if (status)
                 return status;
-        spin_lock(&qdev->hw_lock);
         status = ql_set_mac_addr_reg(qdev, (u8 *) ndev->dev_addr,
                         MAC_ADDR_TYPE_CAM_MAC, qdev->func * MAX_CQ);
-        spin_unlock(&qdev->hw_lock);
         if (status)
                 QPRINTK(qdev, HW, ERR, "Failed to load MAC address.\n");
         ql_sem_unlock(qdev, SEM_MAC_ADDR_MASK);
@@ -3928,7 +3921,6 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
         INIT_DELAYED_WORK(&qdev->mpi_work, ql_mpi_work);
         INIT_DELAYED_WORK(&qdev->mpi_port_cfg_work, ql_mpi_port_cfg_work);
         INIT_DELAYED_WORK(&qdev->mpi_idc_work, ql_mpi_idc_work);
-        mutex_init(&qdev->mpi_mutex);
         init_completion(&qdev->ide_completion);
 
         if (!cards_found) {
diff --git a/drivers/net/qlge/qlge_mpi.c b/drivers/net/qlge/qlge_mpi.c
index 6685bd97da91..c2e43073047e 100644
--- a/drivers/net/qlge/qlge_mpi.c
+++ b/drivers/net/qlge/qlge_mpi.c
@@ -472,7 +472,6 @@ static int ql_mailbox_command(struct ql_adapter *qdev, struct mbox_params *mbcp)
 {
         int status, count;
 
-        mutex_lock(&qdev->mpi_mutex);
 
         /* Begin polled mode for MPI */
         ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16));
@@ -541,7 +540,6 @@ static int ql_mailbox_command(struct ql_adapter *qdev, struct mbox_params *mbcp)
                 status = -EIO;
         }
 end:
-        mutex_unlock(&qdev->mpi_mutex);
         /* End polled mode for MPI */
         ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16) | INTR_MASK_PI);
         return status;
@@ -776,7 +774,9 @@ static int ql_idc_wait(struct ql_adapter *qdev)
 static int ql_set_port_cfg(struct ql_adapter *qdev)
 {
         int status;
+        rtnl_lock();
         status = ql_mb_set_port_cfg(qdev);
+        rtnl_unlock();
         if (status)
                 return status;
         status = ql_idc_wait(qdev);
@@ -797,7 +797,9 @@ void ql_mpi_port_cfg_work(struct work_struct *work)
             container_of(work, struct ql_adapter, mpi_port_cfg_work.work);
         int status;
 
+        rtnl_lock();
         status = ql_mb_get_port_cfg(qdev);
+        rtnl_unlock();
         if (status) {
                 QPRINTK(qdev, DRV, ERR,
                         "Bug: Failed to get port config data.\n");
@@ -855,7 +857,9 @@ void ql_mpi_idc_work(struct work_struct *work)
                  * needs to be set.
                  * */
                 set_bit(QL_CAM_RT_SET, &qdev->flags);
+                rtnl_lock();
                 status = ql_mb_idc_ack(qdev);
+                rtnl_unlock();
                 if (status) {
                         QPRINTK(qdev, DRV, ERR,
                         "Bug: No pending IDC!\n");
@@ -871,7 +875,7 @@ void ql_mpi_work(struct work_struct *work)
         struct mbox_params *mbcp = &mbc;
         int err = 0;
 
-        mutex_lock(&qdev->mpi_mutex);
+        rtnl_lock();
 
         while (ql_read32(qdev, STS) & STS_PI) {
                 memset(mbcp, 0, sizeof(struct mbox_params));
@@ -884,7 +888,7 @@ void ql_mpi_work(struct work_struct *work)
                         break;
         }
 
-        mutex_unlock(&qdev->mpi_mutex);
+        rtnl_unlock();
         ql_enable_completion_interrupt(qdev, 0);
 }
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index f09bc5dfe8b2..ba5d3fe753b6 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -902,11 +902,12 @@ static int tg3_mdio_read(struct mii_bus *bp, int mii_id, int reg)
         struct tg3 *tp = bp->priv;
         u32 val;
 
