934 files changed, 13670 insertions, 7298 deletions
diff --git a/.gitignore b/.gitignore
index 9c0d650385be..d24ad506e799 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,6 +52,7 @@ series
 # cscope files
 cscope.*
+ncscope.*
 *.orig
 *~
diff --git a/Documentation/ABI/testing/sysfs-class-bdi b/Documentation/ABI/testing/sysfs-class-bdi
index 5ac1e01bbd48..5f500977b42f 100644
--- a/Documentation/ABI/testing/sysfs-class-bdi
+++ b/Documentation/ABI/testing/sysfs-class-bdi
@@ -14,6 +14,10 @@ MAJOR:MINOR
        non-block filesystems which provide their own BDI, such as NFS
        and FUSE.
+MAJOR:MINOR-fuseblk
+        Value of st_dev on fuseblk filesystems.
 default
        The default backing dev, used for non-block device backed
diff --git a/Documentation/DocBook/kernel-locking.tmpl b/Documentation/DocBook/kernel-locking.tmpl
index 77c42f40be5d..2510763295d0 100644
--- a/Documentation/DocBook/kernel-locking.tmpl
+++ b/Documentation/DocBook/kernel-locking.tmpl
@@ -703,6 +703,31 @@
 </sect1>
 </chapter>
+<chapter id="trylock-functions">
+ <title>The trylock Functions</title>
+  <para>
+   There are functions that try to acquire a lock only once and immediately
+   return a value telling about success or failure to acquire the lock.
+   They can be used if you need no access to the data protected with the lock
+   when some other thread is holding the lock. You should acquire the lock
+   later if you then need access to the data protected with the lock.
+  </para>
+  <para>
+    <function>spin_trylock()</function> does not spin but returns non-zero if
+    it acquires the spinlock on the first try or 0 if not. This function can
+    be used in all contexts like <function>spin_lock</function>: you must have
+    disabled the contexts that might interrupt you and acquire the spin lock.
+  </para>
+  <para>
+    <function>mutex_trylock()</function> does not suspend your task
+    but returns non-zero if it could lock the mutex on the first try
+    or 0 if not. This function cannot be safely used in hardware or software
+    interrupt contexts despite not sleeping.
+  </para>
+</chapter>
  <chapter id="Examples">
   <title>Common Examples</title>
    <para>
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 9c93a03ea33b..118ca6e9404f 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -327,6 +327,52 @@ Some people also put extra tags at the end.  They'll just be ignored for
 now, but you can do this to mark internal company procedures or just
 point out some special detail about the sign-off. 
+If you are a subsystem or branch maintainer, sometimes you need to slightly
+modify patches you receive in order to merge them, because the code is not
+exactly the same in your tree and the submitters'. If you stick strictly to
+rule (c), you should ask the submitter to rediff, but this is a totally
+counter-productive waste of time and energy. Rule (b) allows you to adjust
+the code, but then it is very impolite to change one submitter's code and
+make him endorse your bugs. To solve this problem, it is recommended that
+you add a line between the last Signed-off-by header and yours, indicating
+the nature of your changes. While there is nothing mandatory about this, it
+seems like prepending the description with your mail and/or name, all
+enclosed in square brackets, is noticeable enough to make it obvious that
+you are responsible for last-minute changes. Example :
+        Signed-off-by: Random J Developer <random@developer.example.org>
+        [lucky@maintainer.example.org: struct foo moved from foo.c to foo.h]
+        Signed-off-by: Lucky K Maintainer <lucky@maintainer.example.org>
+This practise is particularly helpful if you maintain a stable branch and
+want at the same time to credit the author, track changes, merge the fix,
+and protect the submitter from complaints. Note that under no circumstances
+can you change the author's identity (the From header), as it is the one
+which appears in the changelog.
+Special note to back-porters: It seems to be a common and useful practise
+to insert an indication of the origin of a patch at the top of the commit
+message (just after the subject line) to facilitate tracking. For instance,
+here's what we see in 2.6-stable :
+    Date:   Tue May 13 19:10:30 2008 +0000
+        SCSI: libiscsi regression in 2.6.25: fix nop timer handling
+        commit 4cf1043593db6a337f10e006c23c69e5fc93e722 upstream
+And here's what appears in 2.4 :
+    Date:   Tue May 13 22:12:27 2008 +0200
+        wireless, airo: waitbusy() won't delay
+        [backport of 2.6 commit b7acbdfbd1f277c1eb23f344f899cfa4cd0bf36a]
+Whatever the format, this information provides a valuable help to people
+tracking your trees, and to people trying to trouble-shoot bugs in your
+tree.
 13) When to use Acked-by: and Cc:
diff --git a/Documentation/cciss.txt b/Documentation/cciss.txt
index e65736c6b8bc..63e59b8847c5 100644
--- a/Documentation/cciss.txt
+++ b/Documentation/cciss.txt
@@ -21,6 +21,11 @@ This driver is known to work with the following cards:
        * SA E200
        * SA E200i
        * SA E500
+        * SA P212
+        * SA P410
+        * SA P410i
+        * SA P411
+        * SA P812
 Detecting drive failures:
 -------------------------
diff --git a/Documentation/cpu-freq/governors.txt b/Documentation/cpu-freq/governors.txt
index 6a9c55bd556b..dcec0564d040 100644
--- a/Documentation/cpu-freq/governors.txt
+++ b/Documentation/cpu-freq/governors.txt
@@ -129,14 +129,6 @@ to its default value of '80' it means that between the checking
 intervals the CPU needs to be on average more than 80% in use to then
 decide that the CPU frequency needs to be increased.  
-sampling_down_factor: this parameter controls the rate that the CPU
-makes a decision on when to decrease the frequency.  When set to its
-default value of '5' it means that at 1/5 the sampling_rate the kernel
-makes a decision to lower the frequency.  Five "lower rate" decisions
-have to be made in a row before the CPU frequency is actually lower.
-If set to '1' then the frequency decreases as quickly as it increases,
-if set to '2' it decreases at half the rate of the increase.
 ignore_nice_load: this parameter takes a value of '0' or '1'. When
 set to '0' (its default), all processes are counted towards the
 'cpu utilisation' value.  When set to '1', the processes that are
diff --git a/Documentation/cpusets.txt b/Documentation/cpusets.txt
index fb7b361e6eea..d803c5c68ab5 100644
--- a/Documentation/cpusets.txt
+++ b/Documentation/cpusets.txt
@@ -199,7 +199,7 @@ using the sched_setaffinity, mbind and set_mempolicy system calls.
 The following rules apply to each cpuset:
 - Its CPUs and Memory Nodes must be a subset of its parents.
- - It can only be marked exclusive if its parent is.
+ - It can't be marked exclusive unless its parent is.
 - If its cpu or memory is exclusive, they may not overlap any sibling.
 These rules, and the natural hierarchy of cpusets, enable efficient
@@ -345,7 +345,7 @@ is modified to perform an inline check for this PF_SPREAD_PAGE task
 flag, and if set, a call to a new routine cpuset_mem_spread_node()
 returns the node to prefer for the allocation.
-Similarly, setting 'memory_spread_cache' turns on the flag
+Similarly, setting 'memory_spread_slab' turns on the flag
 PF_SPREAD_SLAB, and appropriately marked slab caches will allocate
 pages from the node returned by cpuset_mem_spread_node().
@@ -709,7 +709,10 @@ Now you want to do something with this cpuset.
 In this directory you can find several files:
 # ls
-cpus  cpu_exclusive  mems  mem_exclusive mem_hardwall  tasks
+cpu_exclusive  memory_migrate      mems                      tasks
+cpus           memory_pressure     notify_on_release
+mem_exclusive  memory_spread_page  sched_load_balance
+mem_hardwall   memory_spread_slab  sched_relax_domain_level
 Reading them will give you information about the state of this cpuset:
 the CPUs and Memory Nodes it can use, the processes that are using
diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt
index 560f88dc7090..0c5086db8352 100644
--- a/Documentation/filesystems/ext4.txt
+++ b/Documentation/filesystems/ext4.txt
@@ -139,8 +139,16 @@ commit=nrsec	(*)	Ext4 can be told to sync all its data and metadata
                        Setting it to very large values will improve
                        performance.
-barrier=1               This enables/disables barriers.  barrier=0 disables
+barrier=<0|1(*)>        This enables/disables the use of write barriers in
-                        it, barrier=1 enables it.
+                        the jbd code.  barrier=0 disables, barrier=1 enables.
+                        This also requires an IO stack which can support
+                        barriers, and if jbd gets an error on a barrier
+                        write, it will disable again with a warning.
+                        Write barriers enforce proper on-disk ordering
+                        of journal commits, making volatile disk write caches
+                        safe to use, at some performance penalty.  If
+                        your disks are battery-backed in one way or another,
+                        disabling barriers may safely improve performance.
 orlov           (*)     This enables the new Orlov block allocator. It is
                        enabled by default.
diff --git a/Documentation/filesystems/sysfs-pci.txt b/Documentation/filesystems/sysfs-pci.txt
index 5daa2aaec2c5..68ef48839c04 100644
--- a/Documentation/filesystems/sysfs-pci.txt
+++ b/Documentation/filesystems/sysfs-pci.txt
@@ -36,6 +36,7 @@ files, each with their own function.
       local_cpus          nearby CPU mask (cpumask, ro)
       resource            PCI resource host addresses (ascii, ro)
       resource0..N        PCI resource N, if present (binary, mmap)
+       resource0_wc..N_wc  PCI WC map resource N, if prefetchable (binary, mmap)
       rom                 PCI ROM resource, if present (binary, ro)
       subsystem_device    PCI subsystem device (ascii, ro)
       subsystem_vendor    PCI subsystem vendor (ascii, ro)
diff --git a/Documentation/hwmon/ibmaem b/Documentation/hwmon/ibmaem
new file mode 100644
index 000000000000..2fefaf582a43
--- /dev/null
+++ b/Documentation/hwmon/ibmaem
@@ -0,0 +1,37 @@
+Kernel driver ibmaem
+======================
+Supported systems:
+  * Any recent IBM System X server with Active Energy Manager support.
+    This includes the x3350, x3550, x3650, x3655, x3755, x3850 M2,
+    x3950 M2, and certain HS2x/LS2x/QS2x blades.  The IPMI host interface
+    driver ("ipmi-si") needs to be loaded for this driver to do anything.
+    Prefix: 'ibmaem'
+    Datasheet: Not available
+Author: Darrick J. Wong
+Description
+-----------
+This driver implements sensor reading support for the energy and power
+meters available on various IBM System X hardware through the BMC.  All
+sensor banks will be exported as platform devices; this driver can talk
+to both v1 and v2 interfaces.  This driver is completely separate from the
+older ibmpex driver.
+The v1 AEM interface has a simple set of features to monitor energy use.
+There is a register that displays an estimate of raw energy consumption
+since the last BMC reset, and a power sensor that returns average power
+use over a configurable interval.
+The v2 AEM interface is a bit more sophisticated, being able to present
+a wider range of energy and power use registers, the power cap as
+set by the AEM software, and temperature sensors.
+Special Features
+----------------
+The "power_cap" value displays the current system power cap, as set by
+the Active Energy Manager software.  Setting the power cap from the host
+is not currently supported.
diff --git a/Documentation/kernel-doc-nano-HOWTO.txt b/Documentation/kernel-doc-nano-HOWTO.txt
index 2075c0658bf5..0bd32748a467 100644
--- a/Documentation/kernel-doc-nano-HOWTO.txt
+++ b/Documentation/kernel-doc-nano-HOWTO.txt
@@ -1,6 +1,105 @@
 kernel-doc nano-HOWTO
 =====================
+How to format kernel-doc comments
+---------------------------------
+In order to provide embedded, 'C' friendly, easy to maintain,
+but consistent and extractable documentation of the functions and
+data structures in the Linux kernel, the Linux kernel has adopted
+a consistent style for documenting functions and their parameters,
+and structures and their members.
+The format for this documentation is called the kernel-doc format.
+It is documented in this Documentation/kernel-doc-nano-HOWTO.txt file.
+This style embeds the documentation within the source files, using
+a few simple conventions.  The scripts/kernel-doc perl script, some
+SGML templates in Documentation/DocBook, and other tools understand
+these conventions, and are used to extract this embedded documentation
+into various documents.
+In order to provide good documentation of kernel functions and data
+structures, please use the following conventions to format your
+kernel-doc comments in Linux kernel source.
+We definitely need kernel-doc formatted documentation for functions
+that are exported to loadable modules using EXPORT_SYMBOL.
+We also look to provide kernel-doc formatted documentation for
+functions externally visible to other kernel files (not marked
+"static").
+We also recommend providing kernel-doc formatted documentation
+for private (file "static") routines, for consistency of kernel
+source code layout.  But this is lower priority and at the
+discretion of the MAINTAINER of that kernel source file.
+Data structures visible in kernel include files should also be
+documented using kernel-doc formatted comments.
+The opening comment mark "/**" is reserved for kernel-doc comments.
+Only comments so marked will be considered by the kernel-doc scripts,
+and any comment so marked must be in kernel-doc format.  Do not use
+"/**" to be begin a comment block unless the comment block contains
+kernel-doc formatted comments.  The closing comment marker for
+kernel-doc comments can be either "*/" or "**/".
+Kernel-doc comments should be placed just before the function
+or data structure being described.
+Example kernel-doc function comment:
+/**
+ * foobar() - short function description of foobar
+ * @arg1:       Describe the first argument to foobar.
+ * @arg2:       Describe the second argument to foobar.
+ *              One can provide multiple line descriptions
+ *              for arguments.
+ *
+ * A longer description, with more discussion of the function foobar()
+ * that might be useful to those using or modifying it.  Begins with
+ * empty comment line, and may include additional embedded empty
+ * comment lines.
+ *
+ * The longer description can have multiple paragraphs.
+ **/
+The first line, with the short description, must be on a single line.
+The @argument descriptions must begin on the very next line following
+this opening short function description line, with no intervening
+empty comment lines.
+Example kernel-doc data structure comment.
+/**
+ * struct blah - the basic blah structure
+ * @mem1:       describe the first member of struct blah
+ * @mem2:       describe the second member of struct blah,
+ *              perhaps with more lines and words.
+ *
+ * Longer description of this structure.
+ **/
+The kernel-doc function comments describe each parameter to the
+function, in order, with the @name lines.
+The kernel-doc data structure comments describe each structure member
+in the data structure, with the @name lines.
+The longer description formatting is "reflowed", losing your line
+breaks.  So presenting carefully formatted lists within these
+descriptions won't work so well; derived documentation will lose
+the formatting.
+See the section below "How to add extractable documentation to your
+source files" for more details and notes on how to format kernel-doc
+comments.
+Components of the kernel-doc system
+-----------------------------------
 Many places in the source tree have extractable documentation in the
 form of block comments above functions.  The components of this system
 are:
diff --git a/Documentation/kernel-docs.txt b/Documentation/kernel-docs.txt
index 5a4ef48224ae..28cdc2af2131 100644
--- a/Documentation/kernel-docs.txt
+++ b/Documentation/kernel-docs.txt
@@ -715,14 +715,14 @@
     * Name: "Gary's Encyclopedia - The Linux Kernel"
       Author: Gary (I suppose...).
-       URL: http://www.lisoleg.net/cgi-bin/lisoleg.pl?view=kernel.htm
+       URL: http://slencyclopedia.berlios.de/index.html
-       Keywords: links, not found here?.
+       Keywords: linux, community, everything!
       Description: Gary's Encyclopedia exists to allow the rapid finding
       of documentation and other information of interest to GNU/Linux
       users. It has about 4000 links to external pages in 150 major
       categories. This link is for kernel-specific links, documents,
-       sites... Look there if you could not find here what you were
+       sites...  This list is now hosted by developer.Berlios.de,
-       looking for.
+       but seems not to have been updated since sometime in 1999.
     * Name: "The home page of Linux-MM"
       Author: The Linux-MM team.
diff --git a/Documentation/kobject.txt b/Documentation/kobject.txt
index bf3256e04027..51a8021ee532 100644
--- a/Documentation/kobject.txt
+++ b/Documentation/kobject.txt
@@ -305,7 +305,7 @@ should not be manipulated by any other user.
 A kset keeps its children in a standard kernel linked list.  Kobjects point
 back to their containing kset via their kset field. In almost all cases,
-the kobjects belonging to a ket have that kset (or, strictly, its embedded
+the kobjects belonging to a kset have that kset (or, strictly, its embedded
 kobject) in their parent.
 As a kset contains a kobject within it, it should always be dynamically
diff --git a/Documentation/laptops/thinkpad-acpi.txt b/Documentation/laptops/thinkpad-acpi.txt
index 01c6c3d8a7e3..64b3f146e4b0 100644
--- a/Documentation/laptops/thinkpad-acpi.txt
+++ b/Documentation/laptops/thinkpad-acpi.txt
@@ -503,7 +503,7 @@ generate input device EV_KEY events.
 In addition to the EV_KEY events, thinkpad-acpi may also issue EV_SW
 events for switches:
-SW_RADIO        T60 and later hardare rfkill rocker switch
+SW_RFKILL_ALL   T60 and later hardare rfkill rocker switch
 SW_TABLET_MODE  Tablet ThinkPads HKEY events 0x5009 and 0x500A
 Non hot-key ACPI HKEY event map:
diff --git a/Documentation/lguest/lguest.c b/Documentation/lguest/lguest.c
index 3be8ab2a886a..82fafe0429fe 100644
--- a/Documentation/lguest/lguest.c
+++ b/Documentation/lguest/lguest.c
@@ -157,6 +157,9 @@ struct virtqueue
        /* The routine to call when the Guest pings us. */
        void (*handle_output)(int fd, struct virtqueue *me);
+        /* Outstanding buffers */
+        unsigned int inflight;
 };
 /* Remember the arguments to the program so we can "reboot" */
@@ -702,6 +705,7 @@ static unsigned get_vq_desc(struct virtqueue *vq,
                        errx(1, "Looped descriptor");
        } while ((i = next_desc(vq, i)) != vq->vring.num);
+        vq->inflight++;
        return head;
 }
@@ -719,6 +723,7 @@ static void add_used(struct virtqueue *vq, unsigned int head, int len)
        /* Make sure buffer is written before we update index. */
        wmb();
        vq->vring.used->idx++;
+        vq->inflight--;
 }
 /* This actually sends the interrupt for this virtqueue */
@@ -726,8 +731,9 @@ static void trigger_irq(int fd, struct virtqueue *vq)
 {
        unsigned long buf[] = { LHREQ_IRQ, vq->config.irq };
-        /* If they don't want an interrupt, don't send one. */
+        /* If they don't want an interrupt, don't send one, unless empty. */
-        if (vq->vring.avail->flags & VRING_AVAIL_F_NO_INTERRUPT)
+        if ((vq->vring.avail->flags & VRING_AVAIL_F_NO_INTERRUPT)
+            && vq->inflight)
                return;
        /* Send the Guest an interrupt tell them we used something up. */
@@ -1107,6 +1113,7 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
        vq->next = NULL;
        vq->last_avail_idx = 0;
        vq->dev = dev;
+        vq->inflight = 0;
        /* Initialize the configuration. */
        vq->config.num = num_descs;
@@ -1368,6 +1375,7 @@ static void setup_tun_net(const char *arg)
        /* Tell Guest what MAC address to use. */
        add_feature(dev, VIRTIO_NET_F_MAC);
+        add_feature(dev, VIRTIO_F_NOTIFY_ON_EMPTY);
        set_config(dev, sizeof(conf), &conf);
        /* We don't need the socket any more; setup is done. */
diff --git a/Documentation/networking/arcnet.txt b/Documentation/networking/arcnet.txt
index 770fc41a78e8..796012540386 100644
--- a/Documentation/networking/arcnet.txt
+++ b/Documentation/networking/arcnet.txt
@@ -46,7 +46,7 @@ These are the ARCnet drivers for Linux.
 This new release (2.91) has been put together by David Woodhouse 
-<dwmw2@cam.ac.uk>, in an attempt to tidy up the driver after adding support 
+<dwmw2@infradead.org>, in an attempt to tidy up the driver after adding support
 for yet another chipset. Now the generic support has been separated from the
 individual chipset drivers, and the source files aren't quite so packed with
 #ifdefs! I've changed this file a bit, but kept it in the first person from
diff --git a/Documentation/networking/bridge.txt b/Documentation/networking/bridge.txt
index bdae2db4119c..bec69a8a1697 100644
--- a/Documentation/networking/bridge.txt
+++ b/Documentation/networking/bridge.txt
@@ -1,6 +1,6 @@
 In order to use the Ethernet bridging functionality, you'll need the
 userspace tools. These programs and documentation are available
-at http://bridge.sourceforge.net.  The download page is
+at http://www.linux-foundation.org/en/Net:Bridge.  The download page is
 http://prdownloads.sourceforge.net/bridge.
 If you still have questions, don't hesitate to post to the mailing list 
diff --git a/Documentation/video4linux/CARDLIST.cx88 b/Documentation/video4linux/CARDLIST.cx88
index 543957346469..7cf5685d3645 100644
--- a/Documentation/video4linux/CARDLIST.cx88
+++ b/Documentation/video4linux/CARDLIST.cx88
@@ -60,7 +60,7 @@
 59 -> DViCO FusionHDTV 5 PCI nano                         [18ac:d530]
 60 -> Pinnacle Hybrid PCTV                                [12ab:1788]
 61 -> Winfast TV2000 XP Global                            [107d:6f18]
- 62 -> PowerColor Real Angel 330                           [14f1:ea3d]
+ 62 -> PowerColor RA330                                    [14f1:ea3d]
 63 -> Geniatech X8000-MT DVBT                             [14f1:8852]
 64 -> DViCO FusionHDTV DVB-T PRO                          [18ac:db30]
 65 -> DViCO FusionHDTV 7 Gold                             [18ac:d610]
diff --git a/Documentation/video4linux/cx18.txt b/Documentation/video4linux/cx18.txt
index 077d56ec3f3d..6842c262890f 100644
--- a/Documentation/video4linux/cx18.txt
+++ b/Documentation/video4linux/cx18.txt
@@ -1,7 +1,9 @@
 Some notes regarding the cx18 driver for the Conexant CX23418 MPEG
 encoder chip:
-1) The only hardware currently supported is the Hauppauge HVR-1600.
+1) The only hardware currently supported is the Hauppauge HVR-1600
+   card and the Compro VideoMate H900 (note that this card only
+   supports analog input, it has no digital tuner!).
 2) Some people have problems getting the i2c bus to work. Cause unknown.
   The symptom is that the eeprom cannot be read and the card is
diff --git a/Documentation/vm/pagemap.txt b/Documentation/vm/pagemap.txt
new file mode 100644
index 000000000000..ce72c0fe6177
--- /dev/null
+++ b/Documentation/vm/pagemap.txt
@@ -0,0 +1,77 @@
+pagemap, from the userspace perspective
+---------------------------------------
+pagemap is a new (as of 2.6.25) set of interfaces in the kernel that allow
+userspace programs to examine the page tables and related information by
+reading files in /proc.
+There are three components to pagemap:
+ * /proc/pid/pagemap.  This file lets a userspace process find out which
+   physical frame each virtual page is mapped to.  It contains one 64-bit
+   value for each virtual page, containing the following data (from
+   fs/proc/task_mmu.c, above pagemap_read):
+    * Bits 0-55  page frame number (PFN) if present
+    * Bits 0-4   swap type if swapped
+    * Bits 5-55  swap offset if swapped
+    * Bits 55-60 page shift (page size = 1<<page shift)
+    * Bit  61    reserved for future use
+    * Bit  62    page swapped
+    * Bit  63    page present
+   If the page is not present but in swap, then the PFN contains an
+   encoding of the swap file number and the page's offset into the
+   swap. Unmapped pages return a null PFN. This allows determining
+   precisely which pages are mapped (or in swap) and comparing mapped
+   pages between processes.
+   Efficient users of this interface will use /proc/pid/maps to
+   determine which areas of memory are actually mapped and llseek to
+   skip over unmapped regions.
+ * /proc/kpagecount.  This file contains a 64-bit count of the number of
+   times each page is mapped, indexed by PFN.
+ * /proc/kpageflags.  This file contains a 64-bit set of flags for each
+   page, indexed by PFN.
+   The flags are (from fs/proc/proc_misc, above kpageflags_read):
+     0. LOCKED
+     1. ERROR
+     2. REFERENCED
+     3. UPTODATE
+     4. DIRTY
+     5. LRU
+     6. ACTIVE
+     7. SLAB
+     8. WRITEBACK
+     9. RECLAIM
+    10. BUDDY
+Using pagemap to do something useful:
+The general procedure for using pagemap to find out about a process' memory
+usage goes like this:
+ 1. Read /proc/pid/maps to determine which parts of the memory space are
+    mapped to what.
+ 2. Select the maps you are interested in -- all of them, or a particular
+    library, or the stack or the heap, etc.
+ 3. Open /proc/pid/pagemap and seek to the pages you would like to examine.
+ 4. Read a u64 for each page from pagemap.
+ 5. Open /proc/kpagecount and/or /proc/kpageflags.  For each PFN you just
+    read, seek to that entry in the file, and read the data you want.
+For example, to find the "unique set size" (USS), which is the amount of
+memory that a process is using that is not shared with any other process,
+you can go through every map in the process, find the PFNs, look those up
+in kpagecount, and tally up the number of pages that are only referenced
+once.
+Other notes:
+Reading from any of the files will return -EINVAL if you are not starting
+the read on an 8-byte boundary (e.g., if you seeked an odd number of bytes
+into the file), or if the size of the read is not a multiple of 8 bytes.
diff --git a/MAINTAINERS b/MAINTAINERS
index b42dcfcbee44..cd587eec9fa7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -228,21 +228,21 @@ ACPI BATTERY DRIVERS
 P:      Alexey Starikovskiy
 M:      astarikovskiy@suse.de
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 ACPI EC DRIVER
 P:      Alexey Starikovskiy
 M:      astarikovskiy@suse.de
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 ACPI FAN DRIVER
 P:      Len Brown
 M:      len.brown@intel.com
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 ACPI PCI HOTPLUG DRIVER
@@ -255,14 +255,14 @@ ACPI THERMAL DRIVER
 P:      Len Brown
 M:      len.brown@intel.com
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 ACPI VIDEO DRIVER
 P:      Rui Zhang
 M:      rui.zhang@intel.com
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 ACPI WMI DRIVER
@@ -274,7 +274,7 @@ S:      Maintained
 AD1889 ALSA SOUND DRIVER
 P:     Kyle McMartin
-M:     kyle@parisc-linux.org
+M:     kyle@mcmartin.ca
 P:     Thibaut Varene
 M:     T-Bone@parisc-linux.org
 W:     http://wiki.parisc-linux.org/AD1889
@@ -995,8 +995,8 @@ L:	netdev@vger.kernel.org
 S:      Supported
 BROADCOM BNX2X 10 GIGABIT ETHERNET DRIVER
-P:      Eliezer Tamir
+P:      Eilon Greenstein
-M:      eliezert@broadcom.com
+M:      eilong@broadcom.com
 L:      netdev@vger.kernel.org
 S:      Supported
@@ -1202,6 +1202,7 @@ M:	pj@sgi.com
 M:      menage@google.com
 L:      linux-kernel@vger.kernel.org
 W:      http://www.bullopensource.org/cpuset/
+W:      http://oss.sgi.com/projects/cpusets/
 S:      Supported
 CRAMFS FILESYSTEM
@@ -1240,6 +1241,20 @@ L:	video4linux-list@redhat.com
 W:      http://linuxtv.org
 S:      Maintained
+CXGB3 ETHERNET DRIVER (CXGB3)
+P:      Divy Le Ray
+M:      divy@chelsio.com
+L:      netdev@vger.kernel.org
+W:      http://www.chelsio.com
+S:      Supported
+CXGB3 IWARP RNIC DRIVER (IW_CXGB3)
+P:      Steve Wise
+M:      swise@chelsio.com
+L:      general@lists.openfabrics.org
+W:      http://www.openfabrics.org
+S:      Supported
 CYBERPRO FB DRIVER
 P:      Russell King
 M:      rmk@arm.linux.org.uk
@@ -1597,7 +1612,7 @@ ETHERNET BRIDGE
 P:      Stephen Hemminger
 M:      shemminger@linux-foundation.org
 L:      bridge@lists.linux-foundation.org
-W:      http://bridge.sourceforge.net/
+W:      http://www.linux-foundation.org/en/Net:Bridge
 S:      Maintained
 ETHERTEAM 16I DRIVER
@@ -1813,7 +1828,7 @@ S:	Maintained
 HARMONY SOUND DRIVER
 P:      Kyle McMartin
-M:      kyle@parisc-linux.org
+M:      kyle@mcmartin.ca
 L:      linux-parisc@vger.kernel.org
 S:      Maintained
@@ -2551,7 +2566,6 @@ LINUX SECURITY MODULE (LSM) FRAMEWORK
 P:      Chris Wright
 M:      chrisw@sous-sol.org
 L:      linux-security-module@vger.kernel.org
-W:      http://lsm.immunix.org
 T:      git kernel.org:/pub/scm/linux/kernel/git/chrisw/lsm-2.6.git
 S:      Supported
@@ -2852,8 +2866,8 @@ S:	Maintained
 NETEFFECT IWARP RNIC DRIVER (IW_NES)
 P:      Faisal Latif
 M:      flatif@neteffect.com
-P:      Nishi Gupta
+P:      Chien Tung
-M:      ngupta@neteffect.com
+M:      ctung@neteffect.com
 P:      Glenn Streiff
 M:      gstreiff@neteffect.com
 L:      general@lists.openfabrics.org
@@ -3107,7 +3121,7 @@ S:	Maintained
 PARISC ARCHITECTURE
 P:      Kyle McMartin
-M:      kyle@parisc-linux.org
+M:      kyle@mcmartin.ca
 P:      Matthew Wilcox
 M:      matthew@wil.cx
 P:      Grant Grundler
@@ -3251,7 +3265,7 @@ S:	Maintained
 PPP OVER ETHERNET
 P:      Michal Ostrowski
-M:      mostrows@speakeasy.net
+M:      mostrows@earthlink.net
 S:      Maintained
 PPP OVER L2TP
@@ -3316,9 +3330,11 @@ L:	video4linux-list@redhat.com
 W:      http://www.isely.net/pvrusb2/
 S:      Maintained
-PXA2xx SUPPORT
+PXA2xx/PXA3xx SUPPORT
-P:      Nicolas Pitre
+P:      Eric Miao
-M:      nico@cam.org
+M:      eric.miao@marvell.com
+P:      Russell King
+M:      linux@arm.linux.org.uk
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
 S:      Maintained
@@ -3425,10 +3441,7 @@ L:	rtc-linux@googlegroups.com
 S:      Maintained
 REISERFS FILE SYSTEM
-P:      Hans Reiser
-M:      reiserfs-dev@namesys.com
 L:      reiserfs-devel@vger.kernel.org
-W:      http://www.namesys.com
 S:      Supported
 RFKILL
@@ -3648,13 +3661,6 @@ M:	romieu@fr.zoreil.com
 L:      netdev@vger.kernel.org
 S:      Maintained
-SIS 5513 IDE CONTROLLER DRIVER
-P:      Lionel Bouton
-M:      Lionel.Bouton@inet6.fr
-W:      http://inet6.dyn.dhs.org/sponsoring/sis5513/index.html
-W:      http://gyver.homeip.net/sis5513/index.html
-S:      Maintained
 SIS 900/7016 FAST ETHERNET DRIVER
 P:      Daniele Venzano
 M:      venza@brownhat.org
@@ -4020,7 +4026,7 @@ TULIP NETWORK DRIVERS
 P:      Grant Grundler
 M:      grundler@parisc-linux.org
 P:      Kyle McMartin
-M:      kyle@parisc-linux.org
+M:      kyle@mcmartin.ca
 L:      netdev@vger.kernel.org
 S:      Maintained
@@ -4361,6 +4367,14 @@ M:	gregkh@suse.de
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
+UTIL-LINUX-NG PACKAGE
+P:      Karel Zak
+M:      kzak@redhat.com
+L:      util-linux-ng@vger.kernel.org
+W:      http://kernel.org/~kzak/util-linux-ng/
+T:      git://git.kernel.org/pub/scm/utils/util-linux-ng/util-linux-ng.git
+S:      Maintained
 VFAT/FAT/MSDOS FILESYSTEM:
 P:      OGAWA Hirofumi
 M:      hirofumi@mail.parknet.co.jp
diff --git a/Makefile b/Makefile
index 20b32351906b..6923d669a4f6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 26
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc6
-NAME = Funky Weasel is Jiggy wit it
+NAME = Rotary Wombat
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/boot/compressed/head-xscale.S b/arch/arm/boot/compressed/head-xscale.S
index 67ea99ef6521..dd3fbd6766e1 100644
--- a/arch/arm/boot/compressed/head-xscale.S
+++ b/arch/arm/boot/compressed/head-xscale.S
@@ -33,10 +33,6 @@ __XScale_start:
                bic     r0, r0, #0x1000         @ clear Icache
                mcr     p15, 0, r0, c1, c0, 0
-#ifdef CONFIG_ARCH_COTULLA_IDP
-                mov     r7, #MACH_TYPE_COTULLA_IDP
-#endif
 #ifdef CONFIG_ARCH_IXP2000
                mov     r1, #-1
                mov     r0, #0xd6000000
diff --git a/arch/arm/mach-at91/at91x40.c b/arch/arm/mach-at91/at91x40.c
index 1de121fc55f4..f44647738ee4 100644
--- a/arch/arm/mach-at91/at91x40.c
+++ b/arch/arm/mach-at91/at91x40.c
@@ -16,16 +16,32 @@
 #include <asm/mach/arch.h>
 #include <asm/arch/at91x40.h>
 #include <asm/arch/at91_st.h>
+#include <asm/arch/timex.h>
 #include "generic.h"
 /*
- * This is used in the gpio code, stub locally.
+ * Export the clock functions for the AT91X40. Some external code common
+ * to all AT91 family parts relys on this, like the gpio and serial support.
 */
 int clk_enable(struct clk *clk)
 {
        return 0;
 }
+void clk_disable(struct clk *clk)
+{
+}
+unsigned long clk_get_rate(struct clk *clk)
+{
+        return AT91X40_MASTER_CLOCK;
+}
+struct clk *clk_get(struct device *dev, const char *id)
+{
+        return NULL;
+}
 void __init at91x40_initialize(unsigned long main_clock)
 {
        at91_extern_irq = (1 << AT91X40_ID_IRQ0) | (1 << AT91X40_ID_IRQ1)
diff --git a/arch/arm/mach-integrator/impd1.c b/arch/arm/mach-integrator/impd1.c
index 92d79fb39311..62e653a3ea1a 100644
--- a/arch/arm/mach-integrator/impd1.c
+++ b/arch/arm/mach-integrator/impd1.c
@@ -369,7 +369,8 @@ static int impd1_probe(struct lm_device *dev)
        lm_set_drvdata(dev, impd1);
-        printk("IM-PD1 found at 0x%08lx\n", dev->resource.start);
+        printk("IM-PD1 found at 0x%08lx\n",
+                (unsigned long)dev->resource.start);
        for (i = 0; i < ARRAY_SIZE(impd1->vcos); i++) {
                impd1->vcos[i].owner = THIS_MODULE,
diff --git a/arch/arm/mach-integrator/pci_v3.c b/arch/arm/mach-integrator/pci_v3.c
index d55fa4e9bb43..c07f497000ca 100644
--- a/arch/arm/mach-integrator/pci_v3.c
+++ b/arch/arm/mach-integrator/pci_v3.c
@@ -405,7 +405,6 @@ v3_pci_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
                addr, fsr, pc, instr, __raw_readl(SC_LBFADDR), __raw_readl(SC_LBFCODE) & 255,
                v3_readb(V3_LB_ISTAT));
        printk(KERN_DEBUG "%s", buf);
-        printascii(buf);
 #endif
        v3_writeb(V3_LB_ISTAT, 0);
@@ -447,6 +446,7 @@ static irqreturn_t v3_irq(int dummy, void *devid)
        unsigned long pc = instruction_pointer(regs);
        unsigned long instr = *(unsigned long *)pc;
        char buf[128];
+        extern void printascii(const char *);
        sprintf(buf, "V3 int %d: pc=0x%08lx [%08lx] LBFADDR=%08x LBFCODE=%02x "
                "ISTAT=%02x\n", IRQ_AP_V3INT, pc, instr,
diff --git a/arch/arm/mach-omap1/board-palmte.c b/arch/arm/mach-omap1/board-palmte.c
index a0b16a7e8a04..a4d20127a60e 100644
--- a/arch/arm/mach-omap1/board-palmte.c
+++ b/arch/arm/mach-omap1/board-palmte.c
@@ -24,7 +24,6 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
 #include <linux/spi/spi.h>
-#include <linux/spi/tsc2102.h>
 #include <linux/interrupt.h>
 #include <linux/apm-emulation.h>
@@ -315,14 +314,6 @@ static void palmte_get_power_status(struct apm_power_info *info, int *battery)
 #define palmte_get_power_status NULL
 #endif
-static struct tsc2102_config palmte_tsc2102_config = {
-        .use_internal   = 0,
-        .monitor        = TSC_BAT1 | TSC_AUX | TSC_TEMP,
-        .temp_at25c     = { 2200, 2615 },
-        .apm_report     = palmte_get_power_status,
-        .alsa_config    = &palmte_alsa_config,
-};
 static struct omap_board_config_kernel palmte_config[] __initdata = {
        { OMAP_TAG_USB,         &palmte_usb_config },
        { OMAP_TAG_MMC,         &palmte_mmc_config },
@@ -336,7 +327,6 @@ static struct spi_board_info palmte_spi_info[] __initdata = {
                .bus_num        = 2,    /* uWire (officially) */
                .chip_select    = 0,    /* As opposed to 3 */
                .irq            = OMAP_GPIO_IRQ(PALMTE_PINTDAV_GPIO),
-                .platform_data  = &palmte_tsc2102_config,
                .max_speed_hz   = 8000000,
        },
 };
diff --git a/arch/arm/mach-pxa/cm-x270.c b/arch/arm/mach-pxa/cm-x270.c
index 6d4416a4f378..f5851d1adc25 100644
--- a/arch/arm/mach-pxa/cm-x270.c
+++ b/arch/arm/mach-pxa/cm-x270.c
@@ -59,7 +59,7 @@ static struct resource cmx270_dm9k_resource[] = {
        [2] = {
                .start = CMX270_ETHIRQ,
                .end   = CMX270_ETHIRQ,
-                .flags = IORESOURCE_IRQ,
+                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE,
        }
 };
diff --git a/arch/arm/mach-pxa/em-x270.c b/arch/arm/mach-pxa/em-x270.c
index edc4f07a230d..9c57700ee5c2 100644
--- a/arch/arm/mach-pxa/em-x270.c
+++ b/arch/arm/mach-pxa/em-x270.c
@@ -50,7 +50,7 @@ static struct resource em_x270_dm9k_resource[] = {
        [2] = {
                .start = EM_X270_ETHIRQ,
                .end   = EM_X270_ETHIRQ,
-                .flags = IORESOURCE_IRQ,
+                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE,
        }
 };
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index dace3820f1ee..e7d0fcd9b43f 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -38,7 +38,6 @@
 #include <asm/arch/pxa-regs.h>
 #include <asm/arch/pxa2xx-regs.h>
 #include <asm/arch/pxa2xx-gpio.h>
-#include <asm/arch/pxa27x-udc.h>
 #include <asm/arch/irda.h>
 #include <asm/arch/mmc.h>
 #include <asm/arch/ohci.h>
diff --git a/arch/arm/mach-pxa/ssp.c b/arch/arm/mach-pxa/ssp.c
index 00af7f2fed66..0bb31982fb6f 100644
--- a/arch/arm/mach-pxa/ssp.c
+++ b/arch/arm/mach-pxa/ssp.c
@@ -330,7 +330,7 @@ struct ssp_device *ssp_request(int port, const char *label)
        mutex_unlock(&ssp_lock);
-        if (ssp->port_id != port)
+        if (&ssp->node == &ssp_list)
                return NULL;
        return ssp;
diff --git a/arch/arm/mach-pxa/tosa.c b/arch/arm/mach-pxa/tosa.c
index c2cbd66db814..ab4a9f579913 100644
--- a/arch/arm/mach-pxa/tosa.c
+++ b/arch/arm/mach-pxa/tosa.c
@@ -467,8 +467,8 @@ static struct platform_device *devices[] __initdata = {
 static void tosa_poweroff(void)
 {
-        pxa_gpio_mode(TOSA_GPIO_ON_RESET | GPIO_OUT);
+        gpio_direction_output(TOSA_GPIO_ON_RESET, 0);
-        GPSR(TOSA_GPIO_ON_RESET) = GPIO_bit(TOSA_GPIO_ON_RESET);
+        gpio_set_value(TOSA_GPIO_ON_RESET, 1);
        mdelay(1000);
        arm_machine_restart('h');
diff --git a/arch/arm/mach-s3c2410/mach-bast.c b/arch/arm/mach-s3c2410/mach-bast.c
index 661a2358ac22..27f63d5d3a7b 100644
--- a/arch/arm/mach-s3c2410/mach-bast.c
+++ b/arch/arm/mach-s3c2410/mach-bast.c
@@ -374,7 +374,7 @@ static struct resource bast_dm9k_resource[] = {
        [2] = {
                .start = IRQ_DM9000,
                .end   = IRQ_DM9000,
-                .flags = IORESOURCE_IRQ,
+                .flags = IORESOURCE_IRQ | IRQF_TRIGGER_HIGH,
        }
 };
diff --git a/arch/arm/mach-s3c2410/mach-vr1000.c b/arch/arm/mach-s3c2410/mach-vr1000.c
index c56423373ff3..4c4b5c4207c4 100644
--- a/arch/arm/mach-s3c2410/mach-vr1000.c
+++ b/arch/arm/mach-s3c2410/mach-vr1000.c
@@ -263,7 +263,7 @@ static struct resource vr1000_dm9k0_resource[] = {
        [2] = {
                .start = IRQ_VR1000_DM9000A,
                .end   = IRQ_VR1000_DM9000A,
-                .flags = IORESOURCE_IRQ
+                .flags = IORESOURCE_IRQ | IRQF_TRIGGER_HIGH,
        }
 };
@@ -282,7 +282,7 @@ static struct resource vr1000_dm9k1_resource[] = {
        [2] = {
                .start = IRQ_VR1000_DM9000N,
                .end   = IRQ_VR1000_DM9000N,
-                .flags = IORESOURCE_IRQ
+                .flags = IORESOURCE_IRQ | IRQF_TRIGGER_HIGH,
        }
 };
diff --git a/arch/arm/mach-sa1100/collie.c b/arch/arm/mach-sa1100/collie.c
index 6496eb645cee..2f772a3965c4 100644
--- a/arch/arm/mach-sa1100/collie.c
+++ b/arch/arm/mach-sa1100/collie.c
@@ -225,26 +225,28 @@ static void __init collie_init(void)
        int ret = 0;
        /* cpu initialize */
-        GAFR = ( GPIO_SSP_TXD | \
+        GAFR = GPIO_SSP_TXD | GPIO_SSP_SCLK | GPIO_SSP_SFRM | GPIO_SSP_CLK |
-                 GPIO_SSP_SCLK | GPIO_SSP_SFRM | GPIO_SSP_CLK | GPIO_TIC_ACK | \
+                GPIO_MCP_CLK | GPIO_32_768kHz;
-                 GPIO_32_768kHz );
+        GPDR = GPIO_LDD8 | GPIO_LDD9 | GPIO_LDD10 | GPIO_LDD11 | GPIO_LDD12 |
-        GPDR = ( GPIO_LDD8 | GPIO_LDD9 | GPIO_LDD10 | GPIO_LDD11 | GPIO_LDD12 | \
+                GPIO_LDD13 | GPIO_LDD14 | GPIO_LDD15 | GPIO_SSP_TXD |
-                 GPIO_LDD13 | GPIO_LDD14 | GPIO_LDD15 | GPIO_SSP_TXD | \
+                GPIO_SSP_SCLK | GPIO_SSP_SFRM | GPIO_SDLC_SCLK |
-                 GPIO_SSP_SCLK | GPIO_SSP_SFRM | GPIO_SDLC_SCLK | \
+                COLLIE_GPIO_UCB1x00_RESET | COLLIE_GPIO_nMIC_ON |
-                 GPIO_SDLC_AAF | GPIO_UART_SCLK1 | GPIO_32_768kHz );
+                COLLIE_GPIO_nREMOCON_ON | GPIO_32_768kHz;
-        GPLR = GPIO_GPIO18;
+        PPDR = PPC_LDD0 | PPC_LDD1 | PPC_LDD2 | PPC_LDD3 | PPC_LDD4 | PPC_LDD5 |
-        // PPC pin setting
+                PPC_LDD6 | PPC_LDD7 | PPC_L_PCLK | PPC_L_LCLK | PPC_L_FCLK | PPC_L_BIAS |
-        PPDR = ( PPC_LDD0 | PPC_LDD1 | PPC_LDD2 | PPC_LDD3 | PPC_LDD4 | PPC_LDD5 | \
+                PPC_TXD1 | PPC_TXD2 | PPC_TXD3 | PPC_TXD4 | PPC_SCLK | PPC_SFRM;
-                 PPC_LDD6 | PPC_LDD7 | PPC_L_PCLK | PPC_L_LCLK | PPC_L_FCLK | PPC_L_BIAS | \
-                 PPC_TXD1 | PPC_TXD2 | PPC_RXD2 | PPC_TXD3 | PPC_TXD4 | PPC_SCLK | PPC_SFRM );
+        PWER = COLLIE_GPIO_AC_IN | COLLIE_GPIO_CO | COLLIE_GPIO_ON_KEY |
+                COLLIE_GPIO_WAKEUP | COLLIE_GPIO_nREMOCON_INT | PWER_RTC;
-        PSDR = ( PPC_RXD1 | PPC_RXD2 | PPC_RXD3 | PPC_RXD4 );
+        PGSR = COLLIE_GPIO_nREMOCON_ON;
-        GAFR |= GPIO_32_768kHz;
-        GPDR |= GPIO_32_768kHz;
+        PSDR = PPC_RXD1 | PPC_RXD2 | PPC_RXD3 | PPC_RXD4;
-        TUCR  = TUCR_32_768kHz;
+        PCFR = PCFR_OPDE;
        platform_scoop_config = &collie_pcmcia_config;
diff --git a/arch/arm/plat-omap/clock.c b/arch/arm/plat-omap/clock.c
index 2946c193a7d6..2db5580048d8 100644
--- a/arch/arm/plat-omap/clock.c
+++ b/arch/arm/plat-omap/clock.c
@@ -21,6 +21,7 @@
 #include <linux/clk.h>
 #include <linux/mutex.h>
 #include <linux/platform_device.h>
+#include <linux/cpufreq.h>
 #include <asm/io.h>
diff --git a/arch/arm/plat-s3c24xx/s3c244x.c b/arch/arm/plat-s3c24xx/s3c244x.c
index f197bb3a2366..2f01af5f64c4 100644
--- a/arch/arm/plat-s3c24xx/s3c244x.c
+++ b/arch/arm/plat-s3c24xx/s3c244x.c
@@ -65,6 +65,7 @@ void __init s3c244x_map_io(struct map_desc *mach_desc, int size)
        /* rename any peripherals used differing from the s3c2410 */
+        s3c_device_sdi.name  = "s3c2440-sdi";
        s3c_device_i2c.name  = "s3c2440-i2c";
        s3c_device_nand.name = "s3c2440-nand";
        s3c_device_usbgadget.name = "s3c2440-usbgadget";
diff --git a/arch/avr32/configs/atngw100_defconfig b/arch/avr32/configs/atngw100_defconfig
index 06046074d68b..119edb839ac3 100644
--- a/arch/avr32/configs/atngw100_defconfig
+++ b/arch/avr32/configs/atngw100_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.24-rc7
+# Linux kernel version: 2.6.26-rc3
-# Wed Jan  9 23:20:41 2008
+# Mon May 26 13:30:59 2008
 #
 CONFIG_AVR32=y
 CONFIG_GENERIC_GPIO=y
@@ -13,10 +13,10 @@ CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_CLOCKEVENTS=y
 # CONFIG_RWSEM_XCHGADD_ALGORITHM is not set
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
-CONFIG_ARCH_SUPPORTS_OPROFILE=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_BUG=y
@@ -37,17 +37,15 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 # CONFIG_TASKSTATS is not set
-# CONFIG_USER_NS is not set
-# CONFIG_PID_NS is not set
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_FAIR_GROUP_SCHED=y
+# CONFIG_GROUP_SCHED is not set
-CONFIG_FAIR_USER_SCHED=y
-# CONFIG_FAIR_CGROUP_SCHED is not set
 CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
+# CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -61,11 +59,13 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
+# CONFIG_COMPAT_BRK is not set
 # CONFIG_BASE_FULL is not set
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
 CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_VM_EVENT_COUNTERS=y
@@ -73,11 +73,21 @@ CONFIG_SLUB_DEBUG=y
 # CONFIG_SLAB is not set
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
+CONFIG_PROFILING=y
+# CONFIG_MARKERS is not set
+CONFIG_OPROFILE=m
+CONFIG_HAVE_OPROFILE=y
+CONFIG_KPROBES=y
+CONFIG_HAVE_KPROBES=y
+# CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_DMA_ATTRS is not set
+CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=1
 CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
@@ -101,10 +111,15 @@ CONFIG_IOSCHED_CFQ=y
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_CLASSIC_RCU=y
 #
 # System Type and features
 #
+CONFIG_TICK_ONESHOT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
 CONFIG_SUBARCH_AVR32B=y
 CONFIG_MMU=y
 CONFIG_PERFORMANCE_COUNTERS=y
@@ -141,16 +156,19 @@ CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 # CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_RESOURCES_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
 # CONFIG_OWNERSHIP_TRACE is not set
+CONFIG_NMI_DEBUGGING=y
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
+# CONFIG_SCHED_HRTICK is not set
 CONFIG_CMDLINE=""
 #
@@ -164,9 +182,10 @@ CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
 # CONFIG_CPU_FREQ_STAT is not set
-CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
 # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
-# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 # CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
 CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
 # CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
@@ -202,6 +221,7 @@ CONFIG_XFRM=y
 CONFIG_XFRM_USER=y
 # CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
 CONFIG_NET_KEY=y
 # CONFIG_NET_KEY_MIGRATE is not set
 CONFIG_INET=y
@@ -255,87 +275,40 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=y
 CONFIG_INET6_XFRM_MODE_BEET=y
 # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
 CONFIG_IPV6_SIT=y
+CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
+# CONFIG_IPV6_MROUTE is not set
 # CONFIG_NETWORK_SECMARK is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
-CONFIG_BRIDGE_NETFILTER=y
+# CONFIG_NETFILTER_ADVANCED is not set
 #
 # Core Netfilter Configuration
 #
-# CONFIG_NETFILTER_NETLINK is not set
+CONFIG_NETFILTER_NETLINK=m
-CONFIG_NF_CONNTRACK_ENABLED=m
+CONFIG_NETFILTER_NETLINK_LOG=m
 CONFIG_NF_CONNTRACK=m
-CONFIG_NF_CT_ACCT=y
-CONFIG_NF_CONNTRACK_MARK=y
-# CONFIG_NF_CONNTRACK_EVENTS is not set
-CONFIG_NF_CT_PROTO_GRE=m
-# CONFIG_NF_CT_PROTO_SCTP is not set
-# CONFIG_NF_CT_PROTO_UDPLITE is not set
-CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
-CONFIG_NF_CONNTRACK_H323=m
 CONFIG_NF_CONNTRACK_IRC=m
-CONFIG_NF_CONNTRACK_NETBIOS_NS=m
-CONFIG_NF_CONNTRACK_PPTP=m
-CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
-CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
 CONFIG_NETFILTER_XTABLES=y
-CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
-# CONFIG_NETFILTER_XT_TARGET_CONNMARK is not set
-# CONFIG_NETFILTER_XT_TARGET_DSCP is not set
 CONFIG_NETFILTER_XT_TARGET_MARK=m
-CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NFLOG=m
-# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set
-# CONFIG_NETFILTER_XT_TARGET_TRACE is not set
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
-CONFIG_NETFILTER_XT_MATCH_COMMENT=m
-CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
-# CONFIG_NETFILTER_XT_MATCH_CONNLIMIT is not set
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
-# CONFIG_NETFILTER_XT_MATCH_DSCP is not set
-CONFIG_NETFILTER_XT_MATCH_ESP=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_POLICY=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-# CONFIG_NETFILTER_XT_MATCH_PHYSDEV is not set
-CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
-CONFIG_NETFILTER_XT_MATCH_QUOTA=m
-CONFIG_NETFILTER_XT_MATCH_REALM=m
-# CONFIG_NETFILTER_XT_MATCH_SCTP is not set
 CONFIG_NETFILTER_XT_MATCH_STATE=m
-CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
-CONFIG_NETFILTER_XT_MATCH_STRING=m
-CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
-# CONFIG_NETFILTER_XT_MATCH_TIME is not set
-# CONFIG_NETFILTER_XT_MATCH_U32 is not set
-CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
 #
 # IP: Netfilter Configuration
 #
 CONFIG_NF_CONNTRACK_IPV4=m
 CONFIG_NF_CONNTRACK_PROC_COMPAT=y
-# CONFIG_IP_NF_QUEUE is not set
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_TARGET_LOG=m
@@ -343,54 +316,25 @@ CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_NF_NAT=m
 CONFIG_NF_NAT_NEEDED=y
 CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_NF_NAT_SNMP_BASIC=m
-CONFIG_NF_NAT_PROTO_GRE=m
 CONFIG_NF_NAT_FTP=m
 CONFIG_NF_NAT_IRC=m
-CONFIG_NF_NAT_TFTP=m
+# CONFIG_NF_NAT_TFTP is not set
-CONFIG_NF_NAT_AMANDA=m
+# CONFIG_NF_NAT_AMANDA is not set
-CONFIG_NF_NAT_PPTP=m
+# CONFIG_NF_NAT_PPTP is not set
-CONFIG_NF_NAT_H323=m
+# CONFIG_NF_NAT_H323 is not set
 CONFIG_NF_NAT_SIP=m
 CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 #
-# IPv6: Netfilter Configuration (EXPERIMENTAL)
+# IPv6: Netfilter Configuration
 #
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_IP6_NF_QUEUE=m
 CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_HL=m
-CONFIG_IP6_NF_MATCH_OWNER=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_LOG=m
 CONFIG_IP6_NF_TARGET_REJECT=m
 CONFIG_IP6_NF_MANGLE=m
-CONFIG_IP6_NF_TARGET_HL=m
-CONFIG_IP6_NF_RAW=m
-#
-# Bridge: Netfilter Configuration
-#
-# CONFIG_BRIDGE_NF_EBTABLES is not set
 # CONFIG_IP_DCCP is not set
 # CONFIG_IP_SCTP is not set
 # CONFIG_TIPC is not set
@@ -407,7 +351,6 @@ CONFIG_LLC=m
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 #
 # Network testing
@@ -415,6 +358,7 @@ CONFIG_NET_CLS_ROUTE=y
 # CONFIG_NET_PKTGEN is not set
 # CONFIG_NET_TCPPROBE is not set
 # CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
@@ -450,6 +394,7 @@ CONFIG_MTD=y
 CONFIG_MTD_PARTITIONS=y
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_AR7_PARTS is not set
 #
 # User Modules And Translation Layers
@@ -531,11 +476,18 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=m
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
-CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
+# CONFIG_BLK_DEV_XIP is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
-# CONFIG_MISC_DEVICES is not set
+CONFIG_MISC_DEVICES=y
-# CONFIG_IDE is not set
+# CONFIG_ATMEL_PWM is not set
+CONFIG_ATMEL_TCLIB=y
+CONFIG_ATMEL_TCB_CLKSRC=y
+CONFIG_ATMEL_TCB_CLKSRC_BLOCK=0
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_ATMEL_SSC is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_HAVE_IDE is not set
 #
 # SCSI device support
@@ -568,11 +520,13 @@ CONFIG_PHYLIB=y
 # CONFIG_SMSC_PHY is not set
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
+# CONFIG_REALTEK_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
 # CONFIG_MII is not set
 CONFIG_MACB=y
+# CONFIG_ENC28J60 is not set
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
@@ -586,6 +540,7 @@ CONFIG_MACB=y
 #
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
+# CONFIG_IWLWIFI_LEDS is not set
 # CONFIG_WAN is not set
 CONFIG_PPP=m
 # CONFIG_PPP_MULTILINK is not set
@@ -599,7 +554,6 @@ CONFIG_PPPOE=m
 # CONFIG_PPPOL2TP is not set
 # CONFIG_SLIP is not set
 CONFIG_SLHC=m
-# CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
 # CONFIG_NET_POLL_CONTROLLER is not set
@@ -621,6 +575,7 @@ CONFIG_SLHC=m
 # Character devices
 #
 # CONFIG_VT is not set
+# CONFIG_DEVKMEM is not set
 # CONFIG_SERIAL_NONSTANDARD is not set
 #
@@ -633,6 +588,7 @@ CONFIG_SLHC=m
 #
 CONFIG_SERIAL_ATMEL=y
 CONFIG_SERIAL_ATMEL_CONSOLE=y
+CONFIG_SERIAL_ATMEL_PDC=y
 # CONFIG_SERIAL_ATMEL_TTYAT is not set
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
@@ -640,21 +596,13 @@ CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
-# CONFIG_RTC is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_R3964 is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_TCG_TPM is not set
 CONFIG_I2C=m
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=m
-#
-# I2C Algorithms
-#
 CONFIG_I2C_ALGOBIT=m
-# CONFIG_I2C_ALGOPCF is not set
-# CONFIG_I2C_ALGOPCA is not set
 #
 # I2C Hardware Bus support
@@ -665,27 +613,23 @@ CONFIG_I2C_GPIO=m
 # CONFIG_I2C_SIMTEC is not set
 # CONFIG_I2C_TAOS_EVM is not set
 # CONFIG_I2C_STUB is not set
+# CONFIG_I2C_PCA_PLATFORM is not set
 #
 # Miscellaneous I2C Chip support
 #
-# CONFIG_SENSORS_DS1337 is not set
-# CONFIG_SENSORS_DS1374 is not set
 # CONFIG_DS1682 is not set
 # CONFIG_SENSORS_EEPROM is not set
 # CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_TPS65010 is not set
 # CONFIG_SENSORS_MAX6875 is not set
 # CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CHIP is not set
-#
-# SPI support
-#
 CONFIG_SPI=y
 # CONFIG_SPI_DEBUG is not set
 CONFIG_SPI_MASTER=y
@@ -702,9 +646,27 @@ CONFIG_SPI_ATMEL=y
 # CONFIG_SPI_AT25 is not set
 CONFIG_SPI_SPIDEV=m
 # CONFIG_SPI_TLE62X0 is not set
+CONFIG_HAVE_GPIO_LIB=y
+#
+# GPIO Support
+#
+# CONFIG_DEBUG_GPIO is not set
+#
+# I2C GPIO expanders:
+#
+# CONFIG_GPIO_PCA953X is not set
+# CONFIG_GPIO_PCF857X is not set
+#
+# SPI GPIO expanders:
+#
+# CONFIG_GPIO_MCP23S08 is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
+# CONFIG_THERMAL is not set
 CONFIG_WATCHDOG=y
 # CONFIG_WATCHDOG_NOWAYOUT is not set
@@ -724,12 +686,22 @@ CONFIG_SSB_POSSIBLE=y
 # Multifunction device drivers
 #
 # CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
 #
 # Multimedia devices
 #
+#
+# Multimedia core support
+#
 # CONFIG_VIDEO_DEV is not set
 # CONFIG_DVB_CORE is not set
+# CONFIG_VIDEO_MEDIA is not set
+#
+# Multimedia drivers
+#
 # CONFIG_DAB is not set
 #
@@ -753,14 +725,12 @@ CONFIG_USB_SUPPORT=y
 # CONFIG_USB_ARCH_HAS_HCD is not set
 # CONFIG_USB_ARCH_HAS_OHCI is not set
 # CONFIG_USB_ARCH_HAS_EHCI is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
 #
 # NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
 #
-#
-# USB Gadget Support
-#
 CONFIG_USB_GADGET=y
 # CONFIG_USB_GADGET_DEBUG is not set
 # CONFIG_USB_GADGET_DEBUG_FILES is not set
@@ -772,6 +742,7 @@ CONFIG_USB_ATMEL_USBA=y
 # CONFIG_USB_GADGET_NET2280 is not set
 # CONFIG_USB_GADGET_PXA2XX is not set
 # CONFIG_USB_GADGET_M66592 is not set
+# CONFIG_USB_GADGET_PXA27X is not set
 # CONFIG_USB_GADGET_GOKU is not set
 # CONFIG_USB_GADGET_LH7A40X is not set
 # CONFIG_USB_GADGET_OMAP is not set
@@ -787,6 +758,7 @@ CONFIG_USB_FILE_STORAGE=m
 # CONFIG_USB_FILE_STORAGE_TEST is not set
 CONFIG_USB_G_SERIAL=m
 # CONFIG_USB_MIDI_GADGET is not set
+# CONFIG_USB_G_PRINTER is not set
 CONFIG_MMC=m
 # CONFIG_MMC_DEBUG is not set
 # CONFIG_MMC_UNSAFE_RESUME is not set
@@ -797,11 +769,13 @@ CONFIG_MMC=m
 CONFIG_MMC_BLOCK=m
 CONFIG_MMC_BLOCK_BOUNCE=y
 # CONFIG_SDIO_UART is not set
+# CONFIG_MMC_TEST is not set
 #
 # MMC/SD Host Controller Drivers
 #
 CONFIG_MMC_SPI=m
+# CONFIG_MEMSTICK is not set
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
@@ -816,6 +790,8 @@ CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+# CONFIG_ACCESSIBILITY is not set
 CONFIG_RTC_LIB=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_HCTOSYS=y
@@ -844,19 +820,22 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_PCF8563 is not set
 # CONFIG_RTC_DRV_PCF8583 is not set
 # CONFIG_RTC_DRV_M41T80 is not set
+# CONFIG_RTC_DRV_S35390A is not set
 #
 # SPI RTC drivers
 #
-# CONFIG_RTC_DRV_RS5C348 is not set
 # CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_R9701 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
 #
 # Platform RTC drivers
 #
+# CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
-# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
 # CONFIG_RTC_DRV_V3020 is not set
@@ -865,10 +844,6 @@ CONFIG_RTC_INTF_DEV=y
 # on-CPU RTC drivers
 #
 CONFIG_RTC_DRV_AT32AP700X=y
-#
-# Userspace I/O
-#
 # CONFIG_UIO is not set
 #
@@ -885,14 +860,11 @@ CONFIG_JBD=m
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
-# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
-# CONFIG_MINIX_FS is not set
+# CONFIG_DNOTIFY is not set
-# CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
-# CONFIG_DNOTIFY is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
 CONFIG_FUSE_FS=m
@@ -948,8 +920,10 @@ CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
+# CONFIG_ROMFS_FS is not set
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
 CONFIG_NETWORK_FILESYSTEMS=y
@@ -957,12 +931,10 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 # CONFIG_NFS_V4 is not set
-# CONFIG_NFS_DIRECTIO is not set
 CONFIG_NFSD=m
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
-CONFIG_NFSD_TCP=y
 CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
@@ -1030,11 +1002,6 @@ CONFIG_NLS_ISO8859_1=m
 # CONFIG_NLS_KOI8_U is not set
 CONFIG_NLS_UTF8=m
 # CONFIG_DLM is not set
-CONFIG_INSTRUMENTATION=y
-CONFIG_PROFILING=y
-CONFIG_OPROFILE=m
-CONFIG_KPROBES=y
-# CONFIG_MARKERS is not set
 #
 # Kernel hacking
@@ -1042,6 +1009,7 @@ CONFIG_KPROBES=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=1024
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 # CONFIG_DEBUG_FS is not set
@@ -1052,7 +1020,9 @@ CONFIG_DETECT_SOFTLOCKUP=y
 CONFIG_SCHED_DEBUG=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_OBJECTS is not set
 # CONFIG_SLUB_DEBUG_ON is not set
+# CONFIG_SLUB_STATS is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
@@ -1066,12 +1036,14 @@ CONFIG_SCHED_DEBUG=y
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
 CONFIG_FRAME_POINTER=y
-# CONFIG_FORCED_INLINING is not set
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_KPROBES_SANITY_TEST is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
 # CONFIG_LKDTM is not set
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_SAMPLES is not set
@@ -1083,52 +1055,90 @@ CONFIG_FRAME_POINTER=y
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITY_FILE_CAPABILITIES is not set
 CONFIG_CRYPTO=y
+#
+# Crypto core or helper
+#
 CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_AEAD=y
 CONFIG_CRYPTO_BLKCIPHER=y
 CONFIG_CRYPTO_HASH=y
 CONFIG_CRYPTO_MANAGER=y
+# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+CONFIG_CRYPTO_AUTHENC=y
+# CONFIG_CRYPTO_TEST is not set
+#
+# Authenticated Encryption with Associated Data
+#
+# CONFIG_CRYPTO_CCM is not set
+# CONFIG_CRYPTO_GCM is not set
+# CONFIG_CRYPTO_SEQIV is not set
+#
+# Block modes
+#
+CONFIG_CRYPTO_CBC=y
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_CTS is not set
+CONFIG_CRYPTO_ECB=m
+# CONFIG_CRYPTO_LRW is not set
+CONFIG_CRYPTO_PCBC=m
+# CONFIG_CRYPTO_XTS is not set
+#
+# Hash modes
+#
 CONFIG_CRYPTO_HMAC=y
 # CONFIG_CRYPTO_XCBC is not set
-# CONFIG_CRYPTO_NULL is not set
+#
+# Digest
+#
+# CONFIG_CRYPTO_CRC32C is not set
 # CONFIG_CRYPTO_MD4 is not set
 CONFIG_CRYPTO_MD5=y
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
 CONFIG_CRYPTO_SHA1=y
 # CONFIG_CRYPTO_SHA256 is not set
 # CONFIG_CRYPTO_SHA512 is not set
-# CONFIG_CRYPTO_WP512 is not set
 # CONFIG_CRYPTO_TGR192 is not set
-# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_WP512 is not set
-CONFIG_CRYPTO_ECB=m
-CONFIG_CRYPTO_CBC=y
+#
-CONFIG_CRYPTO_PCBC=m
+# Ciphers
-# CONFIG_CRYPTO_LRW is not set
+#
-# CONFIG_CRYPTO_XTS is not set
-# CONFIG_CRYPTO_CRYPTD is not set
-CONFIG_CRYPTO_DES=y
-# CONFIG_CRYPTO_FCRYPT is not set
-# CONFIG_CRYPTO_BLOWFISH is not set
-# CONFIG_CRYPTO_TWOFISH is not set
-# CONFIG_CRYPTO_SERPENT is not set
 # CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+CONFIG_CRYPTO_ARC4=m
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
-# CONFIG_CRYPTO_TEA is not set
+CONFIG_CRYPTO_DES=y
-CONFIG_CRYPTO_ARC4=m
+# CONFIG_CRYPTO_FCRYPT is not set
 # CONFIG_CRYPTO_KHAZAD is not set
-# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_SALSA20 is not set
 # CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+#
+# Compression
+#
 CONFIG_CRYPTO_DEFLATE=y
-# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_LZO is not set
-# CONFIG_CRYPTO_CRC32C is not set
-# CONFIG_CRYPTO_CAMELLIA is not set
-# CONFIG_CRYPTO_TEST is not set
-# CONFIG_CRYPTO_AUTHENC is not set
 CONFIG_CRYPTO_HW=y
 #
 # Library routines
 #
 CONFIG_BITREVERSE=y
+# CONFIG_GENERIC_FIND_FIRST_BIT is not set
+# CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
 CONFIG_CRC_ITU_T=m
@@ -1137,10 +1147,6 @@ CONFIG_CRC7=m
 # CONFIG_LIBCRC32C is not set
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=y
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 CONFIG_PLIST=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
diff --git a/arch/avr32/configs/atstk1002_defconfig b/arch/avr32/configs/atstk1002_defconfig
index 2fb2ede5f2b4..c6d02eac8791 100644
--- a/arch/avr32/configs/atstk1002_defconfig
+++ b/arch/avr32/configs/atstk1002_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.24-rc7
+# Linux kernel version: 2.6.26-rc3
-# Wed Jan  9 23:07:43 2008
+# Mon May 26 13:30:20 2008
 #
 CONFIG_AVR32=y
 CONFIG_GENERIC_GPIO=y
@@ -13,10 +13,10 @@ CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_CLOCKEVENTS=y
 # CONFIG_RWSEM_XCHGADD_ALGORITHM is not set
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
-CONFIG_ARCH_SUPPORTS_OPROFILE=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_BUG=y
@@ -36,15 +36,15 @@ CONFIG_SYSVIPC_SYSCTL=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
-# CONFIG_USER_NS is not set
-# CONFIG_PID_NS is not set
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-# CONFIG_FAIR_GROUP_SCHED is not set
+# CONFIG_GROUP_SCHED is not set
 CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_RELAY=y
+# CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -58,11 +58,13 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
+# CONFIG_COMPAT_BRK is not set
 # CONFIG_BASE_FULL is not set
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
 CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_VM_EVENT_COUNTERS=y
@@ -70,11 +72,21 @@ CONFIG_SLUB_DEBUG=y
 # CONFIG_SLAB is not set
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
+CONFIG_PROFILING=y
+# CONFIG_MARKERS is not set
+CONFIG_OPROFILE=m
+CONFIG_HAVE_OPROFILE=y
+CONFIG_KPROBES=y
+CONFIG_HAVE_KPROBES=y
+# CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_DMA_ATTRS is not set
+CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=1
 CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
@@ -98,10 +110,15 @@ CONFIG_IOSCHED_CFQ=y
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_CLASSIC_RCU=y
 #
 # System Type and features
 #
+CONFIG_TICK_ONESHOT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
 CONFIG_SUBARCH_AVR32B=y
 CONFIG_MMU=y
 CONFIG_PERFORMANCE_COUNTERS=y
@@ -147,16 +164,19 @@ CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 # CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_RESOURCES_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
 # CONFIG_OWNERSHIP_TRACE is not set
+CONFIG_NMI_DEBUGGING=y
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
+# CONFIG_SCHED_HRTICK is not set
 CONFIG_CMDLINE=""
 #
@@ -170,9 +190,10 @@ CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
 # CONFIG_CPU_FREQ_STAT is not set
-CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
 # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
-# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 # CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
 CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
 # CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
@@ -208,6 +229,7 @@ CONFIG_XFRM=y
 CONFIG_XFRM_USER=m
 # CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
 CONFIG_NET_KEY=m
 # CONFIG_NET_KEY_MIGRATE is not set
 CONFIG_INET=y
@@ -252,8 +274,10 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m
 CONFIG_INET6_XFRM_MODE_BEET=m
 # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
 CONFIG_IPV6_SIT=m
+CONFIG_IPV6_NDISC_NODETYPE=y
 CONFIG_IPV6_TUNNEL=m
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
+# CONFIG_IPV6_MROUTE is not set
 # CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
 # CONFIG_IP_DCCP is not set
@@ -279,6 +303,7 @@ CONFIG_LLC=m
 # CONFIG_NET_PKTGEN is not set
 # CONFIG_NET_TCPPROBE is not set
 # CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
@@ -314,6 +339,7 @@ CONFIG_MTD=y
 CONFIG_MTD_PARTITIONS=y
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_AR7_PARTS is not set
 #
 # User Modules And Translation Layers
@@ -368,6 +394,7 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=2
 #
 CONFIG_MTD_DATAFLASH=m
 CONFIG_MTD_M25P80=m
+CONFIG_M25PXX_USE_FAST_READ=y
 # CONFIG_MTD_SLRAM is not set
 # CONFIG_MTD_PHRAM is not set
 # CONFIG_MTD_MTDRAM is not set
@@ -395,13 +422,18 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=m
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
-CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
+# CONFIG_BLK_DEV_XIP is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 CONFIG_MISC_DEVICES=y
+CONFIG_ATMEL_PWM=m
+CONFIG_ATMEL_TCLIB=y
+CONFIG_ATMEL_TCB_CLKSRC=y
+CONFIG_ATMEL_TCB_CLKSRC_BLOCK=0
 # CONFIG_EEPROM_93CX6 is not set
 CONFIG_ATMEL_SSC=m
-# CONFIG_IDE is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_HAVE_IDE is not set
 #
 # SCSI device support
@@ -444,6 +476,9 @@ CONFIG_SCSI_WAIT_SCAN=m
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_ATA=m
 # CONFIG_ATA_NONSTANDARD is not set
+# CONFIG_SATA_PMP is not set
+CONFIG_ATA_SFF=y
+# CONFIG_SATA_MV is not set
 CONFIG_PATA_AT32=m
 # CONFIG_PATA_PLATFORM is not set
 # CONFIG_MD is not set
@@ -469,11 +504,13 @@ CONFIG_PHYLIB=y
 # CONFIG_SMSC_PHY is not set
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
+# CONFIG_REALTEK_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
 # CONFIG_MII is not set
 CONFIG_MACB=y
+# CONFIG_ENC28J60 is not set
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
@@ -487,6 +524,7 @@ CONFIG_MACB=y
 #
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
+# CONFIG_IWLWIFI_LEDS is not set
 # CONFIG_WAN is not set
 CONFIG_PPP=m
 # CONFIG_PPP_MULTILINK is not set
@@ -500,7 +538,6 @@ CONFIG_PPP_BSDCOMP=m
 # CONFIG_PPPOL2TP is not set
 # CONFIG_SLIP is not set
 CONFIG_SLHC=m
-# CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
 # CONFIG_NET_POLL_CONTROLLER is not set
@@ -556,6 +593,7 @@ CONFIG_MOUSE_GPIO=m
 # Character devices
 #
 # CONFIG_VT is not set
+# CONFIG_DEVKMEM is not set
 # CONFIG_SERIAL_NONSTANDARD is not set
 #
@@ -568,6 +606,7 @@ CONFIG_MOUSE_GPIO=m
 #
 CONFIG_SERIAL_ATMEL=y
 CONFIG_SERIAL_ATMEL_CONSOLE=y
+CONFIG_SERIAL_ATMEL_PDC=y
 # CONFIG_SERIAL_ATMEL_TTYAT is not set
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
@@ -575,21 +614,13 @@ CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
-# CONFIG_RTC is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_R3964 is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_TCG_TPM is not set
 CONFIG_I2C=m
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=m
-#
-# I2C Algorithms
-#
 CONFIG_I2C_ALGOBIT=m
-# CONFIG_I2C_ALGOPCF is not set
-# CONFIG_I2C_ALGOPCA is not set
 #
 # I2C Hardware Bus support
@@ -600,27 +631,23 @@ CONFIG_I2C_GPIO=m
 # CONFIG_I2C_SIMTEC is not set
 # CONFIG_I2C_TAOS_EVM is not set
 # CONFIG_I2C_STUB is not set
+# CONFIG_I2C_PCA_PLATFORM is not set
 #
 # Miscellaneous I2C Chip support
 #
-# CONFIG_SENSORS_DS1337 is not set
-# CONFIG_SENSORS_DS1374 is not set
 # CONFIG_DS1682 is not set
 # CONFIG_SENSORS_EEPROM is not set
 # CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_TPS65010 is not set
 # CONFIG_SENSORS_MAX6875 is not set
 # CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CHIP is not set
-#
-# SPI support
-#
 CONFIG_SPI=y
 # CONFIG_SPI_DEBUG is not set
 CONFIG_SPI_MASTER=y
@@ -637,9 +664,27 @@ CONFIG_SPI_ATMEL=y
 # CONFIG_SPI_AT25 is not set
 CONFIG_SPI_SPIDEV=m
 # CONFIG_SPI_TLE62X0 is not set
+CONFIG_HAVE_GPIO_LIB=y
+#
+# GPIO Support
+#
+# CONFIG_DEBUG_GPIO is not set
+#
+# I2C GPIO expanders:
+#
+# CONFIG_GPIO_PCA953X is not set
+# CONFIG_GPIO_PCF857X is not set
+#
+# SPI GPIO expanders:
+#
+# CONFIG_GPIO_MCP23S08 is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
+# CONFIG_THERMAL is not set
 CONFIG_WATCHDOG=y
 # CONFIG_WATCHDOG_NOWAYOUT is not set
@@ -659,12 +704,22 @@ CONFIG_SSB_POSSIBLE=y
 # Multifunction device drivers
 #
 # CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
 #
 # Multimedia devices
 #
+#
+# Multimedia core support
+#
 # CONFIG_VIDEO_DEV is not set
 # CONFIG_DVB_CORE is not set
+# CONFIG_VIDEO_MEDIA is not set
+#
+# Multimedia drivers
+#
 # CONFIG_DAB is not set
 #
@@ -682,8 +737,8 @@ CONFIG_FB_CFB_IMAGEBLIT=y
 # CONFIG_FB_SYS_FILLRECT is not set
 # CONFIG_FB_SYS_COPYAREA is not set
 # CONFIG_FB_SYS_IMAGEBLIT is not set
+# CONFIG_FB_FOREIGN_ENDIAN is not set
 # CONFIG_FB_SYS_FOPS is not set
-CONFIG_FB_DEFERRED_IO=y
 # CONFIG_FB_SVGALIB is not set
 # CONFIG_FB_MACMODES is not set
 # CONFIG_FB_BACKLIGHT is not set
@@ -749,7 +804,11 @@ CONFIG_SND_AT73C213_TARGET_BITRATE=48000
 # CONFIG_SND_SOC is not set
 #
-# SoC Audio support for SuperH
+# ALSA SoC audio for Freescale SOCs
+#
+#
+# SoC Audio for the Texas Instruments OMAP
 #
 #
@@ -761,14 +820,12 @@ CONFIG_USB_SUPPORT=y
 # CONFIG_USB_ARCH_HAS_HCD is not set
 # CONFIG_USB_ARCH_HAS_OHCI is not set
 # CONFIG_USB_ARCH_HAS_EHCI is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
 #
 # NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
 #
-#
-# USB Gadget Support
-#
 CONFIG_USB_GADGET=y
 # CONFIG_USB_GADGET_DEBUG is not set
 # CONFIG_USB_GADGET_DEBUG_FILES is not set
@@ -781,6 +838,7 @@ CONFIG_USB_ATMEL_USBA=y
 # CONFIG_USB_GADGET_NET2280 is not set
 # CONFIG_USB_GADGET_PXA2XX is not set
 # CONFIG_USB_GADGET_M66592 is not set
+# CONFIG_USB_GADGET_PXA27X is not set
 # CONFIG_USB_GADGET_GOKU is not set
 # CONFIG_USB_GADGET_LH7A40X is not set
 # CONFIG_USB_GADGET_OMAP is not set
@@ -796,6 +854,7 @@ CONFIG_USB_FILE_STORAGE=m
 # CONFIG_USB_FILE_STORAGE_TEST is not set
 CONFIG_USB_G_SERIAL=m
 # CONFIG_USB_MIDI_GADGET is not set
+# CONFIG_USB_G_PRINTER is not set
 CONFIG_MMC=m
 # CONFIG_MMC_DEBUG is not set
 # CONFIG_MMC_UNSAFE_RESUME is not set
@@ -806,17 +865,20 @@ CONFIG_MMC=m
 CONFIG_MMC_BLOCK=m
 CONFIG_MMC_BLOCK_BOUNCE=y
 # CONFIG_SDIO_UART is not set
+CONFIG_MMC_TEST=m
 #
 # MMC/SD Host Controller Drivers
 #
 CONFIG_MMC_SPI=m
+# CONFIG_MEMSTICK is not set
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=m
 #
 # LED drivers
 #
+CONFIG_LEDS_ATMEL_PWM=m
 CONFIG_LEDS_GPIO=m
 #
@@ -825,6 +887,8 @@ CONFIG_LEDS_GPIO=m
 CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=m
 CONFIG_LEDS_TRIGGER_HEARTBEAT=m
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=m
+# CONFIG_ACCESSIBILITY is not set
 CONFIG_RTC_LIB=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_HCTOSYS=y
@@ -853,19 +917,22 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_PCF8563 is not set
 # CONFIG_RTC_DRV_PCF8583 is not set
 # CONFIG_RTC_DRV_M41T80 is not set
+# CONFIG_RTC_DRV_S35390A is not set
 #
 # SPI RTC drivers
 #
-# CONFIG_RTC_DRV_RS5C348 is not set
 # CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_R9701 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
 #
 # Platform RTC drivers
 #
+# CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
-# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
 # CONFIG_RTC_DRV_V3020 is not set
@@ -874,10 +941,6 @@ CONFIG_RTC_INTF_DEV=y
 # on-CPU RTC drivers
 #
 CONFIG_RTC_DRV_AT32AP700X=y
-#
-# Userspace I/O
-#
 # CONFIG_UIO is not set
 #
@@ -895,14 +958,11 @@ CONFIG_JBD=m
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
-# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
-CONFIG_MINIX_FS=m
+# CONFIG_DNOTIFY is not set
-# CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
-# CONFIG_DNOTIFY is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
 CONFIG_FUSE_FS=m
@@ -957,8 +1017,10 @@ CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_VXFS_FS is not set
+CONFIG_MINIX_FS=m
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
+# CONFIG_ROMFS_FS is not set
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
 CONFIG_NETWORK_FILESYSTEMS=y
@@ -966,7 +1028,6 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 # CONFIG_NFS_V4 is not set
-# CONFIG_NFS_DIRECTIO is not set
 # CONFIG_NFSD is not set
 CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
@@ -1028,11 +1089,6 @@ CONFIG_NLS_ISO8859_1=m
 # CONFIG_NLS_KOI8_U is not set
 CONFIG_NLS_UTF8=m
 # CONFIG_DLM is not set
-CONFIG_INSTRUMENTATION=y
-CONFIG_PROFILING=y
-CONFIG_OPROFILE=m
-CONFIG_KPROBES=y
-# CONFIG_MARKERS is not set
 #
 # Kernel hacking
@@ -1040,6 +1096,7 @@ CONFIG_KPROBES=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=1024
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_FS=y
@@ -1050,7 +1107,9 @@ CONFIG_DETECT_SOFTLOCKUP=y
 CONFIG_SCHED_DEBUG=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_OBJECTS is not set
 # CONFIG_SLUB_DEBUG_ON is not set
+# CONFIG_SLUB_STATS is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
@@ -1064,12 +1123,14 @@ CONFIG_SCHED_DEBUG=y
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
 CONFIG_FRAME_POINTER=y
-CONFIG_FORCED_INLINING=y
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_KPROBES_SANITY_TEST is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
 # CONFIG_LKDTM is not set
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_SAMPLES is not set
@@ -1081,52 +1142,90 @@ CONFIG_FORCED_INLINING=y
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITY_FILE_CAPABILITIES is not set
 CONFIG_CRYPTO=y
+#
+# Crypto core or helper
+#
 CONFIG_CRYPTO_ALGAPI=m
+CONFIG_CRYPTO_AEAD=m
 CONFIG_CRYPTO_BLKCIPHER=m
 CONFIG_CRYPTO_HASH=m
 CONFIG_CRYPTO_MANAGER=m
+# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+CONFIG_CRYPTO_AUTHENC=m
+# CONFIG_CRYPTO_TEST is not set
+#
+# Authenticated Encryption with Associated Data
+#
+# CONFIG_CRYPTO_CCM is not set
+# CONFIG_CRYPTO_GCM is not set
+# CONFIG_CRYPTO_SEQIV is not set
+#
+# Block modes
+#
+CONFIG_CRYPTO_CBC=m
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_CTS is not set
+# CONFIG_CRYPTO_ECB is not set
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+#
+# Hash modes
+#
 CONFIG_CRYPTO_HMAC=m
 # CONFIG_CRYPTO_XCBC is not set
-# CONFIG_CRYPTO_NULL is not set
+#
+# Digest
+#
+# CONFIG_CRYPTO_CRC32C is not set
 # CONFIG_CRYPTO_MD4 is not set
 CONFIG_CRYPTO_MD5=m
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
 CONFIG_CRYPTO_SHA1=m
 # CONFIG_CRYPTO_SHA256 is not set
 # CONFIG_CRYPTO_SHA512 is not set
-# CONFIG_CRYPTO_WP512 is not set
 # CONFIG_CRYPTO_TGR192 is not set
-# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_WP512 is not set
-# CONFIG_CRYPTO_ECB is not set
-CONFIG_CRYPTO_CBC=m
+#
-# CONFIG_CRYPTO_PCBC is not set
+# Ciphers
-# CONFIG_CRYPTO_LRW is not set
+#
-# CONFIG_CRYPTO_XTS is not set
-# CONFIG_CRYPTO_CRYPTD is not set
-CONFIG_CRYPTO_DES=m
-# CONFIG_CRYPTO_FCRYPT is not set
-# CONFIG_CRYPTO_BLOWFISH is not set
-# CONFIG_CRYPTO_TWOFISH is not set
-# CONFIG_CRYPTO_SERPENT is not set
 # CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
-# CONFIG_CRYPTO_TEA is not set
+CONFIG_CRYPTO_DES=m
-# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_FCRYPT is not set
 # CONFIG_CRYPTO_KHAZAD is not set
-# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_SALSA20 is not set
 # CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+#
+# Compression
+#
 CONFIG_CRYPTO_DEFLATE=m
-# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_LZO is not set
-# CONFIG_CRYPTO_CRC32C is not set
-# CONFIG_CRYPTO_CAMELLIA is not set
-# CONFIG_CRYPTO_TEST is not set
-# CONFIG_CRYPTO_AUTHENC is not set
 # CONFIG_CRYPTO_HW is not set
 #
 # Library routines
 #
 CONFIG_BITREVERSE=y
+# CONFIG_GENERIC_FIND_FIRST_BIT is not set
+# CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
 CONFIG_CRC_ITU_T=m
diff --git a/arch/avr32/configs/atstk1003_defconfig b/arch/avr32/configs/atstk1003_defconfig
index 45e23e03f074..5a4ae6b5d28f 100644
--- a/arch/avr32/configs/atstk1003_defconfig
+++ b/arch/avr32/configs/atstk1003_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.24-rc7
+# Linux kernel version: 2.6.26-rc3
-# Wed Jan  9 22:54:34 2008
+# Mon May 26 13:33:05 2008
 #
 CONFIG_AVR32=y
 CONFIG_GENERIC_GPIO=y
@@ -13,10 +13,10 @@ CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_CLOCKEVENTS=y
 # CONFIG_RWSEM_XCHGADD_ALGORITHM is not set
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
-CONFIG_ARCH_SUPPORTS_OPROFILE=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_BUG=y
@@ -39,17 +39,15 @@ CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 # CONFIG_TASK_XACCT is not set
-# CONFIG_USER_NS is not set
-# CONFIG_PID_NS is not set
 CONFIG_AUDIT=y
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_FAIR_GROUP_SCHED=y
+# CONFIG_GROUP_SCHED is not set
-CONFIG_FAIR_USER_SCHED=y
-# CONFIG_FAIR_CGROUP_SCHED is not set
 CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_RELAY=y
+# CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -63,11 +61,13 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
+# CONFIG_COMPAT_BRK is not set
 # CONFIG_BASE_FULL is not set
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
 CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_VM_EVENT_COUNTERS=y
@@ -75,11 +75,20 @@ CONFIG_VM_EVENT_COUNTERS=y
 # CONFIG_SLAB is not set
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
-CONFIG_SLABINFO=y
+CONFIG_PROFILING=y
+# CONFIG_MARKERS is not set
+CONFIG_OPROFILE=m
+CONFIG_HAVE_OPROFILE=y
+CONFIG_KPROBES=y
+CONFIG_HAVE_KPROBES=y
+# CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_DMA_ATTRS is not set
+CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=1
 CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
@@ -103,10 +112,15 @@ CONFIG_IOSCHED_CFQ=y
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_CLASSIC_RCU=y
 #
 # System Type and features
 #
+CONFIG_TICK_ONESHOT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
 CONFIG_SUBARCH_AVR32B=y
 CONFIG_MMU=y
 CONFIG_PERFORMANCE_COUNTERS=y
@@ -152,16 +166,19 @@ CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 # CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_RESOURCES_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
 # CONFIG_OWNERSHIP_TRACE is not set
+CONFIG_NMI_DEBUGGING=y
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
+# CONFIG_SCHED_HRTICK is not set
 CONFIG_CMDLINE=""
 #
@@ -175,9 +192,10 @@ CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
 # CONFIG_CPU_FREQ_STAT is not set
-CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
 # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
-# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 # CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
 CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
 # CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
@@ -234,8 +252,6 @@ CONFIG_TCP_CONG_CUBIC=y
 CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_TCP_MD5SIG is not set
 # CONFIG_IPV6 is not set
-# CONFIG_INET6_XFRM_TUNNEL is not set
-# CONFIG_INET6_TUNNEL is not set
 # CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
 # CONFIG_IP_DCCP is not set
@@ -260,6 +276,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_NET_PKTGEN is not set
 # CONFIG_NET_TCPPROBE is not set
 # CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
@@ -295,6 +312,7 @@ CONFIG_MTD=y
 CONFIG_MTD_PARTITIONS=y
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_AR7_PARTS is not set
 #
 # User Modules And Translation Layers
@@ -349,6 +367,7 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=2
 #
 CONFIG_MTD_DATAFLASH=m
 CONFIG_MTD_M25P80=m
+CONFIG_M25PXX_USE_FAST_READ=y
 # CONFIG_MTD_SLRAM is not set
 # CONFIG_MTD_PHRAM is not set
 # CONFIG_MTD_MTDRAM is not set
@@ -376,13 +395,18 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=m
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
-CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
+# CONFIG_BLK_DEV_XIP is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 CONFIG_MISC_DEVICES=y
+CONFIG_ATMEL_PWM=m
+CONFIG_ATMEL_TCLIB=y
+CONFIG_ATMEL_TCB_CLKSRC=y
+CONFIG_ATMEL_TCB_CLKSRC_BLOCK=0
 # CONFIG_EEPROM_93CX6 is not set
 CONFIG_ATMEL_SSC=m
-# CONFIG_IDE is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_HAVE_IDE is not set
 #
 # SCSI device support
@@ -427,6 +451,9 @@ CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_SCSI_DEBUG is not set
 CONFIG_ATA=m
 # CONFIG_ATA_NONSTANDARD is not set
+# CONFIG_SATA_PMP is not set
+CONFIG_ATA_SFF=y
+# CONFIG_SATA_MV is not set
 CONFIG_PATA_AT32=m
 # CONFIG_PATA_PLATFORM is not set
 # CONFIG_MD is not set
@@ -447,6 +474,7 @@ CONFIG_NETDEVICES=y
 #
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
+# CONFIG_IWLWIFI_LEDS is not set
 # CONFIG_WAN is not set
 CONFIG_PPP=m
 # CONFIG_PPP_MULTILINK is not set
@@ -460,7 +488,6 @@ CONFIG_PPP_BSDCOMP=m
 # CONFIG_PPPOL2TP is not set
 # CONFIG_SLIP is not set
 CONFIG_SLHC=m
-# CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
 # CONFIG_NET_POLL_CONTROLLER is not set
@@ -516,6 +543,7 @@ CONFIG_MOUSE_GPIO=m
 # Character devices
 #
 # CONFIG_VT is not set
+# CONFIG_DEVKMEM is not set
 # CONFIG_SERIAL_NONSTANDARD is not set
 #
@@ -528,6 +556,7 @@ CONFIG_MOUSE_GPIO=m
 #
 CONFIG_SERIAL_ATMEL=y
 CONFIG_SERIAL_ATMEL_CONSOLE=y
+CONFIG_SERIAL_ATMEL_PDC=y
 # CONFIG_SERIAL_ATMEL_TTYAT is not set
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
@@ -535,21 +564,13 @@ CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
-# CONFIG_RTC is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_R3964 is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_TCG_TPM is not set
 CONFIG_I2C=m
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=m
-#
-# I2C Algorithms
-#
 CONFIG_I2C_ALGOBIT=m
-# CONFIG_I2C_ALGOPCF is not set
-# CONFIG_I2C_ALGOPCA is not set
 #
 # I2C Hardware Bus support
@@ -560,27 +581,23 @@ CONFIG_I2C_GPIO=m
 # CONFIG_I2C_SIMTEC is not set
 # CONFIG_I2C_TAOS_EVM is not set
 # CONFIG_I2C_STUB is not set
+# CONFIG_I2C_PCA_PLATFORM is not set
 #
 # Miscellaneous I2C Chip support
 #
-# CONFIG_SENSORS_DS1337 is not set
-# CONFIG_SENSORS_DS1374 is not set
 # CONFIG_DS1682 is not set
 # CONFIG_SENSORS_EEPROM is not set
 # CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_TPS65010 is not set
 # CONFIG_SENSORS_MAX6875 is not set
 # CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CHIP is not set
-#
-# SPI support
-#
 CONFIG_SPI=y
 # CONFIG_SPI_DEBUG is not set
 CONFIG_SPI_MASTER=y
@@ -597,9 +614,27 @@ CONFIG_SPI_ATMEL=y
 # CONFIG_SPI_AT25 is not set
 CONFIG_SPI_SPIDEV=m
 # CONFIG_SPI_TLE62X0 is not set
+CONFIG_HAVE_GPIO_LIB=y
+#
+# GPIO Support
+#
+# CONFIG_DEBUG_GPIO is not set
+#
+# I2C GPIO expanders:
+#
+# CONFIG_GPIO_PCA953X is not set
+# CONFIG_GPIO_PCF857X is not set
+#
+# SPI GPIO expanders:
+#
+# CONFIG_GPIO_MCP23S08 is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
+# CONFIG_THERMAL is not set
 CONFIG_WATCHDOG=y
 # CONFIG_WATCHDOG_NOWAYOUT is not set
@@ -619,12 +654,22 @@ CONFIG_SSB_POSSIBLE=y
 # Multifunction device drivers
 #
 # CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
 #
 # Multimedia devices
 #
+#
+# Multimedia core support
+#
 # CONFIG_VIDEO_DEV is not set
 # CONFIG_DVB_CORE is not set
+# CONFIG_VIDEO_MEDIA is not set
+#
+# Multimedia drivers
+#
 # CONFIG_DAB is not set
 #
@@ -682,7 +727,11 @@ CONFIG_SND_AT73C213_TARGET_BITRATE=48000
 # CONFIG_SND_SOC is not set
 #
-# SoC Audio support for SuperH
+# ALSA SoC audio for Freescale SOCs
+#
+#
+# SoC Audio for the Texas Instruments OMAP
 #
 #
@@ -694,14 +743,12 @@ CONFIG_USB_SUPPORT=y
 # CONFIG_USB_ARCH_HAS_HCD is not set
 # CONFIG_USB_ARCH_HAS_OHCI is not set
 # CONFIG_USB_ARCH_HAS_EHCI is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
 #
 # NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
 #
-#
-# USB Gadget Support
-#
 CONFIG_USB_GADGET=y
 # CONFIG_USB_GADGET_DEBUG is not set
 # CONFIG_USB_GADGET_DEBUG_FILES is not set
@@ -714,6 +761,7 @@ CONFIG_USB_ATMEL_USBA=y
 # CONFIG_USB_GADGET_NET2280 is not set
 # CONFIG_USB_GADGET_PXA2XX is not set
 # CONFIG_USB_GADGET_M66592 is not set
+# CONFIG_USB_GADGET_PXA27X is not set
 # CONFIG_USB_GADGET_GOKU is not set
 # CONFIG_USB_GADGET_LH7A40X is not set
 # CONFIG_USB_GADGET_OMAP is not set
@@ -729,6 +777,7 @@ CONFIG_USB_FILE_STORAGE=m
 # CONFIG_USB_FILE_STORAGE_TEST is not set
 CONFIG_USB_G_SERIAL=m
 # CONFIG_USB_MIDI_GADGET is not set
+# CONFIG_USB_G_PRINTER is not set
 CONFIG_MMC=m
 # CONFIG_MMC_DEBUG is not set
 # CONFIG_MMC_UNSAFE_RESUME is not set
@@ -739,17 +788,20 @@ CONFIG_MMC=m
 CONFIG_MMC_BLOCK=m
 # CONFIG_MMC_BLOCK_BOUNCE is not set
 # CONFIG_SDIO_UART is not set
+# CONFIG_MMC_TEST is not set
 #
 # MMC/SD Host Controller Drivers
 #
 CONFIG_MMC_SPI=m
+# CONFIG_MEMSTICK is not set
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 #
 # LED drivers
 #
+CONFIG_LEDS_ATMEL_PWM=m
 CONFIG_LEDS_GPIO=y
 #
@@ -758,6 +810,8 @@ CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+# CONFIG_ACCESSIBILITY is not set
 CONFIG_RTC_LIB=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_HCTOSYS=y
@@ -786,19 +840,22 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_PCF8563 is not set
 # CONFIG_RTC_DRV_PCF8583 is not set
 # CONFIG_RTC_DRV_M41T80 is not set
+# CONFIG_RTC_DRV_S35390A is not set
 #
 # SPI RTC drivers
 #
-# CONFIG_RTC_DRV_RS5C348 is not set
 # CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_R9701 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
 #
 # Platform RTC drivers
 #
+# CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
-# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
 # CONFIG_RTC_DRV_V3020 is not set
@@ -807,11 +864,8 @@ CONFIG_RTC_INTF_DEV=y
 # on-CPU RTC drivers
 #
 CONFIG_RTC_DRV_AT32AP700X=y
-#
-# Userspace I/O
-#
 CONFIG_UIO=m
+# CONFIG_UIO_SMX is not set
 #
 # File systems
@@ -828,14 +882,11 @@ CONFIG_JBD=m
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
-# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
-# CONFIG_MINIX_FS is not set
+# CONFIG_DNOTIFY is not set
-# CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
-# CONFIG_DNOTIFY is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
 CONFIG_FUSE_FS=m
@@ -891,8 +942,10 @@ CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
+# CONFIG_ROMFS_FS is not set
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
 # CONFIG_NETWORK_FILESYSTEMS is not set
@@ -943,11 +996,6 @@ CONFIG_NLS_ISO8859_1=m
 # CONFIG_NLS_KOI8_U is not set
 CONFIG_NLS_UTF8=m
 # CONFIG_DLM is not set
-CONFIG_INSTRUMENTATION=y
-CONFIG_PROFILING=y
-CONFIG_OPROFILE=m
-CONFIG_KPROBES=y
-# CONFIG_MARKERS is not set
 #
 # Kernel hacking
@@ -955,6 +1003,7 @@ CONFIG_KPROBES=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=1024
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_FS=y
@@ -965,6 +1014,7 @@ CONFIG_DETECT_SOFTLOCKUP=y
 CONFIG_SCHED_DEBUG=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_OBJECTS is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
@@ -978,12 +1028,14 @@ CONFIG_SCHED_DEBUG=y
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
 CONFIG_FRAME_POINTER=y
-CONFIG_FORCED_INLINING=y
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_KPROBES_SANITY_TEST is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
 # CONFIG_LKDTM is not set
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_SAMPLES is not set
@@ -1000,6 +1052,8 @@ CONFIG_FORCED_INLINING=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+# CONFIG_GENERIC_FIND_FIRST_BIT is not set
+# CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
 CONFIG_CRC_ITU_T=m
diff --git a/arch/avr32/configs/atstk1004_defconfig b/arch/avr32/configs/atstk1004_defconfig
index 634c52760349..a0912fb7c92e 100644
--- a/arch/avr32/configs/atstk1004_defconfig
+++ b/arch/avr32/configs/atstk1004_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.24-rc7
+# Linux kernel version: 2.6.26-rc3
-# Wed Jan  9 23:04:20 2008
+# Mon May 26 13:34:57 2008
 #
 CONFIG_AVR32=y
 CONFIG_GENERIC_GPIO=y
@@ -13,10 +13,10 @@ CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_CLOCKEVENTS=y
 # CONFIG_RWSEM_XCHGADD_ALGORITHM is not set
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
-CONFIG_ARCH_SUPPORTS_OPROFILE=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_BUG=y
@@ -34,15 +34,15 @@ CONFIG_LOCALVERSION=""
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
-# CONFIG_USER_NS is not set
-# CONFIG_PID_NS is not set
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-# CONFIG_FAIR_GROUP_SCHED is not set
+# CONFIG_GROUP_SCHED is not set
 CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
+# CONFIG_NAMESPACES is not set
 # CONFIG_BLK_DEV_INITRD is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
@@ -54,24 +54,38 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
+# CONFIG_COMPAT_BRK is not set
 # CONFIG_BASE_FULL is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
+# CONFIG_TIMERFD is not set
 # CONFIG_EVENTFD is not set
 CONFIG_SHMEM=y
 CONFIG_VM_EVENT_COUNTERS=y
 # CONFIG_SLAB is not set
 # CONFIG_SLUB is not set
 CONFIG_SLOB=y
+# CONFIG_PROFILING is not set
+# CONFIG_MARKERS is not set
+CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_KPROBES=y
+# CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_PROC_PAGE_MONITOR is not set
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=1
 # CONFIG_MODULES is not set
 # CONFIG_BLOCK is not set
+CONFIG_CLASSIC_RCU=y
 #
 # System Type and features
 #
+# CONFIG_TICK_ONESHOT is not set
+# CONFIG_NO_HZ is not set
+# CONFIG_HIGH_RES_TIMERS is not set
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
 CONFIG_SUBARCH_AVR32B=y
 CONFIG_MMU=y
 CONFIG_PERFORMANCE_COUNTERS=y
@@ -115,16 +129,19 @@ CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 # CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_RESOURCES_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
 # CONFIG_OWNERSHIP_TRACE is not set
+# CONFIG_NMI_DEBUGGING is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
+# CONFIG_SCHED_HRTICK is not set
 CONFIG_CMDLINE=""
 #
@@ -134,20 +151,7 @@ CONFIG_CMDLINE=""
 #
 # CPU Frequency scaling
 #
-CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ is not set
-CONFIG_CPU_FREQ_TABLE=y
-# CONFIG_CPU_FREQ_DEBUG is not set
-# CONFIG_CPU_FREQ_STAT is not set
-CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
-# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
-# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
-# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
-CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
-# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
-CONFIG_CPU_FREQ_GOV_USERSPACE=y
-CONFIG_CPU_FREQ_GOV_ONDEMAND=y
-# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
-CONFIG_CPU_FREQ_AT32AP=y
 #
 # Bus options
@@ -197,8 +201,6 @@ CONFIG_TCP_CONG_CUBIC=y
 CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_TCP_MD5SIG is not set
 # CONFIG_IPV6 is not set
-# CONFIG_INET6_XFRM_TUNNEL is not set
-# CONFIG_INET6_TUNNEL is not set
 # CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
 # CONFIG_IP_DCCP is not set
@@ -222,6 +224,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 #
 # CONFIG_NET_PKTGEN is not set
 # CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
@@ -255,6 +258,7 @@ CONFIG_MTD=y
 CONFIG_MTD_PARTITIONS=y
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_AR7_PARTS is not set
 #
 # User Modules And Translation Layers
@@ -321,6 +325,7 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=2
 # CONFIG_MTD_UBI is not set
 # CONFIG_PARPORT is not set
 # CONFIG_MISC_DEVICES is not set
+# CONFIG_HAVE_IDE is not set
 #
 # SCSI device support
@@ -346,6 +351,7 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=2
 # Character devices
 #
 # CONFIG_VT is not set
+# CONFIG_DEVKMEM is not set
 # CONFIG_SERIAL_NONSTANDARD is not set
 #
@@ -358,6 +364,7 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=2
 #
 CONFIG_SERIAL_ATMEL=y
 CONFIG_SERIAL_ATMEL_CONSOLE=y
+# CONFIG_SERIAL_ATMEL_PDC is not set
 # CONFIG_SERIAL_ATMEL_TTYAT is not set
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
@@ -365,15 +372,9 @@ CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
-# CONFIG_RTC is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_R3964 is not set
 # CONFIG_TCG_TPM is not set
 # CONFIG_I2C is not set
-#
-# SPI support
-#
 CONFIG_SPI=y
 CONFIG_SPI_MASTER=y
@@ -389,9 +390,24 @@ CONFIG_SPI_ATMEL=y
 # CONFIG_SPI_AT25 is not set
 # CONFIG_SPI_SPIDEV is not set
 # CONFIG_SPI_TLE62X0 is not set
+CONFIG_HAVE_GPIO_LIB=y
+#
+# GPIO Support
+#
+#
+# I2C GPIO expanders:
+#
+#
+# SPI GPIO expanders:
+#
+# CONFIG_GPIO_MCP23S08 is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
+# CONFIG_THERMAL is not set
 CONFIG_WATCHDOG=y
 # CONFIG_WATCHDOG_NOWAYOUT is not set
@@ -411,12 +427,22 @@ CONFIG_SSB_POSSIBLE=y
 # Multifunction device drivers
 #
 # CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
 #
 # Multimedia devices
 #
+#
+# Multimedia core support
+#
 # CONFIG_VIDEO_DEV is not set
 # CONFIG_DVB_CORE is not set
+# CONFIG_VIDEO_MEDIA is not set
+#
+# Multimedia drivers
+#
 # CONFIG_DAB is not set
 #
@@ -434,8 +460,8 @@ CONFIG_FB_CFB_IMAGEBLIT=y
 # CONFIG_FB_SYS_FILLRECT is not set
 # CONFIG_FB_SYS_COPYAREA is not set
 # CONFIG_FB_SYS_IMAGEBLIT is not set
+# CONFIG_FB_FOREIGN_ENDIAN is not set
 # CONFIG_FB_SYS_FOPS is not set
-CONFIG_FB_DEFERRED_IO=y
 # CONFIG_FB_SVGALIB is not set
 # CONFIG_FB_MACMODES is not set
 # CONFIG_FB_BACKLIGHT is not set
@@ -467,14 +493,12 @@ CONFIG_USB_SUPPORT=y
 # CONFIG_USB_ARCH_HAS_HCD is not set
 # CONFIG_USB_ARCH_HAS_OHCI is not set
 # CONFIG_USB_ARCH_HAS_EHCI is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
 #
 # NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
 #
-#
-# USB Gadget Support
-#
 CONFIG_USB_GADGET=y
 # CONFIG_USB_GADGET_DEBUG_FILES is not set
 CONFIG_USB_GADGET_SELECTED=y
@@ -485,6 +509,7 @@ CONFIG_USB_ATMEL_USBA=y
 # CONFIG_USB_GADGET_NET2280 is not set
 # CONFIG_USB_GADGET_PXA2XX is not set
 # CONFIG_USB_GADGET_M66592 is not set
+# CONFIG_USB_GADGET_PXA27X is not set
 # CONFIG_USB_GADGET_GOKU is not set
 # CONFIG_USB_GADGET_LH7A40X is not set
 # CONFIG_USB_GADGET_OMAP is not set
@@ -499,8 +524,11 @@ CONFIG_USB_ETH=y
 # CONFIG_USB_FILE_STORAGE is not set
 # CONFIG_USB_G_SERIAL is not set
 # CONFIG_USB_MIDI_GADGET is not set
+# CONFIG_USB_G_PRINTER is not set
 # CONFIG_MMC is not set
+# CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
+# CONFIG_ACCESSIBILITY is not set
 CONFIG_RTC_LIB=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_HCTOSYS=y
@@ -519,15 +547,17 @@ CONFIG_RTC_INTF_DEV=y
 #
 # SPI RTC drivers
 #
-# CONFIG_RTC_DRV_RS5C348 is not set
 # CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_R9701 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
 #
 # Platform RTC drivers
 #
+# CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
-# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
 # CONFIG_RTC_DRV_V3020 is not set
@@ -536,18 +566,14 @@ CONFIG_RTC_INTF_DEV=y
 # on-CPU RTC drivers
 #
 CONFIG_RTC_DRV_AT32AP700X=y
-#
-# Userspace I/O
-#
 # CONFIG_UIO is not set
 #
 # File systems
 #
+# CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
 # CONFIG_QUOTA is not set
-# CONFIG_DNOTIFY is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
 # CONFIG_FUSE_FS is not set
@@ -580,7 +606,6 @@ CONFIG_JFFS2_RTIME=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
 # CONFIG_NLS is not set
 # CONFIG_DLM is not set
-# CONFIG_INSTRUMENTATION is not set
 #
 # Kernel hacking
@@ -588,6 +613,7 @@ CONFIG_JFFS2_RTIME=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=1024
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 # CONFIG_DEBUG_FS is not set
@@ -608,6 +634,8 @@ CONFIG_MAGIC_SYSRQ=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+# CONFIG_GENERIC_FIND_FIRST_BIT is not set
+# CONFIG_GENERIC_FIND_NEXT_BIT is not set
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 # CONFIG_CRC_ITU_T is not set
diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
index 80f55f8dbf1c..84a7d44edc67 100644
--- a/arch/avr32/kernel/avr32_ksyms.c
+++ b/arch/avr32/kernel/avr32_ksyms.c
@@ -29,7 +29,9 @@ EXPORT_SYMBOL(__avr32_asr64);
 */
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(clear_page);
+EXPORT_SYMBOL(copy_page);
 /*
 * Userspace access stuff.
