98 files changed, 765 insertions, 504 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index c8f47bf154f4..3f591629e953 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -410,9 +410,8 @@ F:	drivers/i2c/busses/i2c-ali1563.c
 ALPHA PORT
 M:      Richard Henderson <rth@twiddle.net>
-S:      Odd Fixes for 2.4; Maintained for 2.6.
 M:      Ivan Kokshaysky <ink@jurassic.park.msu.ru>
-S:      Maintained for 2.4; PCI support for 2.6.
+M:      Matt Turner <mattst88@gmail.com>
 L:      linux-alpha@vger.kernel.org
 F:      arch/alpha/
diff --git a/arch/alpha/include/asm/topology.h b/arch/alpha/include/asm/topology.h
index 36b3a30ba0e5..9251e13e144f 100644
--- a/arch/alpha/include/asm/topology.h
+++ b/arch/alpha/include/asm/topology.h
@@ -28,6 +28,9 @@ static const struct cpumask *cpumask_of_node(int node)
 {
        int cpu;
+        if (node == -1)
+                return cpu_all_mask;
        cpumask_clear(&node_to_cpumask_map[node]);
        for_each_online_cpu(cpu) {
diff --git a/arch/arm/mach-davinci/include/mach/keyscan.h b/arch/arm/mach-davinci/include/mach/keyscan.h
index b4e21a2976d1..7a560e05bda8 100644
--- a/arch/arm/mach-davinci/include/mach/keyscan.h
+++ b/arch/arm/mach-davinci/include/mach/keyscan.h
@@ -29,6 +29,7 @@ enum davinci_matrix_types {
 };
 struct davinci_ks_platform_data {
+        int             (*device_enable)(struct device *dev);
        unsigned short  *keymap;
        u32             keymapsize;
        u8              rep:1;
diff --git a/arch/s390/include/asm/bug.h b/arch/s390/include/asm/bug.h
index efb74fd5156e..b1066b9fb5f8 100644
--- a/arch/s390/include/asm/bug.h
+++ b/arch/s390/include/asm/bug.h
@@ -52,6 +52,10 @@
        unreachable();                                  \
 } while (0)
+#define __WARN() do {                                   \
+        __EMIT_BUG(BUGFLAG_WARNING);                    \
+} while (0)
 #define WARN_ON(x) ({                                   \
        int __ret_warn_on = !!(x);                      \
        if (__builtin_constant_p(__ret_warn_on)) {      \
diff --git a/arch/s390/include/asm/sigp.h b/arch/s390/include/asm/sigp.h
index ec403d4304f8..f72d611f7e13 100644
--- a/arch/s390/include/asm/sigp.h
+++ b/arch/s390/include/asm/sigp.h
@@ -15,11 +15,19 @@
 #ifndef __SIGP__
 #define __SIGP__
-#include <asm/ptrace.h>
+#include <asm/system.h>
-#include <asm/atomic.h>
 /* get real cpu address from logical cpu number */
-extern volatile int __cpu_logical_map[];
+extern int __cpu_logical_map[];
+static inline int cpu_logical_map(int cpu)
+{
+#ifdef CONFIG_SMP
+        return __cpu_logical_map[cpu];
+#else
+        return stap();
+#endif
+}
 typedef enum
 {
@@ -79,7 +87,7 @@ signal_processor(__u16 cpu_addr, sigp_order_code order_code)
                "       ipm     %0\n"
                "       srl     %0,28\n"
                :       "=d"    (ccode)
-                : "d" (reg1), "d" (__cpu_logical_map[cpu_addr]),
+                : "d" (reg1), "d" (cpu_logical_map(cpu_addr)),
                  "a" (order_code) : "cc" , "memory");
        return ccode;
 }
@@ -98,7 +106,7 @@ signal_processor_p(__u32 parameter, __u16 cpu_addr, sigp_order_code order_code)
                "       ipm     %0\n"
                "       srl     %0,28\n"
                : "=d" (ccode)
-                : "d" (reg1), "d" (__cpu_logical_map[cpu_addr]),
+                : "d" (reg1), "d" (cpu_logical_map(cpu_addr)),
                  "a" (order_code) : "cc" , "memory");
        return ccode;
 }
@@ -118,7 +126,7 @@ signal_processor_ps(__u32 *statusptr, __u32 parameter, __u16 cpu_addr,
                "       ipm     %0\n"
                "       srl     %0,28\n"
                : "=d" (ccode), "+d" (reg1)
-                : "d" (__cpu_logical_map[cpu_addr]), "a" (order_code)
+                : "d" (cpu_logical_map(cpu_addr)), "a" (order_code)
                : "cc" , "memory");
        *statusptr = reg1;
        return ccode;
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index 07eb61b2fb3a..66069e736842 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -93,13 +93,12 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_SYSCALL_AUDIT       9       /* syscall auditing active */
 #define TIF_SECCOMP             10      /* secure computing */
 #define TIF_SYSCALL_TRACEPOINT  11      /* syscall tracepoint instrumentation */
-#define TIF_USEDFPU             16      /* FPU was used by this task this quantum (SMP) */
+#define TIF_POLLING_NRFLAG      16      /* true if poll_idle() is polling
-#define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling 
                                           TIF_NEED_RESCHED */
-#define TIF_31BIT               18      /* 32bit process */ 
+#define TIF_31BIT               17      /* 32bit process */
-#define TIF_MEMDIE              19
+#define TIF_MEMDIE              18
-#define TIF_RESTORE_SIGMASK     20      /* restore signal mask in do_signal() */
+#define TIF_RESTORE_SIGMASK     19      /* restore signal mask in do_signal() */
-#define TIF_FREEZE              21      /* thread is freezing for suspend */
+#define TIF_FREEZE              20      /* thread is freezing for suspend */
 #define _TIF_NOTIFY_RESUME      (1<<TIF_NOTIFY_RESUME)
 #define _TIF_RESTORE_SIGMASK    (1<<TIF_RESTORE_SIGMASK)
@@ -112,7 +111,6 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_SYSCALL_AUDIT      (1<<TIF_SYSCALL_AUDIT)
 #define _TIF_SECCOMP            (1<<TIF_SECCOMP)
 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
-#define _TIF_USEDFPU            (1<<TIF_USEDFPU)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 #define _TIF_31BIT              (1<<TIF_31BIT)
 #define _TIF_FREEZE             (1<<TIF_FREEZE)
diff --git a/arch/s390/include/asm/unistd.h b/arch/s390/include/asm/unistd.h
index 192a7203a14f..6e9f049fa823 100644
--- a/arch/s390/include/asm/unistd.h
+++ b/arch/s390/include/asm/unistd.h
@@ -269,8 +269,7 @@
 #define __NR_pwritev            329
 #define __NR_rt_tgsigqueueinfo  330
 #define __NR_perf_event_open    331
-#define __NR_recvmmsg           332
+#define NR_syscalls 332
-#define NR_syscalls 333
 /* 
 * There are some system calls that are not present on 64 bit, some
@@ -377,6 +376,9 @@
 #define __IGNORE_migrate_pages
 #define __IGNORE_move_pages
+/* Ignore system calls that are also reachable via sys_socket */
+#define __IGNORE_recvmmsg
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_SYS_ALARM
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index 22c9e557bb22..11c3aba664ea 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -616,44 +616,35 @@ asmlinkage long sys32_fstatat64(unsigned int dfd, char __user *filename,
 */
 struct mmap_arg_struct_emu31 {
-        u32     addr;
+        compat_ulong_t addr;
-        u32     len;
+        compat_ulong_t len;
-        u32     prot;
+        compat_ulong_t prot;
-        u32     flags;
+        compat_ulong_t flags;
-        u32     fd;
+        compat_ulong_t fd;
-        u32     offset;
+        compat_ulong_t offset;
 };
-asmlinkage unsigned long
+asmlinkage unsigned long old32_mmap(struct mmap_arg_struct_emu31 __user *arg)
-old32_mmap(struct mmap_arg_struct_emu31 __user *arg)
 {
        struct mmap_arg_struct_emu31 a;
-        int error = -EFAULT;
        if (copy_from_user(&a, arg, sizeof(a)))
-                goto out;
+                return -EFAULT;
-        error = -EINVAL;
        if (a.offset & ~PAGE_MASK)
-                goto out;
+                return -EINVAL;
+        a.addr = (unsigned long) compat_ptr(a.addr);
-        error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
+        return sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
-                               a.offset >> PAGE_SHIFT);
+                              a.offset >> PAGE_SHIFT);
-out:
-        return error;
 }
-asmlinkage long 
+asmlinkage long sys32_mmap2(struct mmap_arg_struct_emu31 __user *arg)
-sys32_mmap2(struct mmap_arg_struct_emu31 __user *arg)
 {
        struct mmap_arg_struct_emu31 a;
-        int error = -EFAULT;
        if (copy_from_user(&a, arg, sizeof(a)))
-                goto out;
+                return -EFAULT;
-        error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd, a.offset);
+        a.addr = (unsigned long) compat_ptr(a.addr);
-out:
+        return sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd, a.offset);
-        return error;
 }
 asmlinkage long sys32_read(unsigned int fd, char __user * buf, size_t count)
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index faeaccc7d7d9..30de2d0e52bb 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1853,12 +1853,3 @@ sys32_execve_wrapper:
        llgtr   %r3,%r3                 # compat_uptr_t *
        llgtr   %r4,%r4                 # compat_uptr_t *
        jg      sys32_execve            # branch to system call
-        .globl  compat_sys_recvmmsg_wrapper
-compat_sys_recvmmsg_wrapper:
-        lgfr    %r2,%r2                 # int
-        llgtr   %r3,%r3                 # struct compat_mmsghdr *
-        llgfr   %r4,%r4                 # unsigned int
-        llgfr   %r5,%r5                 # unsigned int
-        llgtr   %r6,%r6                 # struct compat_timespec *
-        jg      compat_sys_recvmmsg
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 5417eb57271a..00b6d1d292f2 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -153,8 +153,6 @@ void exit_thread(void)
 void flush_thread(void)
 {
-        clear_used_math();
-        clear_tsk_thread_flag(current, TIF_USEDFPU);
 }
 void release_thread(struct task_struct *dead_task)
@@ -217,6 +215,7 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp,
        p->thread.mm_segment = get_fs();
        /* Don't copy debug registers */
        memset(&p->thread.per_info, 0, sizeof(p->thread.per_info));
+        clear_tsk_thread_flag(p, TIF_SINGLE_STEP);
        /* Initialize per thread user and system timer values */
        ti = task_thread_info(p);
        ti->user_timer = 0;
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 13815d39f7dd..7cf464234419 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -65,6 +65,7 @@ FixPerRegisters(struct task_struct *task)
 {
        struct pt_regs *regs;
        per_struct *per_info;
+        per_cr_words cr_words;
        regs = task_pt_regs(task);
        per_info = (per_struct *) &task->thread.per_info;
@@ -98,6 +99,13 @@ FixPerRegisters(struct task_struct *task)
                per_info->control_regs.bits.storage_alt_space_ctl = 1;
        else
                per_info->control_regs.bits.storage_alt_space_ctl = 0;
+        if (task == current) {
+                __ctl_store(cr_words, 9, 11);
+                if (memcmp(&cr_words, &per_info->control_regs.words,
+                           sizeof(cr_words)) != 0)
+                        __ctl_load(per_info->control_regs.words, 9, 11);
+        }
 }
 void user_enable_single_step(struct task_struct *task)
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 0663287fa1b3..8d8957b38ab3 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -87,7 +87,6 @@ unsigned long elf_hwcap = 0;
 char elf_platform[ELF_PLATFORM_SIZE];
 struct mem_chunk __initdata memory_chunk[MEMORY_CHUNKS];
-volatile int __cpu_logical_map[NR_CPUS]; /* logical cpu to cpu address */
 int __initdata memory_end_set;
 unsigned long __initdata memory_end;
@@ -124,12 +123,6 @@ void __cpuinit cpu_init(void)
         */
        get_cpu_id(&S390_lowcore.cpu_id);
-        /*
-         * Force FPU initialization:
-         */
-        clear_thread_flag(TIF_USEDFPU);
-        clear_used_math();
        atomic_inc(&init_mm.mm_count);
        current->active_mm = &init_mm;
        BUG_ON(current->mm);
@@ -855,7 +848,6 @@ setup_arch(char **cmdline_p)
        setup_lowcore();
        cpu_init();
-        __cpu_logical_map[0] = stap();
        s390_init_cpu_topology();
        /*
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index 6b4fef877f9d..1675c48b9145 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -500,18 +500,10 @@ void do_signal(struct pt_regs *regs)
                                clear_thread_flag(TIF_RESTORE_SIGMASK);
                        /*
-                         * If we would have taken a single-step trap
-                         * for a normal instruction, act like we took
-                         * one for the handler setup.
-                         */
-                        if (current->thread.per_info.single_step)
-                                set_thread_flag(TIF_SINGLE_STEP);
-                        /*
                         * Let tracing know that we've done the handler setup.
