64 files changed, 1417 insertions, 937 deletions

diff --git a/arch/sparc/include/asm/termbits.h b/arch/sparc/include/asm/termbits.h
index d6ca3e2754f5..d72dfed1f9d7 100644
--- a/arch/sparc/include/asm/termbits.h
+++ b/arch/sparc/include/asm/termbits.h
@@ -29,10 +29,11 @@ struct termios {
         tcflag_t c_cflag;               /* control mode flags */
         tcflag_t c_lflag;               /* local mode flags */
         cc_t c_line;                    /* line discipline */
+#ifndef __KERNEL__
         cc_t c_cc[NCCS];                /* control characters */
-#ifdef __KERNEL__
+#else
+        cc_t c_cc[NCCS+2];      /* kernel needs 2 more to hold vmin/vtime */
 #define SIZEOF_USER_TERMIOS sizeof (struct termios) - (2*sizeof (cc_t))
-        cc_t _x_cc[2];                  /* We need them to hold vmin/vtime */
 #endif
 };
 
@@ -42,8 +43,7 @@ struct termios2 {
         tcflag_t c_cflag;               /* control mode flags */
         tcflag_t c_lflag;               /* local mode flags */
         cc_t c_line;                    /* line discipline */
-        cc_t c_cc[NCCS];                /* control characters */
-        cc_t _x_cc[2];                  /* padding to match ktermios */
+        cc_t c_cc[NCCS+2];              /* control characters */
         speed_t c_ispeed;               /* input speed */
         speed_t c_ospeed;               /* output speed */
 };
@@ -54,8 +54,7 @@ struct ktermios {
         tcflag_t c_cflag;               /* control mode flags */
         tcflag_t c_lflag;               /* local mode flags */
         cc_t c_line;                    /* line discipline */
-        cc_t c_cc[NCCS];                /* control characters */
-        cc_t _x_cc[2];                  /* We need them to hold vmin/vtime */
+        cc_t c_cc[NCCS+2];              /* control characters */
         speed_t c_ispeed;               /* input speed */
         speed_t c_ospeed;               /* output speed */
 };
diff --git a/arch/sparc/kernel/of_device.c b/arch/sparc/kernel/of_device.c
index 0837bd52e28f..0a83bd737654 100644
--- a/arch/sparc/kernel/of_device.c
+++ b/arch/sparc/kernel/of_device.c
@@ -563,9 +563,9 @@ build_resources:
         op->dev.parent = parent;
         op->dev.bus = &of_platform_bus_type;
         if (!parent)
-                strcpy(op->dev.bus_id, "root");
+                dev_set_name(&op->dev, "root");
         else
-                sprintf(op->dev.bus_id, "%08x", dp->node);
+                dev_set_name(&op->dev, "%08x", dp->node);
 
         if (of_device_register(op)) {
                 printk("%s: Could not register of device.\n",
diff --git a/drivers/acpi/sleep/proc.c b/drivers/acpi/sleep/proc.c
index 64e591ba86f2..4dbc2271acf5 100644
--- a/drivers/acpi/sleep/proc.c
+++ b/drivers/acpi/sleep/proc.c
@@ -366,7 +366,7 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
                            dev->wakeup.state.enabled ? "enabled" : "disabled");
                 if (ldev)
                         seq_printf(seq, "%s:%s",
-                                   dev_name(ldev) ? ldev->bus->name : "no-bus",
+                                   ldev->bus ? ldev->bus->name : "no-bus",
                                    dev_name(ldev));
                 seq_printf(seq, "\n");
                 put_device(ldev);
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index c6ab4ba60c52..9b97795e45ad 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -55,10 +55,11 @@ struct apple_key_translation {
 
 static struct apple_key_translation apple_fn_keys[] = {
         { KEY_BACKSPACE, KEY_DELETE },
+        { KEY_ENTER,    KEY_INSERT },
         { KEY_F1,       KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY },
         { KEY_F2,       KEY_BRIGHTNESSUP,   APPLE_FLAG_FKEY },
-        { KEY_F3,       KEY_FN_F5,          APPLE_FLAG_FKEY }, /* Exposé */
-        { KEY_F4,       KEY_FN_F4,          APPLE_FLAG_FKEY }, /* Dashboard */
+        { KEY_F3,       KEY_SCALE,          APPLE_FLAG_FKEY },
+        { KEY_F4,       KEY_DASHBOARD,      APPLE_FLAG_FKEY },
         { KEY_F5,       KEY_KBDILLUMDOWN,   APPLE_FLAG_FKEY },
         { KEY_F6,       KEY_KBDILLUMUP,     APPLE_FLAG_FKEY },
         { KEY_F7,       KEY_PREVIOUSSONG,   APPLE_FLAG_FKEY },
@@ -418,6 +419,12 @@ static const struct hid_device_id apple_devices[] = {
                 .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_JIS),
                 .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO),
+                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
+                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY),
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index d3671b4049c0..147ec591a806 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1250,9 +1250,11 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BRIGHT, USB_DEVICE_ID_BRIGHT_ABNT2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
@@ -1265,7 +1267,6 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_EZKEY, USB_DEVICE_ID_BTC_8193) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GENERIC_13BA, USB_DEVICE_ID_GENERIC_13BA_KBD_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_KWORLD, USB_DEVICE_ID_KWORLD_RADIO_FM700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER) },
@@ -1409,6 +1410,7 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ALCOR, USB_DEVICE_ID_ALCOR_USBRS232) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_LCM)},
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_LCM2)},
+        { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) },
@@ -1486,6 +1488,7 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1007) },
         { HID_USB_DEVICE(USB_VENDOR_ID_IMATION, USB_DEVICE_ID_DISC_STAKKA) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KBGEAR, USB_DEVICE_ID_KBGEAR_JAMSTUDIO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KWORLD, USB_DEVICE_ID_KWORLD_RADIO_FM700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_GPEN_560) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CASSY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POCKETCASSY) },
@@ -1573,6 +1576,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
         { }
@@ -1730,7 +1736,7 @@ static int __init hid_init(void)
                 goto err_bus;
 
 #ifdef CONFIG_HID_COMPAT
-        hid_compat_wq = create_workqueue("hid_compat");
+        hid_compat_wq = create_singlethread_workqueue("hid_compat");
         if (!hid_compat_wq) {
                 hidraw_exit();
                 goto err;
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index f05bcbbbb0d5..d70075dd3d81 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -82,6 +82,9 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI    0x0230
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_ISO     0x0231
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_JIS     0x0232
+#define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI    0x0236
+#define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO     0x0237
+#define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS     0x0238
 #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY    0x030a
 #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY     0x030b
 #define USB_DEVICE_ID_APPLE_ATV_IRCONTROL       0x8241
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 894d52e05bf9..7685ae6808c4 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -38,7 +38,7 @@ static int hidraw_major;
 static struct cdev hidraw_cdev;
 static struct class *hidraw_class;
 static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
-static DEFINE_SPINLOCK(minors_lock);
+static DEFINE_MUTEX(minors_lock);
 
 static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
@@ -159,13 +159,13 @@ static int hidraw_open(struct inode *inode, struct file *file)
         struct hidraw_list *list;
         int err = 0;
 
-        lock_kernel();
         if (!(list = kzalloc(sizeof(struct hidraw_list), GFP_KERNEL))) {
                 err = -ENOMEM;
                 goto out;
         }
 
-        spin_lock(&minors_lock);
+        lock_kernel();
+        mutex_lock(&minors_lock);
         if (!hidraw_table[minor]) {
                 printk(KERN_EMERG "hidraw device with minor %d doesn't exist\n",
                                 minor);
@@ -180,13 +180,16 @@ static int hidraw_open(struct inode *inode, struct file *file)
         file->private_data = list;
 
         dev = hidraw_table[minor];
-        if (!dev->open++)
-                dev->hid->ll_driver->open(dev->hid);
+        if (!dev->open++) {
+                err = dev->hid->ll_driver->open(dev->hid);
+                if (err < 0)
+                        dev->open--;
+        }
 
 out_unlock:
-        spin_unlock(&minors_lock);
-out:
+        mutex_unlock(&minors_lock);
         unlock_kernel();
+out:
         return err;
 
 }
@@ -310,7 +313,7 @@ int hidraw_connect(struct hid_device *hid)
 
         result = -EINVAL;
 
-        spin_lock(&minors_lock);
+        mutex_lock(&minors_lock);
 
         for (minor = 0; minor < HIDRAW_MAX_DEVICES; minor++) {
                 if (hidraw_table[minor])
@@ -320,9 +323,8 @@ int hidraw_connect(struct hid_device *hid)
                 break;
         }
 
-        spin_unlock(&minors_lock);
-
         if (result) {
+                mutex_unlock(&minors_lock);
                 kfree(dev);
                 goto out;
         }
@@ -331,14 +333,14 @@ int hidraw_connect(struct hid_device *hid)
                                  NULL, "%s%d", "hidraw", minor);
 
         if (IS_ERR(dev->dev)) {
-                spin_lock(&minors_lock);
                 hidraw_table[minor] = NULL;
-                spin_unlock(&minors_lock);
+                mutex_unlock(&minors_lock);
                 result = PTR_ERR(dev->dev);
                 kfree(dev);
                 goto out;
         }
 
+        mutex_unlock(&minors_lock);
         init_waitqueue_head(&dev->wait);
         INIT_LIST_HEAD(&dev->list);
 
@@ -360,9 +362,9 @@ void hidraw_disconnect(struct hid_device *hid)
 
         hidraw->exist = 0;
 
-        spin_lock(&minors_lock);
+        mutex_lock(&minors_lock);
         hidraw_table[hidraw->minor] = NULL;
-        spin_unlock(&minors_lock);
+        mutex_unlock(&minors_lock);
 
         device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
 
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 18e5ddd722cd..d746bf8284dd 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -781,6 +781,8 @@ static int usbhid_start(struct hid_device *hid)
         unsigned int n, insize = 0;
         int ret;
 
+        clear_bit(HID_DISCONNECTED, &usbhid->iofl);
+
         usbhid->bufsize = HID_MIN_BUFFER_SIZE;
         hid_find_max_report(hid, HID_INPUT_REPORT, &usbhid->bufsize);
         hid_find_max_report(hid, HID_OUTPUT_REPORT, &usbhid->bufsize);
@@ -847,12 +849,6 @@ static int usbhid_start(struct hid_device *hid)
                 }
         }
 
-        if (!usbhid->urbin) {
-                err_hid("couldn't find an input interrupt endpoint");
-                ret = -ENODEV;
-                goto fail;
-        }
-
         init_waitqueue_head(&usbhid->wait);
         INIT_WORK(&usbhid->reset_work, hid_reset);
         setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
@@ -888,6 +884,9 @@ fail:
         usb_free_urb(usbhid->urbin);
         usb_free_urb(usbhid->urbout);
         usb_free_urb(usbhid->urbctrl);
+        usbhid->urbin = NULL;
+        usbhid->urbout = NULL;
+        usbhid->urbctrl = NULL;
         hid_free_buffers(dev, hid);
         mutex_unlock(&usbhid->setup);
         return ret;
@@ -924,6 +923,9 @@ static void usbhid_stop(struct hid_device *hid)
         usb_free_urb(usbhid->urbin);
         usb_free_urb(usbhid->urbctrl);
         usb_free_urb(usbhid->urbout);
+        usbhid->urbin = NULL; /* don't mess up next start */
+        usbhid->urbctrl = NULL;
+        usbhid->urbout = NULL;
 
         hid_free_buffers(hid_to_usb_dev(hid), hid);
         mutex_unlock(&usbhid->setup);
@@ -940,15 +942,26 @@ static struct hid_ll_driver usb_hid_driver = {
 
 static int hid_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
+        struct usb_host_interface *interface = intf->cur_altsetting;
         struct usb_device *dev = interface_to_usbdev(intf);
         struct usbhid_device *usbhid;
         struct hid_device *hid;
+        unsigned int n, has_in = 0;
         size_t len;
         int ret;
 
         dbg_hid("HID probe called for ifnum %d\n",
                         intf->altsetting->desc.bInterfaceNumber);
 
+        for (n = 0; n < interface->desc.bNumEndpoints; n++)
+                if (usb_endpoint_is_int_in(&interface->endpoint[n].desc))
+                        has_in++;
+        if (!has_in) {
+                dev_err(&intf->dev, "couldn't find an input interrupt "
+                                "endpoint\n");
+                return -ENODEV;
+        }
+
         hid = hid_allocate_device();
         if (IS_ERR(hid))
                 return PTR_ERR(hid);
diff --git a/drivers/ide/ide-cs.c b/drivers/ide/ide-cs.c
index cb199c815b53..f50210fe558f 100644
--- a/drivers/ide/ide-cs.c
+++ b/drivers/ide/ide-cs.c
@@ -444,6 +444,7 @@ static struct pcmcia_device_id ide_ids[] = {
         PCMCIA_DEVICE_PROD_ID1("STI Flash", 0xe4a13209),
         PCMCIA_DEVICE_PROD_ID12("STI", "Flash 5.0", 0xbf2df18d, 0x8cb57a0e),
         PCMCIA_MFC_DEVICE_PROD_ID12(1, "SanDisk", "ConnectPlus", 0x7a954bd9, 0x74be00c6),
+        PCMCIA_DEVICE_PROD_ID2("Flash Card", 0x5a362506),
         PCMCIA_DEVICE_NULL,
 };
 MODULE_DEVICE_TABLE(pcmcia, ide_ids);
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index bb904a0a98bd..1bfc55d7a26c 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -1641,8 +1641,10 @@ isdn_net_ciscohdlck_slarp_send_reply(isdn_net_local *lp)
         /* slarp reply, send own ip/netmask; if values are nonsense remote
          * should think we are unable to provide it with an address via SLARP */
         p += put_u32(p, CISCO_SLARP_REPLY);
-        p += put_u32(p, addr);  // address
-        p += put_u32(p, mask);  // netmask
+        *(__be32 *)p = addr;    // address
+        p += 4;
+        *(__be32 *)p = mask;    // netmask
+        p += 4;
         p += put_u16(p, 0);     // unused
 
         isdn_net_write_super(lp, skb);
diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
index b57326ae464d..0b5bd85dfcec 100644
--- a/drivers/mfd/da903x.c
+++ b/drivers/mfd/da903x.c
@@ -267,7 +267,7 @@ static int da9030_mask_events(struct da903x_chip *chip, unsigned int events)
 {
         uint8_t v[3];
 
-        chip->events_mask &= ~events;
+        chip->events_mask |= events;
 
         v[0] = (chip->events_mask & 0xff);
         v[1] = (chip->events_mask >> 8) & 0xff;
diff --git a/drivers/mfd/wm8350-i2c.c b/drivers/mfd/wm8350-i2c.c
index 8dfe21bb3bd1..3e0ce0e50ea2 100644
--- a/drivers/mfd/wm8350-i2c.c
+++ b/drivers/mfd/wm8350-i2c.c
@@ -30,7 +30,12 @@ static int wm8350_i2c_read_device(struct wm8350 *wm8350, char reg,
         ret = i2c_master_send(wm8350->i2c_client, &reg, 1);
         if (ret < 0)
                 return ret;
-        return i2c_master_recv(wm8350->i2c_client, dest, bytes);
+        ret = i2c_master_recv(wm8350->i2c_client, dest, bytes);
+        if (ret < 0)
+                return ret;
+        if (ret != bytes)
+                return -EIO;
+        return 0;
 }
 
 static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
@@ -38,13 +43,19 @@ static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
 {
         /* we add 1 byte for device register */
         u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
+        int ret;
 
         if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
                 return -EINVAL;
 
         msg[0] = reg;
         memcpy(&msg[1], src, bytes);
-        return i2c_master_send(wm8350->i2c_client, msg, bytes + 1);
+        ret = i2c_master_send(wm8350->i2c_client, msg, bytes + 1);
+        if (ret < 0)
+                return ret;
+        if (ret != bytes + 1)
+                return -EIO;
+        return 0;
 }
 
 static int wm8350_i2c_probe(struct i2c_client *i2c,
diff --git a/drivers/net/atl1e/atl1e_hw.c b/drivers/net/atl1e/atl1e_hw.c
index 8cbc1b59bd62..4a7700620119 100644
--- a/drivers/net/atl1e/atl1e_hw.c
+++ b/drivers/net/atl1e/atl1e_hw.c
@@ -163,9 +163,6 @@ int atl1e_read_mac_addr(struct atl1e_hw *hw)
  * atl1e_hash_mc_addr
  *  purpose
  *      set hash value for a multicast address
- *      hash calcu processing :
- *          1. calcu 32bit CRC for multicast address
- *          2. reverse crc with MSB to LSB
  */
 u32 atl1e_hash_mc_addr(struct atl1e_hw *hw, u8 *mc_addr)
 {
@@ -174,7 +171,6 @@ u32 atl1e_hash_mc_addr(struct atl1e_hw *hw, u8 *mc_addr)
         int i;
 
         crc32 = ether_crc_le(6, mc_addr);
-        crc32 = ~crc32;
         for (i = 0; i < 32; i++)
                 value |= (((crc32 >> i) & 1) << (31 - i));
 
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 246d92b42636..aef403d299ee 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -3404,14 +3404,8 @@ static void atl1_get_wol(struct net_device *netdev,
 {
         struct atl1_adapter *adapter = netdev_priv(netdev);
 
-        wol->supported = WAKE_UCAST | WAKE_MCAST | WAKE_BCAST | WAKE_MAGIC;
+        wol->supported = WAKE_MAGIC;
         wol->wolopts = 0;
-        if (adapter->wol & ATLX_WUFC_EX)
-                wol->wolopts |= WAKE_UCAST;
-        if (adapter->wol & ATLX_WUFC_MC)
-                wol->wolopts |= WAKE_MCAST;
-        if (adapter->wol & ATLX_WUFC_BC)
-                wol->wolopts |= WAKE_BCAST;
         if (adapter->wol & ATLX_WUFC_MAG)
                 wol->wolopts |= WAKE_MAGIC;
         return;
@@ -3422,15 +3416,10 @@ static int atl1_set_wol(struct net_device *netdev,
 {
         struct atl1_adapter *adapter = netdev_priv(netdev);
 
-        if (wol->wolopts & (WAKE_PHY | WAKE_ARP | WAKE_MAGICSECURE))
+        if (wol->wolopts & (WAKE_PHY | WAKE_UCAST | WAKE_MCAST | WAKE_BCAST |
+                WAKE_ARP | WAKE_MAGICSECURE))
                 return -EOPNOTSUPP;
         adapter->wol = 0;
-        if (wol->wolopts & WAKE_UCAST)
-                adapter->wol |= ATLX_WUFC_EX;
-        if (wol->wolopts & WAKE_MCAST)
-                adapter->wol |= ATLX_WUFC_MC;
-        if (wol->wolopts & WAKE_BCAST)
-                adapter->wol |= ATLX_WUFC_BC;
         if (wol->wolopts & WAKE_MAGIC)
                 adapter->wol |= ATLX_WUFC_MAG;
         return 0;
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 3d69fae781cf..e8bfcce6b319 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -166,7 +166,7 @@
 
 #define DRV_NAME                "e100"
 #define DRV_EXT                 "-NAPI"
-#define DRV_VERSION             "3.5.23-k4"DRV_EXT
+#define DRV_VERSION             "3.5.23-k6"DRV_EXT
 #define DRV_DESCRIPTION         "Intel(R) PRO/100 Network Driver"
 #define DRV_COPYRIGHT           "Copyright(c) 1999-2006 Intel Corporation"
 #define PFX                     DRV_NAME ": "
@@ -1804,7 +1804,7 @@ static int e100_rx_alloc_skb(struct nic *nic, struct rx *rx)
                 struct rfd *prev_rfd = (struct rfd *)rx->prev->skb->data;
                 put_unaligned_le32(rx->dma_addr, &prev_rfd->link);
                 pci_dma_sync_single_for_device(nic->pdev, rx->prev->dma_addr,
-                        sizeof(struct rfd), PCI_DMA_TODEVICE);
+                        sizeof(struct rfd), PCI_DMA_BIDIRECTIONAL);
         }
 
         return 0;
@@ -1823,7 +1823,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
 
         /* Need to sync before taking a peek at cb_complete bit */
         pci_dma_sync_single_for_cpu(nic->pdev, rx->dma_addr,
-                sizeof(struct rfd), PCI_DMA_FROMDEVICE);
+                sizeof(struct rfd), PCI_DMA_BIDIRECTIONAL);
         rfd_status = le16_to_cpu(rfd->status);
 
         DPRINTK(RX_STATUS, DEBUG, "status=0x%04X\n", rfd_status);
@@ -1850,7 +1850,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
 
         /* Get data */
         pci_unmap_single(nic->pdev, rx->dma_addr,
-                RFD_BUF_LEN, PCI_DMA_FROMDEVICE);
+                RFD_BUF_LEN, PCI_DMA_BIDIRECTIONAL);
 
         /* If this buffer has the el bit, but we think the receiver
          * is still running, check to see if it really stopped while
@@ -1943,7 +1943,7 @@ static void e100_rx_clean(struct nic *nic, unsigned int *work_done,
                 new_before_last_rfd->command |= cpu_to_le16(cb_el);
                 pci_dma_sync_single_for_device(nic->pdev,
                         new_before_last_rx->dma_addr, sizeof(struct rfd),
-                        PCI_DMA_TODEVICE);
+                        PCI_DMA_BIDIRECTIONAL);
 