@@ -41,6 +43,8 @@ EXPORT_SYMBOL(strncpy_from_user);
 EXPORT_SYMBOL(__strncpy_from_user);
 EXPORT_SYMBOL(clear_user);
 EXPORT_SYMBOL(__clear_user);
+EXPORT_SYMBOL(strnlen_user);
 EXPORT_SYMBOL(csum_partial);
 EXPORT_SYMBOL(csum_partial_copy_generic);
diff --git a/arch/avr32/mach-at32ap/cpufreq.c b/arch/avr32/mach-at32ap/cpufreq.c
index 235524b79193..5dd8d25428bf 100644
--- a/arch/avr32/mach-at32ap/cpufreq.c
+++ b/arch/avr32/mach-at32ap/cpufreq.c
@@ -108,5 +108,4 @@ static int __init at32_cpufreq_init(void)
 {
        return cpufreq_register_driver(&at32_driver);
 }
+late_initcall(at32_cpufreq_init);
-arch_initcall(at32_cpufreq_init);
diff --git a/arch/blackfin/kernel/gptimers.c b/arch/blackfin/kernel/gptimers.c
index e698554895a7..3a3e9615b002 100644
--- a/arch/blackfin/kernel/gptimers.c
+++ b/arch/blackfin/kernel/gptimers.c
@@ -10,8 +10,8 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/io.h>
-#include <asm/io.h>
 #include <asm/blackfin.h>
 #include <asm/gptimers.h>
diff --git a/arch/blackfin/kernel/traps.c b/arch/blackfin/kernel/traps.c
index 7bfbd958980c..f061f5181623 100644
--- a/arch/blackfin/kernel/traps.c
+++ b/arch/blackfin/kernel/traps.c
@@ -67,7 +67,7 @@ void __init trap_init(void)
        CSYNC();
 }
-void *saved_icplb_fault_addr, *saved_dcplb_fault_addr;
+unsigned long saved_icplb_fault_addr, saved_dcplb_fault_addr;
 int kstack_depth_to_print = 48;
@@ -366,7 +366,7 @@ asmlinkage void trap_c(struct pt_regs *fp)
                info.si_code = ILL_CPLB_MULHIT;
                sig = SIGSEGV;
 #ifdef CONFIG_DEBUG_HUNT_FOR_ZERO
-                if (saved_dcplb_fault_addr < (void *)FIXED_CODE_START)
+                if (saved_dcplb_fault_addr < FIXED_CODE_START)
                        printk(KERN_NOTICE "NULL pointer access\n");
                else
 #endif
@@ -421,7 +421,7 @@ asmlinkage void trap_c(struct pt_regs *fp)
                info.si_code = ILL_CPLB_MULHIT;
                sig = SIGSEGV;
 #ifdef CONFIG_DEBUG_HUNT_FOR_ZERO
-                if (saved_icplb_fault_addr < (void *)FIXED_CODE_START)
+                if (saved_icplb_fault_addr < FIXED_CODE_START)
                        printk(KERN_NOTICE "Jump to NULL address\n");
                else
 #endif
@@ -939,8 +939,6 @@ void panic_cplb_error(int cplb_panic, struct pt_regs *fp)
        oops_in_progress = 1;
-        printk(KERN_EMERG "DCPLB_FAULT_ADDR=%p\n", saved_dcplb_fault_addr);
-        printk(KERN_EMERG "ICPLB_FAULT_ADDR=%p\n", saved_icplb_fault_addr);
        dump_bfin_process(fp);
        dump_bfin_mem(fp);
        show_regs(fp);
diff --git a/arch/blackfin/lib/outs.S b/arch/blackfin/lib/outs.S
index 3daf96035bf6..4685b7aa0080 100644
--- a/arch/blackfin/lib/outs.S
+++ b/arch/blackfin/lib/outs.S
@@ -76,4 +76,4 @@ ENTRY(_outsw_8)
                R0 = R0 + R1;
 .Lword8_loop_e: W[P0] = R0;
        RTS;
-ENDPROC(_outsw)
+ENDPROC(_outsw_8)
diff --git a/arch/blackfin/mach-bf527/boards/ezkit.c b/arch/blackfin/mach-bf527/boards/ezkit.c
index bb6d58c931de..5958eecefcf1 100644
--- a/arch/blackfin/mach-bf527/boards/ezkit.c
+++ b/arch/blackfin/mach-bf527/boards/ezkit.c
@@ -451,9 +451,6 @@ static struct platform_device net2272_bfin_device = {
 };
 #endif
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
-/* all SPI peripherals info goes here */
 #if defined(CONFIG_MTD_M25P80) \
        || defined(CONFIG_MTD_M25P80_MODULE)
 static struct mtd_partition bfin_spi_flash_partitions[] = {
@@ -647,10 +644,10 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
        {
                .modalias               = "ad7877",
                .platform_data          = &bfin_ad7877_ts_info,
-                .irq                    = IRQ_PF6,
+                .irq                    = IRQ_PF8,
                .max_speed_hz   = 12500000,     /* max spi clock (SCK) speed in HZ */
                .bus_num        = 0,
-                .chip_select  = 1,
+                .chip_select  = 2,
                .controller_data = &spi_ad7877_chip_info,
        },
 #endif
@@ -676,6 +673,7 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
 #endif
 };
+#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
 /* SPI controller data */
 static struct bfin5xx_spi_master bfin_spi0_info = {
        .num_chipselect = 8,
@@ -1018,10 +1016,7 @@ static int __init stamp_init(void)
 #endif
        platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
+        spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
-        spi_register_board_info(bfin_spi_board_info,
-                                ARRAY_SIZE(bfin_spi_board_info));
-#endif
 #if defined(CONFIG_PATA_PLATFORM) || defined(CONFIG_PATA_PLATFORM_MODULE)
        irq_desc[PATA_INT].status |= IRQ_NOAUTOEN;
diff --git a/arch/blackfin/mach-bf533/boards/ezkit.c b/arch/blackfin/mach-bf533/boards/ezkit.c
index 9d28415163ea..079389cbd859 100644
--- a/arch/blackfin/mach-bf533/boards/ezkit.c
+++ b/arch/blackfin/mach-bf533/boards/ezkit.c
@@ -87,9 +87,6 @@ static struct platform_device smc91x_device = {
 };
 #endif
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
-/* all SPI peripherals info goes here */
 #if defined(CONFIG_MTD_M25P80) || defined(CONFIG_MTD_M25P80_MODULE)
 static struct mtd_partition bfin_spi_flash_partitions[] = {
        {
@@ -189,6 +186,7 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
 #endif
 };
+#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
 /* SPI (0) */
 static struct resource bfin_spi0_resource[] = {
        [0] = {
@@ -425,9 +423,7 @@ static int __init ezkit_init(void)
 {
        printk(KERN_INFO "%s(): registering device resources\n", __func__);
        platform_add_devices(ezkit_devices, ARRAY_SIZE(ezkit_devices));
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
        spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
-#endif
 #if defined(CONFIG_PATA_PLATFORM) || defined(CONFIG_PATA_PLATFORM_MODULE)
        irq_desc[PATA_INT].status |= IRQ_NOAUTOEN;
diff --git a/arch/blackfin/mach-bf533/boards/stamp.c b/arch/blackfin/mach-bf533/boards/stamp.c
index ec05b236dc3f..13ae49515f73 100644
--- a/arch/blackfin/mach-bf533/boards/stamp.c
+++ b/arch/blackfin/mach-bf533/boards/stamp.c
@@ -161,9 +161,6 @@ static struct platform_device stamp_flash_device = {
 };
 #endif
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
-/* all SPI peripherals info goes here */
 #if defined(CONFIG_MTD_M25P80) || defined(CONFIG_MTD_M25P80_MODULE)
 static struct mtd_partition bfin_spi_flash_partitions[] = {
        {
@@ -320,6 +317,7 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
 #endif
 };
+#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
 /* SPI (0) */
 static struct resource bfin_spi0_resource[] = {
        [0] = {
@@ -626,10 +624,8 @@ static int __init stamp_init(void)
        SSYNC();
 #endif
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
+        spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
-        spi_register_board_info(bfin_spi_board_info,
-                                ARRAY_SIZE(bfin_spi_board_info));
-#endif
 #if defined(CONFIG_PATA_PLATFORM) || defined(CONFIG_PATA_PLATFORM_MODULE)
        irq_desc[PATA_INT].status |= IRQ_NOAUTOEN;
 #endif
diff --git a/arch/blackfin/mach-bf537/boards/Makefile b/arch/blackfin/mach-bf537/boards/Makefile
index 87e450f29e37..c94f7a5b8211 100644
--- a/arch/blackfin/mach-bf537/boards/Makefile
+++ b/arch/blackfin/mach-bf537/boards/Makefile
@@ -3,7 +3,7 @@
 #
 obj-$(CONFIG_GENERIC_BF537_BOARD)      += generic_board.o
-obj-$(CONFIG_BFIN537_STAMP)            += stamp.o led.o
+obj-$(CONFIG_BFIN537_STAMP)            += stamp.o
 obj-$(CONFIG_BFIN537_BLUETECHNIX_CM)   += cm_bf537.o
 obj-$(CONFIG_PNAV10)                   += pnav10.o
 obj-$(CONFIG_CAMSIG_MINOTAUR)          += minotaur.o
diff --git a/arch/blackfin/mach-bf537/boards/led.S b/arch/blackfin/mach-bf537/boards/led.S
deleted file mode 100644
index 4e9ea4283e5f..000000000000
--- a/arch/blackfin/mach-bf537/boards/led.S
+++ /dev/null
@@ -1,183 +0,0 @@
-/****************************************************
- * LED1 ---- PF6        LED2 ---- PF7               *
- * LED3 ---- PF8        LED4 ---- PF9               *
- * LED5 ---- PF10       LED6 ---- PF11              *
- ****************************************************/
-#include <linux/linkage.h>
-#include <asm/blackfin.h>
-/* All functions in this file save the registers they uses.
-   So there is no need to save any registers before calling them.  */
-        .text;
-/* Initialize LEDs.  */
-ENTRY(_led_init)
-        LINK 12;
-        [--SP] = P0;
-        [--SP] = R0;
-        [--SP] = R1;
-        [--SP] = R2;
-        R1 = PF6|PF7|PF8|PF9|PF10|PF11 (Z);
-        R2 = ~R1;
-        P0.H = hi(PORTF_FER);
-        P0.L = lo(PORTF_FER);
-        R0 = W[P0](Z);
-        SSYNC;
-        R0 = R0 & R2;
-        W[P0] = R0.L;
-        SSYNC;
-        P0.H = hi(PORTFIO_DIR);
-        P0.L = lo(PORTFIO_DIR);
-        R0 = W[P0](Z);
-        SSYNC;
-        R0 = R0 | R1;
-        W[P0] = R0.L;
-        SSYNC;
-        P0.H = hi(PORTFIO_INEN);
-        P0.L = lo(PORTFIO_INEN);
-        R0 = W[P0](Z);
-        SSYNC;
-        R0 = R0 & R2;
-        W[P0] = R0.L;
-        SSYNC;
-        R2 = [SP++];
-        R1 = [SP++];
-        R0 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_init, .-_led_init
-/* Set one LED on. Leave other LEDs unchanged.
-   It expects the LED number passed through R0.  */
-ENTRY(_led_on)
-        LINK 12;
-        [--SP] = P0;
-        [--SP] = R1;
-        CALL _led_init;
-        R1 = 1;
-        R0 += 5;
-        R1 <<= R0;
-        P0.H = hi(PORTFIO);
-        P0.L = lo(PORTFIO);
-        R0 = W[P0](Z);
-        SSYNC;
-        R0 = R0 | R1;
-        W[P0] = R0.L;
-        SSYNC;
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_on, .-_led_on
-/* Set one LED off. Leave other LEDs unchanged.  */
-ENTRY(_led_off)
-        LINK 12;
-        [--SP] = P0;
-        [--SP] = R1;
-        CALL _led_init;
-        R1 = 1;
-        R0 += 5;
-        R1 <<= R0;
-        R1 = ~R1;
-        P0.H = hi(PORTFIO);
-        P0.L = lo(PORTFIO);
-        R0 = W[P0](Z);
-        SSYNC;
-        R0 = R0 & R1;
-        W[P0] = R0.L;
-        SSYNC;
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_off, .-_led_off
-/* Toggle one LED. Leave other LEDs unchanged.  */
-ENTRY(_led_toggle)
-        LINK 12;
-        [--SP] = P0;
-        [--SP] = R1;
-        CALL _led_init;
-        R1 = 1;
-        R0 += 5;
-        R1 <<= R0;
-        P0.H = hi(PORTFIO);
-        P0.L = lo(PORTFIO);
-        R0 = W[P0](Z);
-        SSYNC;
-        R0 = R0 ^ R1;
-        W[P0] = R0.L;
-        SSYNC;
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_toggle, .-_led_toggle
-/* Display the number using LEDs in binary format.  */
-ENTRY(_led_disp_num)
-        LINK 12;
-        [--SP] = P0;
-        [--SP] = R1;
-        [--SP] = R2;
-        CALL _led_init;
-        R1 = 0x3f(X);
-        R0 = R0 & R1;
-        R2 = 6(X);
-        R0 <<= R2;
-        R1 <<= R2;
-        P0.H = hi(PORTFIO);
-        P0.L = lo(PORTFIO);
-        R2 = W[P0](Z);
-        SSYNC;
-        R1 = ~R1;
-        R2 = R2 & R1;
-        R2 = R2 | R0;
-        W[P0] = R2.L;
-        SSYNC;
-        R2 = [SP++];
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_disp_num, .-_led_disp_num
-/* Toggle the number using LEDs in binary format.  */
-ENTRY(_led_toggle_num)
-        LINK 12;
-        [--SP] = P0;
-        [--SP] = R1;
-        [--SP] = R2;
-        CALL _led_init;
-        R1 = 0x3f(X);
-        R0 = R0 & R1;
-        R1 = 6(X);
-        R0 <<= R1;
-        P0.H = hi(PORTFIO);
-        P0.L = lo(PORTFIO);
-        R1 = W[P0](Z);
-        SSYNC;
-        R1 = R1 ^ R0;
-        W[P0] = R1.L;
-        SSYNC;
-        R2 = [SP++];
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_toggle_num, .-_led_toggle_num
diff --git a/arch/blackfin/mach-bf537/boards/stamp.c b/arch/blackfin/mach-bf537/boards/stamp.c
index 9a756d1f3d73..671f9d67f23a 100644
--- a/arch/blackfin/mach-bf537/boards/stamp.c
+++ b/arch/blackfin/mach-bf537/boards/stamp.c
@@ -400,9 +400,6 @@ static struct platform_device stamp_flash_device = {
 };
 #endif
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
-/* all SPI peripherals info goes here */
 #if defined(CONFIG_MTD_M25P80) \
        || defined(CONFIG_MTD_M25P80_MODULE)
 static struct mtd_partition bfin_spi_flash_partitions[] = {
@@ -629,6 +626,7 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
 #endif
 };
+#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
 /* SPI controller data */
 static struct bfin5xx_spi_master bfin_spi0_info = {
        .num_chipselect = 8,
@@ -939,10 +937,7 @@ static int __init stamp_init(void)
 #endif
        platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
+        spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
-        spi_register_board_info(bfin_spi_board_info,
-                                ARRAY_SIZE(bfin_spi_board_info));
-#endif
 #if defined(CONFIG_PATA_PLATFORM) || defined(CONFIG_PATA_PLATFORM_MODULE)
        irq_desc[PATA_INT].status |= IRQ_NOAUTOEN;
diff --git a/arch/blackfin/mach-bf548/boards/Makefile b/arch/blackfin/mach-bf548/boards/Makefile
index eed161dd7845..319ef54c4221 100644
--- a/arch/blackfin/mach-bf548/boards/Makefile
+++ b/arch/blackfin/mach-bf548/boards/Makefile
@@ -2,5 +2,5 @@
 # arch/blackfin/mach-bf548/boards/Makefile
 #
-obj-$(CONFIG_BFIN548_EZKIT)            += ezkit.o led.o
+obj-$(CONFIG_BFIN548_EZKIT)            += ezkit.o
 obj-$(CONFIG_BFIN548_BLUETECHNIX_CM)   += cm_bf548.o
diff --git a/arch/blackfin/mach-bf548/boards/cm_bf548.c b/arch/blackfin/mach-bf548/boards/cm_bf548.c
index 3b74f96d3590..4f4ae8787edf 100644
--- a/arch/blackfin/mach-bf548/boards/cm_bf548.c
+++ b/arch/blackfin/mach-bf548/boards/cm_bf548.c
@@ -684,7 +684,7 @@ static struct platform_device *cm_bf548_devices[] __initdata = {
 static int __init cm_bf548_init(void)
 {
-        printk(KERN_INFO "%s(): registering device resources\n", __FUNCTION__);
+        printk(KERN_INFO "%s(): registering device resources\n", __func__);
        platform_add_devices(cm_bf548_devices, ARRAY_SIZE(cm_bf548_devices));
 #if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
diff --git a/arch/blackfin/mach-bf548/boards/ezkit.c b/arch/blackfin/mach-bf548/boards/ezkit.c
index d1682bb37509..af7c211a580e 100644
--- a/arch/blackfin/mach-bf548/boards/ezkit.c
+++ b/arch/blackfin/mach-bf548/boards/ezkit.c
@@ -412,8 +412,6 @@ static struct platform_device ezkit_flash_device = {
 };
 #endif
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
-/* all SPI peripherals info goes here */
 #if defined(CONFIG_MTD_M25P80) \
        || defined(CONFIG_MTD_M25P80_MODULE)
 /* SPI flash chip (m25p16) */
@@ -481,7 +479,7 @@ static struct bfin5xx_spi_chip spidev_chip_info = {
 };
 #endif
-static struct spi_board_info bf54x_spi_board_info[] __initdata = {
+static struct spi_board_info bfin_spi_board_info[] __initdata = {
 #if defined(CONFIG_MTD_M25P80) \
        || defined(CONFIG_MTD_M25P80_MODULE)
        {
@@ -527,6 +525,7 @@ static struct spi_board_info bf54x_spi_board_info[] __initdata = {
 #endif
 };
+#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
 /* SPI (0) */
 static struct resource bfin_spi0_resource[] = {
        [0] = {
@@ -800,10 +799,7 @@ static int __init ezkit_init(void)
        platform_add_devices(ezkit_devices, ARRAY_SIZE(ezkit_devices));
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
+        spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
-        spi_register_board_info(bf54x_spi_board_info,
-                        ARRAY_SIZE(bf54x_spi_board_info));
-#endif
        return 0;
 }
diff --git a/arch/blackfin/mach-bf548/boards/led.S b/arch/blackfin/mach-bf548/boards/led.S
deleted file mode 100644
index f47daf3770d0..000000000000
--- a/arch/blackfin/mach-bf548/boards/led.S
+++ /dev/null
@@ -1,172 +0,0 @@
-/****************************************************
- * LED1 ---- PG6        LED2 ---- PG7               *
- * LED3 ---- PG8        LED4 ---- PG9               *
- * LED5 ---- PG10       LED6 ---- PG11              *
- ****************************************************/
-#include <linux/linkage.h>
-#include <asm/blackfin.h>
-/* All functions in this file save the registers they uses.
-   So there is no need to save any registers before calling them.  */
-        .text;
-/* Initialize LEDs.  */
-ENTRY(_led_init)
-        LINK 0;
-        [--SP] = P0;
-        [--SP] = R0;
-        [--SP] = R1;
-        [--SP] = R2;
-        R1 = (PG6|PG7|PG8|PG9|PG10|PG11)(Z);
-        R2 = ~R1;
-        P0.H = hi(PORTG_FER);
-        P0.L = lo(PORTG_FER);
-        R0 = W[P0](Z);
-        SSYNC;
-        R0 = R0 & R2;
-        W[P0] = R0.L;
-        SSYNC;
-        P0.H = hi(PORTG_DIR_SET);
-        P0.L = lo(PORTG_DIR_SET);
-        W[P0] = R1.L;
-        SSYNC;
-        P0.H = hi(PORTG_INEN);
-        P0.L = lo(PORTG_INEN);
-        R0 = W[P0](Z);
-        SSYNC;
-        R0 = R0 & R2;
-        W[P0] = R0.L;
-        SSYNC;
-        R2 = [SP++];
-        R1 = [SP++];
-        R0 = [SP++];
-        P0 = [SP++];
-        RTS;
-        .size   _led_init, .-_led_init
-/* Set one LED on. Leave other LEDs unchanged.
-   It expects the LED number passed through R0.  */
-ENTRY(_led_on)
-        LINK 0;
-        [--SP] = P0;
-        [--SP] = R1;
-        CALL _led_init;
-        R1 = 1;
-        R0 += 5;
-        R1 <<= R0;
-        P0.H = hi(PORTG_SET);
-        P0.L = lo(PORTG_SET);
-        W[P0] = R1.L;
-        SSYNC;
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_on, .-_led_on
-/* Set one LED off. Leave other LEDs unchanged.  */
-ENTRY(_led_off)
-        LINK 0;
-        [--SP] = P0;
-        [--SP] = R1;
-        CALL _led_init;
-        R1 = 1;
-        R0 += 5;
-        R1 <<= R0;
-        P0.H = hi(PORTG_CLEAR);
-        P0.L = lo(PORTG_CLEAR);
-        W[P0] = R1.L;
-        SSYNC;
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_off, .-_led_off
-/* Toggle one LED. Leave other LEDs unchanged.  */
-ENTRY(_led_toggle)
-        LINK 0;
-        [--SP] = P0;
-        [--SP] = R1;
-        CALL _led_init;
-        R1 = 1;
-        R0 += 5;
-        R1 <<= R0;
-        P0.H = hi(PORTG);
-        P0.L = lo(PORTG);
-        R0 = W[P0](Z);
-        SSYNC;
-        R0 = R0 ^ R1;
-        W[P0] = R0.L;
-        SSYNC;
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_toggle, .-_led_toggle
-/* Display the number using LEDs in binary format.  */
-ENTRY(_led_disp_num)
-        LINK 0;
-        [--SP] = P0;
-        [--SP] = R1;
-        [--SP] = R2;
-        CALL _led_init;
-        R1 = 0x3f(X);
-        R0 = R0 & R1;
-        R2 = 6(X);
-        R0 <<= R2;
-        R1 <<= R2;
-        P0.H = hi(PORTG);
-        P0.L = lo(PORTG);
-        R2 = W[P0](Z);
-        SSYNC;
-        R1 = ~R1;
-        R2 = R2 & R1;
-        R2 = R2 | R0;
-        W[P0] = R2.L;
-        SSYNC;
-        R2 = [SP++];
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_disp_num, .-_led_disp_num
-/* Toggle the number using LEDs in binary format.  */
-ENTRY(_led_toggle_num)
-        LINK 0;
-        [--SP] = P0;
-        [--SP] = R1;
-        [--SP] = R2;
-        CALL _led_init;
-        R1 = 0x3f(X);
-        R0 = R0 & R1;
-        R1 = 6(X);
-        R0 <<= R1;
-        P0.H = hi(PORTG);
-        P0.L = lo(PORTG);
-        R1 = W[P0](Z);
-        SSYNC;
-        R1 = R1 ^ R0;
-        W[P0] = R1.L;
-        SSYNC;
-        R2 = [SP++];
-        R1 = [SP++];
-        P0 = [SP++];
-        UNLINK;
-        RTS;
-        .size   _led_toggle_num, .-_led_toggle_num
diff --git a/arch/blackfin/mach-bf561/boards/ezkit.c b/arch/blackfin/mach-bf561/boards/ezkit.c
index 61d8f7648b24..bc6feded8569 100644
--- a/arch/blackfin/mach-bf561/boards/ezkit.c
+++ b/arch/blackfin/mach-bf561/boards/ezkit.c
@@ -280,7 +280,6 @@ static struct platform_device ezkit_flash_device = {
 };
 #endif
-#ifdef CONFIG_SPI_BFIN
 #if defined(CONFIG_SND_BLACKFIN_AD1836) \
        || defined(CONFIG_SND_BLACKFIN_AD1836_MODULE)
 static struct bfin5xx_spi_chip ad1836_spi_chip_info = {
@@ -295,8 +294,8 @@ static struct bfin5xx_spi_chip spidev_chip_info = {
        .bits_per_word = 8,
 };
 #endif
-#endif
+#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
 /* SPI (0) */
 static struct resource bfin_spi0_resource[] = {
        [0] = {
@@ -327,6 +326,7 @@ static struct platform_device bfin_spi0_device = {
                .platform_data = &bfin_spi0_info, /* Passed to driver */
        },
 };
+#endif
 static struct spi_board_info bfin_spi_board_info[] __initdata = {
 #if defined(CONFIG_SND_BLACKFIN_AD1836) \
@@ -537,10 +537,7 @@ static int __init ezkit_init(void)
        SSYNC();
 #endif
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
+        spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
-        spi_register_board_info(bfin_spi_board_info,
-                                ARRAY_SIZE(bfin_spi_board_info));
-#endif
 #if defined(CONFIG_PATA_PLATFORM) || defined(CONFIG_PATA_PLATFORM_MODULE)
        irq_desc[PATA_INT].status |= IRQ_NOAUTOEN;
diff --git a/arch/frv/kernel/cmode.S b/arch/frv/kernel/cmode.S
index 81ba28ad2207..53deeb5d7e87 100644
--- a/arch/frv/kernel/cmode.S
+++ b/arch/frv/kernel/cmode.S
@@ -1,7 +1,7 @@
 /* cmode.S: clock mode management
 *
 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
- * Written by David Woodhouse (dwmw2@redhat.com)
+ * Written by David Woodhouse (dwmw2@infradead.org)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/arch/frv/kernel/sleep.S b/arch/frv/kernel/sleep.S
index c9b2d51ab9ad..f67bf73cd2cc 100644
--- a/arch/frv/kernel/sleep.S
+++ b/arch/frv/kernel/sleep.S
@@ -1,7 +1,7 @@
 /* sleep.S: power saving mode entry
 *
 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
- * Written by David Woodhouse (dwmw2@redhat.com)
+ * Written by David Woodhouse (dwmw2@infradead.org)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/arch/frv/mb93090-mb00/pci-dma-nommu.c b/arch/frv/mb93090-mb00/pci-dma-nommu.c
index 4985466b1a7c..64ee58d748be 100644
--- a/arch/frv/mb93090-mb00/pci-dma-nommu.c
+++ b/arch/frv/mb93090-mb00/pci-dma-nommu.c
@@ -1,7 +1,7 @@
 /* pci-dma-nommu.c: Dynamic DMA mapping support for the FRV
 *
 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
- * Written by David Woodhouse (dwmw2@redhat.com)
+ * Written by David Woodhouse (dwmw2@infradead.org)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/arch/frv/mm/init.c b/arch/frv/mm/init.c
index b841ecfd5d5a..9af7740f32fb 100644
--- a/arch/frv/mm/init.c
+++ b/arch/frv/mm/init.c
@@ -26,6 +26,7 @@
 #include <linux/types.h>
 #include <linux/bootmem.h>
 #include <linux/highmem.h>
+#include <linux/module.h>
 #include <asm/setup.h>
 #include <asm/segment.h>
@@ -56,7 +57,9 @@ DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
 */
 static unsigned long empty_bad_page_table;
 static unsigned long empty_bad_page;
 unsigned long empty_zero_page;
+EXPORT_SYMBOL(empty_zero_page);
 /*****************************************************************************/
 /*
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 853d1f11be00..43687cc60dfb 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -465,7 +465,6 @@ void __init acpi_numa_slit_init(struct acpi_table_slit *slit)
                printk(KERN_ERR
                       "ACPI 2.0 SLIT: size mismatch: %d expected, %d actual\n",
                       len, slit->header.length);
-                memset(numa_slit, 10, sizeof(numa_slit));
                return;
        }
        slit_table = slit;
@@ -574,8 +573,14 @@ void __init acpi_numa_arch_fixup(void)
        printk(KERN_INFO "Number of memory chunks in system = %d\n",
               num_node_memblks);
-        if (!slit_table)
+        if (!slit_table) {
+                for (i = 0; i < MAX_NUMNODES; i++)
+                        for (j = 0; j < MAX_NUMNODES; j++)
+                                node_distance(i, j) = i == j ? LOCAL_DISTANCE :
+                                                        REMOTE_DISTANCE;
                return;
+        }
        memset(numa_slit, -1, sizeof(numa_slit));
        for (i = 0; i < slit_table->locality_count; i++) {
                if (!pxm_bit_test(i))
diff --git a/arch/ia64/kernel/ivt.S b/arch/ia64/kernel/ivt.S
index 6678c49daba3..80b44ea052d7 100644
--- a/arch/ia64/kernel/ivt.S
+++ b/arch/ia64/kernel/ivt.S
@@ -1076,48 +1076,6 @@ END(ia64_syscall_setup)
        DBG_FAULT(15)
        FAULT(15)
-        /*
-         * Squatting in this space ...
-         *
-         * This special case dispatcher for illegal operation faults allows preserved
-         * registers to be modified through a callback function (asm only) that is handed
-         * back from the fault handler in r8. Up to three arguments can be passed to the
-         * callback function by returning an aggregate with the callback as its first
-         * element, followed by the arguments.
-         */
-ENTRY(dispatch_illegal_op_fault)
-        .prologue
-        .body
-        SAVE_MIN_WITH_COVER
-        ssm psr.ic | PSR_DEFAULT_BITS
-        ;;
-        srlz.i          // guarantee that interruption collection is on
-        ;;
-(p15)   ssm psr.i       // restore psr.i
-        adds r3=8,r2    // set up second base pointer for SAVE_REST
-        ;;
-        alloc r14=ar.pfs,0,0,1,0        // must be first in insn group
-        mov out0=ar.ec
-        ;;
-        SAVE_REST
-        PT_REGS_UNWIND_INFO(0)
-        ;;
-        br.call.sptk.many rp=ia64_illegal_op_fault
-.ret0:  ;;
-        alloc r14=ar.pfs,0,0,3,0        // must be first in insn group
-        mov out0=r9
-        mov out1=r10
-        mov out2=r11
-        movl r15=ia64_leave_kernel
-        ;;
-        mov rp=r15
-        mov b6=r8
-        ;;
-        cmp.ne p6,p0=0,r8
-(p6)    br.call.dpnt.many b6=b6         // call returns to ia64_leave_kernel
-        br.sptk.many ia64_leave_kernel
-END(dispatch_illegal_op_fault)
        .org ia64_ivt+0x4000
 /////////////////////////////////////////////////////////////////////////////////////////
 // 0x4000 Entry 16 (size 64 bundles) Reserved
@@ -1715,6 +1673,48 @@ END(ia32_interrupt)
        DBG_FAULT(67)
        FAULT(67)
+        /*
+         * Squatting in this space ...
+         *
+         * This special case dispatcher for illegal operation faults allows preserved
+         * registers to be modified through a callback function (asm only) that is handed
+         * back from the fault handler in r8. Up to three arguments can be passed to the
+         * callback function by returning an aggregate with the callback as its first
+         * element, followed by the arguments.
+         */
+ENTRY(dispatch_illegal_op_fault)
+        .prologue
+        .body
+        SAVE_MIN_WITH_COVER
+        ssm psr.ic | PSR_DEFAULT_BITS
+        ;;
+        srlz.i          // guarantee that interruption collection is on
+        ;;
+(p15)   ssm psr.i       // restore psr.i
+        adds r3=8,r2    // set up second base pointer for SAVE_REST
+        ;;
+        alloc r14=ar.pfs,0,0,1,0        // must be first in insn group
+        mov out0=ar.ec
+        ;;
+        SAVE_REST
+        PT_REGS_UNWIND_INFO(0)
+        ;;
+        br.call.sptk.many rp=ia64_illegal_op_fault
+.ret0:  ;;
+        alloc r14=ar.pfs,0,0,3,0        // must be first in insn group
+        mov out0=r9
+        mov out1=r10
+        mov out2=r11
+        movl r15=ia64_leave_kernel
+        ;;
+        mov rp=r15
+        mov b6=r8
+        ;;
+        cmp.ne p6,p0=0,r8
+(p6)    br.call.dpnt.many b6=b6         // call returns to ia64_leave_kernel
+        br.sptk.many ia64_leave_kernel
+END(dispatch_illegal_op_fault)
 #ifdef CONFIG_IA32_SUPPORT
        /*
diff --git a/arch/ia64/kernel/minstate.h b/arch/ia64/kernel/minstate.h
index 7c548ac52bbc..74b6d670aaef 100644
--- a/arch/ia64/kernel/minstate.h
+++ b/arch/ia64/kernel/minstate.h
@@ -15,6 +15,9 @@
 #define ACCOUNT_SYS_ENTER
 #endif
+.section ".data.patch.rse", "a"
+.previous
 /*
 * DO_SAVE_MIN switches to the kernel stacks (if necessary) and saves
 * the minimum state necessary that allows us to turn psr.ic back
@@ -40,7 +43,7 @@
 * Note that psr.ic is NOT turned on by this macro.  This is so that
 * we can pass interruption state as arguments to a handler.
 */
-#define DO_SAVE_MIN(COVER,SAVE_IFS,EXTRA)                                                       \
+#define DO_SAVE_MIN(COVER,SAVE_IFS,EXTRA,WORKAROUND)                                            \
        mov r16=IA64_KR(CURRENT);       /* M */                                                 \
        mov r27=ar.rsc;                 /* M */                                                 \
        mov r20=r1;                     /* A */                                                 \
@@ -87,6 +90,7 @@
        tbit.nz p15,p0=r29,IA64_PSR_I_BIT;                                                      \
        mov r29=b0                                                                              \
        ;;                                                                                      \
+        WORKAROUND;                                                                             \
        adds r16=PT(R8),r1;     /* initialize first base pointer */                             \
        adds r17=PT(R9),r1;     /* initialize second base pointer */                            \
 (pKStk) mov r18=r0;             /* make sure r18 isn't NaT */                                   \
@@ -206,6 +210,40 @@
        st8 [r25]=r10;          /* ar.ssd */    \
        ;;
-#define SAVE_MIN_WITH_COVER     DO_SAVE_MIN(cover, mov r30=cr.ifs,)
+#define RSE_WORKAROUND                          \
-#define SAVE_MIN_WITH_COVER_R19 DO_SAVE_MIN(cover, mov r30=cr.ifs, mov r15=r19)
+(pUStk) extr.u r17=r18,3,6;                     \
-#define SAVE_MIN                DO_SAVE_MIN(     , mov r30=r0, )
+(pUStk) sub r16=r18,r22;                        \
+[1:](pKStk)     br.cond.sptk.many 1f;           \
+        .xdata4 ".data.patch.rse",1b-.          \
+        ;;                                      \
+        cmp.ge p6,p7 = 33,r17;                  \
+        ;;                                      \
+(p6)    mov r17=0x310;                          \
+(p7)    mov r17=0x308;                          \
+        ;;                                      \
+        cmp.leu p1,p0=r16,r17;                  \
+(p1)    br.cond.sptk.many 1f;                   \
+        dep.z r17=r26,0,62;                     \
+        movl r16=2f;                            \
+        ;;                                      \
+        mov ar.pfs=r17;                         \
+        dep r27=r0,r27,16,14;                   \
+        mov b0=r16;                             \
+        ;;                                      \
+        br.ret.sptk b0;                         \
+        ;;                                      \
+2:                                              \
+        mov ar.rsc=r0                           \
+        ;;                                      \
+        flushrs;                                \
+        ;;                                      \
+        mov ar.bspstore=r22                     \
+        ;;                                      \
+        mov r18=ar.bsp;                         \
+        ;;                                      \
+1:                                              \
+        .pred.rel "mutex", pKStk, pUStk
+#define SAVE_MIN_WITH_COVER     DO_SAVE_MIN(cover, mov r30=cr.ifs, , RSE_WORKAROUND)
+#define SAVE_MIN_WITH_COVER_R19 DO_SAVE_MIN(cover, mov r30=cr.ifs, mov r15=r19, RSE_WORKAROUND)
+#define SAVE_MIN                        DO_SAVE_MIN(     , mov r30=r0, , )
diff --git a/arch/ia64/kernel/patch.c b/arch/ia64/kernel/patch.c
index e0dca8743dbb..b83b2c516008 100644
--- a/arch/ia64/kernel/patch.c
+++ b/arch/ia64/kernel/patch.c
@@ -115,6 +115,29 @@ ia64_patch_vtop (unsigned long start, unsigned long end)
        ia64_srlz_i();
 }
+/*
+ * Disable the RSE workaround by turning the conditional branch
+ * that we tagged in each place the workaround was used into an
+ * unconditional branch.
+ */
+void __init
+ia64_patch_rse (unsigned long start, unsigned long end)
+{
+        s32 *offp = (s32 *) start;
+        u64 ip, *b;
+        while (offp < (s32 *) end) {
+                ip = (u64) offp + *offp;
+                b = (u64 *)(ip & -16);
+                b[1] &= ~0xf800000L;
+                ia64_fc((void *) ip);
+                ++offp;
+        }
+        ia64_sync_i();
+        ia64_srlz_i();
+}
 void __init
 ia64_patch_mckinley_e9 (unsigned long start, unsigned long end)
 {
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index e9596cd0cdab..f48a809c686d 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -560,6 +560,17 @@ setup_arch (char **cmdline_p)
        /* process SAL system table: */
        ia64_sal_init(__va(efi.sal_systab));
+#ifdef CONFIG_ITANIUM
+        ia64_patch_rse((u64) __start___rse_patchlist, (u64) __end___rse_patchlist);
+#else
+        {
+                u64 num_phys_stacked;
+                if (ia64_pal_rse_info(&num_phys_stacked, 0) == 0 && num_phys_stacked > 96)
+                        ia64_patch_rse((u64) __start___rse_patchlist, (u64) __end___rse_patchlist);
+        }
+#endif
 #ifdef CONFIG_SMP
        cpu_physical_id(0) = hard_smp_processor_id();
 #endif
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index 80622acc95de..5929ab10a289 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -156,6 +156,13 @@ SECTIONS
          __end___vtop_patchlist = .;
        }
+  .data.patch.rse : AT(ADDR(.data.patch.rse) - LOAD_OFFSET)
+        {
+          __start___rse_patchlist = .;
+          *(.data.patch.rse)
+          __end___rse_patchlist = .;
+        }
  .data.patch.mckinley_e9 : AT(ADDR(.data.patch.mckinley_e9) - LOAD_OFFSET)
        {
          __start___mckinley_e9_bundles = .;
diff --git a/arch/ia64/kvm/mmio.c b/arch/ia64/kvm/mmio.c
index 351bf70da463..7f1a858bc69f 100644
--- a/arch/ia64/kvm/mmio.c
+++ b/arch/ia64/kvm/mmio.c
@@ -159,7 +159,8 @@ static void mmio_access(struct kvm_vcpu *vcpu, u64 src_pa, u64 *dest,
        if (p->u.ioreq.state == STATE_IORESP_READY) {
                if (dir == IOREQ_READ)
-                        *dest = p->u.ioreq.data;
+                        /* it's necessary to ensure zero extending */
+                        *dest = p->u.ioreq.data & (~0UL >> (64-(s*8)));
        } else
                panic_vm(vcpu);
 out:
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index dca50da9ffd0..8e2a0f5faf53 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:41 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index c3cd5b749d2c..e2d511e2a1d1 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:42 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index 073ae4bbe264..6e20d656adaf 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:43 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 0789ede2e9ee..a0a9b30bb502 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:45 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index 3e140bf49b22..6778041de262 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:46 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index ba3a91792cbf..7cd375740348 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:47 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 4d23f99227f9..0747fa3984df 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:42:31 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index 188847fed824..e7a8246840b5 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:49 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 983e53d990c8..ab536eb172bb 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:50 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index 7707f3fb0a70..e05be687b500 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:51 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index a765f6f15d2c..296340d2b315 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:53 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index 431513937498..8d3a416c92bf 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc2
+# Linux kernel version: 2.6.26-rc4
-# Sun May 18 14:44:54 2008
+# Wed May 28 22:47:35 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -59,7 +59,7 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
-# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
diff --git a/arch/m68knommu/platform/coldfire/timers.c b/arch/m68knommu/platform/coldfire/timers.c
index ba5a9f32ebd4..454f25493491 100644
--- a/arch/m68knommu/platform/coldfire/timers.c
+++ b/arch/m68knommu/platform/coldfire/timers.c
@@ -111,7 +111,13 @@ void hw_timer_init(void)
        __raw_writew(MCFTIMER_TMR_DISABLE, TA(MCFTIMER_TMR));
        mcftmr_cycles_per_jiffy = FREQ / HZ;
-        __raw_writetrr(mcftmr_cycles_per_jiffy, TA(MCFTIMER_TRR));
+        /*
+         *      The coldfire timer runs from 0 to TRR included, then 0
+         *      again and so on.  It counts thus actually TRR + 1 steps
+         *      for 1 tick, not TRR.  So if you want n cycles,
+         *      initialize TRR with n - 1.
+         */
+        __raw_writetrr(mcftmr_cycles_per_jiffy - 1, TA(MCFTIMER_TRR));
        __raw_writew(MCFTIMER_TMR_ENORI | MCFTIMER_TMR_CLK16 |
                MCFTIMER_TMR_RESTART | MCFTIMER_TMR_ENABLE, TA(MCFTIMER_TMR));
diff --git a/arch/mips/au1000/common/clocks.c b/arch/mips/au1000/common/clocks.c
index 46f8ee0e2657..043429d17c5f 100644
--- a/arch/mips/au1000/common/clocks.c
+++ b/arch/mips/au1000/common/clocks.c
@@ -45,6 +45,7 @@ unsigned int get_au1x00_speed(void)
 {
        return au1x00_clock;
 }
+EXPORT_SYMBOL(get_au1x00_speed);
 /*
 * The UART baud base is not known at compile time ... if
diff --git a/arch/mips/au1000/common/dbdma.c b/arch/mips/au1000/common/dbdma.c
index 42d555236de1..601ee9180ee4 100644
--- a/arch/mips/au1000/common/dbdma.c
+++ b/arch/mips/au1000/common/dbdma.c
@@ -216,6 +216,17 @@ u32 au1xxx_ddma_add_device(dbdev_tab_t *dev)
 }
 EXPORT_SYMBOL(au1xxx_ddma_add_device);
+void au1xxx_ddma_del_device(u32 devid)
+{
+        dbdev_tab_t *p = find_dbdev_id(devid);
+        if (p != NULL) {
+                memset(p, 0, sizeof(dbdev_tab_t));
+                p->dev_id = ~0;
+        }
+}
+EXPORT_SYMBOL(au1xxx_ddma_del_device);
 /* Allocate a channel and return a non-zero descriptor if successful. */
 u32 au1xxx_dbdma_chan_alloc(u32 srcid, u32 destid,
       void (*callback)(int, void *), void *callparam)
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index cc0244036aec..65e46a6d4178 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -30,7 +30,6 @@ obj-$(CONFIG_CPU_LOONGSON2)	+= r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_MIPS32)        += r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_MIPS64)        += r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_R3000)         += r2300_fpu.o r2300_switch.o
-obj-$(CONFIG_CPU_R4000)         += r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_R4300)         += r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_R4X00)         += r4k_fpu.o r4k_switch.o
 obj-$(CONFIG_CPU_R5000)         += r4k_fpu.o r4k_switch.o
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index cb8b0e2c7954..f9165d1a17bf 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -88,15 +88,17 @@ static void show_raw_backtrace(unsigned long reg29)
 #ifdef CONFIG_KALLSYMS
        printk("\n");
 #endif
-#define IS_KVA01(a) ((((unsigned int)a) & 0xc0000000) == 0x80000000)
+        while (!kstack_end(sp)) {
-        if (IS_KVA01(sp)) {
+                unsigned long __user *p =
-                while (!kstack_end(sp)) {
+                        (unsigned long __user *)(unsigned long)sp++;
-                        addr = *sp++;
+                if (__get_user(addr, p)) {
-                        if (__kernel_text_address(addr))
+                        printk(" (Bad stack address)");
-                                print_ip_sym(addr);
+                        break;
                }
-                printk("\n");
+                if (__kernel_text_address(addr))
+                        print_ip_sym(addr);
        }
+        printk("\n");
 }
 #ifdef CONFIG_KALLSYMS
diff --git a/arch/mips/mips-boards/generic/time.c b/arch/mips/mips-boards/generic/time.c
index 008fd82b5840..fe2cac1b4514 100644
--- a/arch/mips/mips-boards/generic/time.c
+++ b/arch/mips/mips-boards/generic/time.c
@@ -58,27 +58,8 @@ static int mips_cpu_timer_irq;
 static int mips_cpu_perf_irq;
 extern int cp0_perfcount_irq;
-DEFINE_PER_CPU(unsigned int, tickcount);
-#define tickcount_this_cpu __get_cpu_var(tickcount)
-static unsigned long ledbitmask;
 static void mips_timer_dispatch(void)
 {
-#if defined(CONFIG_MIPS_MALTA) || defined(CONFIG_MIPS_ATLAS)
-        /*
-         * Yes, this is very tacky, won't work as expected with SMTC and
-         * dyntick will break it,
-         * but it gives me a nice warm feeling during debug
-         */
-#define LEDBAR 0xbf000408
-        if (tickcount_this_cpu++ >= HZ) {
-                tickcount_this_cpu = 0;
-                change_bit(smp_processor_id(), &ledbitmask);
-                smp_wmb(); /* Make sure every one else sees the change */
-                /* This will pick up any recent changes made by other CPU's */
-                *(unsigned int *)LEDBAR = ledbitmask;
-        }
-#endif
        do_IRQ(mips_cpu_timer_irq);
 }
diff --git a/arch/mips/mm/page.c b/arch/mips/mm/page.c
index d827d6144369..cab81f42eee5 100644
--- a/arch/mips/mm/page.c
+++ b/arch/mips/mm/page.c
@@ -310,8 +310,8 @@ void __cpuinit build_clear_page(void)
        if (R4600_V2_HIT_CACHEOP_WAR && cpu_is_r4600_v2_x())
                uasm_i_lui(&buf, AT, 0xa000);
-        off = min(8, pref_bias_clear_store / cache_line_size) *
+        off = cache_line_size ? min(8, pref_bias_clear_store / cache_line_size)
-              cache_line_size;
+                                * cache_line_size : 0;
        while (off) {
                build_clear_pref(&buf, -off);
                off -= cache_line_size;
@@ -454,12 +454,14 @@ void __cpuinit build_copy_page(void)
        if (R4600_V2_HIT_CACHEOP_WAR && cpu_is_r4600_v2_x())
                uasm_i_lui(&buf, AT, 0xa000);
-        off = min(8, pref_bias_copy_load / cache_line_size) * cache_line_size;
+        off = cache_line_size ? min(8, pref_bias_copy_load / cache_line_size) *
+                                cache_line_size : 0;
        while (off) {
                build_copy_load_pref(&buf, -off);
                off -= cache_line_size;
        }
-        off = min(8, pref_bias_copy_store / cache_line_size) * cache_line_size;
+        off = cache_line_size ? min(8, pref_bias_copy_load / cache_line_size) *
+                                cache_line_size : 0;
        while (off) {
                build_copy_store_pref(&buf, -off);
                off -= cache_line_size;
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 382738ca8a0b..76da73a5ab3c 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -224,8 +224,9 @@ static u32 final_handler[64] __cpuinitdata;
 static void __cpuinit __maybe_unused build_tlb_probe_entry(u32 **p)
 {
        switch (current_cpu_type()) {
-        /* Found by experiment: R4600 v2.0 needs this, too.  */
+        /* Found by experiment: R4600 v2.0/R4700 needs this, too.  */
        case CPU_R4600:
+        case CPU_R4700:
        case CPU_R5000:
        case CPU_R5000A:
        case CPU_NEVADA:
diff --git a/arch/mips/pci/ops-bridge.c b/arch/mips/pci/ops-bridge.c
index 1fa09929cd7a..b46b3e211775 100644
--- a/arch/mips/pci/ops-bridge.c
+++ b/arch/mips/pci/ops-bridge.c
@@ -14,6 +14,22 @@
 #include <asm/sn/sn0/hub.h>
 /*
+ * Most of the IOC3 PCI config register aren't present
+ * we emulate what is needed for a normal PCI enumeration
+ */
+static u32 emulate_ioc3_cfg(int where, int size)
+{
+        if (size == 1 && where == 0x3d)
+                return 0x01;
+        else if (size == 2 && where == 0x3c)
+                return 0x0100;
+        else if (size == 4 && where == 0x3c)
+                return 0x00000100;
+        return 0;
+}
+/*
 * The Bridge ASIC supports both type 0 and type 1 access.  Type 1 is
 * not really documented, so right now I can't write code which uses it.
 * Therefore we use type 0 accesses for now even though they won't work
@@ -64,7 +80,7 @@ oh_my_gawd:
         * generic PCI code a chance to look at the wrong register.
         */
        if ((where >= 0x14 && where < 0x40) || (where >= 0x48)) {
-                *value = 0;
+                *value = emulate_ioc3_cfg(where, size);
                return PCIBIOS_SUCCESSFUL;
        }
@@ -127,7 +143,7 @@ oh_my_gawd:
         * generic PCI code a chance to look at the wrong register.
         */
        if ((where >= 0x14 && where < 0x40) || (where >= 0x48)) {
-                *value = 0;
+                *value = emulate_ioc3_cfg(where, size);
                return PCIBIOS_SUCCESSFUL;
        }
diff --git a/arch/mips/pci/pci-ip27.c b/arch/mips/pci/pci-ip27.c
index bb64828a92fe..a18516925cdd 100644
--- a/arch/mips/pci/pci-ip27.c
+++ b/arch/mips/pci/pci-ip27.c
@@ -47,6 +47,9 @@ int __cpuinit bridge_probe(nasid_t nasid, int widget_id, int masterwid)
        static int num_bridges = 0;
        bridge_t *bridge;
        int slot;
+        extern int pci_probe_only;
+        pci_probe_only = 1;
        printk("a bridge\n");
@@ -100,6 +103,11 @@ int __cpuinit bridge_probe(nasid_t nasid, int widget_id, int masterwid)
         */
        bridge->b_wid_control |= BRIDGE_CTRL_IO_SWAP |
                                 BRIDGE_CTRL_MEM_SWAP;
+#ifdef CONFIG_PAGE_SIZE_4KB
+        bridge->b_wid_control &= ~BRIDGE_CTRL_PAGE_SIZE;
+#else /* 16kB or larger */
+        bridge->b_wid_control |= BRIDGE_CTRL_PAGE_SIZE;
+#endif
        /*
         * Hmm...  IRIX sets additional bits in the address which
diff --git a/arch/mips/sgi-ip27/ip27-init.c b/arch/mips/sgi-ip27/ip27-init.c
index 7093e7c573a4..4a500e8cd3cc 100644
--- a/arch/mips/sgi-ip27/ip27-init.c
+++ b/arch/mips/sgi-ip27/ip27-init.c
@@ -161,27 +161,6 @@ cnodeid_t get_compact_nodeid(void)
        return NASID_TO_COMPACT_NODEID(get_nasid());
 }
-/* Extracted from the IOC3 meta driver.  FIXME.  */
-static inline void ioc3_sio_init(void)
-{
-        struct ioc3 *ioc3;
-        nasid_t nid;
-        long loops;
-        nid = get_nasid();
-        ioc3 = (struct ioc3 *) KL_CONFIG_CH_CONS_INFO(nid)->memory_base;
-        ioc3->sscr_a = 0;                       /* PIO mode for uarta.  */
-        ioc3->sscr_b = 0;                       /* PIO mode for uartb.  */
-        ioc3->sio_iec = ~0;
-        ioc3->sio_ies = (SIO_IR_SA_INT | SIO_IR_SB_INT);
-        loops=1000000; while(loops--);
-        ioc3->sregs.uarta.iu_fcr = 0;
-        ioc3->sregs.uartb.iu_fcr = 0;
-        loops=1000000; while(loops--);
-}
 static inline void ioc3_eth_init(void)
 {
        struct ioc3 *ioc3;
@@ -234,7 +213,6 @@ void __init plat_mem_setup(void)
                panic("Kernel compiled for N mode.");
 #endif
-        ioc3_sio_init();
        ioc3_eth_init();
        per_cpu_init();
diff --git a/arch/mips/sgi-ip27/ip27-memory.c b/arch/mips/sgi-ip27/ip27-memory.c
index bf438d02366e..42cd10956306 100644
--- a/arch/mips/sgi-ip27/ip27-memory.c
+++ b/arch/mips/sgi-ip27/ip27-memory.c
@@ -33,10 +33,6 @@
 #define SLOT_PFNSHIFT           (SLOT_SHIFT - PAGE_SHIFT)
 #define PFN_NASIDSHFT           (NASID_SHFT - PAGE_SHIFT)
-#define SLOT_IGNORED            0xffff
-static short __initdata slot_lastfilled_cache[MAX_COMPACT_NODES];
-static unsigned short __initdata slot_psize_cache[MAX_COMPACT_NODES][MAX_MEM_SLOTS];
 static struct bootmem_data __initdata plat_node_bdata[MAX_COMPACT_NODES];
 struct node_data *__node_data[MAX_COMPACT_NODES];
@@ -267,51 +263,6 @@ static pfn_t __init slot_getbasepfn(cnodeid_t cnode, int slot)
        return ((pfn_t)nasid << PFN_NASIDSHFT) | (slot << SLOT_PFNSHIFT);
 }
-/*
- * Return the number of pages of memory provided by the given slot
- * on the specified node.
- */
-static pfn_t __init slot_getsize(cnodeid_t node, int slot)
-{
-        return (pfn_t) slot_psize_cache[node][slot];
-}
-/*
- * Return highest slot filled
- */
-static int __init node_getlastslot(cnodeid_t node)
-{
-        return (int) slot_lastfilled_cache[node];
-}
-/*
- * Return the pfn of the last free page of memory on a node.
- */
-static pfn_t __init node_getmaxclick(cnodeid_t node)
-{
-        pfn_t   slot_psize;
-        int     slot;
-        /*
-         * Start at the top slot. When we find a slot with memory in it,
-         * that's the winner.
-         */
-        for (slot = (MAX_MEM_SLOTS - 1); slot >= 0; slot--) {
-                if ((slot_psize = slot_getsize(node, slot))) {
-                        if (slot_psize == SLOT_IGNORED)
-                                continue;
-                        /* Return the basepfn + the slot size, minus 1. */
-                        return slot_getbasepfn(node, slot) + slot_psize - 1;
-                }
-        }
-        /*
-         * If there's no memory on the node, return 0. This is likely
-         * to cause problems.
-         */
-        return 0;
-}
 static pfn_t __init slot_psize_compute(cnodeid_t node, int slot)
 {
        nasid_t nasid;
@@ -404,13 +355,13 @@ static void __init mlreset(void)
 static void __init szmem(void)
 {
        pfn_t slot_psize, slot0sz = 0, nodebytes;       /* Hack to detect problem configs */
-        int slot, ignore;
+        int slot;
        cnodeid_t node;
        num_physpages = 0;
        for_each_online_node(node) {
-                ignore = nodebytes = 0;
+                nodebytes = 0;
                for (slot = 0; slot < MAX_MEM_SLOTS; slot++) {
                        slot_psize = slot_psize_compute(node, slot);
                        if (slot == 0)
@@ -420,21 +371,20 @@ static void __init szmem(void)
                         * kernel text.
                         */
                        nodebytes += (1LL << SLOT_SHIFT);
+                        if (!slot_psize)
+                                continue;
                        if ((nodebytes >> PAGE_SHIFT) * (sizeof(struct page)) >
-                                                (slot0sz << PAGE_SHIFT))
+                                                (slot0sz << PAGE_SHIFT)) {
-                                ignore = 1;
-                        if (ignore && slot_psize) {
                                printk("Ignoring slot %d onwards on node %d\n",
                                                                slot, node);
-                                slot_psize_cache[node][slot] = SLOT_IGNORED;
                                slot = MAX_MEM_SLOTS;
                                continue;
                        }
                        num_physpages += slot_psize;
-                        slot_psize_cache[node][slot] =
+                        add_active_range(node, slot_getbasepfn(node, slot),
-                                        (unsigned short) slot_psize;
+                                         slot_getbasepfn(node, slot) + slot_psize);
-                        if (slot_psize)
-                                slot_lastfilled_cache[node] = slot;
                }
        }
 }
@@ -442,18 +392,20 @@ static void __init szmem(void)
 static void __init node_mem_init(cnodeid_t node)
 {
        pfn_t slot_firstpfn = slot_getbasepfn(node, 0);
-        pfn_t slot_lastpfn = slot_firstpfn + slot_getsize(node, 0);
        pfn_t slot_freepfn = node_getfirstfree(node);
-        struct pglist_data *pd;
        unsigned long bootmap_size;
+        pfn_t start_pfn, end_pfn;
+        get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
        /*
         * Allocate the node data structures on the node first.
