112 files changed, 1501 insertions, 1302 deletions
diff --git a/.gitignore b/.gitignore
index b1f5b9df2ae1..e1d5c17c12c2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,9 @@
 *.ko
 *.so
 *.mod.c
+*.i
+*.lst
+*.symtypes
 #
 # Top-level generic files
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index d1cd5f93e028..552507fe9a7e 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -281,3 +281,16 @@ Why:	The deferred output hooks are a layering violation causing unusual
 Who:    Patrick McHardy <kaber@trash.net>
 ---------------------------
+What:   frame diverter
+When:   November 2006
+Why:    The frame diverter is included in most distribution kernels, but is
+        broken. It does not correctly handle many things:
+        - IPV6
+        - non-linear skb's
+        - network device RCU on removal
+        - input frames not correctly checked for protocol errors
+        It also adds allocation overhead even if not enabled.
+        It is not clear if anyone is still using it.
+Who:    Stephen Hemminger <shemminger@osdl.org>
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 7947cede8712..71d05f481727 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -697,6 +697,12 @@ running once the system is up.
        ips=            [HW,SCSI] Adaptec / IBM ServeRAID controller
                        See header of drivers/scsi/ips.c.
+        ports=          [IP_VS_FTP] IPVS ftp helper module
+                        Default is 21.
+                        Up to 8 (IP_VS_APP_MAX_PORTS) ports
+                        may be specified.
+                        Format: <port>,<port>....
        irqfixup        [HW]
                        When an interrupt is not handled search all handlers
                        for it. Intended to get systems with badly broken
@@ -1183,8 +1189,6 @@ running once the system is up.
                                Mechanism 2.
                nommconf        [IA-32,X86_64] Disable use of MMCONFIG for PCI
                                Configuration
-                mmconf          [IA-32,X86_64] Force MMCONFIG. This is useful
-                                to override the builtin blacklist.
                nomsi           [MSI] If the PCI_MSI kernel config parameter is
                                enabled, this kernel boot option can be used to
                                disable the use of MSI interrupts system-wide.
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 3e0c017e7877..90ed78110fd4 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -102,9 +102,15 @@ inet_peer_gc_maxtime - INTEGER
 TCP variables: 
 tcp_abc - INTEGER
-        Controls Appropriate Byte Count defined in RFC3465. If set to
+        Controls Appropriate Byte Count (ABC) defined in RFC3465.
-        0 then does congestion avoid once per ack. 1 is conservative
+        ABC is a way of increasing congestion window (cwnd) more slowly
-        value, and 2 is more agressive.
+        in response to partial acknowledgments.
+        Possible values are:
+                0 increase cwnd once per acknowledgment (no ABC)
+                1 increase cwnd once per acknowledgment of full sized segment
+                2 allow increase cwnd by two if acknowledgment is
+                  of two segments to compensate for delayed acknowledgments.
+        Default: 0 (off)
 tcp_syn_retries - INTEGER
        Number of times initial SYNs for an active TCP connection attempt
diff --git a/MAINTAINERS b/MAINTAINERS
index 7e86286ddf1e..11b59d2c7cf5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -416,7 +416,7 @@ S:	Supported
 ATM
 P:      Chas Williams
 M:      chas@cmf.nrl.navy.mil
-L:      linux-atm-general@lists.sourceforge.net
+L:      linux-atm-general@lists.sourceforge.net (subscribers-only)
 W:      http://linux-atm.sourceforge.net
 S:      Maintained
@@ -2817,6 +2817,14 @@ M:	hadi@cyberus.ca
 L:      netdev@vger.kernel.org
 S:      Maintained
+TCP LOW PRIORITY MODULE
+P:      Wong Hoi Sing, Edison
+M:      hswong3i@gmail.com
+P:      Hung Hing Lun, Mike
+M:      hlhung3i@gmail.com
+W:      http://tcp-lp-mod.sourceforge.net/
+S:      Maintained
 TI OMAP RANDOM NUMBER GENERATOR SUPPORT
 P:      Deepak Saxena
 M:      dsaxena@plexity.net
diff --git a/Makefile b/Makefile
index eab5a8c2ee49..edfc2fdf76c9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 18
-EXTRAVERSION = -rc7
+EXTRAVERSION =
-NAME=Crazed Snow-Weasel
+NAME=Avast! A bilge rat!
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
@@ -889,7 +889,7 @@ depend dep:
 # ---------------------------------------------------------------------------
 # Kernel headers
-INSTALL_HDR_PATH=$(MODLIB)/abi
+INSTALL_HDR_PATH=$(objtree)/usr
 export INSTALL_HDR_PATH
 PHONY += headers_install
@@ -986,7 +986,7 @@ CLEAN_FILES +=	vmlinux System.map \
                .tmp_kallsyms* .tmp_version .tmp_vmlinux* .tmp_System.map
 # Directories & files removed with 'make mrproper'
-MRPROPER_DIRS  += include/config include2
+MRPROPER_DIRS  += include/config include2 usr/include
 MRPROPER_FILES += .config .config.old include/asm .version .old_version \
                  include/linux/autoconf.h include/linux/version.h      \
                  include/linux/utsrelease.h                            \
@@ -1077,11 +1077,12 @@ help:
        @echo  '  kernelrelease   - Output the release version string'
        @echo  '  kernelversion   - Output the version stored in Makefile'
        @echo  '  headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'
-        @echo  '                    (default: /lib/modules/$$VERSION/abi)'
+        @echo  '                    (default: $(INSTALL_HDR_PATH))'
        @echo  ''
        @echo  'Static analysers'
        @echo  '  checkstack      - Generate a list of stack hogs'
        @echo  '  namespacecheck  - Name space analysis on compiled kernel'
+        @echo  '  headers_check   - Sanity check on exported headers'
        @echo  ''
        @echo  'Kernel packaging:'
        @$(MAKE) $(build)=$(package-dir) help
diff --git a/arch/arm/configs/pnx4008_defconfig b/arch/arm/configs/pnx4008_defconfig
index 8a078d479d57..a4989f44baaa 100644
--- a/arch/arm/configs/pnx4008_defconfig
+++ b/arch/arm/configs/pnx4008_defconfig
@@ -1,14 +1,18 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.17-rc1
+# Linux kernel version: 2.6.18-rc6
-# Thu Apr  6 17:05:58 2006
+# Mon Sep 11 13:59:24 2006
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_VECTORS_BASE=0xffff0000
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 #
 # Code maturity level options
@@ -28,6 +32,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 # CONFIG_BSD_PROCESS_ACCT_V3 is not set
+# CONFIG_TASKSTATS is not set
 CONFIG_SYSCTL=y
 CONFIG_AUDIT=y
 # CONFIG_IKCONFIG is not set
@@ -44,14 +49,15 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
+CONFIG_RT_MUTEXES=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
 CONFIG_SLAB=y
+CONFIG_VM_EVENT_COUNTERS=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
-CONFIG_OBSOLETE_INTERMODULE=m
 #
 # Loadable module support
@@ -84,18 +90,26 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 #
 # System Type
 #
+# CONFIG_ARCH_AAEC2000 is not set
+# CONFIG_ARCH_INTEGRATOR is not set
+# CONFIG_ARCH_REALVIEW is not set
+# CONFIG_ARCH_VERSATILE is not set
+# CONFIG_ARCH_AT91 is not set
 # CONFIG_ARCH_CLPS7500 is not set
 # CONFIG_ARCH_CLPS711X is not set
 # CONFIG_ARCH_CO285 is not set
 # CONFIG_ARCH_EBSA110 is not set
 # CONFIG_ARCH_EP93XX is not set
 # CONFIG_ARCH_FOOTBRIDGE is not set
-# CONFIG_ARCH_INTEGRATOR is not set
+# CONFIG_ARCH_NETX is not set
+# CONFIG_ARCH_H720X is not set
+# CONFIG_ARCH_IMX is not set
 # CONFIG_ARCH_IOP3XX is not set
 # CONFIG_ARCH_IXP4XX is not set
 # CONFIG_ARCH_IXP2000 is not set
 # CONFIG_ARCH_IXP23XX is not set
 # CONFIG_ARCH_L7200 is not set
+CONFIG_ARCH_PNX4008=y
 # CONFIG_ARCH_PXA is not set
 # CONFIG_ARCH_RPC is not set
 # CONFIG_ARCH_SA1100 is not set
@@ -103,13 +117,6 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 # CONFIG_ARCH_SHARK is not set
 # CONFIG_ARCH_LH7A40X is not set
 # CONFIG_ARCH_OMAP is not set
-# CONFIG_ARCH_VERSATILE is not set
-# CONFIG_ARCH_REALVIEW is not set
-# CONFIG_ARCH_IMX is not set
-# CONFIG_ARCH_H720X is not set
-# CONFIG_ARCH_AAEC2000 is not set
-# CONFIG_ARCH_AT91RM9200 is not set
-CONFIG_ARCH_PNX4008=y
 #
 # Processor Type
@@ -138,15 +145,7 @@ CONFIG_ARM_THUMB=y
 #
 # PCCARD (PCMCIA/CardBus) support
 #
-CONFIG_PCCARD=m
+# CONFIG_PCCARD is not set
-# CONFIG_PCMCIA_DEBUG is not set
-CONFIG_PCMCIA=m
-CONFIG_PCMCIA_LOAD_CIS=y
-CONFIG_PCMCIA_IOCTL=y
-#
-# PC-card bridges
-#
 #
 # Kernel Features
@@ -164,13 +163,14 @@ CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4096
+# CONFIG_RESOURCES_64BIT is not set
 CONFIG_ALIGNMENT_TRAP=y
 #
 # Boot options
 #
-CONFIG_ZBOOT_ROM_TEXT=0
+CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0
+CONFIG_ZBOOT_ROM_BSS=0x0
 CONFIG_CMDLINE="mem=64M console=ttyS0,115200"
 # CONFIG_XIP_KERNEL is not set
@@ -181,7 +181,8 @@ CONFIG_CMDLINE="mem=64M console=ttyS0,115200"
 #
 # At least one emulation must be selected
 #
-# CONFIG_FPE_NWFPE is not set
+CONFIG_FPE_NWFPE=y
+# CONFIG_FPE_NWFPE_XP is not set
 # CONFIG_FPE_FASTFPE is not set
 # CONFIG_VFP is not set
@@ -199,7 +200,7 @@ CONFIG_BINFMT_MISC=m
 CONFIG_PM=y
 CONFIG_PM_LEGACY=y
 # CONFIG_PM_DEBUG is not set
-CONFIG_APM=m
+# CONFIG_APM is not set
 #
 # Networking
@@ -210,12 +211,12 @@ CONFIG_NET=y
 # Networking options
 #
 # CONFIG_NETDEBUG is not set
-CONFIG_PACKET=m
+CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
-CONFIG_UNIX=m
+CONFIG_UNIX=y
 CONFIG_XFRM=y
-CONFIG_XFRM_USER=m
+# CONFIG_XFRM_USER is not set
-CONFIG_NET_KEY=m
+# CONFIG_NET_KEY is not set
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -227,10 +228,12 @@ CONFIG_IP_ROUTE_FWMARK=y
 CONFIG_IP_ROUTE_MULTIPATH=y
 # CONFIG_IP_ROUTE_MULTIPATH_CACHED is not set
 CONFIG_IP_ROUTE_VERBOSE=y
-# CONFIG_IP_PNP is not set
+CONFIG_IP_PNP=y
-CONFIG_NET_IPIP=m
+CONFIG_IP_PNP_DHCP=y
-CONFIG_NET_IPGRE=m
+CONFIG_IP_PNP_BOOTP=y
-CONFIG_NET_IPGRE_BROADCAST=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
 CONFIG_IP_MROUTE=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
@@ -241,6 +244,8 @@ CONFIG_INET_ESP=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_TUNNEL=m
 CONFIG_INET_TUNNEL=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
@@ -287,7 +292,10 @@ CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_INET6_XFRM_TUNNEL=m
 CONFIG_INET6_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_TRANSPORT=m
+CONFIG_INET6_XFRM_MODE_TUNNEL=m
 CONFIG_IPV6_TUNNEL=m
+# CONFIG_NETWORK_SECMARK is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
 CONFIG_BRIDGE_NETFILTER=y
@@ -313,6 +321,7 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 # CONFIG_IP_NF_H323 is not set
+# CONFIG_IP_NF_SIP is not set
 CONFIG_IP_NF_QUEUE=m
 #
@@ -384,7 +393,7 @@ CONFIG_LLC2=m
 CONFIG_IPX=m
 # CONFIG_IPX_INTERN is not set
 CONFIG_ATALK=m
-CONFIG_DEV_APPLETALK=y
+CONFIG_DEV_APPLETALK=m
 CONFIG_IPDDP=m
 CONFIG_IPDDP_ENCAP=y
 CONFIG_IPDDP_DECAP=y
@@ -445,110 +454,9 @@ CONFIG_NET_ESTIMATOR=y
 # Network testing
 #
 CONFIG_NET_PKTGEN=m
-CONFIG_HAMRADIO=y
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
-#
+# CONFIG_BT is not set
-# Packet Radio protocols
-#
-CONFIG_AX25=m
-# CONFIG_AX25_DAMA_SLAVE is not set
-CONFIG_NETROM=m
-CONFIG_ROSE=m
-#
-# AX.25 network device drivers
-#
-CONFIG_MKISS=m
-CONFIG_6PACK=m
-CONFIG_BPQETHER=m
-CONFIG_BAYCOM_SER_FDX=m
-CONFIG_BAYCOM_SER_HDX=m
-CONFIG_BAYCOM_PAR=m
-CONFIG_BAYCOM_EPP=m
-CONFIG_YAM=m
-CONFIG_IRDA=m
-#
-# IrDA protocols
-#
-CONFIG_IRLAN=m
-CONFIG_IRNET=m
-CONFIG_IRCOMM=m
-# CONFIG_IRDA_ULTRA is not set
-#
-# IrDA options
-#
-CONFIG_IRDA_CACHE_LAST_LSAP=y
-CONFIG_IRDA_FAST_RR=y
-CONFIG_IRDA_DEBUG=y
-#
-# Infrared-port device drivers
-#
-#
-# SIR device drivers
-#
-CONFIG_IRTTY_SIR=m
-#
-# Dongle support
-#
-CONFIG_DONGLE=y
-CONFIG_ESI_DONGLE=m
-CONFIG_ACTISYS_DONGLE=m
-CONFIG_TEKRAM_DONGLE=m
-# CONFIG_TOIM3232_DONGLE is not set
-CONFIG_LITELINK_DONGLE=m
-CONFIG_MA600_DONGLE=m
-CONFIG_GIRBIL_DONGLE=m
-CONFIG_MCP2120_DONGLE=m
-CONFIG_OLD_BELKIN_DONGLE=m
-CONFIG_ACT200L_DONGLE=m
-#
-# Old SIR device drivers
-#
-CONFIG_IRPORT_SIR=m
-#
-# Old Serial dongle support
-#
-# CONFIG_DONGLE_OLD is not set
-#
-# FIR device drivers
-#
-CONFIG_USB_IRDA=m
-CONFIG_SIGMATEL_FIR=m
-CONFIG_BT=m
-CONFIG_BT_L2CAP=m
-CONFIG_BT_SCO=m
-CONFIG_BT_RFCOMM=m
-CONFIG_BT_RFCOMM_TTY=y
-CONFIG_BT_BNEP=m
-CONFIG_BT_BNEP_MC_FILTER=y
-CONFIG_BT_BNEP_PROTO_FILTER=y
-CONFIG_BT_CMTP=m
-CONFIG_BT_HIDP=m
-#
-# Bluetooth device drivers
-#
-CONFIG_BT_HCIUSB=m
-CONFIG_BT_HCIUSB_SCO=y
-CONFIG_BT_HCIUART=m
-CONFIG_BT_HCIUART_H4=y
-CONFIG_BT_HCIUART_BCSP=y
-CONFIG_BT_HCIBCM203X=m
-# CONFIG_BT_HCIBPA10X is not set
-CONFIG_BT_HCIBFUSB=m
-CONFIG_BT_HCIDTL1=m
-CONFIG_BT_HCIBT3C=m
-CONFIG_BT_HCIBLUECARD=m
-CONFIG_BT_HCIBTUART=m
-CONFIG_BT_HCIVHCI=m
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
 # CONFIG_IEEE80211_CRYPT_WEP is not set
@@ -566,8 +474,9 @@ CONFIG_WIRELESS_EXT=y
 #
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
 # CONFIG_DEBUG_DRIVER is not set
+# CONFIG_SYS_HYPERVISOR is not set
 #
 # Connector - unified userspace <-> kernelspace linker
@@ -577,11 +486,11 @@ CONFIG_FW_LOADER=m
 #
 # Memory Technology Devices (MTD)
 #
-CONFIG_MTD=m
+CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
-CONFIG_MTD_CONCAT=m
+CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_REDBOOT_PARTS=m
+CONFIG_MTD_REDBOOT_PARTS=y
 CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
 # CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED is not set
 # CONFIG_MTD_REDBOOT_PARTS_READONLY is not set
@@ -591,22 +500,18 @@ CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
 #
 # User Modules And Translation Layers
 #
-CONFIG_MTD_CHAR=m
+CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=m
+CONFIG_MTD_BLOCK=y
-CONFIG_MTD_BLOCK_RO=m
+# CONFIG_FTL is not set
-CONFIG_FTL=m
+# CONFIG_NFTL is not set
-CONFIG_NFTL=m
+# CONFIG_INFTL is not set
-CONFIG_NFTL_RW=y
-CONFIG_INFTL=m
 # CONFIG_RFD_FTL is not set
 #
 # RAM/ROM/Flash chip drivers
 #
-CONFIG_MTD_CFI=m
+# CONFIG_MTD_CFI is not set
-CONFIG_MTD_JEDECPROBE=m
+# CONFIG_MTD_JEDECPROBE is not set
-CONFIG_MTD_GEN_PROBE=m
-# CONFIG_MTD_CFI_ADV_OPTIONS is not set
 CONFIG_MTD_MAP_BANK_WIDTH_1=y
 CONFIG_MTD_MAP_BANK_WIDTH_2=y
 CONFIG_MTD_MAP_BANK_WIDTH_4=y
@@ -617,36 +522,27 @@ CONFIG_MTD_CFI_I1=y
 CONFIG_MTD_CFI_I2=y
 # CONFIG_MTD_CFI_I4 is not set
 # CONFIG_MTD_CFI_I8 is not set
-CONFIG_MTD_CFI_INTELEXT=m
+# CONFIG_MTD_RAM is not set
-CONFIG_MTD_CFI_AMDSTD=m
+# CONFIG_MTD_ROM is not set
-CONFIG_MTD_CFI_STAA=m
+# CONFIG_MTD_ABSENT is not set
-CONFIG_MTD_CFI_UTIL=m
-CONFIG_MTD_RAM=m
-CONFIG_MTD_ROM=m
-CONFIG_MTD_ABSENT=m
 # CONFIG_MTD_OBSOLETE_CHIPS is not set
 #
 # Mapping drivers for chip access
 #
-CONFIG_MTD_COMPLEX_MAPPINGS=y
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
-CONFIG_MTD_PHYSMAP=m
-CONFIG_MTD_PHYSMAP_START=0x8000000
-CONFIG_MTD_PHYSMAP_LEN=0x4000000
-CONFIG_MTD_PHYSMAP_BANKWIDTH=2
-# CONFIG_MTD_ARM_INTEGRATOR is not set
-# CONFIG_MTD_IMPA7 is not set
 # CONFIG_MTD_PLATRAM is not set
 #
 # Self-contained MTD device drivers
 #
+# CONFIG_MTD_DATAFLASH is not set
+# CONFIG_MTD_M25P80 is not set
 CONFIG_MTD_SLRAM=m
 CONFIG_MTD_PHRAM=m
 CONFIG_MTD_MTDRAM=m
 CONFIG_MTDRAM_TOTAL_SIZE=4096
 CONFIG_MTDRAM_ERASE_SIZE=128
-CONFIG_MTD_BLKMTD=m
 # CONFIG_MTD_BLOCK2MTD is not set
 #
@@ -663,14 +559,12 @@ CONFIG_MTD_DOCPROBE_ADDRESS=0
 #
 # NAND Flash Device Drivers
 #
-CONFIG_MTD_NAND=m
+CONFIG_MTD_NAND=y
 # CONFIG_MTD_NAND_VERIFY_WRITE is not set
-CONFIG_MTD_NAND_IDS=m
+# CONFIG_MTD_NAND_ECC_SMC is not set
-CONFIG_MTD_NAND_DISKONCHIP=m
+CONFIG_MTD_NAND_IDS=y
-# CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADVANCED is not set
+# CONFIG_MTD_NAND_DISKONCHIP is not set
-CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADDRESS=0
+CONFIG_MTD_NAND_NANDSIM=m
-# CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE is not set
-# CONFIG_MTD_NAND_NANDSIM is not set
 #
 # OneNAND Flash Device Drivers
@@ -680,15 +574,7 @@ CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADDRESS=0
 #
 # Parallel port support
 #
-CONFIG_PARPORT=m
+# CONFIG_PARPORT is not set
-CONFIG_PARPORT_PC=m
-CONFIG_PARPORT_PC_FIFO=y
-# CONFIG_PARPORT_PC_SUPERIO is not set
-CONFIG_PARPORT_PC_PCMCIA=m
-CONFIG_PARPORT_NOT_PC=y
-# CONFIG_PARPORT_ARC is not set
-# CONFIG_PARPORT_GSC is not set
-CONFIG_PARPORT_1284=y
 #
 # Plug and Play support
@@ -697,45 +583,15 @@ CONFIG_PARPORT_1284=y
 #
 # Block devices
 #
-CONFIG_PARIDE=m
-CONFIG_PARIDE_PARPORT=m
-#
-# Parallel IDE high-level drivers
-#
-CONFIG_PARIDE_PD=m
-CONFIG_PARIDE_PCD=m
-CONFIG_PARIDE_PF=m
-CONFIG_PARIDE_PT=m
-CONFIG_PARIDE_PG=m
-#
-# Parallel IDE protocol modules
-#
-CONFIG_PARIDE_ATEN=m
-CONFIG_PARIDE_BPCK=m
-CONFIG_PARIDE_BPCK6=m
-CONFIG_PARIDE_COMM=m
-CONFIG_PARIDE_DSTR=m
-CONFIG_PARIDE_FIT2=m
-CONFIG_PARIDE_FIT3=m
-CONFIG_PARIDE_EPAT=m
-# CONFIG_PARIDE_EPATC8 is not set
-CONFIG_PARIDE_EPIA=m
-CONFIG_PARIDE_FRIQ=m
-CONFIG_PARIDE_FRPW=m
-CONFIG_PARIDE_KBIC=m
-CONFIG_PARIDE_KTTI=m
-CONFIG_PARIDE_ON20=m
-CONFIG_PARIDE_ON26=m
 # CONFIG_BLK_DEV_COW_COMMON is not set
-CONFIG_BLK_DEV_LOOP=m
+CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_CRYPTOLOOP=y
-CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_NBD=y
 # CONFIG_BLK_DEV_UB is not set
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
@@ -743,34 +599,6 @@ CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_ATA_OVER_ETH is not set
 #
-# ATA/ATAPI/MFM/RLL support
-#
-CONFIG_IDE=m
-CONFIG_BLK_DEV_IDE=m
-#
-# Please see Documentation/ide.txt for help/info on IDE drives
-#
-# CONFIG_BLK_DEV_IDE_SATA is not set
-CONFIG_BLK_DEV_IDEDISK=m
-# CONFIG_IDEDISK_MULTI_MODE is not set
-CONFIG_BLK_DEV_IDECS=m
-CONFIG_BLK_DEV_IDECD=m
-CONFIG_BLK_DEV_IDETAPE=m
-CONFIG_BLK_DEV_IDEFLOPPY=m
-CONFIG_BLK_DEV_IDESCSI=m
-# CONFIG_IDE_TASK_IOCTL is not set
-#
-# IDE chipset support/bugfixes
-#
-CONFIG_IDE_GENERIC=m
-# CONFIG_IDE_ARM is not set
-# CONFIG_BLK_DEV_IDEDMA is not set
-# CONFIG_IDEDMA_AUTO is not set
-# CONFIG_BLK_DEV_HD is not set
-#
 # SCSI device support
 #
 # CONFIG_RAID_ATTRS is not set
@@ -808,41 +636,12 @@ CONFIG_SCSI_FC_ATTRS=m
 #
 # CONFIG_ISCSI_TCP is not set
 CONFIG_SCSI_SATA=m
-CONFIG_SCSI_PPA=m
-CONFIG_SCSI_IMM=m
-# CONFIG_SCSI_IZIP_EPP16 is not set
-# CONFIG_SCSI_IZIP_SLOW_CTR is not set
 CONFIG_SCSI_DEBUG=m
 #
-# PCMCIA SCSI adapter support
-#
-CONFIG_PCMCIA_AHA152X=m
-CONFIG_PCMCIA_FDOMAIN=m
-CONFIG_PCMCIA_NINJA_SCSI=m
-CONFIG_PCMCIA_QLOGIC=m
-CONFIG_PCMCIA_SYM53C500=m
-#
 # Multi-device support (RAID and LVM)
 #
-CONFIG_MD=y
+# CONFIG_MD is not set
-CONFIG_BLK_DEV_MD=m
-CONFIG_MD_LINEAR=m
-CONFIG_MD_RAID0=m
-CONFIG_MD_RAID1=m
-CONFIG_MD_RAID10=m
-CONFIG_MD_RAID5=m
-# CONFIG_MD_RAID5_RESHAPE is not set
-CONFIG_MD_RAID6=m
-CONFIG_MD_MULTIPATH=m
-CONFIG_MD_FAULTY=m
-CONFIG_BLK_DEV_DM=m
-CONFIG_DM_CRYPT=m
-CONFIG_DM_SNAPSHOT=m
-CONFIG_DM_MIRROR=m
-CONFIG_DM_ZERO=m
-# CONFIG_DM_MULTIPATH is not set