                 /* Now that we have a new stopping point, we can clear the old
                  * stopping point.  We must sync twice to get the proper
@@ -1951,11 +1951,11 @@ static void e100_rx_clean(struct nic *nic, unsigned int *work_done,
                 old_before_last_rfd->command &= ~cpu_to_le16(cb_el);
                 pci_dma_sync_single_for_device(nic->pdev,
                         old_before_last_rx->dma_addr, sizeof(struct rfd),
-                        PCI_DMA_TODEVICE);
+                        PCI_DMA_BIDIRECTIONAL);
                 old_before_last_rfd->size = cpu_to_le16(VLAN_ETH_FRAME_LEN);
                 pci_dma_sync_single_for_device(nic->pdev,
                         old_before_last_rx->dma_addr, sizeof(struct rfd),
-                        PCI_DMA_TODEVICE);
+                        PCI_DMA_BIDIRECTIONAL);
         }
 
         if(restart_required) {
@@ -1978,7 +1978,7 @@ static void e100_rx_clean_list(struct nic *nic)
                 for(rx = nic->rxs, i = 0; i < count; rx++, i++) {
                         if(rx->skb) {
                                 pci_unmap_single(nic->pdev, rx->dma_addr,
-                                        RFD_BUF_LEN, PCI_DMA_FROMDEVICE);
+                                        RFD_BUF_LEN, PCI_DMA_BIDIRECTIONAL);
                                 dev_kfree_skb(rx->skb);
                         }
                 }
@@ -2021,7 +2021,7 @@ static int e100_rx_alloc_list(struct nic *nic)
         before_last->command |= cpu_to_le16(cb_el);
         before_last->size = 0;
         pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
-                sizeof(struct rfd), PCI_DMA_TODEVICE);
+                sizeof(struct rfd), PCI_DMA_BIDIRECTIONAL);
 
         nic->rx_to_use = nic->rx_to_clean = nic->rxs;
         nic->ru_running = RU_SUSPENDED;
@@ -2222,7 +2222,7 @@ static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode)
         msleep(10);
 
         pci_dma_sync_single_for_cpu(nic->pdev, nic->rx_to_clean->dma_addr,
-                        RFD_BUF_LEN, PCI_DMA_FROMDEVICE);
+                        RFD_BUF_LEN, PCI_DMA_BIDIRECTIONAL);
 
         if(memcmp(nic->rx_to_clean->skb->data + sizeof(struct rfd),
            skb->data, ETH_DATA_LEN))
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index 6a3893acfe04..c854c96f5ab3 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -1774,7 +1774,8 @@ static void e1000_get_wol(struct net_device *netdev,
 
         /* this function will set ->supported = 0 and return 1 if wol is not
          * supported by this hardware */
-        if (e1000_wol_exclusion(adapter, wol))
+        if (e1000_wol_exclusion(adapter, wol) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return;
 
         /* apply any specific unsupported masks here */
@@ -1811,7 +1812,8 @@ static int e1000_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & (WAKE_PHY | WAKE_ARP | WAKE_MAGICSECURE))
                 return -EOPNOTSUPP;
 
-        if (e1000_wol_exclusion(adapter, wol))
+        if (e1000_wol_exclusion(adapter, wol) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return wol->wolopts ? -EOPNOTSUPP : 0;
 
         switch (hw->device_id) {
@@ -1838,6 +1840,8 @@ static int e1000_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & WAKE_MAGIC)
                 adapter->wol |= E1000_WUFC_MAG;
 
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
+
         return 0;
 }
 
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index fac82152e4c8..872799b746f5 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1179,6 +1179,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 
         /* initialize the wol settings based on the eeprom settings */
         adapter->wol = adapter->eeprom_wol;
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
         /* print bus type/speed/width info */
         DPRINTK(PROBE, INFO, "(PCI%s:%s:%s) ",
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index c55de1c027af..c55fd6fdb91c 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -299,6 +299,7 @@ struct e1000_adapter {
         unsigned long led_status;
 
         unsigned int flags;
+        unsigned int flags2;
         struct work_struct downshift_task;
         struct work_struct update_phy_task;
 };
@@ -306,6 +307,7 @@ struct e1000_adapter {
 struct e1000_info {
         enum e1000_mac_type     mac;
         unsigned int            flags;
+        unsigned int            flags2;
         u32                     pba;
         s32                     (*get_variants)(struct e1000_adapter *);
         struct e1000_mac_operations *mac_ops;
@@ -347,6 +349,9 @@ struct e1000_info {
 #define FLAG_RX_RESTART_NOW               (1 << 30)
 #define FLAG_MSI_TEST_FAILED              (1 << 31)
 
+/* CRC Stripping defines */
+#define FLAG2_CRC_STRIPPING               (1 << 0)
+
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
 #define E1000_GET_DESC(R, i, type)      (&(((struct type *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index 70c11c811a08..62421ce96311 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -1713,7 +1713,8 @@ static void e1000_get_wol(struct net_device *netdev,
         wol->supported = 0;
         wol->wolopts = 0;
 
-        if (!(adapter->flags & FLAG_HAS_WOL))
+        if (!(adapter->flags & FLAG_HAS_WOL) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return;
 
         wol->supported = WAKE_UCAST | WAKE_MCAST |
@@ -1751,7 +1752,8 @@ static int e1000_set_wol(struct net_device *netdev,
         if (wol->wolopts & WAKE_MAGICSECURE)
                 return -EOPNOTSUPP;
 
-        if (!(adapter->flags & FLAG_HAS_WOL))
+        if (!(adapter->flags & FLAG_HAS_WOL) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return wol->wolopts ? -EOPNOTSUPP : 0;
 
         /* these settings will always override what we currently have */
@@ -1770,6 +1772,8 @@ static int e1000_set_wol(struct net_device *netdev,
         if (wol->wolopts & WAKE_ARP)
                 adapter->wol |= E1000_WUFC_ARP;
 
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
+
         return 0;
 }
 
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index abd492b7336d..91795f78c3e4 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -499,6 +499,10 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                         goto next_desc;
                 }
 
+                /* adjust length to remove Ethernet CRC */
+                if (!(adapter->flags2 & FLAG2_CRC_STRIPPING))
+                        length -= 4;
+
                 total_rx_bytes += length;
                 total_rx_packets++;
 
@@ -804,6 +808,10 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         pci_dma_sync_single_for_device(pdev, ps_page->dma,
                                 PAGE_SIZE, PCI_DMA_FROMDEVICE);
 
+                        /* remove the CRC */
+                        if (!(adapter->flags2 & FLAG2_CRC_STRIPPING))
+                                l1 -= 4;
+
                         skb_put(skb, l1);
                         goto copydone;
                 } /* if */
@@ -825,6 +833,12 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         skb->truesize += length;
                 }
 
+                /* strip the ethernet crc, problem is we're using pages now so
+                 * this whole operation can get a little cpu intensive
+                 */
+                if (!(adapter->flags2 & FLAG2_CRC_STRIPPING))
+                        pskb_trim(skb, skb->len - 4);
+
 copydone:
                 total_rx_bytes += skb->len;
                 total_rx_packets++;
@@ -2301,8 +2315,12 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
         else
                 rctl |= E1000_RCTL_LPE;
 
-        /* Enable hardware CRC frame stripping */
-        rctl |= E1000_RCTL_SECRC;
+        /* Some systems expect that the CRC is included in SMBUS traffic. The
+         * hardware strips the CRC before sending to both SMBUS (BMC) and to
+         * host memory when this is enabled
+         */
+        if (adapter->flags2 & FLAG2_CRC_STRIPPING)
+                rctl |= E1000_RCTL_SECRC;
 
         /* Setup buffer sizes */
         rctl &= ~E1000_RCTL_SZ_4096;
@@ -4766,6 +4784,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         adapter->ei = ei;
         adapter->pba = ei->pba;
         adapter->flags = ei->flags;
+        adapter->flags2 = ei->flags2;
         adapter->hw.adapter = adapter;
         adapter->hw.mac.type = ei->mac;
         adapter->msg_enable = (1 << NETIF_MSG_DRV | NETIF_MSG_PROBE) - 1;
@@ -4970,6 +4989,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 
         /* initialize the wol settings based on the eeprom settings */
         adapter->wol = adapter->eeprom_wol;
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
         /* reset the hardware with the new settings */
         e1000e_reset(adapter);
@@ -5008,6 +5028,7 @@ err_hw_init:
 err_sw_init:
         if (adapter->hw.flash_address)
                 iounmap(adapter->hw.flash_address);
+        e1000e_reset_interrupt_capability(adapter);
 err_flashmap:
         iounmap(adapter->hw.hw_addr);
 err_ioremap:
diff --git a/drivers/net/e1000e/param.c b/drivers/net/e1000e/param.c
index 77a3d7207a5f..e909f96698e8 100644
--- a/drivers/net/e1000e/param.c
+++ b/drivers/net/e1000e/param.c
@@ -151,6 +151,16 @@ E1000_PARAM(KumeranLockLoss, "Enable Kumeran lock loss workaround");
  */
 E1000_PARAM(WriteProtectNVM, "Write-protect NVM [WARNING: disabling this can lead to corrupted NVM]");
 
+/*
+ * Enable CRC Stripping
+ *
+ * Valid Range: 0, 1
+ *
+ * Default Value: 1 (enabled)
+ */
+E1000_PARAM(CrcStripping, "Enable CRC Stripping, disable if your BMC needs " \
+                          "the CRC");
+
 struct e1000_option {
         enum { enable_option, range_option, list_option } type;
         const char *name;
@@ -404,6 +414,21 @@ void __devinit e1000e_check_options(struct e1000_adapter *adapter)
                                 adapter->flags |= FLAG_SMART_POWER_DOWN;
                 }
         }
+        { /* CRC Stripping */
+                const struct e1000_option opt = {
+                        .type = enable_option,
+                        .name = "CRC Stripping",
+                        .err  = "defaulting to enabled",
+                        .def  = OPTION_ENABLED
+                };
+
+                if (num_CrcStripping > bd) {
+                        unsigned int crc_stripping = CrcStripping[bd];
+                        e1000_validate_option(&crc_stripping, &opt, adapter);
+                        if (crc_stripping == OPTION_ENABLED)
+                                adapter->flags2 |= FLAG2_CRC_STRIPPING;
+                }
+        }
         { /* Kumeran Lock Loss Workaround */
                 const struct e1000_option opt = {
                         .type = enable_option,
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 83a5cb6aa23b..c4af949bf860 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1407,6 +1407,10 @@ static int gfar_clean_tx_ring(struct net_device *dev)
                 if (bdp->status & TXBD_DEF)
                         dev->stats.collisions++;
 
+                /* Unmap the DMA memory */
+                dma_unmap_single(&priv->dev->dev, bdp->bufPtr,
+                                bdp->length, DMA_TO_DEVICE);
+
                 /* Free the sk buffer associated with this TxBD */
                 dev_kfree_skb_irq(priv->tx_skbuff[priv->skb_dirtytx]);
 
@@ -1666,6 +1670,9 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
 
                 skb = priv->rx_skbuff[priv->skb_currx];
 
+                dma_unmap_single(&priv->dev->dev, bdp->bufPtr,
+                                priv->rx_buffer_size, DMA_FROM_DEVICE);
+
                 /* We drop the frame if we failed to allocate a new buffer */
                 if (unlikely(!newskb || !(bdp->status & RXBD_LAST) ||
                                  bdp->status & RXBD_ERR)) {
@@ -1674,14 +1681,8 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
                         if (unlikely(!newskb))
                                 newskb = skb;
 
-                        if (skb) {
-                                dma_unmap_single(&priv->dev->dev,
-                                                bdp->bufPtr,
-                                                priv->rx_buffer_size,
-                                                DMA_FROM_DEVICE);
-
+                        if (skb)
                                 dev_kfree_skb_any(skb);
-                        }
                 } else {
                         /* Increment the number of packets */
                         dev->stats.rx_packets++;
diff --git a/drivers/net/igb/igb_ethtool.c b/drivers/net/igb/igb_ethtool.c
index 58906c984be9..89964fa739a0 100644
--- a/drivers/net/igb/igb_ethtool.c
+++ b/drivers/net/igb/igb_ethtool.c
@@ -1776,7 +1776,8 @@ static void igb_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
 
         /* this function will set ->supported = 0 and return 1 if wol is not
          * supported by this hardware */
-        if (igb_wol_exclusion(adapter, wol))
+        if (igb_wol_exclusion(adapter, wol) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return;
 
         /* apply any specific unsupported masks here */
@@ -1805,7 +1806,8 @@ static int igb_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & (WAKE_PHY | WAKE_ARP | WAKE_MAGICSECURE))
                 return -EOPNOTSUPP;
 
-        if (igb_wol_exclusion(adapter, wol))
+        if (igb_wol_exclusion(adapter, wol) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return wol->wolopts ? -EOPNOTSUPP : 0;
 
         switch (hw->device_id) {
@@ -1825,6 +1827,8 @@ static int igb_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & WAKE_MAGIC)
                 adapter->wol |= E1000_WUFC_MAG;
 
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
+
         return 0;
 }
 
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 1f397cd99414..1cbae85b1426 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -1019,10 +1019,9 @@ static int __devinit igb_probe(struct pci_dev *pdev,
                         state &= ~PCIE_LINK_STATE_L0S;
                         pci_write_config_word(us_dev, pos + PCI_EXP_LNKCTL,
                                               state);
-                        printk(KERN_INFO "Disabling ASPM L0s upstream switch "
-                               "port %x:%x.%x\n", us_dev->bus->number,
-                               PCI_SLOT(us_dev->devfn),
-                               PCI_FUNC(us_dev->devfn));
+                        dev_info(&pdev->dev,
+                                 "Disabling ASPM L0s upstream switch port %s\n",
+                                 pci_name(us_dev));
                 }
         default:
                 break;
@@ -1244,6 +1243,7 @@ static int __devinit igb_probe(struct pci_dev *pdev,
 
         /* initialize the wol settings based on the eeprom settings */
         adapter->wol = adapter->eeprom_wol;
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
         /* reset the hardware with the new settings */
         igb_reset(adapter);
diff --git a/drivers/net/mlx4/en_netdev.c b/drivers/net/mlx4/en_netdev.c
index a3f732418c49..96e709d6440a 100644
--- a/drivers/net/mlx4/en_netdev.c
+++ b/drivers/net/mlx4/en_netdev.c
@@ -656,10 +656,10 @@ static int mlx4_en_start_port(struct net_device *dev)
         /* Configure port */
         err = mlx4_SET_PORT_general(mdev->dev, priv->port,
                                     priv->rx_skb_size + ETH_FCS_LEN,
-                                    mdev->profile.tx_pause,
-                                    mdev->profile.tx_ppp,
-                                    mdev->profile.rx_pause,
-                                    mdev->profile.rx_ppp);
+                                    priv->prof->tx_pause,
+                                    priv->prof->tx_ppp,
+                                    priv->prof->rx_pause,
+                                    priv->prof->rx_ppp);
         if (err) {
                 mlx4_err(mdev, "Failed setting port general configurations"
                                " for port %d, with error %d\n", priv->port, err);
diff --git a/drivers/net/mlx4/en_params.c b/drivers/net/mlx4/en_params.c
index c2e69b1bcd0a..95706ee1c019 100644
--- a/drivers/net/mlx4/en_params.c
+++ b/drivers/net/mlx4/en_params.c
@@ -90,6 +90,7 @@ MLX4_EN_PARM_INT(rx_ring_size2, MLX4_EN_AUTO_CONF, "Rx ring size for port 2");
 int mlx4_en_get_profile(struct mlx4_en_dev *mdev)
 {
         struct mlx4_en_profile *params = &mdev->profile;
+        int i;
 
         params->rx_moder_cnt = min_t(int, rx_moder_cnt, MLX4_EN_AUTO_CONF);
         params->rx_moder_time = min_t(int, rx_moder_time, MLX4_EN_AUTO_CONF);
@@ -97,11 +98,13 @@ int mlx4_en_get_profile(struct mlx4_en_dev *mdev)
         params->rss_xor = (rss_xor != 0);
         params->rss_mask = rss_mask & 0x1f;
         params->num_lro = min_t(int, num_lro , MLX4_EN_MAX_LRO_DESCRIPTORS);
-        params->rx_pause = pprx;
-        params->rx_ppp = pfcrx;
-        params->tx_pause = pptx;
-        params->tx_ppp = pfctx;
-        if (params->rx_ppp || params->tx_ppp) {
+        for (i = 1; i <= MLX4_MAX_PORTS; i++) {
+                params->prof[i].rx_pause = pprx;
+                params->prof[i].rx_ppp = pfcrx;
+                params->prof[i].tx_pause = pptx;
+                params->prof[i].tx_ppp = pfctx;
+        }
+        if (pfcrx || pfctx) {
                 params->prof[1].tx_ring_num = MLX4_EN_TX_RING_NUM;
                 params->prof[2].tx_ring_num = MLX4_EN_TX_RING_NUM;
         } else {
@@ -407,14 +410,14 @@ static int mlx4_en_set_pauseparam(struct net_device *dev,
         struct mlx4_en_dev *mdev = priv->mdev;
         int err;
 
-        mdev->profile.tx_pause = pause->tx_pause != 0;
-        mdev->profile.rx_pause = pause->rx_pause != 0;
+        priv->prof->tx_pause = pause->tx_pause != 0;
+        priv->prof->rx_pause = pause->rx_pause != 0;
         err = mlx4_SET_PORT_general(mdev->dev, priv->port,
                                     priv->rx_skb_size + ETH_FCS_LEN,
-                                    mdev->profile.tx_pause,
-                                    mdev->profile.tx_ppp,
-                                    mdev->profile.rx_pause,
-                                    mdev->profile.rx_ppp);
+                                    priv->prof->tx_pause,
+                                    priv->prof->tx_ppp,
+                                    priv->prof->rx_pause,
+                                    priv->prof->rx_ppp);
         if (err)
                 mlx4_err(mdev, "Failed setting pause params to\n");
 
@@ -425,10 +428,9 @@ static void mlx4_en_get_pauseparam(struct net_device *dev,
                                  struct ethtool_pauseparam *pause)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
-        struct mlx4_en_dev *mdev = priv->mdev;
 
-        pause->tx_pause = mdev->profile.tx_pause;
-        pause->rx_pause = mdev->profile.rx_pause;
+        pause->tx_pause = priv->prof->tx_pause;
+        pause->rx_pause = priv->prof->rx_pause;
 }
 
 static void mlx4_en_get_ringparam(struct net_device *dev,
diff --git a/drivers/net/mlx4/mlx4_en.h b/drivers/net/mlx4/mlx4_en.h
index 11fb17c6e97b..98ddc0811f93 100644
--- a/drivers/net/mlx4/mlx4_en.h
+++ b/drivers/net/mlx4/mlx4_en.h
@@ -322,6 +322,10 @@ struct mlx4_en_port_profile {
         u32 rx_ring_num;
         u32 tx_ring_size;
         u32 rx_ring_size;
+        u8 rx_pause;
+        u8 rx_ppp;
+        u8 tx_pause;
+        u8 tx_ppp;
 };
 
 struct mlx4_en_profile {
@@ -333,10 +337,6 @@ struct mlx4_en_profile {
         int rx_moder_cnt;
         int rx_moder_time;
         int auto_moder;
-        u8 rx_pause;
-        u8 rx_ppp;
-        u8 tx_pause;
-        u8 tx_ppp;
         u8 no_reset;
         struct mlx4_en_port_profile prof[MLX4_MAX_PORTS + 1];
 };
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index d8463b1c3df3..1b6f548c4411 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -33,8 +33,8 @@
 
 #define DRV_MODULE_NAME         "niu"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "0.9"
-#define DRV_MODULE_RELDATE      "May 4, 2008"
+#define DRV_MODULE_VERSION      "1.0"
+#define DRV_MODULE_RELDATE      "Nov 14, 2008"
 
 static char version[] __devinitdata =
         DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
@@ -406,7 +406,7 @@ static int esr2_set_rx_cfg(struct niu *np, unsigned long channel, u32 val)
 }
 
 /* Mode is always 10G fiber.  */
-static int serdes_init_niu(struct niu *np)
+static int serdes_init_niu_10g_fiber(struct niu *np)
 {
         struct niu_link_config *lp = &np->link_config;
         u32 tx_cfg, rx_cfg;
@@ -443,6 +443,223 @@ static int serdes_init_niu(struct niu *np)
         return 0;
 }
 