-        if (tp->tg3_flags3 & TG3_FLG3_MDIOBUS_PAUSED)
-                return -EAGAIN;
+        spin_lock_bh(&tp->lock);
 
         if (tg3_readphy(tp, reg, &val))
-                return -EIO;
+                val = -EIO;
+
+        spin_unlock_bh(&tp->lock);
 
         return val;
 }
@@ -914,14 +915,16 @@ static int tg3_mdio_read(struct mii_bus *bp, int mii_id, int reg)
 static int tg3_mdio_write(struct mii_bus *bp, int mii_id, int reg, u16 val)
 {
         struct tg3 *tp = bp->priv;
+        u32 ret = 0;
 
-        if (tp->tg3_flags3 & TG3_FLG3_MDIOBUS_PAUSED)
-                return -EAGAIN;
+        spin_lock_bh(&tp->lock);
 
         if (tg3_writephy(tp, reg, val))
-                return -EIO;
+                ret = -EIO;
 
-        return 0;
+        spin_unlock_bh(&tp->lock);
+
+        return ret;
 }
 
 static int tg3_mdio_reset(struct mii_bus *bp)
@@ -1011,12 +1014,6 @@ static void tg3_mdio_config_5785(struct tg3 *tp)
 
 static void tg3_mdio_start(struct tg3 *tp)
 {
-        if (tp->tg3_flags3 & TG3_FLG3_MDIOBUS_INITED) {
-                mutex_lock(&tp->mdio_bus->mdio_lock);
-                tp->tg3_flags3 &= ~TG3_FLG3_MDIOBUS_PAUSED;
-                mutex_unlock(&tp->mdio_bus->mdio_lock);
-        }
-
         tp->mi_mode &= ~MAC_MI_MODE_AUTO_POLL;
         tw32_f(MAC_MI_MODE, tp->mi_mode);
         udelay(80);
@@ -1041,15 +1038,6 @@ static void tg3_mdio_start(struct tg3 *tp)
                 tg3_mdio_config_5785(tp);
 }
 
-static void tg3_mdio_stop(struct tg3 *tp)
-{
-        if (tp->tg3_flags3 & TG3_FLG3_MDIOBUS_INITED) {
-                mutex_lock(&tp->mdio_bus->mdio_lock);
-                tp->tg3_flags3 |= TG3_FLG3_MDIOBUS_PAUSED;
-                mutex_unlock(&tp->mdio_bus->mdio_lock);
-        }
-}
-
 static int tg3_mdio_init(struct tg3 *tp)
 {
         int i;
@@ -1141,7 +1129,6 @@ static void tg3_mdio_fini(struct tg3 *tp)
                 tp->tg3_flags3 &= ~TG3_FLG3_MDIOBUS_INITED;
                 mdiobus_unregister(tp->mdio_bus);
                 mdiobus_free(tp->mdio_bus);
-                tp->tg3_flags3 &= ~TG3_FLG3_MDIOBUS_PAUSED;
         }
 }
 
@@ -1363,7 +1350,7 @@ static void tg3_adjust_link(struct net_device *dev)
         struct tg3 *tp = netdev_priv(dev);
         struct phy_device *phydev = tp->mdio_bus->phy_map[PHY_ADDR];
 
-        spin_lock(&tp->lock);
+        spin_lock_bh(&tp->lock);
 
         mac_mode = tp->mac_mode & ~(MAC_MODE_PORT_MODE_MASK |
                                     MAC_MODE_HALF_DUPLEX);
@@ -1431,7 +1418,7 @@ static void tg3_adjust_link(struct net_device *dev)
         tp->link_config.active_speed = phydev->speed;
         tp->link_config.active_duplex = phydev->duplex;
 
-        spin_unlock(&tp->lock);
+        spin_unlock_bh(&tp->lock);
 
         if (linkmesg)
                 tg3_link_report(tp);
@@ -6392,8 +6379,6 @@ static int tg3_chip_reset(struct tg3 *tp)
 
         tg3_nvram_lock(tp);
 