                         */
                        tracehook_signal_handler(signr, &info, &ka, regs,
-                                         test_thread_flag(TIF_SINGLE_STEP));
+                                        current->thread.per_info.single_step);
                }
                return;
        }
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 93e52039321b..76a6fdd46c45 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -52,6 +52,9 @@
 #include <asm/cpu.h>
 #include "entry.h"
+/* logical cpu to cpu address */
+int __cpu_logical_map[NR_CPUS];
 static struct task_struct *current_set[NR_CPUS];
 static u8 smp_cpu_type;
@@ -717,6 +720,12 @@ void __init smp_cpus_done(unsigned int max_cpus)
 {
 }
+void __init smp_setup_processor_id(void)
+{
+        S390_lowcore.cpu_nr = 0;
+        __cpu_logical_map[0] = stap();
+}
 /*
 * the frequency of the profiling timer can be changed
 * by writing a multiplier value into /proc/profile.
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 4f292c936872..30eca070d426 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -340,4 +340,3 @@ SYSCALL(sys_preadv,sys_preadv,compat_sys_preadv_wrapper)
 SYSCALL(sys_pwritev,sys_pwritev,compat_sys_pwritev_wrapper)
 SYSCALL(sys_rt_tgsigqueueinfo,sys_rt_tgsigqueueinfo,compat_sys_rt_tgsigqueueinfo_wrapper) /* 330 */
 SYSCALL(sys_perf_event_open,sys_perf_event_open,sys_perf_event_open_wrapper)
-SYSCALL(sys_recvmmsg,sys_recvmmsg,compat_sys_recvmmsg_wrapper)
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index 3c72c9cf22b6..14ef6f05e432 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -114,7 +114,7 @@ static void add_cpus_to_core(struct tl_cpu *tl_cpu, struct core_info *core)
                rcpu = CPU_BITS - 1 - cpu + tl_cpu->origin;
                for_each_present_cpu(lcpu) {
-                        if (__cpu_logical_map[lcpu] == rcpu) {
+                        if (cpu_logical_map(lcpu) == rcpu) {
                                cpu_set(lcpu, core->mask);
                                smp_cpu_polarization[lcpu] = tl_cpu->pp;
                        }
diff --git a/arch/s390/lib/spinlock.c b/arch/s390/lib/spinlock.c
index 10754a375668..cff327f109a8 100644
--- a/arch/s390/lib/spinlock.c
+++ b/arch/s390/lib/spinlock.c
@@ -34,7 +34,7 @@ static inline void _raw_yield_cpu(int cpu)
 {
        if (MACHINE_HAS_DIAG9C)
                asm volatile("diag %0,0,0x9c"
-                             : : "d" (__cpu_logical_map[cpu]));
+                             : : "d" (cpu_logical_map(cpu)));
        else
                _raw_yield();
 }
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index f4558ccf02b9..869efbaed3ea 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -40,7 +40,7 @@
 static inline unsigned long mmap_base(void)
 {
-        unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
+        unsigned long gap = rlimit(RLIMIT_STACK);
        if (gap < MIN_GAP)
                gap = MIN_GAP;
@@ -61,7 +61,7 @@ static inline int mmap_is_legacy(void)
 #endif
        return sysctl_legacy_va_layout ||
            (current->personality & ADDR_COMPAT_LAYOUT) ||
-            current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY;
+            rlimit(RLIMIT_STACK) == RLIM_INFINITY;
 }
 #ifndef CONFIG_64BIT
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 6a8861b39f05..5c246289b4f0 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -353,6 +353,10 @@ static struct i2c_board_info i2c1_devices[] = {
        {
                I2C_BOARD_INFO("r2025sd", 0x32),
        },
+        {
+                I2C_BOARD_INFO("lis3lv02d", 0x1c),
+                .irq = 33,
+        }
 };
 /* KEYSC */
@@ -1115,6 +1119,10 @@ static int __init arch_setup(void)
        gpio_direction_output(GPIO_PTU0, 0);
        mdelay(20);
+        /* enable motion sensor */
+        gpio_request(GPIO_FN_INTC_IRQ1, NULL);
+        gpio_direction_input(GPIO_FN_INTC_IRQ1);
        /* enable I2C device */
        i2c_register_board_info(0, i2c0_devices,
                                ARRAY_SIZE(i2c0_devices));
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index c5facd951dda..000dc67b85b7 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -197,7 +197,7 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci, u32 *bw)
        edac_printk(KERN_DEBUG, EDAC_MC,
                    "pci-read, sdram scrub control value: %d \n", scrubval);
-        for (i = 0; ARRAY_SIZE(scrubrates); i++) {
+        for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
                if (scrubrates[i].scrubval == scrubval) {
                        *bw = scrubrates[i].bandwidth;
                        status = 0;
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index dee6706038aa..258c639571b5 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -59,7 +59,8 @@ static void evdev_pass_event(struct evdev_client *client,
        client->head &= EVDEV_BUFFER_SIZE - 1;
        spin_unlock(&client->buffer_lock);
-        kill_fasync(&client->fasync, SIGIO, POLL_IN);
+        if (event->type == EV_SYN)
+                kill_fasync(&client->fasync, SIGIO, POLL_IN);
 }
 /*
diff --git a/drivers/input/input.c b/drivers/input/input.c
index ab060710688f..30b503b8d67b 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -24,6 +24,7 @@
 #include <linux/mutex.h>
 #include <linux/rcupdate.h>
 #include <linux/smp_lock.h>
+#include "input-compat.h"
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@suse.cz>");
 MODULE_DESCRIPTION("Input core");
@@ -764,6 +765,40 @@ static int input_attach_handler(struct input_dev *dev, struct input_handler *han
        return error;
 }
+#ifdef CONFIG_COMPAT
+static int input_bits_to_string(char *buf, int buf_size,
+                                unsigned long bits, bool skip_empty)
+{
+        int len = 0;
+        if (INPUT_COMPAT_TEST) {
+                u32 dword = bits >> 32;
+                if (dword || !skip_empty)
+                        len += snprintf(buf, buf_size, "%x ", dword);
+                dword = bits & 0xffffffffUL;
+                if (dword || !skip_empty || len)
+                        len += snprintf(buf + len, max(buf_size - len, 0),
+                                        "%x", dword);
+        } else {
+                if (bits || !skip_empty)
+                        len += snprintf(buf, buf_size, "%lx", bits);
+        }
+        return len;
+}
+#else /* !CONFIG_COMPAT */
+static int input_bits_to_string(char *buf, int buf_size,
+                                unsigned long bits, bool skip_empty)
+{
+        return bits || !skip_empty ?
+                snprintf(buf, buf_size, "%lx", bits) : 0;
+}
+#endif
 #ifdef CONFIG_PROC_FS
@@ -832,14 +867,25 @@ static void input_seq_print_bitmap(struct seq_file *seq, const char *name,
                                   unsigned long *bitmap, int max)
 {
        int i;
+        bool skip_empty = true;
-        for (i = BITS_TO_LONGS(max) - 1; i > 0; i--)
+        char buf[18];
-                if (bitmap[i])
-                        break;
        seq_printf(seq, "B: %s=", name);
-        for (; i >= 0; i--)
-                seq_printf(seq, "%lx%s", bitmap[i], i > 0 ? " " : "");
+        for (i = BITS_TO_LONGS(max) - 1; i >= 0; i--) {
+                if (input_bits_to_string(buf, sizeof(buf),
+                                         bitmap[i], skip_empty)) {
+                        skip_empty = false;
+                        seq_printf(seq, "%s%s", buf, i > 0 ? " " : "");
+                }
+        }
+        /*
+         * If no output was produced print a single 0.
+         */
+        if (skip_empty)
+                seq_puts(seq, "0");
        seq_putc(seq, '\n');
 }
@@ -1128,14 +1174,23 @@ static int input_print_bitmap(char *buf, int buf_size, unsigned long *bitmap,
 {
        int i;
        int len = 0;
+        bool skip_empty = true;
+        for (i = BITS_TO_LONGS(max) - 1; i >= 0; i--) {
+                len += input_bits_to_string(buf + len, max(buf_size - len, 0),
+                                            bitmap[i], skip_empty);
+                if (len) {
+                        skip_empty = false;
+                        if (i > 0)
+                                len += snprintf(buf + len, max(buf_size - len, 0), " ");
+                }
+        }
-        for (i = BITS_TO_LONGS(max) - 1; i > 0; i--)
+        /*
-                if (bitmap[i])
+         * If no output was produced print a single 0.
-                        break;
+         */
+        if (len == 0)
-        for (; i >= 0; i--)
+                len = snprintf(buf, buf_size, "%d", 0);
-                len += snprintf(buf + len, max(buf_size - len, 0),
-                                "%lx%s", bitmap[i], i > 0 ? " " : "");
        if (add_cr)
                len += snprintf(buf + len, max(buf_size - len, 0), "\n");
@@ -1150,7 +1205,8 @@ static ssize_t input_dev_show_cap_##bm(struct device *dev,		\
 {                                                                       \
        struct input_dev *input_dev = to_input_dev(dev);                \
        int len = input_print_bitmap(buf, PAGE_SIZE,                    \
-                                     input_dev->bm##bit, ev##_MAX, 1);  \
+                                     input_dev->bm##bit, ev##_MAX,      \
+                                     true);                             \
        return min_t(int, len, PAGE_SIZE);                              \
 }                                                                       \
 static DEVICE_ATTR(bm, S_IRUGO, input_dev_show_cap_##bm, NULL)
@@ -1214,7 +1270,7 @@ static int input_add_uevent_bm_var(struct kobj_uevent_env *env,
        len = input_print_bitmap(&env->buf[env->buflen - 1],
                                 sizeof(env->buf) - env->buflen,
-                                 bitmap, max, 0);
+                                 bitmap, max, false);
        if (len >= (sizeof(env->buf) - env->buflen))
                return -ENOMEM;
diff --git a/drivers/input/joystick/gf2k.c b/drivers/input/joystick/gf2k.c
index 67c207f5b1a1..45ac70eae0aa 100644
--- a/drivers/input/joystick/gf2k.c
+++ b/drivers/input/joystick/gf2k.c
@@ -277,7 +277,7 @@ static int gf2k_connect(struct gameport *gameport, struct gameport_driver *drv)
        }
 #ifdef RESET_WORKS
-        if ((gf2k->id != (GB(19,2,0) | GB(15,3,2) | GB(12,3,5))) ||
+        if ((gf2k->id != (GB(19,2,0) | GB(15,3,2) | GB(12,3,5))) &&
            (gf2k->id != (GB(31,2,0) | GB(27,3,2) | GB(24,3,5)))) {
                err = -ENODEV;
                goto fail2;
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 482cb1204e43..8a28fb7846dc 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -446,7 +446,7 @@ static void xpad_irq_in(struct urb *urb)
        }
 exit:
-        retval = usb_submit_urb (urb, GFP_ATOMIC);
+        retval = usb_submit_urb(urb, GFP_ATOMIC);
        if (retval)
                err ("%s - usb_submit_urb failed with result %d",
                     __func__, retval);
@@ -571,7 +571,7 @@ static int xpad_play_effect(struct input_dev *dev, void *data,
                xpad->odata[6] = 0x00;
                xpad->odata[7] = 0x00;
                xpad->irq_out->transfer_buffer_length = 8;
-                usb_submit_urb(xpad->irq_out, GFP_KERNEL);
+                usb_submit_urb(xpad->irq_out, GFP_ATOMIC);
        }
        return 0;
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 1f5e2ce327d6..7b4056292eaf 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -225,8 +225,10 @@ struct atkbd {
        struct delayed_work event_work;
        unsigned long event_jiffies;
-        struct mutex event_mutex;
        unsigned long event_mask;
+        /* Serializes reconnect(), attr->set() and event work */
+        struct mutex mutex;
 };
 /*
@@ -577,7 +579,7 @@ static void atkbd_event_work(struct work_struct *work)
 {
        struct atkbd *atkbd = container_of(work, struct atkbd, event_work.work);
-        mutex_lock(&atkbd->event_mutex);
+        mutex_lock(&atkbd->mutex);
        if (!atkbd->enabled) {
                /*
@@ -596,7 +598,7 @@ static void atkbd_event_work(struct work_struct *work)
                        atkbd_set_repeat_rate(atkbd);
        }
-        mutex_unlock(&atkbd->event_mutex);
+        mutex_unlock(&atkbd->mutex);
 }
 /*
@@ -612,7 +614,7 @@ static void atkbd_schedule_event_work(struct atkbd *atkbd, int event_bit)
        atkbd->event_jiffies = jiffies;
        set_bit(event_bit, &atkbd->event_mask);
-        wmb();
+        mb();
        schedule_delayed_work(&atkbd->event_work, delay);
 }
@@ -849,13 +851,20 @@ static void atkbd_disconnect(struct serio *serio)
 {
        struct atkbd *atkbd = serio_get_drvdata(serio);
+        sysfs_remove_group(&serio->dev.kobj, &atkbd_attribute_group);
        atkbd_disable(atkbd);
-        /* make sure we don't have a command in flight */
+        input_unregister_device(atkbd->dev);
+        /*
+         * Make sure we don't have a command in flight.
+         * Note that since atkbd->enabled is false event work will keep
+         * rescheduling itself until it gets canceled and will not try
+         * accessing freed input device or serio port.