+static int serdes_init_niu_1g_serdes(struct niu *np)
+{
+        struct niu_link_config *lp = &np->link_config;
+        u16 pll_cfg, pll_sts;
+        int max_retry = 100;
+        u64 sig, mask, val;
+        u32 tx_cfg, rx_cfg;
+        unsigned long i;
+        int err;
+
+        tx_cfg = (PLL_TX_CFG_ENTX | PLL_TX_CFG_SWING_1375MV |
+                  PLL_TX_CFG_RATE_HALF);
+        rx_cfg = (PLL_RX_CFG_ENRX | PLL_RX_CFG_TERM_0P8VDDT |
+                  PLL_RX_CFG_ALIGN_ENA | PLL_RX_CFG_LOS_LTHRESH |
+                  PLL_RX_CFG_RATE_HALF);
+
+        if (np->port == 0)
+                rx_cfg |= PLL_RX_CFG_EQ_LP_ADAPTIVE;
+
+        if (lp->loopback_mode == LOOPBACK_PHY) {
+                u16 test_cfg = PLL_TEST_CFG_LOOPBACK_CML_DIS;
+
+                mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                           ESR2_TI_PLL_TEST_CFG_L, test_cfg);
+
+                tx_cfg |= PLL_TX_CFG_ENTEST;
+                rx_cfg |= PLL_RX_CFG_ENTEST;
+        }
+
+        /* Initialize PLL for 1G */
+        pll_cfg = (PLL_CFG_ENPLL | PLL_CFG_MPY_8X);
+
+        err = mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                         ESR2_TI_PLL_CFG_L, pll_cfg);
+        if (err) {
+                dev_err(np->device, PFX "NIU Port %d "
+                        "serdes_init_niu_1g_serdes: "
+                        "mdio write to ESR2_TI_PLL_CFG_L failed", np->port);
+                return err;
+        }
+
+        pll_sts = PLL_CFG_ENPLL;
+
+        err = mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                         ESR2_TI_PLL_STS_L, pll_sts);
+        if (err) {
+                dev_err(np->device, PFX "NIU Port %d "
+                        "serdes_init_niu_1g_serdes: "
+                        "mdio write to ESR2_TI_PLL_STS_L failed", np->port);
+                return err;
+        }
+
+        udelay(200);
+
+        /* Initialize all 4 lanes of the SERDES.  */
+        for (i = 0; i < 4; i++) {
+                err = esr2_set_tx_cfg(np, i, tx_cfg);
+                if (err)
+                        return err;
+        }
+
+        for (i = 0; i < 4; i++) {
+                err = esr2_set_rx_cfg(np, i, rx_cfg);
+                if (err)
+                        return err;
+        }
+
+        switch (np->port) {
+        case 0:
+                val = (ESR_INT_SRDY0_P0 | ESR_INT_DET0_P0);
+                mask = val;
+                break;
+
+        case 1:
+                val = (ESR_INT_SRDY0_P1 | ESR_INT_DET0_P1);
+                mask = val;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        while (max_retry--) {
+                sig = nr64(ESR_INT_SIGNALS);
+                if ((sig & mask) == val)
+                        break;
+
+                mdelay(500);
+        }
+
+        if ((sig & mask) != val) {
+                dev_err(np->device, PFX "Port %u signal bits [%08x] are not "
+                        "[%08x]\n", np->port, (int) (sig & mask), (int) val);
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+static int serdes_init_niu_10g_serdes(struct niu *np)
+{
+        struct niu_link_config *lp = &np->link_config;
+        u32 tx_cfg, rx_cfg, pll_cfg, pll_sts;
+        int max_retry = 100;
+        u64 sig, mask, val;
+        unsigned long i;
+        int err;
+
+        tx_cfg = (PLL_TX_CFG_ENTX | PLL_TX_CFG_SWING_1375MV);
+        rx_cfg = (PLL_RX_CFG_ENRX | PLL_RX_CFG_TERM_0P8VDDT |
+                  PLL_RX_CFG_ALIGN_ENA | PLL_RX_CFG_LOS_LTHRESH |
+                  PLL_RX_CFG_EQ_LP_ADAPTIVE);
+
+        if (lp->loopback_mode == LOOPBACK_PHY) {
+                u16 test_cfg = PLL_TEST_CFG_LOOPBACK_CML_DIS;
+
+                mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                           ESR2_TI_PLL_TEST_CFG_L, test_cfg);
+
+                tx_cfg |= PLL_TX_CFG_ENTEST;
+                rx_cfg |= PLL_RX_CFG_ENTEST;
+        }
+
+        /* Initialize PLL for 10G */
+        pll_cfg = (PLL_CFG_ENPLL | PLL_CFG_MPY_10X);
+
+        err = mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                         ESR2_TI_PLL_CFG_L, pll_cfg & 0xffff);
+        if (err) {
+                dev_err(np->device, PFX "NIU Port %d "
+                        "serdes_init_niu_10g_serdes: "
+                        "mdio write to ESR2_TI_PLL_CFG_L failed", np->port);
+                return err;
+        }
+
+        pll_sts = PLL_CFG_ENPLL;
+
+        err = mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                         ESR2_TI_PLL_STS_L, pll_sts & 0xffff);
+        if (err) {
+                dev_err(np->device, PFX "NIU Port %d "
+                        "serdes_init_niu_10g_serdes: "
+                        "mdio write to ESR2_TI_PLL_STS_L failed", np->port);
+                return err;
+        }
+
+        udelay(200);
+
+        /* Initialize all 4 lanes of the SERDES.  */
+        for (i = 0; i < 4; i++) {
+                err = esr2_set_tx_cfg(np, i, tx_cfg);
+                if (err)
+                        return err;
+        }
+
+        for (i = 0; i < 4; i++) {
+                err = esr2_set_rx_cfg(np, i, rx_cfg);
+                if (err)
+                        return err;
+        }
+
+        /* check if serdes is ready */
+
+        switch (np->port) {
+        case 0:
+                mask = ESR_INT_SIGNALS_P0_BITS;
+                val = (ESR_INT_SRDY0_P0 |
+                       ESR_INT_DET0_P0 |
+                       ESR_INT_XSRDY_P0 |
+                       ESR_INT_XDP_P0_CH3 |
+                       ESR_INT_XDP_P0_CH2 |
+                       ESR_INT_XDP_P0_CH1 |
+                       ESR_INT_XDP_P0_CH0);
+                break;
+
+        case 1:
+                mask = ESR_INT_SIGNALS_P1_BITS;
+                val = (ESR_INT_SRDY0_P1 |
+                       ESR_INT_DET0_P1 |
+                       ESR_INT_XSRDY_P1 |
+                       ESR_INT_XDP_P1_CH3 |
+                       ESR_INT_XDP_P1_CH2 |
+                       ESR_INT_XDP_P1_CH1 |
+                       ESR_INT_XDP_P1_CH0);
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        while (max_retry--) {
+                sig = nr64(ESR_INT_SIGNALS);
+                if ((sig & mask) == val)
+                        break;
+
+                mdelay(500);
+        }
+
+        if ((sig & mask) != val) {
+                pr_info(PFX "NIU Port %u signal bits [%08x] are not "
+                        "[%08x] for 10G...trying 1G\n",
+                        np->port, (int) (sig & mask), (int) val);
+
+                /* 10G failed, try initializing at 1G */
+                err = serdes_init_niu_1g_serdes(np);
+                if (!err) {
+                        np->flags &= ~NIU_FLAGS_10G;
+                        np->mac_xcvr = MAC_XCVR_PCS;
+                }  else {
+                        dev_err(np->device, PFX "Port %u 10G/1G SERDES "
+                                "Link Failed \n", np->port);
+                        return -ENODEV;
+                }
+        }
+        return 0;
+}
+
 static int esr_read_rxtx_ctrl(struct niu *np, unsigned long chan, u32 *val)
 {
         int err;
@@ -1954,13 +2171,23 @@ static const struct niu_phy_ops phy_ops_10g_serdes = {
         .link_status            = link_status_10g_serdes,
 };
 
+static const struct niu_phy_ops phy_ops_10g_serdes_niu = {
+        .serdes_init            = serdes_init_niu_10g_serdes,
+        .link_status            = link_status_10g_serdes,
+};
+
+static const struct niu_phy_ops phy_ops_1g_serdes_niu = {
+        .serdes_init            = serdes_init_niu_1g_serdes,
+        .link_status            = link_status_1g_serdes,
+};
+
 static const struct niu_phy_ops phy_ops_1g_rgmii = {
         .xcvr_init              = xcvr_init_1g_rgmii,
         .link_status            = link_status_1g_rgmii,
 };
 
 static const struct niu_phy_ops phy_ops_10g_fiber_niu = {
-        .serdes_init            = serdes_init_niu,
+        .serdes_init            = serdes_init_niu_10g_fiber,
         .xcvr_init              = xcvr_init_10g,
         .link_status            = link_status_10g,
 };
@@ -1998,11 +2225,21 @@ struct niu_phy_template {
         u32                             phy_addr_base;
 };
 
-static const struct niu_phy_template phy_template_niu = {
+static const struct niu_phy_template phy_template_niu_10g_fiber = {
         .ops            = &phy_ops_10g_fiber_niu,
         .phy_addr_base  = 16,
 };
 
+static const struct niu_phy_template phy_template_niu_10g_serdes = {
+        .ops            = &phy_ops_10g_serdes_niu,
+        .phy_addr_base  = 0,
+};
+
+static const struct niu_phy_template phy_template_niu_1g_serdes = {
+        .ops            = &phy_ops_1g_serdes_niu,
+        .phy_addr_base  = 0,
+};
+
 static const struct niu_phy_template phy_template_10g_fiber = {
         .ops            = &phy_ops_10g_fiber,
         .phy_addr_base  = 8,
@@ -2182,8 +2419,25 @@ static int niu_determine_phy_disposition(struct niu *np)
         u32 phy_addr_off = 0;
 
         if (plat_type == PLAT_TYPE_NIU) {
-                tp = &phy_template_niu;
-                phy_addr_off += np->port;
+                switch (np->flags &
+                        (NIU_FLAGS_10G |
+                         NIU_FLAGS_FIBER |
+                         NIU_FLAGS_XCVR_SERDES)) {
+                case NIU_FLAGS_10G | NIU_FLAGS_XCVR_SERDES:
+                        /* 10G Serdes */
+                        tp = &phy_template_niu_10g_serdes;
+                        break;
+                case NIU_FLAGS_XCVR_SERDES:
+                        /* 1G Serdes */
+                        tp = &phy_template_niu_1g_serdes;
+                        break;
+                case NIU_FLAGS_10G | NIU_FLAGS_FIBER:
+                        /* 10G Fiber */
+                default:
+                        tp = &phy_template_niu_10g_fiber;
+                        phy_addr_off += np->port;
+                        break;
+                }
         } else {
                 switch (np->flags &
                         (NIU_FLAGS_10G |
@@ -7213,6 +7467,12 @@ static int __devinit niu_phy_type_prop_decode(struct niu *np,
                 np->flags |= NIU_FLAGS_10G;
                 np->flags &= ~NIU_FLAGS_FIBER;
                 np->mac_xcvr = MAC_XCVR_XPCS;
+        } else if (!strcmp(phy_prop, "xgsd") || !strcmp(phy_prop, "gsd")) {
+                /* 10G Serdes or 1G Serdes, default to 10G */
+                np->flags |= NIU_FLAGS_10G;
+                np->flags &= ~NIU_FLAGS_FIBER;
+                np->flags |= NIU_FLAGS_XCVR_SERDES;
+                np->mac_xcvr = MAC_XCVR_XPCS;
         } else {
                 return -EINVAL;
         }
@@ -7741,6 +8001,8 @@ static int __devinit walk_phys(struct niu *np, struct niu_parent *parent)
         u32 val;
         int err;
 
+        num_10g = num_1g = 0;
+
         if (!strcmp(np->vpd.model, NIU_ALONSO_MDL_STR) ||
             !strcmp(np->vpd.model, NIU_KIMI_MDL_STR)) {
                 num_10g = 0;
@@ -7757,6 +8019,16 @@ static int __devinit walk_phys(struct niu *np, struct niu_parent *parent)
                 parent->num_ports = 2;
                 val = (phy_encode(PORT_TYPE_10G, 0) |
                        phy_encode(PORT_TYPE_10G, 1));
+        } else if ((np->flags & NIU_FLAGS_XCVR_SERDES) &&
+                   (parent->plat_type == PLAT_TYPE_NIU)) {
+                /* this is the Monza case */
+                if (np->flags & NIU_FLAGS_10G) {
+                        val = (phy_encode(PORT_TYPE_10G, 0) |
+                               phy_encode(PORT_TYPE_10G, 1));
+                } else {
+                        val = (phy_encode(PORT_TYPE_1G, 0) |
+                               phy_encode(PORT_TYPE_1G, 1));
+                }
         } else {
                 err = fill_phy_probe_info(np, parent, info);
                 if (err)
@@ -8656,7 +8928,9 @@ static void __devinit niu_device_announce(struct niu *np)
                                 dev->name,
                                 (np->flags & NIU_FLAGS_XMAC ? "XMAC" : "BMAC"),
                                 (np->flags & NIU_FLAGS_10G ? "10G" : "1G"),
-                                (np->flags & NIU_FLAGS_FIBER ? "FIBER" : "COPPER"),
+                                (np->flags & NIU_FLAGS_FIBER ? "FIBER" :
+                                 (np->flags & NIU_FLAGS_XCVR_SERDES ? "SERDES" :
+                                  "COPPER")),
                                 (np->mac_xcvr == MAC_XCVR_MII ? "MII" :
                                  (np->mac_xcvr == MAC_XCVR_PCS ? "PCS" : "XPCS")),
                                 np->vpd.phy_type);
diff --git a/drivers/net/niu.h b/drivers/net/niu.h
index c6fa883daa22..180ca8ae93de 100644
--- a/drivers/net/niu.h
+++ b/drivers/net/niu.h
@@ -1048,6 +1048,13 @@
 #define  PLL_CFG_LD_SHIFT               8
 #define  PLL_CFG_MPY                    0x0000001e
 #define  PLL_CFG_MPY_SHIFT              1
+#define  PLL_CFG_MPY_4X         0x0
+#define  PLL_CFG_MPY_5X         0x00000002
+#define  PLL_CFG_MPY_6X         0x00000004
+#define  PLL_CFG_MPY_8X         0x00000008
+#define  PLL_CFG_MPY_10X                0x0000000a
+#define  PLL_CFG_MPY_12X                0x0000000c
+#define  PLL_CFG_MPY_12P5X              0x0000000e
 #define  PLL_CFG_ENPLL                  0x00000001
 
 #define ESR2_TI_PLL_STS_L               (ESR2_BASE + 0x002)
@@ -1093,6 +1100,9 @@
 #define  PLL_TX_CFG_INVPAIR             0x00000080
 #define  PLL_TX_CFG_RATE                0x00000060
 #define  PLL_TX_CFG_RATE_SHIFT          5
+#define  PLL_TX_CFG_RATE_FULL           0x0
+#define  PLL_TX_CFG_RATE_HALF           0x20
+#define  PLL_TX_CFG_RATE_QUAD           0x40
 #define  PLL_TX_CFG_BUSWIDTH            0x0000001c
 #define  PLL_TX_CFG_BUSWIDTH_SHIFT      2
 #define  PLL_TX_CFG_ENTEST              0x00000002
@@ -1132,6 +1142,9 @@
 #define  PLL_RX_CFG_INVPAIR             0x00000080
 #define  PLL_RX_CFG_RATE                0x00000060
 #define  PLL_RX_CFG_RATE_SHIFT          5
+#define  PLL_RX_CFG_RATE_FULL           0x0
+#define  PLL_RX_CFG_RATE_HALF           0x20
+#define  PLL_RX_CFG_RATE_QUAD           0x40
 #define  PLL_RX_CFG_BUSWIDTH            0x0000001c
 #define  PLL_RX_CFG_BUSWIDTH_SHIFT      2
 #define  PLL_RX_CFG_ENTEST              0x00000002
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 4aa547947040..eb6411c4694f 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -227,6 +227,59 @@ static int m88e1111_config_init(struct phy_device *phydev)
         return 0;
 }
 
+static int m88e1118_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, MII_M1011_PHY_SCR,
+                        MII_M1011_PHY_SCR_AUTO_CROSS);
+        if (err < 0)
+                return err;
+
+        err = genphy_config_aneg(phydev);
+        return 0;
+}
+
+static int m88e1118_config_init(struct phy_device *phydev)
+{
+        int err;
+
+        /* Change address */
+        err = phy_write(phydev, 0x16, 0x0002);
+        if (err < 0)
+                return err;
+
+        /* Enable 1000 Mbit */
+        err = phy_write(phydev, 0x15, 0x1070);
+        if (err < 0)
+                return err;
+
+        /* Change address */
+        err = phy_write(phydev, 0x16, 0x0003);
+        if (err < 0)
+                return err;
+
+        /* Adjust LED Control */
+        err = phy_write(phydev, 0x10, 0x021e);
+        if (err < 0)
+                return err;
+
+        /* Reset address */
+        err = phy_write(phydev, 0x16, 0x0);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
 static int m88e1145_config_init(struct phy_device *phydev)
 {
         int err;
@@ -416,6 +469,19 @@ static struct phy_driver marvell_drivers[] = {
                 .driver = { .owner = THIS_MODULE },
         },
         {
+                .phy_id = 0x01410e10,
+                .phy_id_mask = 0xfffffff0,
+                .name = "Marvell 88E1118",
+                .features = PHY_GBIT_FEATURES,
+                .flags = PHY_HAS_INTERRUPT,
+                .config_init = &m88e1118_config_init,
+                .config_aneg = &m88e1118_config_aneg,
+                .read_status = &genphy_read_status,
+                .ack_interrupt = &marvell_ack_interrupt,
+                .config_intr = &marvell_config_intr,
+                .driver = {.owner = THIS_MODULE,},
+        },
+        {
                 .phy_id = 0x01410cd0,
                 .phy_id_mask = 0xfffffff0,
                 .name = "Marvell 88E1145",
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index d0ed1ef284a8..536bda1f428b 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -136,7 +136,7 @@ void mdiobus_unregister(struct mii_bus *bus)
         BUG_ON(bus->state != MDIOBUS_REGISTERED);
         bus->state = MDIOBUS_UNREGISTERED;
 
-        device_unregister(&bus->dev);
+        device_del(&bus->dev);
         for (i = 0; i < PHY_MAX_ADDR; i++) {
                 if (bus->phy_map[i])
                         device_unregister(&bus->phy_map[i]->dev);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index e11b03b2b25a..8fb1faca883a 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -227,8 +227,8 @@ struct phy_device * get_phy_device(struct mii_bus *bus, int addr)
         if (r)
                 return ERR_PTR(r);
 
-        /* If the phy_id is all Fs, there is no device there */
-        if (0xffffffff == phy_id)
+        /* If the phy_id is all Fs or all 0s, there is no device there */
+        if ((0xffff == phy_id) || (0x00 == phy_id))
                 return NULL;
 
         dev = phy_device_create(bus, addr, phy_id);
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index 3cdd07c45b6d..508452c02151 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -1515,9 +1515,6 @@ static u32 ql_get_link_state(struct ql3_adapter *qdev)
                 linkState = LS_UP;
         } else {
                 linkState = LS_DOWN;
-                if (netif_msg_link(qdev))
-                        printk(KERN_WARNING PFX
-                               "%s: Link is down.\n", qdev->ndev->name);
         }
         return linkState;
 }
@@ -1581,10 +1578,6 @@ static int ql_finish_auto_neg(struct ql3_adapter *qdev)
                         ql_mac_enable(qdev, 1);
                 }
 
-                if (netif_msg_link(qdev))
-                        printk(KERN_DEBUG PFX
-                               "%s: Change port_link_state LS_DOWN to LS_UP.\n",
-                               qdev->ndev->name);
                 qdev->port_link_state = LS_UP;
                 netif_start_queue(qdev->ndev);
                 netif_carrier_on(qdev->ndev);
@@ -1655,14 +1648,9 @@ static void ql_link_state_machine_work(struct work_struct *work)
                 /* Fall Through */
 
         case LS_DOWN:
-                if (netif_msg_link(qdev))
-                        printk(KERN_DEBUG PFX
-                               "%s: port_link_state = LS_DOWN.\n",
-                               qdev->ndev->name);
                 if (curr_link_state == LS_UP) {
                         if (netif_msg_link(qdev))
-                                printk(KERN_DEBUG PFX
-                                       "%s: curr_link_state = LS_UP.\n",
+                                printk(KERN_INFO PFX "%s: Link is up.\n",
                                        qdev->ndev->name);
                         if (ql_is_auto_neg_complete(qdev))
                                 ql_finish_auto_neg(qdev);
@@ -1670,6 +1658,7 @@ static void ql_link_state_machine_work(struct work_struct *work)
                         if (qdev->port_link_state == LS_UP)
                                 ql_link_down_detect_clear(qdev);
 
+                        qdev->port_link_state = LS_UP;
                 }
                 break;
 
@@ -1678,12 +1667,14 @@ static void ql_link_state_machine_work(struct work_struct *work)
                  * See if the link is currently down or went down and came
                  * back up
                  */
-                if ((curr_link_state == LS_DOWN) || ql_link_down_detect(qdev)) {
+                if (curr_link_state == LS_DOWN) {
                         if (netif_msg_link(qdev))
                                 printk(KERN_INFO PFX "%s: Link is down.\n",
                                        qdev->ndev->name);
                         qdev->port_link_state = LS_DOWN;
                 }
+                if (ql_link_down_detect(qdev))
+                        qdev->port_link_state = LS_DOWN;
                 break;
         }
         spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
diff --git a/drivers/net/ucc_geth_ethtool.c b/drivers/net/ucc_geth_ethtool.c
index 85f38a6b6a49..68a7f5414133 100644
--- a/drivers/net/ucc_geth_ethtool.c
+++ b/drivers/net/ucc_geth_ethtool.c
@@ -323,17 +323,17 @@ static void uec_get_ethtool_stats(struct net_device *netdev,
         if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_HARDWARE) {
                 base = (u32 __iomem *)&ugeth->ug_regs->tx64;
                 for (i = 0; i < UEC_HW_STATS_LEN; i++)
-                        data[j++] = (u64)in_be32(&base[i]);
+                        data[j++] = in_be32(&base[i]);
         }
         if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_TX) {
                 base = (u32 __iomem *)ugeth->p_tx_fw_statistics_pram;
                 for (i = 0; i < UEC_TX_FW_STATS_LEN; i++)
-                        data[j++] = (u64)in_be32(&base[i]);
+                        data[j++] = base ? in_be32(&base[i]) : 0;
         }
         if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX) {
                 base = (u32 __iomem *)ugeth->p_rx_fw_statistics_pram;
                 for (i = 0; i < UEC_RX_FW_STATS_LEN; i++)
-                        data[j++] = (u64)in_be32(&base[i]);
+                        data[j++] = base ? in_be32(&base[i]) : 0;
         }
 }
 