-        tg3_mdio_stop(tp);
-
         tg3_ape_lock(tp, TG3_APE_LOCK_GRC);
 
         /* No matching tg3_nvram_unlock() after this because
@@ -8698,6 +8683,8 @@ static int tg3_close(struct net_device *dev)
 
         del_timer_sync(&tp->timer);
 
+        tg3_phy_stop(tp);
+
         tg3_full_lock(tp, 1);
 #if 0
         tg3_dump_state(tp);
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 524691cd9896..bab7940158e6 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2748,7 +2748,6 @@ struct tg3 {
 #define TG3_FLG3_5701_DMA_BUG           0x00000008
 #define TG3_FLG3_USE_PHYLIB             0x00000010
 #define TG3_FLG3_MDIOBUS_INITED         0x00000020
-#define TG3_FLG3_MDIOBUS_PAUSED         0x00000040
 #define TG3_FLG3_PHY_CONNECTED          0x00000080
 #define TG3_FLG3_RGMII_STD_IBND_DISABLE 0x00000100
 #define TG3_FLG3_RGMII_EXT_IBND_RX_EN   0x00000200
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index d032bba9bc4c..0caa8008c51c 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -418,6 +418,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
                 goto halt_fail_and_release;
         }
         memcpy(net->dev_addr, bp, ETH_ALEN);
+        memcpy(net->perm_addr, bp, ETH_ALEN);
 
         /* set a nonzero filter to enable data transfers */
         memset(u.set, 0, sizeof *u.set);
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index a3bb49031a7f..ff4617e21426 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -873,10 +873,10 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "Psion Dacom", "Gold Card V34 Ethernet", 0xf5f025c2, 0x338e8155, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "Psion Dacom", "Gold Card V34 Ethernet GSM", 0xf5f025c2, 0x4ae85d35, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "LINKSYS", "PCMLM28", 0xf7cb0b07, 0x66881874, "cis/PCMLM28.cis"),
-        PCMCIA_MFC_DEVICE_CIS_PROD_ID12(1, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "DP83903.cis"),
-        PCMCIA_MFC_DEVICE_CIS_PROD_ID4(1, "NSC MF LAN/Modem", 0x58fc6056, "DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_PROD_ID12(1, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "cis/DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_PROD_ID4(1, "NSC MF LAN/Modem", 0x58fc6056, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x0556, "cis/3CCFEM556.cis"),
-        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0175, 0x0000, "DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0175, 0x0000, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x0035, "cis/3CXEM556.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x003d, "cis/3CXEM556.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("Sierra Wireless", "AC850", 0xd85f6206, 0x42a2c018, "SW_8xx_SER.cis"),  /* Sierra Wireless AC850 3G Network Adapter R1 */
@@ -884,9 +884,9 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_DEVICE_CIS_MANF_CARD(0x0192, 0xa555, "SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- pre update */
         PCMCIA_DEVICE_CIS_MANF_CARD(0x013f, 0xa555, "SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- post update */
         PCMCIA_DEVICE_CIS_PROD_ID12("MultiTech", "PCMCIA 56K DataFax", 0x842047ee, 0xc2efcf03, "cis/MT5634ZLX.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-2", 0x96913a85, 0x27ab5437, "COMpad2.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "COMpad4.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "COMpad2.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-2", 0x96913a85, 0x27ab5437, "cis/COMpad2.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "cis/COMpad4.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "cis/COMpad2.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID2("RS-COM 2P", 0xad20b156, "cis/RS-COM-2P.cis"),
         PCMCIA_DEVICE_CIS_MANF_CARD(0x0013, 0x0000, "GLOBETROTTER.cis"),
         PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.","SERIAL CARD: SL100  1.00.",0x19ca78af,0xf964f42b),
diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c
index 42e1005e2916..d065894ce38f 100644
--- a/drivers/video/da8xx-fb.c
+++ b/drivers/video/da8xx-fb.c
@@ -26,7 +26,6 @@
 #include <linux/device.h>
 #include <linux/platform_device.h>
 #include <linux/uaccess.h>
-#include <linux/device.h>
 #include <linux/interrupt.h>
 #include <linux/clk.h>
 #include <video/da8xx-fb.h>
diff --git a/drivers/video/msm/mddi.c b/drivers/video/msm/mddi.c
index f2de5a1acd6d..5c5a1ad1d397 100644
--- a/drivers/video/msm/mddi.c
+++ b/drivers/video/msm/mddi.c
@@ -27,8 +27,6 @@
 #include <mach/msm_iomap.h>
 #include <mach/irqs.h>
 #include <mach/board.h>
-#include <linux/delay.h>
-
 #include <mach/msm_fb.h>
 #include "mddi_hw.h"
 