 #
 # Fusion MPT device support
@@ -878,9 +677,6 @@ CONFIG_NET_ETHERNET=y
 CONFIG_MII=m
 # CONFIG_SMC91X is not set
 # CONFIG_DM9000 is not set
-CONFIG_NET_POCKET=y
-CONFIG_DE600=m
-CONFIG_DE620=m
 #
 # Ethernet (1000 Mbit)
@@ -904,49 +700,13 @@ CONFIG_NET_RADIO=y
 # Obsolete Wireless cards support (pre-802.11)
 #
 CONFIG_STRIP=m
-CONFIG_PCMCIA_WAVELAN=m
+# CONFIG_USB_ZD1201 is not set
-CONFIG_PCMCIA_NETWAVE=m
-#
-# Wireless 802.11 Frequency Hopping cards support
-#
-CONFIG_PCMCIA_RAYCS=m
-#
-# Wireless 802.11b ISA/PCI cards support
-#
-CONFIG_HERMES=m
-CONFIG_ATMEL=m
-#
-# Wireless 802.11b Pcmcia/Cardbus cards support
-#
-CONFIG_PCMCIA_HERMES=m
-# CONFIG_PCMCIA_SPECTRUM is not set
-CONFIG_AIRO_CS=m
-CONFIG_PCMCIA_ATMEL=m
-CONFIG_PCMCIA_WL3501=m
 # CONFIG_HOSTAP is not set
-CONFIG_NET_WIRELESS=y
-#
-# PCMCIA network device support
-#
-CONFIG_NET_PCMCIA=y
-CONFIG_PCMCIA_3C589=m
-CONFIG_PCMCIA_3C574=m
-CONFIG_PCMCIA_FMVJ18X=m
-CONFIG_PCMCIA_PCNET=m
-CONFIG_PCMCIA_NMCLAN=m
-CONFIG_PCMCIA_SMC91C92=m
-CONFIG_PCMCIA_XIRC2PS=m
-CONFIG_PCMCIA_AXNET=m
 #
 # Wan interfaces
 #
 CONFIG_WAN=y
-CONFIG_SYNCLINK_SYNCPPP=m
 CONFIG_HDLC=m
 CONFIG_HDLC_RAW=y
 CONFIG_HDLC_RAW_ETH=y
@@ -966,7 +726,6 @@ CONFIG_X25_ASY=m
 #
 # CONFIG_ATM_DUMMY is not set
 CONFIG_ATM_TCP=m
-CONFIG_PLIP=m
 CONFIG_PPP=m
 CONFIG_PPP_MULTILINK=y
 CONFIG_PPP_FILTER=y
@@ -991,114 +750,7 @@ CONFIG_NET_POLL_CONTROLLER=y
 #
 # ISDN subsystem
 #
-CONFIG_ISDN=m
+# CONFIG_ISDN is not set
-#
-# Old ISDN4Linux
-#
-CONFIG_ISDN_I4L=m
-CONFIG_ISDN_PPP=y
-CONFIG_ISDN_PPP_VJ=y
-CONFIG_ISDN_MPP=y
-CONFIG_IPPP_FILTER=y
-CONFIG_ISDN_PPP_BSDCOMP=m
-CONFIG_ISDN_AUDIO=y
-CONFIG_ISDN_TTY_FAX=y
-CONFIG_ISDN_X25=y
-#
-# ISDN feature submodules
-#
-CONFIG_ISDN_DRV_LOOP=m
-CONFIG_ISDN_DIVERSION=m
-#
-# ISDN4Linux hardware drivers
-#
-#
-# Passive cards
-#
-CONFIG_ISDN_DRV_HISAX=m
-#
-# D-channel protocol features
-#
-CONFIG_HISAX_EURO=y
-CONFIG_DE_AOC=y
-# CONFIG_HISAX_NO_SENDCOMPLETE is not set
-# CONFIG_HISAX_NO_LLC is not set
-# CONFIG_HISAX_NO_KEYPAD is not set
-CONFIG_HISAX_1TR6=y
-CONFIG_HISAX_NI1=y
-CONFIG_HISAX_MAX_CARDS=8
-#
-# HiSax supported cards
-#
-CONFIG_HISAX_16_3=y
-CONFIG_HISAX_S0BOX=y
-CONFIG_HISAX_FRITZPCI=y
-CONFIG_HISAX_AVM_A1_PCMCIA=y
-CONFIG_HISAX_ELSA=y
-CONFIG_HISAX_DIEHLDIVA=y
-CONFIG_HISAX_SEDLBAUER=y
-CONFIG_HISAX_NICCY=y
-CONFIG_HISAX_GAZEL=y
-CONFIG_HISAX_HFC_SX=y
-# CONFIG_HISAX_DEBUG is not set
-#
-# HiSax PCMCIA card service modules
-#
-CONFIG_HISAX_SEDLBAUER_CS=m
-CONFIG_HISAX_ELSA_CS=m
-CONFIG_HISAX_AVM_A1_CS=m
-CONFIG_HISAX_TELES_CS=m
-#
-# HiSax sub driver modules
-#
-CONFIG_HISAX_ST5481=m
-CONFIG_HISAX_HFCUSB=m
-# CONFIG_HISAX_HFC4S8S is not set
-CONFIG_HISAX_HDLC=y
-#
-# Active cards
-#
-#
-# Siemens Gigaset
-#
-# CONFIG_ISDN_DRV_GIGASET is not set
-#
-# CAPI subsystem
-#
-CONFIG_ISDN_CAPI=m
-CONFIG_ISDN_DRV_AVMB1_VERBOSE_REASON=y
-CONFIG_ISDN_CAPI_MIDDLEWARE=y
-CONFIG_ISDN_CAPI_CAPI20=m
-CONFIG_ISDN_CAPI_CAPIFS_BOOL=y
-CONFIG_ISDN_CAPI_CAPIFS=m
-CONFIG_ISDN_CAPI_CAPIDRV=m
-#
-# CAPI hardware drivers
-#
-#
-# Active AVM cards
-#
-CONFIG_CAPI_AVM=y
-CONFIG_ISDN_DRV_AVMB1_B1PCMCIA=m
-CONFIG_ISDN_DRV_AVMB1_AVM_CS=m
-#
-# Active Eicon DIVA Server cards
-#
-CONFIG_CAPI_EICON=y
 #
 # Input device support
@@ -1108,10 +760,7 @@ CONFIG_INPUT=y
 #
 # Userland interfaces
 #
-CONFIG_INPUT_MOUSEDEV=m
+# CONFIG_INPUT_MOUSEDEV is not set
-CONFIG_INPUT_MOUSEDEV_PSAUX=y
-CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
-CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
 CONFIG_INPUT_JOYDEV=m
 CONFIG_INPUT_TSDEV=m
 CONFIG_INPUT_TSDEV_SCREEN_X=240
@@ -1153,11 +802,9 @@ CONFIG_JOYSTICK_SPACEORB=m
 CONFIG_JOYSTICK_SPACEBALL=m
 CONFIG_JOYSTICK_STINGER=m
 # CONFIG_JOYSTICK_TWIDJOY is not set
-CONFIG_JOYSTICK_DB9=m
-CONFIG_JOYSTICK_GAMECON=m
-CONFIG_JOYSTICK_TURBOGRAFX=m
 CONFIG_JOYSTICK_JOYDUMP=m
 CONFIG_INPUT_TOUCHSCREEN=y
+# CONFIG_TOUCHSCREEN_ADS7846 is not set
 CONFIG_TOUCHSCREEN_GUNZE=m
 # CONFIG_TOUCHSCREEN_ELO is not set
 # CONFIG_TOUCHSCREEN_MTOUCH is not set
@@ -1170,7 +817,6 @@ CONFIG_INPUT_UINPUT=m
 #
 CONFIG_SERIO=y
 CONFIG_SERIO_SERPORT=m
-CONFIG_SERIO_PARKBD=m
 CONFIG_SERIO_LIBPS2=y
 CONFIG_SERIO_RAW=m
 CONFIG_GAMEPORT=m
@@ -1183,32 +829,14 @@ CONFIG_GAMEPORT_L4=m
 CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
-CONFIG_SERIAL_NONSTANDARD=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
-CONFIG_COMPUTONE=m
+# CONFIG_SERIAL_NONSTANDARD is not set
-CONFIG_ROCKETPORT=m
-CONFIG_CYCLADES=m
-# CONFIG_CYZ_INTR is not set
-CONFIG_DIGIEPCA=m
-CONFIG_MOXA_INTELLIO=m
-CONFIG_MOXA_SMARTIO=m
-# CONFIG_ISI is not set
-CONFIG_SYNCLINKMP=m
-CONFIG_N_HDLC=m
-# CONFIG_RISCOM8 is not set
-# CONFIG_SPECIALIX is not set
-CONFIG_SX=m
-CONFIG_RIO=m
-CONFIG_RIO_OLDPCI=y
-CONFIG_STALDRV=y
-CONFIG_STALLION=m
-CONFIG_ISTALLION=m
 #
 # Serial drivers
 #
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_CS=m
 CONFIG_SERIAL_8250_NR_UARTS=4
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
@@ -1225,20 +853,11 @@ CONFIG_SERIAL_CORE_CONSOLE=y
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
-CONFIG_PRINTER=m
-# CONFIG_LP_CONSOLE is not set
-CONFIG_PPDEV=m
-CONFIG_TIPAR=m
 #
 # IPMI
 #
-CONFIG_IPMI_HANDLER=m
+# CONFIG_IPMI_HANDLER is not set
-# CONFIG_IPMI_PANIC_EVENT is not set
-CONFIG_IPMI_DEVICE_INTERFACE=m
-CONFIG_IPMI_SI=m
-CONFIG_IPMI_WATCHDOG=m
-CONFIG_IPMI_POWEROFF=m
 #
 # Watchdog Cards
@@ -1255,22 +874,15 @@ CONFIG_SOFT_WATCHDOG=m
 # USB-based Watchdog Cards
 #
 CONFIG_USBPCWATCHDOG=m
-CONFIG_NVRAM=m
+CONFIG_HW_RANDOM=y
-CONFIG_DTLK=m
+# CONFIG_NVRAM is not set
-CONFIG_R3964=m
+# CONFIG_DTLK is not set
+# CONFIG_R3964 is not set
 #
 # Ftape, the floppy tape device driver
 #
+# CONFIG_RAW_DRIVER is not set
-#
-# PCMCIA character devices
-#
-CONFIG_SYNCLINK_CS=m
-# CONFIG_CARDMAN_4000 is not set
-# CONFIG_CARDMAN_4040 is not set
-CONFIG_RAW_DRIVER=m
-CONFIG_MAX_RAW_DEVS=256
 #
 # TPM devices
@@ -1281,8 +893,8 @@ CONFIG_MAX_RAW_DEVS=256
 #
 # I2C support
 #
-CONFIG_I2C=m
+CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_CHARDEV=y
 #
 # I2C Algorithms
@@ -1294,11 +906,10 @@ CONFIG_I2C_ALGOPCA=m
 #
 # I2C Hardware Bus support
 #
-CONFIG_I2C_ISA=m
+# CONFIG_I2C_OCORES is not set
-CONFIG_I2C_PARPORT=m
+# CONFIG_I2C_PARPORT_LIGHT is not set
-CONFIG_I2C_PARPORT_LIGHT=m
+# CONFIG_I2C_STUB is not set
-CONFIG_I2C_STUB=m
+# CONFIG_I2C_PCA_ISA is not set
-CONFIG_I2C_PCA_ISA=m
 #
 # Miscellaneous I2C Chip support
@@ -1318,66 +929,28 @@ CONFIG_SENSORS_PCF8591=m
 #
 # SPI support
 #
-# CONFIG_SPI is not set
+CONFIG_SPI=y
-# CONFIG_SPI_MASTER is not set
+# CONFIG_SPI_DEBUG is not set
+CONFIG_SPI_MASTER=y
 #
-# Dallas's 1-wire bus
+# SPI Master Controller Drivers
 #
-CONFIG_W1=m
+CONFIG_SPI_BITBANG=y
 #
-# 1-wire Bus Masters
+# SPI Protocol Masters
 #
-# CONFIG_W1_MASTER_DS9490 is not set
-# CONFIG_W1_MASTER_DS2482 is not set
 #
-# 1-wire Slaves
+# Dallas's 1-wire bus
 #
-# CONFIG_W1_SLAVE_THERM is not set
-# CONFIG_W1_SLAVE_SMEM is not set
-# CONFIG_W1_SLAVE_DS2433 is not set
 #
 # Hardware Monitoring support
 #
-CONFIG_HWMON=y
+# CONFIG_HWMON is not set
-CONFIG_HWMON_VID=m
+# CONFIG_HWMON_VID is not set
-CONFIG_SENSORS_ADM1021=m
-CONFIG_SENSORS_ADM1025=m
-CONFIG_SENSORS_ADM1026=m
-CONFIG_SENSORS_ADM1031=m
-# CONFIG_SENSORS_ADM9240 is not set
-CONFIG_SENSORS_ASB100=m
-# CONFIG_SENSORS_ATXP1 is not set
-CONFIG_SENSORS_DS1621=m
-# CONFIG_SENSORS_F71805F is not set
-CONFIG_SENSORS_FSCHER=m
-# CONFIG_SENSORS_FSCPOS is not set
-CONFIG_SENSORS_GL518SM=m
-# CONFIG_SENSORS_GL520SM is not set
-CONFIG_SENSORS_IT87=m
-CONFIG_SENSORS_LM63=m
-CONFIG_SENSORS_LM75=m
-CONFIG_SENSORS_LM77=m
-CONFIG_SENSORS_LM78=m
-CONFIG_SENSORS_LM80=m
-CONFIG_SENSORS_LM83=m
-CONFIG_SENSORS_LM85=m
-CONFIG_SENSORS_LM87=m
-CONFIG_SENSORS_LM90=m
-# CONFIG_SENSORS_LM92 is not set
-CONFIG_SENSORS_MAX1619=m
-CONFIG_SENSORS_PC87360=m
-CONFIG_SENSORS_SMSC47M1=m
-# CONFIG_SENSORS_SMSC47B397 is not set
-CONFIG_SENSORS_W83781D=m
-# CONFIG_SENSORS_W83792D is not set
-CONFIG_SENSORS_W83L785TS=m
-CONFIG_SENSORS_W83627HF=m
-# CONFIG_SENSORS_W83627EHF is not set
-# CONFIG_HWMON_DEBUG_CHIP is not set
 #
 # Misc devices
@@ -1389,9 +962,18 @@ CONFIG_SENSORS_W83627HF=m
 # CONFIG_NEW_LEDS is not set
 #
+# LED drivers
+#
+#
+# LED Triggers
+#
+#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
+CONFIG_VIDEO_V4L2=y
 #
 # Digital Video Broadcasting Devices
@@ -1460,18 +1042,25 @@ CONFIG_DVB_TDA10021=m
 CONFIG_DVB_STV0297=m
 #
-# ATSC (North American/Korean Terresterial DTV) frontends
+# ATSC (North American/Korean Terrestrial/Cable DTV) frontends
 #
 # CONFIG_DVB_NXT200X is not set
 # CONFIG_DVB_OR51211 is not set
 # CONFIG_DVB_OR51132 is not set
 # CONFIG_DVB_BCM3510 is not set
 # CONFIG_DVB_LGDT330X is not set
+#
+# Miscellaneous devices
+#
+CONFIG_DVB_LNBP21=m
+# CONFIG_DVB_ISL6421 is not set
 # CONFIG_USB_DABUSB is not set
 #
 # Graphics support
 #
+CONFIG_FIRMWARE_EDID=y
 # CONFIG_FB is not set
 #
@@ -1479,6 +1068,7 @@ CONFIG_DVB_STV0297=m
 #
 # CONFIG_VGA_CONSOLE is not set
 CONFIG_DUMMY_CONSOLE=y
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 #
 # Sound
@@ -1526,17 +1116,12 @@ CONFIG_SND_MPU401=m
 CONFIG_SND_USB_AUDIO=m
 #
-# PCMCIA devices
-#
-#
 # Open Sound System
 #
 CONFIG_SOUND_PRIME=m
-# CONFIG_OBSOLETE_OSS_DRIVER is not set
+# CONFIG_OSS_OBSOLETE_DRIVER is not set
 # CONFIG_SOUND_MSNDCLAS is not set
 # CONFIG_SOUND_MSNDPIN is not set
-CONFIG_SOUND_TVMIXER=m
 #
 # USB support
@@ -1544,7 +1129,7 @@ CONFIG_SOUND_TVMIXER=m
 CONFIG_USB_ARCH_HAS_HCD=y
 # CONFIG_USB_ARCH_HAS_OHCI is not set
 # CONFIG_USB_ARCH_HAS_EHCI is not set
-CONFIG_USB=m
+CONFIG_USB=y
 # CONFIG_USB_DEBUG is not set
 #
@@ -1561,7 +1146,6 @@ CONFIG_USB_BANDWIDTH=y
 #
 # CONFIG_USB_ISP116X_HCD is not set
 CONFIG_USB_SL811_HCD=m
-# CONFIG_USB_SL811_CS is not set
 #
 # USB Device Class drivers
@@ -1580,7 +1164,6 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_DEBUG is not set
 CONFIG_USB_STORAGE_DATAFAB=y
 CONFIG_USB_STORAGE_FREECOM=y
-CONFIG_USB_STORAGE_ISD200=y
 CONFIG_USB_STORAGE_DPCM=y
 CONFIG_USB_STORAGE_USBAT=y
 CONFIG_USB_STORAGE_SDDR09=y
@@ -1608,9 +1191,7 @@ CONFIG_USB_WACOM=m
 # CONFIG_USB_ACECAD is not set
 CONFIG_USB_KBTAB=m
 CONFIG_USB_POWERMATE=m
-CONFIG_USB_MTOUCH=m
+# CONFIG_USB_TOUCHSCREEN is not set
-# CONFIG_USB_ITMTOUCH is not set
-CONFIG_USB_EGALAX=m
 # CONFIG_USB_YEALINK is not set
 CONFIG_USB_XPAD=m
 CONFIG_USB_ATI_REMOTE=m
@@ -1640,13 +1221,11 @@ CONFIG_USB_NET_NET1080=m
 # CONFIG_USB_NET_RNDIS_HOST is not set
 # CONFIG_USB_NET_CDC_SUBSET is not set
 CONFIG_USB_NET_ZAURUS=m
-# CONFIG_USB_ZD1201 is not set
 CONFIG_USB_MON=y
 #
 # USB port drivers
 #
-CONFIG_USB_USS720=m
 #
 # USB Serial Converter support
@@ -1654,7 +1233,7 @@ CONFIG_USB_USS720=m
 CONFIG_USB_SERIAL=m
 CONFIG_USB_SERIAL_GENERIC=y
 # CONFIG_USB_SERIAL_AIRPRIME is not set
-# CONFIG_USB_SERIAL_ANYDATA is not set
+# CONFIG_USB_SERIAL_ARK3116 is not set
 CONFIG_USB_SERIAL_BELKIN=m
 CONFIG_USB_SERIAL_WHITEHEAT=m
 CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
@@ -1662,6 +1241,7 @@ CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
 CONFIG_USB_SERIAL_CYPRESS_M8=m
 CONFIG_USB_SERIAL_EMPEG=m
 CONFIG_USB_SERIAL_FTDI_SIO=m
+# CONFIG_USB_SERIAL_FUNSOFT is not set
 CONFIG_USB_SERIAL_VISOR=m
 CONFIG_USB_SERIAL_IPAQ=m
 CONFIG_USB_SERIAL_IR=m
@@ -1691,9 +1271,11 @@ CONFIG_USB_SERIAL_PL2303=m
 # CONFIG_USB_SERIAL_HP4X is not set
 CONFIG_USB_SERIAL_SAFE=m
 # CONFIG_USB_SERIAL_SAFE_PADDED is not set
+# CONFIG_USB_SERIAL_SIERRAWIRELESS is not set
 # CONFIG_USB_SERIAL_TI is not set
 CONFIG_USB_SERIAL_CYBERJACK=m
 CONFIG_USB_SERIAL_XIRCOM=m
+# CONFIG_USB_SERIAL_OPTION is not set
 CONFIG_USB_SERIAL_OMNINET=m
 CONFIG_USB_EZUSB=y
@@ -1707,10 +1289,12 @@ CONFIG_USB_RIO500=m
 CONFIG_USB_LEGOTOWER=m
 CONFIG_USB_LCD=m
 CONFIG_USB_LED=m
+# CONFIG_USB_CYPRESS_CY7C63 is not set
 CONFIG_USB_CYTHERM=m
 CONFIG_USB_PHIDGETKIT=m
 CONFIG_USB_PHIDGETSERVO=m
 # CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_LD is not set
 CONFIG_USB_TEST=m
@@ -1787,7 +1371,6 @@ CONFIG_JFS_POSIX_ACL=y
 CONFIG_JFS_STATISTICS=y
 CONFIG_FS_POSIX_ACL=y
 CONFIG_XFS_FS=m
-CONFIG_XFS_EXPORT=y
 CONFIG_XFS_QUOTA=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
@@ -1796,6 +1379,7 @@ CONFIG_XFS_RT=y
 CONFIG_MINIX_FS=m
 CONFIG_ROMFS_FS=m
 CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
 CONFIG_QUOTA=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
@@ -1856,6 +1440,7 @@ CONFIG_JFFS2_FS=m
 CONFIG_JFFS2_FS_DEBUG=0
 CONFIG_JFFS2_FS_WRITEBUFFER=y
 # CONFIG_JFFS2_SUMMARY is not set
+# CONFIG_JFFS2_FS_XATTR is not set
 # CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
@@ -1866,11 +1451,13 @@ CONFIG_HPFS_FS=m
 CONFIG_QNX4FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
+# CONFIG_UFS_FS_WRITE is not set
+# CONFIG_UFS_DEBUG is not set
 #
 # Network File Systems
 #
-CONFIG_NFS_FS=m
+CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
@@ -1880,19 +1467,22 @@ CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 CONFIG_NFSD_V4=y
 CONFIG_NFSD_TCP=y
-CONFIG_LOCKD=m
+CONFIG_ROOT_NFS=y
+CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
-CONFIG_SUNRPC=m
+CONFIG_SUNRPC=y
-CONFIG_SUNRPC_GSS=m
+CONFIG_SUNRPC_GSS=y
-CONFIG_RPCSEC_GSS_KRB5=m
+CONFIG_RPCSEC_GSS_KRB5=y
 CONFIG_RPCSEC_GSS_SPKM3=m
 CONFIG_SMB_FS=m
 # CONFIG_SMB_NLS_DEFAULT is not set
 CONFIG_CIFS=m
 # CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_WEAK_PW_HASH is not set
 # CONFIG_CIFS_XATTR is not set
+# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_CIFS_EXPERIMENTAL is not set
 CONFIG_NCP_FS=m
 CONFIG_NCPFS_PACKET_SIGNING=y
@@ -1940,7 +1530,7 @@ CONFIG_SUN_PARTITION=y
 #
 # Native Language Support
 #
-CONFIG_NLS=y
+CONFIG_NLS=m
 CONFIG_NLS_DEFAULT="cp437"
 CONFIG_NLS_CODEPAGE_437=m
 CONFIG_NLS_CODEPAGE_737=m
@@ -1984,26 +1574,29 @@ CONFIG_NLS_UTF8=m
 #
 # Profiling support
 #
-CONFIG_PROFILING=y
+# CONFIG_PROFILING is not set
-CONFIG_OPROFILE=m
 #
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
 CONFIG_MAGIC_SYSRQ=y
+# CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
-CONFIG_DEBUG_PREEMPT=y
+# CONFIG_DEBUG_RT_MUTEXES is not set
-CONFIG_DEBUG_MUTEXES=y
+# CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
+CONFIG_DEBUG_MUTEXES=y
+# CONFIG_DEBUG_RWSEMS is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_BUGVERBOSE is not set
-CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
 CONFIG_FRAME_POINTER=y
@@ -2013,8 +1606,7 @@ CONFIG_FORCED_INLINING=y
 # CONFIG_DEBUG_USER is not set
 # CONFIG_DEBUG_WAITQ is not set
 # CONFIG_DEBUG_ERRORS is not set
-CONFIG_DEBUG_LL=y
+# CONFIG_DEBUG_LL is not set
-# CONFIG_DEBUG_ICEDCC is not set
 #
 # Security options
@@ -2039,7 +1631,7 @@ CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_WP512=m
 # CONFIG_CRYPTO_TGR192 is not set
-CONFIG_CRYPTO_DES=m
+CONFIG_CRYPTO_DES=y
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_SERPENT=m
@@ -2068,5 +1660,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_REED_SOLOMON=m
+CONFIG_TEXTSEARCH=y
-CONFIG_REED_SOLOMON_DEC16=y
+CONFIG_TEXTSEARCH_KMP=m
+CONFIG_PLIST=y
diff --git a/arch/arm/mach-s3c2410/Kconfig b/arch/arm/mach-s3c2410/Kconfig
index b4171dd43df0..bbd138be6a70 100644
--- a/arch/arm/mach-s3c2410/Kconfig
+++ b/arch/arm/mach-s3c2410/Kconfig
@@ -81,9 +81,17 @@ config SMDK2440_CPU2442
        depends on ARCH_S3C2440
        select CPU_S3C2442
+config MACH_S3C2413
+        bool
+        help
+          Internal node for S3C2413 verison of SMDK2413, so that
+          machine_is_s3c2413() will work when MACH_SMDK2413 is
+          selected
 config MACH_SMDK2413
        bool "SMDK2413"
        select CPU_S3C2412
+        select MACH_S3C2413
        select MACH_SMDK
        help
          Say Y here if you are using an SMDK2413
diff --git a/arch/arm/mach-s3c2410/irq.h b/arch/arm/mach-s3c2410/irq.h
index f7cc4c983de5..842a9f42c97b 100644
--- a/arch/arm/mach-s3c2410/irq.h
+++ b/arch/arm/mach-s3c2410/irq.h
@@ -100,5 +100,10 @@ s3c_irqsub_ack(unsigned int irqno, unsigned int parentmask, unsigned int group)
 /* exported for use in arch/arm/mach-s3c2410 */
+#ifdef CONFIG_PM
 extern int s3c_irq_wake(unsigned int irqno, unsigned int state);
+#else
+#define s3c_irq_wake NULL
+#endif
 extern int s3c_irqext_type(unsigned int irq, unsigned int type);
diff --git a/arch/arm/mach-s3c2410/s3c2412.c b/arch/arm/mach-s3c2410/s3c2412.c
index e24ffd5e478b..2d163f7600be 100644
--- a/arch/arm/mach-s3c2410/s3c2412.c
+++ b/arch/arm/mach-s3c2410/s3c2412.c
@@ -35,11 +35,15 @@
 #include <asm/mach/irq.h>
 #include <asm/hardware.h>
+#include <asm/proc-fns.h>
 #include <asm/io.h>
 #include <asm/irq.h>
+#include <asm/arch/idle.h>
 #include <asm/arch/regs-clock.h>
 #include <asm/arch/regs-serial.h>
+#include <asm/arch/regs-power.h>
 #include <asm/arch/regs-gpio.h>
 #include <asm/arch/regs-gpioj.h>
 #include <asm/arch/regs-dsc.h>
@@ -75,6 +79,27 @@ void __init s3c2412_init_uarts(struct s3c2410_uartcfg *cfg, int no)
        s3c_device_nand.name = "s3c2412-nand";
 }
+/* s3c2412_idle
+ *
+ * use the standard idle call by ensuring the idle mode
+ * in power config, then issuing the idle co-processor
+ * instruction
+*/
+static void s3c2412_idle(void)
+{
+        unsigned long tmp;
+        /* ensure our idle mode is to go to idle */
+        tmp = __raw_readl(S3C2412_PWRCFG);
+        tmp &= ~S3C2412_PWRCFG_STANDBYWFI_MASK;
+        tmp |= S3C2412_PWRCFG_STANDBYWFI_IDLE;
+        __raw_writel(tmp, S3C2412_PWRCFG);
+        cpu_do_idle();
+}
 /* s3c2412_map_io
 *
 * register the standard cpu IO areas, and any passed in from the
@@ -87,6 +112,10 @@ void __init s3c2412_map_io(struct map_desc *mach_desc, int mach_size)
        s3c24xx_va_gpio2 = S3C24XX_VA_GPIO + 0x10;
+        /* set our idle function */
+        s3c24xx_idle = s3c2412_idle;
        /* register our io-tables */
        iotable_init(s3c2412_iodesc, ARRAY_SIZE(s3c2412_iodesc));
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 561bff73a036..3ca0c92e98a2 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -644,7 +644,7 @@ __80219_proc_info:
        .type   __8032x_proc_info,#object
 __8032x_proc_info:
        .long   0x69052420
-        .long   0xffffffe0
+        .long   0xfffff7e0
        .long   PMD_TYPE_SECT | \
                PMD_SECT_BUFFERABLE | \
                PMD_SECT_CACHEABLE | \
diff --git a/arch/i386/kernel/entry.S b/arch/i386/kernel/entry.S
index 37a7d2eaf4a0..87f9f60b803b 100644
--- a/arch/i386/kernel/entry.S
+++ b/arch/i386/kernel/entry.S
@@ -209,6 +209,10 @@ ENTRY(ret_from_fork)
        GET_THREAD_INFO(%ebp)
        popl %eax
        CFI_ADJUST_CFA_OFFSET -4
+        pushl $0x0202                   # Reset kernel eflags
+        CFI_ADJUST_CFA_OFFSET 4
+        popfl
+        CFI_ADJUST_CFA_OFFSET -4
        jmp syscall_exit
        CFI_ENDPROC
diff --git a/arch/i386/kernel/setup.c b/arch/i386/kernel/setup.c
index 345ffb7d904d..f1682206d304 100644
--- a/arch/i386/kernel/setup.c
+++ b/arch/i386/kernel/setup.c
@@ -956,6 +956,38 @@ efi_memory_present_wrapper(unsigned long start, unsigned long end, void *arg)
        return 0;
 }
+ /*
+  * This function checks if the entire range <start,end> is mapped with type.