+         */
        cancel_delayed_work_sync(&atkbd->event_work);
-        sysfs_remove_group(&serio->dev.kobj, &atkbd_attribute_group);
-        input_unregister_device(atkbd->dev);
        serio_close(serio);
        serio_set_drvdata(serio, NULL);
        kfree(atkbd);
@@ -1087,7 +1096,7 @@ static int atkbd_connect(struct serio *serio, struct serio_driver *drv)
        atkbd->dev = dev;
        ps2_init(&atkbd->ps2dev, serio);
        INIT_DELAYED_WORK(&atkbd->event_work, atkbd_event_work);
-        mutex_init(&atkbd->event_mutex);
+        mutex_init(&atkbd->mutex);
        switch (serio->id.type) {
@@ -1160,19 +1169,23 @@ static int atkbd_reconnect(struct serio *serio)
 {
        struct atkbd *atkbd = serio_get_drvdata(serio);
        struct serio_driver *drv = serio->drv;
+        int retval = -1;
        if (!atkbd || !drv) {
                printk(KERN_DEBUG "atkbd: reconnect request, but serio is disconnected, ignoring...\n");
                return -1;
        }
+        mutex_lock(&atkbd->mutex);
        atkbd_disable(atkbd);
        if (atkbd->write) {
                if (atkbd_probe(atkbd))
-                        return -1;
+                        goto out;
                if (atkbd->set != atkbd_select_set(atkbd, atkbd->set, atkbd->extra))
-                        return -1;
+                        goto out;
                atkbd_activate(atkbd);
@@ -1190,8 +1203,11 @@ static int atkbd_reconnect(struct serio *serio)
        }
        atkbd_enable(atkbd);
+        retval = 0;
-        return 0;
+ out:
+        mutex_unlock(&atkbd->mutex);
+        return retval;
 }
 static struct serio_device_id atkbd_serio_ids[] = {
@@ -1235,47 +1251,28 @@ static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf,
                                ssize_t (*handler)(struct atkbd *, char *))
 {
        struct serio *serio = to_serio_port(dev);
-        int retval;
+        struct atkbd *atkbd = serio_get_drvdata(serio);
-        retval = serio_pin_driver(serio);
-        if (retval)
-                return retval;
-        if (serio->drv != &atkbd_drv) {
-                retval = -ENODEV;
-                goto out;
-        }
-        retval = handler((struct atkbd *)serio_get_drvdata(serio), buf);
-out:
+        return handler(atkbd, buf);
-        serio_unpin_driver(serio);
-        return retval;
 }
 static ssize_t atkbd_attr_set_helper(struct device *dev, const char *buf, size_t count,
                                ssize_t (*handler)(struct atkbd *, const char *, size_t))
 {
        struct serio *serio = to_serio_port(dev);
-        struct atkbd *atkbd;
+        struct atkbd *atkbd = serio_get_drvdata(serio);
        int retval;
-        retval = serio_pin_driver(serio);
+        retval = mutex_lock_interruptible(&atkbd->mutex);
        if (retval)
                return retval;
-        if (serio->drv != &atkbd_drv) {
-                retval = -ENODEV;
-                goto out;
-        }
-        atkbd = serio_get_drvdata(serio);
        atkbd_disable(atkbd);
        retval = handler(atkbd, buf, count);
        atkbd_enable(atkbd);
-out:
+        mutex_unlock(&atkbd->mutex);
-        serio_unpin_driver(serio);
        return retval;
 }
diff --git a/drivers/input/keyboard/davinci_keyscan.c b/drivers/input/keyboard/davinci_keyscan.c
index 6e52d855f637..d410d7a52f1d 100644
--- a/drivers/input/keyboard/davinci_keyscan.c
+++ b/drivers/input/keyboard/davinci_keyscan.c
@@ -174,6 +174,14 @@ static int __init davinci_ks_probe(struct platform_device *pdev)
        struct davinci_ks_platform_data *pdata = pdev->dev.platform_data;
        int error, i;
+        if (pdata->device_enable) {
+                error = pdata->device_enable(dev);
+                if (error < 0) {
+                        dev_dbg(dev, "device enable function failed\n");
+                        return error;
+                }
+        }
        if (!pdata->keymap) {
                dev_dbg(dev, "no keymap from pdata\n");
                return -EINVAL;
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index 0d1d33468b43..4f8fe0886b2a 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -139,6 +139,7 @@ struct tp_finger {
 /* trackpad finger data size, empirically at least ten fingers */
 #define SIZEOF_FINGER           sizeof(struct tp_finger)
 #define SIZEOF_ALL_FINGERS      (16 * SIZEOF_FINGER)
+#define MAX_FINGER_ORIENTATION  16384
 /* device-specific parameters */
 struct bcm5974_param {
@@ -284,6 +285,26 @@ static void setup_events_to_report(struct input_dev *input_dev,
        input_set_abs_params(input_dev, ABS_Y,
                                0, cfg->y.dim, cfg->y.fuzz, 0);
+        /* finger touch area */
+        input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
+                             cfg->w.devmin, cfg->w.devmax, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_TOUCH_MINOR,
+                             cfg->w.devmin, cfg->w.devmax, 0, 0);
+        /* finger approach area */
+        input_set_abs_params(input_dev, ABS_MT_WIDTH_MAJOR,
+                             cfg->w.devmin, cfg->w.devmax, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_WIDTH_MINOR,
+                             cfg->w.devmin, cfg->w.devmax, 0, 0);
+        /* finger orientation */
+        input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
+                             -MAX_FINGER_ORIENTATION,
+                             MAX_FINGER_ORIENTATION, 0, 0);
+        /* finger position */
+        input_set_abs_params(input_dev, ABS_MT_POSITION_X,
+                             cfg->x.devmin, cfg->x.devmax, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
+                             cfg->y.devmin, cfg->y.devmax, 0, 0);
        __set_bit(EV_KEY, input_dev->evbit);
        __set_bit(BTN_TOUCH, input_dev->keybit);
        __set_bit(BTN_TOOL_FINGER, input_dev->keybit);
@@ -310,13 +331,29 @@ static int report_bt_state(struct bcm5974 *dev, int size)
        return 0;
 }
+static void report_finger_data(struct input_dev *input,
+                               const struct bcm5974_config *cfg,
+                               const struct tp_finger *f)
+{
+        input_report_abs(input, ABS_MT_TOUCH_MAJOR, raw2int(f->force_major));
+        input_report_abs(input, ABS_MT_TOUCH_MINOR, raw2int(f->force_minor));
+        input_report_abs(input, ABS_MT_WIDTH_MAJOR, raw2int(f->size_major));
+        input_report_abs(input, ABS_MT_WIDTH_MINOR, raw2int(f->size_minor));
+        input_report_abs(input, ABS_MT_ORIENTATION,
+                         MAX_FINGER_ORIENTATION - raw2int(f->orientation));
+        input_report_abs(input, ABS_MT_POSITION_X, raw2int(f->abs_x));
+        input_report_abs(input, ABS_MT_POSITION_Y,
+                         cfg->y.devmin + cfg->y.devmax - raw2int(f->abs_y));
+        input_mt_sync(input);
+}
 /* report trackpad data as logical trackpad state */
 static int report_tp_state(struct bcm5974 *dev, int size)
 {
        const struct bcm5974_config *c = &dev->cfg;
        const struct tp_finger *f;
        struct input_dev *input = dev->input;
-        int raw_p, raw_w, raw_x, raw_y, raw_n;
+        int raw_p, raw_w, raw_x, raw_y, raw_n, i;
        int ptest, origin, ibt = 0, nmin = 0, nmax = 0;
        int abs_p = 0, abs_w = 0, abs_x = 0, abs_y = 0;
@@ -329,6 +366,11 @@ static int report_tp_state(struct bcm5974 *dev, int size)
        /* always track the first finger; when detached, start over */
        if (raw_n) {
+                /* report raw trackpad data */
+                for (i = 0; i < raw_n; i++)
+                        report_finger_data(input, c, &f[i]);
                raw_p = raw2int(f->force_major);
                raw_w = raw2int(f->size_major);
                raw_x = raw2int(f->abs_x);
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 401ac6b6edd4..9774bdfaa482 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -627,8 +627,15 @@ static int psmouse_extensions(struct psmouse *psmouse,
                synaptics_hardware = true;
                if (max_proto > PSMOUSE_IMEX) {
-                        if (!set_properties || synaptics_init(psmouse) == 0)
+/*
+ * Try activating protocol, but check if support is enabled first, since
+ * we try detecting Synaptics even when protocol is disabled.
+ */
+                        if (synaptics_supported() &&
+                            (!set_properties || synaptics_init(psmouse) == 0)) {
                                return PSMOUSE_SYNAPTICS;
+                        }
 /*
 * Some Synaptics touchpads can emulate extended protocols (like IMPS/2).
 * Unfortunately Logitech/Genius probes confuse some firmware versions so
@@ -683,19 +690,6 @@ static int psmouse_extensions(struct psmouse *psmouse,
                max_proto = PSMOUSE_IMEX;
        }
-/*
- * Try Finger Sensing Pad
- */
-        if (max_proto > PSMOUSE_IMEX) {
-                if (fsp_detect(psmouse, set_properties) == 0) {
-                        if (!set_properties || fsp_init(psmouse) == 0)
-                                return PSMOUSE_FSP;
-/*
- * Init failed, try basic relative protocols
- */
-                        max_proto = PSMOUSE_IMEX;
-                }
-        }
        if (max_proto > PSMOUSE_IMEX) {
                if (genius_detect(psmouse, set_properties) == 0)
@@ -712,6 +706,21 @@ static int psmouse_extensions(struct psmouse *psmouse,
        }
 /*
+ * Try Finger Sensing Pad. We do it here because its probe upsets
+ * Trackpoint devices (causing TP_READ_ID command to time out).
+ */
+        if (max_proto > PSMOUSE_IMEX) {
+                if (fsp_detect(psmouse, set_properties) == 0) {
+                        if (!set_properties || fsp_init(psmouse) == 0)
+                                return PSMOUSE_FSP;
+/*
+ * Init failed, try basic relative protocols
+ */
+                        max_proto = PSMOUSE_IMEX;
+                }
+        }
+/*
 * Reset to defaults in case the device got confused by extended
 * protocol probes. Note that we follow up with full reset because
 * some mice put themselves to sleep when they see PSMOUSE_RESET_DIS.
@@ -1450,24 +1459,10 @@ ssize_t psmouse_attr_show_helper(struct device *dev, struct device_attribute *de
        struct serio *serio = to_serio_port(dev);
        struct psmouse_attribute *attr = to_psmouse_attr(devattr);
        struct psmouse *psmouse;
-        int retval;
-        retval = serio_pin_driver(serio);
-        if (retval)
-                return retval;
-        if (serio->drv != &psmouse_drv) {
-                retval = -ENODEV;
-                goto out;
-        }
        psmouse = serio_get_drvdata(serio);
-        retval = attr->show(psmouse, attr->data, buf);
+        return attr->show(psmouse, attr->data, buf);
-out:
-        serio_unpin_driver(serio);
-        return retval;
 }
 ssize_t psmouse_attr_set_helper(struct device *dev, struct device_attribute *devattr,
@@ -1478,18 +1473,9 @@ ssize_t psmouse_attr_set_helper(struct device *dev, struct device_attribute *dev
        struct psmouse *psmouse, *parent = NULL;
        int retval;
-        retval = serio_pin_driver(serio);
-        if (retval)
-                return retval;
-        if (serio->drv != &psmouse_drv) {
-                retval = -ENODEV;
-                goto out_unpin;
-        }
        retval = mutex_lock_interruptible(&psmouse_mutex);
        if (retval)
-                goto out_unpin;
+                goto out;
        psmouse = serio_get_drvdata(serio);
@@ -1519,8 +1505,7 @@ ssize_t psmouse_attr_set_helper(struct device *dev, struct device_attribute *dev
 out_unlock:
        mutex_unlock(&psmouse_mutex);
- out_unpin:
+ out:
-        serio_unpin_driver(serio);
        return retval;
 }
@@ -1582,9 +1567,7 @@ static ssize_t psmouse_attr_set_protocol(struct psmouse *psmouse, void *data, co
                }
                mutex_unlock(&psmouse_mutex);
-                serio_unpin_driver(serio);
                serio_unregister_child_port(serio);
-                serio_pin_driver_uninterruptible(serio);
                mutex_lock(&psmouse_mutex);
                if (serio->drv != &psmouse_drv) {
diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index 77b9fd0b3fbf..81a6b81cb2fe 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -2,7 +2,7 @@
 * Finger Sensing Pad PS/2 mouse driver.
 *
 * Copyright (C) 2005-2007 Asia Vital Components Co., Ltd.
- * Copyright (C) 2005-2009 Tai-hwa Liang, Sentelic Corporation.
+ * Copyright (C) 2005-2010 Tai-hwa Liang, Sentelic Corporation.