diff --git a/drivers/video/omap/blizzard.c b/drivers/video/omap/blizzard.c
index d5e59556f9e2..70dadf9d2334 100644
--- a/drivers/video/omap/blizzard.c
+++ b/drivers/video/omap/blizzard.c
@@ -93,7 +93,7 @@ struct blizzard_reg_list {
 };
 
 /* These need to be saved / restored separately from the rest. */
-static struct blizzard_reg_list blizzard_pll_regs[] = {
+static const struct blizzard_reg_list blizzard_pll_regs[] = {
         {
                 .start  = 0x04,         /* Don't save PLL ctrl (0x0C) */
                 .end    = 0x0a,
@@ -104,7 +104,7 @@ static struct blizzard_reg_list blizzard_pll_regs[] = {
         },
 };
 
-static struct blizzard_reg_list blizzard_gen_regs[] = {
+static const struct blizzard_reg_list blizzard_gen_regs[] = {
         {
                 .start  = 0x18,         /* SDRAM control */
                 .end    = 0x20,
@@ -191,7 +191,7 @@ struct blizzard_struct {
 
         struct omapfb_device    *fbdev;
         struct lcd_ctrl_extif   *extif;
-        struct lcd_ctrl         *int_ctrl;
+        const struct lcd_ctrl   *int_ctrl;
 
         void                    (*power_up)(struct device *dev);
         void                    (*power_down)(struct device *dev);
@@ -1372,7 +1372,7 @@ static void blizzard_get_caps(int plane, struct omapfb_caps *caps)
                            (1 << OMAPFB_COLOR_YUV420);
 }
 
-static void _save_regs(struct blizzard_reg_list *list, int cnt)
+static void _save_regs(const struct blizzard_reg_list *list, int cnt)
 {
         int i;
 
@@ -1383,7 +1383,7 @@ static void _save_regs(struct blizzard_reg_list *list, int cnt)
         }
 }
 
-static void _restore_regs(struct blizzard_reg_list *list, int cnt)
+static void _restore_regs(const struct blizzard_reg_list *list, int cnt)
 {
         int i;
 
diff --git a/drivers/video/omap/omapfb_main.c b/drivers/video/omap/omapfb_main.c
index 125e605b8c68..0d0c8c8b9b56 100644
--- a/drivers/video/omap/omapfb_main.c
+++ b/drivers/video/omap/omapfb_main.c
@@ -393,7 +393,7 @@ static void omapfb_sync(struct fb_info *fbi)
  * Set fb_info.fix fields and also updates fbdev.
  * When calling this fb_info.var must be set up already.
  */
-static void set_fb_fix(struct fb_info *fbi)
+static void set_fb_fix(struct fb_info *fbi, int from_init)
 {
         struct fb_fix_screeninfo *fix = &fbi->fix;
         struct fb_var_screeninfo *var = &fbi->var;
@@ -403,10 +403,16 @@ static void set_fb_fix(struct fb_info *fbi)
 
         rg = &plane->fbdev->mem_desc.region[plane->idx];
         fbi->screen_base        = rg->vaddr;
-        mutex_lock(&fbi->mm_lock);
-        fix->smem_start         = rg->paddr;
-        fix->smem_len           = rg->size;
-        mutex_unlock(&fbi->mm_lock);
+
+        if (!from_init) {
+                mutex_lock(&fbi->mm_lock);
+                fix->smem_start         = rg->paddr;
+                fix->smem_len           = rg->size;
+                mutex_unlock(&fbi->mm_lock);
+        } else {
+                fix->smem_start         = rg->paddr;
+                fix->smem_len           = rg->size;
+        }
 
         fix->type = FB_TYPE_PACKED_PIXELS;
         bpp = var->bits_per_pixel;
@@ -704,7 +710,7 @@ static int omapfb_set_par(struct fb_info *fbi)
         int r = 0;
 
         omapfb_rqueue_lock(fbdev);
-        set_fb_fix(fbi);
+        set_fb_fix(fbi, 0);
         r = ctrl_change_mode(fbi);
         omapfb_rqueue_unlock(fbdev);
 