+  *
+  * Note: this function only works correct if the e820 table is sorted and
+  * not-overlapping, which is the case
+  */
+int __init
+e820_all_mapped(unsigned long s, unsigned long e, unsigned type)
+{
+        u64 start = s;
+        u64 end = e;
+        int i;
+        for (i = 0; i < e820.nr_map; i++) {
+                struct e820entry *ei = &e820.map[i];
+                if (type && ei->type != type)
+                        continue;
+                /* is the region (part) in overlap with the current region ?*/
+                if (ei->addr >= end || ei->addr + ei->size <= start)
+                        continue;
+                /* if the region is at the beginning of <start,end> we move
+                 * start to the end of the region since it's ok until there
+                 */
+                if (ei->addr <= start)
+                        start = ei->addr + ei->size;
+                /* if start is now at or beyond end, we're done, full
+                 * coverage */
+                if (start >= end)
+                        return 1; /* we're done */
+        }
+        return 0;
+}
 /*
 * Find the highest page frame number we have available
 */
diff --git a/arch/i386/oprofile/nmi_int.c b/arch/i386/oprofile/nmi_int.c
index c8c1df8ff2b4..5f8dc8a21bd7 100644
--- a/arch/i386/oprofile/nmi_int.c
+++ b/arch/i386/oprofile/nmi_int.c
@@ -337,6 +337,8 @@ static int __init ppro_init(char ** cpu_type)
        if (cpu_model == 14)
                *cpu_type = "i386/core";
+        else if (cpu_model == 15)
+                *cpu_type = "i386/core_2";
        else if (cpu_model > 0xd)
                return 0;
        else if (cpu_model == 9) {
diff --git a/arch/i386/pci/common.c b/arch/i386/pci/common.c
index 1220dd828ce3..0a362e3aeac5 100644
--- a/arch/i386/pci/common.c
+++ b/arch/i386/pci/common.c
@@ -237,11 +237,6 @@ char * __devinit  pcibios_setup(char *str)
                pci_probe &= ~PCI_PROBE_MMCONF;
                return NULL;
        }
-        /* override DMI blacklist */
-        else if (!strcmp(str, "mmconf")) {
-                pci_probe |= PCI_PROBE_MMCONF_FORCE;
-                return NULL;
-        }
 #endif
        else if (!strcmp(str, "noacpi")) {
                acpi_noirq_set();
diff --git a/arch/i386/pci/mmconfig.c b/arch/i386/pci/mmconfig.c
index ef5a2faa7d82..972180f738d9 100644
--- a/arch/i386/pci/mmconfig.c
+++ b/arch/i386/pci/mmconfig.c
@@ -12,7 +12,6 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/acpi.h>
-#include <linux/dmi.h>
 #include <asm/e820.h>
 #include "pci.h"
@@ -188,31 +187,9 @@ static __init void unreachable_devices(void)
        }
 }
-static int disable_mcfg(struct dmi_system_id *d)
-{
-        printk("PCI: %s detected. Disabling MCFG.\n", d->ident);
-        pci_probe &= ~PCI_PROBE_MMCONF;
-        return 0;
-}
-static struct dmi_system_id __initdata dmi_bad_mcfg[] = {
-        /* Has broken MCFG table that makes the system hang when used */
-        {
-         .callback = disable_mcfg,
-         .ident = "Intel D3C5105 SDV",
-         .matches = {
-                     DMI_MATCH(DMI_BIOS_VENDOR, "Intel"),
-                     DMI_MATCH(DMI_BOARD_NAME, "D26928"),
-                     },
-         },
-         {}
-};
 void __init pci_mmcfg_init(void)
 {
-        dmi_check_system(dmi_bad_mcfg);
+        if ((pci_probe & PCI_PROBE_MMCONF) == 0)
-        if ((pci_probe & (PCI_PROBE_MMCONF_FORCE|PCI_PROBE_MMCONF)) == 0)
                return;
        acpi_table_parse(ACPI_MCFG, acpi_parse_mcfg);
@@ -221,6 +198,15 @@ void __init pci_mmcfg_init(void)
            (pci_mmcfg_config[0].base_address == 0))
                return;
+        if (!e820_all_mapped(pci_mmcfg_config[0].base_address,
+                        pci_mmcfg_config[0].base_address + MMCONFIG_APER_MIN,
+                        E820_RESERVED)) {
+                printk(KERN_ERR "PCI: BIOS Bug: MCFG area at %x is not E820-reserved\n",
+                                pci_mmcfg_config[0].base_address);
+                printk(KERN_ERR "PCI: Not using MMCONFIG.\n");
+                return;
+        }
        printk(KERN_INFO "PCI: Using MMCONFIG\n");
        raw_pci_ops = &pci_mmcfg;
        pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;
diff --git a/arch/i386/pci/pci.h b/arch/i386/pci/pci.h
index 49a849b3a241..bf4e79335388 100644
--- a/arch/i386/pci/pci.h
+++ b/arch/i386/pci/pci.h
@@ -16,8 +16,7 @@
 #define PCI_PROBE_CONF1         0x0002
 #define PCI_PROBE_CONF2         0x0004
 #define PCI_PROBE_MMCONF        0x0008
-#define PCI_PROBE_MMCONF_FORCE  0x0010
+#define PCI_PROBE_MASK          0x000f
-#define PCI_PROBE_MASK          0x00ff
 #define PCI_NO_SORT             0x0100
 #define PCI_BIOS_SORT           0x0200
diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c
index 94ff58c9d4a9..896863fb208a 100644
--- a/arch/sparc/kernel/sys_sparc.c
+++ b/arch/sparc/kernel/sys_sparc.c
@@ -470,19 +470,21 @@ asmlinkage int sys_getdomainname(char __user *name, int len)
 {
        int nlen, err;
        
-        if (len < 0 || len > __NEW_UTS_LEN)
+        if (len < 0)
                return -EINVAL;
        down_read(&uts_sem);
        
        nlen = strlen(system_utsname.domainname) + 1;
-        if (nlen < len)
+        err = -EINVAL;
-                len = nlen;
+        if (nlen > len)
+                goto out;
        err = -EFAULT;
-        if (!copy_to_user(name, system_utsname.domainname, len))
+        if (!copy_to_user(name, system_utsname.domainname, nlen))
                err = 0;
+out:
        up_read(&uts_sem);
        return err;
 }
diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
index bf5f14ee73de..c608c947e6c3 100644
--- a/arch/sparc64/kernel/sys_sparc.c
+++ b/arch/sparc64/kernel/sys_sparc.c
@@ -707,19 +707,21 @@ asmlinkage long sys_getdomainname(char __user *name, int len)
 {
        int nlen, err;
-        if (len < 0 || len > __NEW_UTS_LEN)
+        if (len < 0)
                return -EINVAL;
        down_read(&uts_sem);
        
        nlen = strlen(system_utsname.domainname) + 1;
-        if (nlen < len)
+        err = -EINVAL;
-                len = nlen;
+        if (nlen > len)
+                goto out;
        err = -EFAULT;
-        if (!copy_to_user(name, system_utsname.domainname, len))
+        if (!copy_to_user(name, system_utsname.domainname, nlen))
                err = 0;
+out:
        up_read(&uts_sem);
        return err;
 }
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index 764bf23c7103..d6d7f731f6f0 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -108,6 +108,35 @@ e820_any_mapped(unsigned long start, unsigned long end, unsigned type)
        return 0;
 }
+/*
+ * This function checks if the entire range <start,end> is mapped with type.
+ *
+ * Note: this function only works correct if the e820 table is sorted and
+ * not-overlapping, which is the case
+ */
+int __init e820_all_mapped(unsigned long start, unsigned long end, unsigned type)
+{
+        int i;
+        for (i = 0; i < e820.nr_map; i++) {
+                struct e820entry *ei = &e820.map[i];
+                if (type && ei->type != type)
+                        continue;
+                /* is the region (part) in overlap with the current region ?*/
+                if (ei->addr >= end || ei->addr + ei->size <= start)
+                        continue;
+                /* if the region is at the beginning of <start,end> we move
+                 * start to the end of the region since it's ok until there
+                 */
+                if (ei->addr <= start)
+                        start = ei->addr + ei->size;
+                /* if start is now at or beyond end, we're done, full coverage */
+                if (start >= end)
+                        return 1; /* we're done */
+        }
+        return 0;
+}
 /* 
 * Find a free area in a specific range. 
 */ 
diff --git a/arch/x86_64/pci/mmconfig.c b/arch/x86_64/pci/mmconfig.c
index 2d48a7941d48..3c55c76c6fd5 100644
--- a/arch/x86_64/pci/mmconfig.c
+++ b/arch/x86_64/pci/mmconfig.c
@@ -9,7 +9,6 @@
 #include <linux/init.h>
 #include <linux/acpi.h>
 #include <linux/bitmap.h>
-#include <linux/dmi.h>
 #include <asm/e820.h>
 #include "pci.h"
@@ -165,33 +164,11 @@ static __init void unreachable_devices(void)
        }
 }
-static int disable_mcfg(struct dmi_system_id *d)
-{
-        printk("PCI: %s detected. Disabling MCFG.\n", d->ident);
-        pci_probe &= ~PCI_PROBE_MMCONF;
-        return 0;
-}
-static struct dmi_system_id __initdata dmi_bad_mcfg[] = {
-        /* Has broken MCFG table that makes the system hang when used */
-        {
-         .callback = disable_mcfg,
-         .ident = "Intel D3C5105 SDV",
-         .matches = {
-                     DMI_MATCH(DMI_BIOS_VENDOR, "Intel"),
-                     DMI_MATCH(DMI_BOARD_NAME, "D26928"),
-                     },
-         },
-         {}
-};
 void __init pci_mmcfg_init(void)
 {
        int i;
-        dmi_check_system(dmi_bad_mcfg);
+        if ((pci_probe & PCI_PROBE_MMCONF) == 0)
-        if ((pci_probe & (PCI_PROBE_MMCONF|PCI_PROBE_MMCONF_FORCE)) == 0)
                return;
        acpi_table_parse(ACPI_MCFG, acpi_parse_mcfg);
@@ -200,6 +177,15 @@ void __init pci_mmcfg_init(void)
            (pci_mmcfg_config[0].base_address == 0))
                return;
+        if (!e820_all_mapped(pci_mmcfg_config[0].base_address,
+                        pci_mmcfg_config[0].base_address + MMCONFIG_APER_MIN,
+                        E820_RESERVED)) {
+                printk(KERN_ERR "PCI: BIOS Bug: MCFG area at %x is not E820-reserved\n",
+                                pci_mmcfg_config[0].base_address);
+                printk(KERN_ERR "PCI: Not using MMCONFIG.\n");
+                return;
+        }
        /* RED-PEN i386 doesn't do _nocache right now */
        pci_mmcfg_virt = kmalloc(sizeof(*pci_mmcfg_virt) * pci_mmcfg_config_num, GFP_KERNEL);
        if (pci_mmcfg_virt == NULL) {
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index d369130f4235..ffcb9fd31c38 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -1928,7 +1928,9 @@ he_service_rbrq(struct he_dev *he_dev, int group)
 #ifdef notdef
                ATM_SKB(skb)->vcc = vcc;
 #endif
+                spin_unlock(&he_dev->global_lock);
                vcc->push(vcc, skb);
+                spin_lock(&he_dev->global_lock);
                atomic_inc(&vcc->stats->rx);
@@ -2282,6 +2284,8 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
                                TPDRQ_MASK(he_readl(he_dev, TPDRQ_B_H)));
                if (new_tail == he_dev->tpdrq_head) {
+                        int slot;
                        hprintk("tpdrq full (cid 0x%x)\n", cid);
                        /*
                         * FIXME
@@ -2289,6 +2293,13 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
                         * after service_tbrq, service the backlog
                         * for now, we just drop the pdu
                         */
+                        for (slot = 0; slot < TPD_MAXIOV; ++slot) {
+                                if (tpd->iovec[slot].addr)
+                                        pci_unmap_single(he_dev->pci_dev,
+                                                tpd->iovec[slot].addr,
+                                                tpd->iovec[slot].len & TPD_LEN_MASK,
+                                                                PCI_DMA_TODEVICE);
+                        }
                        if (tpd->skb) {
                                if (tpd->vcc->pop)
                                        tpd->vcc->pop(tpd->vcc, tpd->skb);
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 1d1bd34b7f12..a76d2c40dd5e 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -667,6 +667,7 @@ int khvcd(void *unused)
        do {
                poll_mask = 0;
                hvc_kicked = 0;
+                try_to_freeze();
                wmb();
                if (cpus_empty(cpus_in_xmon)) {
                        spin_lock(&hvc_structs_lock);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index f57eba0bf253..abca98beac14 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -402,10 +402,10 @@ static void handle_flags(struct smi_info *smi_info)
                        smi_info->curr_msg->data,
                        smi_info->curr_msg->data_size);
                smi_info->si_state = SI_GETTING_EVENTS;
-        } else if (smi_info->msg_flags & OEM_DATA_AVAIL) {
+        } else if (smi_info->msg_flags & OEM_DATA_AVAIL &&
-                if (smi_info->oem_data_avail_handler)
+                   smi_info->oem_data_avail_handler) {
-                        if (smi_info->oem_data_avail_handler(smi_info))
+                if (smi_info->oem_data_avail_handler(smi_info))
-                                goto retry;
+                        goto retry;
        } else {
                smi_info->si_state = SI_NORMAL;
        }
@@ -2481,6 +2481,7 @@ static __devinit int init_ipmi_si(void)
 #ifdef CONFIG_PCI
                pci_unregister_driver(&ipmi_pci_driver);
 #endif
+                driver_unregister(&ipmi_driver);
                printk("ipmi_si: Unable to find any System Interface(s)\n");
                return -ENODEV;
        } else {
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index d6f99d5720fc..5d625a81193f 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -49,7 +49,7 @@ MODULE_DESCRIPTION("Generic RDMA CM Agent");
 MODULE_LICENSE("Dual BSD/GPL");
 #define CMA_CM_RESPONSE_TIMEOUT 20
-#define CMA_MAX_CM_RETRIES 3
+#define CMA_MAX_CM_RETRIES 15
 static void cma_add_one(struct ib_device *device);
 static void cma_remove_one(struct ib_device *device);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index b5e6a7be603d..ec356ce7cdcd 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -326,6 +326,7 @@ ipoib_mcast_sendonly_join_complete(int status,
                /* Clear the busy flag so we try again */
                clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+                mcast->query = NULL;
        }
        complete(&mcast->done);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 8257d5a2c8f8..fd8344cdc0db 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -799,13 +799,6 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
        spin_unlock_irqrestore(target->scsi_host->host_lock, flags);
 }
-static void srp_reconnect_work(void *target_ptr)
-{
-        struct srp_target_port *target = target_ptr;
-        srp_reconnect_target(target);
-}
 static void srp_handle_recv(struct srp_target_port *target, struct ib_wc *wc)
 {
        struct srp_iu *iu;
@@ -858,7 +851,6 @@ static void srp_completion(struct ib_cq *cq, void *target_ptr)
 {
        struct srp_target_port *target = target_ptr;
        struct ib_wc wc;
-        unsigned long flags;
        ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
        while (ib_poll_cq(cq, 1, &wc) > 0) {
@@ -866,10 +858,6 @@ static void srp_completion(struct ib_cq *cq, void *target_ptr)
                        printk(KERN_ERR PFX "failed %s status %d\n",
                               wc.wr_id & SRP_OP_RECV ? "receive" : "send",
                               wc.status);
-                        spin_lock_irqsave(target->scsi_host->host_lock, flags);
-                        if (target->state == SRP_TARGET_LIVE)
-                                schedule_work(&target->work);
-                        spin_unlock_irqrestore(target->scsi_host->host_lock, flags);
                        break;
                }
@@ -1705,8 +1693,6 @@ static ssize_t srp_create_target(struct class_device *class_dev,
        target->scsi_host  = target_host;
        target->srp_host   = host;
-        INIT_WORK(&target->work, srp_reconnect_work, target);
        INIT_LIST_HEAD(&target->free_reqs);
        INIT_LIST_HEAD(&target->req_queue);
        for (i = 0; i < SRP_SQ_SIZE; ++i) {
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 39edb8250fbc..7ea49a0d5ec3 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -908,7 +908,7 @@ static void __xipram xip_enable(struct map_info *map, struct flchip *chip,
 static int __xipram xip_wait_for_operation(
                struct map_info *map, struct flchip *chip,
-                unsigned long adr, int *chip_op_time )
+                unsigned long adr, unsigned int chip_op_time )
 {
        struct cfi_private *cfi = map->fldrv_priv;
        struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
@@ -917,7 +917,7 @@ static int __xipram xip_wait_for_operation(
        flstate_t oldstate, newstate;
        start = xip_currtime();
-        usec = *chip_op_time * 8;
+        usec = chip_op_time * 8;
        if (usec == 0)
                usec = 500000;
        done = 0;
@@ -1027,8 +1027,8 @@ static int __xipram xip_wait_for_operation(
 #define XIP_INVAL_CACHED_RANGE(map, from, size)  \
        INVALIDATE_CACHED_RANGE(map, from, size)
-#define INVAL_CACHE_AND_WAIT(map, chip, cmd_adr, inval_adr, inval_len, p_usec) \
+#define INVAL_CACHE_AND_WAIT(map, chip, cmd_adr, inval_adr, inval_len, usec) \
-        xip_wait_for_operation(map, chip, cmd_adr, p_usec)
+        xip_wait_for_operation(map, chip, cmd_adr, usec)
 #else
@@ -1040,64 +1040,64 @@ static int __xipram xip_wait_for_operation(
 static int inval_cache_and_wait_for_operation(
                struct map_info *map, struct flchip *chip,
                unsigned long cmd_adr, unsigned long inval_adr, int inval_len,
-                int *chip_op_time )
+                unsigned int chip_op_time)
 {
        struct cfi_private *cfi = map->fldrv_priv;
        map_word status, status_OK = CMD(0x80);
-        int z, chip_state = chip->state;
+        int chip_state = chip->state;
-        unsigned long timeo;
+        unsigned int timeo, sleep_time;
        spin_unlock(chip->mutex);
        if (inval_len)
                INVALIDATE_CACHED_RANGE(map, inval_adr, inval_len);
-        if (*chip_op_time)
-                cfi_udelay(*chip_op_time);
        spin_lock(chip->mutex);
-        timeo = *chip_op_time * 8 * HZ / 1000000;
+        /* set our timeout to 8 times the expected delay */
-        if (timeo < HZ/2)
+        timeo = chip_op_time * 8;
-                timeo = HZ/2;
+        if (!timeo)
-        timeo += jiffies;
+                timeo = 500000;
+        sleep_time = chip_op_time / 2;
-        z = 0;
        for (;;) {
-                if (chip->state != chip_state) {
-                        /* Someone's suspended the operation: sleep */
-                        DECLARE_WAITQUEUE(wait, current);
-                        set_current_state(TASK_UNINTERRUPTIBLE);
-                        add_wait_queue(&chip->wq, &wait);
-                        spin_unlock(chip->mutex);
-                        schedule();
-                        remove_wait_queue(&chip->wq, &wait);
-                        timeo = jiffies + (HZ / 2); /* FIXME */
-                        spin_lock(chip->mutex);
-                        continue;
-                }
                status = map_read(map, cmd_adr);
                if (map_word_andequal(map, status, status_OK, status_OK))
                        break;
-                /* OK Still waiting */
+                if (!timeo) {
-                if (time_after(jiffies, timeo)) {
                        map_write(map, CMD(0x70), cmd_adr);
                        chip->state = FL_STATUS;
                        return -ETIME;
                }
-                /* Latency issues. Drop the lock, wait a while and retry */
+                /* OK Still waiting. Drop the lock, wait a while and retry. */
-                z++;
                spin_unlock(chip->mutex);
-                cfi_udelay(1);
+                if (sleep_time >= 1000000/HZ) {
+                        /*
+                         * Half of the normal delay still remaining
+                         * can be performed with a sleeping delay instead
+                         * of busy waiting.
+                         */
+                        msleep(sleep_time/1000);
+                        timeo -= sleep_time;
+                        sleep_time = 1000000/HZ;
+                } else {
+                        udelay(1);
+                        cond_resched();
+                        timeo--;
+                }
                spin_lock(chip->mutex);
-        }
-        if (!z) {
+                if (chip->state != chip_state) {
-                if (!--(*chip_op_time))
+                        /* Someone's suspended the operation: sleep */
-                        *chip_op_time = 1;
+                        DECLARE_WAITQUEUE(wait, current);
-        } else if (z > 1)
+                        set_current_state(TASK_UNINTERRUPTIBLE);
-                ++(*chip_op_time);
+                        add_wait_queue(&chip->wq, &wait);
+                        spin_unlock(chip->mutex);
+                        schedule();
+                        remove_wait_queue(&chip->wq, &wait);
+                        spin_lock(chip->mutex);
+                }
+        }
        /* Done and happy. */
        chip->state = FL_STATUS;
@@ -1107,8 +1107,7 @@ static int inval_cache_and_wait_for_operation(
 #endif
 #define WAIT_TIMEOUT(map, chip, adr, udelay) \
-        ({ int __udelay = (udelay); \
+        INVAL_CACHE_AND_WAIT(map, chip, adr, 0, 0, udelay);
-           INVAL_CACHE_AND_WAIT(map, chip, adr, 0, 0, &__udelay); })
 static int do_point_onechip (struct map_info *map, struct flchip *chip, loff_t adr, size_t len)
@@ -1332,7 +1331,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
        ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
                                   adr, map_bankwidth(map),
-                                   &chip->word_write_time);
+                                   chip->word_write_time);
        if (ret) {
                xip_enable(map, chip, adr);
                printk(KERN_ERR "%s: word write error (status timeout)\n", map->name);
@@ -1569,7 +1568,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
        ret = INVAL_CACHE_AND_WAIT(map, chip, cmd_adr,
                                   adr, len,
-                                   &chip->buffer_write_time);
+                                   chip->buffer_write_time);
        if (ret) {
                map_write(map, CMD(0x70), cmd_adr);
                chip->state = FL_STATUS;
@@ -1704,7 +1703,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
        ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
                                   adr, len,
-                                   &chip->erase_time);
+                                   chip->erase_time);
        if (ret) {
                map_write(map, CMD(0x70), adr);
                chip->state = FL_STATUS;
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 9885726a16e4..a482e8922de1 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -45,9 +45,11 @@
 #define MAX_WORD_RETRIES 3
 #define MANUFACTURER_AMD        0x0001
+#define MANUFACTURER_ATMEL      0x001F
 #define MANUFACTURER_SST        0x00BF
 #define SST49LF004B             0x0060
 #define SST49LF008A             0x005a
+#define AT49BV6416              0x00d6
 static int cfi_amdstd_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int cfi_amdstd_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
@@ -68,6 +70,9 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
 static void put_chip(struct map_info *map, struct flchip *chip, unsigned long adr);
 #include "fwh_lock.h"
+static int cfi_atmel_lock(struct mtd_info *mtd, loff_t ofs, size_t len);
+static int cfi_atmel_unlock(struct mtd_info *mtd, loff_t ofs, size_t len);
 static struct mtd_chip_driver cfi_amdstd_chipdrv = {
        .probe          = NULL, /* Not usable directly */
        .destroy        = cfi_amdstd_destroy,
@@ -161,6 +166,26 @@ static void fixup_use_write_buffers(struct mtd_info *mtd, void *param)
        }
 }
+/* Atmel chips don't use the same PRI format as AMD chips */
+static void fixup_convert_atmel_pri(struct mtd_info *mtd, void *param)
+{
+        struct map_info *map = mtd->priv;
+        struct cfi_private *cfi = map->fldrv_priv;
+        struct cfi_pri_amdstd *extp = cfi->cmdset_priv;
+        struct cfi_pri_atmel atmel_pri;
+        memcpy(&atmel_pri, extp, sizeof(atmel_pri));
+        memset((char *)extp + 5, 0, sizeof(*extp) - 5);
+        if (atmel_pri.Features & 0x02)
+                extp->EraseSuspend = 2;
+        if (atmel_pri.BottomBoot)
+                extp->TopBottom = 2;
+        else
+                extp->TopBottom = 3;
+}
 static void fixup_use_secsi(struct mtd_info *mtd, void *param)
 {
        /* Setup for chips with a secsi area */
@@ -179,6 +204,16 @@ static void fixup_use_erase_chip(struct mtd_info *mtd, void *param)
 }
+/*
+ * Some Atmel chips (e.g. the AT49BV6416) power-up with all sectors
+ * locked by default.
+ */
+static void fixup_use_atmel_lock(struct mtd_info *mtd, void *param)
+{
+        mtd->lock = cfi_atmel_lock;
+        mtd->unlock = cfi_atmel_unlock;
+}
 static struct cfi_fixup cfi_fixup_table[] = {
 #ifdef AMD_BOOTLOC_BUG
        { CFI_MFR_AMD, CFI_ID_ANY, fixup_amd_bootblock, NULL },
@@ -192,6 +227,7 @@ static struct cfi_fixup cfi_fixup_table[] = {
 #if !FORCE_WORD_WRITE
        { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_write_buffers, NULL, },
 #endif
+        { CFI_MFR_ATMEL, CFI_ID_ANY, fixup_convert_atmel_pri, NULL },
        { 0, 0, NULL, NULL }
 };
 static struct cfi_fixup jedec_fixup_table[] = {
@@ -207,6 +243,7 @@ static struct cfi_fixup fixup_table[] = {
         * we know that is the case.
         */
        { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_erase_chip, NULL },
+        { CFI_MFR_ATMEL, AT49BV6416, fixup_use_atmel_lock, NULL },
        { 0, 0, NULL, NULL }
 };
@@ -1607,6 +1644,80 @@ static int cfi_amdstd_erase_chip(struct mtd_info *mtd, struct erase_info *instr)
        return 0;
 }
+static int do_atmel_lock(struct map_info *map, struct flchip *chip,
+                         unsigned long adr, int len, void *thunk)
+{
+        struct cfi_private *cfi = map->fldrv_priv;
+        int ret;
+        spin_lock(chip->mutex);
+        ret = get_chip(map, chip, adr + chip->start, FL_LOCKING);
+        if (ret)
+                goto out_unlock;
+        chip->state = FL_LOCKING;
+        DEBUG(MTD_DEBUG_LEVEL3, "MTD %s(): LOCK 0x%08lx len %d\n",
+              __func__, adr, len);
+        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x80, cfi->addr_unlock1, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        map_write(map, CMD(0x40), chip->start + adr);
+        chip->state = FL_READY;
+        put_chip(map, chip, adr + chip->start);
+        ret = 0;
+out_unlock:
+        spin_unlock(chip->mutex);
+        return ret;
+}
+static int do_atmel_unlock(struct map_info *map, struct flchip *chip,
+                           unsigned long adr, int len, void *thunk)
+{
+        struct cfi_private *cfi = map->fldrv_priv;
+        int ret;
+        spin_lock(chip->mutex);
+        ret = get_chip(map, chip, adr + chip->start, FL_UNLOCKING);
+        if (ret)
+                goto out_unlock;
+        chip->state = FL_UNLOCKING;
+        DEBUG(MTD_DEBUG_LEVEL3, "MTD %s(): LOCK 0x%08lx len %d\n",
+              __func__, adr, len);
+        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi,
+                         cfi->device_type, NULL);
+        map_write(map, CMD(0x70), adr);
+        chip->state = FL_READY;
+        put_chip(map, chip, adr + chip->start);
+        ret = 0;
+out_unlock:
+        spin_unlock(chip->mutex);
+        return ret;
+}
+static int cfi_atmel_lock(struct mtd_info *mtd, loff_t ofs, size_t len)
+{
+        return cfi_varsize_frob(mtd, do_atmel_lock, ofs, len, NULL);
+}
+static int cfi_atmel_unlock(struct mtd_info *mtd, loff_t ofs, size_t len)
+{
+        return cfi_varsize_frob(mtd, do_atmel_unlock, ofs, len, NULL);
+}
 static void cfi_amdstd_sync (struct mtd_info *mtd)
 {
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index 8f39d0a31438..1154dac715aa 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -111,6 +111,7 @@
 #define MX29LV040C      0x004F
 #define MX29LV160T      0x22C4
 #define MX29LV160B      0x2249
+#define MX29F040        0x00A4
 #define MX29F016        0x00AD
 #define MX29F002T       0x00B0
 #define MX29F004T       0x0045
@@ -1172,6 +1173,19 @@ static const struct amd_flash_info jedec_table[] = {
                }
        }, {
                .mfr_id         = MANUFACTURER_MACRONIX,
+                .dev_id         = MX29F040,
+                .name           = "Macronix MX29F040",
+                .uaddr          = {
+                        [0] = MTD_UADDR_0x0555_0x02AA /* x8 */
+                },
+                .DevSize        = SIZE_512KiB,
+                .CmdSet         = P_ID_AMD_STD,
+                .NumEraseRegions= 1,
+                .regions        = {
+                        ERASEINFO(0x10000,8),
+                }
+        }, {
+                .mfr_id         = MANUFACTURER_MACRONIX,
                .dev_id         = MX29F016,
                .name           = "Macronix MX29F016",
                .uaddr          = {
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index ede3561be870..401c6a294baa 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -18,6 +18,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/buffer_head.h>
 #include <linux/mutex.h>
+#include <linux/mount.h>
 #define VERSION "$Revision: 1.30 $"
@@ -236,6 +237,8 @@ static int _block2mtd_write(struct block2mtd_dev *dev, const u_char *buf,
        }
        return 0;
 }
 static int block2mtd_write(struct mtd_info *mtd, loff_t to, size_t len,
                size_t *retlen, const u_char *buf)
 {
@@ -299,6 +302,19 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size)
        /* Get a handle on the device */
        bdev = open_bdev_excl(devname, O_RDWR, NULL);
+#ifndef MODULE
+        if (IS_ERR(bdev)) {
+                /* We might not have rootfs mounted at this point. Try
+                   to resolve the device name by other means. */
+                dev_t dev = name_to_dev_t(devname);
+                if (dev != 0) {
+                        bdev = open_by_devnum(dev, FMODE_WRITE | FMODE_READ);
+                }
+        }
+#endif
        if (IS_ERR(bdev)) {
                ERROR("error: cannot open device %s", devname);
                goto devinit_err;
@@ -393,26 +409,6 @@ static int parse_num(size_t *num, const char *token)
 }
-static int parse_name(char **pname, const char *token, size_t limit)
-{
-        size_t len;
-        char *name;
-        len = strlen(token) + 1;
-        if (len > limit)
-                return -ENOSPC;
-        name = kmalloc(len, GFP_KERNEL);
-        if (!name)
-                return -ENOMEM;
-        strcpy(name, token);
-        *pname = name;
-        return 0;
-}
 static inline void kill_final_newline(char *str)
 {
        char *newline = strrchr(str, '\n');
@@ -426,9 +422,15 @@ static inline void kill_final_newline(char *str)
        return 0;                               \
 } while (0)
-static int block2mtd_setup(const char *val, struct kernel_param *kp)
+#ifndef MODULE
+static int block2mtd_init_called = 0;
+static __initdata char block2mtd_paramline[80 + 12]; /* 80 for device, 12 for erase size */
+#endif
+static int block2mtd_setup2(const char *val)
 {
-        char buf[80+12]; /* 80 for device, 12 for erase size */
+        char buf[80 + 12]; /* 80 for device, 12 for erase size */
        char *str = buf;
        char *token[2];
        char *name;
@@ -450,13 +452,9 @@ static int block2mtd_setup(const char *val, struct kernel_param *kp)
        if (!token[0])
                parse_err("no argument");
-        ret = parse_name(&name, token[0], 80);
+        name = token[0];
-        if (ret == -ENOMEM)
+        if (strlen(name) + 1 > 80)
-                parse_err("out of memory");
+                parse_err("device name too long");
-        if (ret == -ENOSPC)
-                parse_err("name too long");
-        if (ret)
-                return 0;
        if (token[1]) {
                ret = parse_num(&erase_size, token[1]);
@@ -472,13 +470,48 @@ static int block2mtd_setup(const char *val, struct kernel_param *kp)
 }
+static int block2mtd_setup(const char *val, struct kernel_param *kp)
+{
+#ifdef MODULE
+        return block2mtd_setup2(val);
+#else
+        /* If more parameters are later passed in via
+           /sys/module/block2mtd/parameters/block2mtd
+           and block2mtd_init() has already been called,
+           we can parse the argument now. */
+        if (block2mtd_init_called)
+                return block2mtd_setup2(val);
+        /* During early boot stage, we only save the parameters
+           here. We must parse them later: if the param passed
+           from kernel boot command line, block2mtd_setup() is
+           called so early that it is not possible to resolve
+           the device (even kmalloc() fails). Deter that work to
+           block2mtd_setup2(). */
+        strlcpy(block2mtd_paramline, val, sizeof(block2mtd_paramline));
+        return 0;
+#endif
+}
 module_param_call(block2mtd, block2mtd_setup, NULL, NULL, 0200);
 MODULE_PARM_DESC(block2mtd, "Device to use. \"block2mtd=<dev>[,<erasesize>]\"");
 static int __init block2mtd_init(void)
 {
+        int ret = 0;
        INFO("version " VERSION);
-        return 0;
+#ifndef MODULE
+        if (strlen(block2mtd_paramline))
+                ret = block2mtd_setup2(block2mtd_paramline);
+        block2mtd_init_called = 1;
+#endif
+        return ret;
 }
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index a8466141e914..ef4a731ca5c2 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -406,13 +406,13 @@ struct flash_info {
 static struct flash_info __devinitdata m25p_data [] = {
        /* REVISIT: fill in JEDEC ids, for parts that have them */
-        { "m25p05", 0x05, 0x0000, 32 * 1024, 2 },
+        { "m25p05", 0x05, 0x2010, 32 * 1024, 2 },
-        { "m25p10", 0x10, 0x0000, 32 * 1024, 4 },
+        { "m25p10", 0x10, 0x2011, 32 * 1024, 4 },
-        { "m25p20", 0x11, 0x0000, 64 * 1024, 4 },
+        { "m25p20", 0x11, 0x2012, 64 * 1024, 4 },
-        { "m25p40", 0x12, 0x0000, 64 * 1024, 8 },
+        { "m25p40", 0x12, 0x2013, 64 * 1024, 8 },
        { "m25p80", 0x13, 0x0000, 64 * 1024, 16 },
-        { "m25p16", 0x14, 0x0000, 64 * 1024, 32 },
+        { "m25p16", 0x14, 0x2015, 64 * 1024, 32 },
-        { "m25p32", 0x15, 0x0000, 64 * 1024, 64 },
+        { "m25p32", 0x15, 0x2016, 64 * 1024, 64 },
        { "m25p64", 0x16, 0x2017, 64 * 1024, 128 },
 };
diff --git a/drivers/mtd/devices/pmc551.c b/drivers/mtd/devices/pmc551.c
index 6f9bbf6fee4d..2c0149708739 100644
--- a/drivers/mtd/devices/pmc551.c
+++ b/drivers/mtd/devices/pmc551.c
@@ -99,10 +99,6 @@
 #include <asm/system.h>
 #include <linux/pci.h>
-#ifndef CONFIG_PCI
-#error Enable PCI in your kernel config
-#endif
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/pmc551.h>
 #include <linux/mtd/compatmac.h>
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 83d0b2a52527..64d1b6a6c920 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -13,13 +13,13 @@ config MTD_COMPLEX_MAPPINGS
 config MTD_PHYSMAP
        tristate "CFI Flash device in physical memory map"
-        depends on MTD_CFI
+        depends on MTD_CFI || MTD_JEDECPROBE || MTD_ROM
        help
-          This provides a 'mapping' driver which allows the CFI probe and
+          This provides a 'mapping' driver which allows the NOR Flash and
-          command set driver code to communicate with flash chips which
+          ROM driver code to communicate with chips which are mapped
-          are mapped physically into the CPU's memory. You will need to
+          physically into the CPU's memory. You will need to configure
-          configure the physical address and size of the flash chips on
+          the physical address and size of the flash chips on your
-          your particular board as well as the bus width, either statically
+          particular board as well as the bus width, either statically
          with config options or at run-time.