 *
 *   This program is free software; you can redistribute it and/or
 *   modify it under the terms of the GNU General Public License
@@ -658,9 +658,9 @@ static psmouse_ret_t fsp_process_byte(struct psmouse *psmouse)
                        if (packet[3] & BIT(1))
                                button_status |= 0x0f;  /* wheel up */
                        if (packet[3] & BIT(2))
-                                button_status |= BIT(5);/* horizontal left */
+                                button_status |= BIT(4);/* horizontal left */
                        if (packet[3] & BIT(3))
-                                button_status |= BIT(4);/* horizontal right */
+                                button_status |= BIT(5);/* horizontal right */
                        /* push back to packet queue */
                        if (button_status != 0)
                                packet[3] = button_status;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 05689e732191..d3f5243fa093 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -743,6 +743,11 @@ int synaptics_init(struct psmouse *psmouse)
        return -1;
 }
+bool synaptics_supported(void)
+{
+        return true;
+}
 #else /* CONFIG_MOUSE_PS2_SYNAPTICS */
 void __init synaptics_module_init(void)
@@ -754,5 +759,10 @@ int synaptics_init(struct psmouse *psmouse)
        return -ENOSYS;
 }
+bool synaptics_supported(void)
+{
+        return false;
+}
 #endif /* CONFIG_MOUSE_PS2_SYNAPTICS */
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index 838e7f2c9b30..f0f40a331dc8 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -109,5 +109,6 @@ void synaptics_module_init(void);
 int synaptics_detect(struct psmouse *psmouse, bool set_properties);
 int synaptics_init(struct psmouse *psmouse);
 void synaptics_reset(struct psmouse *psmouse);
+bool synaptics_supported(void);
 #endif /* _SYNAPTICS_H */
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 64b688daf48a..2a5982e532f8 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -524,6 +524,13 @@ static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
 */
 static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
        {
+                /* Acer Aspire 5610 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5610"),
+                },
+        },
+        {
                /* Acer Aspire 5630 */
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index cebbd9079d53..d6ee28f6ea08 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -582,7 +582,6 @@ extern s32 e1000_read_phy_reg_hv_locked(struct e1000_hw *hw, u32 offset,
 extern s32 e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data);
 extern s32 e1000_write_phy_reg_hv_locked(struct e1000_hw *hw, u32 offset,
                                         u16 data);
-extern s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw, bool slow);
 extern s32 e1000_link_stall_workaround_hv(struct e1000_hw *hw);
 extern s32 e1000_copper_link_setup_82577(struct e1000_hw *hw);
 extern s32 e1000_check_polarity_82577(struct e1000_hw *hw);
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index ad08cf3f40c0..8b6ecd127889 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -138,6 +138,10 @@
 #define E1000_NVM_K1_CONFIG 0x1B /* NVM K1 Config Word */
 #define E1000_NVM_K1_ENABLE 0x1  /* NVM Enable K1 bit */
+/* KMRN Mode Control */
+#define HV_KMRN_MODE_CTRL      PHY_REG(769, 16)
+#define HV_KMRN_MDIO_SLOW      0x0400
 /* ICH GbE Flash Hardware Sequencing Flash Status Register bit breakdown */
 /* Offset 04h HSFSTS */
 union ich8_hws_flash_status {
@@ -219,6 +223,7 @@ static s32 e1000_set_lplu_state_pchlan(struct e1000_hw *hw, bool active);
 static void e1000_power_down_phy_copper_ich8lan(struct e1000_hw *hw);
 static void e1000_lan_init_done_ich8lan(struct e1000_hw *hw);
 static s32  e1000_k1_gig_workaround_hv(struct e1000_hw *hw, bool link);
+static s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw);
 static inline u16 __er16flash(struct e1000_hw *hw, unsigned long reg)
 {
@@ -270,7 +275,21 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
        phy->autoneg_mask             = AUTONEG_ADVERTISE_SPEED_DEFAULT;
        phy->id = e1000_phy_unknown;
-        e1000e_get_phy_id(hw);
+        ret_val = e1000e_get_phy_id(hw);
+        if (ret_val)
+                goto out;
+        if ((phy->id == 0) || (phy->id == PHY_REVISION_MASK)) {
+                /*
+                 * In case the PHY needs to be in mdio slow mode (eg. 82577),
+                 * set slow mode and try to get the PHY id again.
+                 */
+                ret_val = e1000_set_mdio_slow_mode_hv(hw);
+                if (ret_val)
+                        goto out;
+                ret_val = e1000e_get_phy_id(hw);
+                if (ret_val)
+                        goto out;
+        }
        phy->type = e1000e_get_phy_type_from_id(phy->id);
        switch (phy->type) {
@@ -292,6 +311,7 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
                break;
        }
+out:
        return ret_val;
 }
@@ -1076,16 +1096,44 @@ out:
 /**
+ *  e1000_set_mdio_slow_mode_hv - Set slow MDIO access mode
+ *  @hw:   pointer to the HW structure
+ **/
+static s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw)
+{
+        s32 ret_val;
+        u16 data;
+        ret_val = e1e_rphy(hw, HV_KMRN_MODE_CTRL, &data);
+        if (ret_val)
+                return ret_val;
+        data |= HV_KMRN_MDIO_SLOW;
+        ret_val = e1e_wphy(hw, HV_KMRN_MODE_CTRL, data);
+        return ret_val;
+}
+/**
 *  e1000_hv_phy_workarounds_ich8lan - A series of Phy workarounds to be
 *  done after every PHY reset.
 **/
 static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
 {
        s32 ret_val = 0;
+        u16 phy_data;
        if (hw->mac.type != e1000_pchlan)
                return ret_val;
+        /* Set MDIO slow mode before any other MDIO access */
+        if (hw->phy.type == e1000_phy_82577) {
+                ret_val = e1000_set_mdio_slow_mode_hv(hw);
+                if (ret_val)
+                        goto out;
+        }
        if (((hw->phy.type == e1000_phy_82577) &&
             ((hw->phy.revision == 1) || (hw->phy.revision == 2))) ||
            ((hw->phy.type == e1000_phy_82578) && (hw->phy.revision == 1))) {
@@ -1118,16 +1166,32 @@ static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
        hw->phy.addr = 1;
        ret_val = e1000e_write_phy_reg_mdic(hw, IGP01E1000_PHY_PAGE_SELECT, 0);
+        hw->phy.ops.release(hw);
        if (ret_val)
                goto out;
-        hw->phy.ops.release(hw);
        /*
         * Configure the K1 Si workaround during phy reset assuming there is
         * link so that it disables K1 if link is in 1Gbps.
         */
        ret_val = e1000_k1_gig_workaround_hv(hw, true);
+        if (ret_val)
+                goto out;
+        /* Workaround for link disconnects on a busy hub in half duplex */
+        ret_val = hw->phy.ops.acquire(hw);
+        if (ret_val)
+                goto out;
+        ret_val = hw->phy.ops.read_reg_locked(hw,
+                                              PHY_REG(BM_PORT_CTRL_PAGE, 17),
+                                              &phy_data);
+        if (ret_val)
+                goto release;
+        ret_val = hw->phy.ops.write_reg_locked(hw,
+                                               PHY_REG(BM_PORT_CTRL_PAGE, 17),
+                                               phy_data & 0x00FF);
+release:
+        hw->phy.ops.release(hw);
 out:
        return ret_val;
 }
@@ -1184,6 +1248,7 @@ static s32 e1000_phy_hw_reset_ich8lan(struct e1000_hw *hw)
        /* Allow time for h/w to get to a quiescent state after reset */
        mdelay(10);
+        /* Perform any necessary post-reset workarounds */
        if (hw->mac.type == e1000_pchlan) {
                ret_val = e1000_hv_phy_workarounds_ich8lan(hw);
                if (ret_val)
@@ -2484,6 +2549,10 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
        if (!ret_val)
                e1000_release_swflag_ich8lan(hw);
+        /* Perform any necessary post-reset workarounds */
+        if (hw->mac.type == e1000_pchlan)
+                ret_val = e1000_hv_phy_workarounds_ich8lan(hw);
        if (ctrl & E1000_CTRL_PHY_RST)
                ret_val = hw->phy.ops.get_cfg_done(hw);
@@ -2528,9 +2597,6 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
        kab |= E1000_KABGTXD_BGSQLBIAS;
        ew32(KABGTXD, kab);
-        if (hw->mac.type == e1000_pchlan)
-                ret_val = e1000_hv_phy_workarounds_ich8lan(hw);
 out:
        return ret_val;
 }
diff --git a/drivers/net/e1000e/phy.c b/drivers/net/e1000e/phy.c
index 55a2c0acfee7..7f3ceb9dad6a 100644
--- a/drivers/net/e1000e/phy.c
+++ b/drivers/net/e1000e/phy.c
@@ -152,32 +152,9 @@ s32 e1000e_get_phy_id(struct e1000_hw *hw)
                if (phy->id != 0 && phy->id != PHY_REVISION_MASK)
                        goto out;
-                /*
-                 * If the PHY ID is still unknown, we may have an 82577
-                 * without link.  We will try again after setting Slow MDIC
-                 * mode. No harm in trying again in this case since the PHY
-                 * ID is unknown at this point anyway.
-                 */
-                ret_val = phy->ops.acquire(hw);
-                if (ret_val)
-                        goto out;
-                ret_val = e1000_set_mdio_slow_mode_hv(hw, true);
-                if (ret_val)
-                        goto out;
-                phy->ops.release(hw);
                retry_count++;
        }
 out:
-        /* Revert to MDIO fast mode, if applicable */
-        if (retry_count) {
-                ret_val = phy->ops.acquire(hw);
-                if (ret_val)
-                        return ret_val;
-                ret_val = e1000_set_mdio_slow_mode_hv(hw, false);
-                phy->ops.release(hw);
-        }
        return ret_val;
 }
@@ -2791,38 +2768,6 @@ static s32 e1000_set_d0_lplu_state(struct e1000_hw *hw, bool active)
 }
 /**
- *  e1000_set_mdio_slow_mode_hv - Set slow MDIO access mode
- *  @hw:   pointer to the HW structure
- *  @slow: true for slow mode, false for normal mode
- *
- *  Assumes semaphore already acquired.
- **/
-s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw, bool slow)
-{
-        s32 ret_val = 0;
-        u16 data = 0;
-        /* Set MDIO mode - page 769, register 16: 0x2580==slow, 0x2180==fast */
-        hw->phy.addr = 1;
-        ret_val = e1000e_write_phy_reg_mdic(hw, IGP01E1000_PHY_PAGE_SELECT,
-                                         (BM_PORT_CTRL_PAGE << IGP_PAGE_SHIFT));
-        if (ret_val)
-                goto out;
-        ret_val = e1000e_write_phy_reg_mdic(hw, BM_CS_CTRL1,
-                                           (0x2180 | (slow << 10)));
-        if (ret_val)
-                goto out;
-        /* dummy read when reverting to fast mode - throw away result */
-        if (!slow)
-                ret_val = e1000e_read_phy_reg_mdic(hw, BM_CS_CTRL1, &data);
-out:
-        return ret_val;
-}
-/**
 *  __e1000_read_phy_reg_hv -  Read HV PHY register
 *  @hw: pointer to the HW structure
 *  @offset: register offset to be read
@@ -2839,7 +2784,6 @@ static s32 __e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data,
        s32 ret_val;
        u16 page = BM_PHY_REG_PAGE(offset);
        u16 reg = BM_PHY_REG_NUM(offset);
-        bool in_slow_mode = false;
        if (!locked) {
                ret_val = hw->phy.ops.acquire(hw);
@@ -2847,16 +2791,6 @@ static s32 __e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data,
                        return ret_val;
        }
-        /* Workaround failure in MDIO access while cable is disconnected */
-        if ((hw->phy.type == e1000_phy_82577) &&
-            !(er32(STATUS) & E1000_STATUS_LU)) {
-                ret_val = e1000_set_mdio_slow_mode_hv(hw, true);
-                if (ret_val)
-                        goto out;
-                in_slow_mode = true;
-        }
        /* Page 800 works differently than the rest so it has its own func */
        if (page == BM_WUC_PAGE) {
                ret_val = e1000_access_phy_wakeup_reg_bm(hw, offset,
@@ -2893,10 +2827,6 @@ static s32 __e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data,
        ret_val = e1000e_read_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & reg,
                                          data);
 out:
-        /* Revert to MDIO fast mode, if applicable */
-        if ((hw->phy.type == e1000_phy_82577) && in_slow_mode)
-                ret_val |= e1000_set_mdio_slow_mode_hv(hw, false);
        if (!locked)
                hw->phy.ops.release(hw);
@@ -2948,7 +2878,6 @@ static s32 __e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data,
        s32 ret_val;
        u16 page = BM_PHY_REG_PAGE(offset);
        u16 reg = BM_PHY_REG_NUM(offset);
-        bool in_slow_mode = false;
        if (!locked) {
                ret_val = hw->phy.ops.acquire(hw);
@@ -2956,16 +2885,6 @@ static s32 __e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data,
                        return ret_val;
        }
-        /* Workaround failure in MDIO access while cable is disconnected */
-        if ((hw->phy.type == e1000_phy_82577) &&
-            !(er32(STATUS) & E1000_STATUS_LU)) {
-                ret_val = e1000_set_mdio_slow_mode_hv(hw, true);
-                if (ret_val)
-                        goto out;
-                in_slow_mode = true;
-        }
        /* Page 800 works differently than the rest so it has its own func */
        if (page == BM_WUC_PAGE) {
                ret_val = e1000_access_phy_wakeup_reg_bm(hw, offset,
@@ -3019,10 +2938,6 @@ static s32 __e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data,
                                          data);
 out:
-        /* Revert to MDIO fast mode, if applicable */
-        if ((hw->phy.type == e1000_phy_82577) && in_slow_mode)
-                ret_val |= e1000_set_mdio_slow_mode_hv(hw, false);
        if (!locked)
                hw->phy.ops.release(hw);
diff --git a/drivers/net/ixgbe/Makefile b/drivers/net/ixgbe/Makefile
index 21b41f42b61c..bfef0ebcba9a 100644
--- a/drivers/net/ixgbe/Makefile
+++ b/drivers/net/ixgbe/Makefile
@@ -1,7 +1,7 @@
 ################################################################################
 #
 # Intel 10 Gigabit PCI Express Linux driver
-# Copyright(c) 1999 - 2009 Intel Corporation.
+# Copyright(c) 1999 - 2010 Intel Corporation.