@@ -904,7 +910,7 @@ static int omapfb_setup_mem(struct fb_info *fbi, struct omapfb_mem_info *mi)
                 if (old_size != size) {
                         if (size) {
                                 memcpy(&fbi->var, new_var, sizeof(fbi->var));
-                                set_fb_fix(fbi);
+                                set_fb_fix(fbi, 0);
                         } else {
                                 /*
                                  * Set these explicitly to indicate that the
@@ -1504,7 +1510,7 @@ static int fbinfo_init(struct omapfb_device *fbdev, struct fb_info *info)
         var->bits_per_pixel = fbdev->panel->bpp;
 
         set_fb_var(info, var);
-        set_fb_fix(info);
+        set_fb_fix(info, 1);
 
         r = fb_alloc_cmap(&info->cmap, 16, 0);
         if (r != 0)
diff --git a/firmware/Makefile b/firmware/Makefile
index 5ea80b19785b..a6c7c3e47e42 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -67,10 +67,13 @@ fw-shipped-$(CONFIG_DVB_TTUSB_BUDGET) += ttusb-budget/dspbootcode.bin
 fw-shipped-$(CONFIG_E100) += e100/d101m_ucode.bin e100/d101s_ucode.bin \
                              e100/d102e_ucode.bin
 fw-shipped-$(CONFIG_MYRI_SBUS) += myricom/lanai.bin
-fw-shipped-$(CONFIG_PCMCIA_PCNET) += cis/LA-PCM.cis cis/PCMLM28.cis
+fw-shipped-$(CONFIG_PCMCIA_PCNET) += cis/LA-PCM.cis cis/PCMLM28.cis \
+                                     cis/DP83903.cis cis/NE2K.cis \
+                                     cis/tamarack.cis
 fw-shipped-$(CONFIG_PCMCIA_3C589) += cis/3CXEM556.cis
 fw-shipped-$(CONFIG_PCMCIA_3C574) += cis/3CCFEM556.cis
-fw-shipped-$(CONFIG_SERIAL_8250_CS) += cis/MT5634ZLX.cis cis/RS-COM-2P.cis
+fw-shipped-$(CONFIG_SERIAL_8250_CS) += cis/MT5634ZLX.cis cis/RS-COM-2P.cis \
+                                       cis/COMpad2.cis cis/COMpad4.cis
 fw-shipped-$(CONFIG_PCMCIA_SMC91C92) += ositech/Xilinx7OD.bin
 fw-shipped-$(CONFIG_SCSI_ADVANSYS) += advansys/mcode.bin advansys/38C1600.bin \
                                       advansys/3550.bin advansys/38C0800.bin
diff --git a/firmware/WHENCE b/firmware/WHENCE
index 3f8c4f6bc43f..c437e14f0b11 100644
--- a/firmware/WHENCE
+++ b/firmware/WHENCE
@@ -597,6 +597,9 @@ Driver: PCMCIA_PCNET - NE2000 compatible PCMCIA adapter
 
 File: cis/LA-PCM.cis
       cis/PCMLM28.cis
+      cis/DP83903.cis
+      cis/NE2K.cis
+      cis/tamarack.cis
 
 Licence: GPL
 
@@ -628,6 +631,8 @@ Driver: SERIAL_8250_CS - Serial PCMCIA adapter
 
 File: cis/MT5634ZLX.cis
       cis/RS-COM-2P.cis
+      cis/COMpad2.cis
+      cis/COMpad4.cis
 