 config MTD_PHYSMAP_START
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index fb8b4f7e48d3..5b6acfcb2b88 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -62,15 +62,12 @@ static loff_t mtd_lseek (struct file *file, loff_t offset, int orig)
        struct mtd_info *mtd = mfi->mtd;
        switch (orig) {
-        case 0:
+        case SEEK_SET:
-                /* SEEK_SET */
                break;
-        case 1:
+        case SEEK_CUR:
-                /* SEEK_CUR */
                offset += file->f_pos;
                break;
-        case 2:
+        case SEEK_END:
-                /* SEEK_END */
                offset += mtd->size;
                break;
        default:
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 3db77eec0ed2..c99302ed3823 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -11,7 +11,7 @@ config MTD_NAND
        help
          This enables support for accessing all type of NAND flash
          devices. For further information see
-          <http://www.linux-mtd.infradead.org/tech/nand.html>.
+          <http://www.linux-mtd.infradead.org/doc/nand.html>.
 config MTD_NAND_VERIFY_WRITE
        bool "Verify NAND page writes"
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index c8cbc00243fe..975b2ef61121 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1204,7 +1204,7 @@ static int nand_write_oob_syndrome(struct mtd_info *mtd,
                pos = steps * (eccsize + chunk);
                steps = 0;
        } else
-                pos = eccsize + chunk;
+                pos = eccsize;
        chip->cmdfunc(mtd, NAND_CMD_SEQIN, pos, page);
        for (i = 0; i < steps; i++) {
@@ -1567,7 +1567,7 @@ static uint8_t *nand_fill_oob(struct nand_chip *chip, uint8_t *oob,
                                bytes = min_t(size_t, len, free->length);
                                boffs = free->offset;
                        }
-                        memcpy(chip->oob_poi + woffs, oob, bytes);
+                        memcpy(chip->oob_poi + boffs, oob, bytes);
                        oob += bytes;
                }
                return oob;
@@ -2224,7 +2224,7 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
        }
        /* Try to identify manufacturer */
-        for (maf_idx = 0; nand_manuf_ids[maf_idx].id != 0x0; maf_id++) {
+        for (maf_idx = 0; nand_manuf_ids[maf_idx].id != 0x0; maf_idx++) {
                if (nand_manuf_ids[maf_idx].id == *maf_id)
                        break;
        }
diff --git a/drivers/mtd/nand/sharpsl.c b/drivers/mtd/nand/sharpsl.c
index fbeedc3184e9..51c7288ab49a 100644
--- a/drivers/mtd/nand/sharpsl.c
+++ b/drivers/mtd/nand/sharpsl.c
@@ -78,7 +78,7 @@ static struct mtd_partition sharpsl_nand_default_partition_info[] = {
 /*
 *      hardware specific access to control-lines
 *      ctrl:
- *      NAND_CNE: bit 0 -> bit 0 & 4
+ *      NAND_CNE: bit 0 -> ! bit 0 & 4
 *      NAND_CLE: bit 1 -> bit 1
 *      NAND_ALE: bit 2 -> bit 2
 *
@@ -92,7 +92,10 @@ static void sharpsl_nand_hwcontrol(struct mtd_info *mtd, int cmd,
                unsigned char bits = ctrl & 0x07;
                bits |= (ctrl & 0x01) << 4;
-                writeb((readb(FLASHCTL) & 0x17) | bits, FLASHCTL);
+                bits ^= 0x11;
+                writeb((readb(FLASHCTL) & ~0x17) | bits, FLASHCTL);
        }
        if (cmd != NAND_CMD_NONE)
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 726f43d55937..98ef9f85482f 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1433,8 +1433,8 @@ e1000_configure_tx(struct e1000_adapter *adapter)
                E1000_WRITE_REG(hw, TDBAL, (tdba & 0x00000000ffffffffULL));
                E1000_WRITE_REG(hw, TDT, 0);
                E1000_WRITE_REG(hw, TDH, 0);
-                adapter->tx_ring[0].tdh = E1000_TDH;
+                adapter->tx_ring[0].tdh = ((hw->mac_type >= e1000_82543) ? E1000_TDH : E1000_82542_TDH);
-                adapter->tx_ring[0].tdt = E1000_TDT;
+                adapter->tx_ring[0].tdt = ((hw->mac_type >= e1000_82543) ? E1000_TDT : E1000_82542_TDT);
                break;
        }
@@ -1840,8 +1840,8 @@ e1000_configure_rx(struct e1000_adapter *adapter)
                E1000_WRITE_REG(hw, RDBAL, (rdba & 0x00000000ffffffffULL));
                E1000_WRITE_REG(hw, RDT, 0);
                E1000_WRITE_REG(hw, RDH, 0);
-                adapter->rx_ring[0].rdh = E1000_RDH;
+                adapter->rx_ring[0].rdh = ((hw->mac_type >= e1000_82543) ? E1000_RDH : E1000_82542_RDH);
-                adapter->rx_ring[0].rdt = E1000_RDT;
+                adapter->rx_ring[0].rdt = ((hw->mac_type >= e1000_82543) ? E1000_RDT : E1000_82542_RDT);
                break;
        }
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 760c61b98867..eeab1df5bef3 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -385,6 +385,8 @@ static int mv643xx_eth_receive_queue(struct net_device *dev, int budget)
        struct pkt_info pkt_info;
        while (budget-- > 0 && eth_port_receive(mp, &pkt_info) == ETH_OK) {
+                dma_unmap_single(NULL, pkt_info.buf_ptr, RX_SKB_SIZE,
+                                                        DMA_FROM_DEVICE);
                mp->rx_desc_count--;
                received_packets++;
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index da9d06bdb818..aa792821854e 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -1430,9 +1430,43 @@ static int ofdm_qual_db(u8 status_quality, u8 rate, unsigned int size)
                        break;
        }
+        switch (rate) {
+        case ZD_OFDM_RATE_6M:
+        case ZD_OFDM_RATE_9M:
+                i += 3;
+                break;
+        case ZD_OFDM_RATE_12M:
+        case ZD_OFDM_RATE_18M:
+                i += 5;
+                break;
+        case ZD_OFDM_RATE_24M:
+        case ZD_OFDM_RATE_36M:
+                i += 9;
+                break;
+        case ZD_OFDM_RATE_48M:
+        case ZD_OFDM_RATE_54M:
+                i += 15;
+                break;
+        default:
+                return -EINVAL;
+        }
        return i;
 }
+static int ofdm_qual_percent(u8 status_quality, u8 rate, unsigned int size)
+{
+        int r;
+        r = ofdm_qual_db(status_quality, rate, size);
+        ZD_ASSERT(r >= 0);
+        if (r < 0)
+                r = 0;
+        r = (r * 100)/29;
+        return r <= 100 ? r : 100;
+}
 static unsigned int log10times100(unsigned int x)
 {
        static const u8 log10[] = {
@@ -1476,31 +1510,28 @@ static int cck_snr_db(u8 status_quality)
        return r;
 }
-static int rx_qual_db(const void *rx_frame, unsigned int size,
+static int cck_qual_percent(u8 status_quality)
-                      const struct rx_status *status)
 {
-        return (status->frame_status&ZD_RX_OFDM) ?
+        int r;
-                ofdm_qual_db(status->signal_quality_ofdm,
-                             zd_ofdm_plcp_header_rate(rx_frame),
+        r = cck_snr_db(status_quality);
-                             size) :
+        r = (100*r)/17;
-                cck_snr_db(status->signal_quality_cck);
+        return r <= 100 ? r : 100;
 }
 u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
                      const struct rx_status *status)
 {
-        int r = rx_qual_db(rx_frame, size, status);
+        return (status->frame_status&ZD_RX_OFDM) ?
-        if (r < 0)
+                ofdm_qual_percent(status->signal_quality_ofdm,
-                r = 0;
+                                  zd_ofdm_plcp_header_rate(rx_frame),
-        r = (r * 100) / 14;
+                                  size) :
-        if (r > 100)
+                cck_qual_percent(status->signal_quality_cck);
-                r = 100;
-        return r;
 }
 u8 zd_rx_strength_percent(u8 rssi)
 {
-        int r = (rssi*100) / 30;
+        int r = (rssi*100) / 41;
        if (r > 100)
                r = 100;
        return (u8) r;
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index d6f3e02a0b54..a9bd80a08613 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -816,13 +816,25 @@ static int filter_rx(struct ieee80211_device *ieee,
        return -EINVAL;
 }
-static void update_qual_rssi(struct zd_mac *mac, u8 qual_percent, u8 rssi)
+static void update_qual_rssi(struct zd_mac *mac,
+                             const u8 *buffer, unsigned int length,
+                             u8 qual_percent, u8 rssi_percent)
 {
        unsigned long flags;
+        struct ieee80211_hdr_3addr *hdr;
+        int i;
+        hdr = (struct ieee80211_hdr_3addr *)buffer;
+        if (length < offsetof(struct ieee80211_hdr_3addr, addr3))
+                return;
+        if (memcmp(hdr->addr2, zd_mac_to_ieee80211(mac)->bssid, ETH_ALEN) != 0)
+                return;
        spin_lock_irqsave(&mac->lock, flags);
-        mac->qual_average = (7 * mac->qual_average + qual_percent) / 8;
+        i = mac->stats_count % ZD_MAC_STATS_BUFFER_SIZE;
-        mac->rssi_average = (7 * mac->rssi_average + rssi) / 8;
+        mac->qual_buffer[i] = qual_percent;
+        mac->rssi_buffer[i] = rssi_percent;
+        mac->stats_count++;
        spin_unlock_irqrestore(&mac->lock, flags);
 }
@@ -853,7 +865,6 @@ static int fill_rx_stats(struct ieee80211_rx_stats *stats,
        if (stats->rate)
                stats->mask |= IEEE80211_STATMASK_RATE;
-        update_qual_rssi(mac, stats->signal, stats->rssi);
        return 0;
 }
@@ -877,6 +888,8 @@ int zd_mac_rx(struct zd_mac *mac, const u8 *buffer, unsigned int length)
                  sizeof(struct rx_status);
        buffer += ZD_PLCP_HEADER_SIZE;
+        update_qual_rssi(mac, buffer, length, stats.signal, stats.rssi);
        r = filter_rx(ieee, buffer, length, &stats);
        if (r <= 0)
                return r;
@@ -981,17 +994,31 @@ struct iw_statistics *zd_mac_get_wireless_stats(struct net_device *ndev)
 {
        struct zd_mac *mac = zd_netdev_mac(ndev);
        struct iw_statistics *iw_stats = &mac->iw_stats;
+        unsigned int i, count, qual_total, rssi_total;
        memset(iw_stats, 0, sizeof(struct iw_statistics));
        /* We are not setting the status, because ieee->state is not updated
         * at all and this driver doesn't track authentication state.
         */
        spin_lock_irq(&mac->lock);
-        iw_stats->qual.qual = mac->qual_average;
+        count = mac->stats_count < ZD_MAC_STATS_BUFFER_SIZE ?
-        iw_stats->qual.level = mac->rssi_average;
+                mac->stats_count : ZD_MAC_STATS_BUFFER_SIZE;
-        iw_stats->qual.updated = IW_QUAL_QUAL_UPDATED|IW_QUAL_LEVEL_UPDATED|
+        qual_total = rssi_total = 0;
-                                 IW_QUAL_NOISE_INVALID;
+        for (i = 0; i < count; i++) {
+                qual_total += mac->qual_buffer[i];
+                rssi_total += mac->rssi_buffer[i];
+        }
        spin_unlock_irq(&mac->lock);
+        iw_stats->qual.updated = IW_QUAL_NOISE_INVALID;
+        if (count > 0) {
+                iw_stats->qual.qual = qual_total / count;
+                iw_stats->qual.level = rssi_total / count;
+                iw_stats->qual.updated |=
+                        IW_QUAL_QUAL_UPDATED|IW_QUAL_LEVEL_UPDATED;
+        } else {
+                iw_stats->qual.updated |=
+                        IW_QUAL_QUAL_INVALID|IW_QUAL_LEVEL_INVALID;
+        }
        /* TODO: update counter */
        return iw_stats;
 }
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index 71e382c589ee..b3ba49b84634 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -1,4 +1,4 @@
-/* zd_mac.c
+/* zd_mac.h
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -87,9 +87,9 @@ struct rx_length_info {
 #define RX_LENGTH_INFO_TAG              0x697e
 struct rx_status {
+        u8 signal_quality_cck;
        /* rssi */
        u8 signal_strength;
-        u8 signal_quality_cck;
        u8 signal_quality_ofdm;
        u8 decryption_type;
        u8 frame_status;
@@ -120,14 +120,17 @@ enum mac_flags {
        MAC_FIXED_CHANNEL = 0x01,
 };
+#define ZD_MAC_STATS_BUFFER_SIZE 16
 struct zd_mac {
        struct net_device *netdev;
        struct zd_chip chip;
        spinlock_t lock;
        /* Unlocked reading possible */
        struct iw_statistics iw_stats;
-        u8 qual_average;
+        unsigned int stats_count;
-        u8 rssi_average;
+        u8 qual_buffer[ZD_MAC_STATS_BUFFER_SIZE];
+        u8 rssi_buffer[ZD_MAC_STATS_BUFFER_SIZE];
        u8 regdomain;
        u8 default_regdomain;
        u8 requested_channel;
diff --git a/drivers/s390/net/Kconfig b/drivers/s390/net/Kconfig
index 548854754921..1a93fa684e9f 100644
--- a/drivers/s390/net/Kconfig
+++ b/drivers/s390/net/Kconfig
@@ -92,15 +92,6 @@ config QETH_VLAN
          If CONFIG_QETH is switched on, this option will include IEEE
          802.1q VLAN support in the qeth device driver.
-config QETH_PERF_STATS
-        bool "Performance statistics in /proc"
-        depends on QETH
-        help
-          When switched on, this option will add a file in the proc-fs
-          (/proc/qeth_perf_stats) containing performance statistics. It
-          may slightly impact performance, so this is only recommended for
-          internal tuning of the device driver.
 config CCWGROUP
        tristate
        default (LCS || CTC || QETH)
diff --git a/drivers/s390/net/Makefile b/drivers/s390/net/Makefile
index 6775a837d646..4777e36a922f 100644
--- a/drivers/s390/net/Makefile
+++ b/drivers/s390/net/Makefile
@@ -10,7 +10,6 @@ obj-$(CONFIG_SMSGIUCV) += smsgiucv.o
 obj-$(CONFIG_CTC) += ctc.o fsm.o cu3088.o
 obj-$(CONFIG_LCS) += lcs.o cu3088.o
 obj-$(CONFIG_CLAW) += claw.o cu3088.o
-obj-$(CONFIG_MPC) += ctcmpc.o fsm.o cu3088.o
 qeth-y := qeth_main.o qeth_mpc.o qeth_sys.o qeth_eddp.o 
 qeth-$(CONFIG_PROC_FS) += qeth_proc.o
 obj-$(CONFIG_QETH) += qeth.o
diff --git a/drivers/s390/net/ctcmain.c b/drivers/s390/net/ctcmain.c
index 8a4b58120146..3257c22dd79c 100644
--- a/drivers/s390/net/ctcmain.c
+++ b/drivers/s390/net/ctcmain.c
@@ -1714,6 +1714,9 @@ add_channel(struct ccw_device *cdev, enum channel_types type)
                kfree(ch);
                return 0;
        }
+        spin_lock_init(&ch->collect_lock);
        fsm_settimer(ch->fsm, &ch->timer);
        skb_queue_head_init(&ch->io_queue);
        skb_queue_head_init(&ch->collect_queue);
diff --git a/drivers/s390/net/iucv.c b/drivers/s390/net/iucv.c
index 0e863df4027a..821dde86e240 100644
--- a/drivers/s390/net/iucv.c
+++ b/drivers/s390/net/iucv.c
@@ -335,8 +335,8 @@ do { \
 #else
-#define iucv_debug(lvl, fmt, args...)
+#define iucv_debug(lvl, fmt, args...)   do { } while (0)
-#define iucv_dumpit(title, buf, len)
+#define iucv_dumpit(title, buf, len)    do { } while (0)
 #endif
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 2eded55ae88d..16ac68c27a27 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -670,9 +670,8 @@ lcs_ready_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
        int index, rc;
        LCS_DBF_TEXT(5, trace, "rdybuff");
-        if (buffer->state != BUF_STATE_LOCKED &&
+        BUG_ON(buffer->state != BUF_STATE_LOCKED &&
-            buffer->state != BUF_STATE_PROCESSED)
+               buffer->state != BUF_STATE_PROCESSED);
-                BUG();
        spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
        buffer->state = BUF_STATE_READY;
        index = buffer - channel->iob;
@@ -696,8 +695,7 @@ __lcs_processed_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
        int index, prev, next;
        LCS_DBF_TEXT(5, trace, "prcsbuff");
-        if (buffer->state != BUF_STATE_READY)
+        BUG_ON(buffer->state != BUF_STATE_READY);
-                BUG();
        buffer->state = BUF_STATE_PROCESSED;
        index = buffer - channel->iob;
        prev = (index - 1) & (LCS_NUM_BUFFS - 1);
@@ -729,9 +727,8 @@ lcs_release_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
        unsigned long flags;
        LCS_DBF_TEXT(5, trace, "relbuff");
-        if (buffer->state != BUF_STATE_LOCKED &&
+        BUG_ON(buffer->state != BUF_STATE_LOCKED &&
-            buffer->state != BUF_STATE_PROCESSED)
+               buffer->state != BUF_STATE_PROCESSED);
-                BUG();
        spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
        buffer->state = BUF_STATE_EMPTY;
        spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index 5d6e6cbfa360..d7d1cc0a5c8e 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -112,7 +112,12 @@ struct iucv_connection {
 /**
 * Linked list of all connection structs.