 #
 # This program is free software; you can redistribute it and/or modify it
 # under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 8da8eb535084..303e7bd39b67 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index 204177d78cec..3103f4165311 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 538340527aa6..b49bd6b9feb7 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_common.c b/drivers/net/ixgbe/ixgbe_common.c
index 688b8ca5da32..21f158f79dd0 100644
--- a/drivers/net/ixgbe/ixgbe_common.c
+++ b/drivers/net/ixgbe/ixgbe_common.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_common.h b/drivers/net/ixgbe/ixgbe_common.h
index 27f3214bed2e..dfff0ffaa502 100644
--- a/drivers/net/ixgbe/ixgbe_common.h
+++ b/drivers/net/ixgbe/ixgbe_common.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb.c b/drivers/net/ixgbe/ixgbe_dcb.c
index a1562287342f..9aea4f04bbd2 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.c
+++ b/drivers/net/ixgbe/ixgbe_dcb.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb.h b/drivers/net/ixgbe/ixgbe_dcb.h
index 64a9fa15c059..5caafd4afbc3 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.h
+++ b/drivers/net/ixgbe/ixgbe_dcb.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ixgbe/ixgbe_dcb_82598.c
index f30263898ebc..f0e9279d4669 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82598.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82598.h b/drivers/net/ixgbe/ixgbe_dcb_82598.h
index ebbe53c352a7..cc728fa092e2 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82598.h
+++ b/drivers/net/ixgbe/ixgbe_dcb_82598.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.c b/drivers/net/ixgbe/ixgbe_dcb_82599.c
index ec8a252636d3..4f7a26ab411e 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.h b/drivers/net/ixgbe/ixgbe_dcb_82599.h
index 9e5e2827e4af..0f3f791e1e1d 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.h
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index 3c7a79a7d7c6..56f37f66b696 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 0bd49d3b9f65..d77961fc75f9 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index da32a108a7b4..e9a20c88c155 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.h b/drivers/net/ixgbe/ixgbe_fcoe.h
index de8ff53187da..abf4b2b3f252 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.h
+++ b/drivers/net/ixgbe/ixgbe_fcoe.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 2ad754c864cf..9c9202f40b10 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
@@ -52,7 +52,7 @@ static const char ixgbe_driver_string[] =
 #define DRV_VERSION "2.0.44-k2"
 const char ixgbe_driver_version[] = DRV_VERSION;
-static char ixgbe_copyright[] = "Copyright (c) 1999-2009 Intel Corporation.";
+static char ixgbe_copyright[] = "Copyright (c) 1999-2010 Intel Corporation.";
 static const struct ixgbe_info *ixgbe_info_tbl[] = {
        [board_82598] = &ixgbe_82598_info,
@@ -5576,6 +5576,10 @@ static void ixgbe_netpoll(struct net_device *netdev)
        struct ixgbe_adapter *adapter = netdev_priv(netdev);
        int i;
+        /* if interface is down do nothing */
+        if (test_bit(__IXGBE_DOWN, &adapter->state))
+                return;
        adapter->flags |= IXGBE_FLAG_IN_NETPOLL;
        if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
                int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
diff --git a/drivers/net/ixgbe/ixgbe_phy.c b/drivers/net/ixgbe/ixgbe_phy.c
index 9ecad17522c3..1c1efd386956 100644
--- a/drivers/net/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ixgbe/ixgbe_phy.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_phy.h b/drivers/net/ixgbe/ixgbe_phy.h
index 9b700f5bf1ed..9cf5f3b4cc5d 100644
--- a/drivers/net/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ixgbe/ixgbe_phy.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 84650c6ebe03..9eafddfa1b97 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
  This program is free software; you can redistribute it and/or modify it
  under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 683353b904c7..0d4eba7266ec 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -142,8 +142,9 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                if (spins != 0) {
                        --spins;
                        udelay(1);
-                } else
+                } else {
-                        schedule();
+                        schedule_timeout_uninterruptible(1);
+                }
                time = get_seconds();
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index af3933579790..250c8827b842 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -79,10 +79,14 @@ struct efx_loopback_state {
 static int efx_test_mdio(struct efx_nic *efx, struct efx_self_tests *tests)
 {
        int rc = 0;
-        int devad = __ffs(efx->mdio.mmds);
+        int devad;
        u16 physid1, physid2;
-        if (efx->phy_type == PHY_TYPE_NONE)
+        if (efx->mdio.mode_support & MDIO_SUPPORTS_C45)
+                devad = __ffs(efx->mdio.mmds);
+        else if (efx->mdio.mode_support & MDIO_SUPPORTS_C22)
+                devad = MDIO_DEVAD_NONE;
+        else
                return 0;
        mutex_lock(&efx->mac_lock);
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 3a74d2168598..7f82b0238e08 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4,7 +4,7 @@
 * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
 * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik@pobox.com)
 * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2005-2009 Broadcom Corporation.
+ * Copyright (C) 2005-2010 Broadcom Corporation.
 *
 * Firmware is:
 *      Derived from proprietary unpublished source code,
@@ -68,8 +68,8 @@
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.105"
+#define DRV_MODULE_VERSION      "3.106"
-#define DRV_MODULE_RELDATE      "December 2, 2009"
+#define DRV_MODULE_RELDATE      "January 12, 2010"
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -1037,7 +1037,11 @@ static void tg3_mdio_start(struct tg3 *tp)
                else
                        tp->phy_addr = 1;
-                is_serdes = tr32(SG_DIG_STATUS) & SG_DIG_IS_SERDES;
+                if (tp->pci_chip_rev_id != CHIPREV_ID_5717_A0)
+                        is_serdes = tr32(SG_DIG_STATUS) & SG_DIG_IS_SERDES;
+                else
+                        is_serdes = tr32(TG3_CPMU_PHY_STRAP) &
+                                    TG3_CPMU_PHY_STRAP_IS_SERDES;
                if (is_serdes)
                        tp->phy_addr += 7;
        } else
@@ -4693,8 +4697,9 @@ next_pkt:
                (*post_ptr)++;
                if (unlikely(rx_std_posted >= tp->rx_std_max_post)) {
-                        u32 idx = *post_ptr % TG3_RX_RING_SIZE;
+                        tpr->rx_std_prod_idx = std_prod_idx % TG3_RX_RING_SIZE;
-                        tw32_rx_mbox(TG3_RX_STD_PROD_IDX_REG, idx);
+                        tw32_rx_mbox(TG3_RX_STD_PROD_IDX_REG,
+                                     tpr->rx_std_prod_idx);
                        work_mask &= ~RXD_OPAQUE_RING_STD;
                        rx_std_posted = 0;
                }
@@ -7742,7 +7747,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
             ((u64) tpr->rx_std_mapping >> 32));
        tw32(RCVDBDI_STD_BD + TG3_BDINFO_HOST_ADDR + TG3_64BIT_REG_LOW,
             ((u64) tpr->rx_std_mapping & 0xffffffff));
-        if (!(tp->tg3_flags3 & TG3_FLG3_5755_PLUS))
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5717)
                tw32(RCVDBDI_STD_BD + TG3_BDINFO_NIC_ADDR,
                     NIC_SRAM_RX_BUFFER_DESC);
@@ -12122,7 +12127,8 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
                tp->phy_id = eeprom_phy_id;
                if (eeprom_phy_serdes) {
-                        if (tp->tg3_flags2 & TG3_FLG2_5780_CLASS)
+                        if ((tp->tg3_flags2 & TG3_FLG2_5780_CLASS) ||
+                            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717)
                                tp->tg3_flags2 |= TG3_FLG2_MII_SERDES;
                        else
                                tp->tg3_flags2 |= TG3_FLG2_PHY_SERDES;
@@ -13384,6 +13390,11 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
        if (err)
                return err;
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 &&
+            (tp->pci_chip_rev_id != CHIPREV_ID_5717_A0 ||
+                 (tp->tg3_flags2 & TG3_FLG2_MII_SERDES)))
+                return -ENOTSUPP;
        /* Initialize data/descriptor byte/word swapping. */
        val = tr32(GRC_MODE);
        val &= GRC_MODE_HOST_STACKUP;
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index cd30889650f8..8a167912902b 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -4,6 +4,7 @@
 * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
 * Copyright (C) 2001 Jeff Garzik (jgarzik@pobox.com)
 * Copyright (C) 2004 Sun Microsystems Inc.
+ * Copyright (C) 2007-2010 Broadcom Corporation.
 */
 #ifndef _T3_H
@@ -1054,6 +1055,8 @@
 #define  CPMU_MUTEX_REQ_DRIVER           0x00001000
 #define TG3_CPMU_MUTEX_GNT              0x00003660
 #define  CPMU_MUTEX_GNT_DRIVER           0x00001000
+#define TG3_CPMU_PHY_STRAP              0x00003664
+#define TG3_CPMU_PHY_STRAP_IS_SERDES     0x00000020
 /* 0x3664 --> 0x3800 unused */
 /* Mbuf cluster free registers */
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 5d1c8677f180..6a3f4da7fb48 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -97,7 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
        int ret;
        u16 val;
-        u32 cksum, offset;
+        u32 cksum, offset, eep_max = AR5K_EEPROM_INFO_MAX;
        /*
         * Read values from EEPROM and store them in the capability structure
@@ -116,12 +116,38 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
         * Validate the checksum of the EEPROM date. There are some
         * devices with invalid EEPROMs.
         */
-        for (cksum = 0, offset = 0; offset < AR5K_EEPROM_INFO_MAX; offset++) {
+        AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_UPPER, val);
+        if (val) {
+                eep_max = (val & AR5K_EEPROM_SIZE_UPPER_MASK) <<
+                           AR5K_EEPROM_SIZE_ENDLOC_SHIFT;
+                AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_LOWER, val);
+                eep_max = (eep_max | val) - AR5K_EEPROM_INFO_BASE;
+                /*
+                 * Fail safe check to prevent stupid loops due
+                 * to busted EEPROMs. XXX: This value is likely too
+                 * big still, waiting on a better value.
+                 */
+                if (eep_max > (3 * AR5K_EEPROM_INFO_MAX)) {
+                        ATH5K_ERR(ah->ah_sc, "Invalid max custom EEPROM size: "
+                                  "%d (0x%04x) max expected: %d (0x%04x)\n",
+                                  eep_max, eep_max,
+                                  3 * AR5K_EEPROM_INFO_MAX,
+                                  3 * AR5K_EEPROM_INFO_MAX);
+                        return -EIO;
+                }
+        }
+        for (cksum = 0, offset = 0; offset < eep_max; offset++) {
                AR5K_EEPROM_READ(AR5K_EEPROM_INFO(offset), val);
                cksum ^= val;
        }
        if (cksum != AR5K_EEPROM_INFO_CKSUM) {
-                ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum);
+                ATH5K_ERR(ah->ah_sc, "Invalid EEPROM "
+                          "checksum: 0x%04x eep_max: 0x%04x (%s)\n",
+                          cksum, eep_max,
+                          eep_max == AR5K_EEPROM_INFO_MAX ?
+                                "default size" : "custom size");
                return -EIO;
        }
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index 0123f3521a0b..473a483bb9c3 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -37,6 +37,14 @@
 #define AR5K_EEPROM_RFKILL_POLARITY_S   1
 #define AR5K_EEPROM_REG_DOMAIN          0x00bf  /* EEPROM regdom */
+/* FLASH(EEPROM) Defines for AR531X chips */
+#define AR5K_EEPROM_SIZE_LOWER          0x1b /* size info -- lower */
+#define AR5K_EEPROM_SIZE_UPPER          0x1c /* size info -- upper */
+#define AR5K_EEPROM_SIZE_UPPER_MASK     0xfff0
+#define AR5K_EEPROM_SIZE_UPPER_SHIFT    4
+#define AR5K_EEPROM_SIZE_ENDLOC_SHIFT   12
 #define AR5K_EEPROM_CHECKSUM            0x00c0  /* EEPROM checksum */
 #define AR5K_EEPROM_INFO_BASE           0x00c0  /* EEPROM header */
 #define AR5K_EEPROM_INFO_MAX            (0x400 - AR5K_EEPROM_INFO_BASE)
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 03a1106ad725..5774cea23a3b 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -25,7 +25,7 @@ config ATH9K
 config ATH9K_DEBUGFS
        bool "Atheros ath9k debugging"
-        depends on ATH9K
+        depends on ATH9K && DEBUG_FS
        ---help---
          Say Y, if you need access to ath9k's statistics for
          interrupts, rate control, etc.