 Licence: GPL
 
diff --git a/firmware/cis/COMpad2.cis.ihex b/firmware/cis/COMpad2.cis.ihex
new file mode 100644
index 000000000000..1671c5e48caa
--- /dev/null
+++ b/firmware/cis/COMpad2.cis.ihex
@@ -0,0 +1,11 @@
+:1000000001030000FF151F0401414456414E5445B1
+:10001000434800434F4D7061642D33322F38350013
+:10002000312E300000FF210202011A0501050001F6
+:10003000031B0EC18118AA61E80207E8030730B864
+:100040009E1B08820108AA6030030F1B0883010869
+:10005000AA6040030F1B08840108AA6050030F1B0D
+:0D00600008850108AA6060030F1400FF006E
+:00000001FF
+#
+# Replacement CIS for Advantech COMpad-32/85
+#
diff --git a/firmware/cis/COMpad4.cis.ihex b/firmware/cis/COMpad4.cis.ihex
new file mode 100644
index 000000000000..27bbec1921b3
--- /dev/null
+++ b/firmware/cis/COMpad4.cis.ihex
@@ -0,0 +1,9 @@
+:1000000001030000FF151F0401414456414E5445B1
+:10001000434800434F4D7061642D33322F383542D1
+:100020002D34000000FF210202011A050102000127
+:10003000011B0BC18118AA6040021F30B89E1B082B
+:0C004000820108AA6040031F1400FF00AA
+:00000001FF
+#
+# Replacement CIS for Advantech COMpad-32/85B-4
+#
diff --git a/firmware/cis/DP83903.cis.ihex b/firmware/cis/DP83903.cis.ihex
new file mode 100644
index 000000000000..6d73ea3cf1b8
--- /dev/null
+++ b/firmware/cis/DP83903.cis.ihex
@@ -0,0 +1,14 @@
+:1000000001030000FF152904014D756C74696675C4
+:100010006E6374696F6E20436172640000004E531A
+:1000200043204D46204C414E2F4D6F64656D00FFBF
+:1000300020047501000021020000060B02004900A7
+:100040000000006A000000FF00130343495321022F
+:1000500006001A060517201077021B0C970179017C
+:10006000556530FFFF284000FF001303434953212B
+:100070000202001A060507401077021B09870119C2
+:0800800001552330FFFFFF00D2
+:00000001FF
+#
+# This CIS is for cards based on the National Semiconductor
+# DP83903 Multiple Function Interface Chip
+#
diff --git a/firmware/cis/NE2K.cis.ihex b/firmware/cis/NE2K.cis.ihex
new file mode 100644
index 000000000000..1bb40fc4759f
--- /dev/null
+++ b/firmware/cis/NE2K.cis.ihex
@@ -0,0 +1,8 @@
+:1000000001030000FF1515040150434D4349410011
+:1000100045746865726E6574000000FF2102060079
+:100020001A050120F803031B09E001190155653089
+:06003000FFFF1400FF00B9
+:00000001FF
+#
+# Replacement CIS for various busted NE2000-compatible cards
+#
diff --git a/firmware/cis/tamarack.cis.ihex b/firmware/cis/tamarack.cis.ihex
new file mode 100644
index 000000000000..1e86547fb361
--- /dev/null
+++ b/firmware/cis/tamarack.cis.ihex
@@ -0,0 +1,10 @@
+:100000000103D400FF17034100FF152404015441EC
+:100010004D415241434B0045746865726E657400F2
+:10002000410030303437343331313830303100FF33
+:10003000210206001A050120F803031B14E08119B0
+:100040003F554D5D06864626E551000F100F30FFE7
+:05005000FF1400FF0099
+:00000001FF
+#
+# Replacement CIS for Surecom, Tamarack NE2000 cards
+#
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index 56013371f9f3..a44a7897fd4d 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -23,7 +23,6 @@
 #include <asm/io.h>
 #include <linux/list.h>
 #include <linux/ioport.h>
-#include <linux/mm.h>
 #include <linux/memory.h>
 #include <asm/sections.h>
 