 */
-static struct iucv_connection *iucv_connections;
+struct iucv_connection_struct {
+        struct iucv_connection *iucv_connections;
+        rwlock_t iucv_rwlock;
+};
+static struct iucv_connection_struct iucv_conns;
 /**
 * Representation of event-data for the
@@ -1368,8 +1373,10 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
        struct net_device *ndev = priv->conn->netdev;
        char    *p;
        char    *tmp;
-        char    username[10];
+        char    username[9];
        int     i;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
        IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
        if (count>9) {
@@ -1382,7 +1389,7 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
        tmp = strsep((char **) &buf, "\n");
        for (i=0, p=tmp; i<8 && *p; i++, p++) {
                if (isalnum(*p) || (*p == '$'))
-                        username[i]= *p;
+                        username[i]= toupper(*p);
                else if (*p == '\n') {
                        /* trailing lf, grr */
                        break;
@@ -1395,11 +1402,11 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
                        return -EINVAL;
                }
        }
-        while (i<9)
+        while (i<8)
                username[i++] = ' ';
-        username[9] = '\0';
+        username[8] = '\0';
-        if (memcmp(username, priv->conn->userid, 8)) {
+        if (memcmp(username, priv->conn->userid, 9)) {
                /* username changed */
                if (ndev->flags & (IFF_UP | IFF_RUNNING)) {
                        PRINT_WARN(
@@ -1410,6 +1417,19 @@ user_write (struct device *dev, struct device_attribute *attr, const char *buf,
                        return -EBUSY;
                }
        }
+        read_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
+        while (*clist) {
+                if (!strncmp(username, (*clist)->userid, 9) ||
+                    ((*clist)->netdev != ndev))
+                        break;
+                clist = &((*clist)->next);
+        }
+        read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
+        if (*clist) {
+                PRINT_WARN("netiucv: Connection to %s already exists\n",
+                        username);
+                return -EEXIST;
+        }
        memcpy(priv->conn->userid, username, 9);
        return count;
@@ -1781,13 +1801,15 @@ netiucv_unregister_device(struct device *dev)
 static struct iucv_connection *
 netiucv_new_connection(struct net_device *dev, char *username)
 {
-        struct iucv_connection **clist = &iucv_connections;
+        unsigned long flags;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
        struct iucv_connection *conn =
                kzalloc(sizeof(struct iucv_connection), GFP_KERNEL);
        if (conn) {
                skb_queue_head_init(&conn->collect_queue);
                skb_queue_head_init(&conn->commit_queue);
+                spin_lock_init(&conn->collect_lock);
                conn->max_buffsize = NETIUCV_BUFSIZE_DEFAULT;
                conn->netdev = dev;
@@ -1822,8 +1844,10 @@ netiucv_new_connection(struct net_device *dev, char *username)
                        fsm_newstate(conn->fsm, CONN_STATE_STOPPED);
                }
+                write_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
                conn->next = *clist;
                *clist = conn;
+                write_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
        }
        return conn;
 }
@@ -1835,14 +1859,17 @@ netiucv_new_connection(struct net_device *dev, char *username)
 static void
 netiucv_remove_connection(struct iucv_connection *conn)
 {
-        struct iucv_connection **clist = &iucv_connections;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
        IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
        if (conn == NULL)
                return;
+        write_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
        while (*clist) {
                if (*clist == conn) {
                        *clist = conn->next;
+                        write_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
                        if (conn->handle) {
                                iucv_unregister_program(conn->handle);
                                conn->handle = NULL;
@@ -1855,6 +1882,7 @@ netiucv_remove_connection(struct iucv_connection *conn)
                }
                clist = &((*clist)->next);
        }
+        write_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
 }
 /**
@@ -1947,9 +1975,11 @@ static ssize_t
 conn_write(struct device_driver *drv, const char *buf, size_t count)
 {
        char *p;
-        char username[10];
+        char username[9];
        int i, ret;
        struct net_device *dev;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
        IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
        if (count>9) {
@@ -1960,7 +1990,7 @@ conn_write(struct device_driver *drv, const char *buf, size_t count)
        for (i=0, p=(char *)buf; i<8 && *p; i++, p++) {
                if (isalnum(*p) || (*p == '$'))
-                        username[i]= *p;
+                        username[i]= toupper(*p);
                else if (*p == '\n') {
                        /* trailing lf, grr */
                        break;
@@ -1971,9 +2001,22 @@ conn_write(struct device_driver *drv, const char *buf, size_t count)
                        return -EINVAL;
                }
        }
-        while (i<9)
+        while (i<8)
                username[i++] = ' ';
-        username[9] = '\0';
+        username[8] = '\0';
+        read_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
+        while (*clist) {
+                if (!strncmp(username, (*clist)->userid, 9))
+                        break;
+                clist = &((*clist)->next);
+        }
+        read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
+        if (*clist) {
+                PRINT_WARN("netiucv: Connection to %s already exists\n",
+                        username);
+                return -EEXIST;
+        }
        dev = netiucv_init_netdevice(username);
        if (!dev) {
                PRINT_WARN(
@@ -2015,7 +2058,8 @@ DRIVER_ATTR(connection, 0200, NULL, conn_write);
 static ssize_t
 remove_write (struct device_driver *drv, const char *buf, size_t count)
 {
-        struct iucv_connection **clist = &iucv_connections;
+        struct iucv_connection **clist = &iucv_conns.iucv_connections;
+        unsigned long flags;
        struct net_device *ndev;
        struct netiucv_priv *priv;
        struct device *dev;
@@ -2026,7 +2070,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
        IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
        if (count >= IFNAMSIZ)
-                count = IFNAMSIZ-1;
+                count = IFNAMSIZ - 1;;
        for (i=0, p=(char *)buf; i<count && *p; i++, p++) {
                if ((*p == '\n') || (*p == ' ')) {
@@ -2038,6 +2082,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
        }
        name[i] = '\0';
+        read_lock_irqsave(&iucv_conns.iucv_rwlock, flags);
        while (*clist) {
                ndev = (*clist)->netdev;
                priv = (struct netiucv_priv*)ndev->priv;
@@ -2047,6 +2092,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
                        clist = &((*clist)->next);
                        continue;
                }
+                read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
                if (ndev->flags & (IFF_UP | IFF_RUNNING)) {
                        PRINT_WARN(
                                "netiucv: net device %s active with peer %s\n",
@@ -2060,6 +2106,7 @@ remove_write (struct device_driver *drv, const char *buf, size_t count)
                netiucv_unregister_device(dev);
                return count;
        }
+        read_unlock_irqrestore(&iucv_conns.iucv_rwlock, flags);
        PRINT_WARN("netiucv: net device %s unknown\n", name);
        IUCV_DBF_TEXT(data, 2, "remove_write: unknown device\n");
        return -EINVAL;
@@ -2077,8 +2124,8 @@ static void __exit
 netiucv_exit(void)
 {
        IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
-        while (iucv_connections) {
+        while (iucv_conns.iucv_connections) {
-                struct net_device *ndev = iucv_connections->netdev;
+                struct net_device *ndev = iucv_conns.iucv_connections->netdev;
                struct netiucv_priv *priv = (struct netiucv_priv*)ndev->priv;
                struct device *dev = priv->dev;
@@ -2120,6 +2167,7 @@ netiucv_init(void)
        if (!ret) {
                ret = driver_create_file(&netiucv_driver, &driver_attr_remove);
                netiucv_banner();
+                rwlock_init(&iucv_conns.iucv_rwlock);
        } else {
                PRINT_ERR("NETIUCV: failed to add driver attribute.\n");
                IUCV_DBF_TEXT_(setup, 2, "ret %d from driver_create_file\n", ret);
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index 619f4a0c7160..821383d8cbe7 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -176,7 +176,6 @@ extern struct ccwgroup_driver qeth_ccwgroup_driver;
 /**
 * card stuff
 */
-#ifdef CONFIG_QETH_PERF_STATS
 struct qeth_perf_stats {
        unsigned int bufs_rec;
        unsigned int bufs_sent;
@@ -211,8 +210,10 @@ struct qeth_perf_stats {
        unsigned int large_send_cnt;
        unsigned int sg_skbs_sent;
        unsigned int sg_frags_sent;
+        /* initial values when measuring starts */
+        unsigned long initial_rx_packets;
+        unsigned long initial_tx_packets;
 };
-#endif /* CONFIG_QETH_PERF_STATS */
 /* Routing stuff */
 struct qeth_routing_info {
@@ -462,6 +463,7 @@ enum qeth_qdio_info_states {
        QETH_QDIO_UNINITIALIZED,
        QETH_QDIO_ALLOCATED,
        QETH_QDIO_ESTABLISHED,
+        QETH_QDIO_CLEANING
 };
 struct qeth_buffer_pool_entry {
@@ -536,7 +538,7 @@ struct qeth_qdio_out_q {
 } __attribute__ ((aligned(256)));
 struct qeth_qdio_info {
-        volatile enum qeth_qdio_info_states state;
+        atomic_t state;
        /* input */
        struct qeth_qdio_q *in_q;
        struct qeth_qdio_buffer_pool in_buf_pool;
@@ -767,6 +769,7 @@ struct qeth_card_options {
        int fake_ll;
        int layer2;
        enum qeth_large_send_types large_send;
+        int performance_stats;
 };
 /*
@@ -819,9 +822,7 @@ struct qeth_card {
        struct list_head cmd_waiter_list;
        /* QDIO buffer handling */
        struct qeth_qdio_info qdio;
-#ifdef CONFIG_QETH_PERF_STATS
        struct qeth_perf_stats perf_stats;
-#endif /* CONFIG_QETH_PERF_STATS */
        int use_hard_stop;
        int (*orig_hard_header)(struct sk_buff *,struct net_device *,
                                unsigned short,void *,void *,unsigned);
@@ -859,23 +860,18 @@ qeth_get_ipa_adp_type(enum qeth_link_types link_type)
        }
 }
-static inline int
+static inline struct sk_buff *
-qeth_realloc_headroom(struct qeth_card *card, struct sk_buff **skb, int size)
+qeth_realloc_headroom(struct qeth_card *card, struct sk_buff *skb, int size)
 {
-        struct sk_buff *new_skb = NULL;
+        struct sk_buff *new_skb = skb;
-        if (skb_headroom(*skb) < size){
+        if (skb_headroom(skb) >= size)
-                new_skb = skb_realloc_headroom(*skb, size);
+                return skb;
-                if (!new_skb) {
+        new_skb = skb_realloc_headroom(skb, size);
-                        PRINT_ERR("qeth_prepare_skb: could "
+        if (!new_skb) 
-                                  "not realloc headroom for qeth_hdr "
+                PRINT_ERR("Could not realloc headroom for qeth_hdr "
-                                  "on interface %s", QETH_CARD_IFNAME(card));
+                          "on interface %s", QETH_CARD_IFNAME(card));
-                        return -ENOMEM;
+        return new_skb;
-                }
-                kfree_skb(*skb);
-                *skb = new_skb;
-        }
-        return 0;
 }
 static inline struct sk_buff *
@@ -885,16 +881,15 @@ qeth_pskb_unshare(struct sk_buff *skb, int pri)
        if (!skb_cloned(skb))
                return skb;
        nskb = skb_copy(skb, pri);
-        kfree_skb(skb); /* free our shared copy */
        return nskb;
 }
 static inline void *
-qeth_push_skb(struct qeth_card *card, struct sk_buff **skb, int size)
+qeth_push_skb(struct qeth_card *card, struct sk_buff *skb, int size)
 {
        void *hdr;
-        hdr = (void *) skb_push(*skb, size);
+        hdr = (void *) skb_push(skb, size);
        /*
         * sanity check, the Linux memory allocation scheme should
         * never present us cases like this one (the qdio header size plus
@@ -903,8 +898,7 @@ qeth_push_skb(struct qeth_card *card, struct sk_buff **skb, int size)
        if ((((unsigned long) hdr) & (~(PAGE_SIZE - 1))) !=
            (((unsigned long) hdr + size +
              QETH_IP_HEADER_SIZE) & (~(PAGE_SIZE - 1)))) {
-                PRINT_ERR("qeth_prepare_skb: misaligned "
+                PRINT_ERR("Misaligned packet on interface %s. Discarded.",
-                          "packet on interface %s. Discarded.",
                          QETH_CARD_IFNAME(card));
                return NULL;
        }
@@ -1056,13 +1050,11 @@ qeth_get_arphdr_type(int cardtype, int linktype)
        }
 }
-#ifdef CONFIG_QETH_PERF_STATS
 static inline int
 qeth_get_micros(void)
 {
        return (int) (get_clock() >> 12);
 }
-#endif
 static inline int
 qeth_get_qdio_q_format(struct qeth_card *card)
@@ -1096,10 +1088,11 @@ qeth_string_to_ipaddr4(const char *buf, __u8 *addr)
 {
        int count = 0, rc = 0;
        int in[4];
+        char c;
-        rc = sscanf(buf, "%d.%d.%d.%d%n",
+        rc = sscanf(buf, "%u.%u.%u.%u%c",
-                    &in[0], &in[1], &in[2], &in[3], &count);
+                    &in[0], &in[1], &in[2], &in[3], &c);
-        if (rc != 4  || count<=0)
+        if (rc != 4 && (rc != 5 || c != '\n'))
                return -EINVAL;
        for (count = 0; count < 4; count++) {
                if (in[count] > 255)
@@ -1123,24 +1116,28 @@ qeth_ipaddr6_to_string(const __u8 *addr, char *buf)
 static inline int
 qeth_string_to_ipaddr6(const char *buf, __u8 *addr)
 {
-        char *end, *start;
+        const char *end, *end_tmp, *start;
        __u16 *in;
        char num[5];
        int num2, cnt, out, found, save_cnt;
        unsigned short in_tmp[8] = {0, };
        cnt = out = found = save_cnt = num2 = 0;
-        end = start = (char *) buf;
+        end = start = buf;
        in = (__u16 *) addr;
        memset(in, 0, 16);
-        while (end) {
+        while (*end) {
-                end = strchr(end,':');
+                end = strchr(start,':');
                if (end == NULL) {
-                        end = (char *)buf + (strlen(buf));
+                        end = buf + strlen(buf);
-                        out = 1;
+                        if ((end_tmp = strchr(start, '\n')) != NULL)
+                                end = end_tmp;
+                        out = 1;
                }
                if ((end - start)) {
                        memset(num, 0, 5);
+                        if ((end - start) > 4)
+                                return -EINVAL;
                        memcpy(num, start, end - start);
                        if (!qeth_isxdigit(num))
                                return -EINVAL;
@@ -1158,6 +1155,8 @@ qeth_string_to_ipaddr6(const char *buf, __u8 *addr)
                }
                start = ++end;
        }
+        if (cnt + save_cnt > 8)
+                return -EINVAL;
        cnt = 7;
        while (save_cnt)
                in[cnt--] = in_tmp[--save_cnt];
diff --git a/drivers/s390/net/qeth_eddp.c b/drivers/s390/net/qeth_eddp.c
index 8491598f9149..a363721cf28d 100644
--- a/drivers/s390/net/qeth_eddp.c
+++ b/drivers/s390/net/qeth_eddp.c
@@ -179,9 +179,8 @@ out_check:
                        flush_cnt++;
                }
        } else {
-#ifdef CONFIG_QETH_PERF_STATS
+                if (queue->card->options.performance_stats)
-                queue->card->perf_stats.skbs_sent_pack++;
+                        queue->card->perf_stats.skbs_sent_pack++;
-#endif
                QETH_DBF_TEXT(trace, 6, "fillbfpa");
                if (buf->next_element_to_fill >=
                                QETH_MAX_BUFFER_ELEMENTS(queue->card)) {
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index e1327b8fce00..5613b4564fa2 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -1073,6 +1073,7 @@ qeth_set_intial_options(struct qeth_card *card)
                card->options.layer2 = 1;
        else
                card->options.layer2 = 0;
+        card->options.performance_stats = 1;
 }
 /**
@@ -1708,6 +1709,7 @@ qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
                                           "IP address reset.\n",
                                           QETH_CARD_IFNAME(card),
                                           card->info.chpid);
+                                netif_carrier_on(card->dev);
                                qeth_schedule_recovery(card);
                                return NULL;
                        case IPA_CMD_MODCCID:
@@ -2464,24 +2466,6 @@ qeth_rebuild_skb_fake_ll(struct qeth_card *card, struct sk_buff *skb,
                qeth_rebuild_skb_fake_ll_eth(card, skb, hdr);
 }
-static inline void
-qeth_rebuild_skb_vlan(struct qeth_card *card, struct sk_buff *skb,
-                      struct qeth_hdr *hdr)
-{
-#ifdef CONFIG_QETH_VLAN
-        u16 *vlan_tag;
-        if (hdr->hdr.l3.ext_flags &
-            (QETH_HDR_EXT_VLAN_FRAME | QETH_HDR_EXT_INCLUDE_VLAN_TAG)) {
-                vlan_tag = (u16 *) skb_push(skb, VLAN_HLEN);
-                *vlan_tag = (hdr->hdr.l3.ext_flags & QETH_HDR_EXT_VLAN_FRAME)?
-                        hdr->hdr.l3.vlan_id : *((u16 *)&hdr->hdr.l3.dest_addr[12]);
-                *(vlan_tag + 1) = skb->protocol;
-                skb->protocol = __constant_htons(ETH_P_8021Q);
-        }
-#endif /* CONFIG_QETH_VLAN */
-}
 static inline __u16
 qeth_layer2_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                        struct qeth_hdr *hdr)
@@ -2510,15 +2494,16 @@ qeth_layer2_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
        return vlan_id;
 }
-static inline void
+static inline __u16
 qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                 struct qeth_hdr *hdr)
 {
+        unsigned short vlan_id = 0;
 #ifdef CONFIG_QETH_IPV6
        if (hdr->hdr.l3.flags & QETH_HDR_PASSTHRU) {
                skb->pkt_type = PACKET_HOST;
                skb->protocol = qeth_type_trans(skb, card->dev);
-                return;
+                return 0;
        }
 #endif /* CONFIG_QETH_IPV6 */
        skb->protocol = htons((hdr->hdr.l3.flags & QETH_HDR_IPV6)? ETH_P_IPV6 :
@@ -2540,7 +2525,13 @@ qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
        default:
                skb->pkt_type = PACKET_HOST;
        }
-        qeth_rebuild_skb_vlan(card, skb, hdr);
+        if (hdr->hdr.l3.ext_flags &
+            (QETH_HDR_EXT_VLAN_FRAME | QETH_HDR_EXT_INCLUDE_VLAN_TAG)) {
+                vlan_id = (hdr->hdr.l3.ext_flags & QETH_HDR_EXT_VLAN_FRAME)?
+                        hdr->hdr.l3.vlan_id : *((u16 *)&hdr->hdr.l3.dest_addr[12]);
+        }
        if (card->options.fake_ll)
                qeth_rebuild_skb_fake_ll(card, skb, hdr);
        else
@@ -2556,6 +2547,7 @@ qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                else
                        skb->ip_summed = SW_CHECKSUMMING;
        }
+        return vlan_id;
 }
 static inline void
@@ -2568,20 +2560,20 @@ qeth_process_inbound_buffer(struct qeth_card *card,
        int offset;
        int rxrc;
        __u16 vlan_tag = 0;
+        __u16 *vlan_addr;
        /* get first element of current buffer */
        element = (struct qdio_buffer_element *)&buf->buffer->element[0];
        offset = 0;
-#ifdef CONFIG_QETH_PERF_STATS
+        if (card->options.performance_stats)
-        card->perf_stats.bufs_rec++;
+                card->perf_stats.bufs_rec++;
-#endif
        while((skb = qeth_get_next_skb(card, buf->buffer, &element,
                                       &offset, &hdr))) {
                skb->dev = card->dev;
                if (hdr->hdr.l2.id == QETH_HEADER_TYPE_LAYER2)
                        vlan_tag = qeth_layer2_rebuild_skb(card, skb, hdr);
                else if (hdr->hdr.l3.id == QETH_HEADER_TYPE_LAYER3)
-                        qeth_rebuild_skb(card, skb, hdr);
+                        vlan_tag = qeth_rebuild_skb(card, skb, hdr);
                else { /*in case of OSN*/
                        skb_push(skb, sizeof(struct qeth_hdr));
                        memcpy(skb->data, hdr, sizeof(struct qeth_hdr));
@@ -2591,14 +2583,19 @@ qeth_process_inbound_buffer(struct qeth_card *card,
                        dev_kfree_skb_any(skb);
                        continue;
                }
+                if (card->info.type == QETH_CARD_TYPE_OSN)
+                        rxrc = card->osn_info.data_cb(skb);
+                else
 #ifdef CONFIG_QETH_VLAN
                if (vlan_tag)
-                        vlan_hwaccel_rx(skb, card->vlangrp, vlan_tag);
+                        if (card->vlangrp)
+                                vlan_hwaccel_rx(skb, card->vlangrp, vlan_tag);
+                        else {
+                                dev_kfree_skb_any(skb);
+                                continue;
+                        }
                else
 #endif
-                if (card->info.type == QETH_CARD_TYPE_OSN)
-                        rxrc = card->osn_info.data_cb(skb);
-                else
                        rxrc = netif_rx(skb);
                card->dev->last_rx = jiffies;
                card->stats.rx_packets++;
@@ -2626,7 +2623,7 @@ qeth_init_input_buffer(struct qeth_card *card, struct qeth_qdio_buffer *buf)
 {
        struct qeth_buffer_pool_entry *pool_entry;
        int i;
+ 
        pool_entry = qeth_get_buffer_pool_entry(card);
        /*
         * since the buffer is accessed only from the input_tasklet
@@ -2700,17 +2697,18 @@ qeth_queue_input_buffer(struct qeth_card *card, int index)
                 * 'index') un-requeued -> this buffer is the first buffer that
                 * will be requeued the next time
                 */
-#ifdef CONFIG_QETH_PERF_STATS
+                if (card->options.performance_stats) {
-                card->perf_stats.inbound_do_qdio_cnt++;
+                        card->perf_stats.inbound_do_qdio_cnt++;
-                card->perf_stats.inbound_do_qdio_start_time = qeth_get_micros();
+                        card->perf_stats.inbound_do_qdio_start_time =
-#endif
+                                qeth_get_micros();
+                }
                rc = do_QDIO(CARD_DDEV(card),
                             QDIO_FLAG_SYNC_INPUT | QDIO_FLAG_UNDER_INTERRUPT,
                             0, queue->next_buf_to_init, count, NULL);
-#ifdef CONFIG_QETH_PERF_STATS
+                if (card->options.performance_stats)
-                card->perf_stats.inbound_do_qdio_time += qeth_get_micros() -
+                        card->perf_stats.inbound_do_qdio_time +=
-                        card->perf_stats.inbound_do_qdio_start_time;
+                                qeth_get_micros() -
-#endif
+                                card->perf_stats.inbound_do_qdio_start_time;
                if (rc){
                        PRINT_WARN("qeth_queue_input_buffer's do_QDIO "
                                   "return %i (device %s).\n",
@@ -2746,10 +2744,10 @@ qeth_qdio_input_handler(struct ccw_device * ccwdev, unsigned int status,
        QETH_DBF_TEXT(trace, 6, "qdinput");
        card = (struct qeth_card *) card_ptr;
        net_dev = card->dev;
-#ifdef CONFIG_QETH_PERF_STATS
+        if (card->options.performance_stats) {
-        card->perf_stats.inbound_cnt++;
+                card->perf_stats.inbound_cnt++;
-        card->perf_stats.inbound_start_time = qeth_get_micros();
+                card->perf_stats.inbound_start_time = qeth_get_micros();
-#endif
+        }
        if (status & QDIO_STATUS_LOOK_FOR_ERROR) {
                if (status & QDIO_STATUS_ACTIVATE_CHECK_CONDITION){
                        QETH_DBF_TEXT(trace, 1,"qdinchk");
@@ -2771,10 +2769,9 @@ qeth_qdio_input_handler(struct ccw_device * ccwdev, unsigned int status,
                qeth_put_buffer_pool_entry(card, buffer->pool_entry);
                qeth_queue_input_buffer(card, index);
        }
-#ifdef CONFIG_QETH_PERF_STATS
+        if (card->options.performance_stats)
-        card->perf_stats.inbound_time += qeth_get_micros() -
+                card->perf_stats.inbound_time += qeth_get_micros() -
-                card->perf_stats.inbound_start_time;
+                        card->perf_stats.inbound_start_time;
-#endif
 }
 static inline int
@@ -2864,10 +2861,11 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
        }
        queue->card->dev->trans_start = jiffies;
-#ifdef CONFIG_QETH_PERF_STATS
+        if (queue->card->options.performance_stats) {
-        queue->card->perf_stats.outbound_do_qdio_cnt++;
+                queue->card->perf_stats.outbound_do_qdio_cnt++;
-        queue->card->perf_stats.outbound_do_qdio_start_time = qeth_get_micros();
+                queue->card->perf_stats.outbound_do_qdio_start_time =
-#endif
+                        qeth_get_micros();
+        }
        if (under_int)
                rc = do_QDIO(CARD_DDEV(queue->card),
                             QDIO_FLAG_SYNC_OUTPUT | QDIO_FLAG_UNDER_INTERRUPT,
@@ -2875,10 +2873,10 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
        else
                rc = do_QDIO(CARD_DDEV(queue->card), QDIO_FLAG_SYNC_OUTPUT,
                             queue->queue_no, index, count, NULL);
-#ifdef CONFIG_QETH_PERF_STATS
+        if (queue->card->options.performance_stats)
-        queue->card->perf_stats.outbound_do_qdio_time += qeth_get_micros() -
+                queue->card->perf_stats.outbound_do_qdio_time +=
-                queue->card->perf_stats.outbound_do_qdio_start_time;
+                        qeth_get_micros() -
-#endif
+                        queue->card->perf_stats.outbound_do_qdio_start_time;
        if (rc){
                QETH_DBF_TEXT(trace, 2, "flushbuf");
                QETH_DBF_TEXT_(trace, 2, " err%d", rc);
@@ -2890,9 +2888,8 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
                return;
        }
        atomic_add(count, &queue->used_buffers);
-#ifdef CONFIG_QETH_PERF_STATS
+        if (queue->card->options.performance_stats)
-        queue->card->perf_stats.bufs_sent += count;
+                queue->card->perf_stats.bufs_sent += count;
-#endif
 }
 /*
@@ -2907,9 +2904,8 @@ qeth_switch_to_packing_if_needed(struct qeth_qdio_out_q *queue)
                    >= QETH_HIGH_WATERMARK_PACK){
                        /* switch non-PACKING -> PACKING */
                        QETH_DBF_TEXT(trace, 6, "np->pack");
-#ifdef CONFIG_QETH_PERF_STATS
+                        if (queue->card->options.performance_stats)
-                        queue->card->perf_stats.sc_dp_p++;
+                                queue->card->perf_stats.sc_dp_p++;
-#endif
                        queue->do_pack = 1;
                }
        }
@@ -2932,9 +2928,8 @@ qeth_switch_to_nonpacking_if_needed(struct qeth_qdio_out_q *queue)
                    <= QETH_LOW_WATERMARK_PACK) {
                        /* switch PACKING -> non-PACKING */
                        QETH_DBF_TEXT(trace, 6, "pack->np");
-#ifdef CONFIG_QETH_PERF_STATS
+                        if (queue->card->options.performance_stats)
-                        queue->card->perf_stats.sc_p_dp++;
+                                queue->card->perf_stats.sc_p_dp++;
-#endif
                        queue->do_pack = 0;
                        /* flush packing buffers */
                        buffer = &queue->bufs[queue->next_buf_to_fill];
@@ -2946,7 +2941,7 @@ qeth_switch_to_nonpacking_if_needed(struct qeth_qdio_out_q *queue)
                                queue->next_buf_to_fill =
                                        (queue->next_buf_to_fill + 1) %
                                        QDIO_MAX_BUFFERS_PER_Q;
-                        }
+                        }
                }
        }
        return flush_count;
@@ -3002,11 +2997,10 @@ qeth_check_outbound_queue(struct qeth_qdio_out_q *queue)
                            !atomic_read(&queue->set_pci_flags_count))
                                flush_cnt +=
                                        qeth_flush_buffers_on_no_pci(queue);
-#ifdef CONFIG_QETH_PERF_STATS
+                        if (queue->card->options.performance_stats &&
-                        if (q_was_packing)
+                            q_was_packing)
                                queue->card->perf_stats.bufs_sent_pack +=
                                        flush_cnt;
-#endif
                        if (flush_cnt)
                                qeth_flush_buffers(queue, 1, index, flush_cnt);
                        atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
@@ -3036,10 +3030,11 @@ qeth_qdio_output_handler(struct ccw_device * ccwdev, unsigned int status,
                        return;
                }
        }
-#ifdef CONFIG_QETH_PERF_STATS
+        if (card->options.performance_stats) {
-        card->perf_stats.outbound_handler_cnt++;
+                card->perf_stats.outbound_handler_cnt++;
-        card->perf_stats.outbound_handler_start_time = qeth_get_micros();
+                card->perf_stats.outbound_handler_start_time =
-#endif
+                        qeth_get_micros();
+        }
        for(i = first_element; i < (first_element + count); ++i){
                buffer = &queue->bufs[i % QDIO_MAX_BUFFERS_PER_Q];
                /*we only handle the KICK_IT error by doing a recovery */
@@ -3058,10 +3053,9 @@ qeth_qdio_output_handler(struct ccw_device * ccwdev, unsigned int status,
                qeth_check_outbound_queue(queue);
        netif_wake_queue(queue->card->dev);
-#ifdef CONFIG_QETH_PERF_STATS
+        if (card->options.performance_stats)
-        card->perf_stats.outbound_handler_time += qeth_get_micros() -
+                card->perf_stats.outbound_handler_time += qeth_get_micros() -
-                card->perf_stats.outbound_handler_start_time;
+                        card->perf_stats.outbound_handler_start_time;
-#endif
 }
 static void
@@ -3185,13 +3179,14 @@ qeth_alloc_qdio_buffers(struct qeth_card *card)
        QETH_DBF_TEXT(setup, 2, "allcqdbf");
-        if (card->qdio.state == QETH_QDIO_ALLOCATED)
+        if (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_UNINITIALIZED,
+                QETH_QDIO_ALLOCATED) != QETH_QDIO_UNINITIALIZED)
                return 0;
        card->qdio.in_q = kmalloc(sizeof(struct qeth_qdio_q),
                                  GFP_KERNEL|GFP_DMA);
        if (!card->qdio.in_q)
-                return - ENOMEM;
+                goto out_nomem;
        QETH_DBF_TEXT(setup, 2, "inq");
        QETH_DBF_HEX(setup, 2, &card->qdio.in_q, sizeof(void *));
        memset(card->qdio.in_q, 0, sizeof(struct qeth_qdio_q));
@@ -3200,27 +3195,19 @@ qeth_alloc_qdio_buffers(struct qeth_card *card)
                card->qdio.in_q->bufs[i].buffer =
                        &card->qdio.in_q->qdio_bufs[i];
        /* inbound buffer pool */
-        if (qeth_alloc_buffer_pool(card)){
+        if (qeth_alloc_buffer_pool(card))
-                kfree(card->qdio.in_q);
+                goto out_freeinq;
-                return -ENOMEM;
-        }
        /* outbound */
        card->qdio.out_qs =
                kmalloc(card->qdio.no_out_queues *
                        sizeof(struct qeth_qdio_out_q *), GFP_KERNEL);
-        if (!card->qdio.out_qs){
+        if (!card->qdio.out_qs)
-                qeth_free_buffer_pool(card);
+                goto out_freepool;
-                return -ENOMEM;
+        for (i = 0; i < card->qdio.no_out_queues; ++i) {
-        }
-        for (i = 0; i < card->qdio.no_out_queues; ++i){
                card->qdio.out_qs[i] = kmalloc(sizeof(struct qeth_qdio_out_q),
                                               GFP_KERNEL|GFP_DMA);
-                if (!card->qdio.out_qs[i]){
+                if (!card->qdio.out_qs[i])
-                        while (i > 0)
+                        goto out_freeoutq;
-                                kfree(card->qdio.out_qs[--i]);
-                        kfree(card->qdio.out_qs);
-                        return -ENOMEM;
-                }
                QETH_DBF_TEXT_(setup, 2, "outq %i", i);
                QETH_DBF_HEX(setup, 2, &card->qdio.out_qs[i], sizeof(void *));
                memset(card->qdio.out_qs[i], 0, sizeof(struct qeth_qdio_out_q));
@@ -3237,8 +3224,19 @@ qeth_alloc_qdio_buffers(struct qeth_card *card)
                        INIT_LIST_HEAD(&card->qdio.out_qs[i]->bufs[j].ctx_list);
                }
        }
-        card->qdio.state = QETH_QDIO_ALLOCATED;
        return 0;
+out_freeoutq:
+        while (i > 0)
+                kfree(card->qdio.out_qs[--i]);
+        kfree(card->qdio.out_qs);
+out_freepool:
+        qeth_free_buffer_pool(card);
+out_freeinq:
+        kfree(card->qdio.in_q);
+out_nomem:
+        atomic_set(&card->qdio.state, QETH_QDIO_UNINITIALIZED);
+        return -ENOMEM;
 }
 static void
@@ -3247,7 +3245,8 @@ qeth_free_qdio_buffers(struct qeth_card *card)
        int i, j;
        QETH_DBF_TEXT(trace, 2, "freeqdbf");
-        if (card->qdio.state == QETH_QDIO_UNINITIALIZED)
+        if (atomic_swap(&card->qdio.state, QETH_QDIO_UNINITIALIZED) ==
+                QETH_QDIO_UNINITIALIZED)
                return;
        kfree(card->qdio.in_q);
        /* inbound buffer pool */
@@ -3260,7 +3259,6 @@ qeth_free_qdio_buffers(struct qeth_card *card)
                kfree(card->qdio.out_qs[i]);
        }
        kfree(card->qdio.out_qs);
-        card->qdio.state = QETH_QDIO_UNINITIALIZED;
 }
 static void
@@ -3282,7 +3280,7 @@ static void
 qeth_init_qdio_info(struct qeth_card *card)
 {
        QETH_DBF_TEXT(setup, 4, "intqdinf");
-        card->qdio.state = QETH_QDIO_UNINITIALIZED;
+        atomic_set(&card->qdio.state, QETH_QDIO_UNINITIALIZED);
        /* inbound */
        card->qdio.in_buf_size = QETH_IN_BUF_SIZE_DEFAULT;
        card->qdio.init_pool.buf_count = QETH_IN_BUF_COUNT_DEFAULT;
@@ -3345,7 +3343,7 @@ qeth_qdio_establish(struct qeth_card *card)
        struct qdio_buffer **in_sbal_ptrs;
        struct qdio_buffer **out_sbal_ptrs;
        int i, j, k;
-        int rc;
+        int rc = 0;
        QETH_DBF_TEXT(setup, 2, "qdioest");
@@ -3404,8 +3402,10 @@ qeth_qdio_establish(struct qeth_card *card)
        init_data.input_sbal_addr_array  = (void **) in_sbal_ptrs;
        init_data.output_sbal_addr_array = (void **) out_sbal_ptrs;
-        if (!(rc = qdio_initialize(&init_data)))
+        if (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_ALLOCATED,
-                card->qdio.state = QETH_QDIO_ESTABLISHED;
+                QETH_QDIO_ESTABLISHED) == QETH_QDIO_ALLOCATED)
+                if ((rc = qdio_initialize(&init_data)))
+                        atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
        kfree(out_sbal_ptrs);
        kfree(in_sbal_ptrs);
@@ -3521,13 +3521,20 @@ qeth_qdio_clear_card(struct qeth_card *card, int use_halt)
        int rc = 0;
        QETH_DBF_TEXT(trace,3,"qdioclr");
-        if (card->qdio.state == QETH_QDIO_ESTABLISHED){
+        switch (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_ESTABLISHED,
+                QETH_QDIO_CLEANING)) {
+        case QETH_QDIO_ESTABLISHED:
                if ((rc = qdio_cleanup(CARD_DDEV(card),
-                             (card->info.type == QETH_CARD_TYPE_IQD) ?