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 3590ea5a902d..11cb3e504e1c 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -2296,7 +2296,7 @@ static void velocity_set_multi(struct net_device *dev)
                 }
 
                 mac_set_cam_mask(regs, vptr->mCAMmask);
-                rx_mode = (RCR_AM | RCR_AB);
+                rx_mode = RCR_AM | RCR_AB | RCR_AP;
         }
         if (dev->mtu > 1500)
                 rx_mode |= RCR_AL;
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index dcce9f5d8465..4a110b7b2673 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -351,10 +351,11 @@ int verify_cis_cache(struct pcmcia_socket *s)
         char *buf;
 
         buf = kmalloc(256, GFP_KERNEL);
-        if (buf == NULL)
+        if (buf == NULL) {
                 dev_printk(KERN_WARNING, &s->dev,
                            "no memory for verifying CIS\n");
                 return -ENOMEM;
+        }
         list_for_each_entry(cis, &s->cis_cache, node) {
                 int len = cis->len;
 
diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
index c68c5d338285..0660ad182589 100644
--- a/drivers/pcmcia/cs.c
+++ b/drivers/pcmcia/cs.c
@@ -186,12 +186,6 @@ int pcmcia_register_socket(struct pcmcia_socket *socket)
 
         spin_lock_init(&socket->lock);
 
-        if (socket->resource_ops->init) {
-                ret = socket->resource_ops->init(socket);
-                if (ret)
-                        return (ret);
-        }
-
         /* try to obtain a socket number [yes, it gets ugly if we
          * register more than 2^sizeof(unsigned int) pcmcia
          * sockets... but the socket number is deprecated
@@ -226,7 +220,7 @@ int pcmcia_register_socket(struct pcmcia_socket *socket)
         /* set proper values in socket->dev */
         dev_set_drvdata(&socket->dev, socket);
         socket->dev.class = &pcmcia_socket_class;
-        snprintf(socket->dev.bus_id, BUS_ID_SIZE, "pcmcia_socket%u", socket->sock);
+        dev_set_name(&socket->dev, "pcmcia_socket%u", socket->sock);
 
         /* base address = 0, map = 0 */
         socket->cis_mem.flags = 0;
@@ -239,6 +233,12 @@ int pcmcia_register_socket(struct pcmcia_socket *socket)
         mutex_init(&socket->skt_mutex);
         spin_lock_init(&socket->thread_lock);
 
+        if (socket->resource_ops->init) {
+                ret = socket->resource_ops->init(socket);
+                if (ret)
+                        goto err;
+        }
+
         tsk = kthread_run(pccardd, socket, "pccardd");
         if (IS_ERR(tsk)) {
                 ret = PTR_ERR(tsk);
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 795660255490..47cab31ff6e4 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -622,7 +622,6 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
 {
         struct pcmcia_device *p_dev, *tmp_dev;
         unsigned long flags;
-        int bus_id_len;
 
         s = pcmcia_get_socket(s);
         if (!s)
@@ -650,12 +649,12 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
         /* by default don't allow DMA */
         p_dev->dma_mask = DMA_MASK_NONE;
         p_dev->dev.dma_mask = &p_dev->dma_mask;
-        bus_id_len = sprintf (p_dev->dev.bus_id, "%d.%d", p_dev->socket->sock, p_dev->device_no);
-
-        p_dev->devname = kmalloc(6 + bus_id_len + 1, GFP_KERNEL);
+        dev_set_name(&p_dev->dev, "%d.%d", p_dev->socket->sock, p_dev->device_no);
+        if (!dev_name(&p_dev->dev))
+                goto err_free;
+        p_dev->devname = kasprintf(GFP_KERNEL, "pcmcia%s", dev_name(&p_dev->dev));
         if (!p_dev->devname)
                 goto err_free;
-        sprintf (p_dev->devname, "pcmcia%s", p_dev->dev.bus_id);
         ds_dev_dbg(3, &p_dev->dev, "devname is %s\n", p_dev->devname);
 
         spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
@@ -668,6 +667,8 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
         list_for_each_entry(tmp_dev, &s->devices_list, socket_device_list)
                 if (p_dev->func == tmp_dev->func) {
                         p_dev->function_config = tmp_dev->function_config;
+                        p_dev->io = tmp_dev->io;
+                        p_dev->irq = tmp_dev->irq;
                         kref_get(&p_dev->function_config->ref);
                 }
 
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 76d4a98f0955..f5d0ba8e22d5 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -302,9 +302,10 @@ int pcmcia_modify_configuration(struct pcmcia_device *p_dev,
         /* We only allow changing Vpp1 and Vpp2 to the same value */
         if ((mod->Attributes & CONF_VPP1_CHANGE_VALID) &&
             (mod->Attributes & CONF_VPP2_CHANGE_VALID)) {
-                if (mod->Vpp1 != mod->Vpp2)
+                if (mod->Vpp1 != mod->Vpp2) {
                         ds_dbg(s, 0, "Vpp1 and Vpp2 must be the same\n");
                         return -EINVAL;
+                }
                 s->socket.Vpp = mod->Vpp1;
                 if (s->ops->set_socket(s, &s->socket)) {
                         dev_printk(KERN_WARNING, &s->dev,
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index 17f4ecf1c0c5..9ca22c7aafb2 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -71,7 +71,7 @@ static DEFINE_MUTEX(rsrc_mutex);
 ======================================================================*/
 
 static struct resource *
-make_resource(resource_size_t b, resource_size_t n, int flags, char *name)
+make_resource(resource_size_t b, resource_size_t n, int flags, const char *name)
 {
         struct resource *res = kzalloc(sizeof(*res), GFP_KERNEL);
 
@@ -624,7 +624,7 @@ static int nonstatic_adjust_io_region(struct resource *res, unsigned long r_star
 static struct resource *nonstatic_find_io_region(unsigned long base, int num,
                    unsigned long align, struct pcmcia_socket *s)
 {
-        struct resource *res = make_resource(0, num, IORESOURCE_IO, s->dev.bus_id);
+        struct resource *res = make_resource(0, num, IORESOURCE_IO, dev_name(&s->dev));
         struct socket_data *s_data = s->resource_data;
         struct pcmcia_align_data data;
         unsigned long min = base;
@@ -658,7 +658,7 @@ static struct resource *nonstatic_find_io_region(unsigned long base, int num,
 static struct resource * nonstatic_find_mem_region(u_long base, u_long num,
                 u_long align, int low, struct pcmcia_socket *s)
 {
-        struct resource *res = make_resource(0, num, IORESOURCE_MEM, s->dev.bus_id);
+        struct resource *res = make_resource(0, num, IORESOURCE_MEM, dev_name(&s->dev));
         struct socket_data *s_data = s->resource_data;
         struct pcmcia_align_data data;
         unsigned long min, max;
diff --git a/drivers/rtc/rtc-sun4v.c b/drivers/rtc/rtc-sun4v.c
index 2012ccbb4a53..5b2261052a65 100644
--- a/drivers/rtc/rtc-sun4v.c
+++ b/drivers/rtc/rtc-sun4v.c
@@ -1,4 +1,4 @@
-/* rtc-sun4c.c: Hypervisor based RTC for SUN4V systems.
+/* rtc-sun4v.c: Hypervisor based RTC for SUN4V systems.
  *
  * Copyright (C) 2008 David S. Miller <davem@davemloft.net>
  */
@@ -7,21 +7,11 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/init.h>
-#include <linux/time.h>
 #include <linux/rtc.h>
 #include <linux/platform_device.h>
 
 #include <asm/hypervisor.h>
 
-MODULE_AUTHOR("David S. Miller <davem@davemloft.net>");
-MODULE_DESCRIPTION("SUN4V RTC driver");
-MODULE_LICENSE("GPL");
-
-struct sun4v_rtc {
-        struct rtc_device       *rtc;
-        spinlock_t              lock;
-};
-
 static unsigned long hypervisor_get_time(void)
 {
         unsigned long ret, time;
@@ -45,15 +35,7 @@ retry:
 
 static int sun4v_read_time(struct device *dev, struct rtc_time *tm)
 {
-        struct sun4v_rtc *p = dev_get_drvdata(dev);
-        unsigned long flags, secs;
-
-        spin_lock_irqsave(&p->lock, flags);
-        secs = hypervisor_get_time();
-        spin_unlock_irqrestore(&p->lock, flags);
-
-        rtc_time_to_tm(secs, tm);
-
+        rtc_time_to_tm(hypervisor_get_time(), tm);
         return 0;
 }
 
@@ -80,19 +62,14 @@ retry:
 
 static int sun4v_set_time(struct device *dev, struct rtc_time *tm)
 {
-        struct sun4v_rtc *p = dev_get_drvdata(dev);
-        unsigned long flags, secs;
+        unsigned long secs;
         int err;
 
         err = rtc_tm_to_time(tm, &secs);
         if (err)
                 return err;
 
-        spin_lock_irqsave(&p->lock, flags);
-        err = hypervisor_set_time(secs);
-        spin_unlock_irqrestore(&p->lock, flags);
-
-        return err;
+        return hypervisor_set_time(secs);
 }
 
 static const struct rtc_class_ops sun4v_rtc_ops = {
@@ -100,33 +77,22 @@ static const struct rtc_class_ops sun4v_rtc_ops = {
         .set_time       = sun4v_set_time,
 };
 
-static int __devinit sun4v_rtc_probe(struct platform_device *pdev)
+static int __init sun4v_rtc_probe(struct platform_device *pdev)
 {
-        struct sun4v_rtc *p = kzalloc(sizeof(*p), GFP_KERNEL);
-
-        if (!p)
-                return -ENOMEM;
-
-        spin_lock_init(&p->lock);
-
-        p->rtc = rtc_device_register("sun4v", &pdev->dev,
+        struct rtc_device *rtc = rtc_device_register("sun4v", &pdev->dev,
                                      &sun4v_rtc_ops, THIS_MODULE);
-        if (IS_ERR(p->rtc)) {
-                int err = PTR_ERR(p->rtc);
-                kfree(p);
-                return err;
-        }
-        platform_set_drvdata(pdev, p);
+        if (IS_ERR(rtc))
+                return PTR_ERR(rtc);
+
+        platform_set_drvdata(pdev, rtc);
         return 0;
 }
 
-static int __devexit sun4v_rtc_remove(struct platform_device *pdev)
+static int __exit sun4v_rtc_remove(struct platform_device *pdev)
 {
-        struct sun4v_rtc *p = platform_get_drvdata(pdev);
-
-        rtc_device_unregister(p->rtc);
-        kfree(p);
+        struct rtc_device *rtc = platform_get_drvdata(pdev);
 
+        rtc_device_unregister(rtc);
         return 0;
 }
 
@@ -135,13 +101,12 @@ static struct platform_driver sun4v_rtc_driver = {
                 .name   = "rtc-sun4v",
                 .owner  = THIS_MODULE,
         },
-        .probe          = sun4v_rtc_probe,
-        .remove         = __devexit_p(sun4v_rtc_remove),
+        .remove         = __exit_p(sun4v_rtc_remove),
 };
 
 static int __init sun4v_rtc_init(void)
 {
-        return platform_driver_register(&sun4v_rtc_driver);
+        return platform_driver_probe(&sun4v_rtc_driver, sun4v_rtc_probe);
 }
 
 static void __exit sun4v_rtc_exit(void)
@@ -151,3 +116,7 @@ static void __exit sun4v_rtc_exit(void)
 
 module_init(sun4v_rtc_init);
 module_exit(sun4v_rtc_exit);
+
+MODULE_AUTHOR("David S. Miller <davem@davemloft.net>");
+MODULE_DESCRIPTION("SUN4V RTC driver");
+MODULE_LICENSE("GPL");
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 69a12aae91d3..490e34bbf27a 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -107,12 +107,13 @@ void cifs_dump_mids(struct TCP_Server_Info *server)
 #ifdef CONFIG_PROC_FS
 static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
 {
-        struct list_head *tmp;
-        struct list_head *tmp1;
+        struct list_head *tmp1, *tmp2, *tmp3;
         struct mid_q_entry *mid_entry;
+        struct TCP_Server_Info *server;
         struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
-        int i;
+        int i, j;
+        __u32 dev_type;
 
         seq_puts(m,
                     "Display Internal CIFS Data Structures for Debugging\n"
@@ -122,46 +123,78 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
         seq_printf(m, "Servers:");
 
         i = 0;
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalSMBSessionList) {
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp1, &cifs_tcp_ses_list) {
+                server = list_entry(tmp1, struct TCP_Server_Info,
+                                    tcp_ses_list);
                 i++;
-                ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
-                if ((ses->serverDomain == NULL) || (ses->serverOS == NULL) ||
-                   (ses->serverNOS == NULL)) {
-                        seq_printf(m, "\nentry for %s not fully "
-                                        "displayed\n\t", ses->serverName);
-                } else {
-                        seq_printf(m,
-                                    "\n%d) Name: %s  Domain: %s Mounts: %d OS:"
-                                    " %s  \n\tNOS: %s\tCapability: 0x%x\n\tSMB"
+                list_for_each(tmp2, &server->smb_ses_list) {
+                        ses = list_entry(tmp2, struct cifsSesInfo,
+                                         smb_ses_list);
+                        if ((ses->serverDomain == NULL) ||
+                                (ses->serverOS == NULL) ||
+                                (ses->serverNOS == NULL)) {
+                                seq_printf(m, "\n%d) entry for %s not fully "
+                                           "displayed\n\t", i, ses->serverName);
+                        } else {
+                                seq_printf(m,
+                                    "\n%d) Name: %s  Domain: %s Uses: %d OS:"
+                                    " %s\n\tNOS: %s\tCapability: 0x%x\n\tSMB"
                                     " session status: %d\t",
                                 i, ses->serverName, ses->serverDomain,
-                                atomic_read(&ses->inUse),
-                                ses->serverOS, ses->serverNOS,
+                                ses->ses_count, ses->serverOS, ses->serverNOS,
                                 ses->capabilities, ses->status);
-                }
-                if (ses->server) {
+                        }
                         seq_printf(m, "TCP status: %d\n\tLocal Users To "
-                                    "Server: %d SecMode: 0x%x Req On Wire: %d",
-                                ses->server->tcpStatus,
-                                atomic_read(&ses->server->socketUseCount),
-                                ses->server->secMode,
-                                atomic_read(&ses->server->inFlight));
+                                   "Server: %d SecMode: 0x%x Req On Wire: %d",
+                                   server->tcpStatus, server->srv_count,
+                                   server->secMode,
+                                   atomic_read(&server->inFlight));
 
 #ifdef CONFIG_CIFS_STATS2
                         seq_printf(m, " In Send: %d In MaxReq Wait: %d",
-                                atomic_read(&ses->server->inSend),
-                                atomic_read(&ses->server->num_waiters));
+                                atomic_read(&server->inSend),
+                                atomic_read(&server->num_waiters));
 #endif
 
-                        seq_puts(m, "\nMIDs:\n");
+                        seq_puts(m, "\n\tShares:");
+                        j = 0;
+                        list_for_each(tmp3, &ses->tcon_list) {
+                                tcon = list_entry(tmp3, struct cifsTconInfo,
+                                                  tcon_list);
+                                ++j;
+                                dev_type = le32_to_cpu(tcon->fsDevInfo.DeviceType);
+                                seq_printf(m, "\n\t%d) %s Mounts: %d ", j,
+                                           tcon->treeName, tcon->tc_count);
+                                if (tcon->nativeFileSystem) {
+                                        seq_printf(m, "Type: %s ",
+                                                   tcon->nativeFileSystem);
+                                }
+                                seq_printf(m, "DevInfo: 0x%x Attributes: 0x%x"
+                                        "\nPathComponentMax: %d Status: 0x%d",
+                                        le32_to_cpu(tcon->fsDevInfo.DeviceCharacteristics),
+                                        le32_to_cpu(tcon->fsAttrInfo.Attributes),
+                                        le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength),
+                                        tcon->tidStatus);
+                                if (dev_type == FILE_DEVICE_DISK)
+                                        seq_puts(m, " type: DISK ");
+                                else if (dev_type == FILE_DEVICE_CD_ROM)
+                                        seq_puts(m, " type: CDROM ");
+                                else
+                                        seq_printf(m, " type: %d ", dev_type);
+
+                                if (tcon->need_reconnect)
+                                        seq_puts(m, "\tDISCONNECTED ");
+                                seq_putc(m, '\n');
+                        }
+
+                        seq_puts(m, "\n\tMIDs:\n");
 
                         spin_lock(&GlobalMid_Lock);
-                        list_for_each(tmp1, &ses->server->pending_mid_q) {
-                                mid_entry = list_entry(tmp1, struct
-                                        mid_q_entry,
+                        list_for_each(tmp3, &server->pending_mid_q) {
+                                mid_entry = list_entry(tmp3, struct mid_q_entry,
                                         qhead);
-                                seq_printf(m, "State: %d com: %d pid:"
+                                seq_printf(m, "\tState: %d com: %d pid:"
                                                 " %d tsk: %p mid %d\n",
                                                 mid_entry->midState,
                                                 (int)mid_entry->command,
@@ -171,44 +204,8 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
                         }
                         spin_unlock(&GlobalMid_Lock);
                 }
-
-        }
-        read_unlock(&GlobalSMBSeslock);
-        seq_putc(m, '\n');
-
-        seq_puts(m, "Shares:");
-
-        i = 0;
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                __u32 dev_type;
-                i++;
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                dev_type = le32_to_cpu(tcon->fsDevInfo.DeviceType);
-                seq_printf(m, "\n%d) %s Uses: %d ", i,
-                                 tcon->treeName, atomic_read(&tcon->useCount));
-                if (tcon->nativeFileSystem) {
-                        seq_printf(m, "Type: %s ",
-                                         tcon->nativeFileSystem);
-                }
-                seq_printf(m, "DevInfo: 0x%x Attributes: 0x%x"
-                                 "\nPathComponentMax: %d Status: %d",
-                            le32_to_cpu(tcon->fsDevInfo.DeviceCharacteristics),
-                            le32_to_cpu(tcon->fsAttrInfo.Attributes),
-                            le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength),
-                            tcon->tidStatus);
-                if (dev_type == FILE_DEVICE_DISK)
-                        seq_puts(m, " type: DISK ");
-                else if (dev_type == FILE_DEVICE_CD_ROM)
-                        seq_puts(m, " type: CDROM ");
-                else
-                        seq_printf(m, " type: %d ", dev_type);
-
-                if (tcon->tidStatus == CifsNeedReconnect)
-                        seq_puts(m, "\tDISCONNECTED ");
         }
-        read_unlock(&GlobalSMBSeslock);
-
+        read_unlock(&cifs_tcp_ses_lock);
         seq_putc(m, '\n');
 
         /* BB add code to dump additional info such as TCP session info now */
@@ -234,7 +231,9 @@ static ssize_t cifs_stats_proc_write(struct file *file,
 {
         char c;
         int rc;
-        struct list_head *tmp;
+        struct list_head *tmp1, *tmp2, *tmp3;
+        struct TCP_Server_Info *server;
+        struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
 
         rc = get_user(c, buffer);
@@ -242,33 +241,42 @@ static ssize_t cifs_stats_proc_write(struct file *file,
                 return rc;
 
         if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
-                read_lock(&GlobalSMBSeslock);
 #ifdef CONFIG_CIFS_STATS2
                 atomic_set(&totBufAllocCount, 0);
                 atomic_set(&totSmBufAllocCount, 0);
 #endif /* CONFIG_CIFS_STATS2 */
-                list_for_each(tmp, &GlobalTreeConnectionList) {
-                        tcon = list_entry(tmp, struct cifsTconInfo,
-                                        cifsConnectionList);
-                        atomic_set(&tcon->num_smbs_sent, 0);
-                        atomic_set(&tcon->num_writes, 0);
-                        atomic_set(&tcon->num_reads, 0);
-                        atomic_set(&tcon->num_oplock_brks, 0);
-                        atomic_set(&tcon->num_opens, 0);
-                        atomic_set(&tcon->num_closes, 0);
-                        atomic_set(&tcon->num_deletes, 0);
-                        atomic_set(&tcon->num_mkdirs, 0);
-                        atomic_set(&tcon->num_rmdirs, 0);
-                        atomic_set(&tcon->num_renames, 0);
-                        atomic_set(&tcon->num_t2renames, 0);
-                        atomic_set(&tcon->num_ffirst, 0);
-                        atomic_set(&tcon->num_fnext, 0);
-                        atomic_set(&tcon->num_fclose, 0);
-                        atomic_set(&tcon->num_hardlinks, 0);
-                        atomic_set(&tcon->num_symlinks, 0);
-                        atomic_set(&tcon->num_locks, 0);
+                read_lock(&cifs_tcp_ses_lock);
+                list_for_each(tmp1, &cifs_tcp_ses_list) {
+                        server = list_entry(tmp1, struct TCP_Server_Info,
+                                            tcp_ses_list);
+                        list_for_each(tmp2, &server->smb_ses_list) {
+                                ses = list_entry(tmp2, struct cifsSesInfo,
+                                                 smb_ses_list);
+                                list_for_each(tmp3, &ses->tcon_list) {
+                                        tcon = list_entry(tmp3,
+                                                          struct cifsTconInfo,
+                                                          tcon_list);
+                                        atomic_set(&tcon->num_smbs_sent, 0);
+                                        atomic_set(&tcon->num_writes, 0);
+                                        atomic_set(&tcon->num_reads, 0);
+                                        atomic_set(&tcon->num_oplock_brks, 0);
+                                        atomic_set(&tcon->num_opens, 0);
+                                        atomic_set(&tcon->num_closes, 0);
+                                        atomic_set(&tcon->num_deletes, 0);
+                                        atomic_set(&tcon->num_mkdirs, 0);
+                                        atomic_set(&tcon->num_rmdirs, 0);
+                                        atomic_set(&tcon->num_renames, 0);
+                                        atomic_set(&tcon->num_t2renames, 0);
+                                        atomic_set(&tcon->num_ffirst, 0);
+                                        atomic_set(&tcon->num_fnext, 0);
+                                        atomic_set(&tcon->num_fclose, 0);
+                                        atomic_set(&tcon->num_hardlinks, 0);
+                                        atomic_set(&tcon->num_symlinks, 0);
+                                        atomic_set(&tcon->num_locks, 0);
+                                }
+                        }
                 }
-                read_unlock(&GlobalSMBSeslock);
+                read_unlock(&cifs_tcp_ses_lock);
         }
 