         */
        __node_data[node] = __va(slot_freepfn << PAGE_SHIFT);
-        pd = NODE_DATA(node);
+        NODE_DATA(node)->bdata = &plat_node_bdata[node];
-        pd->bdata = &plat_node_bdata[node];
+        NODE_DATA(node)->node_start_pfn = start_pfn;
+        NODE_DATA(node)->node_spanned_pages = end_pfn - start_pfn;
        cpus_clear(hub_data(node)->h_cpus);
@@ -461,12 +413,12 @@ static void __init node_mem_init(cnodeid_t node)
                               sizeof(struct hub_data));
        bootmap_size = init_bootmem_node(NODE_DATA(node), slot_freepfn,
-                                        slot_firstpfn, slot_lastpfn);
+                                        start_pfn, end_pfn);
-        free_bootmem_node(NODE_DATA(node), slot_firstpfn << PAGE_SHIFT,
+        free_bootmem_with_active_regions(node, end_pfn);
-                        (slot_lastpfn - slot_firstpfn) << PAGE_SHIFT);
        reserve_bootmem_node(NODE_DATA(node), slot_firstpfn << PAGE_SHIFT,
                ((slot_freepfn - slot_firstpfn) << PAGE_SHIFT) + bootmap_size,
                BOOTMEM_DEFAULT);
+        sparse_memory_present_with_active_regions(node);
 }
 /*
@@ -515,16 +467,15 @@ void __init paging_init(void)
        pagetable_init();
        for_each_online_node(node) {
-                pfn_t start_pfn = slot_getbasepfn(node, 0);
+                pfn_t start_pfn, end_pfn;
-                pfn_t end_pfn = node_getmaxclick(node) + 1;
-                zones_size[ZONE_NORMAL] = end_pfn - start_pfn;
+                get_pfn_range_for_nid(node, &start_pfn, &end_pfn);
-                free_area_init_node(node, NODE_DATA(node),
-                                zones_size, start_pfn, NULL);
                if (end_pfn > max_low_pfn)
                        max_low_pfn = end_pfn;
        }
+        zones_size[ZONE_NORMAL] = max_low_pfn;
+        free_area_init_nodes(zones_size);
 }
 void __init mem_init(void)
@@ -535,34 +486,10 @@ void __init mem_init(void)
        high_memory = (void *) __va(num_physpages << PAGE_SHIFT);
        for_each_online_node(node) {
-                unsigned slot, numslots;
-                struct page *end, *p;
                /*
                 * This will free up the bootmem, ie, slot 0 memory.
                 */
                totalram_pages += free_all_bootmem_node(NODE_DATA(node));
-                /*
-                 * We need to manually do the other slots.
-                 */
-                numslots = node_getlastslot(node);
-                for (slot = 1; slot <= numslots; slot++) {
-                        p = nid_page_nr(node, slot_getbasepfn(node, slot) -
-                                              slot_getbasepfn(node, 0));
-                        /*
-                         * Free valid memory in current slot.
-                         */
-                        for (end = p + slot_getsize(node, slot); p < end; p++) {
-                                /* if (!page_is_ram(pgnr)) continue; */
-                                /* commented out until page_is_ram works */
-                                ClearPageReserved(p);
-                                init_page_count(p);
-                                __free_page(p);
-                                totalram_pages++;
-                        }
-                }
        }
        totalram_pages -= setup_zero_pages();   /* This comes from node 0 */
diff --git a/arch/mips/sgi-ip27/ip27-smp.c b/arch/mips/sgi-ip27/ip27-smp.c
index f15fc93d6b35..ba5cdebeaf0d 100644
--- a/arch/mips/sgi-ip27/ip27-smp.c
+++ b/arch/mips/sgi-ip27/ip27-smp.c
@@ -176,11 +176,14 @@ static void ip27_send_ipi_mask(cpumask_t mask, unsigned int action)
 static void __cpuinit ip27_init_secondary(void)
 {
        per_cpu_init();
-        local_irq_enable();
 }
 static void __cpuinit ip27_smp_finish(void)
 {
+        extern void hub_rt_clock_event_init(void);
+        hub_rt_clock_event_init();
+        local_irq_enable();
 }
 static void __init ip27_cpus_done(void)
diff --git a/arch/mips/sgi-ip27/ip27-timer.c b/arch/mips/sgi-ip27/ip27-timer.c
index 9cebc9e7da63..8b4e854af925 100644
--- a/arch/mips/sgi-ip27/ip27-timer.c
+++ b/arch/mips/sgi-ip27/ip27-timer.c
@@ -160,10 +160,13 @@ static void rt_set_mode(enum clock_event_mode mode,
 int rt_timer_irq;
+static DEFINE_PER_CPU(struct clock_event_device, hub_rt_clockevent);
+static DEFINE_PER_CPU(char [11], hub_rt_name);
 static irqreturn_t hub_rt_counter_handler(int irq, void *dev_id)
 {
-        struct clock_event_device *cd = dev_id;
        unsigned int cpu = smp_processor_id();
+        struct clock_event_device *cd = &per_cpu(hub_rt_clockevent, cpu);
        int slice = cputoslice(cpu);
        /*
@@ -192,10 +195,7 @@ struct irqaction hub_rt_irqaction = {
 #define NSEC_PER_CYCLE          800
 #define CYCLES_PER_SEC          (NSEC_PER_SEC / NSEC_PER_CYCLE)
-static DEFINE_PER_CPU(struct clock_event_device, hub_rt_clockevent);
+void __cpuinit hub_rt_clock_event_init(void)
-static DEFINE_PER_CPU(char [11], hub_rt_name);
-static void __cpuinit hub_rt_clock_event_init(void)
 {
        unsigned int cpu = smp_processor_id();
        struct clock_event_device *cd = &per_cpu(hub_rt_clockevent, cpu);
@@ -203,17 +203,16 @@ static void __cpuinit hub_rt_clock_event_init(void)
        int irq = rt_timer_irq;
        sprintf(name, "hub-rt %d", cpu);
-        cd->name                = "HUB-RT",
+        cd->name                = name;
-        cd->features            = CLOCK_EVT_FEAT_ONESHOT,
+        cd->features            = CLOCK_EVT_FEAT_ONESHOT;
        clockevent_set_clock(cd, CYCLES_PER_SEC);
        cd->max_delta_ns        = clockevent_delta2ns(0xfffffffffffff, cd);
        cd->min_delta_ns        = clockevent_delta2ns(0x300, cd);
-        cd->rating              = 200,
+        cd->rating              = 200;
-        cd->irq                 = irq,
+        cd->irq                 = irq;
-        cd->cpumask             = cpumask_of_cpu(cpu),
+        cd->cpumask             = cpumask_of_cpu(cpu);
-        cd->rating              = 300,
+        cd->set_next_event      = rt_next_event;
-        cd->set_next_event      = rt_next_event,
+        cd->set_mode            = rt_set_mode;
-        cd->set_mode            = rt_set_mode,
        clockevents_register_device(cd);
 }
@@ -261,6 +260,7 @@ void __init plat_time_init(void)
 {
        hub_rt_clocksource_init();
        hub_rt_clock_event_global_init();
+        hub_rt_clock_event_init();
 }
 void __cpuinit cpu_time_init(void)
@@ -281,7 +281,6 @@ void __cpuinit cpu_time_init(void)
        printk("CPU %d clock is %dMHz.\n", smp_processor_id(), cpu->cpu_speed);
-        hub_rt_clock_event_init();
        set_c0_status(SRB_TIMOCLK);
 }
diff --git a/arch/parisc/hpux/gate.S b/arch/parisc/hpux/gate.S
index f0b18ce89842..38a1c1b8d4e8 100644
--- a/arch/parisc/hpux/gate.S
+++ b/arch/parisc/hpux/gate.S
@@ -13,10 +13,9 @@
 #include <asm/unistd.h>
 #include <asm/errno.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
        .level  LEVEL
-        __HEAD
+        .text
        .import hpux_call_table
        .import hpux_syscall_exit,code
diff --git a/arch/parisc/hpux/wrappers.S b/arch/parisc/hpux/wrappers.S
index ccd3a50c0995..58c53c879c02 100644
--- a/arch/parisc/hpux/wrappers.S
+++ b/arch/parisc/hpux/wrappers.S
@@ -28,10 +28,9 @@
 #include <asm/assembly.h>
 #include <asm/signal.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
        .level  LEVEL
-        __HEAD
+        .text
        /* These should probably go in a header file somewhere.
         * They are duplicated in kernel/wrappers.S
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 5d0837458c19..d1fa4edd2d80 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -38,7 +38,6 @@
 #include <asm/thread_info.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
 #ifdef CONFIG_64BIT
        .level 2.0w
@@ -622,7 +621,7 @@
         * the static part of the kernel address space.
         */
-        __HEAD
+        .text
        .align  PAGE_SIZE
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index 5680a2c3b13d..a84e31e82876 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -33,6 +33,7 @@ ENTRY(boot_args)
 END(boot_args)
        __HEAD
        .align  4
        .import init_thread_union,data
        .import fault_vector_20,code    /* IVA parisc 2.0 32 bit */
diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S
index 068322eb8c9b..2cbf13b3ef11 100644
--- a/arch/parisc/kernel/hpmc.S
+++ b/arch/parisc/kernel/hpmc.S
@@ -47,7 +47,6 @@
 #include <asm/pdc.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
        /*
         * stack for os_hpmc, the HPMC handler.
@@ -77,7 +76,7 @@ ENTRY(hpmc_pim_data)
        .block HPMC_PIM_DATA_SIZE
 END(hpmc_pim_data)
-        __HEAD
+        .text
        .import intr_save, code
 ENTRY(os_hpmc)
diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
index e3246a5ca74f..09b77b2553c6 100644
--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
@@ -37,9 +37,8 @@
 #include <asm/pgtable.h>
 #include <asm/cache.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
-        __HEAD
+        .text
        .align  128
 ENTRY(flush_tlb_all_local)
diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index 5b7fc4aa044d..0eecfbbc59cd 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c
@@ -152,3 +152,6 @@ EXPORT_SYMBOL($$dyncall);
 EXPORT_SYMBOL(node_data);
 EXPORT_SYMBOL(pfnnid_map);
 #endif
+/* from pacache.S -- needed for copy_page */
+EXPORT_SYMBOL(copy_user_page_asm);
diff --git a/arch/parisc/kernel/perf_asm.S b/arch/parisc/kernel/perf_asm.S
index d411dfb5b6d1..fa6ea99bb324 100644
--- a/arch/parisc/kernel/perf_asm.S
+++ b/arch/parisc/kernel/perf_asm.S
@@ -43,7 +43,7 @@
 ; The coprocessor only needs to be enabled when
 ; starting/stopping the coprocessor with the pmenb/pmdis.
 ;
-        __HEAD
+        .text
 ENTRY(perf_intrigue_enable_perf_counters)
        .proc
diff --git a/arch/parisc/kernel/real2.S b/arch/parisc/kernel/real2.S
index 47fbdae6efd5..7a92695d95a6 100644
--- a/arch/parisc/kernel/real2.S
+++ b/arch/parisc/kernel/real2.S
@@ -12,7 +12,6 @@
 #include <asm/assembly.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
        .section        .bss
        .export real_stack
@@ -40,7 +39,7 @@ save_cr_end:
 /************************ 32-bit real-mode calls ***********************/
 /* This can be called in both narrow and wide kernels */
-        __HEAD
+        .text
        /* unsigned long real32_call_asm(unsigned int *sp,
         *              unsigned int *arg0p,
@@ -114,7 +113,7 @@ ENDPROC(real32_call_asm)
 #  define PUSH_CR(r, where) mfctl r, %r1 ! STREG,ma %r1, REG_SZ(where)
 #  define POP_CR(r, where) LDREG,mb -REG_SZ(where), %r1 ! mtctl %r1, r
-        __HEAD
+        .text
 save_control_regs:
        load32  PA(save_cr_space), %r28
        PUSH_CR(%cr24, %r28)
@@ -146,7 +145,7 @@ restore_control_regs:
 /* rfi_virt2real() and rfi_real2virt() could perhaps be adapted for
 * more general-purpose use by the several places which need RFIs
 */
-        __HEAD
+        .text
        .align 128
 rfi_virt2real:
        /* switch to real mode... */
@@ -181,7 +180,7 @@ rfi_v2r_1:
        bv      0(%r2)
        nop
-        __HEAD
+        .text
        .align 128
 rfi_real2virt:
        rsm             PSW_SM_I,%r0
@@ -219,7 +218,7 @@ rfi_r2v_1:
 /************************ 64-bit real-mode calls ***********************/
 /* This is only usable in wide kernels right now and will probably stay so */
-        __HEAD
+        .text
        /* unsigned long real64_call_asm(unsigned long *sp,
         *              unsigned long *arg0p,
         *              unsigned long fn)
@@ -277,7 +276,7 @@ ENDPROC(real64_call_asm)
 #endif
-        __HEAD
+        .text
        /* http://lists.parisc-linux.org/hypermail/parisc-linux/10916.html
        **      GCC 3.3 and later has a new function in libgcc.a for
        **      comparing function pointers.
diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
index db94affe5c71..fb59852006de 100644
--- a/arch/parisc/kernel/signal32.c
+++ b/arch/parisc/kernel/signal32.c
@@ -289,7 +289,7 @@ setup_sigcontext32(struct compat_sigcontext __user *sc, struct compat_regfile __
                                &sc->sc_iaoq[0], compat_reg);
                
                /* Store upper half */
-                compat_reg = (compat_uint_t)(regs->gr[32] >> 32);
+                compat_reg = (compat_uint_t)(regs->gr[31] >> 32);
                err |= __put_user(compat_reg, &rf->rf_iaoq[0]);
                DBG(2,"setup_sigcontext32: upper half iaoq[0] = %#x\n", compat_reg);
                
@@ -299,7 +299,7 @@ setup_sigcontext32(struct compat_sigcontext __user *sc, struct compat_regfile __
                DBG(2,"setup_sigcontext32: sc->sc_iaoq[1] = %p <= %#x\n",
                                &sc->sc_iaoq[1], compat_reg);
                /* Store upper half */
-                compat_reg = (compat_uint_t)((regs->gr[32]+4) >> 32);
+                compat_reg = (compat_uint_t)((regs->gr[31]+4) >> 32);
                err |= __put_user(compat_reg, &rf->rf_iaoq[1]);
                DBG(2,"setup_sigcontext32: upper half iaoq[1] = %#x\n", compat_reg);
                
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index ae509d8cd03f..69b6eebc466e 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -17,7 +17,6 @@
 #include <asm/processor.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
        /* We fill the empty parts of the gateway page with
         * something that will kill the kernel or a
@@ -27,7 +26,7 @@
        .level          LEVEL
-        __HEAD
+        .text
        .import syscall_exit,code
        .import syscall_exit_rfi,code
@@ -637,7 +636,7 @@ END(sys_call_table64)
                All light-weight-syscall atomic operations 
                will use this set of locks 
        */
-        .section .data, "aw"
+        .section .data
        .align  PAGE_SIZE
 ENTRY(lws_lock_start)
        /* lws locks */
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 50b4a3a25d0a..2e516b871752 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -50,6 +50,7 @@ SECTIONS
        _text = .;              /* Text and read-only data */
        .text ALIGN(16) : {
+                HEAD_TEXT
                TEXT_TEXT
                SCHED_TEXT
                LOCK_TEXT
diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S
index 4821ad6d5269..d172d4245cdc 100644
--- a/arch/parisc/lib/fixup.S
+++ b/arch/parisc/lib/fixup.S
@@ -23,7 +23,6 @@
 #include <asm/assembly.h>
 #include <asm/errno.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
 #ifdef CONFIG_SMP
        .macro  get_fault_ip t1 t2
@@ -56,7 +55,7 @@
        .level LEVEL
-        __HEAD
+        .text
        .section .fixup, "ax"
        /* get_user() fixups, store -EFAULT in r8, and 0 in r9 */
diff --git a/arch/parisc/lib/lusercopy.S b/arch/parisc/lib/lusercopy.S
index b0d885350846..1bd23ccec17b 100644
--- a/arch/parisc/lib/lusercopy.S
+++ b/arch/parisc/lib/lusercopy.S
@@ -33,12 +33,11 @@
 */
+        .text
+        
 #include <asm/assembly.h>
 #include <asm/errno.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
-        __HEAD
        /*
         * get_sr gets the appropriate space value into
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 78fe252b92c3..ce0da689a89d 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -547,6 +547,7 @@ void __init mem_init(void)
 }
 unsigned long *empty_zero_page __read_mostly;
+EXPORT_SYMBOL(empty_zero_page);
 void show_mem(void)
 {
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index f5e0b2a5af57..d53b84e761a9 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -221,8 +221,8 @@ image-$(CONFIG_WARP)			+= cuImage.warp
 image-$(CONFIG_YOSEMITE)                += cuImage.yosemite
 # Board ports in arch/powerpc/platform/8xx/Kconfig
-image-$(CONFIG_PPC_MPC86XADS)           += cuImage.mpc866ads
+image-$(CONFIG_MPC86XADS)               += cuImage.mpc866ads
-image-$(CONFIG_PPC_MPC885ADS)           += cuImage.mpc885ads
+image-$(CONFIG_MPC885ADS)               += cuImage.mpc885ads
 image-$(CONFIG_PPC_EP88XC)              += dtbImage.ep88xc
 image-$(CONFIG_PPC_ADDER875)            += cuImage.adder875-uboot \
                                           dtbImage.adder875-redboot
diff --git a/arch/powerpc/boot/dts/mpc8610_hpcd.dts b/arch/powerpc/boot/dts/mpc8610_hpcd.dts
index 08a780d89807..fa9b6bbeb5af 100644
--- a/arch/powerpc/boot/dts/mpc8610_hpcd.dts
+++ b/arch/powerpc/boot/dts/mpc8610_hpcd.dts
@@ -251,14 +251,14 @@
                dma@c300 {
                        #address-cells = <1>;
                        #size-cells = <1>;
-                        compatible = "fsl,mpc8610-dma", "fsl,mpc8540-dma";
+                        compatible = "fsl,mpc8610-dma", "fsl,eloplus-dma";
                        cell-index = <1>;
                        reg = <0xc300 0x4>; /* DMA general status register */
                        ranges = <0x0 0xc100 0x200>;
                        dma-channel@0 {
                                compatible = "fsl,mpc8610-dma-channel",
-                                        "fsl,mpc8540-dma-channel";
+                                        "fsl,eloplus-dma-channel";
                                cell-index = <0>;
                                reg = <0x0 0x80>;
                                interrupt-parent = <&mpic>;
@@ -266,7 +266,7 @@
                        };
                        dma-channel@1 {
                                compatible = "fsl,mpc8610-dma-channel",
-                                        "fsl,mpc8540-dma-channel";
+                                        "fsl,eloplus-dma-channel";
                                cell-index = <1>;
                                reg = <0x80 0x80>;
                                interrupt-parent = <&mpic>;
@@ -274,7 +274,7 @@
                        };
                        dma-channel@2 {
                                compatible = "fsl,mpc8610-dma-channel",
-                                        "fsl,mpc8540-dma-channel";
+                                        "fsl,eloplus-dma-channel";
                                cell-index = <2>;
                                reg = <0x100 0x80>;
                                interrupt-parent = <&mpic>;
@@ -282,7 +282,7 @@
                        };
                        dma-channel@3 {
                                compatible = "fsl,mpc8610-dma-channel",
-                                        "fsl,mpc8540-dma-channel";
+                                        "fsl,eloplus-dma-channel";
                                cell-index = <3>;
                                reg = <0x180 0x80>;
                                interrupt-parent = <&mpic>;
diff --git a/arch/powerpc/configs/pasemi_defconfig b/arch/powerpc/configs/pasemi_defconfig
index 09f306248f2e..199e5f59d7a6 100644
--- a/arch/powerpc/configs/pasemi_defconfig
+++ b/arch/powerpc/configs/pasemi_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.25-rc6
+# Linux kernel version: 2.6.26-rc3
-# Tue Mar 25 10:25:48 2008
+# Tue May 27 16:08:06 2008
 #
 CONFIG_PPC64=y
@@ -29,6 +29,9 @@ CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_HAVE_SETUP_PER_CPU_AREA=y
 CONFIG_IRQ_PER_CPU=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 CONFIG_ARCH_HAS_ILOG2_U32=y
 CONFIG_ARCH_HAS_ILOG2_U64=y
@@ -87,6 +90,7 @@ CONFIG_INITRAMFS_SOURCE=""
 CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_SYSCTL_SYSCALL=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
@@ -115,12 +119,14 @@ CONFIG_HAVE_OPROFILE=y
 # CONFIG_KPROBES is not set
 CONFIG_HAVE_KPROBES=y
 CONFIG_HAVE_KRETPROBES=y
+# CONFIG_HAVE_DMA_ATTRS is not set
 CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
@@ -167,11 +173,11 @@ CONFIG_PPC_PASEMI=y
 CONFIG_PPC_PASEMI_IOMMU=y
 # CONFIG_PPC_PASEMI_IOMMU_DMA_FORCE is not set
 CONFIG_PPC_PASEMI_MDIO=y
-# CONFIG_PPC_CELLEB is not set
 # CONFIG_PPC_PS3 is not set
 # CONFIG_PPC_CELL is not set
 # CONFIG_PPC_CELL_NATIVE is not set
 # CONFIG_PPC_IBM_CELL_BLADE is not set
+# CONFIG_PPC_CELLEB is not set
 # CONFIG_PQ2ADS is not set
 CONFIG_PPC_NATIVE=y
 # CONFIG_IPIC is not set
@@ -192,6 +198,7 @@ CONFIG_CPU_FREQ_DEBUG=y
 CONFIG_CPU_FREQ_STAT=y
 # CONFIG_CPU_FREQ_STAT_DETAILS is not set
 CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
 # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
 # CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
 # CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
@@ -226,7 +233,6 @@ CONFIG_PREEMPT_NONE=y
 CONFIG_BINFMT_ELF=y
 CONFIG_COMPAT_BINFMT_ELF=y
 # CONFIG_BINFMT_MISC is not set
-CONFIG_FORCE_MAX_ZONEORDER=9
 CONFIG_HUGETLB_PAGE_SIZE_VARIABLE=y
 CONFIG_IOMMU_VMERGE=y
 CONFIG_IOMMU_HELPER=y
@@ -249,12 +255,14 @@ CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_RESOURCES_64BIT=y
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
 CONFIG_PPC_HAS_HASH_64K=y
 CONFIG_PPC_64K_PAGES=y
+CONFIG_FORCE_MAX_ZONEORDER=9
 # CONFIG_PPC_SUBPAGE_PROT is not set
 # CONFIG_SCHED_SMT is not set
 CONFIG_PROC_DEVICETREE=y
@@ -290,9 +298,12 @@ CONFIG_CARDBUS=y
 # CONFIG_YENTA is not set
 # CONFIG_PD6729 is not set
 # CONFIG_I82092 is not set
-# CONFIG_ELECTRA_CF is not set
+CONFIG_ELECTRA_CF=y
 # CONFIG_HOTPLUG_PCI is not set
+# CONFIG_HAS_RAPIDIO is not set
+CONFIG_PAGE_OFFSET=0xc000000000000000
 CONFIG_KERNEL_START=0xc000000000000000
+CONFIG_PHYSICAL_START=0x00000000
 #
 # Networking
@@ -341,8 +352,6 @@ CONFIG_TCP_CONG_CUBIC=y
 CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_TCP_MD5SIG is not set
 # CONFIG_IPV6 is not set
-# CONFIG_INET6_XFRM_TUNNEL is not set
-# CONFIG_INET6_TUNNEL is not set
 # CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
 # CONFIG_IP_DCCP is not set
@@ -473,6 +482,7 @@ CONFIG_MTD_NAND_PASEMI=y
 #
 # CONFIG_MTD_UBI is not set
 CONFIG_OF_DEVICE=y
+CONFIG_OF_I2C=y
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_FD is not set
@@ -520,7 +530,6 @@ CONFIG_IDE_PROC_FS=y
 #
 # IDE chipset support/bugfixes
 #
-# CONFIG_IDE_GENERIC is not set
 # CONFIG_BLK_DEV_PLATFORM is not set
 #
@@ -554,7 +563,7 @@ CONFIG_IDE_PROC_FS=y
 # CONFIG_BLK_DEV_VIA82CXXX is not set
 # CONFIG_BLK_DEV_TC86C001 is not set
 # CONFIG_BLK_DEV_IDEDMA is not set
-CONFIG_IDE_ARCH_OBSOLETE_INIT=y
+# CONFIG_BLK_DEV_HD_ONLY is not set
 # CONFIG_BLK_DEV_HD is not set
 #
@@ -632,7 +641,10 @@ CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_SCSI_LOWLEVEL_PCMCIA is not set
 CONFIG_ATA=y
 # CONFIG_ATA_NONSTANDARD is not set
+CONFIG_SATA_PMP=y
 # CONFIG_SATA_AHCI is not set
+CONFIG_SATA_SIL24=y
+CONFIG_ATA_SFF=y
 # CONFIG_SATA_SVW is not set
 # CONFIG_ATA_PIIX is not set
 CONFIG_SATA_MV=y
@@ -642,7 +654,6 @@ CONFIG_SATA_MV=y
 # CONFIG_SATA_PROMISE is not set
 # CONFIG_SATA_SX4 is not set
 # CONFIG_SATA_SIL is not set
-CONFIG_SATA_SIL24=y
 # CONFIG_SATA_SIS is not set
 # CONFIG_SATA_ULI is not set
 # CONFIG_SATA_VIA is not set
@@ -689,6 +700,7 @@ CONFIG_PATA_PCMCIA=y
 # CONFIG_PATA_WINBOND is not set
 CONFIG_PATA_PLATFORM=y
 CONFIG_PATA_OF_PLATFORM=y
+# CONFIG_PATA_SCH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=y
 CONFIG_MD_LINEAR=y
@@ -791,7 +803,6 @@ CONFIG_E1000_NAPI=y
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
 # CONFIG_SKY2 is not set
-# CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
 # CONFIG_BNX2 is not set
@@ -810,6 +821,7 @@ CONFIG_PASEMI_MAC=y
 # CONFIG_MLX4_CORE is not set
 # CONFIG_TEHUTI is not set
 # CONFIG_BNX2X is not set
+# CONFIG_SFC is not set
 # CONFIG_TR is not set
 #
@@ -817,6 +829,7 @@ CONFIG_PASEMI_MAC=y
 #
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
+# CONFIG_IWLWIFI_LEDS is not set
 #
 # USB Network Adapters
@@ -890,6 +903,7 @@ CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 # CONFIG_VT_HW_CONSOLE_BINDING is not set
+CONFIG_DEVKMEM=y
 # CONFIG_SERIAL_NONSTANDARD is not set
 # CONFIG_NOZOMI is not set
@@ -917,7 +931,6 @@ CONFIG_LEGACY_PTY_COUNT=4
 # CONFIG_IPMI_HANDLER is not set
 CONFIG_HW_RANDOM=y
 CONFIG_HW_RANDOM_PASEMI=y
-# CONFIG_GEN_RTC is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
@@ -936,13 +949,7 @@ CONFIG_DEVPORT=y
 CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=y
-#
-# I2C Algorithms
-#
 CONFIG_I2C_ALGOBIT=y
-CONFIG_I2C_ALGOPCF=y
-CONFIG_I2C_ALGOPCA=y
 #
 # I2C Hardware Bus support
@@ -971,6 +978,7 @@ CONFIG_I2C_PASEMI=y
 # CONFIG_I2C_VIA is not set
 # CONFIG_I2C_VIAPRO is not set
 # CONFIG_I2C_VOODOO3 is not set
+# CONFIG_I2C_PCA_PLATFORM is not set
 #
 # Miscellaneous I2C Chip support
@@ -980,19 +988,13 @@ CONFIG_SENSORS_EEPROM=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_TPS65010 is not set
 # CONFIG_SENSORS_MAX6875 is not set
 # CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CHIP is not set
-#
-# SPI support
-#
 # CONFIG_SPI is not set
-# CONFIG_SPI_MASTER is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 CONFIG_HWMON=y
@@ -1062,12 +1064,22 @@ CONFIG_SSB_POSSIBLE=y
 # Multifunction device drivers
 #
 # CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
 #
 # Multimedia devices
 #
+#
+# Multimedia core support
+#
 # CONFIG_VIDEO_DEV is not set
 # CONFIG_DVB_CORE is not set
+# CONFIG_VIDEO_MEDIA is not set
+#
+# Multimedia drivers
+#
 CONFIG_DAB=y
 # CONFIG_USB_DABUSB is not set
@@ -1094,8 +1106,8 @@ CONFIG_FB_CFB_IMAGEBLIT=y
 # CONFIG_FB_SYS_FILLRECT is not set
 # CONFIG_FB_SYS_COPYAREA is not set
 # CONFIG_FB_SYS_IMAGEBLIT is not set
+# CONFIG_FB_FOREIGN_ENDIAN is not set
 # CONFIG_FB_SYS_FOPS is not set
-CONFIG_FB_DEFERRED_IO=y
 # CONFIG_FB_SVGALIB is not set
 CONFIG_FB_MACMODES=y
 CONFIG_FB_BACKLIGHT=y
@@ -1213,6 +1225,7 @@ CONFIG_SND_VERBOSE_PROCFS=y
 # CONFIG_SND_AU8810 is not set
 # CONFIG_SND_AU8820 is not set
 # CONFIG_SND_AU8830 is not set
+# CONFIG_SND_AW2 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
 # CONFIG_SND_CA0106 is not set
@@ -1292,11 +1305,11 @@ CONFIG_SND_USB_USX2Y=y
 # CONFIG_SND_SOC is not set
 #
-# SoC Audio support for SuperH
+# ALSA SoC audio for Freescale SOCs
 #
 #
-# ALSA SoC audio for Freescale SOCs
+# SoC Audio for the Texas Instruments OMAP
 #
 #
@@ -1334,11 +1347,13 @@ CONFIG_USB_DEVICEFS=y
 #
 # USB Host Controller Drivers
 #
+# CONFIG_USB_C67X00_HCD is not set
 CONFIG_USB_EHCI_HCD=y
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
 # CONFIG_USB_EHCI_TT_NEWSCHED is not set
 CONFIG_USB_EHCI_HCD_PPC_OF=y
 # CONFIG_USB_ISP116X_HCD is not set
+# CONFIG_USB_ISP1760_HCD is not set
 CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OHCI_HCD_PPC_OF is not set
 # CONFIG_USB_OHCI_BIG_ENDIAN_DESC is not set
@@ -1354,6 +1369,7 @@ CONFIG_USB_SL811_HCD=y
 #
 # CONFIG_USB_ACM is not set
 # CONFIG_USB_PRINTER is not set
+# CONFIG_USB_WDM is not set
 #
 # NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
@@ -1375,6 +1391,7 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
 # CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
 CONFIG_USB_LIBUSUAL=y
 #
@@ -1416,6 +1433,7 @@ CONFIG_USB_LIBUSUAL=y
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
+# CONFIG_ACCESSIBILITY is not set
 # CONFIG_INFINIBAND is not set
 CONFIG_EDAC=y
@@ -1475,10 +1493,6 @@ CONFIG_RTC_DRV_DS1307=y
 # on-CPU RTC drivers
 #
 # CONFIG_DMADEVICES is not set
-#
-# Userspace I/O
-#
 # CONFIG_UIO is not set
 #
@@ -1576,12 +1590,10 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 # CONFIG_NFS_V4 is not set
-# CONFIG_NFS_DIRECTIO is not set
 CONFIG_NFSD=y
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 CONFIG_NFSD_V4=y
-CONFIG_NFSD_TCP=y
 CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
@@ -1665,9 +1677,10 @@ CONFIG_NLS_ISO8859_1=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+# CONFIG_GENERIC_FIND_FIRST_BIT is not set
 CONFIG_CRC_CCITT=y
 # CONFIG_CRC16 is not set
-# CONFIG_CRC_ITU_T is not set
+CONFIG_CRC_ITU_T=y
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
 CONFIG_LIBCRC32C=m
@@ -1677,6 +1690,7 @@ CONFIG_PLIST=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
 CONFIG_HAS_DMA=y
+CONFIG_HAVE_LMB=y
 #
 # Kernel hacking
@@ -1684,6 +1698,7 @@ CONFIG_HAS_DMA=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=2048
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 # CONFIG_DEBUG_FS is not set
@@ -1694,18 +1709,23 @@ CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_OBJECTS is not set
 # CONFIG_SLUB_DEBUG_ON is not set
 # CONFIG_SLUB_STATS is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_LOCK_STAT is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
 # CONFIG_BOOT_PRINTK_DELAY is not set
@@ -1735,53 +1755,83 @@ CONFIG_ASYNC_CORE=y
 CONFIG_ASYNC_MEMCPY=y
 CONFIG_ASYNC_XOR=y
 CONFIG_CRYPTO=y
+#
+# Crypto core or helper
+#
 CONFIG_CRYPTO_ALGAPI=y
 CONFIG_CRYPTO_AEAD=y
 CONFIG_CRYPTO_BLKCIPHER=y
-# CONFIG_CRYPTO_SEQIV is not set
 CONFIG_CRYPTO_HASH=y
 CONFIG_CRYPTO_MANAGER=y
+# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+CONFIG_CRYPTO_AUTHENC=y
+# CONFIG_CRYPTO_TEST is not set
+#
+# Authenticated Encryption with Associated Data
+#
+# CONFIG_CRYPTO_CCM is not set
+# CONFIG_CRYPTO_GCM is not set
+# CONFIG_CRYPTO_SEQIV is not set
+#
+# Block modes
+#
+CONFIG_CRYPTO_CBC=y
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_CTS is not set
+# CONFIG_CRYPTO_ECB is not set
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+#
+# Hash modes
+#
 CONFIG_CRYPTO_HMAC=y
 # CONFIG_CRYPTO_XCBC is not set
-# CONFIG_CRYPTO_NULL is not set
+#
+# Digest
+#
+# CONFIG_CRYPTO_CRC32C is not set
 CONFIG_CRYPTO_MD4=y
 CONFIG_CRYPTO_MD5=y
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
 CONFIG_CRYPTO_SHA1=y
 CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
-# CONFIG_CRYPTO_WP512 is not set
 # CONFIG_CRYPTO_TGR192 is not set
-# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_WP512 is not set
-# CONFIG_CRYPTO_ECB is not set
-CONFIG_CRYPTO_CBC=y
+#
-# CONFIG_CRYPTO_PCBC is not set
+# Ciphers
-# CONFIG_CRYPTO_LRW is not set
+#
-# CONFIG_CRYPTO_XTS is not set
-# CONFIG_CRYPTO_CTR is not set
-# CONFIG_CRYPTO_GCM is not set
-# CONFIG_CRYPTO_CCM is not set
-# CONFIG_CRYPTO_CRYPTD is not set
-CONFIG_CRYPTO_DES=y
-# CONFIG_CRYPTO_FCRYPT is not set
-CONFIG_CRYPTO_BLOWFISH=y
-# CONFIG_CRYPTO_TWOFISH is not set
-# CONFIG_CRYPTO_SERPENT is not set
 CONFIG_CRYPTO_AES=y
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_ARC4 is not set
+CONFIG_CRYPTO_BLOWFISH=y
+# CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
-# CONFIG_CRYPTO_TEA is not set
+CONFIG_CRYPTO_DES=y
-# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_FCRYPT is not set
 # CONFIG_CRYPTO_KHAZAD is not set
-# CONFIG_CRYPTO_ANUBIS is not set
-# CONFIG_CRYPTO_SEED is not set
 # CONFIG_CRYPTO_SALSA20 is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+#
+# Compression
+#
 # CONFIG_CRYPTO_DEFLATE is not set
-# CONFIG_CRYPTO_MICHAEL_MIC is not set
-# CONFIG_CRYPTO_CRC32C is not set
-# CONFIG_CRYPTO_CAMELLIA is not set
-# CONFIG_CRYPTO_TEST is not set
-CONFIG_CRYPTO_AUTHENC=y
 # CONFIG_CRYPTO_LZO is not set
 CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_DEV_HIFN_795X is not set
 # CONFIG_PPC_CLOCK is not set
+# CONFIG_VIRTUALIZATION is not set
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index 52750745edfd..30eedfc5a566 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -189,7 +189,7 @@ struct pci_dev *of_create_pci_dev(struct device_node *node,
        dev->cfg_size = pci_cfg_space_size(dev);
-        sprintf(pci_name(dev), "%04x:%02x:%02x.%d", pci_domain_nr(bus),
+        dev_set_name(&dev->dev, "%04x:%02x:%02x.%d", pci_domain_nr(bus),
                dev->bus->number, PCI_SLOT(devfn), PCI_FUNC(devfn));
        dev->class = get_int_prop(node, "class-code", 0);
        dev->revision = get_int_prop(node, "revision-id", 0);
diff --git a/arch/powerpc/kernel/prom_init_check.sh b/arch/powerpc/kernel/prom_init_check.sh
index 8e24fc1821e8..31729a9387df 100644
--- a/arch/powerpc/kernel/prom_init_check.sh
+++ b/arch/powerpc/kernel/prom_init_check.sh
@@ -20,7 +20,7 @@ WHITELIST="add_reloc_offset __bss_start __bss_stop copy_and_flush
 _end enter_prom memcpy memset reloc_offset __secondary_hold
 __secondary_hold_acknowledge __secondary_hold_spinloop __start
 strcmp strcpy strlcpy strlen strncmp strstr logo_linux_clut224
-reloc_got2"
+reloc_got2 kernstart_addr"
 NM="$1"
 OBJ="$2"
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index faeb8f207ea4..da7c058e3731 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -87,6 +87,7 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
 #ifdef CONFIG_ALTIVEC
        elf_vrreg_t __user *v_regs = (elf_vrreg_t __user *)(((unsigned long)sc->vmx_reserve + 15) & ~0xful);
 #endif
+        unsigned long msr = regs->msr;
        long err = 0;
        flush_fp_to_thread(current);
@@ -102,7 +103,7 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
                /* set MSR_VEC in the MSR value in the frame to indicate that sc->v_reg)
                 * contains valid data.
                 */
-                regs->msr |= MSR_VEC;
+                msr |= MSR_VEC;
        }
        /* We always copy to/from vrsave, it's 0 if we don't have or don't
         * use altivec.
@@ -114,6 +115,7 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
        err |= __put_user(&sc->gp_regs, &sc->regs);
        WARN_ON(!FULL_REGS(regs));
        err |= __copy_to_user(&sc->gp_regs, regs, GP_REGS_SIZE);
+        err |= __put_user(msr, &sc->gp_regs[PT_MSR]);
        err |= __copy_to_user(&sc->fp_regs, &current->thread.fpr, FP_REGS_SIZE);
        err |= __put_user(signr, &sc->signal);
        err |= __put_user(handler, &sc->handler);
diff --git a/arch/powerpc/kvm/44x_tlb.c b/arch/powerpc/kvm/44x_tlb.c
index f5d7a5eab96e..75dff7cfa814 100644
--- a/arch/powerpc/kvm/44x_tlb.c
+++ b/arch/powerpc/kvm/44x_tlb.c
@@ -116,8 +116,6 @@ static void kvmppc_44x_shadow_release(struct kvm_vcpu *vcpu,
        struct tlbe *stlbe = &vcpu->arch.shadow_tlb[index];
        struct page *page = vcpu->arch.shadow_pages[index];
-        kunmap(vcpu->arch.shadow_pages[index]);
        if (get_tlb_v(stlbe)) {
                if (kvmppc_44x_tlbe_is_writable(stlbe))
                        kvm_release_page_dirty(page);
@@ -144,18 +142,19 @@ void kvmppc_mmu_map(struct kvm_vcpu *vcpu, u64 gvaddr, gfn_t gfn, u64 asid,
        stlbe = &vcpu->arch.shadow_tlb[victim];
        /* Get reference to new page. */
-        down_write(&current->mm->mmap_sem);
+        down_read(&current->mm->mmap_sem);
        new_page = gfn_to_page(vcpu->kvm, gfn);
        if (is_error_page(new_page)) {
-                printk(KERN_ERR "Couldn't get guest page!\n");
+                printk(KERN_ERR "Couldn't get guest page for gfn %lx!\n", gfn);
                kvm_release_page_clean(new_page);
+                up_read(&current->mm->mmap_sem);
                return;
        }
        hpaddr = page_to_phys(new_page);
        /* Drop reference to old page. */
        kvmppc_44x_shadow_release(vcpu, victim);
-        up_write(&current->mm->mmap_sem);
+        up_read(&current->mm->mmap_sem);
        vcpu->arch.shadow_pages[victim] = new_page;
diff --git a/arch/powerpc/kvm/booke_guest.c b/arch/powerpc/kvm/booke_guest.c
index 712d89a28c46..9c8ad850c6e3 100644
--- a/arch/powerpc/kvm/booke_guest.c
+++ b/arch/powerpc/kvm/booke_guest.c
@@ -227,39 +227,6 @@ void kvmppc_check_and_deliver_interrupts(struct kvm_vcpu *vcpu)
        }
 }
-static int kvmppc_emulate_mmio(struct kvm_run *run, struct kvm_vcpu *vcpu)
-{
-        enum emulation_result er;
-        int r;
-        er = kvmppc_emulate_instruction(run, vcpu);
-        switch (er) {
-        case EMULATE_DONE:
-                /* Future optimization: only reload non-volatiles if they were
-                 * actually modified. */
-                r = RESUME_GUEST_NV;
-                break;
-        case EMULATE_DO_MMIO:
-                run->exit_reason = KVM_EXIT_MMIO;
-                /* We must reload nonvolatiles because "update" load/store
-                 * instructions modify register state. */
-                /* Future optimization: only reload non-volatiles if they were
-                 * actually modified. */
-                r = RESUME_HOST_NV;
-                break;
-        case EMULATE_FAIL:
-                /* XXX Deliver Program interrupt to guest. */
-                printk(KERN_EMERG "%s: emulation failed (%08x)\n", __func__,
-                       vcpu->arch.last_inst);
-                r = RESUME_HOST;
-                break;
-        default:
-                BUG();
-        }
-        return r;
-}
 /**
 * kvmppc_handle_exit
 *
diff --git a/arch/powerpc/kvm/emulate.c b/arch/powerpc/kvm/emulate.c
index a03fe0c80698..000097461283 100644
--- a/arch/powerpc/kvm/emulate.c
+++ b/arch/powerpc/kvm/emulate.c
@@ -246,6 +246,11 @@ int kvmppc_emulate_instruction(struct kvm_run *run, struct kvm_vcpu *vcpu)
        case 31:
                switch (get_xop(inst)) {
+                case 23:                                        /* lwzx */
+                        rt = get_rt(inst);
+                        emulated = kvmppc_handle_load(run, vcpu, rt, 4, 1);
+                        break;
                case 83:                                        /* mfmsr */
                        rt = get_rt(inst);
                        vcpu->arch.gpr[rt] = vcpu->arch.msr;
@@ -267,6 +272,13 @@ int kvmppc_emulate_instruction(struct kvm_run *run, struct kvm_vcpu *vcpu)
                        kvmppc_set_msr(vcpu, vcpu->arch.gpr[rs]);
                        break;
+                case 151:                                       /* stwx */
+                        rs = get_rs(inst);
+                        emulated = kvmppc_handle_store(run, vcpu,
+                                                       vcpu->arch.gpr[rs],
+                                                       4, 1);
+                        break;
                case 163:                                       /* wrteei */
                        vcpu->arch.msr = (vcpu->arch.msr & ~MSR_EE)
                                         | (inst & MSR_EE);
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index f67e118116fa..51f82d83bf14 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -151,6 +151,7 @@ out:
        return ret;
 }
 #endif /* CONFIG_MEMORY_HOTREMOVE */
+#endif /* CONFIG_MEMORY_HOTPLUG */
 /*
 * walk_memory_resource() needs to make sure there is no holes in a given
@@ -184,8 +185,6 @@ walk_memory_resource(unsigned long start_pfn, unsigned long nr_pages, void *arg,
 }
 EXPORT_SYMBOL_GPL(walk_memory_resource);
-#endif /* CONFIG_MEMORY_HOTPLUG */
 void show_mem(void)
 {
        unsigned long total = 0, reserved = 0;
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index 80d1babb230d..e0ff59f21135 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -402,7 +402,7 @@ void __set_fixmap (enum fixed_addresses idx, phys_addr_t phys, pgprot_t flags)
                return;
        }
-        map_page(address, phys, flags);
+        map_page(address, phys, pgprot_val(flags));
        fixmaps++;
 }
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_gpio.c b/arch/powerpc/platforms/52xx/mpc52xx_gpio.c
index 48da5dfe4856..8a455ebce98d 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_gpio.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_gpio.c
@@ -100,7 +100,7 @@ static int mpc52xx_wkup_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio)
        struct of_mm_gpio_chip *mm_gc = to_of_mm_gpio_chip(gc);
        struct mpc52xx_gpiochip *chip = container_of(mm_gc,
                        struct mpc52xx_gpiochip, mmchip);
-        struct mpc52xx_gpio_wkup *regs = mm_gc->regs;
+        struct mpc52xx_gpio_wkup __iomem *regs = mm_gc->regs;
        unsigned long flags;
        spin_lock_irqsave(&gpio_lock, flags);
@@ -122,7 +122,7 @@ static int
 mpc52xx_wkup_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
 {
        struct of_mm_gpio_chip *mm_gc = to_of_mm_gpio_chip(gc);
-        struct mpc52xx_gpio_wkup *regs = mm_gc->regs;
+        struct mpc52xx_gpio_wkup __iomem *regs = mm_gc->regs;
        struct mpc52xx_gpiochip *chip = container_of(mm_gc,
                        struct mpc52xx_gpiochip, mmchip);
        unsigned long flags;
@@ -150,7 +150,7 @@ static int __devinit mpc52xx_wkup_gpiochip_probe(struct of_device *ofdev,
                                        const struct of_device_id *match)
 {
        struct mpc52xx_gpiochip *chip;
-        struct mpc52xx_gpio_wkup *regs;
+        struct mpc52xx_gpio_wkup __iomem *regs;
        struct of_gpio_chip *ofchip;
        int ret;
@@ -260,7 +260,7 @@ static int mpc52xx_simple_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio)
        struct of_mm_gpio_chip *mm_gc = to_of_mm_gpio_chip(gc);
        struct mpc52xx_gpiochip *chip = container_of(mm_gc,
                        struct mpc52xx_gpiochip, mmchip);
-        struct mpc52xx_gpio *regs = mm_gc->regs;
+        struct mpc52xx_gpio __iomem *regs = mm_gc->regs;
        unsigned long flags;
        spin_lock_irqsave(&gpio_lock, flags);
@@ -284,7 +284,7 @@ mpc52xx_simple_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
        struct of_mm_gpio_chip *mm_gc = to_of_mm_gpio_chip(gc);
        struct mpc52xx_gpiochip *chip = container_of(mm_gc,
                        struct mpc52xx_gpiochip, mmchip);
-        struct mpc52xx_gpio *regs = mm_gc->regs;
+        struct mpc52xx_gpio __iomem *regs = mm_gc->regs;
        unsigned long flags;
        spin_lock_irqsave(&gpio_lock, flags);
@@ -312,7 +312,7 @@ static int __devinit mpc52xx_simple_gpiochip_probe(struct of_device *ofdev,
 {
        struct mpc52xx_gpiochip *chip;
        struct of_gpio_chip *ofchip;
-        struct mpc52xx_gpio *regs;
+        struct mpc52xx_gpio __iomem *regs;
        int ret;
        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
@@ -387,7 +387,7 @@ mpc52xx_gpt_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val)
 static int mpc52xx_gpt_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio)
 {
        struct of_mm_gpio_chip *mm_gc = to_of_mm_gpio_chip(gc);
-        struct mpc52xx_gpt *regs = mm_gc->regs;
+        struct mpc52xx_gpt __iomem *regs = mm_gc->regs;
        out_be32(&regs->mode, 0x04);
diff --git a/arch/powerpc/platforms/cell/celleb_scc_pciex.c b/arch/powerpc/platforms/cell/celleb_scc_pciex.c
index 31da84c458d2..0e04f8fb152a 100644
--- a/arch/powerpc/platforms/cell/celleb_scc_pciex.c
+++ b/arch/powerpc/platforms/cell/celleb_scc_pciex.c
@@ -217,7 +217,7 @@ static u##size scc_pciex_in##name(unsigned long port)			\
 static void scc_pciex_ins##name(unsigned long p, void *b, unsigned long c) \
 {                                                                       \
        struct iowa_bus *bus = iowa_pio_find_bus(p);                    \
-        u##size *dst = b;                                               \
+        __le##size *dst = b;                                            \
        for (; c != 0; c--, dst++)                                      \
                *dst = cpu_to_le##size(__scc_pciex_in##name(bus->phb, p)); \
        scc_pciex_io_flush(bus);                                        \
@@ -231,10 +231,11 @@ static void scc_pciex_outs##name(unsigned long p, const void *b,	\
                                 unsigned long c)                       \
 {                                                                       \
        struct iowa_bus *bus = iowa_pio_find_bus(p);                    \
-        const u##size *src = b;                                         \
+        const __le##size *src = b;                                      \
        for (; c != 0; c--, src++)                                      \
                __scc_pciex_out##name(bus->phb, le##size##_to_cpu(*src), p); \
 }
+#define __le8 u8
 #define cpu_to_le8(x) (x)
 #define le8_to_cpu(x) (x)
 PCIEX_PIO_FUNC(8, b)
diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
index 5b3fb2b321ab..3a58ffabccd9 100644
--- a/arch/powerpc/platforms/ps3/mm.c
+++ b/arch/powerpc/platforms/ps3/mm.c
@@ -317,6 +317,9 @@ static int __init ps3_mm_add_memory(void)
                return result;
        }
+        lmb_add(start_addr, map.r1.size);
+        lmb_analyze();
        result = online_pages(start_pfn, nr_pages);
        if (result)
diff --git a/arch/powerpc/sysdev/fsl_soc.c b/arch/powerpc/sysdev/fsl_soc.c
index 3a7054e2bb75..019657c110b6 100644
--- a/arch/powerpc/sysdev/fsl_soc.c
+++ b/arch/powerpc/sysdev/fsl_soc.c
@@ -432,7 +432,7 @@ static struct i2c_driver_device i2c_devices[] __initdata = {
        {"dallas,ds1339",  "ds1339"},
        {"dallas,ds1340",  "ds1340"},
        {"stm,m41t00",     "m41t00"},
-        {"dallas,ds1374",  "rtc-ds1374"},
+        {"dallas,ds1374",  "ds1374"},
 };
 static int __init of_find_i2c_driver(struct device_node *node,
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 8619f2a3f1f6..7680001676a6 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -1331,6 +1331,9 @@ void mpic_irq_set_priority(unsigned int irq, unsigned int pri)
        unsigned long flags;
        u32 reg;
+        if (!mpic)
+                return;
        spin_lock_irqsave(&mpic_lock, flags);
        if (is_ipi) {
                reg = mpic_ipi_read(src - mpic->ipi_vecs[0]) &
@@ -1346,23 +1349,6 @@ void mpic_irq_set_priority(unsigned int irq, unsigned int pri)
        spin_unlock_irqrestore(&mpic_lock, flags);
 }
-unsigned int mpic_irq_get_priority(unsigned int irq)
-{
-        unsigned int is_ipi;
-        struct mpic *mpic = mpic_find(irq, &is_ipi);
-        unsigned int src = mpic_irq_to_hw(irq);
-        unsigned long flags;
-        u32 reg;
-        spin_lock_irqsave(&mpic_lock, flags);
-        if (is_ipi)
-                reg = mpic_ipi_read(src = mpic->ipi_vecs[0]);
-        else
-                reg = mpic_irq_read(src, MPIC_INFO(IRQ_VECTOR_PRI));
-        spin_unlock_irqrestore(&mpic_lock, flags);
-        return (reg & MPIC_VECPRI_PRIORITY_MASK) >> MPIC_VECPRI_PRIORITY_SHIFT;
-}
 void mpic_setup_this_cpu(void)
 {
 #ifdef CONFIG_SMP
diff --git a/arch/ppc/kernel/ppc_ksyms.c b/arch/ppc/kernel/ppc_ksyms.c
index 602c268fc8a2..5d529bcbeee9 100644
--- a/arch/ppc/kernel/ppc_ksyms.c
+++ b/arch/ppc/kernel/ppc_ksyms.c
@@ -60,8 +60,10 @@ long long __ashrdi3(long long, int);
 long long __ashldi3(long long, int);
 long long __lshrdi3(long long, int);
+EXPORT_SYMBOL(empty_zero_page);
 EXPORT_SYMBOL(clear_pages);
 EXPORT_SYMBOL(clear_user_page);
+EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(transfer_to_handler);
 EXPORT_SYMBOL(do_IRQ);
 EXPORT_SYMBOL(machine_check_exception);
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 1d035082e78e..107e492cb47e 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -304,10 +304,14 @@ config ARCH_SPARSEMEM_ENABLE
        def_bool y
        select SPARSEMEM_VMEMMAP_ENABLE
        select SPARSEMEM_VMEMMAP
+        select SPARSEMEM_STATIC if !64BIT
 config ARCH_SPARSEMEM_DEFAULT
        def_bool y
+config ARCH_SELECT_MEMORY_MODEL
+       def_bool y
 source "mm/Kconfig"
 comment "I/O subsystem configuration"
diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
index 655d52543e2d..ad40729bec3d 100644
--- a/arch/s390/appldata/appldata_base.c
+++ b/arch/s390/appldata/appldata_base.c
@@ -130,6 +130,7 @@ static void appldata_work_fn(struct work_struct *work)
        P_DEBUG("  -= Work Queue =-\n");
        i = 0;
+        get_online_cpus();
        spin_lock(&appldata_ops_lock);
        list_for_each(lh, &appldata_ops_list) {
                ops = list_entry(lh, struct appldata_ops, list);
@@ -140,6 +141,7 @@ static void appldata_work_fn(struct work_struct *work)
                }
        }
        spin_unlock(&appldata_ops_lock);
+        put_online_cpus();
 }
 /*
@@ -266,12 +268,14 @@ appldata_timer_handler(ctl_table *ctl, int write, struct file *filp,
        len = *lenp;
        if (copy_from_user(buf, buffer, len > sizeof(buf) ? sizeof(buf) : len))
                return -EFAULT;
+        get_online_cpus();
        spin_lock(&appldata_timer_lock);
        if (buf[0] == '1')
                __appldata_vtimer_setup(APPLDATA_ADD_TIMER);
        else if (buf[0] == '0')
                __appldata_vtimer_setup(APPLDATA_DEL_TIMER);
        spin_unlock(&appldata_timer_lock);
+        put_online_cpus();
 out:
        *lenp = len;
        *ppos += len;
@@ -314,10 +318,12 @@ appldata_interval_handler(ctl_table *ctl, int write, struct file *filp,
                return -EINVAL;
        }
+        get_online_cpus();
        spin_lock(&appldata_timer_lock);
        appldata_interval = interval;
        __appldata_vtimer_setup(APPLDATA_MOD_TIMER);
        spin_unlock(&appldata_timer_lock);
+        put_online_cpus();
        P_INFO("Monitoring CPU interval set to %u milliseconds.\n",
                 interval);
@@ -556,8 +562,10 @@ static int __init appldata_init(void)
                return -ENOMEM;
        }
+        get_online_cpus();
        for_each_online_cpu(i)
                appldata_online_cpu(i);
+        put_online_cpus();
        /* Register cpu hotplug notifier */
        register_hotcpu_notifier(&appldata_nb);
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index aa341d0ea1e6..c5cdb975d590 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.25
+# Linux kernel version: 2.6.26-rc4
-# Wed Apr 30 11:07:45 2008
+# Fri May 30 09:49:33 2008
 #
 CONFIG_SCHED_MC=y
 CONFIG_MMU=y
@@ -103,6 +103,7 @@ CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 CONFIG_MODVERSIONS=y
@@ -173,6 +174,7 @@ CONFIG_PREEMPT=y
 # CONFIG_PREEMPT_RCU is not set
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_SELECT_MEMORY_MODEL=y
 # CONFIG_FLATMEM_MANUAL is not set
 # CONFIG_DISCONTIGMEM_MANUAL is not set
@@ -210,6 +212,7 @@ CONFIG_FORCE_MAX_ZONEORDER=9
 CONFIG_PFAULT=y
 # CONFIG_SHARED_KERNEL is not set
 # CONFIG_CMM is not set
+# CONFIG_PAGE_STATES is not set
 CONFIG_VIRT_TIMER=y
 CONFIG_VIRT_CPU_ACCOUNTING=y
 # CONFIG_APPLDATA_BASE is not set
@@ -620,6 +623,7 @@ CONFIG_S390_VMUR=m
 #
 # CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
+CONFIG_ACCESSIBILITY=y
 #
 # File systems
@@ -754,11 +758,12 @@ CONFIG_FRAME_WARN=2048
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_FS=y
-CONFIG_HEADERS_CHECK=y
+# CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_OBJECTS is not set
 # CONFIG_DEBUG_SLAB is not set
 CONFIG_DEBUG_PREEMPT=y
 # CONFIG_DEBUG_RT_MUTEXES is not set
diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
index c14a336f6300..d2f270c995d9 100644
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -208,7 +208,7 @@ static const unsigned char formats[][7] = {
        [INSTR_RRF_F0FF]  = { 0xff, F_16,F_24,F_28,0,0,0 },    /* e.g. madbr */
        [INSTR_RRF_FUFF]  = { 0xff, F_24,F_16,F_28,U4_20,0,0 },/* e.g. didbr */
        [INSTR_RRF_RURR]  = { 0xff, R_24,R_28,R_16,U4_20,0,0 },/* e.g. .insn */
-        [INSTR_RRF_R0RR]  = { 0xff, R_24,R_28,R_16,0,0,0 },    /* e.g. idte  */
+        [INSTR_RRF_R0RR]  = { 0xff, R_24,R_16,R_28,0,0,0 },    /* e.g. idte  */
        [INSTR_RRF_U0FF]  = { 0xff, F_24,U4_16,F_28,0,0,0 },   /* e.g. fixr  */
        [INSTR_RRF_U0RF]  = { 0xff, R_24,U4_16,F_28,0,0,0 },   /* e.g. cfebr */
        [INSTR_RRF_M0RR]  = { 0xff, R_24,R_28,M_16,0,0,0 },    /* e.g. sske  */
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 1f4228948dc4..5d4fa4b1c74c 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -711,7 +711,7 @@ int __cpuinit __cpu_up(unsigned int cpu)
        memset(sf, 0, sizeof(struct stack_frame));
        sf->gprs[9] = (unsigned long) sf;
        cpu_lowcore->save_area[15] = (unsigned long) sf;
-        __ctl_store(cpu_lowcore->cregs_save_area[0], 0, 15);
+        __ctl_store(cpu_lowcore->cregs_save_area, 0, 15);
        asm volatile(
                "       stam    0,15,0(%0)"
                : : "a" (&cpu_lowcore->access_regs_save_area) : "memory");
@@ -1089,7 +1089,7 @@ out:
 #ifdef CONFIG_HOTPLUG_CPU
-int smp_rescan_cpus(void)
+int __ref smp_rescan_cpus(void)
 {
        cpumask_t newcpus;
        int cpu;
diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
index f639a152869f..a0775e1f08df 100644
--- a/arch/s390/kvm/diag.c
+++ b/arch/s390/kvm/diag.c
@@ -20,7 +20,7 @@ static int __diag_time_slice_end(struct kvm_vcpu *vcpu)
        VCPU_EVENT(vcpu, 5, "%s", "diag time slice end");
        vcpu->stat.diagnose_44++;
        vcpu_put(vcpu);
-        schedule();
+        yield();
        vcpu_load(vcpu);
        return 0;
 }
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index fcd1ed8015c1..84a7fed4cd4e 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -339,6 +339,11 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
        if (kvm_cpu_has_interrupt(vcpu))
                return 0;
+        __set_cpu_idle(vcpu);
+        spin_lock_bh(&vcpu->arch.local_int.lock);
+        vcpu->arch.local_int.timer_due = 0;
+        spin_unlock_bh(&vcpu->arch.local_int.lock);
        if (psw_interrupts_disabled(vcpu)) {
                VCPU_EVENT(vcpu, 3, "%s", "disabled wait");
                __unset_cpu_idle(vcpu);
@@ -366,8 +371,6 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
 no_timer:
        spin_lock_bh(&vcpu->arch.local_int.float_int->lock);
        spin_lock_bh(&vcpu->arch.local_int.lock);
-        __set_cpu_idle(vcpu);
-        vcpu->arch.local_int.timer_due = 0;
        add_wait_queue(&vcpu->arch.local_int.wq, &wait);
        while (list_empty(&vcpu->arch.local_int.list) &&
                list_empty(&vcpu->arch.local_int.float_int->list) &&
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 0ac36a649eba..6558b09ff579 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -423,6 +423,8 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
        return -EINVAL; /* not implemented yet */
 }
+extern void s390_handle_mcck(void);
 static void __vcpu_run(struct kvm_vcpu *vcpu)
 {
        memcpy(&vcpu->arch.sie_block->gg14, &vcpu->arch.guest_gprs[14], 16);
@@ -430,13 +432,21 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
        if (need_resched())
                schedule();
+        if (test_thread_flag(TIF_MCCK_PENDING))
+                s390_handle_mcck();
+        kvm_s390_deliver_pending_interrupts(vcpu);
        vcpu->arch.sie_block->icptcode = 0;
        local_irq_disable();
        kvm_guest_enter();
        local_irq_enable();
        VCPU_EVENT(vcpu, 6, "entering sie flags %x",
                   atomic_read(&vcpu->arch.sie_block->cpuflags));
-        sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs);
+        if (sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs)) {
+                VCPU_EVENT(vcpu, 3, "%s", "fault in sie instruction");
+                kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+        }
        VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
                   vcpu->arch.sie_block->icptcode);
        local_irq_disable();
@@ -475,7 +485,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
        might_sleep();
        do {
-                kvm_s390_deliver_pending_interrupts(vcpu);
                __vcpu_run(vcpu);
                rc = kvm_handle_sie_intercept(vcpu);
        } while (!signal_pending(current) && !rc);
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 29f3a63806b9..05598649b326 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -44,37 +44,34 @@ char  empty_zero_page[PAGE_SIZE] __attribute__((__aligned__(PAGE_SIZE)));
 void show_mem(void)
 {
-        int i, total = 0, reserved = 0;
+        unsigned long i, total = 0, reserved = 0;
-        int shared = 0, cached = 0;
+        unsigned long shared = 0, cached = 0;
+        unsigned long flags;
        struct page *page;
+        pg_data_t *pgdat;
        printk("Mem-info:\n");
        show_free_areas();
-        i = max_mapnr;
+        for_each_online_pgdat(pgdat) {
-        while (i-- > 0) {
+                pgdat_resize_lock(pgdat, &flags);
-                if (!pfn_valid(i))
+                for (i = 0; i < pgdat->node_spanned_pages; i++) {
-                        continue;
+                        if (!pfn_valid(pgdat->node_start_pfn + i))
-                page = pfn_to_page(i);
+                                continue;
-                total++;
+                        page = pfn_to_page(pgdat->node_start_pfn + i);
-                if (PageReserved(page))
+                        total++;
-                        reserved++;
+                        if (PageReserved(page))
-                else if (PageSwapCache(page))
+                                reserved++;
-                        cached++;
+                        else if (PageSwapCache(page))
-                else if (page_count(page))
+                                cached++;
-                        shared += page_count(page) - 1;
+                        else if (page_count(page))
+                                shared += page_count(page) - 1;
+                }
+                pgdat_resize_unlock(pgdat, &flags);
        }
-        printk("%d pages of RAM\n", total);
+        printk("%ld pages of RAM\n", total);
-        printk("%d reserved pages\n", reserved);
+        printk("%ld reserved pages\n", reserved);
-        printk("%d pages shared\n", shared);
+        printk("%ld pages shared\n", shared);
-        printk("%d pages swap cached\n", cached);
+        printk("%ld pages swap cached\n", cached);
-        printk("%lu pages dirty\n", global_page_state(NR_FILE_DIRTY));
-        printk("%lu pages writeback\n", global_page_state(NR_WRITEBACK));
-        printk("%lu pages mapped\n", global_page_state(NR_FILE_MAPPED));
-        printk("%lu pages slab\n",
-               global_page_state(NR_SLAB_RECLAIMABLE) +
-               global_page_state(NR_SLAB_UNRECLAIMABLE));
-        printk("%lu pages pagetables\n", global_page_state(NR_PAGETABLE));
 }
 /*
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 5c1aea97cd12..3d98ba82ea67 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -254,36 +254,46 @@ void disable_noexec(struct mm_struct *mm, struct task_struct *tsk)
 int s390_enable_sie(void)
 {
        struct task_struct *tsk = current;
-        struct mm_struct *mm;
+        struct mm_struct *mm, *old_mm;
-        int rc;
-        task_lock(tsk);
+        /* Do we have pgstes? if yes, we are done */
-        rc = 0;
        if (tsk->mm->context.pgstes)
-                goto unlock;
+                return 0;
-        rc = -EINVAL;
+        /* lets check if we are allowed to replace the mm */
+        task_lock(tsk);
        if (!tsk->mm || atomic_read(&tsk->mm->mm_users) > 1 ||
-            tsk->mm != tsk->active_mm || tsk->mm->ioctx_list)
+            tsk->mm != tsk->active_mm || tsk->mm->ioctx_list) {
-                goto unlock;
+                task_unlock(tsk);
+                return -EINVAL;
+        }
+        task_unlock(tsk);
-        tsk->mm->context.pgstes = 1;    /* dirty little tricks .. */
+        /* we copy the mm with pgstes enabled */
+        tsk->mm->context.pgstes = 1;
        mm = dup_mm(tsk);
        tsk->mm->context.pgstes = 0;
-        rc = -ENOMEM;
        if (!mm)
-                goto unlock;
+                return -ENOMEM;
-        mmput(tsk->mm);
+        /* Now lets check again if somebody attached ptrace etc */
+        task_lock(tsk);
+        if (!tsk->mm || atomic_read(&tsk->mm->mm_users) > 1 ||
+            tsk->mm != tsk->active_mm || tsk->mm->ioctx_list) {
+                mmput(mm);
+                task_unlock(tsk);
+                return -EINVAL;
+        }
+        /* ok, we are alone. No ptrace, no threads, etc. */
+        old_mm = tsk->mm;
        tsk->mm = tsk->active_mm = mm;
        preempt_disable();
        update_mm(mm, tsk);
        cpu_set(smp_processor_id(), mm->cpu_vm_mask);
        preempt_enable();
-        rc = 0;
-unlock:
        task_unlock(tsk);
-        return rc;
+        mmput(old_mm);
+        return 0;
 }
 EXPORT_SYMBOL_GPL(s390_enable_sie);
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index ea2804808f39..e4868bfc672f 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -27,12 +27,19 @@ struct memory_segment {
 static LIST_HEAD(mem_segs);
-static pud_t *vmem_pud_alloc(void)
+static void __ref *vmem_alloc_pages(unsigned int order)
+{
+        if (slab_is_available())
+                return (void *)__get_free_pages(GFP_KERNEL, order);
+        return alloc_bootmem_pages((1 << order) * PAGE_SIZE);
+}
+static inline pud_t *vmem_pud_alloc(void)
 {
        pud_t *pud = NULL;
 #ifdef CONFIG_64BIT
-        pud = vmemmap_alloc_block(PAGE_SIZE * 4, 0);
+        pud = vmem_alloc_pages(2);
        if (!pud)
                return NULL;
        clear_table((unsigned long *) pud, _REGION3_ENTRY_EMPTY, PAGE_SIZE * 4);
@@ -40,12 +47,12 @@ static pud_t *vmem_pud_alloc(void)
        return pud;
 }
-static pmd_t *vmem_pmd_alloc(void)
+static inline pmd_t *vmem_pmd_alloc(void)
 {
        pmd_t *pmd = NULL;
 #ifdef CONFIG_64BIT
-        pmd = vmemmap_alloc_block(PAGE_SIZE * 4, 0);
+        pmd = vmem_alloc_pages(2);
        if (!pmd)
                return NULL;
        clear_table((unsigned long *) pmd, _SEGMENT_ENTRY_EMPTY, PAGE_SIZE * 4);
@@ -207,13 +214,14 @@ int __meminit vmemmap_populate(struct page *start, unsigned long nr, int node)
                if (pte_none(*pt_dir)) {
                        unsigned long new_page;
-                        new_page =__pa(vmemmap_alloc_block(PAGE_SIZE, 0));
+                        new_page =__pa(vmem_alloc_pages(0));
                        if (!new_page)
                                goto out;
                        pte = pfn_pte(new_page >> PAGE_SHIFT, PAGE_KERNEL);
                        *pt_dir = pte;
                }
        }
+        memset(start, 0, nr * sizeof(struct page));
        ret = 0;
 out:
        flush_tlb_kernel_range(start_addr, end_addr);
@@ -228,7 +236,7 @@ static int insert_memory_segment(struct memory_segment *seg)
 {
        struct memory_segment *tmp;
-        if (seg->start + seg->size >= VMEM_MAX_PHYS ||
+        if (seg->start + seg->size > VMEM_MAX_PHYS ||
            seg->start + seg->size < seg->start)
                return -ERANGE;
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 8a68160079a9..9a854c8e5274 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -281,7 +281,6 @@ config CPU_SUBTYPE_SH7723
        select CPU_SH4A
        select CPU_SHX2
        select ARCH_SPARSEMEM_ENABLE
-        select SYS_SUPPORTS_NUMA
        help
          Select SH7723 if you have an SH-MobileR2 CPU.
diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
index 0d2ef1e9a6fd..0f4549860226 100644
--- a/arch/sh/Kconfig.debug
+++ b/arch/sh/Kconfig.debug
@@ -81,7 +81,7 @@ config DEBUG_STACK_USAGE
 config 4KSTACKS
        bool "Use 4Kb for kernel stacks instead of 8Kb"
-        depends on DEBUG_KERNEL
+        depends on DEBUG_KERNEL && (MMU || BROKEN)
        help
          If you say Y here the kernel will use a 4Kb stacksize for the
          kernel stack attached to each process/thread. This facilitates
diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index 8050b03d51fc..fb7b1b15e392 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -41,6 +41,8 @@ cflags-$(CONFIG_CPU_SH5)		:= $(call cc-option,-m5-32media-nofpu,)
 cflags-$(CONFIG_CPU_BIG_ENDIAN)         += -mb
 cflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += -ml
+cflags-y        += $(call cc-option,-mno-fdpic)
 #
 # -Wa,-isa= tuning implies -Wa,-dsp for the versions of binutils that
 # support it, while -Wa,-dsp by itself limits the range of usable opcodes
diff --git a/arch/sh/boards/renesas/rts7751r2d/setup.c b/arch/sh/boards/renesas/rts7751r2d/setup.c
index 452d0d6459a4..2308e8753bcd 100644
--- a/arch/sh/boards/renesas/rts7751r2d/setup.c
+++ b/arch/sh/boards/renesas/rts7751r2d/setup.c
@@ -11,7 +11,6 @@
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/ata_platform.h>
-#include <linux/serial_8250.h>
 #include <linux/sm501.h>
 #include <linux/sm501-regs.h>
 #include <linux/pm.h>
@@ -109,27 +108,6 @@ static struct platform_device heartbeat_device = {
        .resource       = heartbeat_resources,
 };
-static struct plat_serial8250_port uart_platform_data[] = {
-        {
-                .membase        = (void __iomem *)0xb3e30000,
-                .mapbase        = 0xb3e30000,
-                .iotype         = UPIO_MEM,
-                .irq            = IRQ_VOYAGER,
-                .flags          = UPF_BOOT_AUTOCONF | UPF_SHARE_IRQ,
-                .regshift       = 2,
-                .uartclk        = (9600 * 16),
-        },
-        { 0 },
-};
-static struct platform_device uart_device = {
-        .name           = "serial8250",
-        .id             = PLAT8250_DEV_PLATFORM,
-        .dev            = {
-                .platform_data  = uart_platform_data,
-        },
-};
 static struct resource sm501_resources[] = {
        [0]     = {
                .start  = 0x10000000,
@@ -185,11 +163,7 @@ static struct sm501_platdata_fb sm501_fb_pdata = {
 };
 static struct sm501_initdata sm501_initdata = {
-        .gpio_high      = {
+        .devices        = SM501_USE_USB_HOST | SM501_USE_UART0,
-                .set    = 0x00001fe0,
-                .mask   = 0x0,
-        },
-        .devices        = SM501_USE_USB_HOST,
 };
 static struct sm501_platdata sm501_platform_data = {
@@ -208,7 +182,6 @@ static struct platform_device sm501_device = {
 };
 static struct platform_device *rts7751r2d_devices[] __initdata = {
-        &uart_device,
        &sm501_device,
        &heartbeat_device,
        &spi_sh_sci_device,
@@ -272,16 +245,6 @@ static void __init rts7751r2d_setup(char **cmdline_p)
        sm501_reg = (void __iomem *)0xb3e00000 + SM501_DRAM_CONTROL;
        writel(readl(sm501_reg) | 0x00f107c0, sm501_reg);
-        /*
-         * Power Mode Gate - Enable UART0
-         */
-        sm501_reg = (void __iomem *)0xb3e00000 + SM501_POWER_MODE_0_GATE;
-        writel(readl(sm501_reg) | (1 << SM501_GATE_UART0), sm501_reg);
-        sm501_reg = (void __iomem *)0xb3e00000 + SM501_POWER_MODE_1_GATE;
-        writel(readl(sm501_reg) | (1 << SM501_GATE_UART0), sm501_reg);
 }
 /*
diff --git a/arch/sh/configs/migor_defconfig b/arch/sh/configs/migor_defconfig
index ee5900817f8f..287408b2ace6 100644
--- a/arch/sh/configs/migor_defconfig
+++ b/arch/sh/configs/migor_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.24
+# Linux kernel version: 2.6.26-rc3
-# Wed Feb  6 21:52:20 2008
+# Thu May 22 14:30:07 2008
 #
 CONFIG_SUPERH=y
 CONFIG_SUPERH32=y
@@ -20,6 +20,7 @@ CONFIG_LOCKDEP_SUPPORT=y
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_ARCH_NO_VIRT_TO_BUS=y
+CONFIG_ARCH_SUPPORTS_AOUT=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 #
@@ -36,18 +37,16 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
-# CONFIG_USER_NS is not set
-# CONFIG_PID_NS is not set
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_FAIR_GROUP_SCHED=y
+# CONFIG_GROUP_SCHED is not set
-CONFIG_FAIR_USER_SCHED=y
-# CONFIG_FAIR_CGROUP_SCHED is not set
 CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
+# CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
@@ -61,11 +60,13 @@ CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
 CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_VM_EVENT_COUNTERS=y
@@ -77,11 +78,15 @@ CONFIG_PROFILING=y
 CONFIG_OPROFILE=y
 CONFIG_HAVE_OPROFILE=y
 # CONFIG_HAVE_KPROBES is not set
+# CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_DMA_ATTRS is not set
+CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
 # CONFIG_MODULE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
@@ -105,7 +110,6 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
 CONFIG_CLASSIC_RCU=y
-# CONFIG_PREEMPT_RCU is not set
 #
 # System type
@@ -118,6 +122,7 @@ CONFIG_CPU_SHX2=y
 # CONFIG_CPU_SUBTYPE_SH7203 is not set
 # CONFIG_CPU_SUBTYPE_SH7206 is not set
 # CONFIG_CPU_SUBTYPE_SH7263 is not set
+# CONFIG_CPU_SUBTYPE_MXG is not set
 # CONFIG_CPU_SUBTYPE_SH7705 is not set
 # CONFIG_CPU_SUBTYPE_SH7706 is not set
 # CONFIG_CPU_SUBTYPE_SH7707 is not set
@@ -135,6 +140,7 @@ CONFIG_CPU_SHX2=y
 # CONFIG_CPU_SUBTYPE_SH7751R is not set
 # CONFIG_CPU_SUBTYPE_SH7760 is not set
 # CONFIG_CPU_SUBTYPE_SH4_202 is not set
+# CONFIG_CPU_SUBTYPE_SH7723 is not set
 # CONFIG_CPU_SUBTYPE_SH7763 is not set
 # CONFIG_CPU_SUBTYPE_SH7770 is not set
 # CONFIG_CPU_SUBTYPE_SH7780 is not set
@@ -142,6 +148,7 @@ CONFIG_CPU_SHX2=y
 # CONFIG_CPU_SUBTYPE_SHX3 is not set
 # CONFIG_CPU_SUBTYPE_SH7343 is not set
 CONFIG_CPU_SUBTYPE_SH7722=y
+# CONFIG_CPU_SUBTYPE_SH7366 is not set
 # CONFIG_CPU_SUBTYPE_SH5_101 is not set
 # CONFIG_CPU_SUBTYPE_SH5_103 is not set
@@ -255,7 +262,6 @@ CONFIG_HZ=250
 CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_PREEMPT is not set
-CONFIG_RCU_TRACE=y
 CONFIG_GUSA=y
 #
@@ -323,8 +329,6 @@ CONFIG_TCP_CONG_CUBIC=y
 CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_TCP_MD5SIG is not set
 # CONFIG_IPV6 is not set
-# CONFIG_INET6_XFRM_TUNNEL is not set
-# CONFIG_INET6_TUNNEL is not set
 # CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
 # CONFIG_IP_DCCP is not set
@@ -376,7 +380,90 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=m
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_CONNECTOR is not set
-# CONFIG_MTD is not set
+CONFIG_MTD=y
+# CONFIG_MTD_DEBUG is not set
+CONFIG_MTD_CONCAT=y
+CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_REDBOOT_PARTS is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_AR7_PARTS is not set
+#
+# User Modules And Translation Layers
+#
+CONFIG_MTD_CHAR=y
+CONFIG_MTD_BLKDEVS=y
+CONFIG_MTD_BLOCK=y
+# CONFIG_FTL is not set
+# CONFIG_NFTL is not set
+# CONFIG_INFTL is not set
+# CONFIG_RFD_FTL is not set
+# CONFIG_SSFDC is not set
+# CONFIG_MTD_OOPS is not set
+#
+# RAM/ROM/Flash chip drivers
+#
+CONFIG_MTD_CFI=y
+# CONFIG_MTD_JEDECPROBE is not set
+CONFIG_MTD_GEN_PROBE=y
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+# CONFIG_MTD_CFI_INTELEXT is not set
+CONFIG_MTD_CFI_AMDSTD=y
+# CONFIG_MTD_CFI_STAA is not set
+CONFIG_MTD_CFI_UTIL=y
+# CONFIG_MTD_RAM is not set
+# CONFIG_MTD_ROM is not set
+# CONFIG_MTD_ABSENT is not set
+#
+# Mapping drivers for chip access
+#
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PHYSMAP_START=0xffffffff
+CONFIG_MTD_PHYSMAP_LEN=0
+CONFIG_MTD_PHYSMAP_BANKWIDTH=0
+# CONFIG_MTD_PLATRAM is not set
+#
+# Self-contained MTD device drivers
+#
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_BLOCK2MTD is not set
+#
+# Disk-On-Chip Device Drivers
+#
+# CONFIG_MTD_DOC2000 is not set
+# CONFIG_MTD_DOC2001 is not set
+# CONFIG_MTD_DOC2001PLUS is not set
+CONFIG_MTD_NAND=y
+# CONFIG_MTD_NAND_VERIFY_WRITE is not set
+# CONFIG_MTD_NAND_ECC_SMC is not set
+# CONFIG_MTD_NAND_MUSEUM_IDS is not set
+CONFIG_MTD_NAND_IDS=y
+# CONFIG_MTD_NAND_DISKONCHIP is not set
+# CONFIG_MTD_NAND_NANDSIM is not set
+CONFIG_MTD_NAND_PLATFORM=y
+# CONFIG_MTD_ONENAND is not set
+#
+# UBI - Unsorted block images
+#
+# CONFIG_MTD_UBI is not set
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_COW_COMMON is not set
@@ -385,11 +472,13 @@ CONFIG_BLK_DEV=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
-CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
+# CONFIG_BLK_DEV_XIP is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 #
@@ -461,6 +550,7 @@ CONFIG_SMC91X=y
 #
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
+# CONFIG_IWLWIFI_LEDS is not set
 # CONFIG_WAN is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
@@ -482,13 +572,20 @@ CONFIG_INPUT=y
 #
 # CONFIG_INPUT_MOUSEDEV is not set
 # CONFIG_INPUT_JOYDEV is not set
-# CONFIG_INPUT_EVDEV is not set
+CONFIG_INPUT_EVDEV=y
 # CONFIG_INPUT_EVBUG is not set
 #
 # Input Device Drivers
 #
-# CONFIG_INPUT_KEYBOARD is not set
+CONFIG_INPUT_KEYBOARD=y
+# CONFIG_KEYBOARD_ATKBD is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_LKKBD is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
+CONFIG_KEYBOARD_SH_KEYSC=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_INPUT_JOYSTICK is not set
 # CONFIG_INPUT_TABLET is not set
@@ -508,6 +605,7 @@ CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_DEVKMEM=y
 # CONFIG_SERIAL_NONSTANDARD is not set
 #
@@ -531,16 +629,40 @@ CONFIG_HW_RANDOM=y
 # CONFIG_R3964 is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_TCG_TPM is not set
-# CONFIG_I2C is not set
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
-#
+# CONFIG_I2C_CHARDEV is not set
-# SPI support
-#
+#
+# I2C Hardware Bus support
+#
+# CONFIG_I2C_OCORES is not set
+# CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_SIMTEC is not set
+# CONFIG_I2C_TAOS_EVM is not set
+# CONFIG_I2C_STUB is not set
+# CONFIG_I2C_PCA_PLATFORM is not set
+CONFIG_I2C_SH_MOBILE=y
+#
+# Miscellaneous I2C Chip support
+#
+# CONFIG_DS1682 is not set
+# CONFIG_SENSORS_EEPROM is not set
+# CONFIG_SENSORS_PCF8574 is not set
+# CONFIG_PCF8575 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_SENSORS_TSL2550 is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
 # CONFIG_SPI is not set
-# CONFIG_SPI_MASTER is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
+# CONFIG_THERMAL is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -553,12 +675,22 @@ CONFIG_SSB_POSSIBLE=y
 # Multifunction device drivers
 #
 # CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
 #
 # Multimedia devices
 #
+#
+# Multimedia core support
+#
 # CONFIG_VIDEO_DEV is not set
 # CONFIG_DVB_CORE is not set
+# CONFIG_VIDEO_MEDIA is not set
+#
+# Multimedia drivers
+#
 # CONFIG_DAB is not set
 #
@@ -592,6 +724,8 @@ CONFIG_USB_ARCH_HAS_HCD=y
 # CONFIG_USB_ARCH_HAS_OHCI is not set
 # CONFIG_USB_ARCH_HAS_EHCI is not set
 # CONFIG_USB is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
 #
 # NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
@@ -608,6 +742,7 @@ CONFIG_USB_GADGET_SELECTED=y
 CONFIG_USB_GADGET_M66592=y
 CONFIG_USB_M66592=y
 CONFIG_SUPERH_BUILT_IN_M66592=y
+# CONFIG_USB_GADGET_PXA27X is not set
 # CONFIG_USB_GADGET_GOKU is not set
 # CONFIG_USB_GADGET_LH7A40X is not set
 # CONFIG_USB_GADGET_OMAP is not set
@@ -623,7 +758,9 @@ CONFIG_USB_G_SERIAL=y
 # CONFIG_USB_MIDI_GADGET is not set
 # CONFIG_USB_G_PRINTER is not set
 # CONFIG_MMC is not set
+# CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
+# CONFIG_ACCESSIBILITY is not set
 CONFIG_RTC_LIB=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_HCTOSYS=y
@@ -640,15 +777,31 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_TEST is not set
 #
+# I2C RTC drivers
+#
+# CONFIG_RTC_DRV_DS1307 is not set
+# CONFIG_RTC_DRV_DS1374 is not set
+# CONFIG_RTC_DRV_DS1672 is not set
+# CONFIG_RTC_DRV_MAX6900 is not set
+CONFIG_RTC_DRV_RS5C372=y
+# CONFIG_RTC_DRV_ISL1208 is not set
+# CONFIG_RTC_DRV_X1205 is not set
+# CONFIG_RTC_DRV_PCF8563 is not set
+# CONFIG_RTC_DRV_PCF8583 is not set
+# CONFIG_RTC_DRV_M41T80 is not set
+# CONFIG_RTC_DRV_S35390A is not set
+#
 # SPI RTC drivers
 #
 #
 # Platform RTC drivers
 #
+# CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
-# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
 # CONFIG_RTC_DRV_V3020 is not set
@@ -657,10 +810,6 @@ CONFIG_RTC_INTF_DEV=y
 # on-CPU RTC drivers
 #
 CONFIG_RTC_DRV_SH=y
-#
-# Userspace I/O
-#
 # CONFIG_UIO is not set
 #
@@ -673,13 +822,10 @@ CONFIG_RTC_DRV_SH=y
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
-# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
-# CONFIG_MINIX_FS is not set
+# CONFIG_DNOTIFY is not set
-# CONFIG_ROMFS_FS is not set
 # CONFIG_INOTIFY is not set
 # CONFIG_QUOTA is not set
-# CONFIG_DNOTIFY is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
 # CONFIG_FUSE_FS is not set
@@ -720,10 +866,13 @@ CONFIG_TMPFS=y
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
+# CONFIG_JFFS2_FS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
+# CONFIG_ROMFS_FS is not set
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
 # CONFIG_NETWORK_FILESYSTEMS is not set
@@ -743,6 +892,7 @@ CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=1024
 # CONFIG_MAGIC_SYSRQ is not set
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_FS=y
@@ -763,48 +913,77 @@ CONFIG_EARLY_PRINTK=y
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITY_FILE_CAPABILITIES is not set
 CONFIG_CRYPTO=y
-# CONFIG_CRYPTO_SEQIV is not set
+#
+# Crypto core or helper
+#
 # CONFIG_CRYPTO_MANAGER is not set
+# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+# CONFIG_CRYPTO_AUTHENC is not set
+# CONFIG_CRYPTO_TEST is not set
+#
+# Authenticated Encryption with Associated Data
+#
+# CONFIG_CRYPTO_CCM is not set
+# CONFIG_CRYPTO_GCM is not set
+# CONFIG_CRYPTO_SEQIV is not set
+#
+# Block modes
+#
+# CONFIG_CRYPTO_CBC is not set
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_CTS is not set
+# CONFIG_CRYPTO_ECB is not set
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+#
+# Hash modes
+#
 # CONFIG_CRYPTO_HMAC is not set
 # CONFIG_CRYPTO_XCBC is not set
-# CONFIG_CRYPTO_NULL is not set
+#
+# Digest
+#
+# CONFIG_CRYPTO_CRC32C is not set
 # CONFIG_CRYPTO_MD4 is not set
 # CONFIG_CRYPTO_MD5 is not set
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
 # CONFIG_CRYPTO_SHA1 is not set
 # CONFIG_CRYPTO_SHA256 is not set
 # CONFIG_CRYPTO_SHA512 is not set
-# CONFIG_CRYPTO_WP512 is not set
 # CONFIG_CRYPTO_TGR192 is not set
-# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_WP512 is not set
-# CONFIG_CRYPTO_ECB is not set
-# CONFIG_CRYPTO_CBC is not set
+#
-# CONFIG_CRYPTO_PCBC is not set
+# Ciphers
-# CONFIG_CRYPTO_LRW is not set
+#
-# CONFIG_CRYPTO_XTS is not set
-# CONFIG_CRYPTO_CTR is not set
-# CONFIG_CRYPTO_GCM is not set
-# CONFIG_CRYPTO_CCM is not set
-# CONFIG_CRYPTO_CRYPTD is not set
-# CONFIG_CRYPTO_DES is not set
-# CONFIG_CRYPTO_FCRYPT is not set
-# CONFIG_CRYPTO_BLOWFISH is not set
-# CONFIG_CRYPTO_TWOFISH is not set
-# CONFIG_CRYPTO_SERPENT is not set
 # CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
-# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_DES is not set
-# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_FCRYPT is not set
 # CONFIG_CRYPTO_KHAZAD is not set
-# CONFIG_CRYPTO_ANUBIS is not set
-# CONFIG_CRYPTO_SEED is not set
 # CONFIG_CRYPTO_SALSA20 is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+#
+# Compression
+#
 # CONFIG_CRYPTO_DEFLATE is not set
-# CONFIG_CRYPTO_MICHAEL_MIC is not set
-# CONFIG_CRYPTO_CRC32C is not set
-# CONFIG_CRYPTO_CAMELLIA is not set
-# CONFIG_CRYPTO_TEST is not set
-# CONFIG_CRYPTO_AUTHENC is not set
 # CONFIG_CRYPTO_LZO is not set
 CONFIG_CRYPTO_HW=y
@@ -812,6 +991,7 @@ CONFIG_CRYPTO_HW=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+# CONFIG_GENERIC_FIND_FIRST_BIT is not set
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 # CONFIG_CRC_ITU_T is not set
diff --git a/arch/sh/configs/rsk7203_defconfig b/arch/sh/configs/rsk7203_defconfig
new file mode 100644
index 000000000000..a0ebd439cbd2
--- /dev/null
+++ b/arch/sh/configs/rsk7203_defconfig
@@ -0,0 +1,841 @@
+#
+# Automatically generated make config: don't edit
+# Linux kernel version: 2.6.26-rc4
+# Tue Jun  3 13:02:42 2008
+#
+CONFIG_SUPERH=y
+CONFIG_SUPERH32=y
+CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_FIND_NEXT_BIT=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+# CONFIG_GENERIC_TIME is not set
+# CONFIG_GENERIC_CLOCKEVENTS is not set
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_LOCKDEP_SUPPORT=y
+# CONFIG_ARCH_HAS_ILOG2_U32 is not set
+# CONFIG_ARCH_HAS_ILOG2_U64 is not set
+CONFIG_ARCH_NO_VIRT_TO_BUS=y
+CONFIG_ARCH_SUPPORTS_AOUT=y
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+#
+# General setup
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_BROKEN_ON_SMP=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+CONFIG_POSIX_MQUEUE=y
+# CONFIG_BSD_PROCESS_ACCT is not set
+# CONFIG_TASKSTATS is not set
+# CONFIG_AUDIT is not set
+# CONFIG_IKCONFIG is not set
+CONFIG_LOG_BUF_SHIFT=14
+# CONFIG_CGROUPS is not set
+CONFIG_GROUP_SCHED=y
+CONFIG_FAIR_GROUP_SCHED=y
+# CONFIG_RT_GROUP_SCHED is not set
+CONFIG_USER_SCHED=y
+# CONFIG_CGROUP_SCHED is not set
+CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_RELAY is not set
+# CONFIG_NAMESPACES is not set
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_SYSCTL=y
+CONFIG_EMBEDDED=y
+CONFIG_UID16=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_ELF_CORE=y
+CONFIG_COMPAT_BRK=y
+CONFIG_BASE_FULL=y
+CONFIG_FUTEX=y
+CONFIG_ANON_INODES=y
+CONFIG_EPOLL=y
+CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
+CONFIG_EVENTFD=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_SLAB=y
+# CONFIG_SLUB is not set
+# CONFIG_SLOB is not set
+CONFIG_PROFILING=y
+# CONFIG_MARKERS is not set
+CONFIG_OPROFILE=y
+CONFIG_HAVE_OPROFILE=y
+# CONFIG_HAVE_KPROBES is not set
+# CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_DMA_ATTRS is not set
+CONFIG_SLABINFO=y
+CONFIG_RT_MUTEXES=y
+CONFIG_TINY_SHMEM=y
+CONFIG_BASE_SMALL=0
+# CONFIG_MODULES is not set
+CONFIG_BLOCK=y
+# CONFIG_LBD is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_LSF is not set
+# CONFIG_BLK_DEV_BSG is not set
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+# CONFIG_IOSCHED_AS is not set
+# CONFIG_IOSCHED_DEADLINE is not set
+# CONFIG_IOSCHED_CFQ is not set
+# CONFIG_DEFAULT_AS is not set
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+CONFIG_DEFAULT_NOOP=y
+CONFIG_DEFAULT_IOSCHED="noop"
+CONFIG_CLASSIC_RCU=y
+#
+# System type
+#
+CONFIG_CPU_SH2=y
+CONFIG_CPU_SH2A=y
+# CONFIG_CPU_SUBTYPE_SH7619 is not set
+CONFIG_CPU_SUBTYPE_SH7203=y
+# CONFIG_CPU_SUBTYPE_SH7206 is not set
+# CONFIG_CPU_SUBTYPE_SH7263 is not set
+# CONFIG_CPU_SUBTYPE_MXG is not set
+# CONFIG_CPU_SUBTYPE_SH7705 is not set
+# CONFIG_CPU_SUBTYPE_SH7706 is not set
+# CONFIG_CPU_SUBTYPE_SH7707 is not set
+# CONFIG_CPU_SUBTYPE_SH7708 is not set
+# CONFIG_CPU_SUBTYPE_SH7709 is not set
+# CONFIG_CPU_SUBTYPE_SH7710 is not set
+# CONFIG_CPU_SUBTYPE_SH7712 is not set
+# CONFIG_CPU_SUBTYPE_SH7720 is not set
+# CONFIG_CPU_SUBTYPE_SH7721 is not set
+# CONFIG_CPU_SUBTYPE_SH7750 is not set
+# CONFIG_CPU_SUBTYPE_SH7091 is not set
+# CONFIG_CPU_SUBTYPE_SH7750R is not set
+# CONFIG_CPU_SUBTYPE_SH7750S is not set
+# CONFIG_CPU_SUBTYPE_SH7751 is not set
+# CONFIG_CPU_SUBTYPE_SH7751R is not set
+# CONFIG_CPU_SUBTYPE_SH7760 is not set
+# CONFIG_CPU_SUBTYPE_SH4_202 is not set
+# CONFIG_CPU_SUBTYPE_SH7723 is not set
+# CONFIG_CPU_SUBTYPE_SH7763 is not set
+# CONFIG_CPU_SUBTYPE_SH7770 is not set
+# CONFIG_CPU_SUBTYPE_SH7780 is not set
+# CONFIG_CPU_SUBTYPE_SH7785 is not set
+# CONFIG_CPU_SUBTYPE_SHX3 is not set
+# CONFIG_CPU_SUBTYPE_SH7343 is not set
+# CONFIG_CPU_SUBTYPE_SH7722 is not set
+# CONFIG_CPU_SUBTYPE_SH7366 is not set
+# CONFIG_CPU_SUBTYPE_SH5_101 is not set
+# CONFIG_CPU_SUBTYPE_SH5_103 is not set
+#
+# Memory management options
+#
+CONFIG_QUICKLIST=y
+CONFIG_PAGE_OFFSET=0x00000000
+CONFIG_MEMORY_START=0x0c000000
+CONFIG_MEMORY_SIZE=0x01000000
+CONFIG_29BIT=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_MAX_ACTIVE_REGIONS=1
+CONFIG_ARCH_POPULATES_NODE_MAP=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_PAGE_SIZE_4KB=y
+# CONFIG_PAGE_SIZE_8KB is not set
+# CONFIG_PAGE_SIZE_64KB is not set
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+CONFIG_SPARSEMEM_STATIC=y
+# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
+CONFIG_SPLIT_PTLOCK_CPUS=4
+# CONFIG_RESOURCES_64BIT is not set
+CONFIG_ZONE_DMA_FLAG=0
+CONFIG_NR_QUICK=2
+#
+# Cache configuration
+#
+# CONFIG_SH_DIRECT_MAPPED is not set
+CONFIG_CACHE_WRITEBACK=y
+# CONFIG_CACHE_WRITETHROUGH is not set
+# CONFIG_CACHE_OFF is not set
+#
+# Processor features
+#
+# CONFIG_CPU_LITTLE_ENDIAN is not set
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_SH_FPU=y
+CONFIG_CPU_HAS_FPU=y
+#
+# Board support
+#
+#
+# Timer and clock configuration
+#
+CONFIG_SH_CMT=y
+# CONFIG_SH_MTU2 is not set
+CONFIG_SH_TIMER_IRQ=142
+CONFIG_SH_PCLK_FREQ=16670800
+CONFIG_SH_CLK_MD=0
+# CONFIG_TICK_ONESHOT is not set
+#
+# CPU Frequency scaling
+#
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_TABLE=y
+# CONFIG_CPU_FREQ_DEBUG is not set
+CONFIG_CPU_FREQ_STAT=y
+# CONFIG_CPU_FREQ_STAT_DETAILS is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_GOV_USERSPACE is not set
+# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_SH_CPU_FREQ=y
+#
+# DMA support
+#
+#
+# Companion Chips
+#
+#
+# Additional SuperH Device Drivers
+#
+CONFIG_HEARTBEAT=y
+# CONFIG_PUSH_SWITCH is not set
+#
+# Kernel features
+#
+# CONFIG_HZ_100 is not set
+# CONFIG_HZ_250 is not set
+# CONFIG_HZ_300 is not set
+CONFIG_HZ_1000=y
+CONFIG_HZ=1000
+# CONFIG_SCHED_HRTICK is not set
+# CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT is not set
+CONFIG_GUSA=y
+#
+# Boot options
+#
+CONFIG_ZERO_PAGE_OFFSET=0x00001000
+CONFIG_BOOT_LINK_OFFSET=0x00800000
+CONFIG_CMDLINE_BOOL=y
+CONFIG_CMDLINE="console=ttySC0,115200 earlyprintk=serial ignore_loglevel"
+#
+# Bus options
+#
+# CONFIG_ARCH_SUPPORTS_MSI is not set
+# CONFIG_PCCARD is not set
+#
+# Executable file formats
+#
+CONFIG_BINFMT_FLAT=y
+CONFIG_BINFMT_ZFLAT=y
+CONFIG_BINFMT_SHARED_FLAT=y
+# CONFIG_BINFMT_MISC is not set
+#
+# Networking
+#
+CONFIG_NET=y
+#
+# Networking options
+#
+# CONFIG_PACKET is not set
+# CONFIG_UNIX is not set
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+# CONFIG_IP_MULTICAST is not set
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+# CONFIG_IP_PNP_BOOTP is not set
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_ARPD is not set
+# CONFIG_SYN_COOKIES is not set
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
+# CONFIG_INET_TUNNEL is not set
+# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
+# CONFIG_INET_XFRM_MODE_TUNNEL is not set
+# CONFIG_INET_XFRM_MODE_BEET is not set
+# CONFIG_INET_LRO is not set
+# CONFIG_INET_DIAG is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
+# CONFIG_IPV6 is not set
+# CONFIG_NETWORK_SECMARK is not set
+# CONFIG_NETFILTER is not set
+# CONFIG_IP_DCCP is not set
+# CONFIG_IP_SCTP is not set
+# CONFIG_TIPC is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_NET_SCHED is not set
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+# CONFIG_AF_RXRPC is not set
+#
+# Wireless
+#
+# CONFIG_CFG80211 is not set
+# CONFIG_WIRELESS_EXT is not set
+# CONFIG_MAC80211 is not set
+# CONFIG_IEEE80211 is not set
+# CONFIG_RFKILL is not set
+# CONFIG_NET_9P is not set
+#
+# Device Drivers
+#
+#
+# Generic Driver Options
+#
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_STANDALONE is not set
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+# CONFIG_FW_LOADER is not set
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_SYS_HYPERVISOR is not set
+# CONFIG_CONNECTOR is not set
+CONFIG_MTD=y
+# CONFIG_MTD_DEBUG is not set
+CONFIG_MTD_CONCAT=y
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_REDBOOT_PARTS=y
+CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
+# CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED is not set
+# CONFIG_MTD_REDBOOT_PARTS_READONLY is not set
+# CONFIG_MTD_CMDLINE_PARTS is not set
+# CONFIG_MTD_AR7_PARTS is not set
+#
+# User Modules And Translation Layers
+#
+CONFIG_MTD_CHAR=y
+CONFIG_MTD_BLKDEVS=y
+CONFIG_MTD_BLOCK=y
+# CONFIG_FTL is not set
+# CONFIG_NFTL is not set
+# CONFIG_INFTL is not set
+# CONFIG_RFD_FTL is not set
+# CONFIG_SSFDC is not set
+# CONFIG_MTD_OOPS is not set
+#
+# RAM/ROM/Flash chip drivers
+#
+CONFIG_MTD_CFI=y
+# CONFIG_MTD_JEDECPROBE is not set
+CONFIG_MTD_GEN_PROBE=y
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+# CONFIG_MTD_CFI_INTELEXT is not set
+CONFIG_MTD_CFI_AMDSTD=y
+# CONFIG_MTD_CFI_STAA is not set
+CONFIG_MTD_CFI_UTIL=y
+# CONFIG_MTD_RAM is not set
+# CONFIG_MTD_ROM is not set
+# CONFIG_MTD_ABSENT is not set
+#
+# Mapping drivers for chip access
+#
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PHYSMAP_START=0x20000000
+CONFIG_MTD_PHYSMAP_LEN=0x01000000
+CONFIG_MTD_PHYSMAP_BANKWIDTH=4
+# CONFIG_MTD_UCLINUX is not set
+# CONFIG_MTD_PLATRAM is not set
+#
+# Self-contained MTD device drivers
+#
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_BLOCK2MTD is not set
+#
+# Disk-On-Chip Device Drivers
+#
+# CONFIG_MTD_DOC2000 is not set
+# CONFIG_MTD_DOC2001 is not set
+# CONFIG_MTD_DOC2001PLUS is not set
+# CONFIG_MTD_NAND is not set
+# CONFIG_MTD_ONENAND is not set
+#
+# UBI - Unsorted block images
+#
+# CONFIG_MTD_UBI is not set
+# CONFIG_PARPORT is not set
+CONFIG_BLK_DEV=y
+# CONFIG_BLK_DEV_COW_COMMON is not set
+# CONFIG_BLK_DEV_LOOP is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_RAM is not set
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
+CONFIG_MISC_DEVICES=y
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+CONFIG_HAVE_IDE=y
+# CONFIG_IDE is not set
+#
+# SCSI device support
+#
+# CONFIG_RAID_ATTRS is not set
+# CONFIG_SCSI is not set
+# CONFIG_SCSI_DMA is not set
+# CONFIG_SCSI_NETLINK is not set
+# CONFIG_ATA is not set
+# CONFIG_MD is not set
+CONFIG_NETDEVICES=y
+# CONFIG_NETDEVICES_MULTIQUEUE is not set
+# CONFIG_DUMMY is not set
+# CONFIG_BONDING is not set
+# CONFIG_MACVLAN is not set
+# CONFIG_EQUALIZER is not set
+# CONFIG_TUN is not set
+# CONFIG_VETH is not set
+# CONFIG_PHYLIB is not set
+CONFIG_NET_ETHERNET=y
+CONFIG_MII=y
+# CONFIG_AX88796 is not set
+# CONFIG_STNIC is not set
+CONFIG_SMC91X=y
+# CONFIG_IBM_NEW_EMAC_ZMII is not set
+# CONFIG_IBM_NEW_EMAC_RGMII is not set
+# CONFIG_IBM_NEW_EMAC_TAH is not set
+# CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_B44 is not set
+CONFIG_NETDEV_1000=y
+# CONFIG_E1000E_ENABLED is not set
+CONFIG_NETDEV_10000=y
+#
+# Wireless LAN
+#
+# CONFIG_WLAN_PRE80211 is not set
+# CONFIG_WLAN_80211 is not set
+# CONFIG_IWLWIFI_LEDS is not set
+# CONFIG_WAN is not set
+# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
+# CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+# CONFIG_ISDN is not set
+# CONFIG_PHONE is not set
+#
+# Input device support
+#
+CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
+# CONFIG_INPUT_POLLDEV is not set
+#
+# Userland interfaces
+#
+# CONFIG_INPUT_MOUSEDEV is not set
+# CONFIG_INPUT_JOYDEV is not set
+# CONFIG_INPUT_EVDEV is not set
+# CONFIG_INPUT_EVBUG is not set
+#
+# Input Device Drivers
+#
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TABLET is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_MISC is not set
+#
+# Hardware I/O ports
+#
+# CONFIG_SERIO is not set
+# CONFIG_GAMEPORT is not set
+#
+# Character devices
+#
+# CONFIG_VT is not set
+CONFIG_DEVKMEM=y
+# CONFIG_SERIAL_NONSTANDARD is not set
+#
+# Serial drivers
+#
+# CONFIG_SERIAL_8250 is not set
+#
+# Non-8250 serial port support
+#
+CONFIG_SERIAL_SH_SCI=y
+CONFIG_SERIAL_SH_SCI_NR_UARTS=4
+CONFIG_SERIAL_SH_SCI_CONSOLE=y
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_UNIX98_PTYS is not set
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_IPMI_HANDLER is not set
+# CONFIG_HW_RANDOM is not set
+# CONFIG_R3964 is not set
+# CONFIG_RAW_DRIVER is not set
+# CONFIG_TCG_TPM is not set
+# CONFIG_I2C is not set
+# CONFIG_SPI is not set
+# CONFIG_W1 is not set
+# CONFIG_POWER_SUPPLY is not set
+# CONFIG_HWMON is not set
+CONFIG_THERMAL=y
+# CONFIG_WATCHDOG is not set
+#
+# Sonics Silicon Backplane
+#
+CONFIG_SSB_POSSIBLE=y
+# CONFIG_SSB is not set
+#
+# Multifunction device drivers
+#
+# CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
+#
+# Multimedia devices
+#
+#
+# Multimedia core support
+#
+# CONFIG_VIDEO_DEV is not set
+# CONFIG_DVB_CORE is not set
+# CONFIG_VIDEO_MEDIA is not set
+#
+# Multimedia drivers
+#
+CONFIG_DAB=y
+#
+# Graphics support
+#
+# CONFIG_VGASTATE is not set
+CONFIG_VIDEO_OUTPUT_CONTROL=y
+# CONFIG_FB is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
+#
+# Display device support
+#
+# CONFIG_DISPLAY_SUPPORT is not set
+#
+# Sound
+#
+# CONFIG_SOUND is not set
+CONFIG_HID_SUPPORT=y
+CONFIG_HID=y
+# CONFIG_HID_DEBUG is not set
+# CONFIG_HIDRAW is not set
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_ARCH_HAS_HCD=y
+# CONFIG_USB_ARCH_HAS_OHCI is not set
+# CONFIG_USB_ARCH_HAS_EHCI is not set
+# CONFIG_USB is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
+#
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+# CONFIG_USB_GADGET is not set
+# CONFIG_MMC is not set
+# CONFIG_MEMSTICK is not set
+# CONFIG_NEW_LEDS is not set
+# CONFIG_ACCESSIBILITY is not set
+CONFIG_RTC_LIB=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+# CONFIG_RTC_DEBUG is not set
+#
+# RTC interfaces
+#
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_DEV=y
+# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
+# CONFIG_RTC_DRV_TEST is not set
+#
+# SPI RTC drivers
+#
+#
+# Platform RTC drivers
+#
+# CONFIG_RTC_DRV_DS1511 is not set
+# CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
+# CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_V3020 is not set
+#
+# on-CPU RTC drivers
+#
+CONFIG_RTC_DRV_SH=y
+# CONFIG_UIO is not set
+#
+# File systems
+#
+# CONFIG_EXT2_FS is not set
+# CONFIG_EXT3_FS is not set
+# CONFIG_EXT4DEV_FS is not set
+# CONFIG_REISERFS_FS is not set
+# CONFIG_JFS_FS is not set
+# CONFIG_FS_POSIX_ACL is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
+# CONFIG_DNOTIFY is not set
+# CONFIG_INOTIFY is not set
+# CONFIG_QUOTA is not set
+# CONFIG_AUTOFS_FS is not set
+# CONFIG_AUTOFS4_FS is not set
+# CONFIG_FUSE_FS is not set
+#
+# CD-ROM/DVD Filesystems
+#
+# CONFIG_ISO9660_FS is not set
+# CONFIG_UDF_FS is not set
+#
+# DOS/FAT/NT Filesystems
+#
+# CONFIG_MSDOS_FS is not set
+# CONFIG_VFAT_FS is not set
+# CONFIG_NTFS_FS is not set
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+CONFIG_PROC_SYSCTL=y
+CONFIG_SYSFS=y
+# CONFIG_TMPFS is not set
+# CONFIG_HUGETLB_PAGE is not set
+# CONFIG_CONFIGFS_FS is not set
+#
+# Miscellaneous filesystems
+#
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_JFFS2_FS is not set
+# CONFIG_CRAMFS is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+CONFIG_ROMFS_FS=y
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+CONFIG_NETWORK_FILESYSTEMS=y
+CONFIG_NFS_FS=y
+# CONFIG_NFS_V3 is not set
+# CONFIG_NFS_V4 is not set
+# CONFIG_NFSD is not set
+CONFIG_ROOT_NFS=y
+CONFIG_LOCKD=y
+CONFIG_NFS_COMMON=y
+CONFIG_SUNRPC=y
+# CONFIG_SUNRPC_BIND34 is not set
+# CONFIG_RPCSEC_GSS_KRB5 is not set
+# CONFIG_RPCSEC_GSS_SPKM3 is not set
+# CONFIG_SMB_FS is not set
+# CONFIG_CIFS is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_AFS_FS is not set
+#
+# Partition Types
+#
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_MSDOS_PARTITION=y
+# CONFIG_NLS is not set
+# CONFIG_DLM is not set
+#
+# Kernel hacking
+#
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+# CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_WARN_DEPRECATED=y
+# CONFIG_ENABLE_MUST_CHECK is not set
+CONFIG_FRAME_WARN=1024
+CONFIG_MAGIC_SYSRQ=y
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_DEBUG_FS is not set
+# CONFIG_HEADERS_CHECK is not set
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_SHIRQ=y
+CONFIG_DETECT_SOFTLOCKUP=y
+CONFIG_SCHED_DEBUG=y
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+CONFIG_DEBUG_MUTEXES=y
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_LOCK_STAT is not set
+CONFIG_DEBUG_SPINLOCK_SLEEP=y
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_KOBJECT is not set
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_SG is not set
+CONFIG_FRAME_POINTER=y
+# CONFIG_BOOT_PRINTK_DELAY is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_SAMPLES is not set
+# CONFIG_SH_STANDARD_BIOS is not set
+CONFIG_EARLY_SCIF_CONSOLE=y
+CONFIG_EARLY_SCIF_CONSOLE_PORT=0xfffe8000
+CONFIG_EARLY_PRINTK=y
+CONFIG_DEBUG_BOOTMEM=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+CONFIG_DEBUG_STACK_USAGE=y
+# CONFIG_IRQSTACKS is not set
+#
+# Security options
+#
+# CONFIG_KEYS is not set
+# CONFIG_SECURITY is not set
+# CONFIG_SECURITY_FILE_CAPABILITIES is not set
+# CONFIG_CRYPTO is not set
+#
+# Library routines
+#
+CONFIG_BITREVERSE=y
+# CONFIG_GENERIC_FIND_FIRST_BIT is not set
+# CONFIG_CRC_CCITT is not set
+# CONFIG_CRC16 is not set
+# CONFIG_CRC_ITU_T is not set
+CONFIG_CRC32=y
+# CONFIG_CRC7 is not set
+# CONFIG_LIBCRC32C is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_PLIST=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAS_DMA=y
diff --git a/arch/sh/configs/se7206_defconfig b/arch/sh/configs/se7206_defconfig
index 0d0cda908270..6b34baa26eae 100644
--- a/arch/sh/configs/se7206_defconfig
+++ b/arch/sh/configs/se7206_defconfig
@@ -1,9 +1,10 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.23-rc4
+# Linux kernel version: 2.6.26-rc4
-# Thu Sep 13 16:40:16 2007
+# Tue Jun  3 20:27:08 2008
 #
 CONFIG_SUPERH=y
+CONFIG_SUPERH32=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
@@ -18,6 +19,7 @@ CONFIG_LOCKDEP_SUPPORT=y
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_ARCH_NO_VIRT_TO_BUS=y
+CONFIG_ARCH_SUPPORTS_AOUT=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 #
@@ -25,47 +27,82 @@ CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 #
 CONFIG_EXPERIMENTAL=y
 CONFIG_BROKEN_ON_SMP=y
+CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 CONFIG_LOCALVERSION=""
-# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_LOCALVERSION_AUTO=y
-# CONFIG_SYSVIPC is not set
+CONFIG_SYSVIPC=y
-# CONFIG_POSIX_MQUEUE is not set
+CONFIG_SYSVIPC_SYSCTL=y
-# CONFIG_BSD_PROCESS_ACCT is not set
+CONFIG_POSIX_MQUEUE=y
+CONFIG_BSD_PROCESS_ACCT=y
+# CONFIG_BSD_PROCESS_ACCT_V3 is not set
 # CONFIG_TASKSTATS is not set
-# CONFIG_USER_NS is not set
+CONFIG_AUDIT=y
-# CONFIG_AUDIT is not set
+CONFIG_AUDITSYSCALL=y
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED=y
+CONFIG_CGROUPS=y
-# CONFIG_RELAY is not set
+CONFIG_CGROUP_DEBUG=y
-# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_CGROUP_NS=y
+CONFIG_CGROUP_DEVICE=y
+# CONFIG_GROUP_SCHED is not set
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_RESOURCE_COUNTERS=y
+CONFIG_MM_OWNER=y
+CONFIG_CGROUP_MEM_RES_CTLR=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
+CONFIG_RELAY=y
+CONFIG_NAMESPACES=y
+CONFIG_UTS_NS=y
+CONFIG_IPC_NS=y
+CONFIG_USER_NS=y
+CONFIG_PID_NS=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
 CONFIG_EMBEDDED=y
 # CONFIG_UID16 is not set
 # CONFIG_SYSCTL_SYSCALL is not set
-# CONFIG_KALLSYMS is not set
+CONFIG_KALLSYMS=y
-# CONFIG_HOTPLUG is not set
+CONFIG_KALLSYMS_ALL=y
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 # CONFIG_ELF_CORE is not set
-# CONFIG_BASE_FULL is not set
+# CONFIG_COMPAT_BRK is not set
-# CONFIG_FUTEX is not set
+CONFIG_BASE_FULL=y
+CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
-# CONFIG_EPOLL is not set
+CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
-# CONFIG_VM_EVENT_COUNTERS is not set
+CONFIG_VM_EVENT_COUNTERS=y
-CONFIG_SLUB_DEBUG=y
 # CONFIG_SLAB is not set
-CONFIG_SLUB=y
+# CONFIG_SLUB is not set
-# CONFIG_SLOB is not set
+CONFIG_SLOB=y
+CONFIG_PROFILING=y
+# CONFIG_MARKERS is not set
+CONFIG_OPROFILE=y
+CONFIG_HAVE_OPROFILE=y
+# CONFIG_HAVE_KPROBES is not set
+# CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_DMA_ATTRS is not set
+CONFIG_RT_MUTEXES=y
 CONFIG_TINY_SHMEM=y
-CONFIG_BASE_SMALL=1
+CONFIG_BASE_SMALL=0
-# CONFIG_MODULES is not set
+CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+# CONFIG_MODVERSIONS is not set
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+# CONFIG_KMOD is not set
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 # CONFIG_BLK_DEV_BSG is not set
@@ -81,6 +118,7 @@ CONFIG_IOSCHED_NOOP=y
 # CONFIG_DEFAULT_CFQ is not set
 CONFIG_DEFAULT_NOOP=y
 CONFIG_DEFAULT_IOSCHED="noop"
+# CONFIG_CLASSIC_RCU is not set
 #
 # System type
@@ -88,7 +126,10 @@ CONFIG_DEFAULT_IOSCHED="noop"
 CONFIG_CPU_SH2=y
 CONFIG_CPU_SH2A=y
 # CONFIG_CPU_SUBTYPE_SH7619 is not set
+# CONFIG_CPU_SUBTYPE_SH7203 is not set
 CONFIG_CPU_SUBTYPE_SH7206=y
+# CONFIG_CPU_SUBTYPE_SH7263 is not set
+# CONFIG_CPU_SUBTYPE_MXG is not set
 # CONFIG_CPU_SUBTYPE_SH7705 is not set
 # CONFIG_CPU_SUBTYPE_SH7706 is not set
 # CONFIG_CPU_SUBTYPE_SH7707 is not set
@@ -97,6 +138,7 @@ CONFIG_CPU_SUBTYPE_SH7206=y
 # CONFIG_CPU_SUBTYPE_SH7710 is not set
 # CONFIG_CPU_SUBTYPE_SH7712 is not set
 # CONFIG_CPU_SUBTYPE_SH7720 is not set
+# CONFIG_CPU_SUBTYPE_SH7721 is not set
 # CONFIG_CPU_SUBTYPE_SH7750 is not set
 # CONFIG_CPU_SUBTYPE_SH7091 is not set
 # CONFIG_CPU_SUBTYPE_SH7750R is not set
@@ -105,14 +147,17 @@ CONFIG_CPU_SUBTYPE_SH7206=y
 # CONFIG_CPU_SUBTYPE_SH7751R is not set
 # CONFIG_CPU_SUBTYPE_SH7760 is not set
 # CONFIG_CPU_SUBTYPE_SH4_202 is not set
-# CONFIG_CPU_SUBTYPE_ST40STB1 is not set
+# CONFIG_CPU_SUBTYPE_SH7723 is not set
-# CONFIG_CPU_SUBTYPE_ST40GX1 is not set
+# CONFIG_CPU_SUBTYPE_SH7763 is not set
 # CONFIG_CPU_SUBTYPE_SH7770 is not set
 # CONFIG_CPU_SUBTYPE_SH7780 is not set
 # CONFIG_CPU_SUBTYPE_SH7785 is not set
 # CONFIG_CPU_SUBTYPE_SHX3 is not set
 # CONFIG_CPU_SUBTYPE_SH7343 is not set
 # CONFIG_CPU_SUBTYPE_SH7722 is not set
+# CONFIG_CPU_SUBTYPE_SH7366 is not set
+# CONFIG_CPU_SUBTYPE_SH5_101 is not set
+# CONFIG_CPU_SUBTYPE_SH5_103 is not set
 #
 # Memory management options
@@ -121,23 +166,25 @@ CONFIG_QUICKLIST=y
 CONFIG_PAGE_OFFSET=0x00000000
 CONFIG_MEMORY_START=0x0c000000
 CONFIG_MEMORY_SIZE=0x04000000
+CONFIG_29BIT=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_DEFAULT=y
 CONFIG_MAX_ACTIVE_REGIONS=1
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
-CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_PAGE_SIZE_4KB=y
 # CONFIG_PAGE_SIZE_8KB is not set
 # CONFIG_PAGE_SIZE_64KB is not set
 CONFIG_SELECT_MEMORY_MODEL=y
-# CONFIG_FLATMEM_MANUAL is not set
+CONFIG_FLATMEM_MANUAL=y
 # CONFIG_DISCONTIGMEM_MANUAL is not set
-CONFIG_SPARSEMEM_MANUAL=y
+# CONFIG_SPARSEMEM_MANUAL is not set
-CONFIG_SPARSEMEM=y
+CONFIG_FLATMEM=y
-CONFIG_HAVE_MEMORY_PRESENT=y
+CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_SPARSEMEM_STATIC=y
+# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_RESOURCES_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
@@ -183,13 +230,16 @@ CONFIG_CPU_FREQ_TABLE=y
 CONFIG_CPU_FREQ_STAT=y
 # CONFIG_CPU_FREQ_STAT_DETAILS is not set
 CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
 # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
 CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
 # CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
 # CONFIG_CPU_FREQ_GOV_USERSPACE is not set
 # CONFIG_CPU_FREQ_GOV_ONDEMAND is not set
 # CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
-# CONFIG_SH_CPU_FREQ is not set
+CONFIG_SH_CPU_FREQ=y
 #
 # DMA support
@@ -213,11 +263,15 @@ CONFIG_HEARTBEAT=y
 # CONFIG_HZ_300 is not set
 CONFIG_HZ_1000=y
 CONFIG_HZ=1000
-# CONFIG_KEXEC is not set
+# CONFIG_SCHED_HRTICK is not set
+CONFIG_KEXEC=y
 # CONFIG_CRASH_DUMP is not set
-CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_NONE is not set
 # CONFIG_PREEMPT_VOLUNTARY is not set
-# CONFIG_PREEMPT is not set
+CONFIG_PREEMPT=y
+CONFIG_PREEMPT_RCU=y
+CONFIG_RCU_TRACE=y
+CONFIG_GUSA=y
 #
 # Boot options
@@ -225,25 +279,25 @@ CONFIG_PREEMPT_NONE=y
 CONFIG_ZERO_PAGE_OFFSET=0x00001000
 CONFIG_BOOT_LINK_OFFSET=0x00800000
 CONFIG_CMDLINE_BOOL=y
-CONFIG_CMDLINE="console=ttySC3,115200 earlyprintk=serial ignore_loglevel"
+CONFIG_CMDLINE="console=ttySC3,115200 ignore_loglevel earlyprintk=serial"
 #
 # Bus options
 #
-# CONFIG_CF_ENABLER is not set
+CONFIG_CF_ENABLER=y
+# CONFIG_CF_AREA5 is not set
+CONFIG_CF_AREA6=y
+CONFIG_CF_BASE_ADDR=0xb8000000
 # CONFIG_ARCH_SUPPORTS_MSI is not set
+# CONFIG_PCCARD is not set
-#
-# PCCARD (PCMCIA/CardBus) support
-#
 #
 # Executable file formats
 #
 CONFIG_BINFMT_FLAT=y
 CONFIG_BINFMT_ZFLAT=y
-# CONFIG_BINFMT_SHARED_FLAT is not set
+CONFIG_BINFMT_SHARED_FLAT=y
-# CONFIG_BINFMT_MISC is not set
+CONFIG_BINFMT_MISC=y
 #
 # Networking
@@ -253,14 +307,24 @@ CONFIG_NET=y