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index e2cef2ff5d8f..1597a42731ed 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -33,11 +33,11 @@ struct ath_node;
 /* Macro to expand scalars to 64-bit objects */
-#define ito64(x) (sizeof(x) == 8) ?                     \
+#define ito64(x) (sizeof(x) == 1) ?                     \
        (((unsigned long long int)(x)) & (0xff)) :      \
-        (sizeof(x) == 16) ?                             \
+        (sizeof(x) == 2) ?                              \
        (((unsigned long long int)(x)) & 0xffff) :      \
-        ((sizeof(x) == 32) ?                            \
+        ((sizeof(x) == 4) ?                             \
         (((unsigned long long int)(x)) & 0xffffffff) : \
         (unsigned long long int)(x))
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 484c5fdf7c2a..9b4b8b5c7574 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -1961,7 +1961,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
        struct ieee80211_tx_info *info;
        struct iwl4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
        u32  status = le32_to_cpu(tx_resp->u.status);
-        int tid = MAX_TID_COUNT;
+        int uninitialized_var(tid);
        int sta_id;
        int freed;
        u8 *qc = NULL;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 574d36658702..5461f105bd2d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2344,6 +2344,21 @@ static void iwl_ht_conf(struct iwl_priv *priv,
        IWL_DEBUG_MAC80211(priv, "leave\n");
 }
+static inline void iwl_set_no_assoc(struct iwl_priv *priv)
+{
+        priv->assoc_id = 0;
+        iwl_led_disassociate(priv);
+        /*
+         * inform the ucode that there is no longer an
+         * association and that no more packets should be
+         * sent
+         */
+        priv->staging_rxon.filter_flags &=
+                ~RXON_FILTER_ASSOC_MSK;
+        priv->staging_rxon.assoc_id = 0;
+        iwlcore_commit_rxon(priv);
+}
 #define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
                          struct ieee80211_vif *vif,
@@ -2475,20 +2490,8 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                                        IWL_DELAY_NEXT_SCAN_AFTER_ASSOC;
                        if (!iwl_is_rfkill(priv))
                                priv->cfg->ops->lib->post_associate(priv);
-                } else {
+                } else
-                        priv->assoc_id = 0;
+                        iwl_set_no_assoc(priv);
-                        iwl_led_disassociate(priv);
-                        /*
-                         * inform the ucode that there is no longer an
-                         * association and that no more packets should be
-                         * send
-                         */
-                        priv->staging_rxon.filter_flags &=
-                                ~RXON_FILTER_ASSOC_MSK;
-                        priv->staging_rxon.assoc_id = 0;
-                        iwlcore_commit_rxon(priv);
-                }
        }
        if (changes && iwl_is_associated(priv) && priv->assoc_id) {
@@ -2503,12 +2506,14 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                }
        }
-        if ((changes & BSS_CHANGED_BEACON_ENABLED) &&
+        if (changes & BSS_CHANGED_BEACON_ENABLED) {
-            vif->bss_conf.enable_beacon) {
+                if (vif->bss_conf.enable_beacon) {
-                memcpy(priv->staging_rxon.bssid_addr,
+                        memcpy(priv->staging_rxon.bssid_addr,
-                       bss_conf->bssid, ETH_ALEN);
+                               bss_conf->bssid, ETH_ALEN);
-                memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
+                        memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
-                iwlcore_config_ap(priv);
+                        iwlcore_config_ap(priv);
+                } else
+                        iwl_set_no_assoc(priv);
        }
        mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 165d1f6e2dd9..3822cf53e368 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -711,7 +711,7 @@ extern void iwl_txq_ctx_stop(struct iwl_priv *priv);
 extern int iwl_queue_space(const struct iwl_queue *q);
 static inline int iwl_queue_used(const struct iwl_queue *q, int i)
 {
-        return q->write_ptr > q->read_ptr ?
+        return q->write_ptr >= q->read_ptr ?
                (i >= q->read_ptr && i < q->write_ptr) :
                !(i < q->read_ptr && i >= q->write_ptr);
 }
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 59d49159cf2a..59f92105b0c2 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -3157,8 +3157,10 @@ static void mwl8k_configure_filter(struct ieee80211_hw *hw,
        /* Clear unsupported feature flags */
        *total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
-        if (mwl8k_fw_lock(hw))
+        if (mwl8k_fw_lock(hw)) {
+                kfree(cmd);
                return;
+        }
        if (priv->sniffer_enabled) {
                mwl8k_enable_sniffer(hw, 0);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 27bf887f1453..9deae41cb784 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -340,7 +340,7 @@ static int rt2800_blink_set(struct led_classdev *led_cdev,
        rt2x00_set_field32(&reg, LED_CFG_OFF_PERIOD, *delay_off);
        rt2x00_set_field32(&reg, LED_CFG_SLOW_BLINK_PERIOD, 3);
        rt2x00_set_field32(&reg, LED_CFG_R_LED_MODE, 3);
-        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 12);
+        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 3);
        rt2x00_set_field32(&reg, LED_CFG_Y_LED_MODE, 3);
        rt2x00_set_field32(&reg, LED_CFG_LED_POLAR, 1);
        rt2800_register_write(led->rt2x00dev, LED_CFG, reg);
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 4d841c07c970..dcfc8c25d1a7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -113,6 +113,12 @@
        (  ((unsigned long)((__skb)->data + (__header))) & 3 )
 /*
+ * Constants for extra TX headroom for alignment purposes.
+ */
+#define RT2X00_ALIGN_SIZE       4 /* Only whole frame needs alignment */
+#define RT2X00_L2PAD_SIZE       8 /* Both header & payload need alignment */
+/*
 * Standard timing and size defines.
 * These values should follow the ieee80211 specifications.
 */
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 06c43ca39bf8..265e66dba552 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -686,7 +686,17 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
        /*
         * Initialize extra TX headroom required.
         */
-        rt2x00dev->hw->extra_tx_headroom = rt2x00dev->ops->extra_tx_headroom;
+        rt2x00dev->hw->extra_tx_headroom =
+                max_t(unsigned int, IEEE80211_TX_STATUS_HEADROOM,
+                      rt2x00dev->ops->extra_tx_headroom);
+        /*
+         * Take TX headroom required for alignment into account.
+         */
+        if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
+        else if (test_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
        /*
         * Register HW.
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 239afc7a9c0b..9915a09141ef 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -104,7 +104,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
         * is also mapped to the DMA so it can be used for transfering
         * additional descriptor information to the hardware.
         */
-        skb_push(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_push(skb, rt2x00dev->ops->extra_tx_headroom);
        skbdesc->skb_dma =
            dma_map_single(rt2x00dev->dev, skb->data, skb->len, DMA_TO_DEVICE);
@@ -112,7 +112,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
        /*
         * Restore data pointer to original location again.
         */
-        skb_pull(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_pull(skb, rt2x00dev->ops->extra_tx_headroom);
        skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
 }
@@ -134,7 +134,7 @@ void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
                 * by the driver, but it was actually mapped to DMA.
                 */
                dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma,
-                                 skb->len + rt2x00dev->hw->extra_tx_headroom,
+                                 skb->len + rt2x00dev->ops->extra_tx_headroom,
                                 DMA_TO_DEVICE);
                skbdesc->flags &= ~SKBDESC_DMA_MAPPED_TX;
        }
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 8ebf5c33955d..f14deb0c8514 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -987,12 +987,13 @@ static void zd_op_configure_filter(struct ieee80211_hw *hw,
        changed_flags &= SUPPORTED_FIF_FLAGS;
        *new_flags &= SUPPORTED_FIF_FLAGS;
-        /* changed_flags is always populated but this driver
+        /*
-         * doesn't support all FIF flags so its possible we don't
+         * If multicast parameter (as returned by zd_op_prepare_multicast)
-         * need to do anything */
+         * has changed, no bit in changed_flags is set. To handle this
-        if (!changed_flags)
+         * situation, we do not return if changed_flags is 0. If we do so,
-                return;
+         * we will have some issue with IPv6 which uses multicast for link
+         * layer address resolution.
+         */
        if (*new_flags & (FIF_PROMISC_IN_BSS | FIF_ALLMULTI))
                zd_mc_add_all(&hash);
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 5819dc02a143..1c500c462225 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -23,6 +23,7 @@
 #include <asm/debug.h>
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
+#include <asm/compat.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/cio.h>
@@ -2844,13 +2845,16 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
        rc = -EFAULT;
        if (copy_from_user(&usrparm, argp, sizeof(usrparm)))
                goto out;
-#ifndef CONFIG_64BIT
+        if (is_compat_task() || sizeof(long) == 4) {
-        /* Make sure pointers are sane even on 31 bit. */
+                /* Make sure pointers are sane even on 31 bit. */
-        if ((usrparm.psf_data >> 32) != 0 || (usrparm.rssd_result >> 32) != 0) {
                rc = -EINVAL;
-                goto out;
+                if ((usrparm.psf_data >> 32) != 0)
+                        goto out;
+                if ((usrparm.rssd_result >> 32) != 0)
+                        goto out;
+                usrparm.psf_data &= 0x7fffffffULL;
+                usrparm.rssd_result &= 0x7fffffffULL;
        }
-#endif
        /* alloc I/O data area */
        psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
        rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 478bcdb90b6f..fc7b30b4a255 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -17,7 +17,7 @@
 #include <linux/fs.h>
 #include <linux/blkpg.h>
 #include <linux/smp_lock.h>
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include <asm/cmb.h>
 #include <asm/uaccess.h>
@@ -358,9 +358,8 @@ dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
 }
 static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
-                unsigned long arg)
+                                  struct cmbdata __user *argp)
 {
-        struct cmbdata __user *argp = (void __user *) arg;
        size_t size = _IOC_SIZE(cmd);
        struct cmbdata data;
        int ret;
@@ -376,7 +375,12 @@ dasd_do_ioctl(struct block_device *bdev, fmode_t mode,
              unsigned int cmd, unsigned long arg)
 {
        struct dasd_block *block = bdev->bd_disk->private_data;
-        void __user *argp = (void __user *)arg;
+        void __user *argp;
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (void __user *)arg;
        if (!block)
                return -ENODEV;
@@ -414,7 +418,7 @@ dasd_do_ioctl(struct block_device *bdev, fmode_t mode,
        case BIODASDCMFDISABLE:
                return disable_cmf(block->base->cdev);
        case BIODASDREADALLCMB:
-                return dasd_ioctl_readall_cmb(block, cmd, arg);
+                return dasd_ioctl_readall_cmb(block, cmd, argp);
        default:
                /* if the discipline has an ioctl method try it. */
                if (block->base->discipline->ioctl) {
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 9d61683b5633..59ec073724bf 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -1037,22 +1037,6 @@ static void tty3215_flush_buffer(struct tty_struct *tty)
 }
 /*
- * Currently we don't have any io controls for 3215 ttys
- */
-static int tty3215_ioctl(struct tty_struct *tty, struct file * file,
-                         unsigned int cmd, unsigned long arg)
-{
-        if (tty->flags & (1 << TTY_IO_ERROR))
-                return -EIO;
-        switch (cmd) {
-        default:
-                return -ENOIOCTLCMD;
-        }
-        return 0;
-}
-/*
 * Disable reading from a 3215 tty
 */
 static void tty3215_throttle(struct tty_struct * tty)
@@ -1117,7 +1101,6 @@ static const struct tty_operations tty3215_ops = {
        .write_room = tty3215_write_room,
        .chars_in_buffer = tty3215_chars_in_buffer,
        .flush_buffer = tty3215_flush_buffer,
-        .ioctl = tty3215_ioctl,
        .throttle = tty3215_throttle,
        .unthrottle = tty3215_unthrottle,
        .stop = tty3215_stop,
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index 247b2b934728..31c59b0d6df0 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -15,6 +15,7 @@
 #include <linux/types.h>
 #include <linux/smp_lock.h>
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include <asm/cio.h>
 #include <asm/ebcdic.h>
@@ -322,6 +323,7 @@ fs3270_write(struct file *filp, const char __user *data, size_t count, loff_t *o
 static long
 fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
+        char __user *argp;
        struct fs3270 *fp;
        struct raw3270_iocb iocb;
        int rc;
@@ -329,6 +331,10 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        fp = filp->private_data;
        if (!fp)
                return -ENODEV;
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (char __user *)arg;
        rc = 0;
        mutex_lock(&fs3270_mutex);
        switch (cmd) {
@@ -339,10 +345,10 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                fp->write_command = arg;
                break;
        case TUBGETI:
-                rc = put_user(fp->read_command, (char __user *) arg);
+                rc = put_user(fp->read_command, argp);
                break;
        case TUBGETO:
-                rc = put_user(fp->write_command,(char __user *) arg);
+                rc = put_user(fp->write_command, argp);
                break;
        case TUBGETMOD:
                iocb.model = fp->view.model;
@@ -351,8 +357,7 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                iocb.pf_cnt = 24;
                iocb.re_cnt = 20;
                iocb.map = 0;
-                if (copy_to_user((char __user *) arg, &iocb,
+                if (copy_to_user(argp, &iocb, sizeof(struct raw3270_iocb)))
-                                 sizeof(struct raw3270_iocb)))
                        rc = -EFAULT;
                break;
        }
@@ -511,8 +516,8 @@ static const struct file_operations fs3270_fops = {
        .write           = fs3270_write,        /* write */
        .unlocked_ioctl  = fs3270_ioctl,        /* ioctl */
        .compat_ioctl    = fs3270_ioctl,        /* ioctl */
-        .open           = fs3270_open,          /* open */
+        .open            = fs3270_open,         /* open */
-        .release        = fs3270_close,         /* release */
+        .release         = fs3270_close,        /* release */
 };
 /*
diff --git a/drivers/s390/char/tape_block.c b/drivers/s390/char/tape_block.c
index 96816149368a..8d3d720737da 100644
--- a/drivers/s390/char/tape_block.c
+++ b/drivers/s390/char/tape_block.c
@@ -46,8 +46,6 @@
 */
 static int tapeblock_open(struct block_device *, fmode_t);
 static int tapeblock_release(struct gendisk *, fmode_t);
-static int tapeblock_ioctl(struct block_device *, fmode_t, unsigned int,
-                                unsigned long);
 static int tapeblock_medium_changed(struct gendisk *);
 static int tapeblock_revalidate_disk(struct gendisk *);
@@ -55,7 +53,6 @@ static const struct block_device_operations tapeblock_fops = {
        .owner           = THIS_MODULE,
        .open            = tapeblock_open,
        .release         = tapeblock_release,
-        .ioctl           = tapeblock_ioctl,
        .media_changed   = tapeblock_medium_changed,
        .revalidate_disk = tapeblock_revalidate_disk,
 };
@@ -416,42 +413,6 @@ tapeblock_release(struct gendisk *disk, fmode_t mode)
 }
 /*
- * Support of some generic block device IOCTLs.