         return count;
@@ -277,7 +285,9 @@ static ssize_t cifs_stats_proc_write(struct file *file,
 static int cifs_stats_proc_show(struct seq_file *m, void *v)
 {
         int i;
-        struct list_head *tmp;
+        struct list_head *tmp1, *tmp2, *tmp3;
+        struct TCP_Server_Info *server;
+        struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
 
         seq_printf(m,
@@ -306,44 +316,55 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
                 GlobalCurrentXid, GlobalMaxActiveXid);
 
         i = 0;
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                i++;
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                seq_printf(m, "\n%d) %s", i, tcon->treeName);
-                if (tcon->tidStatus == CifsNeedReconnect)
-                        seq_puts(m, "\tDISCONNECTED ");
-                seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
-                        atomic_read(&tcon->num_smbs_sent),
-                        atomic_read(&tcon->num_oplock_brks));
-                seq_printf(m, "\nReads:  %d Bytes: %lld",
-                        atomic_read(&tcon->num_reads),
-                        (long long)(tcon->bytes_read));
-                seq_printf(m, "\nWrites: %d Bytes: %lld",
-                        atomic_read(&tcon->num_writes),
-                        (long long)(tcon->bytes_written));
-                seq_printf(m,
-                        "\nLocks: %d HardLinks: %d Symlinks: %d",
-                        atomic_read(&tcon->num_locks),
-                        atomic_read(&tcon->num_hardlinks),
-                        atomic_read(&tcon->num_symlinks));
-
-                seq_printf(m, "\nOpens: %d Closes: %d Deletes: %d",
-                        atomic_read(&tcon->num_opens),
-                        atomic_read(&tcon->num_closes),
-                        atomic_read(&tcon->num_deletes));
-                seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
-                        atomic_read(&tcon->num_mkdirs),
-                        atomic_read(&tcon->num_rmdirs));
-                seq_printf(m, "\nRenames: %d T2 Renames %d",
-                        atomic_read(&tcon->num_renames),
-                        atomic_read(&tcon->num_t2renames));
-                seq_printf(m, "\nFindFirst: %d FNext %d FClose %d",
-                        atomic_read(&tcon->num_ffirst),
-                        atomic_read(&tcon->num_fnext),
-                        atomic_read(&tcon->num_fclose));
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp1, &cifs_tcp_ses_list) {
+                server = list_entry(tmp1, struct TCP_Server_Info,
+                                    tcp_ses_list);
+                list_for_each(tmp2, &server->smb_ses_list) {
+                        ses = list_entry(tmp2, struct cifsSesInfo,
+                                         smb_ses_list);
+                        list_for_each(tmp3, &ses->tcon_list) {
+                                tcon = list_entry(tmp3,
+                                                  struct cifsTconInfo,
+                                                  tcon_list);
+                                i++;
+                                seq_printf(m, "\n%d) %s", i, tcon->treeName);
+                                if (tcon->need_reconnect)
+                                        seq_puts(m, "\tDISCONNECTED ");
+                                seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
+                                        atomic_read(&tcon->num_smbs_sent),
+                                        atomic_read(&tcon->num_oplock_brks));
+                                seq_printf(m, "\nReads:  %d Bytes: %lld",
+                                        atomic_read(&tcon->num_reads),
+                                        (long long)(tcon->bytes_read));
+                                seq_printf(m, "\nWrites: %d Bytes: %lld",
+                                        atomic_read(&tcon->num_writes),
+                                        (long long)(tcon->bytes_written));
+                                seq_printf(m, "\nLocks: %d HardLinks: %d "
+                                              "Symlinks: %d",
+                                        atomic_read(&tcon->num_locks),
+                                        atomic_read(&tcon->num_hardlinks),
+                                        atomic_read(&tcon->num_symlinks));
+                                seq_printf(m, "\nOpens: %d Closes: %d"
+                                              "Deletes: %d",
+                                        atomic_read(&tcon->num_opens),
+                                        atomic_read(&tcon->num_closes),
+                                        atomic_read(&tcon->num_deletes));
+                                seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
+                                        atomic_read(&tcon->num_mkdirs),
+                                        atomic_read(&tcon->num_rmdirs));
+                                seq_printf(m, "\nRenames: %d T2 Renames %d",
+                                        atomic_read(&tcon->num_renames),
+                                        atomic_read(&tcon->num_t2renames));
+                                seq_printf(m, "\nFindFirst: %d FNext %d "
+                                              "FClose %d",
+                                        atomic_read(&tcon->num_ffirst),
+                                        atomic_read(&tcon->num_fnext),
+                                        atomic_read(&tcon->num_fclose));
+                        }
+                }
         }
-        read_unlock(&GlobalSMBSeslock);
+        read_unlock(&cifs_tcp_ses_lock);
 
         seq_putc(m, '\n');
         return 0;
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index d2c8eef84f3c..e1c18362ba46 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -106,7 +106,8 @@ static char *cifs_get_share_name(const char *node_name)
 /**
  * compose_mount_options        -       creates mount options for refferral
  * @sb_mountdata:       parent/root DFS mount options (template)
- * @ref_unc:            refferral server UNC
+ * @dentry:             point where we are going to mount
+ * @ref:                server's referral
  * @devname:            pointer for saving device name
  *
  * creates mount options for submount based on template options sb_mountdata
@@ -116,7 +117,8 @@ static char *cifs_get_share_name(const char *node_name)
  * Caller is responcible for freeing retunrned value if it is not error.
  */
 static char *compose_mount_options(const char *sb_mountdata,
-                                   const char *ref_unc,
+                                   struct dentry *dentry,
+                                   const struct dfs_info3_param *ref,
                                    char **devname)
 {
         int rc;
@@ -126,11 +128,12 @@ static char *compose_mount_options(const char *sb_mountdata,
         char *srvIP = NULL;
         char sep = ',';
         int off, noff;
+        char *fullpath;
 
         if (sb_mountdata == NULL)
                 return ERR_PTR(-EINVAL);
 
-        *devname = cifs_get_share_name(ref_unc);
+        *devname = cifs_get_share_name(ref->node_name);
         rc = dns_resolve_server_name_to_ip(*devname, &srvIP);
         if (rc != 0) {
                 cERROR(1, ("%s: Failed to resolve server part of %s to IP",
@@ -138,7 +141,12 @@ static char *compose_mount_options(const char *sb_mountdata,
                 mountdata = ERR_PTR(rc);
                 goto compose_mount_options_out;
         }
-        md_len = strlen(sb_mountdata) + strlen(srvIP) + strlen(ref_unc) + 3;
+        /* md_len = strlen(...) + 12 for 'sep+prefixpath='
+         * assuming that we have 'unc=' and 'ip=' in
+         * the original sb_mountdata
+         */
+        md_len = strlen(sb_mountdata) + strlen(srvIP) +
+                strlen(ref->node_name) + 12;
         mountdata = kzalloc(md_len+1, GFP_KERNEL);
         if (mountdata == NULL) {
                 mountdata = ERR_PTR(-ENOMEM);
@@ -152,41 +160,56 @@ static char *compose_mount_options(const char *sb_mountdata,
                         strncpy(mountdata, sb_mountdata, 5);
                         off += 5;
         }
-        while ((tkn_e = strchr(sb_mountdata+off, sep))) {
-                noff = (tkn_e - (sb_mountdata+off)) + 1;
-                if (strnicmp(sb_mountdata+off, "unc=", 4) == 0) {
+
+        do {
+                tkn_e = strchr(sb_mountdata + off, sep);
+                if (tkn_e == NULL)
+                        noff = strlen(sb_mountdata + off);
+                else
+                        noff = tkn_e - (sb_mountdata + off) + 1;
+
+                if (strnicmp(sb_mountdata + off, "unc=", 4) == 0) {
                         off += noff;
                         continue;
                 }
-                if (strnicmp(sb_mountdata+off, "ip=", 3) == 0) {
+                if (strnicmp(sb_mountdata + off, "ip=", 3) == 0) {
                         off += noff;
                         continue;
                 }
-                if (strnicmp(sb_mountdata+off, "prefixpath=", 3) == 0) {
+                if (strnicmp(sb_mountdata + off, "prefixpath=", 11) == 0) {
                         off += noff;
                         continue;
                 }
-                strncat(mountdata, sb_mountdata+off, noff);
+                strncat(mountdata, sb_mountdata + off, noff);
                 off += noff;
-        }
-        strcat(mountdata, sb_mountdata+off);
+        } while (tkn_e);
+        strcat(mountdata, sb_mountdata + off);
         mountdata[md_len] = '\0';
 
         /* copy new IP and ref share name */
-        strcat(mountdata, ",ip=");
+        if (mountdata[strlen(mountdata) - 1] != sep)
+                strncat(mountdata, &sep, 1);
+        strcat(mountdata, "ip=");
         strcat(mountdata, srvIP);
-        strcat(mountdata, ",unc=");
+        strncat(mountdata, &sep, 1);
+        strcat(mountdata, "unc=");
         strcat(mountdata, *devname);
 
         /* find & copy prefixpath */
-        tkn_e = strchr(ref_unc+2, '\\');
-        if (tkn_e) {
-                tkn_e = strchr(tkn_e+1, '\\');
-                if (tkn_e) {
-                        strcat(mountdata, ",prefixpath=");
-                        strcat(mountdata, tkn_e+1);
-                }
+        tkn_e = strchr(ref->node_name + 2, '\\');
+        if (tkn_e == NULL) /* invalid unc, missing share name*/
+                goto compose_mount_options_out;
+
+        fullpath = build_path_from_dentry(dentry);
+        tkn_e = strchr(tkn_e + 1, '\\');
+        if (tkn_e || strlen(fullpath) - (ref->path_consumed)) {
+                strncat(mountdata, &sep, 1);
+                strcat(mountdata, "prefixpath=");
+                if (tkn_e)
+                        strcat(mountdata, tkn_e + 1);
+                strcat(mountdata, fullpath + (ref->path_consumed));
         }
+        kfree(fullpath);
 
         /*cFYI(1,("%s: parent mountdata: %s", __func__,sb_mountdata));*/
         /*cFYI(1, ("%s: submount mountdata: %s", __func__, mountdata ));*/
@@ -198,7 +221,7 @@ compose_mount_options_out:
 
 
 static struct vfsmount *cifs_dfs_do_refmount(const struct vfsmount *mnt_parent,
-                struct dentry *dentry, char *ref_unc)
+                struct dentry *dentry, const struct dfs_info3_param *ref)
 {
         struct cifs_sb_info *cifs_sb;
         struct vfsmount *mnt;
@@ -207,7 +230,7 @@ static struct vfsmount *cifs_dfs_do_refmount(const struct vfsmount *mnt_parent,
 
         cifs_sb = CIFS_SB(dentry->d_inode->i_sb);
         mountdata = compose_mount_options(cifs_sb->mountdata,
-                                                ref_unc, &devname);
+                                                dentry, ref, &devname);
 
         if (IS_ERR(mountdata))
                 return (struct vfsmount *)mountdata;
@@ -310,7 +333,7 @@ cifs_dfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
                         }
                         mnt = cifs_dfs_do_refmount(nd->path.mnt,
                                                 nd->path.dentry,
-                                                referrals[i].node_name);
+                                                referrals + i);
                         cFYI(1, ("%s: cifs_dfs_do_refmount:%s , mnt:%p",
                                          __func__,
                                         referrals[i].node_name, mnt));
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index fcee9298b620..0ab2fb5afef1 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -73,8 +73,8 @@ struct key_type cifs_spnego_key_type = {
  * strlen(";sec=ntlmsspi") */
 #define MAX_MECH_STR_LEN        13
 
-/* max possible addr len eg FEDC:BA98:7654:3210:FEDC:BA98:7654:3210/60 */
-#define MAX_IPV6_ADDR_LEN       42
+/* max possible addr len eg FEDC:BA98:7654:3210:FEDC:BA98:7654:3210/128 */
+#define MAX_IPV6_ADDR_LEN       43
 
 /* strlen of "host=" */
 #define HOST_KEY_LEN            5
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index ac5915d61dca..d9cf467309e8 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -514,10 +514,11 @@ static void cifs_umount_begin(struct super_block *sb)
         tcon = cifs_sb->tcon;
         if (tcon == NULL)
                 return;
-        down(&tcon->tconSem);
-        if (atomic_read(&tcon->useCount) == 1)
+
+        read_lock(&cifs_tcp_ses_lock);
+        if (tcon->tc_count == 1)
                 tcon->tidStatus = CifsExiting;
-        up(&tcon->tconSem);
+        read_unlock(&cifs_tcp_ses_lock);
 
         /* cancel_brl_requests(tcon); */ /* BB mark all brl mids as exiting */
         /* cancel_notify_requests(tcon); */
@@ -1013,7 +1014,7 @@ static int cifs_oplock_thread(void *dummyarg)
                                 not bother sending an oplock release if session
                                 to server still is disconnected since oplock
                                 already released by the server in that case */
-                        if (pTcon->tidStatus != CifsNeedReconnect) {
+                        if (!pTcon->need_reconnect) {
                                 rc = CIFSSMBLock(0, pTcon, netfid,
                                                 0 /* len */ , 0 /* offset */, 0,
                                                 0, LOCKING_ANDX_OPLOCK_RELEASE,
@@ -1031,24 +1032,24 @@ static int cifs_oplock_thread(void *dummyarg)
 static int cifs_dnotify_thread(void *dummyarg)
 {
         struct list_head *tmp;
-        struct cifsSesInfo *ses;
+        struct TCP_Server_Info *server;
 
         do {
                 if (try_to_freeze())
                         continue;
                 set_current_state(TASK_INTERRUPTIBLE);
                 schedule_timeout(15*HZ);
-                read_lock(&GlobalSMBSeslock);
                 /* check if any stuck requests that need
                    to be woken up and wakeq so the
                    thread can wake up and error out */
-                list_for_each(tmp, &GlobalSMBSessionList) {
-                        ses = list_entry(tmp, struct cifsSesInfo,
-                                cifsSessionList);
-                        if (ses->server && atomic_read(&ses->server->inFlight))
-                                wake_up_all(&ses->server->response_q);
+                read_lock(&cifs_tcp_ses_lock);
+                list_for_each(tmp, &cifs_tcp_ses_list) {
+                        server = list_entry(tmp, struct TCP_Server_Info,
+                                         tcp_ses_list);
+                        if (atomic_read(&server->inFlight))
+                                wake_up_all(&server->response_q);
                 }
-                read_unlock(&GlobalSMBSeslock);
+                read_unlock(&cifs_tcp_ses_lock);
         } while (!kthread_should_stop());
 
         return 0;
@@ -1059,9 +1060,7 @@ init_cifs(void)
 {
         int rc = 0;
         cifs_proc_init();
-/*      INIT_LIST_HEAD(&GlobalServerList);*/    /* BB not implemented yet */
-        INIT_LIST_HEAD(&GlobalSMBSessionList);
-        INIT_LIST_HEAD(&GlobalTreeConnectionList);
+        INIT_LIST_HEAD(&cifs_tcp_ses_list);
         INIT_LIST_HEAD(&GlobalOplock_Q);
 #ifdef CONFIG_CIFS_EXPERIMENTAL
         INIT_LIST_HEAD(&GlobalDnotifyReqList);
@@ -1089,6 +1088,7 @@ init_cifs(void)
         GlobalMaxActiveXid = 0;
         memset(Local_System_Name, 0, 15);
         rwlock_init(&GlobalSMBSeslock);
+        rwlock_init(&cifs_tcp_ses_lock);
         spin_lock_init(&GlobalMid_Lock);
 
         if (cifs_max_pending < 2) {
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 1cb1189f24e0..f1ae1f57c30d 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -85,8 +85,7 @@ enum securityEnum {
 };
 
 enum protocolEnum {
-        IPV4 = 0,
-        IPV6,
+        TCP = 0,
         SCTP
         /* Netbios frames protocol not supported at this time */
 };
@@ -122,6 +121,9 @@ struct cifs_cred {
  */
 
 struct TCP_Server_Info {
+        struct list_head tcp_ses_list;
+        struct list_head smb_ses_list;
+        int srv_count; /* reference counter */
         /* 15 character server name + 0x20 16th byte indicating type = srv */
         char server_RFC1001_name[SERVER_NAME_LEN_WITH_NULL];
         char unicode_server_Name[SERVER_NAME_LEN_WITH_NULL * 2];
@@ -143,7 +145,6 @@ struct TCP_Server_Info {
         bool svlocal:1;                 /* local server or remote */
         bool noblocksnd;                /* use blocking sendmsg */
         bool noautotune;                /* do not autotune send buf sizes */
-        atomic_t socketUseCount; /* number of open cifs sessions on socket */
         atomic_t inFlight;  /* number of requests on the wire to server */
 #ifdef CONFIG_CIFS_STATS2
         atomic_t inSend; /* requests trying to send */
@@ -194,13 +195,14 @@ struct cifsUidInfo {
  * Session structure.  One of these for each uid session with a particular host
  */
 struct cifsSesInfo {
-        struct list_head cifsSessionList;
+        struct list_head smb_ses_list;
+        struct list_head tcon_list;
         struct semaphore sesSem;
 #if 0
         struct cifsUidInfo *uidInfo;    /* pointer to user info */
 #endif
         struct TCP_Server_Info *server; /* pointer to server info */
-        atomic_t inUse; /* # of mounts (tree connections) on this ses */
+        int ses_count;          /* reference counter */
         enum statusEnum status;
         unsigned overrideSecFlg;  /* if non-zero override global sec flags */
         __u16 ipc_tid;          /* special tid for connection to IPC share */
@@ -216,6 +218,7 @@ struct cifsSesInfo {
         char userName[MAX_USERNAME_SIZE + 1];
         char *domainName;
         char *password;
+        bool need_reconnect:1; /* connection reset, uid now invalid */
 };
 /* no more than one of the following three session flags may be set */
 #define CIFS_SES_NT4 1
@@ -230,16 +233,15 @@ struct cifsSesInfo {
  * session
  */
 struct cifsTconInfo {
-        struct list_head cifsConnectionList;
+        struct list_head tcon_list;
+        int tc_count;
         struct list_head openFileList;
-        struct semaphore tconSem;
         struct cifsSesInfo *ses;        /* pointer to session associated with */
         char treeName[MAX_TREE_SIZE + 1]; /* UNC name of resource in ASCII */
         char *nativeFileSystem;
         __u16 tid;              /* The 2 byte tree id */
         __u16 Flags;            /* optional support bits */
         enum statusEnum tidStatus;
-        atomic_t useCount;      /* how many explicit/implicit mounts to share */
 #ifdef CONFIG_CIFS_STATS
         atomic_t num_smbs_sent;
         atomic_t num_writes;
@@ -288,6 +290,7 @@ struct cifsTconInfo {
         bool unix_ext:1;  /* if false disable Linux extensions to CIFS protocol
                                 for this mount even if server would support */
         bool local_lease:1; /* check leases (only) on local system not remote */
+        bool need_reconnect:1; /* connection reset, tid now invalid */
         /* BB add field for back pointer to sb struct(s)? */
 };
 
@@ -588,21 +591,21 @@ require use of the stronger protocol */
 #endif
 
 /*
- * The list of servers that did not respond with NT LM 0.12.
- * This list helps improve performance and eliminate the messages indicating
- * that we had a communications error talking to the server in this list.
+ * the list of TCP_Server_Info structures, ie each of the sockets
+ * connecting our client to a distinct server (ip address), is
+ * chained together by cifs_tcp_ses_list. The list of all our SMB
+ * sessions (and from that the tree connections) can be found
+ * by iterating over cifs_tcp_ses_list
  */
-/* Feature not supported */
-/* GLOBAL_EXTERN struct servers_not_supported *NotSuppList; */
+GLOBAL_EXTERN struct list_head          cifs_tcp_ses_list;
 
 /*
- * The following is a hash table of all the users we know about.
+ * This lock protects the cifs_tcp_ses_list, the list of smb sessions per
+ * tcp session, and the list of tcon's per smb session. It also protects
+ * the reference counters for the server, smb session, and tcon. Finally,
+ * changes to the tcon->tidStatus should be done while holding this lock.
  */
-GLOBAL_EXTERN struct smbUidInfo *GlobalUidList[UID_HASH];
-
-/* GLOBAL_EXTERN struct list_head GlobalServerList; BB not implemented yet */
-GLOBAL_EXTERN struct list_head GlobalSMBSessionList;
-GLOBAL_EXTERN struct list_head GlobalTreeConnectionList;
+GLOBAL_EXTERN rwlock_t          cifs_tcp_ses_lock;
 GLOBAL_EXTERN rwlock_t GlobalSMBSeslock;  /* protects list inserts on 3 above */
 