 #
 # Networking options
 #
-# CONFIG_PACKET is not set
+CONFIG_PACKET=y
-# CONFIG_UNIX is not set
+# CONFIG_PACKET_MMAP is not set
-# CONFIG_NET_KEY is not set
+CONFIG_UNIX=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
+CONFIG_NET_KEY=y
+# CONFIG_NET_KEY_MIGRATE is not set
 CONFIG_INET=y
 # CONFIG_IP_MULTICAST is not set
 # CONFIG_IP_ADVANCED_ROUTER is not set
 CONFIG_IP_FIB_HASH=y
-# CONFIG_IP_PNP is not set
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+# CONFIG_IP_PNP_BOOTP is not set
+# CONFIG_IP_PNP_RARP is not set
 # CONFIG_NET_IPIP is not set
 # CONFIG_NET_IPGRE is not set
 # CONFIG_ARPD is not set
@@ -273,14 +337,13 @@ CONFIG_IP_FIB_HASH=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
+# CONFIG_INET_LRO is not set
 # CONFIG_INET_DIAG is not set
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_CUBIC=y
 CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_TCP_MD5SIG is not set
 # CONFIG_IPV6 is not set
-# CONFIG_INET6_XFRM_TUNNEL is not set
-# CONFIG_INET6_TUNNEL is not set
 # CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
 # CONFIG_IP_DCCP is not set
@@ -297,10 +360,6 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_LAPB is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
-#
-# QoS and/or fair queueing
-#
 # CONFIG_NET_SCHED is not set
 #
@@ -308,6 +367,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 #
 # CONFIG_NET_PKTGEN is not set
 # CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
@@ -329,8 +389,10 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 #
 # Generic Driver Options
 #
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
+# CONFIG_FW_LOADER is not set
 # CONFIG_DEBUG_DRIVER is not set
 # CONFIG_DEBUG_DEVRES is not set
 # CONFIG_SYS_HYPERVISOR is not set
@@ -339,11 +401,9 @@ CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
 CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_REDBOOT_PARTS=y
+# CONFIG_MTD_REDBOOT_PARTS is not set
-CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
-# CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED is not set
-# CONFIG_MTD_REDBOOT_PARTS_READONLY is not set
 # CONFIG_MTD_CMDLINE_PARTS is not set
+# CONFIG_MTD_AR7_PARTS is not set
 #
 # User Modules And Translation Layers
@@ -356,6 +416,7 @@ CONFIG_MTD_BLOCK=y
 # CONFIG_INFTL is not set
 # CONFIG_RFD_FTL is not set
 # CONFIG_SSFDC is not set
+# CONFIG_MTD_OOPS is not set
 #
 # RAM/ROM/Flash chip drivers
@@ -390,7 +451,6 @@ CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_PHYSMAP_START=0x20000000
 CONFIG_MTD_PHYSMAP_LEN=0x01000000
 CONFIG_MTD_PHYSMAP_BANKWIDTH=4
-# CONFIG_MTD_SOLUTIONENGINE is not set
 # CONFIG_MTD_UCLINUX is not set
 # CONFIG_MTD_PLATRAM is not set
@@ -418,13 +478,19 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=4
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_COW_COMMON is not set
-# CONFIG_BLK_DEV_LOOP is not set
+CONFIG_BLK_DEV_LOOP=y
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
 # CONFIG_BLK_DEV_NBD is not set
-# CONFIG_BLK_DEV_RAM is not set
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+# CONFIG_BLK_DEV_XIP is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 CONFIG_MISC_DEVICES=y
-# CONFIG_EEPROM_93CX6 is not set
+CONFIG_EEPROM_93CX6=y
+# CONFIG_ENCLOSURE_SERVICES is not set
+CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 #
@@ -443,23 +509,30 @@ CONFIG_NETDEVICES=y
 # CONFIG_MACVLAN is not set
 # CONFIG_EQUALIZER is not set
 # CONFIG_TUN is not set
+# CONFIG_VETH is not set
 # CONFIG_PHYLIB is not set
 CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
+# CONFIG_AX88796 is not set
 # CONFIG_STNIC is not set
 CONFIG_SMC91X=y
-CONFIG_NETDEV_1000=y
+# CONFIG_IBM_NEW_EMAC_ZMII is not set
-CONFIG_NETDEV_10000=y
+# CONFIG_IBM_NEW_EMAC_RGMII is not set
+# CONFIG_IBM_NEW_EMAC_TAH is not set
+# CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_B44 is not set
+# CONFIG_NETDEV_1000 is not set
+# CONFIG_NETDEV_10000 is not set
 #
 # Wireless LAN
 #
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
+# CONFIG_IWLWIFI_LEDS is not set
 # CONFIG_WAN is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
-# CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
 # CONFIG_NET_POLL_CONTROLLER is not set
@@ -469,28 +542,7 @@ CONFIG_NETDEV_10000=y
 #
 # Input device support
 #
-CONFIG_INPUT=y
+# CONFIG_INPUT is not set
-# CONFIG_INPUT_FF_MEMLESS is not set
-# CONFIG_INPUT_POLLDEV is not set
-#
-# Userland interfaces
-#
-# CONFIG_INPUT_MOUSEDEV is not set
-# CONFIG_INPUT_JOYDEV is not set
-# CONFIG_INPUT_TSDEV is not set
-# CONFIG_INPUT_EVDEV is not set
-# CONFIG_INPUT_EVBUG is not set
-#
-# Input Device Drivers
-#
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_INPUT_JOYSTICK is not set
-# CONFIG_INPUT_TABLET is not set
-# CONFIG_INPUT_TOUCHSCREEN is not set
-# CONFIG_INPUT_MISC is not set
 #
 # Hardware I/O ports
@@ -502,6 +554,7 @@ CONFIG_INPUT=y
 # Character devices
 #
 # CONFIG_VT is not set
+# CONFIG_DEVKMEM is not set
 # CONFIG_SERIAL_NONSTANDARD is not set
 #
@@ -520,106 +573,119 @@ CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_UNIX98_PTYS is not set
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_IPMI_HANDLER is not set
-# CONFIG_WATCHDOG is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_R3964 is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_TCG_TPM is not set
 # CONFIG_I2C is not set
-#
-# SPI support
-#
 # CONFIG_SPI is not set
-# CONFIG_SPI_MASTER is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
+# CONFIG_THERMAL is not set
+# CONFIG_WATCHDOG is not set
+#
+# Sonics Silicon Backplane
+#
+CONFIG_SSB_POSSIBLE=y
+# CONFIG_SSB is not set
 #
 # Multifunction device drivers
 #
 # CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
 #
 # Multimedia devices
 #
+#
+# Multimedia core support
+#
 # CONFIG_VIDEO_DEV is not set
 # CONFIG_DVB_CORE is not set
-CONFIG_DAB=y
+# CONFIG_VIDEO_MEDIA is not set
+#
+# Multimedia drivers
+#
+# CONFIG_DAB is not set
 #
 # Graphics support
 #
+# CONFIG_VGASTATE is not set
+# CONFIG_VIDEO_OUTPUT_CONTROL is not set
+# CONFIG_FB is not set
 # CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 #
 # Display device support
 #
 # CONFIG_DISPLAY_SUPPORT is not set
-# CONFIG_VGASTATE is not set
-CONFIG_VIDEO_OUTPUT_CONTROL=y
-# CONFIG_FB is not set
 #
 # Sound
 #
 # CONFIG_SOUND is not set
-CONFIG_HID_SUPPORT=y
+# CONFIG_USB_SUPPORT is not set
-CONFIG_HID=y
-# CONFIG_HID_DEBUG is not set
-CONFIG_USB_SUPPORT=y
-CONFIG_USB_ARCH_HAS_HCD=y
-# CONFIG_USB_ARCH_HAS_OHCI is not set
-# CONFIG_USB_ARCH_HAS_EHCI is not set
-# CONFIG_USB is not set
-#
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
-#
-#
-# USB Gadget Support
-#
-# CONFIG_USB_GADGET is not set
 # CONFIG_MMC is not set
+# CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
-# CONFIG_RTC_CLASS is not set
+# CONFIG_ACCESSIBILITY is not set
+CONFIG_RTC_LIB=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+# CONFIG_RTC_DEBUG is not set
 #
-# DMA Engine support
+# RTC interfaces
 #
-# CONFIG_DMA_ENGINE is not set
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_DEV=y
+# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
+# CONFIG_RTC_DRV_TEST is not set
 #
-# DMA Clients
+# SPI RTC drivers
 #
 #
-# DMA Devices
+# Platform RTC drivers
 #
+# CONFIG_RTC_DRV_DS1511 is not set
+# CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
+# CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_V3020 is not set
 #
-# Userspace I/O
+# on-CPU RTC drivers
 #
+CONFIG_RTC_DRV_SH=y
 # CONFIG_UIO is not set
 #
 # File systems
 #
-# CONFIG_EXT2_FS is not set
+CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS_XATTR is not set
 # CONFIG_EXT3_FS is not set
 # CONFIG_EXT4DEV_FS is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
-# CONFIG_GFS2_FS is not set
+# CONFIG_OCFS2_FS is not set
-# CONFIG_MINIX_FS is not set
+# CONFIG_DNOTIFY is not set
-CONFIG_ROMFS_FS=y
 # CONFIG_INOTIFY is not set
 # CONFIG_QUOTA is not set
-# CONFIG_DNOTIFY is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
 # CONFIG_FUSE_FS is not set
@@ -642,10 +708,11 @@ CONFIG_ROMFS_FS=y
 #
 CONFIG_PROC_FS=y
 CONFIG_PROC_SYSCTL=y
-# CONFIG_SYSFS is not set
+CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
-CONFIG_RAMFS=y
+CONFIG_CONFIGFS_FS=y
 #
 # Miscellaneous filesystems
@@ -658,18 +725,28 @@ CONFIG_RAMFS=y
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
 # CONFIG_JFFS2_FS is not set
-# CONFIG_CRAMFS is not set
+CONFIG_CRAMFS=y
 # CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
+CONFIG_ROMFS_FS=y
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
+CONFIG_NETWORK_FILESYSTEMS=y
-#
+CONFIG_NFS_FS=y
-# Network File Systems
+CONFIG_NFS_V3=y
-#
+# CONFIG_NFS_V3_ACL is not set
-# CONFIG_NFS_FS is not set
+# CONFIG_NFS_V4 is not set
 # CONFIG_NFSD is not set
+CONFIG_ROOT_NFS=y
+CONFIG_LOCKD=y
+CONFIG_LOCKD_V4=y
+CONFIG_NFS_COMMON=y
+CONFIG_SUNRPC=y
+# CONFIG_SUNRPC_BIND34 is not set
+# CONFIG_RPCSEC_GSS_KRB5 is not set
+# CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
@@ -681,30 +758,20 @@ CONFIG_RAMFS=y
 #
 # CONFIG_PARTITION_ADVANCED is not set
 CONFIG_MSDOS_PARTITION=y
-#
-# Native Language Support
-#
 # CONFIG_NLS is not set
+# CONFIG_DLM is not set
-#
-# Distributed Lock Manager
-#
-#
-# Profiling support
-#
-CONFIG_PROFILING=y
-# CONFIG_OPROFILE is not set
 #
 # Kernel hacking
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_WARN_DEPRECATED=y
 # CONFIG_ENABLE_MUST_CHECK is not set
+CONFIG_FRAME_WARN=1024
 # CONFIG_MAGIC_SYSRQ is not set
 # CONFIG_UNUSED_SYMBOLS is not set
+CONFIG_DEBUG_FS=y
 # CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
 # CONFIG_DEBUG_SHIRQ is not set
@@ -712,7 +779,10 @@ CONFIG_DETECT_SOFTLOCKUP=y
 CONFIG_SCHED_DEBUG=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_TIMER_STATS is not set
-CONFIG_SLUB_DEBUG_ON=y
+# CONFIG_DEBUG_OBJECTS is not set
+CONFIG_DEBUG_PREEMPT=y
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_LOCK_ALLOC is not set
@@ -722,38 +792,123 @@ CONFIG_DEBUG_SPINLOCK_SLEEP=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 CONFIG_DEBUG_BUGVERBOSE=y
-CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_INFO is not set
-# CONFIG_DEBUG_VM is not set
+CONFIG_DEBUG_VM=y
-# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
+CONFIG_DEBUG_LIST=y
+# CONFIG_DEBUG_SG is not set
 CONFIG_FRAME_POINTER=y
-CONFIG_FORCED_INLINING=y
+# CONFIG_BOOT_PRINTK_DELAY is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
 # CONFIG_FAULT_INJECTION is not set
+# CONFIG_SAMPLES is not set
 # CONFIG_SH_STANDARD_BIOS is not set
-CONFIG_EARLY_SCIF_CONSOLE=y
+# CONFIG_EARLY_SCIF_CONSOLE is not set
-CONFIG_EARLY_SCIF_CONSOLE_PORT=0xfffe9800
-CONFIG_EARLY_PRINTK=y
 # CONFIG_DEBUG_BOOTMEM is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
-# CONFIG_4KSTACKS is not set
+# CONFIG_IRQSTACKS is not set
 #
 # Security options
 #
 # CONFIG_KEYS is not set
-# CONFIG_CRYPTO is not set
+# CONFIG_SECURITY is not set
+# CONFIG_SECURITY_FILE_CAPABILITIES is not set
+CONFIG_CRYPTO=y
+#
+# Crypto core or helper
+#
+CONFIG_CRYPTO_ALGAPI=y
+# CONFIG_CRYPTO_MANAGER is not set
+# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+# CONFIG_CRYPTO_AUTHENC is not set
+# CONFIG_CRYPTO_TEST is not set
+#
+# Authenticated Encryption with Associated Data
+#
+# CONFIG_CRYPTO_CCM is not set
+# CONFIG_CRYPTO_GCM is not set
+# CONFIG_CRYPTO_SEQIV is not set
+#
+# Block modes
+#
+# CONFIG_CRYPTO_CBC is not set
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_CTS is not set
+# CONFIG_CRYPTO_ECB is not set
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+#
+# Hash modes
+#
+# CONFIG_CRYPTO_HMAC is not set
+# CONFIG_CRYPTO_XCBC is not set
+#
+# Digest
+#
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_MD4 is not set
+# CONFIG_CRYPTO_MD5 is not set
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_SHA1 is not set
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_WP512 is not set
+#
+# Ciphers
+#
+# CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_DES is not set
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_SALSA20 is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+#
+# Compression
+#
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LZO=y
+# CONFIG_CRYPTO_HW is not set
 #
 # Library routines
 #
 CONFIG_BITREVERSE=y
-# CONFIG_CRC_CCITT is not set
+# CONFIG_GENERIC_FIND_FIRST_BIT is not set
-# CONFIG_CRC16 is not set
+CONFIG_CRC_CCITT=y
-# CONFIG_CRC_ITU_T is not set
+CONFIG_CRC16=y
+CONFIG_CRC_ITU_T=y
 CONFIG_CRC32=y
-# CONFIG_CRC7 is not set
+CONFIG_CRC7=y
-# CONFIG_LIBCRC32C is not set
+CONFIG_LIBCRC32C=y
+CONFIG_AUDIT_GENERIC=y
 CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_PLIST=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
 CONFIG_HAS_DMA=y
diff --git a/arch/sh/kernel/cpu/irq/intc-sh5.c b/arch/sh/kernel/cpu/irq/intc-sh5.c
index de45c6a3e33b..79baa47af977 100644
--- a/arch/sh/kernel/cpu/irq/intc-sh5.c
+++ b/arch/sh/kernel/cpu/irq/intc-sh5.c
@@ -242,6 +242,7 @@ void __init plat_irq_setup(void)
                                reg += 8;
                        }
                }
+        }
 #endif
        /*
diff --git a/arch/sh/kernel/cpu/sh4/probe.c b/arch/sh/kernel/cpu/sh4/probe.c
index ebceb0dadff5..be4926969181 100644
--- a/arch/sh/kernel/cpu/sh4/probe.c
+++ b/arch/sh/kernel/cpu/sh4/probe.c
@@ -132,6 +132,7 @@ int __init detect_cpu_and_cache_system(void)
                switch (prr) {
                case 0x50:
+                case 0x51:
                        boot_cpu_data.type = CPU_SH7723;
                        boot_cpu_data.flags |= CPU_HAS_FPU | CPU_HAS_L2_CACHE;
                        break;
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7722.c b/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
index 069314037049..62ebccf18b3c 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
@@ -16,7 +16,7 @@
 static struct resource usbf_resources[] = {
        [0] = {
-                .name   = "USBF",
+                .name   = "m66592_udc",
                .start  = 0x04480000,
                .end    = 0x044800FF,
                .flags  = IORESOURCE_MEM,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7723.c b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
index 16925cf28db8..a0470f2f5479 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
@@ -16,6 +16,21 @@
 static struct plat_sci_port sci_platform_data[] = {
        {
+                .mapbase        = 0xffe00000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 80, 80, 80, 80 },
+        },{
+                .mapbase        = 0xffe10000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 81, 81, 81, 81 },
+        },{
+                .mapbase        = 0xffe20000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 82, 82, 82, 82 },
+        },{
                .mapbase        = 0xa4e30000,
                .flags          = UPF_BOOT_AUTOCONF,
                .type           = PORT_SCI,
@@ -73,9 +88,35 @@ static struct platform_device rtc_device = {
        .resource       = rtc_resources,
 };
+static struct resource sh7723_usb_host_resources[] = {
+        [0] = {
+                .name   = "r8a66597_hcd",
+                .start  = 0xa4d80000,
+                .end    = 0xa4d800ff,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = 65,
+                .end    = 65,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device sh7723_usb_host_device = {
+        .name           = "r8a66597_hcd",
+        .id             = 0,
+        .dev = {
+                .dma_mask               = NULL,         /*  not use dma */
+                .coherent_dma_mask      = 0xffffffff,
+        },
+        .num_resources  = ARRAY_SIZE(sh7723_usb_host_resources),
+        .resource       = sh7723_usb_host_resources,
+};
 static struct platform_device *sh7723_devices[] __initdata = {
        &sci_device,
        &rtc_device,
+        &sh7723_usb_host_device,
 };
 static int __init sh7723_devices_setup(void)
@@ -153,7 +194,7 @@ static struct intc_vect vectors[] __initdata = {
        INTC_VECT(VIO_VOUI,0x8E0),
        INTC_VECT(SCIFA_SCIFA0,0x900),
-        INTC_VECT(VPU_VPUI,0x920),
+        INTC_VECT(VPU_VPUI,0x980),
        INTC_VECT(TPU_TPUI,0x9A0),
        INTC_VECT(ADC_ADI,0x9E0),
        INTC_VECT(USB_USI0,0xA20),
@@ -292,9 +333,3 @@ void __init plat_irq_setup(void)
 {
        register_intc_controller(&intc_desc);
 }
-void __init plat_mem_setup(void)
-{
-        /* Register the URAM space as Node 1 */
-        setup_bootmem_node(1, 0x055f0000, 0x05610000);
-}
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7763.c b/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
index ae2b22219f02..f189a559462b 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
@@ -291,8 +291,9 @@ static struct intc_sense_reg irq_sense_registers[] __initdata = {
 };
 static DECLARE_INTC_DESC(intc_irq_desc, "sh7763-irq", irq_vectors,
-                         NULL, NULL, irq_mask_registers, irq_prio_registers,
+                        NULL, irq_mask_registers, irq_prio_registers,
-                         irq_sense_registers);
+                        irq_sense_registers);
 /* External interrupt pins in IRL mode */
 static struct intc_vect irl_vectors[] __initdata = {
@@ -324,10 +325,10 @@ static struct intc_mask_reg irl7654_mask_registers[] __initdata = {
 };
 static DECLARE_INTC_DESC(intc_irl7654_desc, "sh7763-irl7654", irl_vectors,
-                         NULL, NULL, irl7654_mask_registers, NULL, NULL);
+                        NULL, irl7654_mask_registers, NULL, NULL);
 static DECLARE_INTC_DESC(intc_irl3210_desc, "sh7763-irl3210", irl_vectors,
-                         NULL, NULL, irl3210_mask_registers, NULL, NULL);
+                        NULL, irl3210_mask_registers, NULL, NULL);
 #define INTC_ICR0       0xffd00000
 #define INTC_INTMSK0    0xffd00044
diff --git a/arch/sh/kernel/module.c b/arch/sh/kernel/module.c
index b3d0a03b4c76..5482e65375a9 100644
--- a/arch/sh/kernel/module.c
+++ b/arch/sh/kernel/module.c
@@ -30,6 +30,7 @@
 #include <linux/fs.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
+#include <asm/unaligned.h>
 void *module_alloc(unsigned long size)
 {
@@ -56,34 +57,6 @@ int module_frob_arch_sections(Elf_Ehdr *hdr,
        return 0;
 }
-#ifdef CONFIG_SUPERH32
-#define COPY_UNALIGNED_WORD(sw, tw, align) \
-{ \
-        void *__s = &(sw), *__t = &(tw); \
-        unsigned short *__s2 = __s, *__t2 = __t; \
-        unsigned char *__s1 = __s, *__t1 = __t; \
-        switch ((align)) \
-        { \
-        case 0: \
-                *(unsigned long *) __t = *(unsigned long *) __s; \
-                break; \
-        case 2: \
-                *__t2++ = *__s2++; \
-                *__t2 = *__s2; \
-                break; \
-        default: \
-                *__t1++ = *__s1++; \
-                *__t1++ = *__s1++; \
-                *__t1++ = *__s1++; \
-                *__t1 = *__s1; \
-                break; \
-        } \
-}
-#else
-/* One thing SHmedia doesn't screw up! */
-#define COPY_UNALIGNED_WORD(sw, tw, align)      { (tw) = (sw); }
-#endif
 int apply_relocate_add(Elf32_Shdr *sechdrs,
                   const char *strtab,
                   unsigned int symindex,
@@ -96,7 +69,6 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
        Elf32_Addr relocation;
        uint32_t *location;
        uint32_t value;
-        int align;
        pr_debug("Applying relocate section %u to %u\n", relsec,
                 sechdrs[relsec].sh_info);
@@ -109,7 +81,6 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
                sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
                        + ELF32_R_SYM(rel[i].r_info);
                relocation = sym->st_value + rel[i].r_addend;
-                align = (int)location & 3;
 #ifdef CONFIG_SUPERH64
                /* For text addresses, bit2 of the st_other field indicates
@@ -122,15 +93,15 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
                switch (ELF32_R_TYPE(rel[i].r_info)) {
                case R_SH_DIR32:
-                        COPY_UNALIGNED_WORD (*location, value, align);
+                        value = get_unaligned(location);
                        value += relocation;
-                        COPY_UNALIGNED_WORD (value, *location, align);
+                        put_unaligned(value, location);
                        break;
                case R_SH_REL32:
                        relocation = (relocation - (Elf32_Addr) location);
-                        COPY_UNALIGNED_WORD (*location, value, align);
+                        value = get_unaligned(location);
                        value += relocation;
-                        COPY_UNALIGNED_WORD (value, *location, align);
+                        put_unaligned(value, location);
                        break;
                case R_SH_IMM_LOW16:
                        *location = (*location & ~0x3fffc00) |
diff --git a/arch/sparc/kernel/led.c b/arch/sparc/kernel/led.c
index 59e9344e7a0d..adaaed4ea2fb 100644
--- a/arch/sparc/kernel/led.c
+++ b/arch/sparc/kernel/led.c
@@ -2,6 +2,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/string.h>
 #include <linux/jiffies.h>
 #include <linux/timer.h>
@@ -45,21 +46,22 @@ static void led_blink(unsigned long timeout)
        add_timer(&led_blink_timer);
 }
-static int led_read_proc(char *buf, char **start, off_t offset, int count,
+static int led_proc_show(struct seq_file *m, void *v)
-                         int *eof, void *data)
 {
-        int len = 0;
        if (get_auxio() & AUXIO_LED)
-                len = sprintf(buf, "on\n");
+                seq_puts(m, "on\n");
        else
-                len = sprintf(buf, "off\n");
+                seq_puts(m, "off\n");
+        return 0;
+}
-        return len;
+static int led_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, led_proc_show, NULL);
 }
-static int led_write_proc(struct file *file, const char __user *buffer,
+static ssize_t led_proc_write(struct file *file, const char __user *buffer,
-                          unsigned long count, void *data)
+                              size_t count, loff_t *ppos)
 {
        char *buf = NULL;
@@ -103,6 +105,15 @@ static int led_write_proc(struct file *file, const char __user *buffer,
        return count;
 }
+static const struct file_operations led_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = led_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+        .write          = led_proc_write,
+};
 static struct proc_dir_entry *led;
 #define LED_VERSION     "0.1"
@@ -112,12 +123,9 @@ static int __init led_init(void)
        init_timer(&led_blink_timer);
        led_blink_timer.function = led_blink;
-        led = create_proc_entry("led", 0, NULL);
+        led = proc_create("led", 0, NULL, &led_proc_fops);
        if (!led)
                return -ENOMEM;
-        led->read_proc = led_read_proc; /* reader function */
-        led->write_proc = led_write_proc; /* writer function */
        led->owner = THIS_MODULE;
        printk(KERN_INFO
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 44ad1607be2d..b58fb8941d8d 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -49,7 +49,6 @@
 #include "irq_user.h"
 #include "irq_kern.h"
 #include "ubd_user.h"
-#include "kern_util.h"
 #include "os.h"
 #include "mem.h"
 #include "mem_kern.h"
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index e2716ac8889a..db5be46e3e18 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -299,6 +299,6 @@ extern int os_arch_prctl(int pid, int code, unsigned long *addr);
 extern int get_pty(void);
 /* sys-$ARCH/task_size.c */
-extern unsigned long os_get_task_size(void);
+extern unsigned long os_get_top_address(void);
 #endif
diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c
index 9db85b2ce698..8d84250324b3 100644
--- a/arch/um/kernel/um_arch.c
+++ b/arch/um/kernel/um_arch.c
@@ -274,7 +274,7 @@ int __init linux_main(int argc, char **argv)
        if (have_root == 0)
                add_arg(DEFAULT_COMMAND_LINE);
-        host_task_size = os_get_task_size();
+        host_task_size = os_get_top_address();
        /*
         * TASK_SIZE needs to be PGDIR_SIZE aligned or else exit_mmap craps
         * out
diff --git a/arch/um/os-Linux/helper.c b/arch/um/os-Linux/helper.c
index 74ca7aabf4e1..30860b89ec58 100644
--- a/arch/um/os-Linux/helper.c
+++ b/arch/um/os-Linux/helper.c
@@ -7,6 +7,7 @@
 #include <unistd.h>
 #include <errno.h>
 #include <sched.h>
+#include <linux/limits.h>
 #include <sys/socket.h>
 #include <sys/wait.h>
 #include "kern_constants.h"
diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index 6be028ca1817..172ad8f72e12 100644
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -55,7 +55,7 @@ static int ptrace_dump_regs(int pid)
 * Signals that are OK to receive in the stub - we'll just continue it.
 * SIGWINCH will happen when UML is inside a detached screen.
 */
-#define STUB_SIG_MASK (1 << SIGVTALRM)
+#define STUB_SIG_MASK ((1 << SIGVTALRM) | (1 << SIGWINCH))
 /* Signals that the stub will finish with - anything else is an error */
 #define STUB_DONE_MASK (1 << SIGTRAP)
diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
index b4b36e0f2e89..183db26d01bf 100644
--- a/arch/um/os-Linux/start_up.c
+++ b/arch/um/os-Linux/start_up.c
@@ -121,8 +121,10 @@ static int stop_ptraced_child(int pid, int exitcode, int mustexit)
 {
        int status, n, ret = 0;
-        if (ptrace(PTRACE_CONT, pid, 0, 0) < 0)
+        if (ptrace(PTRACE_CONT, pid, 0, 0) < 0) {
-                fatal_perror("stop_ptraced_child : ptrace failed");
+                perror("stop_ptraced_child : ptrace failed");
+                return -1;
+        }
        CATCH_EINTR(n = waitpid(pid, &status, 0));
        if (!WIFEXITED(status) || (WEXITSTATUS(status) != exitcode)) {
                int exit_with = WEXITSTATUS(status);
@@ -212,7 +214,7 @@ static void __init check_sysemu(void)
        if (n < 0)
                fatal_perror("check_sysemu : wait failed");
        if (!WIFSTOPPED(status) || (WSTOPSIG(status) != SIGTRAP))
-                fatal("check_sysemu : expected SIGTRAP, got status = %d",
+                fatal("check_sysemu : expected SIGTRAP, got status = %d\n",
                      status);
        if (ptrace(PTRACE_GETREGS, pid, 0, regs) < 0)
@@ -254,9 +256,11 @@ static void __init check_sysemu(void)
                if (WIFSTOPPED(status) &&
                    (WSTOPSIG(status) == (SIGTRAP|0x80))) {
-                        if (!count)
+                        if (!count) {
-                                fatal("check_ptrace : SYSEMU_SINGLESTEP "
+                                non_fatal("check_ptrace : SYSEMU_SINGLESTEP "
-                                      "doesn't singlestep");
+                                          "doesn't singlestep");
+                                goto fail;
+                        }
                        n = ptrace(PTRACE_POKEUSR, pid, PT_SYSCALL_RET_OFFSET,
                                   os_getpid());
                        if (n < 0)
@@ -266,9 +270,12 @@ static void __init check_sysemu(void)
                }
                else if (WIFSTOPPED(status) && (WSTOPSIG(status) == SIGTRAP))
                        count++;
-                else
+                else {
-                        fatal("check_ptrace : expected SIGTRAP or "
+                        non_fatal("check_ptrace : expected SIGTRAP or "
-                              "(SIGTRAP | 0x80), got status = %d", status);
+                                  "(SIGTRAP | 0x80), got status = %d\n",
+                                  status);
+                        goto fail;
+                }
        }
        if (stop_ptraced_child(pid, 0, 0) < 0)
                goto fail_stopped;
diff --git a/arch/um/os-Linux/sys-i386/registers.c b/arch/um/os-Linux/sys-i386/registers.c
index b487cbead1bd..229f7a53d8da 100644
--- a/arch/um/os-Linux/sys-i386/registers.c
+++ b/arch/um/os-Linux/sys-i386/registers.c
@@ -6,7 +6,7 @@
 #include <errno.h>
 #include <sys/ptrace.h>
-#include <asm/user.h>
+#include <sys/user.h>
 #include "kern_constants.h"
 #include "longjmp.h"
 #include "user.h"
@@ -76,7 +76,7 @@ int put_fp_registers(int pid, unsigned long *regs)
 void arch_init_registers(int pid)
 {
-        struct user_fxsr_struct fpx_regs;
+        struct user_fpxregs_struct fpx_regs;
        int err;
        err = ptrace(PTRACE_GETFPXREGS, pid, 0, &fpx_regs);
diff --git a/arch/um/os-Linux/sys-i386/task_size.c b/arch/um/os-Linux/sys-i386/task_size.c
index ccb49b0aff59..be04c1e183bf 100644
--- a/arch/um/os-Linux/sys-i386/task_size.c
+++ b/arch/um/os-Linux/sys-i386/task_size.c
@@ -63,7 +63,7 @@ static int page_ok(unsigned long page)
        return ok;
 }
-unsigned long os_get_task_size(void)
+unsigned long os_get_top_address(void)
 {
        struct sigaction sa, old;
        unsigned long bottom = 0;
@@ -76,9 +76,9 @@ unsigned long os_get_task_size(void)
         * hosts, but shouldn't hurt otherwise.
         */
        unsigned long top = 0xffffd000 >> UM_KERN_PAGE_SHIFT;
-        unsigned long test;
+        unsigned long test, original;
-        printf("Locating the top of the address space ... ");
+        printf("Locating the bottom of the address space ... ");
        fflush(stdout);
        /*
@@ -89,16 +89,31 @@ unsigned long os_get_task_size(void)
        sigemptyset(&sa.sa_mask);
        sa.sa_flags = SA_NODEFER;
        if (sigaction(SIGSEGV, &sa, &old)) {
-                perror("os_get_task_size");
+                perror("os_get_top_address");
                exit(1);
        }
-        if (!page_ok(bottom)) {
+        /* Manually scan the address space, bottom-up, until we find
-                fprintf(stderr, "Address 0x%x no good?\n",
+         * the first valid page (or run out of them).
-                        bottom << UM_KERN_PAGE_SHIFT);
+         */
+        for (bottom = 0; bottom < top; bottom++) {
+                if (page_ok(bottom))
+                        break;
+        }
+        /* If we've got this far, we ran out of pages. */
+        if (bottom == top) {
+                fprintf(stderr, "Unable to determine bottom of address "
+                        "space.\n");
                exit(1);
        }
+        printf("0x%x\n", bottom << UM_KERN_PAGE_SHIFT);
+        printf("Locating the top of the address space ... ");
+        fflush(stdout);
+        original = bottom;
        /* This could happen with a 4G/4G split */
        if (page_ok(top))
                goto out;
@@ -114,7 +129,7 @@ unsigned long os_get_task_size(void)
 out:
        /* Restore the old SIGSEGV handling */
        if (sigaction(SIGSEGV, &old, NULL)) {
-                perror("os_get_task_size");
+                perror("os_get_top_address");
                exit(1);
        }
        top <<= UM_KERN_PAGE_SHIFT;
diff --git a/arch/um/os-Linux/sys-x86_64/task_size.c b/arch/um/os-Linux/sys-x86_64/task_size.c
index fad6f57f8ee3..26a0dd1f349c 100644
--- a/arch/um/os-Linux/sys-x86_64/task_size.c
+++ b/arch/um/os-Linux/sys-x86_64/task_size.c
@@ -1,4 +1,4 @@
-unsigned long os_get_task_size(unsigned long shift)
+unsigned long os_get_top_address(unsigned long shift)
 {
        /* The old value of CONFIG_TOP_ADDR */
        return 0x7fc0000000;
diff --git a/arch/um/os-Linux/time.c b/arch/um/os-Linux/time.c
index bee98f466d66..dec5678fc17f 100644
--- a/arch/um/os-Linux/time.c
+++ b/arch/um/os-Linux/time.c
@@ -106,6 +106,10 @@ static void deliver_alarm(void)
        unsigned long long this_tick = os_nsecs();
        int one_tick = UM_NSEC_PER_SEC / UM_HZ;
+        /* Protection against the host's time going backwards */
+        if ((last_tick != 0) && (this_tick < last_tick))
+                this_tick = last_tick;
        if (last_tick == 0)
                last_tick = this_tick - one_tick;
@@ -148,6 +152,9 @@ static int after_sleep_interval(struct timespec *ts)
                start_usecs = usec;
        start_usecs -= skew / UM_NSEC_PER_USEC;
+        if (start_usecs < 0)
+                start_usecs = 0;
        tv = ((struct timeval) { .tv_sec  = start_usecs / UM_USEC_PER_SEC,
                                 .tv_usec = start_usecs % UM_USEC_PER_SEC });
        interval = ((struct itimerval) { { 0, usec }, tv });
diff --git a/arch/um/sys-x86_64/ksyms.c b/arch/um/sys-x86_64/ksyms.c
index 6604673a849d..1db2fce00948 100644
--- a/arch/um/sys-x86_64/ksyms.c
+++ b/arch/um/sys-x86_64/ksyms.c
@@ -3,5 +3,9 @@
 #include <asm/checksum.h>
 /*XXX: we need them because they would be exported by x86_64 */
+#if (__GNUC__ == 4 && __GNUC_MINOR__ >= 3) || __GNUC__ > 4
+EXPORT_SYMBOL(memcpy);
+#else
 EXPORT_SYMBOL(__memcpy);
+#endif
 EXPORT_SYMBOL(csum_partial);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index fe361ae7ef2f..52e18e6d2ba0 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -26,17 +26,10 @@ config X86
        select HAVE_KVM if ((X86_32 && !X86_VOYAGER && !X86_VISWS && !X86_NUMAQ) || X86_64)
        select HAVE_ARCH_KGDB if !X86_VOYAGER
-config DEFCONFIG_LIST
+config ARCH_DEFCONFIG
        string
-        depends on X86_32
+        default "arch/x86/configs/i386_defconfig" if X86_32
-        option defconfig_list
+        default "arch/x86/configs/x86_64_defconfig" if X86_64
-        default "arch/x86/configs/i386_defconfig"
-config DEFCONFIG_LIST
-        string
-        depends on X86_64
-        option defconfig_list
-        default "arch/x86/configs/x86_64_defconfig"
 config GENERIC_LOCKBREAK
@@ -1515,13 +1508,13 @@ config PCI_GOMMCONFIG
 config PCI_GODIRECT
        bool "Direct"
-config PCI_GOANY
-        bool "Any"
 config PCI_GOOLPC
        bool "OLPC"
        depends on OLPC
+config PCI_GOANY
+        bool "Any"
 endchoice
 config PCI_BIOS
@@ -1538,9 +1531,8 @@ config PCI_MMCONFIG
        depends on X86_32 && PCI && ACPI && (PCI_GOMMCONFIG || PCI_GOANY)
 config PCI_OLPC
-        bool
+        def_bool y
-        depends on PCI && PCI_GOOLPC
+        depends on PCI && OLPC && (PCI_GOOLPC || PCI_GOANY)
-        default y
 config PCI_DOMAINS
        def_bool y
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index ac1e31ba4795..18363374d51a 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -6,15 +6,19 @@ config TRACE_IRQFLAGS_SUPPORT
 source "lib/Kconfig.debug"
 config NONPROMISC_DEVMEM
-        bool "Disable promiscuous /dev/mem"
+        bool "Filter access to /dev/mem"
        help
-          The /dev/mem file by default only allows userspace access to PCI
+          If this option is left off, you allow userspace access to all
-          space and the BIOS code and data regions. This is sufficient for
+          of memory, including kernel and userspace memory. Accidental
-          dosemu and X and all common users of /dev/mem. With this config
+          access to this is obviously disastrous, but specific access can
-          option, you allow userspace access to all of memory, including
+          be used by people debugging the kernel.
-          kernel and userspace memory. Accidental access to this is
-          obviously disasterous, but specific access can be used by people
+          If this option is switched on, the /dev/mem file only allows
-          debugging the kernel.
+          userspace access to PCI space and the BIOS code and data regions.
+          This is sufficient for dosemu and X and all common users of
+          /dev/mem.
+          If in doubt, say Y.
 config EARLY_PRINTK
        bool "Early printk" if EMBEDDED
diff --git a/arch/x86/boot/a20.c b/arch/x86/boot/a20.c
index 90943f83e84d..e01aafd03bde 100644
--- a/arch/x86/boot/a20.c
+++ b/arch/x86/boot/a20.c
@@ -115,8 +115,6 @@ static void enable_a20_fast(void)
 int enable_a20(void)
 {
-        int loops = A20_ENABLE_LOOPS;
 #if defined(CONFIG_X86_ELAN)
        /* Elan croaks if we try to touch the KBC */
        enable_a20_fast();
@@ -128,6 +126,7 @@ int enable_a20(void)
        enable_a20_kbc();
        return 0;
 #else
+       int loops = A20_ENABLE_LOOPS;
        while (loops--) {
                /* First, check to see if A20 is already enabled
                   (legacy free, etc.) */
diff --git a/arch/x86/boot/printf.c b/arch/x86/boot/printf.c
index c1d00c0274c4..50e47cdbdddd 100644
--- a/arch/x86/boot/printf.c
+++ b/arch/x86/boot/printf.c
@@ -56,7 +56,7 @@ static char *number(char *str, long num, int base, int size, int precision,
        if (type & LEFT)
                type &= ~ZEROPAD;
        if (base < 2 || base > 36)
-                return 0;
+                return NULL;
        c = (type & ZEROPAD) ? '0' : ' ';
        sign = 0;
        if (type & SIGN) {
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index c49ebcc6c41e..33c5216fd3e1 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -242,12 +242,19 @@ static int __init acpi_parse_madt(struct acpi_table_header *table)
 static void __cpuinit acpi_register_lapic(int id, u8 enabled)
 {
+        unsigned int ver = 0;
        if (!enabled) {
                ++disabled_cpus;
                return;
        }
-        generic_processor_info(id, 0);
+#ifdef CONFIG_X86_32
+        if (boot_cpu_physical_apicid != -1U)
+                ver = apic_version[boot_cpu_physical_apicid];
+#endif
+        generic_processor_info(id, ver);
 }
 static int __init
@@ -767,8 +774,13 @@ static void __init acpi_register_lapic_address(unsigned long address)
        mp_lapic_addr = address;
        set_fixmap_nocache(FIX_APIC_BASE, address);
-        if (boot_cpu_physical_apicid == -1U)
+        if (boot_cpu_physical_apicid == -1U) {
                boot_cpu_physical_apicid  = GET_APIC_ID(read_apic_id());
+#ifdef CONFIG_X86_32
+                apic_version[boot_cpu_physical_apicid] =
+                         GET_APIC_VERSION(apic_read(APIC_LVR));
+#endif
+        }
 }
 static int __init early_acpi_parse_madt_lapic_addr_ovr(void)
diff --git a/arch/x86/kernel/apic_64.c b/arch/x86/kernel/apic_64.c
index 5910020c3f24..0633cfd0dc29 100644
--- a/arch/x86/kernel/apic_64.c
+++ b/arch/x86/kernel/apic_64.c
@@ -534,7 +534,7 @@ int setup_profiling_timer(unsigned int multiplier)
 */
 void clear_local_APIC(void)
 {
-        int maxlvt = lapic_get_maxlvt();
+        int maxlvt;
        u32 v;
        /* APIC hasn't been mapped yet */
diff --git a/arch/x86/kernel/cpu/cpufreq/longrun.c b/arch/x86/kernel/cpu/cpufreq/longrun.c
index af4a867a097c..777a7ff075de 100644
--- a/arch/x86/kernel/cpu/cpufreq/longrun.c
+++ b/arch/x86/kernel/cpu/cpufreq/longrun.c
@@ -245,7 +245,7 @@ static unsigned int __init longrun_determine_freqs(unsigned int *low_freq,
        if ((ecx > 95) || (ecx == 0) || (eax < ebx))
                return -EIO;
-        edx = (eax - ebx) / (100 - ecx);
+        edx = ((eax - ebx) * 100) / (100 - ecx);
        *low_freq = edx * 1000; /* back to kHz */
        dprintk("low frequency is %u kHz\n", *low_freq);
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index 46d4034d9f37..206791eb46e3 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -1127,12 +1127,23 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
                 * an UP version, and is deprecated by AMD.
                 */
                if (num_online_cpus() != 1) {
-                        printk(KERN_ERR PFX "MP systems not supported by PSB BIOS structure\n");
+#ifndef CONFIG_ACPI_PROCESSOR
+                        printk(KERN_ERR PFX "ACPI Processor support is required "
+                               "for SMP systems but is absent. Please load the "
+                               "ACPI Processor module before starting this "
+                               "driver.\n");
+#else
+                        printk(KERN_ERR PFX "Your BIOS does not provide ACPI "
+                               "_PSS objects in a way that Linux understands. "
+                               "Please report this to the Linux ACPI maintainers"
+                               " and complain to your BIOS vendor.\n");
+#endif
                        kfree(data);
                        return -ENODEV;
                }
                if (pol->cpu != 0) {
-                        printk(KERN_ERR PFX "No _PSS objects for CPU other than CPU0\n");
+                        printk(KERN_ERR PFX "No ACPI _PSS objects for CPU other than "
+                               "CPU0. Complain to your BIOS vendor.\n");
                        kfree(data);
                        return -ENODEV;
                }
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 2a609dc3271c..c778e4fa55a2 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -248,6 +248,7 @@ ENTRY(resume_userspace)
        DISABLE_INTERRUPTS(CLBR_ANY)    # make sure we don't miss an interrupt
                                        # setting need_resched or sigpending
                                        # between sampling and the iret
+        TRACE_IRQS_OFF
        movl TI_flags(%ebp), %ecx
        andl $_TIF_WORK_MASK, %ecx      # is there any work to be done on
                                        # int/exception return?
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index b2cc73768a9d..f7357cc0162c 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -189,7 +189,7 @@ default_entry:
         * this stage.