- */
-static int
-tapeblock_ioctl(
-        struct block_device *   bdev,
-        fmode_t                 mode,
-        unsigned int            command,
-        unsigned long           arg
-) {
-        int rc;
-        int minor;
-        struct gendisk *disk = bdev->bd_disk;
-        struct tape_device *device;
-        rc     = 0;
-        BUG_ON(!disk);
-        device = disk->private_data;
-        BUG_ON(!device);
-        minor  = MINOR(bdev->bd_dev);
-        DBF_LH(6, "tapeblock_ioctl(0x%0x)\n", command);
-        DBF_LH(6, "device = %d:%d\n", tapeblock_major, minor);
-        switch (command) {
-                /* Refuse some IOCTL calls without complaining (mount). */
-                case 0x5310:            /* CDROMMULTISESSION */
-                        rc = -EINVAL;
-                        break;
-                default:
-                        rc = -EINVAL;
-        }
-        return rc;
-}
-/*
 * Initialize block device frontend.
 */
 int
diff --git a/drivers/s390/char/tape_char.c b/drivers/s390/char/tape_char.c
index 2125ec7d95f0..539045acaad4 100644
--- a/drivers/s390/char/tape_char.c
+++ b/drivers/s390/char/tape_char.c
@@ -18,6 +18,7 @@
 #include <linux/proc_fs.h>
 #include <linux/mtio.h>
 #include <linux/smp_lock.h>
+#include <linux/compat.h>
 #include <asm/uaccess.h>
@@ -37,8 +38,9 @@ static ssize_t tapechar_write(struct file *, const char __user *, size_t, loff_t
 static int tapechar_open(struct inode *,struct file *);
 static int tapechar_release(struct inode *,struct file *);
 static long tapechar_ioctl(struct file *, unsigned int, unsigned long);
-static long tapechar_compat_ioctl(struct file *, unsigned int,
+#ifdef CONFIG_COMPAT
-                          unsigned long);
+static long tapechar_compat_ioctl(struct file *, unsigned int, unsigned long);
+#endif
 static const struct file_operations tape_fops =
 {
@@ -46,7 +48,9 @@ static const struct file_operations tape_fops =
        .read = tapechar_read,
        .write = tapechar_write,
        .unlocked_ioctl = tapechar_ioctl,
+#ifdef CONFIG_COMPAT
        .compat_ioctl = tapechar_compat_ioctl,
+#endif
        .open = tapechar_open,
        .release = tapechar_release,
 };
@@ -457,15 +461,22 @@ tapechar_ioctl(struct file *filp, unsigned int no, unsigned long data)
        return rc;
 }
+#ifdef CONFIG_COMPAT
 static long
 tapechar_compat_ioctl(struct file *filp, unsigned int no, unsigned long data)
 {
        struct tape_device *device = filp->private_data;
        int rval = -ENOIOCTLCMD;
+        unsigned long argp;
+        /* The 'arg' argument of any ioctl function may only be used for
+         * pointers because of the compat pointer conversion.
+         * Consider this when adding new ioctls.
+         */
+        argp = (unsigned long) compat_ptr(data);
        if (device->discipline->ioctl_fn) {
                mutex_lock(&device->mutex);
-                rval = device->discipline->ioctl_fn(device, no, data);
+                rval = device->discipline->ioctl_fn(device, no, argp);
                mutex_unlock(&device->mutex);
                if (rval == -EINVAL)
                        rval = -ENOIOCTLCMD;
@@ -473,6 +484,7 @@ tapechar_compat_ioctl(struct file *filp, unsigned int no, unsigned long data)
        return rval;
 }
+#endif /* CONFIG_COMPAT */
 /*
 * Initialize character device frontend.
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index a6087cec55b4..921dcda77676 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
+#include <asm/compat.h>
 #include <asm/cpcmd.h>
 #include <asm/debug.h>
 #include <asm/uaccess.h>
@@ -139,21 +140,26 @@ vmcp_write(struct file *file, const char __user *buff, size_t count,
 static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
        struct vmcp_session *session;
+        int __user *argp;
        int temp;
        session = (struct vmcp_session *)file->private_data;
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (int __user *)arg;
        if (mutex_lock_interruptible(&session->mutex))
                return -ERESTARTSYS;
        switch (cmd) {
        case VMCP_GETCODE:
                temp = session->resp_code;
                mutex_unlock(&session->mutex);
-                return put_user(temp, (int __user *)arg);
+                return put_user(temp, argp);
        case VMCP_SETBUF:
                free_pages((unsigned long)session->response,
                                get_order(session->bufsize));
                session->response=NULL;
-                temp = get_user(session->bufsize, (int __user *)arg);
+                temp = get_user(session->bufsize, argp);
                if (get_order(session->bufsize) > 8) {
                        session->bufsize = PAGE_SIZE;
                        temp = -EINVAL;
@@ -163,7 +169,7 @@ static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case VMCP_GETSIZE:
                temp = session->resp_size;
                mutex_unlock(&session->mutex);
-                return put_user(temp, (int __user *)arg);
+                return put_user(temp, argp);
        default:
                mutex_unlock(&session->mutex);
                return -ENOIOCTLCMD;
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index cc5144b6f9d9..c84ac9443079 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -12,6 +12,7 @@
 #include <linux/uaccess.h>
 #include <linux/miscdevice.h>
+#include <asm/compat.h>
 #include <asm/cio.h>
 #include <asm/chsc.h>
 #include <asm/isc.h>
@@ -770,24 +771,30 @@ out_free:
 static long chsc_ioctl(struct file *filp, unsigned int cmd,
                       unsigned long arg)
 {
+        void __user *argp;
        CHSC_MSG(2, "chsc_ioctl called, cmd=%x\n", cmd);
+        if (is_compat_task())
+                argp = compat_ptr(arg);
+        else
+                argp = (void __user *)arg;
        switch (cmd) {
        case CHSC_START:
-                return chsc_ioctl_start((void __user *)arg);
+                return chsc_ioctl_start(argp);
        case CHSC_INFO_CHANNEL_PATH:
-                return chsc_ioctl_info_channel_path((void __user *)arg);
+                return chsc_ioctl_info_channel_path(argp);
        case CHSC_INFO_CU:
-                return chsc_ioctl_info_cu((void __user *)arg);
+                return chsc_ioctl_info_cu(argp);
        case CHSC_INFO_SCH_CU:
-                return chsc_ioctl_info_sch_cu((void __user *)arg);
+                return chsc_ioctl_info_sch_cu(argp);
        case CHSC_INFO_CI:
-                return chsc_ioctl_conf_info((void __user *)arg);
+                return chsc_ioctl_conf_info(argp);
        case CHSC_INFO_CCL:
-                return chsc_ioctl_conf_comp_list((void __user *)arg);
+                return chsc_ioctl_conf_comp_list(argp);
        case CHSC_INFO_CPD:
-                return chsc_ioctl_chpd((void __user *)arg);
+                return chsc_ioctl_chpd(argp);
        case CHSC_INFO_DCAL:
-                return chsc_ioctl_dcal((void __user *)arg);
+                return chsc_ioctl_dcal(argp);
        default: /* unknown ioctl number */
                return -ENOIOCTLCMD;
        }
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 0d4d18bdd45c..c68be24e27d9 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -393,10 +393,12 @@ static long zcrypt_rsa_crt(struct ica_rsa_modexpo_crt *crt)
                         * u_mult_inv > 128 bytes.
                         */
                        if (copied == 0) {
-                                int len;
+                                unsigned int len;
                                spin_unlock_bh(&zcrypt_device_lock);
                                /* len is max 256 / 2 - 120 = 8 */
                                len = crt->inputdatalength / 2 - 120;
+                                if (len > sizeof(z1))
+                                        return -EFAULT;
                                z1 = z2 = z3 = 0;
                                if (copy_from_user(&z1, crt->np_prime, len) ||
                                    copy_from_user(&z2, crt->bp_key, len) ||
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 37f0de9dd9ce..42f3333c4ad0 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -1052,7 +1052,18 @@ static void __devinit sci_init_single(struct platform_device *dev,
        sci_port->port.ops      = &sci_uart_ops;
        sci_port->port.iotype   = UPIO_MEM;
        sci_port->port.line     = index;
-        sci_port->port.fifosize = 1;
+        switch (p->type) {
+        case PORT_SCIFA:
+                sci_port->port.fifosize = 64;
+                break;
+        case PORT_SCIF:
+                sci_port->port.fifosize = 16;
+                break;
+        default:
+                sci_port->port.fifosize = 1;
+                break;
+        }
        if (dev) {
                sci_port->iclk = p->clk ? clk_get(&dev->dev, p->clk) : NULL;
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index c4997930afc7..5d42d55e299b 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -102,15 +102,15 @@ static void do_suspend(void)
                goto out_thaw;
        }
+        printk(KERN_DEBUG "suspending xenstore...\n");
+        xs_suspend();
        err = dpm_suspend_noirq(PMSG_SUSPEND);
        if (err) {
                printk(KERN_ERR "dpm_suspend_noirq failed: %d\n", err);
                goto out_resume;
        }
-        printk(KERN_DEBUG "suspending xenstore...\n");
-        xs_suspend();
        err = stop_machine(xen_suspend, &cancelled, cpumask_of(0));
        dpm_resume_noirq(PMSG_RESUME);
@@ -120,13 +120,13 @@ static void do_suspend(void)
                cancelled = 1;
        }
+out_resume:
        if (!cancelled) {
                xen_arch_resume();
                xs_resume();
        } else
                xs_suspend_cancel();
-out_resume:
        dpm_resume_end(PMSG_RESUME);
        /* Make sure timer events get retriggered on all CPUs */
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index c9ee67b442e1..1afb0a10229f 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -121,7 +121,7 @@ static int idr_callback(int id, void *p, void *data)
        if (warned)
                return 0;
-        warned = false;
+        warned = true;
        entry = p;
        ientry = container_of(entry, struct inotify_inode_mark_entry, fsn_entry);
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 8271cf05c957..a94e8bd8eb1f 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -552,7 +552,7 @@ retry:
        spin_lock(&group->inotify_data.idr_lock);
        ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
-                                group->inotify_data.last_wd,
+                                group->inotify_data.last_wd+1,
                                &tmp_ientry->wd);
        spin_unlock(&group->inotify_data.idr_lock);
        if (ret) {
@@ -632,7 +632,7 @@ static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsign
        spin_lock_init(&group->inotify_data.idr_lock);
        idr_init(&group->inotify_data.idr);
-        group->inotify_data.last_wd = 1;
+        group->inotify_data.last_wd = 0;
        group->inotify_data.user = user;
        group->inotify_data.fa = NULL;
diff --git a/include/linux/serio.h b/include/linux/serio.h
index e2f3044d4a4a..813d26c247ec 100644
--- a/include/linux/serio.h
+++ b/include/linux/serio.h
@@ -136,25 +136,6 @@ static inline void serio_continue_rx(struct serio *serio)
        spin_unlock_irq(&serio->lock);
 }
-/*
- * Use the following functions to pin serio's driver in process context
- */
-static inline int serio_pin_driver(struct serio *serio)
-{
-        return mutex_lock_interruptible(&serio->drv_mutex);
-}
-static inline void serio_pin_driver_uninterruptible(struct serio *serio)
-{
-        mutex_lock(&serio->drv_mutex);
-}
-static inline void serio_unpin_driver(struct serio *serio)
-{
-        mutex_unlock(&serio->drv_mutex);
-}
 #endif
 /*
diff --git a/include/net/ip.h b/include/net/ip.h
index d9a0e74d8923..fb63371c07a8 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -338,7 +338,7 @@ static inline int sk_mc_loop(struct sock *sk)
                return inet6_sk(sk)->mc_loop;
 #endif
        }
-        __WARN();
+        WARN_ON(1);
        return 1;
 }
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index df159fffe4bc..4bac362b1335 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -559,6 +559,11 @@ static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
        return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 }
+static inline struct net *ipv6_skb_net(struct sk_buff *skb)
+{
+        return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
+}
 /* Router Alert as of RFC 2711 */
 static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
@@ -580,8 +585,8 @@ static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
 static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 {
        const unsigned char *nh = skb_network_header(skb);
+        struct net *net = ipv6_skb_net(skb);
        u32 pkt_len;
-        struct net *net = dev_net(skb_dst(skb)->dev);
        if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
                LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 80c16f6e2af6..32abae3ce32a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -15,12 +15,14 @@
 #include <linux/netdevice.h>
 #include <linux/rtnetlink.h>
 #include <net/mac80211.h>
+#include <net/ieee80211_radiotap.h>
 #include "ieee80211_i.h"
 #include "sta_info.h"
 #include "debugfs_netdev.h"
 #include "mesh.h"
 #include "led.h"
 #include "driver-ops.h"
+#include "wme.h"
 /**
 * DOC: Interface list locking
@@ -314,7 +316,7 @@ static int ieee80211_open(struct net_device *dev)
        if (sdata->vif.type == NL80211_IFTYPE_STATION)
                ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
-        netif_start_queue(dev);
+        netif_tx_start_all_queues(dev);
        return 0;
 err_del_interface:
@@ -343,7 +345,7 @@ static int ieee80211_stop(struct net_device *dev)
        /*
         * Stop TX on this interface first.