 GLOBAL_EXTERN struct list_head GlobalOplock_Q;
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index d5eac48fc415..bdda46dd435a 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -190,10 +190,10 @@ small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                 /* need to prevent multiple threads trying to
                 simultaneously reconnect the same SMB session */
                         down(&tcon->ses->sesSem);
-                        if (tcon->ses->status == CifsNeedReconnect)
+                        if (tcon->ses->need_reconnect)
                                 rc = cifs_setup_session(0, tcon->ses,
                                                         nls_codepage);
-                        if (!rc && (tcon->tidStatus == CifsNeedReconnect)) {
+                        if (!rc && (tcon->need_reconnect)) {
                                 mark_open_files_invalid(tcon);
                                 rc = CIFSTCon(0, tcon->ses, tcon->treeName,
                                               tcon, nls_codepage);
@@ -295,7 +295,7 @@ smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
            check for tcp and smb session status done differently
            for those three - in the calling routine */
         if (tcon) {
-                if (tcon->tidStatus == CifsExiting) {
+                if (tcon->need_reconnect) {
                         /* only tree disconnect, open, and write,
                           (and ulogoff which does not have tcon)
                           are allowed as we start force umount */
@@ -337,10 +337,10 @@ smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                 /* need to prevent multiple threads trying to
                 simultaneously reconnect the same SMB session */
                         down(&tcon->ses->sesSem);
-                        if (tcon->ses->status == CifsNeedReconnect)
+                        if (tcon->ses->need_reconnect)
                                 rc = cifs_setup_session(0, tcon->ses,
                                                         nls_codepage);
-                        if (!rc && (tcon->tidStatus == CifsNeedReconnect)) {
+                        if (!rc && (tcon->need_reconnect)) {
                                 mark_open_files_invalid(tcon);
                                 rc = CIFSTCon(0, tcon->ses, tcon->treeName,
                                               tcon, nls_codepage);
@@ -664,8 +664,9 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                         rc = -EIO;
                         goto neg_err_exit;
                 }
-
-                if (server->socketUseCount.counter > 1) {
+                read_lock(&cifs_tcp_ses_lock);
+                if (server->srv_count > 1) {
+                        read_unlock(&cifs_tcp_ses_lock);
                         if (memcmp(server->server_GUID,
                                    pSMBr->u.extended_response.
                                    GUID, 16) != 0) {
@@ -674,9 +675,11 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                                         pSMBr->u.extended_response.GUID,
                                         16);
                         }
-                } else
+                } else {
+                        read_unlock(&cifs_tcp_ses_lock);
                         memcpy(server->server_GUID,
                                pSMBr->u.extended_response.GUID, 16);
+                }
 
                 if (count == 16) {
                         server->secType = RawNTLMSSP;
@@ -739,50 +742,31 @@ CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon)
         int rc = 0;
 
         cFYI(1, ("In tree disconnect"));
-        /*
-         *  If last user of the connection and
-         *  connection alive - disconnect it
-         *  If this is the last connection on the server session disconnect it
-         *  (and inside session disconnect we should check if tcp socket needs
-         *  to be freed and kernel thread woken up).
-         */
-        if (tcon)
-                down(&tcon->tconSem);
-        else
-                return -EIO;
 
-        atomic_dec(&tcon->useCount);
-        if (atomic_read(&tcon->useCount) > 0) {
-                up(&tcon->tconSem);
-                return -EBUSY;
-        }
+        /* BB: do we need to check this? These should never be NULL. */
+        if ((tcon->ses == NULL) || (tcon->ses->server == NULL))
+                return -EIO;
 
-        /* No need to return error on this operation if tid invalidated and
-        closed on server already e.g. due to tcp session crashing */
-        if (tcon->tidStatus == CifsNeedReconnect) {
-                up(&tcon->tconSem);
+        /*
+         * No need to return error on this operation if tid invalidated and
+         * closed on server already e.g. due to tcp session crashing. Also,
+         * the tcon is no longer on the list, so no need to take lock before
+         * checking this.
+         */
+        if (tcon->need_reconnect)
                 return 0;
-        }
 
-        if ((tcon->ses == NULL) || (tcon->ses->server == NULL)) {
-                up(&tcon->tconSem);
-                return -EIO;
-        }
         rc = small_smb_init(SMB_COM_TREE_DISCONNECT, 0, tcon,
                             (void **)&smb_buffer);
-        if (rc) {
-                up(&tcon->tconSem);
+        if (rc)
                 return rc;
-        }
 
         rc = SendReceiveNoRsp(xid, tcon->ses, smb_buffer, 0);
         if (rc)
                 cFYI(1, ("Tree disconnect failed %d", rc));
 
-        up(&tcon->tconSem);
-
         /* No need to return error on this operation if tid invalidated and
-        closed on server already e.g. due to tcp session crashing */
+           closed on server already e.g. due to tcp session crashing */
         if (rc == -EAGAIN)
                 rc = 0;
 
@@ -796,43 +780,36 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
         int rc = 0;
 
         cFYI(1, ("In SMBLogoff for session disconnect"));
-        if (ses)
-                down(&ses->sesSem);
-        else
+
+        /*
+         * BB: do we need to check validity of ses and server? They should
+         * always be valid since we have an active reference. If not, that
+         * should probably be a BUG()
+         */
+        if (!ses || !ses->server)
                 return -EIO;
 
-        atomic_dec(&ses->inUse);
-        if (atomic_read(&ses->inUse) > 0) {
-                up(&ses->sesSem);
-                return -EBUSY;
-        }
+        down(&ses->sesSem);
+        if (ses->need_reconnect)
+                goto session_already_dead; /* no need to send SMBlogoff if uid
+                                              already closed due to reconnect */
         rc = small_smb_init(SMB_COM_LOGOFF_ANDX, 2, NULL, (void **)&pSMB);
         if (rc) {
                 up(&ses->sesSem);
                 return rc;
         }
 
-        if (ses->server) {
-                pSMB->hdr.Mid = GetNextMid(ses->server);
+        pSMB->hdr.Mid = GetNextMid(ses->server);
 
-                if (ses->server->secMode &
+        if (ses->server->secMode &
                    (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
                         pSMB->hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
-        }
 
         pSMB->hdr.Uid = ses->Suid;
 
         pSMB->AndXCommand = 0xFF;
         rc = SendReceiveNoRsp(xid, ses, (struct smb_hdr *) pSMB, 0);
-        if (ses->server) {
-                atomic_dec(&ses->server->socketUseCount);
-                if (atomic_read(&ses->server->socketUseCount) == 0) {
-                        spin_lock(&GlobalMid_Lock);
-                        ses->server->tcpStatus = CifsExiting;
-                        spin_unlock(&GlobalMid_Lock);
-                        rc = -ESHUTDOWN;
-                }
-        }
+session_already_dead:
         up(&ses->sesSem);
 
         /* if session dead then we do not need to do ulogoff,
@@ -3922,6 +3899,27 @@ GetInodeNumOut:
         return rc;
 }
 
+/* computes length of UCS string converted to host codepage
+ * @src:        UCS string
+ * @maxlen:     length of the input string in UCS characters
+ *              (not in bytes)
+ *
+ * return:      size of input string in host codepage
+ */
+static int hostlen_fromUCS(const __le16 *src, const int maxlen,
+                const struct nls_table *nls_codepage) {
+        int i;
+        int hostlen = 0;
+        char to[4];
+        int charlen;
+        for (i = 0; (i < maxlen) && src[i]; ++i) {
+                charlen = nls_codepage->uni2char(le16_to_cpu(src[i]),
+                                to, NLS_MAX_CHARSET_SIZE);
+                hostlen += charlen > 0 ? charlen : 1;
+        }
+        return hostlen;
+}
+
 /* parses DFS refferal V3 structure
  * caller is responsible for freeing target_nodes
  * returns:
@@ -3932,7 +3930,8 @@ static int
 parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 unsigned int *num_of_nodes,
                 struct dfs_info3_param **target_nodes,
-                const struct nls_table *nls_codepage)
+                const struct nls_table *nls_codepage, int remap,
+                const char *searchName)
 {
         int i, rc = 0;
         char *data_end;
@@ -3983,7 +3982,17 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 struct dfs_info3_param *node = (*target_nodes)+i;
 
                 node->flags = le16_to_cpu(pSMBr->DFSFlags);
-                node->path_consumed = le16_to_cpu(pSMBr->PathConsumed);
+                if (is_unicode) {
+                        __le16 *tmp = kmalloc(strlen(searchName)*2, GFP_KERNEL);
+                        cifsConvertToUCS((__le16 *) tmp, searchName,
+                                        PATH_MAX, nls_codepage, remap);
+                        node->path_consumed = hostlen_fromUCS(tmp,
+                                        le16_to_cpu(pSMBr->PathConsumed)/2,
+                                        nls_codepage);
+                        kfree(tmp);
+                } else
+                        node->path_consumed = le16_to_cpu(pSMBr->PathConsumed);
+
                 node->server_type = le16_to_cpu(ref->ServerType);
                 node->ref_flag = le16_to_cpu(ref->ReferralEntryFlags);
 
@@ -4116,7 +4125,8 @@ getDFSRetry:
 
         /* parse returned result into more usable form */
         rc = parse_DFS_referrals(pSMBr, num_of_nodes,
-                                 target_nodes, nls_codepage);
+                                 target_nodes, nls_codepage, remap,
+                                 searchName);
 
 GetDFSRefExit:
         cifs_buf_release(pSMB);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e9f9248cb3fe..c7d341714586 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -124,7 +124,7 @@ static int
 cifs_reconnect(struct TCP_Server_Info *server)
 {
         int rc = 0;
-        struct list_head *tmp;
+        struct list_head *tmp, *tmp2;
         struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
         struct mid_q_entry *mid_entry;
@@ -144,23 +144,17 @@ cifs_reconnect(struct TCP_Server_Info *server)
 
         /* before reconnecting the tcp session, mark the smb session (uid)
                 and the tid bad so they are not used until reconnected */
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalSMBSessionList) {
-                ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
-                if (ses->server) {
-                        if (ses->server == server) {
-                                ses->status = CifsNeedReconnect;
-                                ses->ipc_tid = 0;
-                        }
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &server->smb_ses_list) {
+                ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
+                ses->need_reconnect = true;
+                ses->ipc_tid = 0;
+                list_for_each(tmp2, &ses->tcon_list) {
+                        tcon = list_entry(tmp2, struct cifsTconInfo, tcon_list);
+                        tcon->need_reconnect = true;
                 }
-                /* else tcp and smb sessions need reconnection */
-        }
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                if ((tcon->ses) && (tcon->ses->server == server))
-                        tcon->tidStatus = CifsNeedReconnect;
         }
-        read_unlock(&GlobalSMBSeslock);
+        read_unlock(&cifs_tcp_ses_lock);
         /* do not want to be sending data on a socket we are freeing */
         down(&server->tcpSem);
         if (server->ssocket) {
@@ -193,7 +187,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         while ((server->tcpStatus != CifsExiting) &&
                (server->tcpStatus != CifsGood)) {
                 try_to_freeze();
-                if (server->protocolType == IPV6) {
+                if (server->addr.sockAddr6.sin6_family == AF_INET6) {
                         rc = ipv6_connect(&server->addr.sockAddr6,
                                           &server->ssocket, server->noautotune);
                 } else {
@@ -417,9 +411,14 @@ incomplete_rcv:
                         msleep(1); /* minimum sleep to prevent looping
                                 allowing socket to clear and app threads to set
                                 tcpStatus CifsNeedReconnect if server hung */
-                        if (pdu_length < 4)
+                        if (pdu_length < 4) {
+                                iov.iov_base = (4 - pdu_length) +
+                                                        (char *)smb_buffer;
+                                iov.iov_len = pdu_length;
+                                smb_msg.msg_control = NULL;
+                                smb_msg.msg_controllen = 0;
                                 goto incomplete_rcv;
-                        else
+                        } else
                                 continue;
                 } else if (length <= 0) {
                         if (server->tcpStatus == CifsNew) {
@@ -654,6 +653,11 @@ multi_t2_fnd:
                 }
         } /* end while !EXITING */
 
+        /* take it off the list, if it's not already */
+        write_lock(&cifs_tcp_ses_lock);
+        list_del_init(&server->tcp_ses_list);
+        write_unlock(&cifs_tcp_ses_lock);
+
         spin_lock(&GlobalMid_Lock);
         server->tcpStatus = CifsExiting;
         spin_unlock(&GlobalMid_Lock);
@@ -686,29 +690,29 @@ multi_t2_fnd:
         if (smallbuf) /* no sense logging a debug message if NULL */
                 cifs_small_buf_release(smallbuf);
 
-        read_lock(&GlobalSMBSeslock);
+        /*
+         * BB: we shouldn't have to do any of this. It shouldn't be
+         * possible to exit from the thread with active SMB sessions
+         */
+        read_lock(&cifs_tcp_ses_lock);
         if (list_empty(&server->pending_mid_q)) {
                 /* loop through server session structures attached to this and
                     mark them dead */
-                list_for_each(tmp, &GlobalSMBSessionList) {
-                        ses =
-                            list_entry(tmp, struct cifsSesInfo,
-                                       cifsSessionList);
-                        if (ses->server == server) {
-                                ses->status = CifsExiting;
-                                ses->server = NULL;
-                        }
+                list_for_each(tmp, &server->smb_ses_list) {
+                        ses = list_entry(tmp, struct cifsSesInfo,
+                                         smb_ses_list);
+                        ses->status = CifsExiting;
+                        ses->server = NULL;
                 }
-                read_unlock(&GlobalSMBSeslock);
+                read_unlock(&cifs_tcp_ses_lock);
         } else {
                 /* although we can not zero the server struct pointer yet,
                 since there are active requests which may depnd on them,
                 mark the corresponding SMB sessions as exiting too */
-                list_for_each(tmp, &GlobalSMBSessionList) {
+                list_for_each(tmp, &server->smb_ses_list) {
                         ses = list_entry(tmp, struct cifsSesInfo,
-                                         cifsSessionList);
-                        if (ses->server == server)
-                                ses->status = CifsExiting;
+                                         smb_ses_list);
+                        ses->status = CifsExiting;
                 }
 
                 spin_lock(&GlobalMid_Lock);
@@ -723,7 +727,7 @@ multi_t2_fnd:
                         }
                 }
                 spin_unlock(&GlobalMid_Lock);
-                read_unlock(&GlobalSMBSeslock);
+                read_unlock(&cifs_tcp_ses_lock);
                 /* 1/8th of sec is more than enough time for them to exit */
                 msleep(125);
         }
@@ -745,14 +749,13 @@ multi_t2_fnd:
         if there are any pointing to this (e.g
         if a crazy root user tried to kill cifsd
         kernel thread explicitly this might happen) */
-        write_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalSMBSessionList) {
-                ses = list_entry(tmp, struct cifsSesInfo,
-                                cifsSessionList);
-                if (ses->server == server)
-                        ses->server = NULL;
+        /* BB: This shouldn't be necessary, see above */
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &server->smb_ses_list) {
+                ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
+                ses->server = NULL;
         }
-        write_unlock(&GlobalSMBSeslock);
+        read_unlock(&cifs_tcp_ses_lock);
 
         kfree(server->hostname);
         task_to_wake = xchg(&server->tsk, NULL);
@@ -1352,94 +1355,158 @@ cifs_parse_mount_options(char *options, const char *devname,
         return 0;
 }
 
-static struct cifsSesInfo *
-cifs_find_tcp_session(struct in_addr *target_ip_addr,
-                      struct in6_addr *target_ip6_addr,
-                      char *userName, struct TCP_Server_Info **psrvTcp)
+static struct TCP_Server_Info *
+cifs_find_tcp_session(struct sockaddr *addr)
 {
         struct list_head *tmp;
-        struct cifsSesInfo *ses;
-
-        *psrvTcp = NULL;
+        struct TCP_Server_Info *server;
+        struct sockaddr_in *addr4 = (struct sockaddr_in *) addr;
+        struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *) addr;
+
+        write_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &cifs_tcp_ses_list) {
+                server = list_entry(tmp, struct TCP_Server_Info,
+                                    tcp_ses_list);
+                /*
+                 * the demux thread can exit on its own while still in CifsNew
+                 * so don't accept any sockets in that state. Since the
+                 * tcpStatus never changes back to CifsNew it's safe to check
+                 * for this without a lock.
+                 */
+                if (server->tcpStatus == CifsNew)
+                        continue;
 
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalSMBSessionList) {
-                ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
-                if (!ses->server)
+                if (addr->sa_family == AF_INET &&
+                    (addr4->sin_addr.s_addr !=
+                     server->addr.sockAddr.sin_addr.s_addr))
+                        continue;
+                else if (addr->sa_family == AF_INET6 &&
+                         memcmp(&server->addr.sockAddr6.sin6_addr,
+                                &addr6->sin6_addr, sizeof(addr6->sin6_addr)))
                         continue;
 
-                if (target_ip_addr &&
-                    ses->server->addr.sockAddr.sin_addr.s_addr != target_ip_addr->s_addr)
-                                continue;
-                else if (target_ip6_addr &&
-                         memcmp(&ses->server->addr.sockAddr6.sin6_addr,
-                                target_ip6_addr, sizeof(*target_ip6_addr)))
-                                continue;
-                /* BB lock server and tcp session; increment use count here?? */
+                ++server->srv_count;
+                write_unlock(&cifs_tcp_ses_lock);
+                cFYI(1, ("Existing tcp session with server found"));
+                return server;
+        }
+        write_unlock(&cifs_tcp_ses_lock);
+        return NULL;
+}
 
-                /* found a match on the TCP session */
-                *psrvTcp = ses->server;
+static void
+cifs_put_tcp_session(struct TCP_Server_Info *server)
+{
+        struct task_struct *task;
 
-                /* BB check if reconnection needed */
-                if (strncmp(ses->userName, userName, MAX_USERNAME_SIZE) == 0) {
-                        read_unlock(&GlobalSMBSeslock);
-                        /* Found exact match on both TCP and
-                           SMB sessions */
-                        return ses;
-                }
-                /* else tcp and smb sessions need reconnection */
+        write_lock(&cifs_tcp_ses_lock);
+        if (--server->srv_count > 0) {
+                write_unlock(&cifs_tcp_ses_lock);
+                return;
         }
-        read_unlock(&GlobalSMBSeslock);
 
-        return NULL;
+        list_del_init(&server->tcp_ses_list);
+        write_unlock(&cifs_tcp_ses_lock);
+
+        spin_lock(&GlobalMid_Lock);
+        server->tcpStatus = CifsExiting;
+        spin_unlock(&GlobalMid_Lock);
+
+        task = xchg(&server->tsk, NULL);
+        if (task)
+                force_sig(SIGKILL, task);
 }
 
-static struct cifsTconInfo *
-find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
+static struct cifsSesInfo *
+cifs_find_smb_ses(struct TCP_Server_Info *server, char *username)
 {
         struct list_head *tmp;
-        struct cifsTconInfo *tcon;
-        __be32 old_ip;
-
-        read_lock(&GlobalSMBSeslock);
+        struct cifsSesInfo *ses;
 
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                cFYI(1, ("Next tcon"));
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                if (!tcon->ses || !tcon->ses->server)
+        write_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &server->smb_ses_list) {
+                ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
+                if (strncmp(ses->userName, username, MAX_USERNAME_SIZE))
                         continue;
 
-                old_ip = tcon->ses->server->addr.sockAddr.sin_addr.s_addr;
-                cFYI(1, ("old ip addr: %x == new ip %x ?",
-                        old_ip, new_target_ip_addr));
+                ++ses->ses_count;
+                write_unlock(&cifs_tcp_ses_lock);
+                return ses;
+        }
+        write_unlock(&cifs_tcp_ses_lock);
+        return NULL;
+}
 
-                if (old_ip != new_target_ip_addr)
-                        continue;
+static void
+cifs_put_smb_ses(struct cifsSesInfo *ses)
+{
+        int xid;
+        struct TCP_Server_Info *server = ses->server;
 
-                /* BB lock tcon, server, tcp session and increment use count? */
-                /* found a match on the TCP session */
-                /* BB check if reconnection needed */
-                cFYI(1, ("IP match, old UNC: %s new: %s",
-                        tcon->treeName, uncName));
+        write_lock(&cifs_tcp_ses_lock);
+        if (--ses->ses_count > 0) {
+                write_unlock(&cifs_tcp_ses_lock);
+                return;
+        }
 
-                if (strncmp(tcon->treeName, uncName, MAX_TREE_SIZE))
-                        continue;
+        list_del_init(&ses->smb_ses_list);
+        write_unlock(&cifs_tcp_ses_lock);
 
-                cFYI(1, ("and old usr: %s new: %s",
-                        tcon->treeName, uncName));
+        if (ses->status == CifsGood) {
+                xid = GetXid();
+                CIFSSMBLogoff(xid, ses);
+                _FreeXid(xid);
+        }
+        sesInfoFree(ses);
+        cifs_put_tcp_session(server);
+}
 
-                if (strncmp(tcon->ses->userName, userName, MAX_USERNAME_SIZE))
+static struct cifsTconInfo *
+cifs_find_tcon(struct cifsSesInfo *ses, const char *unc)
+{
+        struct list_head *tmp;
+        struct cifsTconInfo *tcon;
+
+        write_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &ses->tcon_list) {
+                tcon = list_entry(tmp, struct cifsTconInfo, tcon_list);
+                if (tcon->tidStatus == CifsExiting)
+                        continue;
+                if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
                         continue;
 
-                /* matched smb session (user name) */
-                read_unlock(&GlobalSMBSeslock);
+                ++tcon->tc_count;
+                write_unlock(&cifs_tcp_ses_lock);
                 return tcon;
         }
-
-        read_unlock(&GlobalSMBSeslock);
+        write_unlock(&cifs_tcp_ses_lock);
         return NULL;
 }
 
+static void
+cifs_put_tcon(struct cifsTconInfo *tcon)
+{
+        int xid;
+        struct cifsSesInfo *ses = tcon->ses;
+
+        write_lock(&cifs_tcp_ses_lock);
+        if (--tcon->tc_count > 0) {
+                write_unlock(&cifs_tcp_ses_lock);
+                return;
+        }
+
+        list_del_init(&tcon->tcon_list);
+        write_unlock(&cifs_tcp_ses_lock);
+
+        xid = GetXid();
+        CIFSSMBTDis(xid, tcon);
+        _FreeXid(xid);
+
+        DeleteTconOplockQEntries(tcon);
+        tconInfoFree(tcon);
+        cifs_put_smb_ses(ses);
+}
+
 int
 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
@@ -1876,14 +1943,90 @@ convert_delimiter(char *path, char delim)
         }
 }
 