         */
-#define KPMDS ((0x100000000-__PAGE_OFFSET) >> 30) /* Number of kernel PMDs */
+#define KPMDS (((-__PAGE_OFFSET) >> 30) & 3) /* Number of kernel PMDs */
        xorl %ebx,%ebx                          /* %ebx is kept at zero */
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index e03cc952f233..eb9ddd8efb82 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -56,6 +56,11 @@ void __cpuinit mxcsr_feature_mask_init(void)
 void __init init_thread_xstate(void)
 {
+        if (!HAVE_HWFP) {
+                xstate_size = sizeof(struct i387_soft_struct);
+                return;
+        }
        if (cpu_has_fxsr)
                xstate_size = sizeof(struct i387_fxsave_struct);
 #ifdef CONFIG_X86_32
@@ -94,7 +99,7 @@ void __cpuinit fpu_init(void)
 int init_fpu(struct task_struct *tsk)
 {
        if (tsk_used_math(tsk)) {
-                if (tsk == current)
+                if (HAVE_HWFP && tsk == current)
                        unlazy_fpu(tsk);
                return 0;
        }
@@ -109,6 +114,15 @@ int init_fpu(struct task_struct *tsk)
                        return -ENOMEM;
        }
+#ifdef CONFIG_X86_32
+        if (!HAVE_HWFP) {
+                memset(tsk->thread.xstate, 0, xstate_size);
+                finit();
+                set_stopped_child_used_math(tsk);
+                return 0;
+        }
+#endif
        if (cpu_has_fxsr) {
                struct i387_fxsave_struct *fx = &tsk->thread.xstate->fxsave;
@@ -330,13 +344,13 @@ int fpregs_get(struct task_struct *target, const struct user_regset *regset,
        struct user_i387_ia32_struct env;
        int ret;
-        if (!HAVE_HWFP)
-                return fpregs_soft_get(target, regset, pos, count, kbuf, ubuf);
        ret = init_fpu(target);
        if (ret)
                return ret;
+        if (!HAVE_HWFP)
+                return fpregs_soft_get(target, regset, pos, count, kbuf, ubuf);
        if (!cpu_has_fxsr) {
                return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
                                           &target->thread.xstate->fsave, 0,
@@ -360,15 +374,15 @@ int fpregs_set(struct task_struct *target, const struct user_regset *regset,
        struct user_i387_ia32_struct env;
        int ret;
-        if (!HAVE_HWFP)
-                return fpregs_soft_set(target, regset, pos, count, kbuf, ubuf);
        ret = init_fpu(target);
        if (ret)
                return ret;
        set_stopped_child_used_math(target);
+        if (!HAVE_HWFP)
+                return fpregs_soft_set(target, regset, pos, count, kbuf, ubuf);
        if (!cpu_has_fxsr) {
                return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                          &target->thread.xstate->fsave, 0, -1);
@@ -474,18 +488,18 @@ static int restore_i387_fxsave(struct _fpstate_ia32 __user *buf)
 int restore_i387_ia32(struct _fpstate_ia32 __user *buf)
 {
        int err;
+        struct task_struct *tsk = current;
-        if (HAVE_HWFP) {
+        if (HAVE_HWFP)
-                struct task_struct *tsk = current;
                clear_fpu(tsk);
-                if (!used_math()) {
+        if (!used_math()) {
-                        err = init_fpu(tsk);
+                err = init_fpu(tsk);
-                        if (err)
+                if (err)
-                                return err;
+                        return err;
-                }
+        }
+        if (HAVE_HWFP) {
                if (cpu_has_fxsr)
                        err = restore_i387_fxsave(buf);
                else
diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c
index a40d54fc1fdd..4dc8600d9d20 100644
--- a/arch/x86/kernel/io_apic_32.c
+++ b/arch/x86/kernel/io_apic_32.c
@@ -2130,14 +2130,10 @@ static inline void __init check_timer(void)
 {
        int apic1, pin1, apic2, pin2;
        int vector;
-        unsigned int ver;
        unsigned long flags;
        local_irq_save(flags);
-        ver = apic_read(APIC_LVR);
-        ver = GET_APIC_VERSION(ver);
        /*
         * get/set the timer IRQ vector:
         */
@@ -2150,15 +2146,11 @@ static inline void __init check_timer(void)
         * mode for the 8259A whenever interrupts are routed
         * through I/O APICs.  Also IRQ0 has to be enabled in
         * the 8259A which implies the virtual wire has to be
-         * disabled in the local APIC.  Finally timer interrupts
+         * disabled in the local APIC.
-         * need to be acknowledged manually in the 8259A for
-         * timer_interrupt() and for the i82489DX when using
-         * the NMI watchdog.
         */
        apic_write_around(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_EXTINT);
        init_8259A(1);
-        timer_ack = !cpu_has_tsc;
+        timer_ack = 1;
-        timer_ack |= (nmi_watchdog == NMI_IO_APIC && !APIC_INTEGRATED(ver));
        if (timer_over_8254 > 0)
                enable_8259A_irq(0);
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 4bc1be5d5472..08a30986d472 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -53,7 +53,7 @@ static cycle_t kvm_clock_read(void);
 * have elapsed since the hypervisor wrote the data. So we try to account for
 * that with system time
 */
-unsigned long kvm_get_wallclock(void)
+static unsigned long kvm_get_wallclock(void)
 {
        u32 wc_sec, wc_nsec;
        u64 delta;
@@ -86,7 +86,7 @@ unsigned long kvm_get_wallclock(void)
        return ts.tv_sec + 1;
 }
-int kvm_set_wallclock(unsigned long now)
+static int kvm_set_wallclock(unsigned long now)
 {
        return 0;
 }
diff --git a/arch/x86/kernel/mfgpt_32.c b/arch/x86/kernel/mfgpt_32.c
index 3cad17fe026b..07c0f828f488 100644
--- a/arch/x86/kernel/mfgpt_32.c
+++ b/arch/x86/kernel/mfgpt_32.c
@@ -155,6 +155,7 @@ int geode_mfgpt_toggle_event(int timer, int cmp, int event, int enable)
        wrmsr(msr, value, dummy);
        return 0;
 }
+EXPORT_SYMBOL_GPL(geode_mfgpt_toggle_event);
 int geode_mfgpt_set_irq(int timer, int cmp, int irq, int enable)
 {
@@ -222,6 +223,7 @@ int geode_mfgpt_alloc_timer(int timer, int domain)
        /* No timers available - too bad */
        return -1;
 }
+EXPORT_SYMBOL_GPL(geode_mfgpt_alloc_timer);
 #ifdef CONFIG_GEODE_MFGPT_TIMER
diff --git a/arch/x86/kernel/nmi_32.c b/arch/x86/kernel/nmi_32.c
index 11b14bbaa61e..84160f74eeb0 100644
--- a/arch/x86/kernel/nmi_32.c
+++ b/arch/x86/kernel/nmi_32.c
@@ -26,7 +26,6 @@
 #include <asm/smp.h>
 #include <asm/nmi.h>
-#include <asm/timer.h>
 #include "mach_traps.h"
@@ -82,7 +81,7 @@ int __init check_nmi_watchdog(void)
        prev_nmi_count = kmalloc(NR_CPUS * sizeof(int), GFP_KERNEL);
        if (!prev_nmi_count)
-                goto error;
+                return -1;
        printk(KERN_INFO "Testing NMI watchdog ... ");
@@ -119,7 +118,7 @@ int __init check_nmi_watchdog(void)
        if (!atomic_read(&nmi_active)) {
                kfree(prev_nmi_count);
                atomic_set(&nmi_active, -1);
-                goto error;
+                return -1;
        }
        printk("OK.\n");
@@ -130,10 +129,6 @@ int __init check_nmi_watchdog(void)
        kfree(prev_nmi_count);
        return 0;
-error:
-        timer_ack = !cpu_has_tsc;
-        return -1;
 }
 static int __init setup_nmi_watchdog(char *str)
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index c5ef1af8e79d..dc00a1331ace 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -378,6 +378,7 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
        struct page *page;
        unsigned long dma_mask = 0;
        dma_addr_t bus;
+        int noretry = 0;
        /* ignore region specifiers */
        gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
@@ -397,20 +398,25 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
        if (dev->dma_mask == NULL)
                return NULL;
-        /* Don't invoke OOM killer */
+        /* Don't invoke OOM killer or retry in lower 16MB DMA zone */
-        gfp |= __GFP_NORETRY;
+        if (gfp & __GFP_DMA)
+                noretry = 1;
 #ifdef CONFIG_X86_64
        /* Why <=? Even when the mask is smaller than 4GB it is often
           larger than 16MB and in this case we have a chance of
           finding fitting memory in the next higher zone first. If
           not retry with true GFP_DMA. -AK */
-        if (dma_mask <= DMA_32BIT_MASK && !(gfp & GFP_DMA))
+        if (dma_mask <= DMA_32BIT_MASK && !(gfp & GFP_DMA)) {
                gfp |= GFP_DMA32;
+                if (dma_mask < DMA_32BIT_MASK)
+                        noretry = 1;
+        }
 #endif
 again:
-        page = dma_alloc_pages(dev, gfp, get_order(size));
+        page = dma_alloc_pages(dev,
+                noretry ? gfp | __GFP_NORETRY : gfp, get_order(size));
        if (page == NULL)
                return NULL;
diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
index c07455d1695f..aa8ec928caa8 100644
--- a/arch/x86/kernel/pci-gart_64.c
+++ b/arch/x86/kernel/pci-gart_64.c
@@ -26,6 +26,7 @@
 #include <linux/kdebug.h>
 #include <linux/scatterlist.h>
 #include <linux/iommu-helper.h>
+#include <linux/sysdev.h>
 #include <asm/atomic.h>
 #include <asm/io.h>
 #include <asm/mtrr.h>
@@ -548,6 +549,28 @@ static __init unsigned read_aperture(struct pci_dev *dev, u32 *size)
        return aper_base;
 }
+static int gart_resume(struct sys_device *dev)
+{
+        return 0;
+}
+static int gart_suspend(struct sys_device *dev, pm_message_t state)
+{
+        return -EINVAL;
+}
+static struct sysdev_class gart_sysdev_class = {
+        .name = "gart",
+        .suspend = gart_suspend,
+        .resume = gart_resume,
+};
+static struct sys_device device_gart = {
+        .id     = 0,
+        .cls    = &gart_sysdev_class,
+};
 /*
 * Private Northbridge GATT initialization in case we cannot use the
 * AGP driver for some reason.
@@ -558,7 +581,7 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
        unsigned aper_base, new_aper_base;
        struct pci_dev *dev;
        void *gatt;
-        int i;
+        int i, error;
        printk(KERN_INFO "PCI-DMA: Disabling AGP.\n");
        aper_size = aper_base = info->aper_size = 0;
@@ -606,6 +629,12 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
                pci_write_config_dword(dev, 0x90, ctl);
        }
+        error = sysdev_class_register(&gart_sysdev_class);
+        if (!error)
+                error = sysdev_register(&device_gart);
+        if (error)
+                panic("Could not register gart_sysdev -- would corrupt data on next suspend");
        flush_gart();
        printk(KERN_INFO "PCI-DMA: aperture base @ %x size %u KB\n",
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index f8476dfbb60d..6d5483356e74 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -649,8 +649,11 @@ struct task_struct * __switch_to(struct task_struct *prev_p, struct task_struct
        /* If the task has used fpu the last 5 timeslices, just do a full
         * restore of the math state immediately to avoid the trap; the
         * chances of needing FPU soon are obviously high now
+         *
+         * tsk_used_math() checks prevent calling math_state_restore(),
+         * which can sleep in the case of !tsk_used_math()
         */
-        if (next_p->fpu_counter > 5)
+        if (tsk_used_math(next_p) && next_p->fpu_counter > 5)
                math_state_restore();
        /*
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index e2319f39988b..ac54ff56df80 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -658,8 +658,11 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        /* If the task has used fpu the last 5 timeslices, just do a full
         * restore of the math state immediately to avoid the trap; the
         * chances of needing FPU soon are obviously high now
+         *
+         * tsk_used_math() checks prevent calling math_state_restore(),
+         * which can sleep in the case of !tsk_used_math()
         */
-        if (next_p->fpu_counter>5)
+        if (tsk_used_math(next_p) && next_p->fpu_counter > 5)
                math_state_restore();
        return prev_p;
 }
diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c
index 9615eee9b775..05191bbc68b8 100644
--- a/arch/x86/kernel/rtc.c
+++ b/arch/x86/kernel/rtc.c
@@ -4,6 +4,8 @@
 #include <linux/acpi.h>
 #include <linux/bcd.h>
 #include <linux/mc146818rtc.h>
+#include <linux/platform_device.h>
+#include <linux/pnp.h>
 #include <asm/time.h>
 #include <asm/vsyscall.h>
@@ -197,3 +199,35 @@ unsigned long long native_read_tsc(void)
 }
 EXPORT_SYMBOL(native_read_tsc);
+static struct resource rtc_resources[] = {
+        [0] = {
+                .start  = RTC_PORT(0),
+                .end    = RTC_PORT(1),
+                .flags  = IORESOURCE_IO,
+        },
+        [1] = {
+                .start  = RTC_IRQ,
+                .end    = RTC_IRQ,
+                .flags  = IORESOURCE_IRQ,
+        }
+};
+static struct platform_device rtc_device = {
+        .name           = "rtc_cmos",
+        .id             = -1,
+        .resource       = rtc_resources,
+        .num_resources  = ARRAY_SIZE(rtc_resources),
+};
+static __init int add_rtc_cmos(void)
+{
+#ifdef CONFIG_PNP
+        if (!pnp_platform_devices)
+                platform_device_register(&rtc_device);
+#else
+        platform_device_register(&rtc_device);
+#endif /* CONFIG_PNP */
+        return 0;
+}
+device_initcall(add_rtc_cmos);
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 38988491c622..56078d61c793 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1190,6 +1190,7 @@ static void __init smp_cpu_index_default(void)
 */
 void __init native_smp_prepare_cpus(unsigned int max_cpus)
 {
+        preempt_disable();
        nmi_watchdog_default();
        smp_cpu_index_default();
        current_cpu_data = boot_cpu_data;
@@ -1206,7 +1207,7 @@ void __init native_smp_prepare_cpus(unsigned int max_cpus)
        if (smp_sanity_check(max_cpus) < 0) {
                printk(KERN_INFO "SMP disabled\n");
                disable_smp();
-                return;
+                goto out;
        }
        preempt_disable();
@@ -1246,6 +1247,8 @@ void __init native_smp_prepare_cpus(unsigned int max_cpus)
        printk(KERN_INFO "CPU%d: ", 0);
        print_cpu_info(&cpu_data(0));
        setup_boot_clock();
+out:
+        preempt_enable();
 }
 /*
 * Early setup to make printk work.
diff --git a/arch/x86/kernel/traps_32.c b/arch/x86/kernel/traps_32.c
index bde6f63e15d5..08d752de4eee 100644
--- a/arch/x86/kernel/traps_32.c
+++ b/arch/x86/kernel/traps_32.c
@@ -544,6 +544,7 @@ vm86_trap:
 #define DO_ERROR(trapnr, signr, str, name)                              \
 void do_##name(struct pt_regs *regs, long error_code)                   \
 {                                                                       \
+        trace_hardirqs_fixup();                                         \
        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
                                                == NOTIFY_STOP)         \
                return;                                                 \
diff --git a/arch/x86/kernel/tsc_32.c b/arch/x86/kernel/tsc_32.c
index e4790728b224..068759db63dd 100644
--- a/arch/x86/kernel/tsc_32.c
+++ b/arch/x86/kernel/tsc_32.c
@@ -14,7 +14,7 @@
 #include "mach_timer.h"
-static int tsc_enabled;
+static int tsc_disabled;
 /*
 * On some systems the TSC frequency does not
@@ -28,8 +28,8 @@ EXPORT_SYMBOL_GPL(tsc_khz);
 static int __init tsc_setup(char *str)
 {
        printk(KERN_WARNING "notsc: Kernel compiled with CONFIG_X86_TSC, "
-                                "cannot disable TSC completely.\n");
+               "cannot disable TSC completely.\n");
-        mark_tsc_unstable("user disabled TSC");
+        tsc_disabled = 1;
        return 1;
 }
 #else
@@ -120,7 +120,7 @@ unsigned long long native_sched_clock(void)
         *   very important for it to be as fast as the platform
         *   can achive it. )
         */
-        if (unlikely(!tsc_enabled && !tsc_unstable))
+        if (unlikely(tsc_disabled))
                /* No locking but a rare wrong value is not a big deal: */
                return (jiffies_64 - INITIAL_JIFFIES) * (1000000000 / HZ);
@@ -322,7 +322,6 @@ void mark_tsc_unstable(char *reason)
 {
        if (!tsc_unstable) {
                tsc_unstable = 1;
-                tsc_enabled = 0;
                printk("Marking TSC unstable due to: %s.\n", reason);
                /* Can be called before registration */
                if (clocksource_tsc.mult)
@@ -336,7 +335,7 @@ EXPORT_SYMBOL_GPL(mark_tsc_unstable);
 static int __init dmi_mark_tsc_unstable(const struct dmi_system_id *d)
 {
        printk(KERN_NOTICE "%s detected: marking TSC unstable.\n",
-                       d->ident);
+               d->ident);
        tsc_unstable = 1;
        return 0;
 }
@@ -403,14 +402,22 @@ void __init tsc_init(void)
 {
        int cpu;
-        if (!cpu_has_tsc)
+        if (!cpu_has_tsc || tsc_disabled) {
+                /* Disable the TSC in case of !cpu_has_tsc */
+                tsc_disabled = 1;
                return;
+        }
        cpu_khz = calculate_cpu_khz();
        tsc_khz = cpu_khz;
        if (!cpu_khz) {
                mark_tsc_unstable("could not calculate TSC khz");
+                /*
+                 * We need to disable the TSC completely in this case
+                 * to prevent sched_clock() from using it.
+                 */
+                tsc_disabled = 1;
                return;
        }
@@ -441,8 +448,6 @@ void __init tsc_init(void)
        if (check_tsc_unstable()) {
                clocksource_tsc.rating = 0;
                clocksource_tsc.flags &= ~CLOCK_SOURCE_IS_CONTINUOUS;
-        } else
+        }
-                tsc_enabled = 1;
        clocksource_register(&clocksource_tsc);
 }
diff --git a/arch/x86/kernel/tsc_64.c b/arch/x86/kernel/tsc_64.c
index fcc16e58609e..1784b8077a12 100644
--- a/arch/x86/kernel/tsc_64.c
+++ b/arch/x86/kernel/tsc_64.c
@@ -227,14 +227,14 @@ void __init tsc_calibrate(void)
        /* hpet or pmtimer available ? */
        if (!hpet && !pm1 && !pm2) {
                printk(KERN_INFO "TSC calibrated against PIT\n");
-                return;
+                goto out;
        }
        /* Check, whether the sampling was disturbed by an SMI */
        if (tsc1 == ULONG_MAX || tsc2 == ULONG_MAX) {
                printk(KERN_WARNING "TSC calibration disturbed by SMI, "
                       "using PIT calibration result\n");
-                return;
+                goto out;
        }
        tsc2 = (tsc2 - tsc1) * 1000000L;
@@ -255,6 +255,7 @@ void __init tsc_calibrate(void)
        tsc_khz = tsc2 / tsc1;
+out:
        for_each_possible_cpu(cpu)
                set_cyc2ns_scale(tsc_khz, cpu);
 }
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index 7c077a9d9777..f2f5d260874e 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -200,7 +200,6 @@ int __pit_timer_fn(struct kvm_kpit_state *ps)
        atomic_inc(&pt->pending);
        smp_mb__after_atomic_inc();
-        /* FIXME: handle case where the guest is in guest mode */
        if (vcpu0 && waitqueue_active(&vcpu0->wq)) {
                vcpu0->arch.mp_state = KVM_MP_STATE_RUNNABLE;
                wake_up_interruptible(&vcpu0->wq);
@@ -237,6 +236,19 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer *data)
                return HRTIMER_NORESTART;
 }
+void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)
+{
+        struct kvm_pit *pit = vcpu->kvm->arch.vpit;
+        struct hrtimer *timer;
+        if (vcpu->vcpu_id != 0 || !pit)
+                return;
+        timer = &pit->pit_state.pit_timer.timer;
+        if (hrtimer_cancel(timer))
+                hrtimer_start(timer, timer->expires, HRTIMER_MODE_ABS);
+}
 static void destroy_pit_timer(struct kvm_kpit_timer *pt)
 {
        pr_debug("pit: execute del timer!\n");
diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
index ce1f583459b1..76d736b5f664 100644
--- a/arch/x86/kvm/irq.c
+++ b/arch/x86/kvm/irq.c
@@ -94,3 +94,9 @@ void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec)
        /* TODO: PIT, RTC etc. */
 }
 EXPORT_SYMBOL_GPL(kvm_timer_intr_post);
+void __kvm_migrate_timers(struct kvm_vcpu *vcpu)
+{
+        __kvm_migrate_apic_timer(vcpu);
+        __kvm_migrate_pit_timer(vcpu);
+}
diff --git a/arch/x86/kvm/irq.h b/arch/x86/kvm/irq.h
index 1802134b836f..2a15be2275c0 100644
--- a/arch/x86/kvm/irq.h
+++ b/arch/x86/kvm/irq.h
@@ -84,6 +84,8 @@ void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec);
 void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu);
 void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu);
 void __kvm_migrate_apic_timer(struct kvm_vcpu *vcpu);
+void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu);
+void __kvm_migrate_timers(struct kvm_vcpu *vcpu);
 int pit_has_pending_timer(struct kvm_vcpu *vcpu);
 int apic_has_pending_timer(struct kvm_vcpu *vcpu);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 36c5406b1813..ee3f53098f0c 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -658,7 +658,7 @@ static int is_empty_shadow_page(u64 *spt)
        u64 *end;
        for (pos = spt, end = pos + PAGE_SIZE / sizeof(u64); pos != end; pos++)
-                if (*pos != shadow_trap_nonpresent_pte) {
+                if (is_shadow_present_pte(*pos)) {
                        printk(KERN_ERR "%s: %p %llx\n", __func__,
                               pos, *pos);
                        return 0;
@@ -1858,6 +1858,7 @@ static void free_mmu_pages(struct kvm_vcpu *vcpu)
                sp = container_of(vcpu->kvm->arch.active_mmu_pages.next,
                                  struct kvm_mmu_page, link);
                kvm_mmu_zap_page(vcpu->kvm, sp);
+                cond_resched();
        }
        free_page((unsigned long)vcpu->arch.mmu.pae_root);
 }
@@ -1996,7 +1997,7 @@ static struct shrinker mmu_shrinker = {
        .seeks = DEFAULT_SEEKS * 10,
 };
-void mmu_destroy_caches(void)
+static void mmu_destroy_caches(void)
 {
        if (pte_chain_cache)
                kmem_cache_destroy(pte_chain_cache);
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 156fe10288ae..934c7b619396 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -418,7 +418,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
        /* mmio */
        if (is_error_pfn(pfn)) {
-                pgprintk("gfn %x is mmio\n", walker.gfn);
+                pgprintk("gfn %lx is mmio\n", walker.gfn);
                kvm_release_pfn_clean(pfn);
                return 1;
        }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index ab22615eee89..6b0d5fa5bab3 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -688,7 +688,7 @@ static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
                delta = vcpu->arch.host_tsc - tsc_this;
                svm->vmcb->control.tsc_offset += delta;
                vcpu->cpu = cpu;
-                kvm_migrate_apic_timer(vcpu);
+                kvm_migrate_timers(vcpu);
        }
        for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index bfe4db11989c..02efbe75f317 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -608,7 +608,7 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
        if (vcpu->cpu != cpu) {
                vcpu_clear(vmx);
-                kvm_migrate_apic_timer(vcpu);
+                kvm_migrate_timers(vcpu);
                vpid_sync_vcpu_all(vmx);
        }
@@ -1036,6 +1036,7 @@ static void hardware_enable(void *garbage)
 static void hardware_disable(void *garbage)
 {
        asm volatile (ASM_VMX_VMXOFF : : : "cc");
+        write_cr4(read_cr4() & ~X86_CR4_VMXE);
 }
 static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 21338bdb28ff..00acf1301a15 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2758,7 +2758,7 @@ again:
        if (vcpu->requests) {
                if (test_and_clear_bit(KVM_REQ_MIGRATE_TIMER, &vcpu->requests))
-                        __kvm_migrate_apic_timer(vcpu);
+                        __kvm_migrate_timers(vcpu);
                if (test_and_clear_bit(KVM_REQ_REPORT_TPR_ACCESS,
                                       &vcpu->requests)) {
                        kvm_run->exit_reason = KVM_EXIT_TPR_ACCESS;
diff --git a/arch/x86/kvm/x86_emulate.c b/arch/x86/kvm/x86_emulate.c
index 8a96320ab071..932f216d890c 100644
--- a/arch/x86/kvm/x86_emulate.c
+++ b/arch/x86/kvm/x86_emulate.c
@@ -1727,7 +1727,8 @@ twobyte_insn:
                        if (rc)
                                goto done;
-                        kvm_emulate_hypercall(ctxt->vcpu);
+                        /* Let the processor re-execute the fixed hypercall */
+                        c->eip = ctxt->vcpu->arch.rip;
                        /* Disable writeback. */
                        c->dst.type = OP_NONE;
                        break;
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index af65b2da3ba0..5c7e2fd52075 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -582,8 +582,9 @@ static void __init lguest_init_IRQ(void)
                int vector = FIRST_EXTERNAL_VECTOR + i;
                if (vector != SYSCALL_VECTOR) {
                        set_intr_gate(vector, interrupt[i]);
-                        set_irq_chip_and_handler(i, &lguest_irq_controller,
+                        set_irq_chip_and_handler_name(i, &lguest_irq_controller,
-                                                 handle_level_irq);
+                                                      handle_level_irq,
+                                                      "level");
                }
        }
        /* This call is required to set up for 4k stacks, where we have
diff --git a/arch/x86/lib/delay_32.c b/arch/x86/lib/delay_32.c
index 4535e6d147ad..d710f2d167bb 100644
--- a/arch/x86/lib/delay_32.c
+++ b/arch/x86/lib/delay_32.c
@@ -44,13 +44,36 @@ static void delay_loop(unsigned long loops)
 static void delay_tsc(unsigned long loops)
 {
        unsigned long bclock, now;
+        int cpu;
-        preempt_disable();              /* TSC's are per-cpu */
+        preempt_disable();
+        cpu = smp_processor_id();
        rdtscl(bclock);
-        do {
+        for (;;) {
-                rep_nop();
                rdtscl(now);
-        } while ((now-bclock) < loops);
+                if ((now - bclock) >= loops)
+                        break;
+                /* Allow RT tasks to run */
+                preempt_enable();
+                rep_nop();
+                preempt_disable();
+                /*
+                 * It is possible that we moved to another CPU, and
+                 * since TSC's are per-cpu we need to calculate
+                 * that. The delay must guarantee that we wait "at
+                 * least" the amount of time. Being moved to another
+                 * CPU could make the wait longer but we just need to
+                 * make sure we waited long enough. Rebalance the
+                 * counter for this CPU.
+                 */
+                if (unlikely(cpu != smp_processor_id())) {
+                        loops -= (now - bclock);
+                        cpu = smp_processor_id();
+                        rdtscl(bclock);
+                }
+        }
        preempt_enable();
 }
diff --git a/arch/x86/lib/delay_64.c b/arch/x86/lib/delay_64.c
index bbc610518516..4c441be92641 100644
--- a/arch/x86/lib/delay_64.c
+++ b/arch/x86/lib/delay_64.c
@@ -31,14 +31,36 @@ int __devinit read_current_timer(unsigned long *timer_value)
 void __delay(unsigned long loops)
 {
        unsigned bclock, now;
+        int cpu;
-        preempt_disable();              /* TSC's are pre-cpu */
+        preempt_disable();
+        cpu = smp_processor_id();
        rdtscl(bclock);
-        do {
+        for (;;) {
-                rep_nop(); 
                rdtscl(now);
+                if ((now - bclock) >= loops)
+                        break;
+                /* Allow RT tasks to run */
+                preempt_enable();
+                rep_nop();
+                preempt_disable();
+                /*
+                 * It is possible that we moved to another CPU, and
+                 * since TSC's are per-cpu we need to calculate
+                 * that. The delay must guarantee that we wait "at
+                 * least" the amount of time. Being moved to another
+                 * CPU could make the wait longer but we just need to
+                 * make sure we waited long enough. Rebalance the
+                 * counter for this CPU.
+                 */
+                if (unlikely(cpu != smp_processor_id())) {
+                        loops -= (now - bclock);
+                        cpu = smp_processor_id();
+                        rdtscl(bclock);
+                }
        }
-        while ((now-bclock) < loops);
        preempt_enable();
 }
 EXPORT_SYMBOL(__delay);
diff --git a/arch/x86/math-emu/fpu_entry.c b/arch/x86/math-emu/fpu_entry.c
index 6e38d877ea77..c7b06feb139b 100644
--- a/arch/x86/math-emu/fpu_entry.c
+++ b/arch/x86/math-emu/fpu_entry.c
@@ -30,6 +30,7 @@
 #include <asm/uaccess.h>
 #include <asm/desc.h>
 #include <asm/user.h>
+#include <asm/i387.h>
 #include "fpu_system.h"
 #include "fpu_emu.h"
@@ -146,6 +147,13 @@ asmlinkage void math_emulate(long arg)
        unsigned long code_limit = 0;   /* Initialized to stop compiler warnings */
        struct desc_struct code_descriptor;
+        if (!used_math()) {
+                if (init_fpu(current)) {
+                        do_group_exit(SIGKILL);
+                        return;
+                }
+        }
 #ifdef RE_ENTRANT_CHECKING
        if (emulating) {
                printk("ERROR: wm-FPU-emu is not RE-ENTRANT!\n");
@@ -153,11 +161,6 @@ asmlinkage void math_emulate(long arg)
        RE_ENTRANT_CHECK_ON;
 #endif /* RE_ENTRANT_CHECKING */
-        if (!used_math()) {
-                finit();
-                set_used_math();
-        }
        SETUP_DATA_AREA(arg);
        FPU_ORIG_EIP = FPU_EIP;
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index fd7e1798c75a..8bcb6f40ccb6 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -497,6 +497,11 @@ static int vmalloc_fault(unsigned long address)
        unsigned long pgd_paddr;
        pmd_t *pmd_k;
        pte_t *pte_k;
+        /* Make sure we are in vmalloc area */
+        if (!(address >= VMALLOC_START && address < VMALLOC_END))
+                return -1;
        /*
         * Synchronize this task's top level page-table
         * with the 'reference' page table.
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 32ba13b0f818..156e6d7b0e32 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -206,7 +206,7 @@ void __init cleanup_highmap(void)
        pmd_t *last_pmd = pmd + PTRS_PER_PMD;
        for (; pmd < last_pmd; pmd++, vaddr += PMD_SIZE) {
-                if (!pmd_present(*pmd))
+                if (pmd_none(*pmd))
                        continue;
                if (vaddr < (unsigned long) _text || vaddr > end)
                        set_pmd(pmd, __pmd(0));
@@ -506,7 +506,7 @@ early_param("memtest", parse_memtest);
 static void __init early_memtest(unsigned long start, unsigned long end)
 {
-        unsigned long t_start, t_size;
+        u64 t_start, t_size;
        unsigned pattern;
        if (!memtest_pattern)
@@ -525,7 +525,7 @@ static void __init early_memtest(unsigned long start, unsigned long end)
                        if (t_start + t_size > end)
                                t_size = end - t_start;
-                        printk(KERN_CONT "\n  %016lx - %016lx pattern %d",
+                        printk(KERN_CONT "\n  %016llx - %016llx pattern %d",
                                t_start, t_start + t_size, pattern);
                        memtest(t_start, t_size, pattern);
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 71bb3159031a..2b2bb3f9b683 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -593,10 +593,11 @@ void __init early_iounmap(void *addr, unsigned long size)
        unsigned long offset;
        unsigned int nrpages;
        enum fixed_addresses idx;
-        unsigned int nesting;
+        int nesting;
        nesting = --early_ioremap_nested;
-        WARN_ON(nesting < 0);
+        if (WARN_ON(nesting < 0))
+                return;
        if (early_ioremap_debug) {
                printk(KERN_INFO "early_iounmap(%p, %08lx) [%d]\n", addr,
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index de3a99812450..06b7a1c90fb8 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -34,7 +34,7 @@ void __cpuinit pat_disable(char *reason)
        printk(KERN_INFO "%s\n", reason);
 }
-static int nopat(char *str)
+static int __init nopat(char *str)
 {
        pat_disable("PAT support disabled.");
        return 0;
@@ -151,32 +151,33 @@ static int pat_x_mtrr_type(u64 start, u64 end, unsigned long prot,
        unsigned long pat_type;
        u8 mtrr_type;
-        mtrr_type = mtrr_type_lookup(start, end);
-        if (mtrr_type == 0xFF) {                /* MTRR not enabled */
-                *ret_prot = prot;
-                return 0;
-        }
-        if (mtrr_type == 0xFE) {                /* MTRR match error */
-                *ret_prot = _PAGE_CACHE_UC;
-                return -1;
-        }
-        if (mtrr_type != MTRR_TYPE_UNCACHABLE &&
-            mtrr_type != MTRR_TYPE_WRBACK &&
-            mtrr_type != MTRR_TYPE_WRCOMB) {    /* MTRR type unhandled */
-                *ret_prot = _PAGE_CACHE_UC;
-                return -1;
-        }
        pat_type = prot & _PAGE_CACHE_MASK;
        prot &= (~_PAGE_CACHE_MASK);
-        /* Currently doing intersection by hand. Optimize it later. */
+        /*
+         * We return the PAT request directly for types where PAT takes
+         * precedence with respect to MTRR and for UC_MINUS.
+         * Consistency checks with other PAT requests is done later
+         * while going through memtype list.
+         */
        if (pat_type == _PAGE_CACHE_WC) {
                *ret_prot = prot | _PAGE_CACHE_WC;
+                return 0;
        } else if (pat_type == _PAGE_CACHE_UC_MINUS) {
                *ret_prot = prot | _PAGE_CACHE_UC_MINUS;
-        } else if (pat_type == _PAGE_CACHE_UC ||
+                return 0;
-                   mtrr_type == MTRR_TYPE_UNCACHABLE) {
+        } else if (pat_type == _PAGE_CACHE_UC) {
+                *ret_prot = prot | _PAGE_CACHE_UC;
+                return 0;
+        }
+        /*
+         * Look for MTRR hint to get the effective type in case where PAT
+         * request is for WB.
+         */
+        mtrr_type = mtrr_type_lookup(start, end);
+        if (mtrr_type == MTRR_TYPE_UNCACHABLE) {
                *ret_prot = prot | _PAGE_CACHE_UC;
        } else if (mtrr_type == MTRR_TYPE_WRCOMB) {
                *ret_prot = prot | _PAGE_CACHE_WC;
@@ -233,14 +234,12 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
        if (req_type == -1) {
                /*
-                 * Special case where caller wants to inherit from mtrr or
+                 * Call mtrr_lookup to get the type hint. This is an
-                 * existing pat mapping, defaulting to UC_MINUS in case of
+                 * optimization for /dev/mem mmap'ers into WB memory (BIOS
-                 * no match.
+                 * tools and ACPI tools). Use WB request for WB memory and use
+                 * UC_MINUS otherwise.
                 */
                u8 mtrr_type = mtrr_type_lookup(start, end);
-                if (mtrr_type == 0xFE) { /* MTRR match error */
-                        err = -1;
-                }
                if (mtrr_type == MTRR_TYPE_WRBACK) {
                        req_type = _PAGE_CACHE_WB;
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index 3890234e5b26..99649dccad28 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -97,36 +97,9 @@ static __init inline int srat_disabled(void)
        return numa_off || acpi_numa < 0;
 }
-/*
- * A lot of BIOS fill in 10 (= no distance) everywhere. This messes
- * up the NUMA heuristics which wants the local node to have a smaller
- * distance than the others.
- * Do some quick checks here and only use the SLIT if it passes.
- */
-static __init int slit_valid(struct acpi_table_slit *slit)
-{
-        int i, j;
-        int d = slit->locality_count;
-        for (i = 0; i < d; i++) {
-                for (j = 0; j < d; j++)  {
-                        u8 val = slit->entry[d*i + j];
-                        if (i == j) {
-                                if (val != LOCAL_DISTANCE)
-                                        return 0;
-                        } else if (val <= LOCAL_DISTANCE)
-                                return 0;
-                }
-        }
-        return 1;
-}
 /* Callback for SLIT parsing */
 void __init acpi_numa_slit_init(struct acpi_table_slit *slit)
 {
-        if (!slit_valid(slit)) {
-                printk(KERN_INFO "ACPI: SLIT table looks invalid. Not used.\n");
-                return;
-        }
        acpi_slit = slit;
 }
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index 6e64aaf00d1d..940185ecaeda 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -328,18 +328,18 @@ static struct dmi_system_id __devinitdata pciprobe_dmi_table[] = {
 #endif
        {
                .callback = set_bf_sort,
-                .ident = "HP ProLiant DL385 G2",
+                .ident = "HP ProLiant DL360",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "HP"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL385 G2"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL360"),
                },
        },
        {
                .callback = set_bf_sort,
-                .ident = "HP ProLiant DL585 G2",
+                .ident = "HP ProLiant DL380",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "HP"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL585 G2"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL380"),
                },
        },
        {}
diff --git a/arch/x86/pci/init.c b/arch/x86/pci/init.c
index e70b9c57b88e..b821f4462d99 100644
--- a/arch/x86/pci/init.c
+++ b/arch/x86/pci/init.c
@@ -15,7 +15,8 @@ static __init int pci_access_init(void)
        pci_mmcfg_early_init();
 #ifdef CONFIG_PCI_OLPC
-        pci_olpc_init();
+        if (!pci_olpc_init())
+                return 0;       /* skip additional checks if it's an XO */
 #endif
 #ifdef CONFIG_PCI_BIOS
        pci_pcbios_init();
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index 0908fca901bf..ca8df9c260bc 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -621,6 +621,13 @@ static __init int via_router_probe(struct irq_router *r,
                         */
                        device = PCI_DEVICE_ID_VIA_8235;
                        break;
+                case PCI_DEVICE_ID_VIA_8237:
+                        /**
+                         * Asus a7v600 bios wrongly reports 8237
+                         * as 586-compatible
+                         */
+                        device = PCI_DEVICE_ID_VIA_8237;
+                        break;
                }
        }
diff --git a/arch/x86/pci/olpc.c b/arch/x86/pci/olpc.c
index 5e7636558c02..e11e9e803d5f 100644
--- a/arch/x86/pci/olpc.c
+++ b/arch/x86/pci/olpc.c
@@ -302,12 +302,13 @@ static struct pci_raw_ops pci_olpc_conf = {
        .write = pci_olpc_write,
 };
-void __init pci_olpc_init(void)
+int __init pci_olpc_init(void)
 {
        if (!machine_is_olpc() || olpc_has_vsa())
-                return;
+                return -ENODEV;
        printk(KERN_INFO "PCI: Using configuration type OLPC\n");
        raw_pci_ops = &pci_olpc_conf;
        is_lx = is_geode_lx();
+        return 0;
 }
diff --git a/arch/x86/pci/pci.h b/arch/x86/pci/pci.h
index f3972b12c60a..720c4c554534 100644
--- a/arch/x86/pci/pci.h
+++ b/arch/x86/pci/pci.h
@@ -101,7 +101,7 @@ extern struct pci_raw_ops pci_direct_conf1;
 extern int pci_direct_probe(void);
 extern void pci_direct_init(int type);
 extern void pci_pcbios_init(void);
-extern void pci_olpc_init(void);
+extern int pci_olpc_init(void);
 /* pci-mmconfig.c */
diff --git a/arch/x86/vdso/vclock_gettime.c b/arch/x86/vdso/vclock_gettime.c
index 23476c2ebfc4..efa2ba7c6005 100644
--- a/arch/x86/vdso/vclock_gettime.c
+++ b/arch/x86/vdso/vclock_gettime.c
@@ -106,9 +106,9 @@ int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
                do_realtime((struct timespec *)tv);
                tv->tv_usec /= 1000;
                if (unlikely(tz != NULL)) {
-                        /* This relies on gcc inlining the memcpy. We'll notice
+                        /* Avoid memcpy. Some old compilers fail to inline it */
-                           if it ever fails to do so. */
+                        tz->tz_minuteswest = gtod->sys_tz.tz_minuteswest;
-                        memcpy(tz, &gtod->sys_tz, sizeof(struct timezone));
+                        tz->tz_dsttime = gtod->sys_tz.tz_dsttime;
                }
                return 0;
        }
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 126766d43aea..3525ef523a74 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -60,7 +60,7 @@ xmaddr_t arbitrary_virt_to_machine(unsigned long address)
 {
        unsigned int level;
        pte_t *pte = lookup_address(address, &level);
-        unsigned offset = address & PAGE_MASK;
+        unsigned offset = address & ~PAGE_MASK;
        BUG_ON(pte == NULL);
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index c39e1a5aa241..52b2e3856980 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -12,6 +12,7 @@
 #include <linux/clocksource.h>
 #include <linux/clockchips.h>
 #include <linux/kernel_stat.h>
+#include <linux/math64.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
@@ -150,11 +151,7 @@ static void do_stolen_accounting(void)
        if (stolen < 0)
                stolen = 0;
-        ticks = 0;
+        ticks = iter_div_u64_rem(stolen, NS_PER_TICK, &stolen);
-        while (stolen >= NS_PER_TICK) {
-                ticks++;
-                stolen -= NS_PER_TICK;
-        }
        __get_cpu_var(residual_stolen) = stolen;
        account_steal_time(NULL, ticks);
@@ -166,11 +163,7 @@ static void do_stolen_accounting(void)
        if (blocked < 0)
                blocked = 0;
-        ticks = 0;
+        ticks = iter_div_u64_rem(blocked, NS_PER_TICK, &blocked);
-        while (blocked >= NS_PER_TICK) {
-                ticks++;
-                blocked -= NS_PER_TICK;
-        }
        __get_cpu_var(residual_blocked) = blocked;
        account_steal_time(idle_task(smp_processor_id()), ticks);
 }
diff --git a/block/blk-core.c b/block/blk-core.c
index 75fdc65136e8..af094ff48357 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -806,35 +806,32 @@ static struct request *get_request_wait(struct request_queue *q, int rw_flags,
        rq = get_request(q, rw_flags, bio, GFP_NOIO);
        while (!rq) {
                DEFINE_WAIT(wait);
+                struct io_context *ioc;
                struct request_list *rl = &q->rq;
                prepare_to_wait_exclusive(&rl->wait[rw], &wait,
                                TASK_UNINTERRUPTIBLE);
-                rq = get_request(q, rw_flags, bio, GFP_NOIO);
+                blk_add_trace_generic(q, bio, rw, BLK_TA_SLEEPRQ);
-                if (!rq) {
-                        struct io_context *ioc;
-                        blk_add_trace_generic(q, bio, rw, BLK_TA_SLEEPRQ);
+                __generic_unplug_device(q);
+                spin_unlock_irq(q->queue_lock);
-                        __generic_unplug_device(q);
+                io_schedule();
-                        spin_unlock_irq(q->queue_lock);
-                        io_schedule();
-                        /*
+                /*
-                         * After sleeping, we become a "batching" process and
+                 * After sleeping, we become a "batching" process and
-                         * will be able to allocate at least one request, and
+                 * will be able to allocate at least one request, and
-                         * up to a big batch of them for a small period time.
+                 * up to a big batch of them for a small period time.
-                         * See ioc_batching, ioc_set_batching
+                 * See ioc_batching, ioc_set_batching
-                         */
+                 */
-                        ioc = current_io_context(GFP_NOIO, q->node);
+                ioc = current_io_context(GFP_NOIO, q->node);
-                        ioc_set_batching(q, ioc);
+                ioc_set_batching(q, ioc);
-                        spin_lock_irq(q->queue_lock);
+                spin_lock_irq(q->queue_lock);
-                }
                finish_wait(&rl->wait[rw], &wait);
-        }
+                rq = get_request(q, rw_flags, bio, GFP_NOIO);
+        };
        return rq;
 }
diff --git a/block/blktrace.c b/block/blktrace.c
index b2cbb4e5d767..8d3a27780260 100644
--- a/block/blktrace.c
+++ b/block/blktrace.c
@@ -75,6 +75,24 @@ static void trace_note_time(struct blk_trace *bt)
        local_irq_restore(flags);
 }
+void __trace_note_message(struct blk_trace *bt, const char *fmt, ...)
+{
+        int n;
+        va_list args;
+        unsigned long flags;
+        char *buf;
+        local_irq_save(flags);
+        buf = per_cpu_ptr(bt->msg_data, smp_processor_id());
+        va_start(args, fmt);
+        n = vscnprintf(buf, BLK_TN_MAX_MSG, fmt, args);
+        va_end(args);
+        trace_note(bt, 0, BLK_TN_MESSAGE, buf, n);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL_GPL(__trace_note_message);
 static int act_log_check(struct blk_trace *bt, u32 what, sector_t sector,
                         pid_t pid)
 {
@@ -141,10 +159,7 @@ void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
        /*
         * A word about the locking here - we disable interrupts to reserve
         * some space in the relay per-cpu buffer, to prevent an irq
-         * from coming in and stepping on our toes. Once reserved, it's
+         * from coming in and stepping on our toes.
-         * enough to get preemption disabled to prevent read of this data
-         * before we are through filling it. get_cpu()/put_cpu() does this
-         * for us
         */
        local_irq_save(flags);
@@ -232,6 +247,7 @@ static void blk_trace_cleanup(struct blk_trace *bt)
        debugfs_remove(bt->dropped_file);
        blk_remove_tree(bt->dir);
        free_percpu(bt->sequence);
+        free_percpu(bt->msg_data);
        kfree(bt);
 }
@@ -346,6 +362,10 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
        if (!bt->sequence)
                goto err;
+        bt->msg_data = __alloc_percpu(BLK_TN_MAX_MSG);
+        if (!bt->msg_data)
+                goto err;
        ret = -ENOENT;
        dir = blk_create_tree(buts->name);
        if (!dir)
@@ -392,6 +412,7 @@ err:
                if (bt->dropped_file)
                        debugfs_remove(bt->dropped_file);
                free_percpu(bt->sequence);
+                free_percpu(bt->msg_data);
                if (bt->rchan)
                        relay_close(bt->rchan);
                kfree(bt);
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index b399c62936e0..d01b411c72f0 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -124,6 +124,8 @@ struct cfq_data {
 struct cfq_queue {
        /* reference count */
        atomic_t ref;
+        /* various state flags, see below */
+        unsigned int flags;
        /* parent cfq_data */
        struct cfq_data *cfqd;
        /* service_tree member */
@@ -138,14 +140,14 @@ struct cfq_queue {
        int queued[2];
        /* currently allocated requests */
        int allocated[2];
-        /* pending metadata requests */
-        int meta_pending;
        /* fifo list of requests in sort_list */
        struct list_head fifo;
        unsigned long slice_end;
        long slice_resid;
+        /* pending metadata requests */
+        int meta_pending;
        /* number of requests that are on the dispatch list or inside driver */
        int dispatched;
@@ -153,8 +155,6 @@ struct cfq_queue {
        unsigned short ioprio, org_ioprio;
        unsigned short ioprio_class, org_ioprio_class;
-        /* various state flags, see below */
-        unsigned int flags;
 };
 enum cfqq_state_flags {
@@ -1142,6 +1142,9 @@ static void cfq_put_queue(struct cfq_queue *cfqq)
        kmem_cache_free(cfq_pool, cfqq);
 }
+/*
+ * Must always be called with the rcu_read_lock() held
+ */
 static void
 __call_for_each_cic(struct io_context *ioc,
                    void (*func)(struct io_context *, struct cfq_io_context *))
@@ -1197,6 +1200,11 @@ static void cic_free_func(struct io_context *ioc, struct cfq_io_context *cic)
        cfq_cic_free(cic);
 }
+/*
+ * Must be called with rcu_read_lock() held or preemption otherwise disabled.
+ * Only two callers of this - ->dtor() which is called with the rcu_read_lock(),
+ * and ->trim() which is called with the task lock held
+ */
 static void cfq_free_io_context(struct io_context *ioc)
 {
        /*
@@ -1502,20 +1510,24 @@ static struct cfq_io_context *
 cfq_cic_lookup(struct cfq_data *cfqd, struct io_context *ioc)
 {
        struct cfq_io_context *cic;
+        unsigned long flags;
        void *k;
        if (unlikely(!ioc))
                return NULL;
+        rcu_read_lock();
        /*
         * we maintain a last-hit cache, to avoid browsing over the tree
         */
        cic = rcu_dereference(ioc->ioc_data);
-        if (cic && cic->key == cfqd)
+        if (cic && cic->key == cfqd) {
+                rcu_read_unlock();
                return cic;
+        }
        do {
-                rcu_read_lock();
                cic = radix_tree_lookup(&ioc->radix_root, (unsigned long) cfqd);
                rcu_read_unlock();
                if (!cic)
@@ -1524,10 +1536,13 @@ cfq_cic_lookup(struct cfq_data *cfqd, struct io_context *ioc)
                k = cic->key;
                if (unlikely(!k)) {
                        cfq_drop_dead_cic(cfqd, ioc, cic);
+                        rcu_read_lock();
                        continue;
                }
+                spin_lock_irqsave(&ioc->lock, flags);
                rcu_assign_pointer(ioc->ioc_data, cic);
+                spin_unlock_irqrestore(&ioc->lock, flags);
                break;
        } while (1);
@@ -2134,6 +2149,10 @@ static void *cfq_init_queue(struct request_queue *q)
 static void cfq_slab_kill(void)
 {
+        /*
+         * Caller already ensured that pending RCU callbacks are completed,
+         * so we should have no busy allocations at this point.
+         */
        if (cfq_pool)
                kmem_cache_destroy(cfq_pool);
        if (cfq_ioc_pool)
@@ -2292,6 +2311,11 @@ static void __exit cfq_exit(void)
        ioc_gone = &all_gone;
        /* ioc_gone's update must be visible before reading ioc_count */
        smp_wmb();
+        /*
+         * this also protects us from entering cfq_slab_kill() with
+         * pending RCU callbacks
+         */
        if (elv_ioc_count_read(ioc_count))
                wait_for_completion(ioc_gone);
        cfq_slab_kill();
diff --git a/block/elevator.c b/block/elevator.c
index 980f8ae147b4..902dd1344d56 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -1110,6 +1110,8 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
        queue_flag_clear(QUEUE_FLAG_ELVSWITCH, q);
        spin_unlock_irq(q->queue_lock);
+        blk_add_trace_msg(q, "elv switch: %s", e->elevator_type->elevator_name);
        return 1;
 fail_register:
diff --git a/block/genhd.c b/block/genhd.c
index 129ad939f9dd..b922d4801c87 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -660,6 +660,8 @@ dev_t blk_lookup_devt(const char *name, int part)
        mutex_lock(&block_class_lock);
        list_for_each_entry(dev, &block_class.devices, node) {
+                if (dev->type != &disk_type)
+                        continue;
                if (strcmp(dev->bus_id, name) == 0) {
                        struct gendisk *disk = dev_to_disk(dev);
diff --git a/crypto/cts.c b/crypto/cts.c
index c4e70bfb4970..ccf9c5de3958 100644
--- a/crypto/cts.c
+++ b/crypto/cts.c
@@ -89,6 +89,9 @@ static int cts_cbc_encrypt(struct crypto_cts_ctx *ctx,
        if (lastn < 0)
                return -EINVAL;
+        sg_init_table(sgsrc, 1);
+        sg_init_table(sgdst, 1);
        memset(s, 0, sizeof(s));
        scatterwalk_map_and_copy(s, src, offset, nbytes, 0);
@@ -172,6 +175,9 @@ static int cts_cbc_decrypt(struct crypto_cts_ctx *ctx,
        if (lastn < 0)
                return -EINVAL;
+        sg_init_table(sgsrc, 1);
+        sg_init_table(sgdst, 1);
        scatterwalk_map_and_copy(s, src, offset, nbytes, 0);
        lcldesc.tfm = ctx->child;
diff --git a/drivers/acpi/bay.c b/drivers/acpi/bay.c
index d2fc94161848..26038c2a2a71 100644
--- a/drivers/acpi/bay.c
+++ b/drivers/acpi/bay.c
@@ -301,16 +301,20 @@ static int bay_add(acpi_handle handle, int id)
         */
        pdev->dev.uevent_suppress = 0;
-        if (acpi_bay_add_fs(new_bay)) {
-                platform_device_unregister(new_bay->pdev);
-                goto bay_add_err;
-        }
        /* register for events on this device */
        status = acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
                        bay_notify, new_bay);
        if (ACPI_FAILURE(status)) {
-                printk(KERN_ERR PREFIX "Error installing bay notify handler\n");
+                printk(KERN_INFO PREFIX "Error installing bay notify handler\n");
+                platform_device_unregister(new_bay->pdev);
+                goto bay_add_err;
+        }
+        if (acpi_bay_add_fs(new_bay)) {
+                acpi_remove_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
+                                           bay_notify);
+                platform_device_unregister(new_bay->pdev);
+                goto bay_add_err;
        }
        /* if we are on a dock station, we should register for dock
diff --git a/drivers/acpi/dispatcher/dsfield.c b/drivers/acpi/dispatcher/dsfield.c
index c78078315be9..f988a5e7d2b4 100644
--- a/drivers/acpi/dispatcher/dsfield.c
+++ b/drivers/acpi/dispatcher/dsfield.c
@@ -450,10 +450,6 @@ acpi_ds_init_field_objects(union acpi_parse_object *op,
                return_ACPI_STATUS(AE_BAD_PARAMETER);
        }
-        if (!arg) {
-                return_ACPI_STATUS(AE_AML_NO_OPERAND);
-        }
        /* Creating new namespace node(s), should not already exist */
        flags = ACPI_NS_NO_UPSEARCH | ACPI_NS_DONT_OPEN_SCOPE |
@@ -467,6 +463,7 @@ acpi_ds_init_field_objects(union acpi_parse_object *op,
        /*
         * Walk the list of entries in the field_list
+         * Note: field_list can be of zero length. In this case, Arg will be NULL.
         */
        while (arg) {
                /*
diff --git a/drivers/acpi/dispatcher/dsmethod.c b/drivers/acpi/dispatcher/dsmethod.c
index e48a3ea03117..2509809a36cf 100644
--- a/drivers/acpi/dispatcher/dsmethod.c
+++ b/drivers/acpi/dispatcher/dsmethod.c
@@ -565,7 +565,7 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
                                acpi_os_release_mutex(method_desc->method.
                                                      mutex->mutex.os_mutex);
-                                method_desc->method.mutex->mutex.thread_id = 0;
+                                method_desc->method.mutex->mutex.thread_id = NULL;
                        }
                }
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index fa44fb96fc34..96c542f7fded 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -834,7 +834,7 @@ static int dock_add(acpi_handle handle)
                goto dock_add_err;
        }
-        printk(KERN_INFO PREFIX "%s \n", ACPI_DOCK_DRIVER_DESCRIPTION);
+        printk(KERN_INFO PREFIX "%s\n", ACPI_DOCK_DRIVER_DESCRIPTION);
        return 0;
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 0924992187e8..5622aee996b2 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -194,7 +194,7 @@ static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event, int force_poll)
                while (time_before(jiffies, delay)) {
                        if (acpi_ec_check_status(ec, event))
                                return 0;
-                        udelay(ACPI_EC_UDELAY);
+                        msleep(1);
                }
        }
        pr_err(PREFIX "acpi_ec_wait timeout, status = 0x%2.2x, event = %s\n",
diff --git a/drivers/acpi/executer/exconfig.c b/drivers/acpi/executer/exconfig.c
index 24da921d13e3..39d742190584 100644
--- a/drivers/acpi/executer/exconfig.c
+++ b/drivers/acpi/executer/exconfig.c
@@ -375,9 +375,15 @@ acpi_ex_load_op(union acpi_operand_object *obj_desc,
                goto cleanup;
        }
+        /*
+         * Add the table to the namespace.
+         *
+         * Note: We load the table objects relative to the root of the namespace.
+         * This appears to go against the ACPI specification, but we do it for
+         * compatibility with other ACPI implementations.