         */
-        netif_stop_queue(dev);
+        netif_tx_stop_all_queues(dev);
        /*
         * Now delete all active aggregation sessions.
@@ -644,6 +646,12 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
        WARN_ON(flushed);
 }
+static u16 ieee80211_netdev_select_queue(struct net_device *dev,
+                                         struct sk_buff *skb)
+{
+        return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
+}
 static const struct net_device_ops ieee80211_dataif_ops = {
        .ndo_open               = ieee80211_open,
        .ndo_stop               = ieee80211_stop,
@@ -652,8 +660,38 @@ static const struct net_device_ops ieee80211_dataif_ops = {
        .ndo_set_multicast_list = ieee80211_set_multicast_list,
        .ndo_change_mtu         = ieee80211_change_mtu,
        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_select_queue       = ieee80211_netdev_select_queue,
 };
+static u16 ieee80211_monitor_select_queue(struct net_device *dev,
+                                          struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_hdr *hdr;
+        struct ieee80211_radiotap_header *rtap = (void *)skb->data;
+        u8 *p;
+        if (local->hw.queues < 4)
+                return 0;
+        if (skb->len < 4 ||
+            skb->len < le16_to_cpu(rtap->it_len) + 2 /* frame control */)
+                return 0; /* doesn't matter, frame will be dropped */
+        hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len));
+        if (!ieee80211_is_data_qos(hdr->frame_control)) {
+                skb->priority = 7;
+                return ieee802_1d_to_ac[skb->priority];
+        }
+        p = ieee80211_get_qos_ctl(hdr);
+        skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
+        return ieee80211_downgrade_queue(local, skb);
+}
 static const struct net_device_ops ieee80211_monitorif_ops = {
        .ndo_open               = ieee80211_open,
        .ndo_stop               = ieee80211_stop,
@@ -662,6 +700,7 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
        .ndo_set_multicast_list = ieee80211_set_multicast_list,
        .ndo_change_mtu         = ieee80211_change_mtu,
        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_select_queue       = ieee80211_monitor_select_queue,
 };
 static void ieee80211_if_setup(struct net_device *dev)
@@ -768,8 +807,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
        ASSERT_RTNL();
-        ndev = alloc_netdev(sizeof(*sdata) + local->hw.vif_data_size,
+        ndev = alloc_netdev_mq(sizeof(*sdata) + local->hw.vif_data_size,
-                            name, ieee80211_if_setup);
+                               name, ieee80211_if_setup, local->hw.queues);
        if (!ndev)
                return -ENOMEM;
        dev_net_set(ndev, wiphy_net(local->hw.wiphy));
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index c79e59f82fd9..05a18f43e1bf 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -942,7 +942,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
        ieee80211_recalc_ps(local, -1);
        mutex_unlock(&local->iflist_mtx);
-        netif_start_queue(sdata->dev);
+        netif_tx_start_all_queues(sdata->dev);
        netif_carrier_on(sdata->dev);
 }
@@ -1074,7 +1074,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         * time -- we don't want the scan code to enable queues.
         */
-        netif_stop_queue(sdata->dev);
+        netif_tx_stop_all_queues(sdata->dev);
        netif_carrier_off(sdata->dev);
        rcu_read_lock();
@@ -1963,7 +1963,9 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                        rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
                        break;
                case IEEE80211_STYPE_ACTION:
-                        /* XXX: differentiate, can only happen for CSA now! */
+                        if (mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
+                                break;
                        ieee80211_sta_process_chanswitch(sdata,
                                        &mgmt->u.action.u.chan_switch.sw_elem,
                                        ifmgd->associated);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9f2807aeaf52..82a30c1bf3ab 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1746,7 +1746,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                        memset(info, 0, sizeof(*info));
                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                        info->control.vif = &rx->sdata->vif;
-                        ieee80211_select_queue(local, fwd_skb);
+                        skb_set_queue_mapping(skb,
+                                ieee80211_select_queue(rx->sdata, fwd_skb));
+                        ieee80211_set_qos_hdr(local, skb);
                        if (is_multicast_ether_addr(fwd_hdr->addr1))
                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
                                                                fwded_mcast);
@@ -2013,6 +2015,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                }
                break;
        default:
+                /* do not process rejected action frames */
+                if (mgmt->u.action.category & 0x80)
+                        return RX_DROP_MONITOR;
                return RX_CONTINUE;
        }
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f1a4c7160300..f934c9620b73 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -353,10 +353,10 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                        if (sdata->u.mgd.associated) {
                                ieee80211_scan_ps_disable(sdata);
-                                netif_wake_queue(sdata->dev);
+                                netif_tx_wake_all_queues(sdata->dev);
                        }
                } else
-                        netif_wake_queue(sdata->dev);
+                        netif_tx_wake_all_queues(sdata->dev);
                /* re-enable beaconing */
                if (sdata->vif.type == NL80211_IFTYPE_AP ||
@@ -411,7 +411,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
                 * are handled in the scan state machine
                 */
                if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        netif_stop_queue(sdata->dev);
+                        netif_tx_stop_all_queues(sdata->dev);
        }
        mutex_unlock(&local->iflist_mtx);
@@ -575,7 +575,7 @@ static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *loca
                        continue;
                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        netif_stop_queue(sdata->dev);
+                        netif_tx_stop_all_queues(sdata->dev);
                        if (sdata->u.mgd.associated)
                                ieee80211_scan_ps_enable(sdata);
                }
@@ -610,7 +610,7 @@ static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *loca
                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                        if (sdata->u.mgd.associated)
                                ieee80211_scan_ps_disable(sdata);
-                        netif_wake_queue(sdata->dev);
+                        netif_tx_wake_all_queues(sdata->dev);
                }
        }
        mutex_unlock(&local->iflist_mtx);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 27ceaefd7bc8..ac210b586702 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1512,7 +1512,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                                return;
                        }
-        ieee80211_select_queue(local, skb);
+        ieee80211_set_qos_hdr(local, skb);
        ieee80211_tx(sdata, skb, false);
        rcu_read_unlock();
 }
@@ -2291,6 +2291,9 @@ void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
        skb_set_network_header(skb, 0);
        skb_set_transport_header(skb, 0);
+        /* send all internal mgmt frames on VO */
+        skb_set_queue_mapping(skb, 0);
        /*
         * The other path calling ieee80211_xmit is from the tasklet,
         * and while we can handle concurrent transmissions locking
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index dc76267e436e..3848140313f5 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -269,6 +269,7 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
                                   enum queue_stop_reason reason)
 {
        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
        if (WARN_ON(queue >= hw->queues))
                return;
@@ -281,6 +282,11 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
        if (!skb_queue_empty(&local->pending[queue]))
                tasklet_schedule(&local->tx_pending_tasklet);
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                netif_tx_wake_queue(netdev_get_tx_queue(sdata->dev, queue));
+        rcu_read_unlock();
 }
 void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
@@ -305,11 +311,17 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
                                   enum queue_stop_reason reason)
 {
        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
        if (WARN_ON(queue >= hw->queues))
                return;
        __set_bit(reason, &local->queue_stop_reasons[queue]);
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                netif_tx_stop_queue(netdev_get_tx_queue(sdata->dev, queue));
+        rcu_read_unlock();
 }
 void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index b19b7696f3a2..79d887dae738 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -44,22 +44,69 @@ static int wme_downgrade_ac(struct sk_buff *skb)
 }
-/* Indicate which queue to use.  */
+/* Indicate which queue to use. */
-static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
+u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+                           struct sk_buff *skb)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta = NULL;
+        u32 sta_flags = 0;
+        const u8 *ra = NULL;
+        bool qos = false;
-        if (!ieee80211_is_data(hdr->frame_control)) {
+        if (local->hw.queues < 4 || skb->len < 6) {
-                /* management frames go on AC_VO queue, but are sent
+                skb->priority = 0; /* required for correct WPA/11i MIC */
-                * without QoS control fields */
+                return min_t(u16, local->hw.queues - 1,
-                return 0;
+                             ieee802_1d_to_ac[skb->priority]);
+        }
+        rcu_read_lock();
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP_VLAN:
+                rcu_read_lock();
+                sta = rcu_dereference(sdata->u.vlan.sta);
+                if (sta)
+                        sta_flags = get_sta_flags(sta);
+                rcu_read_unlock();
+                if (sta)
+                        break;
+        case NL80211_IFTYPE_AP:
+                ra = skb->data;
+                break;
+        case NL80211_IFTYPE_WDS:
+                ra = sdata->u.wds.remote_addr;
+                break;
+#ifdef CONFIG_MAC80211_MESH
+        case NL80211_IFTYPE_MESH_POINT:
+                /*
+                 * XXX: This is clearly broken ... but already was before,
+                 * because ieee80211_fill_mesh_addresses() would clear A1
+                 * except for multicast addresses.
+                 */
+                break;
+#endif
+        case NL80211_IFTYPE_STATION:
+                ra = sdata->u.mgd.bssid;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ra = skb->data;
+                break;
+        default:
+                break;
        }
-        if (0 /* injected */) {
+        if (!sta && ra && !is_multicast_ether_addr(ra)) {
-                /* use AC from radiotap */
+                sta = sta_info_get(local, ra);
+                if (sta)
+                        sta_flags = get_sta_flags(sta);
        }
-        if (!ieee80211_is_data_qos(hdr->frame_control)) {
+        if (sta_flags & WLAN_STA_WME)
+                qos = true;
+        rcu_read_unlock();
+        if (!qos) {
                skb->priority = 0; /* required for correct WPA/11i MIC */
                return ieee802_1d_to_ac[skb->priority];
        }
@@ -68,6 +115,12 @@ static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
         * data frame has */
        skb->priority = cfg80211_classify8021d(skb);
+        return ieee80211_downgrade_queue(local, skb);
+}
+u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
+                              struct sk_buff *skb)
+{
        /* in case we are a client verify acm is not set for this ac */
        while (unlikely(local->wmm_acm & BIT(skb->priority))) {
                if (wme_downgrade_ac(skb)) {
@@ -85,24 +138,17 @@ static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
        return ieee802_1d_to_ac[skb->priority];
 }
-void ieee80211_select_queue(struct ieee80211_local *local, struct sk_buff *skb)
+void ieee80211_set_qos_hdr(struct ieee80211_local *local, struct sk_buff *skb)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_hdr *hdr = (void *)skb->data;
-        u16 queue;
-        u8 tid;
+        /* Fill in the QoS header if there is one. */
-        queue = classify80211(local, skb);
-        if (unlikely(queue >= local->hw.queues))
-                queue = local->hw.queues - 1;
-        /*
-         * Now we know the 1d priority, fill in the QoS header if
-         * there is one (and we haven't done this before).
-         */
        if (ieee80211_is_data_qos(hdr->frame_control)) {
                u8 *p = ieee80211_get_qos_ctl(hdr);
-                u8 ack_policy = 0;
+                u8 ack_policy = 0, tid;
                tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
                if (unlikely(local->wifi_wme_noack_test))
                        ack_policy |= QOS_CONTROL_ACK_POLICY_NOACK <<
                                        QOS_CONTROL_ACK_POLICY_SHIFT;
@@ -110,6 +156,4 @@ void ieee80211_select_queue(struct ieee80211_local *local, struct sk_buff *skb)
                *p++ = ack_policy | tid;
                *p = 0;
        }
-        skb_set_queue_mapping(skb, queue);
 }
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index d4fd87ca5118..6053b1c9feee 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -20,7 +20,11 @@
 extern const int ieee802_1d_to_ac[8];
-void ieee80211_select_queue(struct ieee80211_local *local,
+u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
-                            struct sk_buff *skb);
+                           struct sk_buff *skb);
+void ieee80211_set_qos_hdr(struct ieee80211_local *local, struct sk_buff *skb);
+u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
+                              struct sk_buff *skb);
 #endif /* _WME_H */
diff --git a/net/wireless/core.c b/net/wireless/core.c
index c2a2c563d21a..92b812442488 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -745,9 +745,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                        mutex_unlock(&rdev->devlist_mtx);
                        dev_put(dev);
                }
-#ifdef CONFIG_CFG80211_WEXT
                cfg80211_lock_rdev(rdev);
                mutex_lock(&rdev->devlist_mtx);
+#ifdef CONFIG_CFG80211_WEXT
                wdev_lock(wdev);
                switch (wdev->iftype) {
                case NL80211_IFTYPE_ADHOC:
@@ -760,10 +760,10 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                        break;
                }
                wdev_unlock(wdev);
+#endif
                rdev->opencount++;
                mutex_unlock(&rdev->devlist_mtx);
                cfg80211_unlock_rdev(rdev);
-#endif
                break;
        case NETDEV_UNREGISTER:
                /*
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index baa898add287..7a0754c92df4 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1690,7 +1690,7 @@ int regulatory_hint_user(const char *alpha2)
        request->wiphy_idx = WIPHY_IDX_STALE;
        request->alpha2[0] = alpha2[0];
        request->alpha2[1] = alpha2[1];
-        request->initiator = NL80211_REGDOM_SET_BY_USER,
+        request->initiator = NL80211_REGDOM_SET_BY_USER;
        queue_regulatory_request(request);