-static void
-kill_cifsd(struct TCP_Server_Info *server)
+static void setup_cifs_sb(struct smb_vol *pvolume_info,
+                          struct cifs_sb_info *cifs_sb)
 {
-        struct task_struct *task;
-
-        task = xchg(&server->tsk, NULL);
-        if (task)
-                force_sig(SIGKILL, task);
+        if (pvolume_info->rsize > CIFSMaxBufSize) {
+                cERROR(1, ("rsize %d too large, using MaxBufSize",
+                        pvolume_info->rsize));
+                cifs_sb->rsize = CIFSMaxBufSize;
+        } else if ((pvolume_info->rsize) &&
+                        (pvolume_info->rsize <= CIFSMaxBufSize))
+                cifs_sb->rsize = pvolume_info->rsize;
+        else /* default */
+                cifs_sb->rsize = CIFSMaxBufSize;
+
+        if (pvolume_info->wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
+                cERROR(1, ("wsize %d too large, using 4096 instead",
+                          pvolume_info->wsize));
+                cifs_sb->wsize = 4096;
+        } else if (pvolume_info->wsize)
+                cifs_sb->wsize = pvolume_info->wsize;
+        else
+                cifs_sb->wsize = min_t(const int,
+                                        PAGEVEC_SIZE * PAGE_CACHE_SIZE,
+                                        127*1024);
+                /* old default of CIFSMaxBufSize was too small now
+                   that SMB Write2 can send multiple pages in kvec.
+                   RFC1001 does not describe what happens when frame
+                   bigger than 128K is sent so use that as max in
+                   conjunction with 52K kvec constraint on arch with 4K
+                   page size  */
+
+        if (cifs_sb->rsize < 2048) {
+                cifs_sb->rsize = 2048;
+                /* Windows ME may prefer this */
+                cFYI(1, ("readsize set to minimum: 2048"));
+        }
+        /* calculate prepath */
+        cifs_sb->prepath = pvolume_info->prepath;
+        if (cifs_sb->prepath) {
+                cifs_sb->prepathlen = strlen(cifs_sb->prepath);
+                /* we can not convert the / to \ in the path
+                separators in the prefixpath yet because we do not
+                know (until reset_cifs_unix_caps is called later)
+                whether POSIX PATH CAP is available. We normalize
+                the / to \ after reset_cifs_unix_caps is called */
+                pvolume_info->prepath = NULL;
+        } else
+                cifs_sb->prepathlen = 0;
+        cifs_sb->mnt_uid = pvolume_info->linux_uid;
+        cifs_sb->mnt_gid = pvolume_info->linux_gid;
+        cifs_sb->mnt_file_mode = pvolume_info->file_mode;
+        cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
+        cFYI(1, ("file mode: 0x%x  dir mode: 0x%x",
+                cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
+
+        if (pvolume_info->noperm)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
+        if (pvolume_info->setuids)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
+        if (pvolume_info->server_ino)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
+        if (pvolume_info->remap)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
+        if (pvolume_info->no_xattr)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
+        if (pvolume_info->sfu_emul)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
+        if (pvolume_info->nobrl)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
+        if (pvolume_info->cifs_acl)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
+        if (pvolume_info->override_uid)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
+        if (pvolume_info->override_gid)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
+        if (pvolume_info->dynperm)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
+        if (pvolume_info->direct_io) {
+                cFYI(1, ("mounting share using direct i/o"));
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
+        }
+
+        if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
+                cERROR(1, ("mount option dynperm ignored if cifsacl "
+                           "mount option supported"));
 }
 
 int
@@ -1892,13 +2035,12 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 {
         int rc = 0;
         int xid;
-        int address_type = AF_INET;
         struct socket *csocket = NULL;
-        struct sockaddr_in sin_server;
-        struct sockaddr_in6 sin_server6;
+        struct sockaddr addr;
+        struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
+        struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
         struct smb_vol volume_info;
         struct cifsSesInfo *pSesInfo = NULL;
-        struct cifsSesInfo *existingCifsSes = NULL;
         struct cifsTconInfo *tcon = NULL;
         struct TCP_Server_Info *srvTcp = NULL;
 
@@ -1906,6 +2048,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 
 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
 
+        memset(&addr, 0, sizeof(struct sockaddr));
         memset(&volume_info, 0, sizeof(struct smb_vol));
         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
                 rc = -EINVAL;
@@ -1928,16 +2071,16 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 
         if (volume_info.UNCip && volume_info.UNC) {
                 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,
-                                    &sin_server.sin_addr.s_addr);
+                                    &sin_server->sin_addr.s_addr);
 
                 if (rc <= 0) {
                         /* not ipv4 address, try ipv6 */
                         rc = cifs_inet_pton(AF_INET6, volume_info.UNCip,
-                                            &sin_server6.sin6_addr.in6_u);
+                                            &sin_server6->sin6_addr.in6_u);
                         if (rc > 0)
-                                address_type = AF_INET6;
+                                addr.sa_family = AF_INET6;
                 } else {
-                        address_type = AF_INET;
+                        addr.sa_family = AF_INET;
                 }
 
                 if (rc <= 0) {
@@ -1977,41 +2120,25 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 }
         }
 
-        if (address_type == AF_INET)
-                existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
-                        NULL /* no ipv6 addr */,
-                        volume_info.username, &srvTcp);
-        else if (address_type == AF_INET6) {
-                cFYI(1, ("looking for ipv6 address"));
-                existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
-                        &sin_server6.sin6_addr,
-                        volume_info.username, &srvTcp);
-        } else {
-                rc = -EINVAL;
-                goto out;
-        }
-
-        if (srvTcp) {
-                cFYI(1, ("Existing tcp session with server found"));
-        } else {        /* create socket */
-                if (volume_info.port)
-                        sin_server.sin_port = htons(volume_info.port);
-                else
-                        sin_server.sin_port = 0;
-                if (address_type == AF_INET6) {
+        srvTcp = cifs_find_tcp_session(&addr);
+        if (!srvTcp) { /* create socket */
+                if (addr.sa_family == AF_INET6) {
                         cFYI(1, ("attempting ipv6 connect"));
                         /* BB should we allow ipv6 on port 139? */
                         /* other OS never observed in Wild doing 139 with v6 */
-                        rc = ipv6_connect(&sin_server6, &csocket,
+                        sin_server6->sin6_port = htons(volume_info.port);
+                        rc = ipv6_connect(sin_server6, &csocket,
                                         volume_info.noblocksnd);
-                } else
-                        rc = ipv4_connect(&sin_server, &csocket,
+                } else {
+                        sin_server->sin_port = htons(volume_info.port);
+                        rc = ipv4_connect(sin_server, &csocket,
                                   volume_info.source_rfc1001_name,
                                   volume_info.target_rfc1001_name,
                                   volume_info.noblocksnd,
                                   volume_info.noautotune);
+                }
                 if (rc < 0) {
-                        cERROR(1, ("Error connecting to IPv4 socket. "
+                        cERROR(1, ("Error connecting to socket. "
                                    "Aborting operation"));
                         if (csocket != NULL)
                                 sock_release(csocket);
@@ -2026,12 +2153,15 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 } else {
                         srvTcp->noblocksnd = volume_info.noblocksnd;
                         srvTcp->noautotune = volume_info.noautotune;
-                        memcpy(&srvTcp->addr.sockAddr, &sin_server,
-                                sizeof(struct sockaddr_in));
+                        if (addr.sa_family == AF_INET6)
+                                memcpy(&srvTcp->addr.sockAddr6, sin_server6,
+                                        sizeof(struct sockaddr_in6));
+                        else
+                                memcpy(&srvTcp->addr.sockAddr, sin_server,
+                                        sizeof(struct sockaddr_in));
                         atomic_set(&srvTcp->inFlight, 0);
                         /* BB Add code for ipv6 case too */
                         srvTcp->ssocket = csocket;
-                        srvTcp->protocolType = IPV4;
                         srvTcp->hostname = extract_hostname(volume_info.UNC);
                         if (IS_ERR(srvTcp->hostname)) {
                                 rc = PTR_ERR(srvTcp->hostname);
@@ -2061,15 +2191,28 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                         memcpy(srvTcp->server_RFC1001_name,
                                 volume_info.target_rfc1001_name, 16);
                         srvTcp->sequence_number = 0;
+                        INIT_LIST_HEAD(&srvTcp->tcp_ses_list);
+                        INIT_LIST_HEAD(&srvTcp->smb_ses_list);
+                        ++srvTcp->srv_count;
+                        write_lock(&cifs_tcp_ses_lock);
+                        list_add(&srvTcp->tcp_ses_list,
+                                 &cifs_tcp_ses_list);
+                        write_unlock(&cifs_tcp_ses_lock);
                 }
         }
 
-        if (existingCifsSes) {
-                pSesInfo = existingCifsSes;
+        pSesInfo = cifs_find_smb_ses(srvTcp, volume_info.username);
+        if (pSesInfo) {
                 cFYI(1, ("Existing smb sess found (status=%d)",
                         pSesInfo->status));
+                /*
+                 * The existing SMB session already has a reference to srvTcp,
+                 * so we can put back the extra one we got before
+                 */
+                cifs_put_tcp_session(srvTcp);
+
                 down(&pSesInfo->sesSem);
-                if (pSesInfo->status == CifsNeedReconnect) {
+                if (pSesInfo->need_reconnect) {
                         cFYI(1, ("Session needs reconnect"));
                         rc = cifs_setup_session(xid, pSesInfo,
                                                 cifs_sb->local_nls);
@@ -2078,187 +2221,101 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         } else if (!rc) {
                 cFYI(1, ("Existing smb sess not found"));
                 pSesInfo = sesInfoAlloc();
-                if (pSesInfo == NULL)
+                if (pSesInfo == NULL) {
                         rc = -ENOMEM;
-                else {
-                        pSesInfo->server = srvTcp;
-                        sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
-                                NIPQUAD(sin_server.sin_addr.s_addr));
-                }
+                        goto mount_fail_check;
+                }
+
+                /* new SMB session uses our srvTcp ref */
+                pSesInfo->server = srvTcp;
+                sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
+                        NIPQUAD(sin_server->sin_addr.s_addr));
+
+                write_lock(&cifs_tcp_ses_lock);
+                list_add(&pSesInfo->smb_ses_list, &srvTcp->smb_ses_list);
+                write_unlock(&cifs_tcp_ses_lock);
+
+                /* volume_info.password freed at unmount */
+                if (volume_info.password) {
+                        pSesInfo->password = volume_info.password;
+                        /* set to NULL to prevent freeing on exit */
+                        volume_info.password = NULL;
+                }
+                if (volume_info.username)
+                        strncpy(pSesInfo->userName, volume_info.username,
+                                MAX_USERNAME_SIZE);
+                if (volume_info.domainname) {
+                        int len = strlen(volume_info.domainname);
+                        pSesInfo->domainName = kmalloc(len + 1, GFP_KERNEL);
+                        if (pSesInfo->domainName)
+                                strcpy(pSesInfo->domainName,
+                                        volume_info.domainname);
+                }
+                pSesInfo->linux_uid = volume_info.linux_uid;
+                pSesInfo->overrideSecFlg = volume_info.secFlg;
+                down(&pSesInfo->sesSem);
 
-                if (!rc) {
-                        /* volume_info.password freed at unmount */
-                        if (volume_info.password) {
-                                pSesInfo->password = volume_info.password;
-                                /* set to NULL to prevent freeing on exit */
-                                volume_info.password = NULL;
-                        }
-                        if (volume_info.username)
-                                strncpy(pSesInfo->userName,
-                                        volume_info.username,
-                                        MAX_USERNAME_SIZE);
-                        if (volume_info.domainname) {
-                                int len = strlen(volume_info.domainname);
-                                pSesInfo->domainName =
-                                        kmalloc(len + 1, GFP_KERNEL);
-                                if (pSesInfo->domainName)
-                                        strcpy(pSesInfo->domainName,
-                                                volume_info.domainname);
-                        }
-                        pSesInfo->linux_uid = volume_info.linux_uid;
-                        pSesInfo->overrideSecFlg = volume_info.secFlg;
-                        down(&pSesInfo->sesSem);
-                        /* BB FIXME need to pass vol->secFlgs BB */
-                        rc = cifs_setup_session(xid, pSesInfo,
-                                                cifs_sb->local_nls);
-                        up(&pSesInfo->sesSem);
-                        if (!rc)
-                                atomic_inc(&srvTcp->socketUseCount);
-                }
+                /* BB FIXME need to pass vol->secFlgs BB */
+                rc = cifs_setup_session(xid, pSesInfo,
+                                        cifs_sb->local_nls);
+                up(&pSesInfo->sesSem);
         }
 
         /* search for existing tcon to this server share */
         if (!rc) {
-                if (volume_info.rsize > CIFSMaxBufSize) {
-                        cERROR(1, ("rsize %d too large, using MaxBufSize",
-                                volume_info.rsize));
-                        cifs_sb->rsize = CIFSMaxBufSize;
-                } else if ((volume_info.rsize) &&
-                                (volume_info.rsize <= CIFSMaxBufSize))
-                        cifs_sb->rsize = volume_info.rsize;
-                else /* default */
-                        cifs_sb->rsize = CIFSMaxBufSize;
-
-                if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
-                        cERROR(1, ("wsize %d too large, using 4096 instead",
-                                  volume_info.wsize));
-                        cifs_sb->wsize = 4096;
-                } else if (volume_info.wsize)
-                        cifs_sb->wsize = volume_info.wsize;
-                else
-                        cifs_sb->wsize =
-                                min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
-                                        127*1024);
-                        /* old default of CIFSMaxBufSize was too small now
-                           that SMB Write2 can send multiple pages in kvec.
-                           RFC1001 does not describe what happens when frame
-                           bigger than 128K is sent so use that as max in
-                           conjunction with 52K kvec constraint on arch with 4K
-                           page size  */
-
-                if (cifs_sb->rsize < 2048) {
-                        cifs_sb->rsize = 2048;
-                        /* Windows ME may prefer this */
-                        cFYI(1, ("readsize set to minimum: 2048"));
-                }
-                /* calculate prepath */
-                cifs_sb->prepath = volume_info.prepath;
-                if (cifs_sb->prepath) {
-                        cifs_sb->prepathlen = strlen(cifs_sb->prepath);
-                        /* we can not convert the / to \ in the path
-                        separators in the prefixpath yet because we do not
-                        know (until reset_cifs_unix_caps is called later)
-                        whether POSIX PATH CAP is available. We normalize
-                        the / to \ after reset_cifs_unix_caps is called */
-                        volume_info.prepath = NULL;
-                } else
-                        cifs_sb->prepathlen = 0;
-                cifs_sb->mnt_uid = volume_info.linux_uid;
-                cifs_sb->mnt_gid = volume_info.linux_gid;
-                cifs_sb->mnt_file_mode = volume_info.file_mode;
-                cifs_sb->mnt_dir_mode = volume_info.dir_mode;
-                cFYI(1, ("file mode: 0x%x  dir mode: 0x%x",
-                        cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
-
-                if (volume_info.noperm)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
-                if (volume_info.setuids)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
-                if (volume_info.server_ino)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
-                if (volume_info.remap)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
-                if (volume_info.no_xattr)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
-                if (volume_info.sfu_emul)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
-                if (volume_info.nobrl)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
-                if (volume_info.cifs_acl)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
-                if (volume_info.override_uid)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
-                if (volume_info.override_gid)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
-                if (volume_info.dynperm)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
-                if (volume_info.direct_io) {
-                        cFYI(1, ("mounting share using direct i/o"));
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
-                }
+                setup_cifs_sb(&volume_info, cifs_sb);
 
-                if ((volume_info.cifs_acl) && (volume_info.dynperm))
-                        cERROR(1, ("mount option dynperm ignored if cifsacl "
-                                   "mount option supported"));
-
-                tcon =
-                    find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
-                             volume_info.username);
+                tcon = cifs_find_tcon(pSesInfo, volume_info.UNC);
                 if (tcon) {
                         cFYI(1, ("Found match on UNC path"));
-                        /* we can have only one retry value for a connection
-                           to a share so for resources mounted more than once
-                           to the same server share the last value passed in
-                           for the retry flag is used */
-                        tcon->retry = volume_info.retry;
-                        tcon->nocase = volume_info.nocase;
-                        tcon->local_lease = volume_info.local_lease;
+                        /* existing tcon already has a reference */
+                        cifs_put_smb_ses(pSesInfo);
                         if (tcon->seal != volume_info.seal)
                                 cERROR(1, ("transport encryption setting "
                                            "conflicts with existing tid"));
                 } else {
                         tcon = tconInfoAlloc();
-                        if (tcon == NULL)
+                        if (tcon == NULL) {
                                 rc = -ENOMEM;
-                        else {
-                                /* check for null share name ie connecting to
-                                 * dfs root */
-
-                                /* BB check if this works for exactly length
-                                 * three strings */
-                                if ((strchr(volume_info.UNC + 3, '\\') == NULL)
-                                    && (strchr(volume_info.UNC + 3, '/') ==
-                                        NULL)) {
-/*                                      rc = connect_to_dfs_path(xid, pSesInfo,
-                                                "", cifs_sb->local_nls,
-                                                cifs_sb->mnt_cifs_flags &
-                                                  CIFS_MOUNT_MAP_SPECIAL_CHR);*/
-                                        cFYI(1, ("DFS root not supported"));
-                                        rc = -ENODEV;
-                                        goto out;
-                                } else {
-                                        /* BB Do we need to wrap sesSem around
-                                         * this TCon call and Unix SetFS as
-                                         * we do on SessSetup and reconnect? */
-                                        rc = CIFSTCon(xid, pSesInfo,
-                                                volume_info.UNC,
-                                                tcon, cifs_sb->local_nls);
-                                        cFYI(1, ("CIFS Tcon rc = %d", rc));
-                                        if (volume_info.nodfs) {
-                                                tcon->Flags &=
-                                                        ~SMB_SHARE_IS_IN_DFS;
-                                                cFYI(1, ("DFS disabled (%d)",
-                                                        tcon->Flags));
-                                        }
-                                }
-                                if (!rc) {
-                                        atomic_inc(&pSesInfo->inUse);
-                                        tcon->retry = volume_info.retry;
-                                        tcon->nocase = volume_info.nocase;
-                                        tcon->seal = volume_info.seal;
+                                goto mount_fail_check;
+                        }
+                        tcon->ses = pSesInfo;
+
+                        /* check for null share name ie connect to dfs root */
+                        if ((strchr(volume_info.UNC + 3, '\\') == NULL)
+                            && (strchr(volume_info.UNC + 3, '/') == NULL)) {
+                                /* rc = connect_to_dfs_path(...) */
+                                cFYI(1, ("DFS root not supported"));
+                                rc = -ENODEV;
+                                goto mount_fail_check;
+                        } else {
+                                /* BB Do we need to wrap sesSem around
+                                 * this TCon call and Unix SetFS as
+                                 * we do on SessSetup and reconnect? */
+                                rc = CIFSTCon(xid, pSesInfo, volume_info.UNC,
+                                              tcon, cifs_sb->local_nls);
+                                cFYI(1, ("CIFS Tcon rc = %d", rc));
+                                if (volume_info.nodfs) {
+                                        tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
+                                        cFYI(1, ("DFS disabled (%d)",
+                                                tcon->Flags));
                                 }
                         }
-                }
+                        if (rc)
+                                goto mount_fail_check;
+                        tcon->seal = volume_info.seal;
+                        write_lock(&cifs_tcp_ses_lock);
+                        list_add(&tcon->tcon_list, &pSesInfo->tcon_list);
+                        write_unlock(&cifs_tcp_ses_lock);
+                }
+
+                /* we can have only one retry value for a connection
+                   to a share so for resources mounted more than once
+                   to the same server share the last value passed in
+                   for the retry flag is used */
+                tcon->retry = volume_info.retry;
+                tcon->nocase = volume_info.nocase;
+                tcon->local_lease = volume_info.local_lease;
         }
         if (pSesInfo) {
                 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
@@ -2270,80 +2327,49 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
         sb->s_time_gran = 100;
 
-/* on error free sesinfo and tcon struct if needed */
+mount_fail_check:
+        /* on error free sesinfo and tcon struct if needed */
         if (rc) {
-                /* if session setup failed, use count is zero but
-                we still need to free cifsd thread */
-                if (atomic_read(&srvTcp->socketUseCount) == 0) {
-                        spin_lock(&GlobalMid_Lock);
-                        srvTcp->tcpStatus = CifsExiting;
-                        spin_unlock(&GlobalMid_Lock);
-                        kill_cifsd(srvTcp);
-                }
-                 /* If find_unc succeeded then rc == 0 so we can not end */
-                if (tcon)  /* up accidently freeing someone elses tcon struct */
-                        tconInfoFree(tcon);
-                if (existingCifsSes == NULL) {
-                        if (pSesInfo) {
-                                if ((pSesInfo->server) &&
-                                    (pSesInfo->status == CifsGood)) {
-                                        int temp_rc;
-                                        temp_rc = CIFSSMBLogoff(xid, pSesInfo);
-                                        /* if the socketUseCount is now zero */
-                                        if ((temp_rc == -ESHUTDOWN) &&
-                                            (pSesInfo->server))
-                                                kill_cifsd(pSesInfo->server);
-                                } else {
-                                        cFYI(1, ("No session or bad tcon"));
-                                        if (pSesInfo->server) {
-                                                spin_lock(&GlobalMid_Lock);
-                                                srvTcp->tcpStatus = CifsExiting;
-                                                spin_unlock(&GlobalMid_Lock);
-                                                kill_cifsd(pSesInfo->server);
-                                        }
-                                }
-                                sesInfoFree(pSesInfo);
-                                /* pSesInfo = NULL; */
-                        }
-                }
-        } else {
-                atomic_inc(&tcon->useCount);
-                cifs_sb->tcon = tcon;
-                tcon->ses = pSesInfo;
-
-                /* do not care if following two calls succeed - informational */
-                if (!tcon->ipc) {
-                        CIFSSMBQFSDeviceInfo(xid, tcon);
-                        CIFSSMBQFSAttributeInfo(xid, tcon);
-                }
-
-                /* tell server which Unix caps we support */
-                if (tcon->ses->capabilities & CAP_UNIX)
-                        /* reset of caps checks mount to see if unix extensions
-                           disabled for just this mount */
-                        reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
+                /* If find_unc succeeded then rc == 0 so we can not end */
+                /* up accidently freeing someone elses tcon struct */
+                if (tcon)
+                        cifs_put_tcon(tcon);
+                else if (pSesInfo)
+                        cifs_put_smb_ses(pSesInfo);
                 else
-                        tcon->unix_ext = 0; /* server does not support them */
+                        cifs_put_tcp_session(srvTcp);
+                goto out;
+        }
+        cifs_sb->tcon = tcon;
 