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 2281c2cbfe2b..5033ce0d254b 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -94,6 +94,7 @@ static const struct file_operations proc_kpagecount_operations = {
 #define KPF_COMPOUND_TAIL       16
 #define KPF_HUGE                17
 #define KPF_UNEVICTABLE         18
+#define KPF_HWPOISON            19
 #define KPF_NOPAGE              20
 
 #define KPF_KSM                 21
@@ -180,6 +181,10 @@ static u64 get_uflags(struct page *page)
         u |= kpf_copy_bit(k, KPF_UNEVICTABLE,   PG_unevictable);
         u |= kpf_copy_bit(k, KPF_MLOCKED,       PG_mlocked);
 
+#ifdef CONFIG_MEMORY_FAILURE
+        u |= kpf_copy_bit(k, KPF_HWPOISON,      PG_hwpoison);
+#endif
+
 #ifdef CONFIG_IA64_UNCACHED_ALLOCATOR
         u |= kpf_copy_bit(k, KPF_UNCACHED,      PG_uncached);
 #endif
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 3b461dffe244..3273a0c5043b 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -16,7 +16,7 @@ struct __kernel_sockaddr_storage {
                                 /* _SS_MAXSIZE value minus size of ss_family */
 } __attribute__ ((aligned(_K_SS_ALIGNSIZE)));   /* force desired alignment */
 
-#if defined(__KERNEL__) || !defined(__GLIBC__) || (__GLIBC__ < 2)
+#ifdef __KERNEL__
 
 #include <asm/socket.h>                 /* arch-dependent defines       */
 #include <linux/sockios.h>              /* the SIOCxxx I/O controls     */
@@ -101,21 +101,6 @@ struct cmsghdr {
                               ((char *)(cmsg) - (char *)(mhdr)->msg_control)))
 
 /*
- *      This mess will go away with glibc
- */
- 
-#ifdef __KERNEL__
-#define __KINLINE static inline
-#elif  defined(__GNUC__) 
-#define __KINLINE static __inline__
-#elif defined(__cplusplus)
-#define __KINLINE static inline
-#else
-#define __KINLINE static
-#endif
-
-
-/*
  *      Get the next cmsg header
  *
  *      PLEASE, do not touch this function. If you think, that it is
@@ -128,7 +113,7 @@ struct cmsghdr {
  *      ancillary object DATA.                          --ANK (980731)
  */
  
-__KINLINE struct cmsghdr * __cmsg_nxthdr(void *__ctl, __kernel_size_t __size,
+static inline struct cmsghdr * __cmsg_nxthdr(void *__ctl, __kernel_size_t __size,
                                                struct cmsghdr *__cmsg)
 {
         struct cmsghdr * __ptr;
@@ -140,7 +125,7 @@ __KINLINE struct cmsghdr * __cmsg_nxthdr(void *__ctl, __kernel_size_t __size,
         return __ptr;
 }
 
-__KINLINE struct cmsghdr * cmsg_nxthdr (struct msghdr *__msg, struct cmsghdr *__cmsg)
+static inline struct cmsghdr * cmsg_nxthdr (struct msghdr *__msg, struct cmsghdr *__cmsg)
 {
         return __cmsg_nxthdr(__msg->msg_control, __msg->msg_controllen, __cmsg);
 }
diff --git a/mm/Kconfig b/mm/Kconfig
index edd300aca173..57963c6063d1 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -224,7 +224,9 @@ config KSM
           the many instances by a single resident page with that content, so
           saving memory until one or another app needs to modify the content.
           Recommended for use with KVM, or with other duplicative applications.
-          See Documentation/vm/ksm.txt for more information.
+          See Documentation/vm/ksm.txt for more information: KSM is inactive
+          until a program has madvised that an area is MADV_MERGEABLE, and
+          root has set /sys/kernel/mm/ksm/run to 1 (if CONFIG_SYSFS is set).
 
 config DEFAULT_MMAP_MIN_ADDR
         int "Low address space to protect from user allocation"
diff --git a/mm/ksm.c b/mm/ksm.c
index f7edac356f46..bef1af4f77e3 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -184,11 +184,6 @@ static DEFINE_SPINLOCK(ksm_mmlist_lock);
                 sizeof(struct __struct), __alignof__(struct __struct),\
                 (__flags), NULL)
 