+                                (card->info.type == QETH_CARD_TYPE_IQD) ?
-                             QDIO_FLAG_CLEANUP_USING_HALT :
+                                QDIO_FLAG_CLEANUP_USING_HALT :
-                             QDIO_FLAG_CLEANUP_USING_CLEAR)))
+                                QDIO_FLAG_CLEANUP_USING_CLEAR)))
                        QETH_DBF_TEXT_(trace, 3, "1err%d", rc);
-                card->qdio.state = QETH_QDIO_ALLOCATED;
+                atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
+                break;
+        case QETH_QDIO_CLEANING:
+                return rc;
+        default:
+                break;
        }
        if ((rc = qeth_clear_halt_card(card, use_halt)))
                QETH_DBF_TEXT_(trace, 3, "2err%d", rc);
@@ -3687,10 +3694,10 @@ qeth_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                /* return OK; otherwise ksoftirqd goes to 100% */
                return NETDEV_TX_OK;
        }
-#ifdef CONFIG_QETH_PERF_STATS
+        if (card->options.performance_stats) {
-        card->perf_stats.outbound_cnt++;
+                card->perf_stats.outbound_cnt++;
-        card->perf_stats.outbound_start_time = qeth_get_micros();
+                card->perf_stats.outbound_start_time = qeth_get_micros();
-#endif
+        }
        netif_stop_queue(dev);
        if ((rc = qeth_send_packet(card, skb))) {
                if (rc == -EBUSY) {
@@ -3704,10 +3711,9 @@ qeth_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        }
        netif_wake_queue(dev);
-#ifdef CONFIG_QETH_PERF_STATS
+        if (card->options.performance_stats)
-        card->perf_stats.outbound_time += qeth_get_micros() -
+                card->perf_stats.outbound_time += qeth_get_micros() -
-                card->perf_stats.outbound_start_time;
+                        card->perf_stats.outbound_start_time;
-#endif
        return rc;
 }
@@ -3922,49 +3928,59 @@ qeth_get_ip_version(struct sk_buff *skb)
        }
 }
-static inline int
+static inline struct qeth_hdr *
-qeth_prepare_skb(struct qeth_card *card, struct sk_buff **skb,
+__qeth_prepare_skb(struct qeth_card *card, struct sk_buff *skb, int ipv)
-                 struct qeth_hdr **hdr, int ipv)
 {
-        int rc = 0;
 #ifdef CONFIG_QETH_VLAN
        u16 *tag;
-#endif
+        if (card->vlangrp && vlan_tx_tag_present(skb) &&
-        QETH_DBF_TEXT(trace, 6, "prepskb");
-        if (card->info.type == QETH_CARD_TYPE_OSN) {
-                *hdr = (struct qeth_hdr *)(*skb)->data;
-                return rc;
-        }
-        rc = qeth_realloc_headroom(card, skb, sizeof(struct qeth_hdr));
-        if (rc)
-                return rc;
-#ifdef CONFIG_QETH_VLAN
-        if (card->vlangrp && vlan_tx_tag_present(*skb) &&
            ((ipv == 6) || card->options.layer2) ) {
                /*
                 * Move the mac addresses (6 bytes src, 6 bytes dest)
                 * to the beginning of the new header.  We are using three
                 * memcpys instead of one memmove to save cycles.
                 */
-                skb_push(*skb, VLAN_HLEN);
+                skb_push(skb, VLAN_HLEN);
-                memcpy((*skb)->data, (*skb)->data + 4, 4);
+                memcpy(skb->data, skb->data + 4, 4);
-                memcpy((*skb)->data + 4, (*skb)->data + 8, 4);
+                memcpy(skb->data + 4, skb->data + 8, 4);
-                memcpy((*skb)->data + 8, (*skb)->data + 12, 4);
+                memcpy(skb->data + 8, skb->data + 12, 4);
-                tag = (u16 *)((*skb)->data + 12);
+                tag = (u16 *)(skb->data + 12);
                /*
                 * first two bytes  = ETH_P_8021Q (0x8100)
                 * second two bytes = VLANID
                 */
                *tag = __constant_htons(ETH_P_8021Q);
-                *(tag + 1) = htons(vlan_tx_tag_get(*skb));
+                *(tag + 1) = htons(vlan_tx_tag_get(skb));
        }
 #endif
-        *hdr = (struct qeth_hdr *)
+        return ((struct qeth_hdr *)
-                qeth_push_skb(card, skb, sizeof(struct qeth_hdr));
+                qeth_push_skb(card, skb, sizeof(struct qeth_hdr)));
-        if (*hdr == NULL)
+}
-                return -EINVAL;
-        return 0;
+static inline void
+__qeth_free_new_skb(struct sk_buff *orig_skb, struct sk_buff *new_skb)
+{
+        if (orig_skb != new_skb)
+                dev_kfree_skb_any(new_skb);
+}
+static inline struct sk_buff *
+qeth_prepare_skb(struct qeth_card *card, struct sk_buff *skb,
+                 struct qeth_hdr **hdr, int ipv)
+{
+        struct sk_buff *new_skb;
+        
+        QETH_DBF_TEXT(trace, 6, "prepskb");
+        new_skb = qeth_realloc_headroom(card, skb, sizeof(struct qeth_hdr));
+        if (new_skb == NULL)
+                return NULL;
+        *hdr = __qeth_prepare_skb(card, new_skb, ipv);
+        if (*hdr == NULL) {
+                __qeth_free_new_skb(skb, new_skb);
+                return NULL;
+        }
+        return new_skb;
 }
 static inline u8
@@ -4206,9 +4222,8 @@ qeth_fill_buffer(struct qeth_qdio_out_q *queue,
                flush_cnt = 1;
        } else {
                QETH_DBF_TEXT(trace, 6, "fillbfpa");
-#ifdef CONFIG_QETH_PERF_STATS
+                if (queue->card->options.performance_stats)
-                queue->card->perf_stats.skbs_sent_pack++;
+                        queue->card->perf_stats.skbs_sent_pack++;
-#endif
                if (buf->next_element_to_fill >=
                                QETH_MAX_BUFFER_ELEMENTS(queue->card)) {
                        /*
@@ -4245,21 +4260,15 @@ qeth_do_send_packet_fast(struct qeth_card *card, struct qeth_qdio_out_q *queue,
         * check if buffer is empty to make sure that we do not 'overtake'
         * ourselves and try to fill a buffer that is already primed
         */
-        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY) {
+        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY) 
-                card->stats.tx_dropped++;
+                goto out;
-                atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
-                return -EBUSY;
-        }
        if (ctx == NULL)
                queue->next_buf_to_fill = (queue->next_buf_to_fill + 1) %
                                          QDIO_MAX_BUFFERS_PER_Q;
        else {
                buffers_needed = qeth_eddp_check_buffers_for_context(queue,ctx);
-                if (buffers_needed < 0) {
+                if (buffers_needed < 0) 
-                        card->stats.tx_dropped++;
+                        goto out;
-                        atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
-                        return -EBUSY;
-                }
                queue->next_buf_to_fill =
                        (queue->next_buf_to_fill + buffers_needed) %
                        QDIO_MAX_BUFFERS_PER_Q;
@@ -4274,6 +4283,9 @@ qeth_do_send_packet_fast(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                qeth_flush_buffers(queue, 0, index, flush_cnt);
        }
        return 0;
+out:
+        atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
+        return -EBUSY;
 }
 static inline int
@@ -4299,8 +4311,7 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
         * check if buffer is empty to make sure that we do not 'overtake'
         * ourselves and try to fill a buffer that is already primed
         */
-        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY){
+        if (atomic_read(&buffer->state) != QETH_QDIO_BUF_EMPTY) {
-                card->stats.tx_dropped++;
                atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
                return -EBUSY;
        }
@@ -4323,7 +4334,6 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                                 * again */
                                if (atomic_read(&buffer->state) !=
                                                QETH_QDIO_BUF_EMPTY){
-                                        card->stats.tx_dropped++;
                                        qeth_flush_buffers(queue, 0, start_index, flush_count);
                                        atomic_set(&queue->state, QETH_OUT_Q_UNLOCKED);
                                        return -EBUSY;
@@ -4334,7 +4344,6 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                         * free buffers) to handle eddp context */
                        if (qeth_eddp_check_buffers_for_context(queue,ctx) < 0){
                                printk("eddp tx_dropped 1\n");
-                                card->stats.tx_dropped++;
                                rc = -EBUSY;
                                goto out;
                        }
@@ -4346,7 +4355,6 @@ qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                tmp = qeth_eddp_fill_buffer(queue,ctx,queue->next_buf_to_fill);
                if (tmp < 0) {
                        printk("eddp tx_dropped 2\n");
-                        card->stats.tx_dropped++;
                        rc = - EBUSY;
                        goto out;
                }
@@ -4380,10 +4388,8 @@ out:
                        qeth_flush_buffers(queue, 0, start_index, flush_count);
        }
        /* at this point the queue is UNLOCKED again */
-#ifdef CONFIG_QETH_PERF_STATS
+        if (queue->card->options.performance_stats && do_pack)
-        if (do_pack)
                queue->card->perf_stats.bufs_sent_pack += flush_count;
-#endif /* CONFIG_QETH_PERF_STATS */
        return rc;
 }
@@ -4394,21 +4400,21 @@ qeth_get_elements_no(struct qeth_card *card, void *hdr,
 {
        int elements_needed = 0;
-        if (skb_shinfo(skb)->nr_frags > 0) {
+        if (skb_shinfo(skb)->nr_frags > 0) 
                elements_needed = (skb_shinfo(skb)->nr_frags + 1);
-        }
+        if (elements_needed == 0)
-        if (elements_needed == 0 )
                elements_needed = 1 + (((((unsigned long) hdr) % PAGE_SIZE)
                                        + skb->len) >> PAGE_SHIFT);
        if ((elements_needed + elems) > QETH_MAX_BUFFER_ELEMENTS(card)){
-                PRINT_ERR("qeth_do_send_packet: invalid size of "
+                PRINT_ERR("Invalid size of IP packet "
-                          "IP packet (Number=%d / Length=%d). Discarded.\n",
+                          "(Number=%d / Length=%d). Discarded.\n",
                          (elements_needed+elems), skb->len);
                return 0;
        }
        return elements_needed;
 }
 static inline int
 qeth_send_packet(struct qeth_card *card, struct sk_buff *skb)
 {
@@ -4420,112 +4426,112 @@ qeth_send_packet(struct qeth_card *card, struct sk_buff *skb)
        enum qeth_large_send_types large_send = QETH_LARGE_SEND_NO;
        struct qeth_eddp_context *ctx = NULL;
        int tx_bytes = skb->len;
-#ifdef CONFIG_QETH_PERF_STATS
        unsigned short nr_frags = skb_shinfo(skb)->nr_frags;
        unsigned short tso_size = skb_shinfo(skb)->gso_size;
-#endif
+        struct sk_buff *new_skb, *new_skb2;
        int rc;
        QETH_DBF_TEXT(trace, 6, "sendpkt");
+        new_skb = skb;
+        if ((card->info.type == QETH_CARD_TYPE_OSN) &&
+            (skb->protocol == htons(ETH_P_IPV6)))
+                return -EPERM;
+        cast_type = qeth_get_cast_type(card, skb);
+        if ((cast_type == RTN_BROADCAST) &&
+            (card->info.broadcast_capable == 0))
+                return -EPERM;
+        queue = card->qdio.out_qs
+                [qeth_get_priority_queue(card, skb, ipv, cast_type)];
        if (!card->options.layer2) {
                ipv = qeth_get_ip_version(skb);
                if ((card->dev->hard_header == qeth_fake_header) && ipv) {
-                        if ((skb = qeth_pskb_unshare(skb,GFP_ATOMIC)) == NULL) {
+                        new_skb = qeth_pskb_unshare(skb, GFP_ATOMIC);
-                                card->stats.tx_dropped++;
+                        if (!new_skb)
-                                dev_kfree_skb_irq(skb);
+                                return -ENOMEM;
-                                return 0;
-                        }
                        if(card->dev->type == ARPHRD_IEEE802_TR){
-                                skb_pull(skb, QETH_FAKE_LL_LEN_TR);
+                                skb_pull(new_skb, QETH_FAKE_LL_LEN_TR);
                        } else {
-                                skb_pull(skb, QETH_FAKE_LL_LEN_ETH);
+                                skb_pull(new_skb, QETH_FAKE_LL_LEN_ETH);
                        }
                }
        }
-        if ((card->info.type == QETH_CARD_TYPE_OSN) &&
-                (skb->protocol == htons(ETH_P_IPV6))) {
-                dev_kfree_skb_any(skb);
-                return 0;
-        }
-        cast_type = qeth_get_cast_type(card, skb);
-        if ((cast_type == RTN_BROADCAST) &&
-            (card->info.broadcast_capable == 0)){
-                card->stats.tx_dropped++;
-                card->stats.tx_errors++;
-                dev_kfree_skb_any(skb);
-                return NETDEV_TX_OK;
-        }
-        queue = card->qdio.out_qs
-                [qeth_get_priority_queue(card, skb, ipv, cast_type)];
        if (skb_is_gso(skb))
                large_send = card->options.large_send;
+        /* check on OSN device*/
-        /*are we able to do TSO ? If so ,prepare and send it from here */
+        if (card->info.type == QETH_CARD_TYPE_OSN)
+                hdr = (struct qeth_hdr *)new_skb->data;
+        /*are we able to do TSO ? */
        if ((large_send == QETH_LARGE_SEND_TSO) &&
            (cast_type == RTN_UNSPEC)) {
-                rc = qeth_tso_prepare_packet(card, skb, ipv, cast_type);
+                rc = qeth_tso_prepare_packet(card, new_skb, ipv, cast_type);
                if (rc) {
-                        card->stats.tx_dropped++;
+                        __qeth_free_new_skb(skb, new_skb);
-                        card->stats.tx_errors++;
+                        return rc;
-                        dev_kfree_skb_any(skb);
-                        return NETDEV_TX_OK;
                }
                elements_needed++;
-        } else {
+        } else if (card->info.type != QETH_CARD_TYPE_OSN) {
-                if ((rc = qeth_prepare_skb(card, &skb, &hdr, ipv))) {
+                new_skb2 = qeth_prepare_skb(card, new_skb, &hdr, ipv);
-                        QETH_DBF_TEXT_(trace, 4, "pskbe%d", rc);
+                if (!new_skb2) {
-                        return rc;
+                        __qeth_free_new_skb(skb, new_skb);
+                        return -EINVAL;
                }
-                if (card->info.type != QETH_CARD_TYPE_OSN)
+                if (new_skb != skb)
-                        qeth_fill_header(card, hdr, skb, ipv, cast_type);
+                        __qeth_free_new_skb(new_skb2, new_skb);
+                new_skb = new_skb2;
+                qeth_fill_header(card, hdr, new_skb, ipv, cast_type);
        }
        if (large_send == QETH_LARGE_SEND_EDDP) {
-                ctx = qeth_eddp_create_context(card, skb, hdr);
+                ctx = qeth_eddp_create_context(card, new_skb, hdr);
                if (ctx == NULL) {
+                        __qeth_free_new_skb(skb, new_skb);
                        PRINT_WARN("could not create eddp context\n");
                        return -EINVAL;
                }
        } else {
-                int elems = qeth_get_elements_no(card,(void*) hdr, skb,
+                int elems = qeth_get_elements_no(card,(void*) hdr, new_skb,
                                                 elements_needed);
-                if (!elems)
+                if (!elems) {
+                        __qeth_free_new_skb(skb, new_skb);
                        return -EINVAL;
+                }
                elements_needed += elems;
        }
        if (card->info.type != QETH_CARD_TYPE_IQD)
-                rc = qeth_do_send_packet(card, queue, skb, hdr,
+                rc = qeth_do_send_packet(card, queue, new_skb, hdr,
                                         elements_needed, ctx);
        else
-                rc = qeth_do_send_packet_fast(card, queue, skb, hdr,
+                rc = qeth_do_send_packet_fast(card, queue, new_skb, hdr,
                                              elements_needed, ctx);
-        if (!rc){
+        if (!rc) {
                card->stats.tx_packets++;
                card->stats.tx_bytes += tx_bytes;
-#ifdef CONFIG_QETH_PERF_STATS
+                if (new_skb != skb)
-                if (tso_size &&
+                        dev_kfree_skb_any(skb);
-                   !(large_send == QETH_LARGE_SEND_NO)) {
+                if (card->options.performance_stats) {
-                        card->perf_stats.large_send_bytes += tx_bytes;
+                        if (tso_size &&
-                        card->perf_stats.large_send_cnt++;
+                            !(large_send == QETH_LARGE_SEND_NO)) {
-                }
+                                card->perf_stats.large_send_bytes += tx_bytes;
-                if (nr_frags > 0){
+                                card->perf_stats.large_send_cnt++;
-                        card->perf_stats.sg_skbs_sent++;
+                        }
-                        /* nr_frags + skb->data */
+                        if (nr_frags > 0) {
-                        card->perf_stats.sg_frags_sent +=
+                                card->perf_stats.sg_skbs_sent++;
-                                nr_frags + 1;
+                                /* nr_frags + skb->data */
+                                card->perf_stats.sg_frags_sent +=
+                                        nr_frags + 1;
+                        }
                }
-#endif /* CONFIG_QETH_PERF_STATS */
+        } else {
+                card->stats.tx_dropped++;
+                __qeth_free_new_skb(skb, new_skb);
        }
        if (ctx != NULL) {
                /* drop creator's reference */
                qeth_eddp_put_context(ctx);
                /* free skb; it's not referenced by a buffer */
-                if (rc == 0)
+                if (!rc)
-                        dev_kfree_skb_any(skb);
+                       dev_kfree_skb_any(new_skb);
        }
        return rc;
 }
@@ -7338,6 +7344,8 @@ qeth_setrouting_v6(struct qeth_card *card)
        QETH_DBF_TEXT(trace,3,"setrtg6");
 #ifdef CONFIG_QETH_IPV6
+        if (!qeth_is_supported(card, IPA_IPV6))
+                return 0;
        qeth_correct_routing_type(card, &card->options.route6.type,
                                  QETH_PROT_IPV6);
@@ -7876,12 +7884,12 @@ __qeth_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                QETH_DBF_TEXT_(setup, 2, "5err%d", rc);
                goto out_remove;
        }
-        card->state = CARD_STATE_SOFTSETUP;
        if ((rc = qeth_init_qdio_queues(card))){
                QETH_DBF_TEXT_(setup, 2, "6err%d", rc);
                goto out_remove;
        }
+        card->state = CARD_STATE_SOFTSETUP;
        netif_carrier_on(card->dev);
        qeth_set_allowed_threads(card, 0xffffffff, 0);
@@ -8538,34 +8546,44 @@ qeth_ipv6_uninit(void)
 static void
 qeth_sysfs_unregister(void)
 {
+        s390_root_dev_unregister(qeth_root_dev);
        qeth_remove_driver_attributes();
        ccw_driver_unregister(&qeth_ccw_driver);
        ccwgroup_driver_unregister(&qeth_ccwgroup_driver);
-        s390_root_dev_unregister(qeth_root_dev);
 }
 /**
 * register qeth at sysfs
 */
 static int
 qeth_sysfs_register(void)
 {
-        int rc=0;
+        int rc;
        rc = ccwgroup_driver_register(&qeth_ccwgroup_driver);
        if (rc)
-                return rc;
+                goto out;
        rc = ccw_driver_register(&qeth_ccw_driver);
        if (rc)
-                return rc;
+                goto out_ccw_driver;
        rc = qeth_create_driver_attributes();
        if (rc)
-                return rc;
+                goto out_qeth_attr;
        qeth_root_dev = s390_root_dev_register("qeth");
-        if (IS_ERR(qeth_root_dev)) {
+        rc = IS_ERR(qeth_root_dev) ? PTR_ERR(qeth_root_dev) : 0;
-                rc = PTR_ERR(qeth_root_dev);
+        if (!rc)
-                return rc;
+                goto out;
-        }
-        return 0;
+        qeth_remove_driver_attributes();
+out_qeth_attr:
+        ccw_driver_unregister(&qeth_ccw_driver);
+out_ccw_driver:
+        ccwgroup_driver_unregister(&qeth_ccwgroup_driver);
+out:
+        return rc;
 }
 /***
@@ -8574,7 +8592,7 @@ qeth_sysfs_register(void)
 static int __init
 qeth_init(void)
 {
-        int rc=0;
+        int rc;
        PRINT_INFO("loading %s\n", version);
@@ -8583,20 +8601,26 @@ qeth_init(void)
        spin_lock_init(&qeth_notify_lock);
        rwlock_init(&qeth_card_list.rwlock);
-        if (qeth_register_dbf_views())
+        rc = qeth_register_dbf_views();
+        if (rc)
                goto out_err;
-        if (qeth_sysfs_register())
-                goto out_sysfs;
+        rc = qeth_sysfs_register();
+        if (rc)
+                goto out_dbf;
 #ifdef CONFIG_QETH_IPV6
-        if (qeth_ipv6_init()) {
+        rc = qeth_ipv6_init();
-                PRINT_ERR("Out of memory during ipv6 init.\n");
+        if (rc) {
+                PRINT_ERR("Out of memory during ipv6 init code = %d\n", rc);
                goto out_sysfs;
        }
 #endif /* QETH_IPV6 */
-        if (qeth_register_notifiers())
+        rc = qeth_register_notifiers();
+        if (rc)
                goto out_ipv6;
-        if (qeth_create_procfs_entries())
+        rc = qeth_create_procfs_entries();
+        if (rc)
                goto out_notifiers;
        return rc;
@@ -8606,12 +8630,13 @@ out_notifiers:
 out_ipv6:
 #ifdef CONFIG_QETH_IPV6
        qeth_ipv6_uninit();
-#endif /* QETH_IPV6 */
 out_sysfs:
+#endif /* QETH_IPV6 */
        qeth_sysfs_unregister();
+out_dbf:
        qeth_unregister_dbf_views();
 out_err:
-        PRINT_ERR("Initialization failed");
+        PRINT_ERR("Initialization failed with code %d\n", rc);
        return rc;
 }
diff --git a/drivers/s390/net/qeth_proc.c b/drivers/s390/net/qeth_proc.c
index 66f2da14e6e3..faa768e59257 100644
--- a/drivers/s390/net/qeth_proc.c
+++ b/drivers/s390/net/qeth_proc.c
@@ -173,7 +173,6 @@ static struct file_operations qeth_procfile_fops = {
 #define QETH_PERF_PROCFILE_NAME "qeth_perf"
 static struct proc_dir_entry *qeth_perf_procfile;
-#ifdef CONFIG_QETH_PERF_STATS
 static int
 qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
 {
@@ -192,14 +191,21 @@ qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
                        CARD_DDEV_ID(card),
                        QETH_CARD_IFNAME(card)
                  );
+        if (!card->options.performance_stats)
+                seq_printf(s, "Performance statistics are deactivated.\n");
        seq_printf(s, "  Skb's/buffers received                 : %lu/%u\n"
                      "  Skb's/buffers sent                     : %lu/%u\n\n",
-                        card->stats.rx_packets, card->perf_stats.bufs_rec,
+                        card->stats.rx_packets -
-                        card->stats.tx_packets, card->perf_stats.bufs_sent
+                                card->perf_stats.initial_rx_packets,
+                        card->perf_stats.bufs_rec,
+                        card->stats.tx_packets -
+                                card->perf_stats.initial_tx_packets,
+                        card->perf_stats.bufs_sent
                  );
        seq_printf(s, "  Skb's/buffers sent without packing     : %lu/%u\n"
                      "  Skb's/buffers sent with packing        : %u/%u\n\n",
-                   card->stats.tx_packets - card->perf_stats.skbs_sent_pack,
+                   card->stats.tx_packets - card->perf_stats.initial_tx_packets
+                                          - card->perf_stats.skbs_sent_pack,
                   card->perf_stats.bufs_sent - card->perf_stats.bufs_sent_pack,
                   card->perf_stats.skbs_sent_pack,
                   card->perf_stats.bufs_sent_pack
@@ -275,11 +281,6 @@ static struct file_operations qeth_perf_procfile_fops = {
        .release = seq_release,
 };
-#define qeth_perf_procfile_created qeth_perf_procfile
-#else
-#define qeth_perf_procfile_created 1
-#endif /* CONFIG_QETH_PERF_STATS */
 int __init
 qeth_create_procfs_entries(void)
 {
@@ -288,15 +289,13 @@ qeth_create_procfs_entries(void)
        if (qeth_procfile)
                qeth_procfile->proc_fops = &qeth_procfile_fops;
-#ifdef CONFIG_QETH_PERF_STATS
        qeth_perf_procfile = create_proc_entry(QETH_PERF_PROCFILE_NAME,
                                           S_IFREG | 0444, NULL);
        if (qeth_perf_procfile)
                qeth_perf_procfile->proc_fops = &qeth_perf_procfile_fops;
-#endif /* CONFIG_QETH_PERF_STATS */
        if (qeth_procfile &&
-            qeth_perf_procfile_created)
+            qeth_perf_procfile)
                return 0;
        else
                return -ENOMEM;
diff --git a/drivers/s390/net/qeth_sys.c b/drivers/s390/net/qeth_sys.c
index 001497bbea16..5836737ac58f 100644
--- a/drivers/s390/net/qeth_sys.c
+++ b/drivers/s390/net/qeth_sys.c
@@ -743,6 +743,47 @@ static DEVICE_ATTR(layer2, 0644, qeth_dev_layer2_show,
                   qeth_dev_layer2_store);
 static ssize_t
+qeth_dev_performance_stats_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct qeth_card *card = dev->driver_data;
+        if (!card)
+                return -EINVAL;
+        return sprintf(buf, "%i\n", card->options.performance_stats ? 1:0);
+}
+static ssize_t
+qeth_dev_performance_stats_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct qeth_card *card = dev->driver_data;
+        char *tmp;
+        int i;
+        if (!card)
+                return -EINVAL;
+        i = simple_strtoul(buf, &tmp, 16);
+        if ((i == 0) || (i == 1)) {
+                if (i == card->options.performance_stats)
+                        return count;
+                card->options.performance_stats = i;
+                if (i == 0)
+                        memset(&card->perf_stats, 0,
+                                sizeof(struct qeth_perf_stats));
+                card->perf_stats.initial_rx_packets = card->stats.rx_packets;
+                card->perf_stats.initial_tx_packets = card->stats.tx_packets;
+        } else {
+                PRINT_WARN("performance_stats: write 0 or 1 to this file!\n");
+                return -EINVAL;
+        }
+        return count;
+}
+static DEVICE_ATTR(performance_stats, 0644, qeth_dev_performance_stats_show,
+                   qeth_dev_performance_stats_store);
+static ssize_t
 qeth_dev_large_send_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
        struct qeth_card *card = dev->driver_data;
@@ -928,6 +969,7 @@ static struct device_attribute * qeth_device_attrs[] = {
        &dev_attr_canonical_macaddr,
        &dev_attr_layer2,
        &dev_attr_large_send,
+        &dev_attr_performance_stats,
        NULL,
 };
@@ -1110,12 +1152,12 @@ qeth_parse_ipatoe(const char* buf, enum qeth_prot_versions proto,
 {
        const char *start, *end;
        char *tmp;
-        char buffer[49] = {0, };
+        char buffer[40] = {0, };
        start = buf;
        /* get address string */
        end = strchr(start, '/');
-        if (!end || (end-start >= 49)){
+        if (!end || (end - start >= 40)){
                PRINT_WARN("Invalid format for ipato_addx/delx. "
                           "Use <ip addr>/<mask bits>\n");
                return -EINVAL;
@@ -1127,7 +1169,12 @@ qeth_parse_ipatoe(const char* buf, enum qeth_prot_versions proto,
        }
        start = end + 1;
        *mask_bits = simple_strtoul(start, &tmp, 10);
+        if (!strlen(start) ||
+            (tmp == start) ||
+            (*mask_bits > ((proto == QETH_PROT_IPV4) ? 32 : 128))) {
+                PRINT_WARN("Invalid mask bits for ipato_addx/delx !\n");
+                return -EINVAL;
+        }
        return 0;
 }
@@ -1698,11 +1745,16 @@ qeth_create_device_attributes(struct device *dev)
                sysfs_remove_group(&dev->kobj, &qeth_device_attr_group);
                sysfs_remove_group(&dev->kobj, &qeth_device_ipato_group);
                sysfs_remove_group(&dev->kobj, &qeth_device_vipa_group);
+                return ret;
        }
-        if ((ret = sysfs_create_group(&dev->kobj, &qeth_device_blkt_group)))
+        if ((ret = sysfs_create_group(&dev->kobj, &qeth_device_blkt_group))){
+                sysfs_remove_group(&dev->kobj, &qeth_device_attr_group);
+                sysfs_remove_group(&dev->kobj, &qeth_device_ipato_group);
+                sysfs_remove_group(&dev->kobj, &qeth_device_vipa_group);
+                sysfs_remove_group(&dev->kobj, &qeth_device_rxip_group);
                return ret;
+        }
-        return ret;
+        return 0;
 }
 void
diff --git a/drivers/s390/net/qeth_tso.h b/drivers/s390/net/qeth_tso.h
index 593f298142c1..14504afb044e 100644
--- a/drivers/s390/net/qeth_tso.h
+++ b/drivers/s390/net/qeth_tso.h
@@ -24,7 +24,7 @@ static inline struct qeth_hdr_tso *
 qeth_tso_prepare_skb(struct qeth_card *card, struct sk_buff **skb)
 {
        QETH_DBF_TEXT(trace, 5, "tsoprsk");
-        return qeth_push_skb(card, skb, sizeof(struct qeth_hdr_tso));
+        return qeth_push_skb(card, *skb, sizeof(struct qeth_hdr_tso));
 }
 /**
diff --git a/drivers/sbus/char/openprom.c b/drivers/sbus/char/openprom.c
index 293bb2fdb1d5..2f698763ba5d 100644
--- a/drivers/sbus/char/openprom.c
+++ b/drivers/sbus/char/openprom.c
@@ -145,8 +145,9 @@ static int opromgetprop(void __user *argp, struct device_node *dp, struct openpr
        void *pval;
        int len;
-        pval = of_get_property(dp, op->oprom_array, &len);
+        if (!dp ||
-        if (!pval || len <= 0 || len > bufsize)
+            !(pval = of_get_property(dp, op->oprom_array, &len)) ||
+            len <= 0 || len > bufsize)
                return copyout(argp, op, sizeof(int));
        memcpy(op->oprom_array, pval, len);
@@ -161,6 +162,8 @@ static int opromnxtprop(void __user *argp, struct device_node *dp, struct openpr
        struct property *prop;
        int len;
+        if (!dp)
+                return copyout(argp, op, sizeof(int));
        if (op->oprom_array[0] == '\0') {
                prop = dp->properties;
                if (!prop)
@@ -266,9 +269,13 @@ static int oprompci2node(void __user *argp, struct device_node *dp, struct openp
 static int oprompath2node(void __user *argp, struct device_node *dp, struct openpromio *op, int bufsize, DATA *data)
 {
+        phandle ph = 0;
        dp = of_find_node_by_path(op->oprom_array);
+        if (dp)
+                ph = dp->node;
        data->current_node = dp;
-        *((int *)op->oprom_array) = dp->node;
+        *((int *)op->oprom_array) = ph;
        op->oprom_size = sizeof(int);
        return copyout(argp, op, bufsize + sizeof(int));
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index 392bffcf96e8..95738a19cde7 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -1621,7 +1621,7 @@ static struct s3c24xx_uart_info s3c2412_uart_inf = {
 static int s3c2412_serial_probe(struct platform_device *dev)
 {
        dbg("s3c2440_serial_probe: dev=%p\n", dev);
-        return s3c24xx_serial_probe(dev, &s3c2440_uart_inf);
+        return s3c24xx_serial_probe(dev, &s3c2412_uart_inf);
 }
 static struct platform_driver s3c2412_serial_drv = {
diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index d4870432ecfc..b1981d0e95ad 100644
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -539,7 +539,6 @@ unsigned long ext2_count_free (struct buffer_head * map, unsigned int numchars)
 #endif  /*  EXT2FS_DEBUG  */
-/* Superblock must be locked */
 unsigned long ext2_count_free_blocks (struct super_block * sb)
 {
        struct ext2_group_desc * desc;
diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index de85c61c58c5..695f69ccf908 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -637,7 +637,6 @@ fail:
        return ERR_PTR(err);
 }
-/* Superblock must be locked */
 unsigned long ext2_count_free_inodes (struct super_block * sb)
 {
        struct ext2_group_desc *desc;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 681dea8f9532..4286ff6330b6 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -251,6 +251,44 @@ static struct super_operations ext2_sops = {
 #endif
 };
+static struct dentry *ext2_get_dentry(struct super_block *sb, void *vobjp)
+{
+        __u32 *objp = vobjp;
+        unsigned long ino = objp[0];
+        __u32 generation = objp[1];
+        struct inode *inode;
+        struct dentry *result;
+        if (ino < EXT2_FIRST_INO(sb) && ino != EXT2_ROOT_INO)
+                return ERR_PTR(-ESTALE);
+        if (ino > le32_to_cpu(EXT2_SB(sb)->s_es->s_inodes_count))
+                return ERR_PTR(-ESTALE);
+        /* iget isn't really right if the inode is currently unallocated!!