-                /* convert forward to back slashes in prepath here if needed */
-                if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
-                        convert_delimiter(cifs_sb->prepath,
-                                          CIFS_DIR_SEP(cifs_sb));
+        /* do not care if following two calls succeed - informational */
+        if (!tcon->ipc) {
+                CIFSSMBQFSDeviceInfo(xid, tcon);
+                CIFSSMBQFSAttributeInfo(xid, tcon);
+        }
 
-                if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
-                        cifs_sb->rsize = 1024 * 127;
-                        cFYI(DBG2,
-                                ("no very large read support, rsize now 127K"));
-                }
-                if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
-                        cifs_sb->wsize = min(cifs_sb->wsize,
-                                             (tcon->ses->server->maxBuf -
-                                              MAX_CIFS_HDR_SIZE));
-                if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
-                        cifs_sb->rsize = min(cifs_sb->rsize,
-                                             (tcon->ses->server->maxBuf -
-                                              MAX_CIFS_HDR_SIZE));
+        /* tell server which Unix caps we support */
+        if (tcon->ses->capabilities & CAP_UNIX)
+                /* reset of caps checks mount to see if unix extensions
+                   disabled for just this mount */
+                reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
+        else
+                tcon->unix_ext = 0; /* server does not support them */
+
+        /* convert forward to back slashes in prepath here if needed */
+        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
+                convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb));
+
+        if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
+                cifs_sb->rsize = 1024 * 127;
+                cFYI(DBG2, ("no very large read support, rsize now 127K"));
         }
+        if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
+                cifs_sb->wsize = min(cifs_sb->wsize,
+                               (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
+        if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
+                cifs_sb->rsize = min(cifs_sb->rsize,
+                               (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
 
         /* volume_info.password is freed above when existing session found
         (in which case it is not needed anymore) but when new sesion is created
@@ -3513,6 +3539,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
         /* above now done in SendReceive */
         if ((rc == 0) && (tcon != NULL)) {
                 tcon->tidStatus = CifsGood;
+                tcon->need_reconnect = false;
                 tcon->tid = smb_buffer_response->Tid;
                 bcc_ptr = pByteArea(smb_buffer_response);
                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
@@ -3584,48 +3611,17 @@ int
 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
 {
         int rc = 0;
-        int xid;
-        struct cifsSesInfo *ses = NULL;
         char *tmp;
 
-        xid = GetXid();
-
-        if (cifs_sb->tcon) {
-                ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
-                rc = CIFSSMBTDis(xid, cifs_sb->tcon);
-                if (rc == -EBUSY) {
-                        FreeXid(xid);
-                        return 0;
-                }
-                DeleteTconOplockQEntries(cifs_sb->tcon);
-                tconInfoFree(cifs_sb->tcon);
-                if ((ses) && (ses->server)) {
-                        /* save off task so we do not refer to ses later */
-                        cFYI(1, ("About to do SMBLogoff "));
-                        rc = CIFSSMBLogoff(xid, ses);
-                        if (rc == -EBUSY) {
-                                FreeXid(xid);
-                                return 0;
-                        } else if (rc == -ESHUTDOWN) {
-                                cFYI(1, ("Waking up socket by sending signal"));
-                                if (ses->server)
-                                        kill_cifsd(ses->server);
-                                rc = 0;
-                        } /* else - we have an smb session
-                                left on this socket do not kill cifsd */
-                } else
-                        cFYI(1, ("No session or bad tcon"));
-        }
+        if (cifs_sb->tcon)
+                cifs_put_tcon(cifs_sb->tcon);
 
         cifs_sb->tcon = NULL;
         tmp = cifs_sb->prepath;
         cifs_sb->prepathlen = 0;
         cifs_sb->prepath = NULL;
         kfree(tmp);
-        if (ses)
-                sesInfoFree(ses);
 
-        FreeXid(xid);
         return rc;
 }
 
@@ -3741,6 +3737,7 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                 cFYI(1, ("CIFS Session Established successfully"));
                         spin_lock(&GlobalMid_Lock);
                         pSesInfo->status = CifsGood;
+                        pSesInfo->need_reconnect = false;
                         spin_unlock(&GlobalMid_Lock);
         }
 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index ead1a3bb0256..6449e1aae621 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -493,7 +493,7 @@ int cifs_close(struct inode *inode, struct file *file)
                 if (pTcon) {
                         /* no sense reconnecting to close a file that is
                            already closed */
-                        if (pTcon->tidStatus != CifsNeedReconnect) {
+                        if (!pTcon->need_reconnect) {
                                 timeout = 2;
                                 while ((atomic_read(&pSMBFile->wrtPending) != 0)
                                         && (timeout <= 2048)) {
@@ -1404,7 +1404,10 @@ retry:
                         if ((wbc->nr_to_write -= n_iov) <= 0)
                                 done = 1;
                         index = next;
-                }
+                } else
+                        /* Need to re-find the pages we skipped */
+                        index = pvec.pages[0]->index + 1;
+
                 pagevec_release(&pvec);
         }
         if (!scanned && !done) {
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 88786ba02d27..addd1dcc2d79 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -75,12 +75,12 @@ sesInfoAlloc(void)
 
         ret_buf = kzalloc(sizeof(struct cifsSesInfo), GFP_KERNEL);
         if (ret_buf) {
-                write_lock(&GlobalSMBSeslock);
                 atomic_inc(&sesInfoAllocCount);
                 ret_buf->status = CifsNew;
-                list_add(&ret_buf->cifsSessionList, &GlobalSMBSessionList);
+                ++ret_buf->ses_count;
+                INIT_LIST_HEAD(&ret_buf->smb_ses_list);
+                INIT_LIST_HEAD(&ret_buf->tcon_list);
                 init_MUTEX(&ret_buf->sesSem);
-                write_unlock(&GlobalSMBSeslock);
         }
         return ret_buf;
 }
@@ -93,10 +93,7 @@ sesInfoFree(struct cifsSesInfo *buf_to_free)
                 return;
         }
 
-        write_lock(&GlobalSMBSeslock);
         atomic_dec(&sesInfoAllocCount);
-        list_del(&buf_to_free->cifsSessionList);
-        write_unlock(&GlobalSMBSeslock);
         kfree(buf_to_free->serverOS);
         kfree(buf_to_free->serverDomain);
         kfree(buf_to_free->serverNOS);
@@ -111,17 +108,14 @@ tconInfoAlloc(void)
         struct cifsTconInfo *ret_buf;
         ret_buf = kzalloc(sizeof(struct cifsTconInfo), GFP_KERNEL);
         if (ret_buf) {
-                write_lock(&GlobalSMBSeslock);
                 atomic_inc(&tconInfoAllocCount);
-                list_add(&ret_buf->cifsConnectionList,
-                         &GlobalTreeConnectionList);
                 ret_buf->tidStatus = CifsNew;
+                ++ret_buf->tc_count;
                 INIT_LIST_HEAD(&ret_buf->openFileList);
-                init_MUTEX(&ret_buf->tconSem);
+                INIT_LIST_HEAD(&ret_buf->tcon_list);
 #ifdef CONFIG_CIFS_STATS
                 spin_lock_init(&ret_buf->stat_lock);
 #endif
-                write_unlock(&GlobalSMBSeslock);
         }
         return ret_buf;
 }
@@ -133,10 +127,7 @@ tconInfoFree(struct cifsTconInfo *buf_to_free)
                 cFYI(1, ("Null buffer passed to tconInfoFree"));
                 return;
         }
-        write_lock(&GlobalSMBSeslock);
         atomic_dec(&tconInfoAllocCount);
-        list_del(&buf_to_free->cifsConnectionList);
-        write_unlock(&GlobalSMBSeslock);
         kfree(buf_to_free->nativeFileSystem);
         kfree(buf_to_free);
 }
@@ -350,9 +341,9 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
                                 if (current->fsuid != treeCon->ses->linux_uid) {
                                         cFYI(1, ("Multiuser mode and UID "
                                                  "did not match tcon uid"));
-                                        read_lock(&GlobalSMBSeslock);
-                                        list_for_each(temp_item, &GlobalSMBSessionList) {
-                                                ses = list_entry(temp_item, struct cifsSesInfo, cifsSessionList);
+                                        read_lock(&cifs_tcp_ses_lock);
+                                        list_for_each(temp_item, &treeCon->ses->server->smb_ses_list) {
+                                                ses = list_entry(temp_item, struct cifsSesInfo, smb_ses_list);
                                                 if (ses->linux_uid == current->fsuid) {
                                                         if (ses->server == treeCon->ses->server) {
                                                                 cFYI(1, ("found matching uid substitute right smb_uid"));
@@ -364,7 +355,7 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
                                                         }
                                                 }
                                         }
-                                        read_unlock(&GlobalSMBSeslock);
+                                        read_unlock(&cifs_tcp_ses_lock);
                                 }
                         }
                 }
@@ -497,9 +488,10 @@ bool
 is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
 {
         struct smb_com_lock_req *pSMB = (struct smb_com_lock_req *)buf;
-        struct list_head *tmp;
-        struct list_head *tmp1;
+        struct list_head *tmp, *tmp1, *tmp2;
+        struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
+        struct cifsInodeInfo *pCifsInode;
         struct cifsFileInfo *netfile;
 
         cFYI(1, ("Checking for oplock break or dnotify response"));
@@ -554,42 +546,42 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
                 return false;
 
         /* look up tcon based on tid & uid */
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                if ((tcon->tid == buf->Tid) && (srv == tcon->ses->server)) {
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &srv->smb_ses_list) {
+                ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
+                list_for_each(tmp1, &ses->tcon_list) {
+                        tcon = list_entry(tmp1, struct cifsTconInfo, tcon_list);
+                        if (tcon->tid != buf->Tid)
+                                continue;
+
                         cifs_stats_inc(&tcon->num_oplock_brks);
-                        list_for_each(tmp1, &tcon->openFileList) {
-                                netfile = list_entry(tmp1, struct cifsFileInfo,
+                        list_for_each(tmp2, &tcon->openFileList) {
+                                netfile = list_entry(tmp2, struct cifsFileInfo,
                                                      tlist);
-                                if (pSMB->Fid == netfile->netfid) {
-                                        struct cifsInodeInfo *pCifsInode;
-                                        read_unlock(&GlobalSMBSeslock);
-                                        cFYI(1,
-                                            ("file id match, oplock break"));
-                                        pCifsInode =
-                                                CIFS_I(netfile->pInode);
-                                        pCifsInode->clientCanCacheAll = false;
-                                        if (pSMB->OplockLevel == 0)
-                                                pCifsInode->clientCanCacheRead
-                                                        = false;
-                                        pCifsInode->oplockPending = true;
-                                        AllocOplockQEntry(netfile->pInode,
-                                                          netfile->netfid,
-                                                          tcon);
-                                        cFYI(1,
-                                            ("about to wake up oplock thread"));
-                                        if (oplockThread)
-                                            wake_up_process(oplockThread);
-                                        return true;
-                                }
+                                if (pSMB->Fid != netfile->netfid)
+                                        continue;
+
+                                read_unlock(&cifs_tcp_ses_lock);
+                                cFYI(1, ("file id match, oplock break"));
+                                pCifsInode = CIFS_I(netfile->pInode);
+                                pCifsInode->clientCanCacheAll = false;
+                                if (pSMB->OplockLevel == 0)
+                                        pCifsInode->clientCanCacheRead = false;
+                                pCifsInode->oplockPending = true;
+                                AllocOplockQEntry(netfile->pInode,
+                                                  netfile->netfid, tcon);
+                                cFYI(1, ("about to wake up oplock thread"));
+                                if (oplockThread)
+                                        wake_up_process(oplockThread);
+
+                                return true;
                         }
-                        read_unlock(&GlobalSMBSeslock);
+                        read_unlock(&cifs_tcp_ses_lock);
                         cFYI(1, ("No matching file for oplock break"));
                         return true;
                 }
         }
-        read_unlock(&GlobalSMBSeslock);
+        read_unlock(&cifs_tcp_ses_lock);
         cFYI(1, ("Can not process oplock break for non-existent connection"));
         return true;
 }
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 94fcfff6863a..06ed10b7da9e 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -31,6 +31,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
         inode->i_flags |= S_PRIVATE; /* tell selinux to ignore this inode */
         inode->i_mode = table->mode;
+        inode->i_uid = inode->i_gid = 0;
         if (!table->child) {
                 inode->i_mode |= S_IFREG;
                 inode->i_op = &proc_sys_inode_operations;
diff --git a/include/linux/input.h b/include/linux/input.h
index b86fb5581ce6..5341e8251f8c 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -238,6 +238,7 @@ struct input_absinfo {
 #define KEY_KPEQUAL             117
 #define KEY_KPPLUSMINUS         118
 #define KEY_PAUSE               119
+#define KEY_SCALE               120     /* AL Compiz Scale (Expose) */
 
 #define KEY_KPCOMMA             121
 #define KEY_HANGEUL             122
@@ -322,6 +323,7 @@ struct input_absinfo {
 #define KEY_PAUSECD             201
 #define KEY_PROG3               202
 #define KEY_PROG4               203
+#define KEY_DASHBOARD           204     /* AL Dashboard */
 #define KEY_SUSPEND             205
 #define KEY_CLOSE               206     /* AC Close */
 #define KEY_PLAY                207
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index 331e5f1c2d8e..29aec6e10020 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -331,10 +331,11 @@ static inline void lockdep_on(void)
 # define lock_set_subclass(l, s, i)             do { } while (0)
 # define lockdep_init()                         do { } while (0)
 # define lockdep_info()                         do { } while (0)
-# define lockdep_init_map(lock, name, key, sub) do { (void)(key); } while (0)
+# define lockdep_init_map(lock, name, key, sub) \
+                do { (void)(name); (void)(key); } while (0)
 # define lockdep_set_class(lock, key)           do { (void)(key); } while (0)
 # define lockdep_set_class_and_name(lock, key, name) \
-                do { (void)(key); } while (0)
+                do { (void)(key); (void)(name); } while (0)
 #define lockdep_set_class_and_subclass(lock, key, sub) \
                 do { (void)(key); } while (0)
 #define lockdep_set_subclass(lock, sub)         do { } while (0)
diff --git a/include/net/sock.h b/include/net/sock.h
index c04f9e18ea22..2f47107f6d0f 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -815,7 +815,7 @@ static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)
  */
 #define sock_lock_init_class_and_name(sk, sname, skey, name, key)       \
 do {                                                                    \
-        sk->sk_lock.owned = 0;                                  \
+        sk->sk_lock.owned = 0;                                          \
         init_waitqueue_head(&sk->sk_lock.wq);                           \
         spin_lock_init(&(sk)->sk_lock.slock);                           \
         debug_check_no_locks_freed((void *)&(sk)->sk_lock,              \
diff --git a/kernel/Makefile b/kernel/Makefile
index 9a3ec66a9d84..19fad003b19d 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -11,8 +11,6 @@ obj-y     = sched.o fork.o exec_domain.o panic.o printk.o \
             hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
             notifier.o ksysfs.o pm_qos_params.o sched_clock.o
 
-CFLAGS_REMOVE_sched.o = -mno-spe
-
 ifdef CONFIG_FUNCTION_TRACER
 # Do not trace debug files and internal ftrace files
 CFLAGS_REMOVE_lockdep.o = -pg
@@ -21,7 +19,7 @@ CFLAGS_REMOVE_mutex-debug.o = -pg
 CFLAGS_REMOVE_rtmutex-debug.o = -pg
 CFLAGS_REMOVE_cgroup-debug.o = -pg
 CFLAGS_REMOVE_sched_clock.o = -pg
-CFLAGS_REMOVE_sched.o = -mno-spe -pg
+CFLAGS_REMOVE_sched.o = -pg
 endif
 
 obj-$(CONFIG_FREEZER) += freezer.o
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 9bc4c00872c9..24e8ceacc388 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -112,7 +112,7 @@ static int chill(void *unused)
 int __stop_machine(int (*fn)(void *), void *data, const cpumask_t *cpus)
 {
         struct work_struct *sm_work;
-        int i;
+        int i, ret;
 
         /* Set up initial state. */
         mutex_lock(&lock);
@@ -137,8 +137,9 @@ int __stop_machine(int (*fn)(void *), void *data, const cpumask_t *cpus)
         /* This will release the thread on our CPU. */
         put_cpu();
         flush_workqueue(stop_machine_wq);
+        ret = active.fnret;
         mutex_unlock(&lock);
-        return active.fnret;
+        return ret;
 }
 
 int stop_machine(int (*fn)(void *), void *data, const cpumask_t *cpus)
diff --git a/mm/mlock.c b/mm/mlock.c
index a6da2aee940a..1ada366570cb 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -162,7 +162,7 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         unsigned long addr = start;
         struct page *pages[16]; /* 16 gives a reasonable batch */
         int nr_pages = (end - start) / PAGE_SIZE;
-        int ret;
+        int ret = 0;
         int gup_flags = 0;
 
         VM_BUG_ON(start & ~PAGE_MASK);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 31f29d2989fd..4dfb6b4d4559 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -878,7 +878,9 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                 if (ifm->ifi_change)
                         flags = (flags & ifm->ifi_change) |
                                 (dev->flags & ~ifm->ifi_change);
-                dev_change_flags(dev, flags);
+                err = dev_change_flags(dev, flags);
+                if (err < 0)
+                        goto errout;
         }
 
         if (tb[IFLA_TXQLEN])
diff --git a/net/core/scm.c b/net/core/scm.c
index ab242cc1acca..b12303dd39d9 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -75,7 +75,6 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                 if (!fpl)
                         return -ENOMEM;
                 *fplp = fpl;
-                INIT_LIST_HEAD(&fpl->list);
                 fpl->count = 0;
         }
         fpp = &fpl->fp[fpl->count];
@@ -301,7 +300,6 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
 
         new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
         if (new_fpl) {
-                INIT_LIST_HEAD(&new_fpl->list);
                 for (i=fpl->count-1; i>=0; i--)
                         get_file(fpl->fp[i]);
                 memcpy(new_fpl, fpl, sizeof(*fpl));
diff --git a/net/core/sock.c b/net/core/sock.c
index 5e2a3132a8c9..341e39456952 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -136,7 +136,6 @@
 static struct lock_class_key af_family_keys[AF_MAX];
 static struct lock_class_key af_family_slock_keys[AF_MAX];
 
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
 /*
  * Make lock validator output more readable. (we pre-construct these
  * strings build-time, so that runtime initialization of socket
@@ -187,7 +186,6 @@ static const char *af_family_clock_key_strings[AF_MAX+1] = {
   "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
   "clock-AF_MAX"
 };
-#endif
 
 /*
  * sk_callback_lock locking rules are per-address-family,
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 861978a4f1a8..cfb38ac9d698 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -209,9 +209,17 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
 
                 hash = protocol & (MAX_INET_PROTOS - 1);
                 ipprot = rcu_dereference(inet_protos[hash]);
-                if (ipprot != NULL && (net == &init_net || ipprot->netns_ok)) {
+                if (ipprot != NULL) {
                         int ret;
 
+                        if (!net_eq(net, &init_net) && !ipprot->netns_ok) {
+                                if (net_ratelimit())
+                                        printk("%s: proto %d isn't netns-ready\n",
+                                                __func__, protocol);
+                                kfree_skb(skb);
+                                goto out;
+                        }
+
                         if (!ipprot->no_policy) {
                                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                                         kfree_skb(skb);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 410046a8cc91..e44deb8d4df2 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -661,6 +661,11 @@ int datagram_send_ctl(struct net *net,
                         switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1) {
+                                        err = -EINVAL;
+                                        goto exit_f;
+                                }
                                 break;
 #endif
                         default:
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4e5eac301f91..2aa294be0c79 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -366,11 +366,16 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 }
 
                 /* routing header option needs extra check */
+                retv = -EINVAL;
                 if (optname == IPV6_RTHDR && opt && opt->srcrt) {
                         struct ipv6_rt_hdr *rthdr = opt->srcrt;
                         switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1)
+                                        goto sticky_done;
+
                                 break;
 #endif
                         default:
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index defeb7a0d502..7ab30f668b5a 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -144,8 +144,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
         struct phonethdr *ph;
         int err;
 
-        if (skb->len + 2 > 0xffff) {
-                /* Phonet length field would overflow */
+        if (skb->len + 2 > 0xffff /* Phonet length field limit */ ||
+            skb->len + sizeof(struct phonethdr) > dev->mtu) {
                 err = -EMSGSIZE;
                 goto drop;
         }