-static void __init ksm_init_max_kernel_pages(void)
-{
-        ksm_max_kernel_pages = nr_free_buffer_pages() / 4;
-}
-
 static int __init ksm_slab_init(void)
 {
         rmap_item_cache = KSM_KMEM_CACHE(rmap_item, 0);
@@ -1673,7 +1668,7 @@ static int __init ksm_init(void)
         struct task_struct *ksm_thread;
         int err;
 
-        ksm_init_max_kernel_pages();
+        ksm_max_kernel_pages = totalram_pages / 4;
 
         err = ksm_slab_init();
         if (err)
@@ -1697,6 +1692,9 @@ static int __init ksm_init(void)
                 kthread_stop(ksm_thread);
                 goto out_free2;
         }
+#else
+        ksm_run = KSM_RUN_MERGE;        /* no way for user to start it */
+
 #endif /* CONFIG_SYSFS */
 
         return 0;
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 69511e663234..2f7c9d75c552 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -25,7 +25,6 @@
 #include <linux/rcupdate.h>
 #include <linux/pfn.h>
 #include <linux/kmemleak.h>
-#include <linux/highmem.h>
 #include <asm/atomic.h>
 #include <asm/uaccess.h>
 #include <asm/tlbflush.h>
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 821d30918cfc..427ded841224 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -366,13 +366,13 @@ static ssize_t wireless_show(struct device *d, char *buf,
         const struct iw_statistics *iw;
         ssize_t ret = -EINVAL;
 
-        read_lock(&dev_base_lock);
+        rtnl_lock();
         if (dev_isalive(dev)) {
                 iw = get_wireless_stats(dev);
                 if (iw)
                         ret = (*format)(iw, buf);
         }
-        read_unlock(&dev_base_lock);
+        rtnl_unlock();
 
         return ret;
 }
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index b69455217ed6..86acdba0a97d 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -964,7 +964,7 @@ static ssize_t pktgen_if_write(struct file *file,
                 if (value == 0x7FFFFFFF)
                         pkt_dev->delay = ULLONG_MAX;
                 else
-                        pkt_dev->delay = (u64)value * NSEC_PER_USEC;
+                        pkt_dev->delay = (u64)value;
 
                 sprintf(pg_result, "OK: delay=%llu",
                         (unsigned long long) pkt_dev->delay);
@@ -2212,7 +2212,7 @@ static void set_cur_queue_map(struct pktgen_dev *pkt_dev)
         if (pkt_dev->flags & F_QUEUE_MAP_CPU)
                 pkt_dev->cur_queue_map = smp_processor_id();
 
-        else if (pkt_dev->queue_map_min < pkt_dev->queue_map_max) {
+        else if (pkt_dev->queue_map_min <= pkt_dev->queue_map_max) {
                 __u16 t;
                 if (pkt_dev->flags & F_QUEUE_MAP_RND) {
                         t = random32() %
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index e92f1fd28aa5..5df2f6a0b0f0 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1077,12 +1077,16 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 ip_mc_up(in_dev);
                 /* fall through */
         case NETDEV_CHANGEADDR:
-                if (IN_DEV_ARP_NOTIFY(in_dev))
-                        arp_send(ARPOP_REQUEST, ETH_P_ARP,
-                                 in_dev->ifa_list->ifa_address,
-                                 dev,
-                                 in_dev->ifa_list->ifa_address,
-                                 NULL, dev->dev_addr, NULL);
+                /* Send gratuitous ARP to notify of link change */
+                if (IN_DEV_ARP_NOTIFY(in_dev)) {
+                        struct in_ifaddr *ifa = in_dev->ifa_list;
+
+                        if (ifa)
+                                arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                                         ifa->ifa_address, dev,
+                                         ifa->ifa_address, NULL,
+                                         dev->dev_addr, NULL);
+                }
                 break;
         case NETDEV_DOWN:
                 ip_mc_down(in_dev);