+         * ext2_read_inode currently does appropriate checks, but
+         * it might be "neater" to call ext2_get_inode first and check
+         * if the inode is valid.....
+         */
+        inode = iget(sb, ino);
+        if (inode == NULL)
+                return ERR_PTR(-ENOMEM);
+        if (is_bad_inode(inode) ||
+            (generation && inode->i_generation != generation)) {
+                /* we didn't find the right inode.. */
+                iput(inode);
+                return ERR_PTR(-ESTALE);
+        }
+        /* now to find a dentry.
+         * If possible, get a well-connected one
+         */
+        result = d_alloc_anon(inode);
+        if (!result) {
+                iput(inode);
+                return ERR_PTR(-ENOMEM);
+        }
+        return result;
+}
 /* Yes, most of these are left as NULL!!
 * A NULL value implies the default, which works with ext2-like file
 * systems, but can be improved upon.
@@ -258,6 +296,7 @@ static struct super_operations ext2_sops = {
 */
 static struct export_operations ext2_export_ops = {
        .get_parent = ext2_get_parent,
+        .get_dentry = ext2_get_dentry,
 };
 static unsigned long get_sb_block(void **data)
@@ -1044,7 +1083,6 @@ static int ext2_statfs (struct dentry * dentry, struct kstatfs * buf)
        unsigned long overhead;
        int i;
-        lock_super(sb);
        if (test_opt (sb, MINIX_DF))
                overhead = 0;
        else {
@@ -1085,7 +1123,6 @@ static int ext2_statfs (struct dentry * dentry, struct kstatfs * buf)
        buf->f_files = le32_to_cpu(sbi->s_es->s_inodes_count);
        buf->f_ffree = ext2_count_free_inodes (sb);
        buf->f_namelen = EXT2_NAME_LEN;
-        unlock_super(sb);
        return 0;
 }
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 0f0b1eadb98d..84be02e93652 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -925,7 +925,7 @@ int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
        set_buffer_new(bh_result);
 got_it:
        map_bh(bh_result, inode->i_sb, le32_to_cpu(chain[depth-1].key));
-        if (blocks_to_boundary == 0)
+        if (count > blocks_to_boundary)
                set_buffer_boundary(bh_result);
        err = count;
        /* Clean up and exit */
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 813d589cc6c0..3559086eee5f 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -554,6 +554,47 @@ static int ext3_show_options(struct seq_file *seq, struct vfsmount *vfs)
        return 0;
 }
+static struct dentry *ext3_get_dentry(struct super_block *sb, void *vobjp)
+{
+        __u32 *objp = vobjp;
+        unsigned long ino = objp[0];
+        __u32 generation = objp[1];
+        struct inode *inode;
+        struct dentry *result;
+        if (ino < EXT3_FIRST_INO(sb) && ino != EXT3_ROOT_INO)
+                return ERR_PTR(-ESTALE);
+        if (ino > le32_to_cpu(EXT3_SB(sb)->s_es->s_inodes_count))
+                return ERR_PTR(-ESTALE);
+        /* iget isn't really right if the inode is currently unallocated!!
+         *
+         * ext3_read_inode will return a bad_inode if the inode had been
+         * deleted, so we should be safe.
+         *
+         * Currently we don't know the generation for parent directory, so
+         * a generation of 0 means "accept any"
+         */
+        inode = iget(sb, ino);
+        if (inode == NULL)
+                return ERR_PTR(-ENOMEM);
+        if (is_bad_inode(inode) ||
+            (generation && inode->i_generation != generation)) {
+                iput(inode);
+                return ERR_PTR(-ESTALE);
+        }
+        /* now to find a dentry.
+         * If possible, get a well-connected one
+         */
+        result = d_alloc_anon(inode);
+        if (!result) {
+                iput(inode);
+                return ERR_PTR(-ENOMEM);
+        }
+        return result;
+}
 #ifdef CONFIG_QUOTA
 #define QTYPE2NAME(t) ((t)==USRQUOTA?"user":"group")
 #define QTYPE2MOPT(on, t) ((t)==USRQUOTA?((on)##USRJQUOTA):((on)##GRPJQUOTA))
@@ -622,6 +663,7 @@ static struct super_operations ext3_sops = {
 static struct export_operations ext3_export_ops = {
        .get_parent = ext3_get_parent,
+        .get_dentry = ext3_get_dentry,
 };
 enum {
diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index 7675b33396c7..5a6b4d64206c 100644
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -21,6 +21,9 @@
 #include <linux/pagemap.h>
 #include "nodelist.h"
+static void jffs2_obsolete_node_frag(struct jffs2_sb_info *c,
+                                     struct jffs2_node_frag *this);
 void jffs2_add_fd_to_list(struct jffs2_sb_info *c, struct jffs2_full_dirent *new, struct jffs2_full_dirent **list)
 {
        struct jffs2_full_dirent **prev = list;
@@ -87,7 +90,8 @@ void jffs2_truncate_fragtree(struct jffs2_sb_info *c, struct rb_root *list, uint
        }
 }
-void jffs2_obsolete_node_frag(struct jffs2_sb_info *c, struct jffs2_node_frag *this)
+static void jffs2_obsolete_node_frag(struct jffs2_sb_info *c,
+                                     struct jffs2_node_frag *this)
 {
        if (this->node) {
                this->node->frags--;
diff --git a/fs/jffs2/nodelist.h b/fs/jffs2/nodelist.h
index cae92c14116d..0ddfd70307fb 100644
--- a/fs/jffs2/nodelist.h
+++ b/fs/jffs2/nodelist.h
@@ -334,7 +334,6 @@ void jffs2_kill_fragtree(struct rb_root *root, struct jffs2_sb_info *c_delete);
 struct rb_node *rb_next(struct rb_node *);
 struct rb_node *rb_prev(struct rb_node *);
 void rb_replace_node(struct rb_node *victim, struct rb_node *new, struct rb_root *root);
-void jffs2_obsolete_node_frag(struct jffs2_sb_info *c, struct jffs2_node_frag *this);
 int jffs2_add_full_dnode_to_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_full_dnode *fn);
 void jffs2_truncate_fragtree (struct jffs2_sb_info *c, struct rb_root *list, uint32_t size);
 int jffs2_add_older_frag_to_fragtree(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_tmp_dnode_info *tn);
diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
index c19bd476e8ec..e52cef526d90 100644
--- a/fs/jffs2/summary.c
+++ b/fs/jffs2/summary.c
@@ -252,6 +252,11 @@ int jffs2_sum_add_kvec(struct jffs2_sb_info *c, const struct kvec *invecs,
        union jffs2_node_union *node;
        struct jffs2_eraseblock *jeb;
+        if (c->summary->sum_size == JFFS2_SUMMARY_NOSUM_SIZE) {
+                dbg_summary("Summary is disabled for this jeb! Skipping summary info!\n");
+                return 0;
+        }
        node = invecs[0].iov_base;
        jeb = &c->blocks[ofs / c->sector_size];
        ofs -= jeb->offset;
diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
index 25bc1ae08648..4da09ce1d1f5 100644
--- a/fs/jffs2/xattr.c
+++ b/fs/jffs2/xattr.c
@@ -1215,7 +1215,6 @@ int jffs2_garbage_collect_xattr_datum(struct jffs2_sb_info *c, struct jffs2_xatt
        rc = jffs2_reserve_space_gc(c, totlen, &length, JFFS2_SUMMARY_XATTR_SIZE);
        if (rc) {
                JFFS2_WARNING("jffs2_reserve_space_gc()=%d, request=%u\n", rc, totlen);
-                rc = rc ? rc : -EBADFD;
                goto out;
        }
        rc = save_xattr_datum(c, xd);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 153898e1331f..b14145b7b87f 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -970,7 +970,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st
        status = -ENOMEM;
        opendata = nfs4_opendata_alloc(dentry, sp, flags, sattr);
        if (opendata == NULL)
-                goto err_put_state_owner;
+                goto err_release_rwsem;
        status = _nfs4_proc_open(opendata);
        if (status != 0)
@@ -989,11 +989,11 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st
        return 0;
 err_opendata_free:
        nfs4_opendata_free(opendata);
+err_release_rwsem:
+        up_read(&clp->cl_sem);
 err_put_state_owner:
        nfs4_put_state_owner(sp);
 out_err:
-        /* Note: clp->cl_sem must be released before nfs4_put_open_state()! */
-        up_read(&clp->cl_sem);
        *res = NULL;
        return status;
 }
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 7a9ee00e0c61..f0aff824a291 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -204,9 +204,11 @@ static int nfs_readpage_sync(struct nfs_open_context *ctx, struct inode *inode,
        NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ATIME;
        spin_unlock(&inode->i_lock);
-        nfs_readpage_truncate_uninitialised_page(rdata);
+        if (rdata->res.eof || rdata->res.count == rdata->args.count) {
-        if (rdata->res.eof || rdata->res.count == rdata->args.count)
                SetPageUptodate(page);
+                if (rdata->res.eof && count != 0)
+                        memclear_highpage_flush(page, rdata->args.pgbase, count);
+        }
        result = 0;
 io_error:
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 8ab3cf10d792..7084ac9a6455 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -590,8 +590,8 @@ static void nfs_cancel_commit_list(struct list_head *head)
                req = nfs_list_entry(head->next);
                nfs_list_remove_request(req);
                nfs_inode_remove_request(req);
-                nfs_clear_page_writeback(req);
                dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
+                nfs_clear_page_writeback(req);
        }
 }
@@ -1386,8 +1386,8 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how)
                req = nfs_list_entry(head->next);
                nfs_list_remove_request(req);
                nfs_mark_request_commit(req);
-                nfs_clear_page_writeback(req);
                dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
+                nfs_clear_page_writeback(req);
        }
        return -ENOMEM;
 }
diff --git a/include/asm-alpha/Kbuild b/include/asm-alpha/Kbuild
index e57fd57538b8..2b06b3bad5ff 100644
--- a/include/asm-alpha/Kbuild
+++ b/include/asm-alpha/Kbuild
@@ -1,5 +1,5 @@
 include include/asm-generic/Kbuild.asm
-unifdef-y += console.h fpu.h sysinfo.h
+unifdef-y += console.h fpu.h sysinfo.h compiler.h
 header-y += gentrap.h regdef.h pal.h reg.h
diff --git a/include/asm-alpha/compiler.h b/include/asm-alpha/compiler.h
index 00c6f57ad9a7..d2768cc3d7a4 100644
--- a/include/asm-alpha/compiler.h
+++ b/include/asm-alpha/compiler.h
@@ -90,6 +90,7 @@
  __asm__("stw %1,%0" : "=m"(mem) : "r"(val))
 #endif
+#ifdef __KERNEL__
 /* Some idiots over in <linux/compiler.h> thought inline should imply
   always_inline.  This breaks stuff.  We'll include this file whenever
   we run into such problems.  */
@@ -101,4 +102,6 @@
 #undef __always_inline
 #define __always_inline         inline __attribute__((always_inline))
+#endif /* __KERNEL__ */
 #endif /* __ALPHA_COMPILER_H */
diff --git a/include/asm-alpha/page.h b/include/asm-alpha/page.h
index 8c7cd50d4eae..d2bed3cb33ff 100644
--- a/include/asm-alpha/page.h
+++ b/include/asm-alpha/page.h
@@ -1,6 +1,8 @@
 #ifndef _ALPHA_PAGE_H
 #define _ALPHA_PAGE_H
+#ifdef __KERNEL__
 #include <asm/pal.h>
 /* PAGE_SHIFT determines the page size */
@@ -8,8 +10,6 @@
 #define PAGE_SIZE       (1UL << PAGE_SHIFT)
 #define PAGE_MASK       (~(PAGE_SIZE-1))
-#ifdef __KERNEL__
 #ifndef __ASSEMBLY__
 #define STRICT_MM_TYPECHECKS
@@ -92,9 +92,9 @@ typedef unsigned long pgprot_t;
 #define VM_DATA_DEFAULT_FLAGS           (VM_READ | VM_WRITE | VM_EXEC | \
                                         VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-#endif /* __KERNEL__ */
 #include <asm-generic/memory_model.h>
 #include <asm-generic/page.h>
+#endif /* __KERNEL__ */
 #endif /* _ALPHA_PAGE_H */
diff --git a/include/asm-arm/arch-s3c2410/regs-power.h b/include/asm-arm/arch-s3c2410/regs-power.h
new file mode 100644
index 000000000000..6c319ea2afac
--- /dev/null
+++ b/include/asm-arm/arch-s3c2410/regs-power.h
@@ -0,0 +1,34 @@
+/* linux/include/asm/arch-s3c2410/regs-power.h
+ *
+ * Copyright (c) 2003,2004,2005,2006 Simtec Electronics <linux@simtec.co.uk>
+ *                    http://armlinux.simtec.co.uk/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * S3C24XX power control register definitions
+*/
+#ifndef __ASM_ARM_REGS_PWR
+#define __ASM_ARM_REGS_PWR __FILE__
+#define S3C24XX_PWRREG(x) ((x) + S3C24XX_VA_CLKPWR)
+#define S3C2412_PWRMODECON      S3C24XX_PWRREG(0x20)
+#define S3C2412_PWRCFG          S3C24XX_PWRREG(0x24)
+#define S3C2412_PWRCFG_BATF_IGNORE              (0<<0)
+#define S3C2412_PWRCFG_BATF_SLEEP               (3<<0)
+#define S3C2412_PWRCFG_BATF_MASK                (3<<0)
+#define S3C2412_PWRCFG_STANDBYWFI_IGNORE        (0<<6)
+#define S3C2412_PWRCFG_STANDBYWFI_IDLE          (1<<6)
+#define S3C2412_PWRCFG_STANDBYWFI_STOP          (2<<6)
+#define S3C2412_PWRCFG_STANDBYWFI_SLEEP         (3<<6)
+#define S3C2412_PWRCFG_STANDBYWFI_MASK          (3<<6)
+#define S3C2412_PWRCFG_RTC_MASKIRQ              (1<<8)
+#define S3C2412_PWRCFG_NAND_NORST               (1<<9)
+#endif /* __ASM_ARM_REGS_PWR */
diff --git a/include/asm-arm/elf.h b/include/asm-arm/elf.h
index 71061ca5c5d0..ae7baa6c73f7 100644
--- a/include/asm-arm/elf.h
+++ b/include/asm-arm/elf.h
@@ -8,7 +8,9 @@
 #include <asm/ptrace.h>
 #include <asm/user.h>
+#ifdef __KERNEL
 #include <asm/procinfo.h>
+#endif
 typedef unsigned long elf_greg_t;
 typedef unsigned long elf_freg_t[3];
diff --git a/include/asm-arm/page.h b/include/asm-arm/page.h
index 63d12f0244c5..b721270b9986 100644
--- a/include/asm-arm/page.h
+++ b/include/asm-arm/page.h
@@ -193,8 +193,8 @@ extern pmd_t *top_pmd;
 #define ARCH_SLAB_MINALIGN 8
 #endif
-#endif /* __KERNEL__ */
 #include <asm-generic/page.h>
+#endif /* __KERNEL__ */
 #endif
diff --git a/include/asm-i386/system.h b/include/asm-i386/system.h
index 49928eb33f8b..098bcee94e38 100644
--- a/include/asm-i386/system.h
+++ b/include/asm-i386/system.h
@@ -11,9 +11,14 @@
 struct task_struct;     /* one of the stranger aspects of C forward declarations.. */
 extern struct task_struct * FASTCALL(__switch_to(struct task_struct *prev, struct task_struct *next));
+/*
+ * Saving eflags is important. It switches not only IOPL between tasks,
+ * it also protects other tasks from NT leaking through sysenter etc.
+ */
 #define switch_to(prev,next,last) do {                                  \
        unsigned long esi,edi;                                          \
-        asm volatile("pushl %%ebp\n\t"                                  \
+        asm volatile("pushfl\n\t"               /* Save flags */        \
+                     "pushl %%ebp\n\t"                                  \
                     "movl %%esp,%0\n\t"        /* save ESP */          \
                     "movl %5,%%esp\n\t"        /* restore ESP */       \
                     "movl $1f,%1\n\t"          /* save EIP */          \
@@ -21,6 +26,7 @@ extern struct task_struct * FASTCALL(__switch_to(struct task_struct *prev, struc
                     "jmp __switch_to\n"                                \
                     "1:\t"                                             \
                     "popl %%ebp\n\t"                                   \
+                     "popfl"                                            \
                     :"=m" (prev->thread.esp),"=m" (prev->thread.eip),  \
                      "=a" (last),"=S" (esi),"=D" (edi)                 \
                     :"m" (next->thread.esp),"m" (next->thread.eip),    \
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index d983b74e4d9f..fc1c8ddae149 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -324,6 +324,8 @@
 #define __NR_vmsplice           316
 #define __NR_move_pages         317
+#ifdef __KERNEL__
 #define NR_syscalls 318
 /*
@@ -423,8 +425,6 @@ __asm__ volatile ("push %%ebp ; push %%ebx ; movl 4(%2),%%ebp ; " \
 __syscall_return(type,__res); \
 }
-#ifdef __KERNEL__
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/include/asm-ia64/Kbuild b/include/asm-ia64/Kbuild
index 85d6f8005eb4..f1cb00f39c22 100644
--- a/include/asm-ia64/Kbuild
+++ b/include/asm-ia64/Kbuild
@@ -4,4 +4,4 @@ header-y += break.h fpu.h fpswa.h gcc_intrin.h ia64regs.h		\
         intel_intrin.h intrinsics.h perfmon_default_smpl.h     \
         ptrace_offsets.h rse.h setup.h ucontext.h
-unifdef-y += perfmon.h
+unifdef-y += perfmon.h ustack.h
diff --git a/include/asm-ia64/page.h b/include/asm-ia64/page.h
index f5a949ec6e1e..947cb72b520e 100644
--- a/include/asm-ia64/page.h
+++ b/include/asm-ia64/page.h
@@ -7,6 +7,7 @@
 *      David Mosberger-Tang <davidm@hpl.hp.com>
 */
+# ifdef __KERNEL__
 #include <asm/intrinsics.h>
 #include <asm/types.h>
@@ -64,7 +65,6 @@
 # define __pa(x)                ((x) - PAGE_OFFSET)
 # define __va(x)                ((x) + PAGE_OFFSET)
 #else /* !__ASSEMBLY */
-# ifdef __KERNEL__
 #  define STRICT_MM_TYPECHECKS
 extern void clear_page (void *page);
@@ -174,7 +174,6 @@ get_order (unsigned long size)
        return order;
 }
-# endif /* __KERNEL__ */
 #endif /* !__ASSEMBLY__ */
 #ifdef STRICT_MM_TYPECHECKS
@@ -228,4 +227,5 @@ get_order (unsigned long size)
                                         (((current->personality & READ_IMPLIES_EXEC) != 0)     \
                                          ? VM_EXEC : 0))
+# endif /* __KERNEL__ */
 #endif /* _ASM_IA64_PAGE_H */
diff --git a/include/asm-ia64/ptrace.h b/include/asm-ia64/ptrace.h
index 415abb23b210..1414316efd40 100644
--- a/include/asm-ia64/ptrace.h
+++ b/include/asm-ia64/ptrace.h
@@ -56,6 +56,8 @@
 #include <asm/fpu.h>
+#ifdef __KERNEL__
 #ifndef ASM_OFFSETS_C
 #include <asm/asm-offsets.h>
 #endif
@@ -79,10 +81,9 @@
 #define KERNEL_STACK_SIZE               IA64_STK_OFFSET
-#ifndef __ASSEMBLY__
+#endif /* __KERNEL__ */
-#include <asm/current.h>
+#ifndef __ASSEMBLY__
-#include <asm/page.h>
 /*
 * This struct defines the way the registers are saved on system
@@ -229,6 +230,9 @@ struct switch_stack {
 #ifdef __KERNEL__
+#include <asm/current.h>
+#include <asm/page.h>
 #define __ARCH_SYS_PTRACE       1
 /*
diff --git a/include/asm-ia64/ustack.h b/include/asm-ia64/ustack.h
index da55c91246e3..a349467913ea 100644
--- a/include/asm-ia64/ustack.h
+++ b/include/asm-ia64/ustack.h
@@ -5,12 +5,15 @@
 * Constants for the user stack size
 */
+#ifdef __KERNEL__
 #include <asm/page.h>
 /* The absolute hard limit for stack size is 1/2 of the mappable space in the region */
 #define MAX_USER_STACK_SIZE     (RGN_MAP_LIMIT/2)
-/* Make a default stack size of 2GB */
-#define DEFAULT_USER_STACK_SIZE (1UL << 31)
 #define STACK_TOP               (0x6000000000000000UL + RGN_MAP_LIMIT)
+#endif
+/* Make a default stack size of 2GiB */
+#define DEFAULT_USER_STACK_SIZE (1UL << 31)
 #endif /* _ASM_IA64_USTACK_H */
diff --git a/include/asm-m68k/page.h b/include/asm-m68k/page.h
index db017f838c29..fcc165ddd09e 100644
--- a/include/asm-m68k/page.h
+++ b/include/asm-m68k/page.h
@@ -2,6 +2,8 @@
 #define _M68K_PAGE_H
+#ifdef __KERNEL__
 /* PAGE_SHIFT determines the page size */
 #ifndef CONFIG_SUN3
 #define PAGE_SHIFT      (12)
@@ -15,8 +17,6 @@
 #endif
 #define PAGE_MASK       (~(PAGE_SIZE-1))
-#ifdef __KERNEL__
 #include <asm/setup.h>
 #if PAGE_SHIFT < 13
@@ -175,8 +175,8 @@ static inline void *__va(unsigned long x)
 #define VM_DATA_DEFAULT_FLAGS   (VM_READ | VM_WRITE | VM_EXEC | \
                                 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-#endif /* __KERNEL__ */
 #include <asm-generic/page.h>
+#endif /* __KERNEL__ */
 #endif /* _M68K_PAGE_H */
diff --git a/include/asm-parisc/page.h b/include/asm-parisc/page.h
index 0695bc958d56..57d6d82756dd 100644
--- a/include/asm-parisc/page.h
+++ b/include/asm-parisc/page.h
@@ -1,22 +1,14 @@
 #ifndef _PARISC_PAGE_H
 #define _PARISC_PAGE_H
-#if !defined(__KERNEL__)
-/* this is for userspace applications (4k page size) */
-# define PAGE_SHIFT     12      /* 4k */
-# define PAGE_SIZE      (1UL << PAGE_SHIFT)
-# define PAGE_MASK      (~(PAGE_SIZE-1))
-#endif
 #ifdef __KERNEL__
 #if defined(CONFIG_PARISC_PAGE_SIZE_4KB)
-# define PAGE_SHIFT     12      /* 4k */
+# define PAGE_SHIFT     12
 #elif defined(CONFIG_PARISC_PAGE_SIZE_16KB)
-# define PAGE_SHIFT     14      /* 16k */
+# define PAGE_SHIFT     14
 #elif defined(CONFIG_PARISC_PAGE_SIZE_64KB)
-# define PAGE_SHIFT     16      /* 64k */
+# define PAGE_SHIFT     16
 #else
 # error "unknown default kernel page size"
 #endif
@@ -188,9 +180,9 @@ extern int npmem_ranges;
 #define VM_DATA_DEFAULT_FLAGS   (VM_READ | VM_WRITE | VM_EXEC | \
                                 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-#endif /* __KERNEL__ */
 #include <asm-generic/memory_model.h>
 #include <asm-generic/page.h>
+#endif /* __KERNEL__ */
 #endif /* _PARISC_PAGE_H */
diff --git a/include/asm-s390/debug.h b/include/asm-s390/debug.h
index 7f1ef99fd1e1..c00dd2b3dc50 100644
--- a/include/asm-s390/debug.h
+++ b/include/asm-s390/debug.h
@@ -10,7 +10,6 @@
 #define DEBUG_H
 #include <linux/fs.h>
-#include <linux/string.h>
 /* Note:
 * struct __debug_entry must be defined outside of #ifdef __KERNEL__ 
@@ -35,6 +34,7 @@ struct __debug_entry{
 #define __DEBUG_FEATURE_VERSION      2  /* version of debug feature */
 #ifdef __KERNEL__
+#include <linux/string.h>
 #include <linux/spinlock.h>
 #include <linux/kernel.h>
 #include <linux/time.h>
diff --git a/include/asm-s390/elf.h b/include/asm-s390/elf.h
index 710646e64f7d..c0d629d61d3e 100644
--- a/include/asm-s390/elf.h
+++ b/include/asm-s390/elf.h
@@ -93,19 +93,6 @@
 #define R_390_NUM       61
 /*
- * ELF register definitions..
- */
-#include <linux/sched.h>        /* for task_struct */
-#include <asm/ptrace.h>
-#include <asm/user.h>
-#include <asm/system.h>         /* for save_access_regs */
-typedef s390_fp_regs elf_fpregset_t;
-typedef s390_regs elf_gregset_t;
-/*
 * These are used to set parameters in the core dumps.
 */
 #ifndef __s390x__
@@ -117,6 +104,20 @@ typedef s390_regs elf_gregset_t;
 #define ELF_ARCH        EM_S390
 /*
+ * ELF register definitions..
+ */
+#include <asm/ptrace.h>
+#include <asm/user.h>
+typedef s390_fp_regs elf_fpregset_t;
+typedef s390_regs elf_gregset_t;
+#ifdef __KERNEL__
+#include <linux/sched.h>        /* for task_struct */
+#include <asm/system.h>         /* for save_access_regs */
+/*
 * This is used to ensure we don't load something for the wrong architecture.
 */
 #define elf_check_arch(x) \
@@ -198,7 +199,6 @@ static inline int dump_task_fpu(struct task_struct *tsk, elf_fpregset_t *fpregs)
 #define ELF_PLATFORM (NULL)
-#ifdef __KERNEL__
 #ifndef __s390x__
 #define SET_PERSONALITY(ex, ibcs2) set_personality((ibcs2)?PER_SVR4:PER_LINUX)
 #else /* __s390x__ */
diff --git a/include/asm-x86_64/elf.h b/include/asm-x86_64/elf.h
index b4f8f4a41a6e..a406fcb1e924 100644
--- a/include/asm-x86_64/elf.h
+++ b/include/asm-x86_64/elf.h
@@ -7,8 +7,6 @@
 #include <asm/ptrace.h>
 #include <asm/user.h>
-#include <asm/processor.h>
-#include <asm/compat.h>
 /* x86-64 relocation types */
 #define R_X86_64_NONE           0       /* No reloc */
@@ -39,18 +37,23 @@ typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 typedef struct user_i387_struct elf_fpregset_t;
 /*
- * This is used to ensure we don't load something for the wrong architecture.
- */
-#define elf_check_arch(x) \
-        ((x)->e_machine == EM_X86_64)
-/*
 * These are used to set parameters in the core dumps.
 */
 #define ELF_CLASS       ELFCLASS64
 #define ELF_DATA        ELFDATA2LSB
 #define ELF_ARCH        EM_X86_64
+#ifdef __KERNEL__
+#include <asm/processor.h>
+#include <asm/compat.h>
+/*
+ * This is used to ensure we don't load something for the wrong architecture.
+ */
+#define elf_check_arch(x) \
+        ((x)->e_machine == EM_X86_64)
 /* SVR4/i386 ABI (pages 3-31, 3-32) says that when the program starts %edx
   contains a pointer to a function which might be registered using `atexit'.
   This provides a mean for the dynamic linker to call DT_FINI functions for
@@ -141,7 +144,6 @@ typedef struct user_i387_struct elf_fpregset_t;
 /* I'm not sure if we can use '-' here */
 #define ELF_PLATFORM  ("x86_64")
-#ifdef __KERNEL__
 extern void set_personality_64bit(void);
 #define SET_PERSONALITY(ex, ibcs2) set_personality_64bit()
 /*
diff --git a/include/asm-x86_64/signal.h b/include/asm-x86_64/signal.h
index cef7a7d51b7e..3ede2a61973a 100644
--- a/include/asm-x86_64/signal.h
+++ b/include/asm-x86_64/signal.h
@@ -3,13 +3,13 @@
 #ifndef __ASSEMBLY__
 #include <linux/types.h>
-#include <linux/linkage.h>
 #include <linux/time.h>
 /* Avoid too many header ordering problems.  */
 struct siginfo;
 #ifdef __KERNEL__
+#include <linux/linkage.h>
 /* Most things should be clean enough to redefine this at will, if care
   is taken to make libc match.  */
diff --git a/include/asm-x86_64/unistd.h b/include/asm-x86_64/unistd.h
index 2d89d309a2a8..80fd48e84bbb 100644
--- a/include/asm-x86_64/unistd.h
+++ b/include/asm-x86_64/unistd.h
@@ -620,6 +620,8 @@ __SYSCALL(__NR_vmsplice, sys_vmsplice)
 #define __NR_move_pages         279
 __SYSCALL(__NR_move_pages, sys_move_pages)
+#ifdef __KERNEL__
 #define __NR_syscall_max __NR_move_pages
 #ifndef __NO_STUBS
@@ -744,8 +746,6 @@ __syscall_return(type,__res); \
 #else /* __KERNEL_SYSCALLS__ */
-#ifdef __KERNEL__
 #include <linux/syscalls.h>
 #include <asm/ptrace.h>
@@ -821,8 +821,6 @@ asmlinkage long sys_fork(struct pt_regs regs);
 asmlinkage long sys_vfork(struct pt_regs regs);
 asmlinkage long sys_pipe(int *fildes);
-#endif /* __KERNEL_SYSCALLS__ */
 #ifndef __ASSEMBLY__
 #include <linux/linkage.h>
@@ -838,9 +836,9 @@ asmlinkage long sys_rt_sigaction(int sig,
                                struct sigaction __user *oact,
                                size_t sigsetsize);
-#endif
+#endif  /* __ASSEMBLY__ */
-#endif
+#endif /* __KERNEL_SYSCALLS__ */
 /*
 * "Conditional" syscalls
@@ -850,6 +848,8 @@ asmlinkage long sys_rt_sigaction(int sig,
 */
 #define cond_syscall(x) asm(".weak\t" #x "\n\t.set\t" #x ",sys_ni_syscall")
-#endif
+#endif /* __NO_STUBS */
-#endif
+#endif /* __KERNEL__ */
+#endif /* _ASM_X86_64_UNISTD_H_ */
diff --git a/include/asm-x86_64/vsyscall.h b/include/asm-x86_64/vsyscall.h
index a85e16f56d73..146b24402a5f 100644
--- a/include/asm-x86_64/vsyscall.h
+++ b/include/asm-x86_64/vsyscall.h
@@ -1,8 +1,6 @@
 #ifndef _ASM_X86_64_VSYSCALL_H_
 #define _ASM_X86_64_VSYSCALL_H_
-#include <linux/seqlock.h>
 enum vsyscall_num {
        __NR_vgettimeofday,
        __NR_vtime,
@@ -14,6 +12,7 @@ enum vsyscall_num {
 #define VSYSCALL_ADDR(vsyscall_nr) (VSYSCALL_START+VSYSCALL_SIZE*(vsyscall_nr))
 #ifdef __KERNEL__
+#include <linux/seqlock.h>
 #define __section_vxtime __attribute__ ((unused, __section__ (".vxtime"), aligned(16)))
 #define __section_wall_jiffies __attribute__ ((unused, __section__ (".wall_jiffies"), aligned(16)))
diff --git a/include/linux/mtd/cfi.h b/include/linux/mtd/cfi.h
index 09bfae6938b3..123948b14547 100644
--- a/include/linux/mtd/cfi.h
+++ b/include/linux/mtd/cfi.h
@@ -199,6 +199,18 @@ struct cfi_pri_amdstd {
        uint8_t  TopBottom;
 } __attribute__((packed));
+/* Vendor-Specific PRI for Atmel chips (command set 0x0002) */
+struct cfi_pri_atmel {
+        uint8_t pri[3];
+        uint8_t MajorVersion;
+        uint8_t MinorVersion;
+        uint8_t Features;
+        uint8_t BottomBoot;
+        uint8_t BurstMode;
+        uint8_t PageMode;
+} __attribute__((packed));
 struct cfi_pri_query {
        uint8_t  NumFields;
        uint32_t ProtField[1]; /* Not host ordered */
@@ -464,6 +476,7 @@ struct cfi_fixup {
 #define CFI_ID_ANY  0xffff
 #define CFI_MFR_AMD 0x0001
+#define CFI_MFR_ATMEL 0x001F
 #define CFI_MFR_ST  0x0020      /* STMicroelectronics */
 void cfi_fixup(struct mtd_info *mtd, struct cfi_fixup* fixups);
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index d06311acd448..1d3a14e2da6e 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -5,7 +5,7 @@ header-y := nf_conntrack_sctp.h nf_conntrack_tuple_common.h		\
            xt_helper.h xt_length.h xt_limit.h xt_mac.h xt_mark.h       \
            xt_MARK.h xt_multiport.h xt_NFQUEUE.h xt_pkttype.h          \
            xt_policy.h xt_realm.h xt_sctp.h xt_state.h xt_string.h     \
-            xt_tcpmss.h xt_tcpudp.h
+            xt_tcpmss.h xt_tcpudp.h xt_SECMARK.h xt_CONNSECMARK.h
 unifdef-y := nf_conntrack_common.h nf_conntrack_ftp.h           \
        nf_conntrack_tcp.h nfnetlink.h x_tables.h xt_physdev.h
diff --git a/init/Kconfig b/init/Kconfig
index a099fc6526d9..9a7656f0b5ec 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -182,23 +182,6 @@ config TASK_DELAY_ACCT
          Say N if unsure.
-config SYSCTL
-        bool "Sysctl support" if EMBEDDED
-        default y
-        ---help---
-          The sysctl interface provides a means of dynamically changing
-          certain kernel parameters and variables on the fly without requiring
-          a recompile of the kernel or reboot of the system.  The primary
-          interface consists of a system call, but if you say Y to "/proc
-          file system support", a tree of modifiable sysctl entries will be
-          generated beneath the /proc/sys directory. They are explained in the
-          files in <file:Documentation/sysctl/>.  Note that enabling this
-          option will enlarge the kernel by at least 8 KB.
-          As it is generally a good thing, you should say Y here unless
-          building a kernel for install/rescue disks or your system is very
-          limited in memory.
 config AUDIT
        bool "Auditing support"
        depends on NET
@@ -261,13 +244,6 @@ config RELAY
 source "usr/Kconfig"
-config UID16
-        bool "Enable 16-bit UID system calls" if EMBEDDED
-        depends on ARM || CRIS || FRV || H8300 || X86_32 || M68K || (S390 && !64BIT) || SUPERH || SPARC32 || (SPARC64 && SPARC32_COMPAT) || UML || (X86_64 && IA32_EMULATION)
-        default y
-        help
-          This enables the legacy 16-bit UID syscall wrappers.
 config CC_OPTIMIZE_FOR_SIZE
        bool "Optimize for size (Look out for broken compilers!)"
        default y
@@ -289,6 +265,30 @@ menuconfig EMBEDDED
          environments which can tolerate a "non-standard" kernel.
          Only use this if you really know what you are doing.
+config UID16
+        bool "Enable 16-bit UID system calls" if EMBEDDED
+        depends on ARM || CRIS || FRV || H8300 || X86_32 || M68K || (S390 && !64BIT) || SUPERH || SPARC32 || (SPARC64 && SPARC32_COMPAT) || UML || (X86_64 && IA32_EMULATION)
+        default y
+        help
+          This enables the legacy 16-bit UID syscall wrappers.
+config SYSCTL
+        bool "Sysctl support" if EMBEDDED
+        default y
+        ---help---
+          The sysctl interface provides a means of dynamically changing
+          certain kernel parameters and variables on the fly without requiring
+          a recompile of the kernel or reboot of the system.  The primary
+          interface consists of a system call, but if you say Y to "/proc
+          file system support", a tree of modifiable sysctl entries will be
+          generated beneath the /proc/sys directory. They are explained in the
+          files in <file:Documentation/sysctl/>.  Note that enabling this
+          option will enlarge the kernel by at least 8 KB.
+          As it is generally a good thing, you should say Y here unless
+          building a kernel for install/rescue disks or your system is very
+          limited in memory.
 config KALLSYMS
         bool "Load all symbols for debugging/kksymoops" if EMBEDDED
         default y
@@ -363,10 +363,6 @@ config BASE_FULL
          kernel data structures. This saves memory on small machines,
          but may reduce performance.
-config RT_MUTEXES
-        boolean
-        select PLIST
 config FUTEX
        bool "Enable futex support" if EMBEDDED
        default y
@@ -414,6 +410,10 @@ config VM_EVENT_COUNTERS
 endmenu         # General setup
+config RT_MUTEXES
+        boolean
+        select PLIST
 config TINY_SHMEM
        default !SHMEM
        bool
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 9336f2e89e40..ac1f850d4937 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -252,7 +252,7 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc, struct pt_regs *regs)
        mask_ack_irq(desc, irq);
        if (unlikely(desc->status & IRQ_INPROGRESS))
-                goto out;
+                goto out_unlock;
        desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
        kstat_cpu(cpu).irqs[irq]++;
@@ -263,7 +263,7 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc, struct pt_regs *regs)
        action = desc->action;
        if (unlikely(!action || (desc->status & IRQ_DISABLED))) {
                desc->status |= IRQ_PENDING;
-                goto out;
+                goto out_unlock;
        }
        desc->status |= IRQ_INPROGRESS;
@@ -276,9 +276,9 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc, struct pt_regs *regs)
        spin_lock(&desc->lock);
        desc->status &= ~IRQ_INPROGRESS;
-out:
        if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
                desc->chip->unmask(irq);
+out_unlock:
        spin_unlock(&desc->lock);
 }
diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
index 872f91ba2ce8..35f10f7ff94a 100644
--- a/kernel/irq/resend.c
+++ b/kernel/irq/resend.c
@@ -63,8 +63,7 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
        desc->chip->enable(irq);
        if ((status & (IRQ_PENDING | IRQ_REPLAY)) == IRQ_PENDING) {
-                desc->status &= ~IRQ_PENDING;
+                desc->status = (status & ~IRQ_PENDING) | IRQ_REPLAY;
-                desc->status = status | IRQ_REPLAY;
                if (!desc->chip || !desc->chip->retrigger ||
                                        !desc->chip->retrigger(irq)) {
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 1d32defa38ab..5c470c57fb57 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -197,11 +197,12 @@ static void __call_usermodehelper(void *data)
 {
        struct subprocess_info *sub_info = data;
        pid_t pid;
+        int wait = sub_info->wait;
        /* CLONE_VFORK: wait until the usermode helper has execve'd
         * successfully We need the data structures to stay around
         * until that is done.  */
-        if (sub_info->wait)
+        if (wait)
                pid = kernel_thread(wait_for_helper, sub_info,
                                    CLONE_FS | CLONE_FILES | SIGCHLD);
        else
@@ -211,7 +212,7 @@ static void __call_usermodehelper(void *data)
        if (pid < 0) {
                sub_info->retval = pid;
                complete(sub_info->complete);
-        } else if (!sub_info->wait)
+        } else if (!wait)
                complete(sub_info->complete);
 }
diff --git a/net/Kconfig b/net/Kconfig
index c6cec5aa5486..4959a4e1e0fe 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -177,7 +177,7 @@ source "net/lapb/Kconfig"
 config NET_DIVERT
        bool "Frame Diverter (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        depends on EXPERIMENTAL && BROKEN
        ---help---
          The Frame Diverter allows you to divert packets from the
          network, that are not aimed at the interface receiving it (in
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 7ce7bfe3fbad..7af2c411da82 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -500,9 +500,11 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
                } else {
                        unsigned int len = skb->len;
+                        skb_get(skb);
                        clip_push(vcc, skb);
                        PRIV(skb->dev)->stats.rx_packets--;
                        PRIV(skb->dev)->stats.rx_bytes -= len;
+                        kfree_skb(skb);
                }
        return 0;
 }
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index a7ba0cce0b46..068d8afbf0a7 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -121,7 +121,7 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
        buf[1] = 0;
        buf[2] = 0;
        buf[3] = BPDU_TYPE_TCN;
-        br_send_bpdu(p, buf, 7);
+        br_send_bpdu(p, buf, 4);
 }
 /*
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5130d2efdbbe..fe2113f54e2b 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1432,6 +1432,9 @@ int neigh_table_clear(struct neigh_table *tbl)
        kfree(tbl->phash_buckets);
        tbl->phash_buckets = NULL;
+        free_percpu(tbl->stats);
+        tbl->stats = NULL;
        return 0;
 }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 23fb9d9768e3..01801c0f885d 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1281,18 +1281,18 @@ static inline int check_leaf(struct trie *t, struct leaf *l,
                             struct fib_result *res)
 {
        int err, i;
-        t_key mask;
+        __be32 mask;
        struct leaf_info *li;
        struct hlist_head *hhead = &l->list;
        struct hlist_node *node;
        hlist_for_each_entry_rcu(li, node, hhead, hlist) {
                i = li->plen;
-                mask = ntohl(inet_make_mask(i));
+                mask = inet_make_mask(i);
-                if (l->key != (key & mask))
+                if (l->key != (key & ntohl(mask)))
                        continue;
-                if ((err = fib_semantic_match(&li->falh, flp, res, l->key, mask, i)) <= 0) {
+                if ((err = fib_semantic_match(&li->falh, flp, res, htonl(l->key), mask, i)) <= 0) {
                        *plen = i;
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                        t->stats.semantic_match_passed++;
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index a19a33ceb811..37fafb1fbcff 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -46,14 +46,7 @@
 */
 static int ports[IP_VS_APP_MAX_PORTS] = {21, 0};
 module_param_array(ports, int, NULL, 0);
+MODULE_PARM_DESC(ports, "Ports to monitor for FTP control commands");
-/*
- *      Debug level
- */
-#ifdef CONFIG_IP_VS_DEBUG
-static int debug=0;
-module_param(debug, int, 0);
-#endif
 /*      Dummy variable */
@@ -177,7 +170,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                                           &start, &end) != 1)
                        return 1;
-                IP_VS_DBG(1-debug, "PASV response (%u.%u.%u.%u:%d) -> "
+                IP_VS_DBG(7, "PASV response (%u.%u.%u.%u:%d) -> "
                          "%u.%u.%u.%u:%d detected\n",
                          NIPQUAD(from), ntohs(port), NIPQUAD(cp->caddr), 0);
@@ -280,7 +273,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
        while (data <= data_limit - 6) {
                if (strnicmp(data, "PASV\r\n", 6) == 0) {
                        /* Passive mode on */
-                        IP_VS_DBG(1-debug, "got PASV at %zd of %zd\n",
+                        IP_VS_DBG(7, "got PASV at %zd of %zd\n",
                                  data - data_start,
                                  data_limit - data_start);
                        cp->app_data = &ip_vs_ftp_pasv;
@@ -302,7 +295,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
                                   &start, &end) != 1)
                return 1;
-        IP_VS_DBG(1-debug, "PORT %u.%u.%u.%u:%d detected\n",
+        IP_VS_DBG(7, "PORT %u.%u.%u.%u:%d detected\n",
                  NIPQUAD(to), ntohs(port));
        /* Passive mode off */
@@ -311,7 +304,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
        /*
         * Now update or create a connection entry for it
         */
-        IP_VS_DBG(1-debug, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
+        IP_VS_DBG(7, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
                  ip_vs_proto_name(iph->protocol),
                  NIPQUAD(to), ntohs(port), NIPQUAD(cp->vaddr), 0);
@@ -372,11 +365,17 @@ static int __init ip_vs_ftp_init(void)
        for (i=0; i<IP_VS_APP_MAX_PORTS; i++) {
                if (!ports[i])
                        continue;
+                if (ports[i] < 0 || ports[i] > 0xffff) {
+                        IP_VS_WARNING("ip_vs_ftp: Ignoring invalid "
+                                      "configuration port[%d] = %d\n",
+                                      i, ports[i]);
+                        continue;
+                }
                ret = register_ip_vs_app_inc(app, app->protocol, ports[i]);
                if (ret)
                        break;
-                IP_VS_DBG(1-debug, "%s: loaded support on port[%d] = %d\n",
+                IP_VS_INFO("%s: loaded support on port[%d] = %d\n",
-                          app->name, i, ports[i]);
+                           app->name, i, ports[i]);
        }
        if (ret)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 111ff39a08c5..159fa3f1ba67 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -89,7 +89,7 @@ int sysctl_tcp_frto;
 int sysctl_tcp_nometrics_save;
 int sysctl_tcp_moderate_rcvbuf = 1;
-int sysctl_tcp_abc = 1;
+int sysctl_tcp_abc;
 #define FLAG_DATA               0x01 /* Incoming frame contained data.          */
 #define FLAG_WIN_UPDATE         0x02 /* Incoming ACK was a window update.       */
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index 1f977b6ee9a1..48f28d617ce6 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -3,13 +3,8 @@
 *
 * TCP Low Priority is a distributed algorithm whose goal is to utilize only
 *   the excess network bandwidth as compared to the ``fair share`` of
- *   bandwidth as targeted by TCP. Available from:
+ *   bandwidth as targeted by TCP.
- *     http://www.ece.rice.edu/~akuzma/Doc/akuzma/TCP-LP.pdf
 *
- * Original Author:
- *   Aleksandar Kuzmanovic <akuzma@northwestern.edu>
- *
- * See http://www-ece.rice.edu/networks/TCP-LP/ for their implementation.
 * As of 2.6.13, Linux supports pluggable congestion control algorithms.
 * Due to the limitation of the API, we take the following changes from
 * the original TCP-LP implementation:
@@ -24,11 +19,20 @@
 *   o OWD is handled in relative format, where local time stamp will in
 *     tcp_time_stamp format.
 *
- * Port from 2.4.19 to 2.6.16 as module by:
+ * Original Author:
- *   Wong Hoi Sing Edison <hswong3i@gmail.com>
+ *   Aleksandar Kuzmanovic <akuzma@northwestern.edu>
- *   Hung Hing Lun <hlhung3i@gmail.com>
+ * Available from:
+ *   http://www.ece.rice.edu/~akuzma/Doc/akuzma/TCP-LP.pdf
+ * Original implementation for 2.4.19:
+ *   http://www-ece.rice.edu/networks/TCP-LP/
 *
- * Version: $Id: tcp_lp.c,v 1.22 2006-05-02 18:18:19 hswong3i Exp $
+ * 2.6.x module Authors:
+ *   Wong Hoi Sing, Edison <hswong3i@gmail.com>
+ *   Hung Hing Lun, Mike <hlhung3i@gmail.com>
+ * SourceForge project page:
+ *   http://tcp-lp-mod.sourceforge.net/
+ *
+ * Version: $Id: tcp_lp.c,v 1.24 2006/09/05 20:22:53 hswong3i Exp $
 */
 #include <linux/config.h>
@@ -153,16 +157,19 @@ static u32 tcp_lp_remote_hz_estimator(struct sock *sk)
        if (m < 0)
                m = -m;
-        if (rhz != 0) {
+        if (rhz > 0) {
                m -= rhz >> 6;  /* m is now error in remote HZ est */
                rhz += m;       /* 63/64 old + 1/64 new */
        } else
                rhz = m << 6;
+ out:
        /* record time for successful remote HZ calc */
-        lp->flag |= LP_VALID_RHZ;
+        if (rhz > 0)
+                lp->flag |= LP_VALID_RHZ;
+        else
+                lp->flag &= ~LP_VALID_RHZ;
- out:
        /* record reference time stamp */
        lp->remote_ref_time = tp->rx_opt.rcv_tsval;
        lp->local_ref_time = tp->rx_opt.rcv_tsecr;
@@ -333,6 +340,6 @@ static void __exit tcp_lp_unregister(void)
 module_init(tcp_lp_register);
 module_exit(tcp_lp_unregister);
-MODULE_AUTHOR("Wong Hoi Sing Edison, Hung Hing Lun");
+MODULE_AUTHOR("Wong Hoi Sing Edison, Hung Hing Lun Mike");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("TCP Low Priority");
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 99a6eb23378b..3b55b4c8e2d1 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -696,7 +696,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                        }
                        tc = *(int *)CMSG_DATA(cmsg);
-                        if (tc < 0 || tc > 0xff)
+                        if (tc < -1 || tc > 0xff)
                                goto exit_f;
                        err = 0;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 3d6e9a351150..356a8a7ef22a 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -401,7 +401,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
        if (hlimit < 0)
                hlimit = ipv6_get_hoplimit(dst->dev);
-        tclass = np->cork.tclass;
+        tclass = np->tclass;
        if (tclass < 0)
                tclass = 0;
@@ -497,7 +497,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
        if (hlimit < 0)
                hlimit = ipv6_get_hoplimit(dst->dev);
-        tclass = np->cork.tclass;
+        tclass = np->tclass;
        if (tclass < 0)
                tclass = 0;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 43327264e69c..a5eaaf693abf 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -362,7 +362,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                break;
        case IPV6_TCLASS:
-                if (val < 0 || val > 0xff)
+                if (val < -1 || val > 0xff)
                        goto e_inval;
                np->tclass = val;
                retv = 0;
@@ -947,6 +947,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
        case IPV6_TCLASS:
                val = np->tclass;
+                if (val < 0)
+                        val = 0;
                break;
        case IPV6_RECVTCLASS:
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d57e61ce4a7d..15b862d8acab 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -781,7 +781,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
        }
        if (tclass < 0) {
-                tclass = np->cork.tclass;
+                tclass = np->tclass;
                if (tclass < 0)
                        tclass = 0;
        }
diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c
index 4cdba7469dc4..be8d3c26b568 100644
--- a/net/netfilter/xt_quota.c
+++ b/net/netfilter/xt_quota.c
@@ -11,6 +11,8 @@
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
+MODULE_ALIAS("ipt_quota");
+MODULE_ALIAS("ip6t_quota");
 static DEFINE_SPINLOCK(quota_lock);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f9cef3671593..4172a5235916 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -626,8 +626,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                if ((int)snaplen < 0)
                        snaplen = 0;
        }
-        if (snaplen > skb->len-skb->data_len)
-                snaplen = skb->len-skb->data_len;
        spin_lock(&sk->sk_receive_queue.lock);
        h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head);
@@ -644,7 +642,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                status &= ~TP_STATUS_LOSING;
        spin_unlock(&sk->sk_receive_queue.lock);
-        memcpy((u8*)h + macoff, skb->data, snaplen);
+        skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
        h->tp_len = skb->len;
        h->tp_snaplen = snaplen;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 0834c2ee9174..6f9151899795 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -238,9 +238,7 @@ void __netdev_watchdog_up(struct net_device *dev)
 static void dev_watchdog_up(struct net_device *dev)
 {
-        netif_tx_lock_bh(dev);
        __netdev_watchdog_up(dev);
-        netif_tx_unlock_bh(dev);
 }
 static void dev_watchdog_down(struct net_device *dev)
diff --git a/scripts/Makefile.headersinst b/scripts/Makefile.headersinst
index aa9990a3ccd6..12e1daf875c8 100644
--- a/scripts/Makefile.headersinst
+++ b/scripts/Makefile.headersinst
@@ -93,14 +93,14 @@ STUBDEF=__ASM_STUB_`echo $@ | tr a-z. A-Z_`;				\
 echo "\#ifndef $$STUBDEF" ;                                             \
 echo "\#define $$STUBDEF" ;                                             \
 echo "\# if $(ARCHDEF)" ;                                               \
-if [ -r $(srctree)/include/$(archasm)/$@ ]; then                        \
+if [ -r $(INSTALL_HDR_PATH)/include/$(archasm)/$@ ]; then               \
        echo "\#  include <$(archasm)/$@>" ;                            \
 else                                                                    \
        echo "\#  error $(archasm)/$@ does not exist in"                \
                        "the $(ARCH) architecture" ;                    \
 fi ;                                                                    \
 echo "\# elif $(ALTARCHDEF)" ;                                          \
-if [ -r $(srctree)/include/$(altarchasm)/$@ ]; then                     \
+if [ -r $(INSTALL_HDR_PATH)/include/$(altarchasm)/$@ ]; then            \
        echo "\#  include <$(altarchasm)/$@>" ;                         \
 else                                                                    \
        echo "\#  error $(altarchasm)/$@ does not exist in"             \
@@ -149,7 +149,9 @@ endif
 hdrinst := -rR -f $(srctree)/scripts/Makefile.headersinst obj
 .PHONY: altarch-dir
-altarch-dir:
+# All the files in the normal arch dir must be created first, since we test
+# for their existence.
+altarch-dir: $(subdir-y) $(header-y) $(unifdef-y) $(objhdr-y)
        $(Q)$(MAKE) $(hdrinst)=include/asm-$(ALTARCH) dst=include/asm-$(ALTARCH)
        $(Q)$(MAKE) $(hdrinst)=include/asm dst=include/asm
diff --git a/scripts/Makefile.host b/scripts/Makefile.host
index 18ecd4d5df7f..060f4c563a5c 100644
--- a/scripts/Makefile.host
+++ b/scripts/Makefile.host
@@ -30,7 +30,7 @@
 # libkconfig.so as the executable conf.
 # Note: Shared libraries consisting of C++ files are not supported
-__hostprogs := $(sort $(hostprogs-y)$(hostprogs-m))
+__hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
 # hostprogs-y := tools/build may have been specified. Retreive directory
 host-objdirs := $(foreach f,$(__hostprogs), $(if $(dir $(f)),$(dir $(f))))