+         */
        status =
-            acpi_ex_add_table(table_index, walk_state->scope_info->scope.node,
+            acpi_ex_add_table(table_index, acpi_gbl_root_node, &ddb_handle);
-                              &ddb_handle);
        if (ACPI_FAILURE(status)) {
                /* On error, table_ptr was deallocated above */
diff --git a/drivers/acpi/executer/exmutex.c b/drivers/acpi/executer/exmutex.c
index c873ab40cd0e..a8bf3d713e28 100644
--- a/drivers/acpi/executer/exmutex.c
+++ b/drivers/acpi/executer/exmutex.c
@@ -326,7 +326,7 @@ acpi_status acpi_ex_release_mutex_object(union acpi_operand_object *obj_desc)
        /* Clear mutex info */
-        obj_desc->mutex.thread_id = 0;
+        obj_desc->mutex.thread_id = NULL;
        return_ACPI_STATUS(status);
 }
@@ -463,7 +463,7 @@ void acpi_ex_release_all_mutexes(struct acpi_thread_state *thread)
                /* Mark mutex unowned */
                obj_desc->mutex.owner_thread = NULL;
-                obj_desc->mutex.thread_id = 0;
+                obj_desc->mutex.thread_id = NULL;
                /* Update Thread sync_level (Last mutex is the important one) */
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 06f8634fe58b..2808dc60fd67 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -272,6 +272,12 @@ static u32 rtc_handler(void *context)
 static inline void rtc_wake_setup(void)
 {
        acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, NULL);
+        /*
+         * After the RTC handler is installed, the Fixed_RTC event should
+         * be disabled. Only when the RTC alarm is set will it be enabled.
+         */
+        acpi_clear_event(ACPI_EVENT_RTC);
+        acpi_disable_event(ACPI_EVENT_RTC, 0);
 }
 static void rtc_wake_on(struct device *dev)
diff --git a/drivers/acpi/hardware/hwsleep.c b/drivers/acpi/hardware/hwsleep.c
index d9937e05ec6a..dba3cfbe8cba 100644
--- a/drivers/acpi/hardware/hwsleep.c
+++ b/drivers/acpi/hardware/hwsleep.c
@@ -223,15 +223,17 @@ acpi_status acpi_enter_sleep_state_prep(u8 sleep_state)
                break;
        }
-        /* Set the system indicators to show the desired sleep state. */
+        /*
+         * Set the system indicators to show the desired sleep state.
+         * _SST is an optional method (return no error if not found)
+         */
        status = acpi_evaluate_object(NULL, METHOD_NAME__SST, &arg_list, NULL);
        if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
                ACPI_EXCEPTION((AE_INFO, status,
                                "While executing method _SST"));
        }
-        return_ACPI_STATUS(status);
+        return_ACPI_STATUS(AE_OK);
 }
 ACPI_EXPORT_SYMBOL(acpi_enter_sleep_state_prep)
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index 5d59cb33b1a5..658e5f3abae0 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -140,19 +140,42 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header)
        }
 }
+/*
+ * A lot of BIOS fill in 10 (= no distance) everywhere. This messes
+ * up the NUMA heuristics which wants the local node to have a smaller
+ * distance than the others.
+ * Do some quick checks here and only use the SLIT if it passes.
+ */
+static __init int slit_valid(struct acpi_table_slit *slit)
+{
+        int i, j;
+        int d = slit->locality_count;
+        for (i = 0; i < d; i++) {
+                for (j = 0; j < d; j++)  {
+                        u8 val = slit->entry[d*i + j];
+                        if (i == j) {
+                                if (val != LOCAL_DISTANCE)
+                                        return 0;
+                        } else if (val <= LOCAL_DISTANCE)
+                                return 0;
+                }
+        }
+        return 1;
+}
 static int __init acpi_parse_slit(struct acpi_table_header *table)
 {
        struct acpi_table_slit *slit;
-        u32 localities;
        if (!table)
                return -EINVAL;
        slit = (struct acpi_table_slit *)table;
-        /* downcast just for %llu vs %lu for i386/ia64  */
+        if (!slit_valid(slit)) {
-        localities = (u32) slit->locality_count;
+                printk(KERN_INFO "ACPI: SLIT table looks invalid. Not used.\n");
+                return -EINVAL;
+        }
        acpi_numa_slit_init(slit);
        return 0;
diff --git a/drivers/acpi/parser/psargs.c b/drivers/acpi/parser/psargs.c
index f1e8bf65e24e..e94463778845 100644
--- a/drivers/acpi/parser/psargs.c
+++ b/drivers/acpi/parser/psargs.c
@@ -268,7 +268,7 @@ acpi_ps_get_next_namepath(struct acpi_walk_state *walk_state,
         */
        if (ACPI_SUCCESS(status) &&
            possible_method_call && (node->type == ACPI_TYPE_METHOD)) {
-                if (walk_state->op->common.aml_opcode == AML_UNLOAD_OP) {
+                if (walk_state->opcode == AML_UNLOAD_OP) {
                        /*
                         * acpi_ps_get_next_namestring has increased the AML pointer,
                         * so we need to restore the saved AML pointer for method call.
@@ -691,7 +691,7 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
                        /* To support super_name arg of Unload */
-                        if (walk_state->op->common.aml_opcode == AML_UNLOAD_OP) {
+                        if (walk_state->opcode == AML_UNLOAD_OP) {
                                status =
                                    acpi_ps_get_next_namepath(walk_state,
                                                              parser_state, arg,
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 386e5aa48834..9dd0fa93b9e1 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -86,7 +86,6 @@ static int acpi_processor_info_open_fs(struct inode *inode, struct file *file);
 static void acpi_processor_notify(acpi_handle handle, u32 event, void *data);
 static acpi_status acpi_processor_hotadd_init(acpi_handle handle, int *p_cpu);
 static int acpi_processor_handle_eject(struct acpi_processor *pr);
-extern int acpi_processor_tstate_has_changed(struct acpi_processor *pr);
 static const struct acpi_device_id processor_device_ids[] = {
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 2dd2c1f3a01c..556ee1585192 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1669,6 +1669,7 @@ static int acpi_processor_setup_cpuidle(struct acpi_processor *pr)
                return -EINVAL;
        }
+        dev->cpu = pr->id;
        for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
                dev->states[i].name[0] = '\0';
                dev->states[i].desc[0] = '\0';
@@ -1738,7 +1739,7 @@ static int acpi_processor_setup_cpuidle(struct acpi_processor *pr)
 int acpi_processor_cst_has_changed(struct acpi_processor *pr)
 {
-        int ret;
+        int ret = 0;
        if (boot_option_idle_override)
                return 0;
@@ -1756,8 +1757,10 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
        cpuidle_pause_and_lock();
        cpuidle_disable_device(&pr->power.dev);
        acpi_processor_get_power_info(pr);
-        acpi_processor_setup_cpuidle(pr);
+        if (pr->flags.power) {
-        ret = cpuidle_enable_device(&pr->power.dev);
+                acpi_processor_setup_cpuidle(pr);
+                ret = cpuidle_enable_device(&pr->power.dev);
+        }
        cpuidle_resume_and_unlock();
        return ret;
@@ -1813,7 +1816,6 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
        if (pr->flags.power) {
 #ifdef CONFIG_CPU_IDLE
                acpi_processor_setup_cpuidle(pr);
-                pr->power.dev.cpu = pr->id;
                if (cpuidle_register_device(&pr->power.dev))
                        return -EIO;
 #endif
@@ -1850,8 +1852,7 @@ int acpi_processor_power_exit(struct acpi_processor *pr,
                return 0;
 #ifdef CONFIG_CPU_IDLE
-        if (pr->flags.power)
+        cpuidle_unregister_device(&pr->power.dev);
-                cpuidle_unregister_device(&pr->power.dev);
 #endif
        pr->flags.power_setup_done = 0;
diff --git a/drivers/acpi/sleep/proc.c b/drivers/acpi/sleep/proc.c
index 8a5fe8710513..224c57c03381 100644
--- a/drivers/acpi/sleep/proc.c
+++ b/drivers/acpi/sleep/proc.c
@@ -495,6 +495,12 @@ static int __init acpi_sleep_proc_init(void)
                    acpi_root_dir, &acpi_system_alarm_fops);
        acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, NULL);
+        /*
+         * Disable the RTC event after installing RTC handler.
+         * Only when RTC alarm is set will it be enabled.
+         */
+        acpi_clear_event(ACPI_EVENT_RTC);
+        acpi_disable_event(ACPI_EVENT_RTC, 0);
 #endif                          /* HAVE_ACPI_LEGACY_ALARM */
        /* 'wakeup device' [R/W] */
diff --git a/drivers/acpi/system.c b/drivers/acpi/system.c
index 769f24855eb6..5bd2dec9a7ac 100644
--- a/drivers/acpi/system.c
+++ b/drivers/acpi/system.c
@@ -77,7 +77,6 @@ static ssize_t acpi_table_show(struct kobject *kobj,
            container_of(bin_attr, struct acpi_table_attr, attr);
        struct acpi_table_header *table_header = NULL;
        acpi_status status;
-        ssize_t ret_count = count;
        status =
            acpi_get_table(table_attr->name, table_attr->instance,
@@ -85,18 +84,8 @@ static ssize_t acpi_table_show(struct kobject *kobj,
        if (ACPI_FAILURE(status))
                return -ENODEV;
-        if (offset >= table_header->length) {
+        return memory_read_from_buffer(buf, count, &offset,
-                ret_count = 0;
+                                        table_header, table_header->length);
-                goto end;
-        }
-        if (offset + ret_count > table_header->length)
-                ret_count = table_header->length - offset;
-        memcpy(buf, ((char *)table_header) + offset, ret_count);
-      end:
-        return ret_count;
 }
 static void acpi_table_attr_init(struct acpi_table_attr *table_attr,
diff --git a/drivers/acpi/tables/tbinstal.c b/drivers/acpi/tables/tbinstal.c
index 402f93e1ff20..5336ce88f89f 100644
--- a/drivers/acpi/tables/tbinstal.c
+++ b/drivers/acpi/tables/tbinstal.c
@@ -123,24 +123,13 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc,
                }
        }
-        /* The table must be either an SSDT or a PSDT or an OEMx */
+        /*
+         * Originally, we checked the table signature for "SSDT" or "PSDT" here.
-        if (!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_PSDT)&&
+         * Next, we added support for OEMx tables, signature "OEM".
-            !ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_SSDT)&&
+         * Valid tables were encountered with a null signature, so we've just
-            strncmp(table_desc->pointer->signature, "OEM", 3)) {
+         * given up on validating the signature, since it seems to be a waste
-                /* Check for a printable name */
+         * of code. The original code was removed (05/2008).
-                if (acpi_ut_valid_acpi_name(
+         */
-                        *(u32 *) table_desc->pointer->signature)) {
-                        ACPI_ERROR((AE_INFO, "Table has invalid signature "
-                                        "[%4.4s], must be SSDT or PSDT",
-                                    table_desc->pointer->signature));
-                } else {
-                        ACPI_ERROR((AE_INFO, "Table has invalid signature "
-                                        "(0x%8.8X), must be SSDT or PSDT",
-                                    *(u32 *) table_desc->pointer->signature));
-                }
-                return_ACPI_STATUS(AE_BAD_SIGNATURE);
-        }
        (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
diff --git a/drivers/acpi/tables/tbxface.c b/drivers/acpi/tables/tbxface.c
index fb57b93c2495..0e319604d3e7 100644
--- a/drivers/acpi/tables/tbxface.c
+++ b/drivers/acpi/tables/tbxface.c
@@ -540,7 +540,7 @@ static acpi_status acpi_tb_load_namespace(void)
                acpi_tb_print_table_header(0, table);
                if (no_auto_ssdt == 0) {
-                        printk(KERN_WARNING "ACPI: DSDT override uses original SSDTs unless \"acpi_no_auto_ssdt\"");
+                        printk(KERN_WARNING "ACPI: DSDT override uses original SSDTs unless \"acpi_no_auto_ssdt\"\n");
                }
        }
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 504385b1f211..84c795fb9b1e 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -364,10 +364,17 @@ static int acpi_thermal_trips_update(struct acpi_thermal *tz, int flag)
        if (flag & ACPI_TRIPS_CRITICAL) {
                status = acpi_evaluate_integer(tz->device->handle,
                                "_CRT", NULL, &tz->trips.critical.temperature);
-                if (ACPI_FAILURE(status)) {
+                /*
+                 * Treat freezing temperatures as invalid as well; some
+                 * BIOSes return really low values and cause reboots at startup.
+                 * Below zero (Celcius) values clearly aren't right for sure..
+                 * ... so lets discard those as invalid.
+                 */
+                if (ACPI_FAILURE(status) ||
+                                tz->trips.critical.temperature <= 2732) {
                        tz->trips.critical.flags.valid = 0;
                        ACPI_EXCEPTION((AE_INFO, status,
-                                        "No critical threshold"));
+                                        "No or invalid critical threshold"));
                        return -ENODEV;
                } else {
                        tz->trips.critical.flags.valid = 1;
diff --git a/drivers/acpi/utilities/utmisc.c b/drivers/acpi/utilities/utmisc.c
index e4ba7192cd15..1f057b71db1a 100644
--- a/drivers/acpi/utilities/utmisc.c
+++ b/drivers/acpi/utilities/utmisc.c
@@ -1048,6 +1048,7 @@ acpi_ut_exception(char *module_name,
        va_start(args, format);
        acpi_os_vprintf(format, args);
        acpi_os_printf(" [%X]\n", ACPI_CA_VERSION);
+        va_end(args);
 }
 EXPORT_SYMBOL(acpi_ut_exception);
@@ -1063,7 +1064,6 @@ acpi_ut_warning(char *module_name, u32 line_number, char *format, ...)
        acpi_os_vprintf(format, args);
        acpi_os_printf(" [%X]\n", ACPI_CA_VERSION);
        va_end(args);
-        va_end(args);
 }
 void ACPI_INTERNAL_VAR_XFACE
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 97f83fb2ee2e..966ab401e523 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -89,6 +89,7 @@ enum {
        board_ahci_sb600        = 3,
        board_ahci_mv           = 4,
        board_ahci_sb700        = 5,
+        board_ahci_mcp65        = 6,
        /* global controller registers */
        HOST_CAP                = 0x00, /* host capabilities */
@@ -190,6 +191,7 @@ enum {
        AHCI_HFLAG_NO_PMP               = (1 << 6), /* no PMP */
        AHCI_HFLAG_NO_HOTPLUG           = (1 << 7), /* ignore PxSERR.DIAG.N */
        AHCI_HFLAG_SECT255              = (1 << 8), /* max 255 sectors */
+        AHCI_HFLAG_YES_NCQ              = (1 << 9), /* force NCQ cap on */
        /* ap->flags bits */
@@ -253,6 +255,8 @@ static void ahci_pmp_attach(struct ata_port *ap);
 static void ahci_pmp_detach(struct ata_port *ap);
 static int ahci_softreset(struct ata_link *link, unsigned int *class,
                          unsigned long deadline);
+static int ahci_sb600_softreset(struct ata_link *link, unsigned int *class,
+                          unsigned long deadline);
 static int ahci_hardreset(struct ata_link *link, unsigned int *class,
                          unsigned long deadline);
 static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
@@ -329,6 +333,12 @@ static struct ata_port_operations ahci_p5wdh_ops = {
        .hardreset              = ahci_p5wdh_hardreset,
 };
+static struct ata_port_operations ahci_sb600_ops = {
+        .inherits               = &ahci_ops,
+        .softreset              = ahci_sb600_softreset,
+        .pmp_softreset          = ahci_sb600_softreset,
+};
 #define AHCI_HFLAGS(flags)      .private_data   = (void *)(flags)
 static const struct ata_port_info ahci_port_info[] = {
@@ -359,11 +369,11 @@ static const struct ata_port_info ahci_port_info[] = {
        {
                AHCI_HFLAGS     (AHCI_HFLAG_IGN_SERR_INTERNAL |
                                 AHCI_HFLAG_32BIT_ONLY | AHCI_HFLAG_NO_MSI |
-                                 AHCI_HFLAG_SECT255 | AHCI_HFLAG_NO_PMP),
+                                 AHCI_HFLAG_SECT255),
                .flags          = AHCI_FLAG_COMMON,
                .pio_mask       = 0x1f, /* pio0-4 */
                .udma_mask      = ATA_UDMA6,
-                .port_ops       = &ahci_ops,
+                .port_ops       = &ahci_sb600_ops,
        },
        /* board_ahci_mv */
        {
@@ -377,8 +387,15 @@ static const struct ata_port_info ahci_port_info[] = {
        },
        /* board_ahci_sb700 */
        {
-                AHCI_HFLAGS     (AHCI_HFLAG_IGN_SERR_INTERNAL |
+                AHCI_HFLAGS     (AHCI_HFLAG_IGN_SERR_INTERNAL),
-                                 AHCI_HFLAG_NO_PMP),
+                .flags          = AHCI_FLAG_COMMON,
+                .pio_mask       = 0x1f, /* pio0-4 */
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &ahci_sb600_ops,
+        },
+        /* board_ahci_mcp65 */
+        {
+                AHCI_HFLAGS     (AHCI_HFLAG_YES_NCQ),
                .flags          = AHCI_FLAG_COMMON,
                .pio_mask       = 0x1f, /* pio0-4 */
                .udma_mask      = ATA_UDMA6,
@@ -438,14 +455,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(VIA, 0x6287), board_ahci_vt8251 }, /* VIA VT8251 */
        /* NVIDIA */
-        { PCI_VDEVICE(NVIDIA, 0x044c), board_ahci },            /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x044c), board_ahci_mcp65 },      /* MCP65 */
-        { PCI_VDEVICE(NVIDIA, 0x044d), board_ahci },            /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x044d), board_ahci_mcp65 },      /* MCP65 */
-        { PCI_VDEVICE(NVIDIA, 0x044e), board_ahci },            /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x044e), board_ahci_mcp65 },      /* MCP65 */
-        { PCI_VDEVICE(NVIDIA, 0x044f), board_ahci },            /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x044f), board_ahci_mcp65 },      /* MCP65 */
-        { PCI_VDEVICE(NVIDIA, 0x045c), board_ahci },            /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x045c), board_ahci_mcp65 },      /* MCP65 */
-        { PCI_VDEVICE(NVIDIA, 0x045d), board_ahci },            /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x045d), board_ahci_mcp65 },      /* MCP65 */
-        { PCI_VDEVICE(NVIDIA, 0x045e), board_ahci },            /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x045e), board_ahci_mcp65 },      /* MCP65 */
-        { PCI_VDEVICE(NVIDIA, 0x045f), board_ahci },            /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x045f), board_ahci_mcp65 },      /* MCP65 */
        { PCI_VDEVICE(NVIDIA, 0x0550), board_ahci },            /* MCP67 */
        { PCI_VDEVICE(NVIDIA, 0x0551), board_ahci },            /* MCP67 */
        { PCI_VDEVICE(NVIDIA, 0x0552), board_ahci },            /* MCP67 */
@@ -502,10 +519,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(NVIDIA, 0x0bcd), board_ahci },            /* MCP7B */
        { PCI_VDEVICE(NVIDIA, 0x0bce), board_ahci },            /* MCP7B */
        { PCI_VDEVICE(NVIDIA, 0x0bcf), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bd0), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bc4), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bd1), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bc5), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bd2), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bc6), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bd3), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0bc7), board_ahci },            /* MCP7B */
        /* SiS */
        { PCI_VDEVICE(SI, 0x1184), board_ahci }, /* SiS 966 */
@@ -624,6 +641,12 @@ static void ahci_save_initial_config(struct pci_dev *pdev,
                cap &= ~HOST_CAP_NCQ;
        }
+        if (!(cap & HOST_CAP_NCQ) && (hpriv->flags & AHCI_HFLAG_YES_NCQ)) {
+                dev_printk(KERN_INFO, &pdev->dev,
+                           "controller can do NCQ, turning on CAP_NCQ\n");
+                cap |= HOST_CAP_NCQ;
+        }
        if ((cap & HOST_CAP_PMP) && (hpriv->flags & AHCI_HFLAG_NO_PMP)) {
                dev_printk(KERN_INFO, &pdev->dev,
                           "controller can't do PMP, turning off CAP_PMP\n");
@@ -1262,19 +1285,11 @@ static int ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
        return 0;
 }
-static int ahci_check_ready(struct ata_link *link)
+static int ahci_do_softreset(struct ata_link *link, unsigned int *class,
-{
+                             int pmp, unsigned long deadline,
-        void __iomem *port_mmio = ahci_port_base(link->ap);
+                             int (*check_ready)(struct ata_link *link))
-        u8 status = readl(port_mmio + PORT_TFDATA) & 0xFF;
-        return ata_check_ready(status);
-}
-static int ahci_softreset(struct ata_link *link, unsigned int *class,
-                          unsigned long deadline)
 {
        struct ata_port *ap = link->ap;
-        int pmp = sata_srst_pmp(link);
        const char *reason = NULL;
        unsigned long now, msecs;
        struct ata_taskfile tf;
@@ -1312,7 +1327,7 @@ static int ahci_softreset(struct ata_link *link, unsigned int *class,
        ahci_exec_polled_cmd(ap, pmp, &tf, 0, 0, 0);
        /* wait for link to become ready */
-        rc = ata_wait_after_reset(link, deadline, ahci_check_ready);
+        rc = ata_wait_after_reset(link, deadline, check_ready);
        /* link occupied, -ENODEV too is an error */
        if (rc) {
                reason = "device not ready";
@@ -1328,6 +1343,72 @@ static int ahci_softreset(struct ata_link *link, unsigned int *class,
        return rc;
 }
+static int ahci_check_ready(struct ata_link *link)
+{
+        void __iomem *port_mmio = ahci_port_base(link->ap);
+        u8 status = readl(port_mmio + PORT_TFDATA) & 0xFF;
+        return ata_check_ready(status);
+}
+static int ahci_softreset(struct ata_link *link, unsigned int *class,
+                          unsigned long deadline)
+{
+        int pmp = sata_srst_pmp(link);
+        DPRINTK("ENTER\n");
+        return ahci_do_softreset(link, class, pmp, deadline, ahci_check_ready);
+}
+static int ahci_sb600_check_ready(struct ata_link *link)
+{
+        void __iomem *port_mmio = ahci_port_base(link->ap);
+        u8 status = readl(port_mmio + PORT_TFDATA) & 0xFF;
+        u32 irq_status = readl(port_mmio + PORT_IRQ_STAT);
+        /*
+         * There is no need to check TFDATA if BAD PMP is found due to HW bug,
+         * which can save timeout delay.
+         */
+        if (irq_status & PORT_IRQ_BAD_PMP)
+                return -EIO;
+        return ata_check_ready(status);
+}
+static int ahci_sb600_softreset(struct ata_link *link, unsigned int *class,
+                                unsigned long deadline)
+{
+        struct ata_port *ap = link->ap;
+        void __iomem *port_mmio = ahci_port_base(ap);
+        int pmp = sata_srst_pmp(link);
+        int rc;
+        u32 irq_sts;
+        DPRINTK("ENTER\n");
+        rc = ahci_do_softreset(link, class, pmp, deadline,
+                               ahci_sb600_check_ready);
+        /*
+         * Soft reset fails on some ATI chips with IPMS set when PMP
+         * is enabled but SATA HDD/ODD is connected to SATA port,
+         * do soft reset again to port 0.
+         */
+        if (rc == -EIO) {
+                irq_sts = readl(port_mmio + PORT_IRQ_STAT);
+                if (irq_sts & PORT_IRQ_BAD_PMP) {
+                        ata_link_printk(link, KERN_WARNING,
+                                        "failed due to HW bug, retry pmp=0\n");
+                        rc = ahci_do_softreset(link, class, 0, deadline,
+                                               ahci_check_ready);
+                }
+        }
+        return rc;
+}
 static int ahci_hardreset(struct ata_link *link, unsigned int *class,
                          unsigned long deadline)
 {
@@ -2118,7 +2199,8 @@ static void ahci_p5wdh_workaround(struct ata_host *host)
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        static int printed_version;
-        struct ata_port_info pi = ahci_port_info[ent->driver_data];
+        unsigned int board_id = ent->driver_data;
+        struct ata_port_info pi = ahci_port_info[board_id];
        const struct ata_port_info *ppi[] = { &pi, NULL };
        struct device *dev = &pdev->dev;
        struct ahci_host_priv *hpriv;
@@ -2167,6 +2249,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                return -ENOMEM;
        hpriv->flags |= (unsigned long)pi.private_data;
+        /* MCP65 revision A1 and A2 can't do MSI */
+        if (board_id == board_ahci_mcp65 &&
+            (pdev->revision == 0xa1 || pdev->revision == 0xa2))
+                hpriv->flags |= AHCI_HFLAG_NO_MSI;
        if ((hpriv->flags & AHCI_HFLAG_NO_MSI) || pci_enable_msi(pdev))
                pci_intx(pdev, 1);
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index a9027b8fbdd5..81b7ae376951 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -247,10 +247,11 @@ static const struct pci_device_id piix_pci_tbl[] = {
        { 0x8086, 0x2820, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
        /* SATA Controller 2 IDE (ICH8) */
        { 0x8086, 0x2825, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
-        /* Mobile SATA Controller IDE (ICH8M) */
-        { 0x8086, 0x2828, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
        /* Mobile SATA Controller IDE (ICH8M), Apple */
        { 0x8086, 0x2828, 0x106b, 0x00a0, 0, 0, ich8m_apple_sata },
+        { 0x8086, 0x2828, 0x106b, 0x00a1, 0, 0, ich8m_apple_sata },
+        /* Mobile SATA Controller IDE (ICH8M) */
+        { 0x8086, 0x2828, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
        /* SATA Controller IDE (ICH9) */
        { 0x8086, 0x2920, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
        /* SATA Controller IDE (ICH9) */
@@ -526,7 +527,7 @@ static struct ata_port_info piix_port_info[] = {
        [ich8m_apple_sata] =
        {
-                .flags          = PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR,
+                .flags          = PIIX_SATA_FLAGS,
                .pio_mask       = 0x1f, /* pio0-4 */
                .mwdma_mask     = 0x07, /* mwdma0-2 */
                .udma_mask      = ATA_UDMA6,
@@ -573,6 +574,8 @@ static const struct ich_laptop ich_laptop[] = {
        { 0x27DF, 0x1043, 0x1267 },     /* ICH7 on Asus W5F */
        { 0x27DF, 0x103C, 0x30A1 },     /* ICH7 on HP Compaq nc2400 */
        { 0x24CA, 0x1025, 0x0061 },     /* ICH4 on ACER Aspire 2023WLMi */
+        { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
+        { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
        { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
        /* end marker */
        { 0, }
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index dbf6ca781f66..3ff8b14420d9 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -118,12 +118,62 @@ static void ata_acpi_associate_ide_port(struct ata_port *ap)
                ap->pflags |= ATA_PFLAG_INIT_GTM_VALID;
 }
-static void ata_acpi_handle_hotplug(struct ata_port *ap, struct ata_device
+static void ata_acpi_eject_device(acpi_handle handle)
-                                    *dev, u32 event)
+{
+        struct acpi_object_list arg_list;
+        union acpi_object arg;
+        arg_list.count = 1;
+        arg_list.pointer = &arg;
+        arg.type = ACPI_TYPE_INTEGER;
+        arg.integer.value = 1;
+        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_EJ0",
+                                              &arg_list, NULL)))
+                printk(KERN_ERR "Failed to evaluate _EJ0!\n");
+}
+/* @ap and @dev are the same as ata_acpi_handle_hotplug() */
+static void ata_acpi_detach_device(struct ata_port *ap, struct ata_device *dev)
+{
+        if (dev)
+                dev->flags |= ATA_DFLAG_DETACH;
+        else {
+                struct ata_link *tlink;
+                struct ata_device *tdev;
+                ata_port_for_each_link(tlink, ap)
+                        ata_link_for_each_dev(tdev, tlink)
+                                tdev->flags |= ATA_DFLAG_DETACH;
+        }
+        ata_port_schedule_eh(ap);
+}
+/**
+ * ata_acpi_handle_hotplug - ACPI event handler backend
+ * @ap: ATA port ACPI event occurred
+ * @dev: ATA device ACPI event occurred (can be NULL)
+ * @event: ACPI event which occurred
+ * @is_dock_event: boolean indicating whether the event was a dock one
+ *
+ * All ACPI bay / device realted events end up in this function.  If
+ * the event is port-wide @dev is NULL.  If the event is specific to a
+ * device, @dev points to it.
+ *
+ * Hotplug (as opposed to unplug) notification is always handled as
+ * port-wide while unplug only kills the target device on device-wide
+ * event.
+ *
+ * LOCKING:
+ * ACPI notify handler context.  May sleep.
+ */
+static void ata_acpi_handle_hotplug(struct ata_port *ap, struct ata_device *dev,
+                                    u32 event, int is_dock_event)
 {
        char event_string[12];
        char *envp[] = { event_string, NULL };
-        struct ata_eh_info *ehi;
+        struct ata_eh_info *ehi = &ap->link.eh_info;
        struct kobject *kobj = NULL;
        int wait = 0;
        unsigned long flags;
@@ -131,87 +181,100 @@ static void ata_acpi_handle_hotplug(struct ata_port *ap, struct ata_device
        unsigned long sta;
        acpi_status status;
-        if (!ap)
+        if (dev) {
-                ap = dev->link->ap;
+                if (dev->sdev)
-        ehi = &ap->link.eh_info;
+                        kobj = &dev->sdev->sdev_gendev.kobj;
-        spin_lock_irqsave(ap->lock, flags);
-        if (dev)
                handle = dev->acpi_handle;
-        else
+        } else {
+                kobj = &ap->dev->kobj;
                handle = ap->acpi_handle;
+        }
        status = acpi_get_handle(handle, "_EJ0", &tmphandle);
-        if (ACPI_FAILURE(status)) {
+        if (ACPI_FAILURE(status))
-                /* This device is not ejectable */
+                /* This device does not support hotplug */
-                spin_unlock_irqrestore(ap->lock, flags);
                return;
-        }
-        status = acpi_evaluate_integer(handle, "_STA", NULL, &sta);
+        spin_lock_irqsave(ap->lock, flags);
-        if (ACPI_FAILURE(status)) {
-                printk ("Unable to determine bay status\n");
-                spin_unlock_irqrestore(ap->lock, flags);
-                return;
-        }
        switch (event) {
        case ACPI_NOTIFY_BUS_CHECK:
        case ACPI_NOTIFY_DEVICE_CHECK:
                ata_ehi_push_desc(ehi, "ACPI event");
-                if (!sta) {
-                /* Device has been unplugged */
+                status = acpi_evaluate_integer(handle, "_STA", NULL, &sta);
-                        if (dev)
+                if (ACPI_FAILURE(status)) {
-                                dev->flags |= ATA_DFLAG_DETACH;
+                        ata_port_printk(ap, KERN_ERR,
-                        else {
+                                "acpi: failed to determine bay status (0x%x)\n",
-                                struct ata_link *tlink;
+                                status);
-                                struct ata_device *tdev;
+                        break;
+                }
-                                ata_port_for_each_link(tlink, ap) {
-                                        ata_link_for_each_dev(tdev, tlink) {
+                if (sta) {
-                                                tdev->flags |=
-                                                        ATA_DFLAG_DETACH;
-                                        }
-                                }
-                        }
-                        ata_port_schedule_eh(ap);
-                        wait = 1;
-                } else {
                        ata_ehi_hotplugged(ehi);
                        ata_port_freeze(ap);
+                } else {
+                        /* The device has gone - unplug it */
+                        ata_acpi_detach_device(ap, dev);
+                        wait = 1;
                }
+                break;
+        case ACPI_NOTIFY_EJECT_REQUEST:
+                ata_ehi_push_desc(ehi, "ACPI event");
+                if (!is_dock_event)
+                        break;
+                /* undock event - immediate unplug */
+                ata_acpi_detach_device(ap, dev);
+                wait = 1;
+                break;
        }
+        /* make sure kobj doesn't go away while ap->lock is released */
+        kobject_get(kobj);
        spin_unlock_irqrestore(ap->lock, flags);
-        if (wait)
+        if (wait) {
                ata_port_wait_eh(ap);
+                ata_acpi_eject_device(handle);
+        }
-        if (dev) {
+        if (kobj && !is_dock_event) {
-                if (dev->sdev)
-                        kobj = &dev->sdev->sdev_gendev.kobj;
-        } else
-                kobj = &ap->dev->kobj;
-        if (kobj) {
                sprintf(event_string, "BAY_EVENT=%d", event);
                kobject_uevent_env(kobj, KOBJ_CHANGE, envp);
        }
+        kobject_put(kobj);
+}
+static void ata_acpi_dev_notify_dock(acpi_handle handle, u32 event, void *data)
+{
+        struct ata_device *dev = data;
+        ata_acpi_handle_hotplug(dev->link->ap, dev, event, 1);
+}
+static void ata_acpi_ap_notify_dock(acpi_handle handle, u32 event, void *data)
+{
+        struct ata_port *ap = data;
+        ata_acpi_handle_hotplug(ap, NULL, event, 1);
 }
 static void ata_acpi_dev_notify(acpi_handle handle, u32 event, void *data)
 {
        struct ata_device *dev = data;
-        ata_acpi_handle_hotplug(NULL, dev, event);
+        ata_acpi_handle_hotplug(dev->link->ap, dev, event, 0);
 }
 static void ata_acpi_ap_notify(acpi_handle handle, u32 event, void *data)
 {
        struct ata_port *ap = data;
-        ata_acpi_handle_hotplug(ap, NULL, event);
+        ata_acpi_handle_hotplug(ap, NULL, event, 0);
 }
 /**
@@ -252,7 +315,7 @@ void ata_acpi_associate(struct ata_host *host)
                                                    ata_acpi_ap_notify, ap);
                        /* we might be on a docking station */
                        register_hotplug_dock_device(ap->acpi_handle,
-                                                     ata_acpi_ap_notify, ap);
+                                             ata_acpi_ap_notify_dock, ap);
                }
                for (j = 0; j < ata_link_max_devices(&ap->link); j++) {
@@ -264,7 +327,7 @@ void ata_acpi_associate(struct ata_host *host)
                                                ata_acpi_dev_notify, dev);
                                /* we might be on a docking station */
                                register_hotplug_dock_device(dev->acpi_handle,
-                                                ata_acpi_dev_notify, dev);
+                                             ata_acpi_dev_notify_dock, dev);
                        }
                }
        }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3c89f205c83f..cc816ca623d3 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5403,7 +5403,7 @@ static void ata_host_stop(struct device *gendev, void *res)
 */
 static void ata_finalize_port_ops(struct ata_port_operations *ops)
 {
-        static spinlock_t lock = SPIN_LOCK_UNLOCKED;
+        static DEFINE_SPINLOCK(lock);
        const struct ata_port_operations *cur;
        void **begin = (void **)ops;
        void **end = (void **)&ops->inherits;
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 0f9386d4a5a0..7daf4c0f6216 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -322,9 +322,12 @@ static void sata_pmp_quirks(struct ata_port *ap)
        if (vendor == 0x1095 && devid == 0x3726) {
                /* sil3726 quirks */
                ata_port_for_each_link(link, ap) {
-                        /* class code report is unreliable */
+                        /* Class code report is unreliable and SRST
+                         * times out under certain configurations.
+                         */
                        if (link->pmp < 5)
-                                link->flags |= ATA_LFLAG_ASSUME_ATA;
+                                link->flags |= ATA_LFLAG_NO_SRST |
+                                               ATA_LFLAG_ASSUME_ATA;
                        /* port 5 is for SEMB device and it doesn't like SRST */
                        if (link->pmp == 5)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index aeb6e01d82ce..2e6e1622dc6d 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1637,6 +1637,7 @@ defer:
 /**
 *      ata_scsi_rbuf_get - Map response buffer.
+ *      @cmd: SCSI command containing buffer to be mapped.
 *      @flags: unsigned long variable to store irq enable status
 *      @copy_in: copy in from user buffer
 *
@@ -1954,7 +1955,7 @@ static unsigned int ata_msense_ctl_mode(u8 *buf)
 /**
 *      ata_msense_rw_recovery - Simulate MODE SENSE r/w error recovery page
- *      @bufp: output buffer
+ *      @buf: output buffer
 *
 *      Generate a generic MODE SENSE r/w error recovery page.
 *
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 3c2d2289f85e..215d18672a5a 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -247,7 +247,7 @@ u8 ata_sff_check_status(struct ata_port *ap)
 *      LOCKING:
 *      Inherited from caller.
 */
-u8 ata_sff_altstatus(struct ata_port *ap)
+static u8 ata_sff_altstatus(struct ata_port *ap)
 {
        if (ap->ops->sff_check_altstatus)
                return ap->ops->sff_check_altstatus(ap);
@@ -256,6 +256,93 @@ u8 ata_sff_altstatus(struct ata_port *ap)
 }
 /**
+ *      ata_sff_irq_status - Check if the device is busy
+ *      @ap: port where the device is
+ *
+ *      Determine if the port is currently busy. Uses altstatus
+ *      if available in order to avoid clearing shared IRQ status
+ *      when finding an IRQ source. Non ctl capable devices don't
+ *      share interrupt lines fortunately for us.
+ *
+ *      LOCKING:
+ *      Inherited from caller.
+ */
+static u8 ata_sff_irq_status(struct ata_port *ap)
+{
+        u8 status;
+        if (ap->ops->sff_check_altstatus || ap->ioaddr.altstatus_addr) {
+                status = ata_sff_altstatus(ap);
+                /* Not us: We are busy */
+                if (status & ATA_BUSY)
+                        return status;
+        }
+        /* Clear INTRQ latch */
+        status = ap->ops->sff_check_status(ap);
+        return status;
+}
+/**
+ *      ata_sff_sync - Flush writes
+ *      @ap: Port to wait for.
+ *
+ *      CAUTION:
+ *      If we have an mmio device with no ctl and no altstatus
+ *      method this will fail. No such devices are known to exist.
+ *
+ *      LOCKING:
+ *      Inherited from caller.
+ */
+static void ata_sff_sync(struct ata_port *ap)
+{
+        if (ap->ops->sff_check_altstatus)
+                ap->ops->sff_check_altstatus(ap);
+        else if (ap->ioaddr.altstatus_addr)
+                ioread8(ap->ioaddr.altstatus_addr);
+}
+/**
+ *      ata_sff_pause           -       Flush writes and wait 400nS
+ *      @ap: Port to pause for.
+ *
+ *      CAUTION:
+ *      If we have an mmio device with no ctl and no altstatus
+ *      method this will fail. No such devices are known to exist.
+ *
+ *      LOCKING:
+ *      Inherited from caller.
+ */
+void ata_sff_pause(struct ata_port *ap)
+{
+        ata_sff_sync(ap);
+        ndelay(400);
+}
+/**
+ *      ata_sff_dma_pause       -       Pause before commencing DMA
+ *      @ap: Port to pause for.
+ *
+ *      Perform I/O fencing and ensure sufficient cycle delays occur
+ *      for the HDMA1:0 transition
+ */
+ 
+void ata_sff_dma_pause(struct ata_port *ap)
+{
+        if (ap->ops->sff_check_altstatus || ap->ioaddr.altstatus_addr) {
+                /* An altstatus read will cause the needed delay without
+                   messing up the IRQ status */
+                ata_sff_altstatus(ap);
+                return;
+        }
+        /* There are no DMA controllers without ctl. BUG here to ensure
+           we never violate the HDMA1:0 transition timing and risk
+           corruption. */
+        BUG();
+}
+/**
 *      ata_sff_busy_sleep - sleep until BSY clears, or timeout
 *      @ap: port containing status register to be polled
 *      @tmout_pat: impatience timeout
@@ -742,7 +829,7 @@ static void ata_pio_sectors(struct ata_queued_cmd *qc)
        } else
                ata_pio_sector(qc);
-        ata_sff_altstatus(qc->ap); /* flush */
+        ata_sff_sync(qc->ap); /* flush */
 }
 /**
@@ -763,8 +850,9 @@ static void atapi_send_cdb(struct ata_port *ap, struct ata_queued_cmd *qc)
        WARN_ON(qc->dev->cdb_len < 12);
        ap->ops->sff_data_xfer(qc->dev, qc->cdb, qc->dev->cdb_len, 1);
-        ata_sff_altstatus(ap); /* flush */
+        ata_sff_sync(ap);
+        /* FIXME: If the CDB is for DMA do we need to do the transition delay
+           or is bmdma_start guaranteed to do it ? */
        switch (qc->tf.protocol) {
        case ATAPI_PROT_PIO:
                ap->hsm_task_state = HSM_ST;
@@ -905,7 +993,7 @@ static void atapi_pio_bytes(struct ata_queued_cmd *qc)
        if (unlikely(__atapi_pio_bytes(qc, bytes)))
                goto err_out;
-        ata_sff_altstatus(ap); /* flush */
+        ata_sff_sync(ap); /* flush */
        return;
@@ -1489,14 +1577,10 @@ inline unsigned int ata_sff_host_intr(struct ata_port *ap,
                goto idle_irq;
        }
-        /* check altstatus */
-        status = ata_sff_altstatus(ap);
-        if (status & ATA_BUSY)
-                goto idle_irq;
-        /* check main status, clearing INTRQ */
+        /* check main status, clearing INTRQ if needed */
-        status = ap->ops->sff_check_status(ap);
+        status = ata_sff_irq_status(ap);
-        if (unlikely(status & ATA_BUSY))
+        if (status & ATA_BUSY)
                goto idle_irq;
        /* ack bmdma irq events */
@@ -2030,7 +2114,7 @@ void ata_sff_error_handler(struct ata_port *ap)
                ap->ops->bmdma_stop(qc);
        }
-        ata_sff_altstatus(ap);
+        ata_sff_sync(ap);               /* FIXME: We don't need this */
        ap->ops->sff_check_status(ap);
        ap->ops->sff_irq_clear(ap);
@@ -2203,7 +2287,7 @@ void ata_bmdma_stop(struct ata_queued_cmd *qc)
                 mmio + ATA_DMA_CMD);
        /* one-PIO-cycle guaranteed wait, per spec, for HDMA1:0 transition */
-        ata_sff_altstatus(ap);        /* dummy read */
+        ata_sff_dma_pause(ap);
 }
 /**
@@ -2722,7 +2806,8 @@ EXPORT_SYMBOL_GPL(ata_sff_qc_prep);
 EXPORT_SYMBOL_GPL(ata_sff_dumb_qc_prep);
 EXPORT_SYMBOL_GPL(ata_sff_dev_select);
 EXPORT_SYMBOL_GPL(ata_sff_check_status);
-EXPORT_SYMBOL_GPL(ata_sff_altstatus);
+EXPORT_SYMBOL_GPL(ata_sff_dma_pause);
+EXPORT_SYMBOL_GPL(ata_sff_pause);
 EXPORT_SYMBOL_GPL(ata_sff_busy_sleep);
 EXPORT_SYMBOL_GPL(ata_sff_wait_ready);
 EXPORT_SYMBOL_GPL(ata_sff_tf_load);
diff --git a/drivers/ata/pata_icside.c b/drivers/ata/pata_icside.c
index 17138436423d..cf9e9848f8b5 100644
--- a/drivers/ata/pata_icside.c
+++ b/drivers/ata/pata_icside.c
@@ -270,7 +270,7 @@ static void pata_icside_bmdma_stop(struct ata_queued_cmd *qc)
        disable_dma(state->dma);
        /* see ata_bmdma_stop */
-        ata_sff_altstatus(ap);
+        ata_sff_dma_pause(ap);
 }
 static u8 pata_icside_bmdma_status(struct ata_port *ap)
diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c
index a108d259f19d..f8b3ffc8ae9e 100644
--- a/drivers/ata/pata_rb532_cf.c
+++ b/drivers/ata/pata_rb532_cf.c
@@ -57,7 +57,9 @@ static inline void rb532_pata_finish_io(struct ata_port *ap)
        struct ata_host *ah = ap->host;
        struct rb532_cf_info *info = ah->private_data;
-        ata_sff_altstatus(ap);
+        /* FIXME: Keep previous delay. If this is merely a fence then
+           ata_sff_sync might be sufficient. */
+        ata_sff_dma_pause(ap);
        ndelay(RB500_CF_IO_DELAY);
        set_irq_type(info->irq, IRQ_TYPE_LEVEL_HIGH);
diff --git a/drivers/ata/pata_scc.c b/drivers/ata/pata_scc.c
index e965b251ca24..bbf5aa345e68 100644
--- a/drivers/ata/pata_scc.c
+++ b/drivers/ata/pata_scc.c
@@ -726,7 +726,7 @@ static void scc_bmdma_stop (struct ata_queued_cmd *qc)
                 in_be32(bmid_base + SCC_DMA_CMD) & ~ATA_DMA_START);
        /* one-PIO-cycle guaranteed wait, per spec, for HDMA1:0 transition */
-        ata_sff_altstatus(ap);  /* dummy read */
+        ata_sff_dma_pause(ap);  /* dummy read */
 }
 /**
@@ -747,7 +747,8 @@ static u8 scc_bmdma_status (struct ata_port *ap)
                return host_stat;
        /* errata A252,A308 workaround: Step4 */
-        if ((ata_sff_altstatus(ap) & ATA_ERR) && (int_status & INTSTS_INTRQ))
+        if ((scc_check_altstatus(ap) & ATA_ERR)
+                                        && (int_status & INTSTS_INTRQ))
                return (host_stat | ATA_DMA_INTR);
        /* errata A308 workaround Step5 */
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 853559e32315..3924e7209a44 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -34,7 +34,7 @@ enum {
        SATA_FSL_HOST_FLAGS     = (ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
                                ATA_FLAG_MMIO | ATA_FLAG_PIO_DMA |
-                                ATA_FLAG_NCQ),
+                                ATA_FLAG_PMP | ATA_FLAG_NCQ),
        SATA_FSL_MAX_CMDS       = SATA_FSL_QUEUE_DEPTH,
        SATA_FSL_CMD_HDR_SIZE   = 16,   /* 4 DWORDS */
@@ -395,7 +395,7 @@ static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
        cd = (struct command_desc *)pp->cmdentry + tag;
        cd_paddr = pp->cmdentry_paddr + tag * SATA_FSL_CMD_DESC_SIZE;
-        ata_tf_to_fis(&qc->tf, 0, 1, (u8 *) &cd->cfis);
+        ata_tf_to_fis(&qc->tf, qc->dev->link->pmp, 1, (u8 *) &cd->cfis);
        VPRINTK("Dumping cfis : 0x%x, 0x%x, 0x%x\n",
                cd->cfis[0], cd->cfis[1], cd->cfis[2]);
@@ -438,6 +438,8 @@ static unsigned int sata_fsl_qc_issue(struct ata_queued_cmd *qc)
                ioread32(CA + hcr_base),
                ioread32(CE + hcr_base), ioread32(CC + hcr_base));
+        iowrite32(qc->dev->link->pmp, CQPMP + hcr_base);
        /* Simply queue command to the controller/device */
        iowrite32(1 << tag, CQ + hcr_base);
@@ -558,11 +560,36 @@ static void sata_fsl_thaw(struct ata_port *ap)
                ioread32(hcr_base + HCONTROL), ioread32(hcr_base + HSTATUS));
 }
+static void sata_fsl_pmp_attach(struct ata_port *ap)
+{
+        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
+        void __iomem *hcr_base = host_priv->hcr_base;
+        u32 temp;
+        temp = ioread32(hcr_base + HCONTROL);
+        iowrite32((temp | HCONTROL_PMP_ATTACHED), hcr_base + HCONTROL);
+}
+static void sata_fsl_pmp_detach(struct ata_port *ap)
+{
+        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
+        void __iomem *hcr_base = host_priv->hcr_base;
+        u32 temp;
+        temp = ioread32(hcr_base + HCONTROL);
+        temp &= ~HCONTROL_PMP_ATTACHED;
+        iowrite32(temp, hcr_base + HCONTROL);
+        /* enable interrupts on the controller/port */
+        temp = ioread32(hcr_base + HCONTROL);
+        iowrite32((temp | DEFAULT_PORT_IRQ_ENABLE_MASK), hcr_base + HCONTROL);
+}
 static int sata_fsl_port_start(struct ata_port *ap)
 {
        struct device *dev = ap->host->dev;
        struct sata_fsl_port_priv *pp;
-        int retval;
        void *mem;
        dma_addr_t mem_dma;
        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
@@ -688,12 +715,13 @@ static int sata_fsl_prereset(struct ata_link *link, unsigned long deadline)
 }
 static int sata_fsl_softreset(struct ata_link *link, unsigned int *class,
-                              unsigned long deadline)
+                                        unsigned long deadline)
 {
        struct ata_port *ap = link->ap;
        struct sata_fsl_port_priv *pp = ap->private_data;
        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
        void __iomem *hcr_base = host_priv->hcr_base;
+        int pmp = sata_srst_pmp(link);
        u32 temp;
        struct ata_taskfile tf;
        u8 *cfis;
@@ -703,6 +731,9 @@ static int sata_fsl_softreset(struct ata_link *link, unsigned int *class,
        DPRINTK("in xx_softreset\n");
+        if (pmp != SATA_PMP_CTRL_PORT)
+                goto issue_srst;
 try_offline_again:
        /*
         * Force host controller to go off-line, aborting current operations
@@ -746,6 +777,7 @@ try_offline_again:
        temp = ioread32(hcr_base + HCONTROL);
        temp |= (HCONTROL_ONLINE_PHY_RST | HCONTROL_SNOOP_ENABLE);
+        temp |= HCONTROL_PMP_ATTACHED;
        iowrite32(temp, hcr_base + HCONTROL);
        temp = ata_wait_register(hcr_base + HSTATUS, ONLINE, 0, 1, 500);
@@ -771,7 +803,8 @@ try_offline_again:
                ata_port_printk(ap, KERN_WARNING,
                                "No Device OR PHYRDY change,Hstatus = 0x%x\n",
                                ioread32(hcr_base + HSTATUS));
-                goto err;
+                *class = ATA_DEV_NONE;
+                goto out;
        }
        /*
@@ -783,7 +816,8 @@ try_offline_again:
        if ((temp & 0xFF) != 0x18) {
                ata_port_printk(ap, KERN_WARNING, "No Signature Update\n");
-                goto err;
+                *class = ATA_DEV_NONE;
+                goto out;
        } else {
                ata_port_printk(ap, KERN_INFO,
                                "Signature Update detected @ %d msecs\n",
@@ -798,6 +832,7 @@ try_offline_again:
         * reached here, we can send a command to the target device
         */
+issue_srst:
        DPRINTK("Sending SRST/device reset\n");
        ata_tf_init(link->device, &tf);
@@ -808,7 +843,7 @@ try_offline_again:
                                     SRST_CMD | CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
        tf.ctl |= ATA_SRST;     /* setup SRST bit in taskfile control reg */
-        ata_tf_to_fis(&tf, 0, 0, cfis);
+        ata_tf_to_fis(&tf, pmp, 0, cfis);
        DPRINTK("Dumping cfis : 0x%x, 0x%x, 0x%x, 0x%x\n",
                cfis[0], cfis[1], cfis[2], cfis[3]);
@@ -854,8 +889,10 @@ try_offline_again:
        sata_fsl_setup_cmd_hdr_entry(pp, 0, CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
        tf.ctl &= ~ATA_SRST;    /* 2nd H2D Ctl. register FIS */
-        ata_tf_to_fis(&tf, 0, 0, cfis);
+        ata_tf_to_fis(&tf, pmp, 0, cfis);
+        if (pmp != SATA_PMP_CTRL_PORT)
+                iowrite32(pmp, CQPMP + hcr_base);
        iowrite32(1, CQ + hcr_base);
        msleep(150);            /* ?? */
@@ -886,12 +923,21 @@ try_offline_again:
                VPRINTK("cereg = 0x%x\n", ioread32(hcr_base + CE));
        }
+out:
        return 0;
 err:
        return -EIO;
 }
+static void sata_fsl_error_handler(struct ata_port *ap)
+{
+        DPRINTK("in xx_error_handler\n");
+        sata_pmp_error_handler(ap);
+}
 static void sata_fsl_post_internal_cmd(struct ata_queued_cmd *qc)
 {
        if (qc->flags & ATA_QCFLAG_FAILED)
@@ -905,18 +951,21 @@ static void sata_fsl_post_internal_cmd(struct ata_queued_cmd *qc)
 static void sata_fsl_error_intr(struct ata_port *ap)
 {
-        struct ata_link *link = &ap->link;
-        struct ata_eh_info *ehi = &link->eh_info;
        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
        void __iomem *hcr_base = host_priv->hcr_base;
-        u32 hstatus, dereg, cereg = 0, SError = 0;
+        u32 hstatus, dereg=0, cereg = 0, SError = 0;
        unsigned int err_mask = 0, action = 0;
-        struct ata_queued_cmd *qc;
+        int freeze = 0, abort=0;
-        int freeze = 0;
+        struct ata_link *link = NULL;
+        struct ata_queued_cmd *qc = NULL;
+        struct ata_eh_info *ehi;
        hstatus = ioread32(hcr_base + HSTATUS);
        cereg = ioread32(hcr_base + CE);
+        /* first, analyze and record host port events */
+        link = &ap->link;
+        ehi = &link->eh_info;
        ata_ehi_clear_desc(ehi);
        /*
@@ -926,42 +975,28 @@ static void sata_fsl_error_intr(struct ata_port *ap)
        sata_fsl_scr_read(ap, SCR_ERROR, &SError);
        if (unlikely(SError & 0xFFFF0000)) {
                sata_fsl_scr_write(ap, SCR_ERROR, SError);
-                err_mask |= AC_ERR_ATA_BUS;
        }
        DPRINTK("error_intr,hStat=0x%x,CE=0x%x,DE =0x%x,SErr=0x%x\n",
                hstatus, cereg, ioread32(hcr_base + DE), SError);
-        /* handle single device errors */
+        /* handle fatal errors */
-        if (cereg) {
+        if (hstatus & FATAL_ERROR_DECODE) {
-                /*
+                ehi->err_mask |= AC_ERR_ATA_BUS;
-                 * clear the command error, also clears queue to the device
+                ehi->action |= ATA_EH_SOFTRESET;
-                 * in error, and we can (re)issue commands to this device.
-                 * When a device is in error all commands queued into the
-                 * host controller and at the device are considered aborted
-                 * and the queue for that device is stopped. Now, after
-                 * clearing the device error, we can issue commands to the
-                 * device to interrogate it to find the source of the error.
-                 */
-                dereg = ioread32(hcr_base + DE);
-                iowrite32(dereg, hcr_base + DE);
-                iowrite32(cereg, hcr_base + CE);
-                DPRINTK("single device error, CE=0x%x, DE=0x%x\n",
-                        ioread32(hcr_base + CE), ioread32(hcr_base + DE));
                /*
-                 * We should consider this as non fatal error, and TF must
+                 * Ignore serror in case of fatal errors as we always want
-                 * be updated as done below.
+                 * to do a soft-reset of the FSL SATA controller. Analyzing
+                 * serror may cause libata to schedule a hard-reset action,
+                 * and hard-reset currently does not do controller
+                 * offline/online, causing command timeouts and leads to an
+                 * un-recoverable state, hence make libATA ignore
+                 * autopsy in case of fatal errors.
                 */
-                err_mask |= AC_ERR_DEV;
+                ehi->flags |= ATA_EHI_NO_AUTOPSY;
-        }
-        /* handle fatal errors */
-        if (hstatus & FATAL_ERROR_DECODE) {
-                err_mask |= AC_ERR_ATA_BUS;
-                action |= ATA_EH_RESET;
-                /* how will fatal error interrupts be completed ?? */
                freeze = 1;
        }
@@ -971,30 +1006,83 @@ static void sata_fsl_error_intr(struct ata_port *ap)
                /* Setup a soft-reset EH action */
                ata_ehi_hotplugged(ehi);
+                ata_ehi_push_desc(ehi, "%s", "PHY RDY changed");
                freeze = 1;
        }
-        /* record error info */
+        /* handle single device errors */
-        qc = ata_qc_from_tag(ap, link->active_tag);
+        if (cereg) {
+                /*
+                 * clear the command error, also clears queue to the device
+                 * in error, and we can (re)issue commands to this device.
+                 * When a device is in error all commands queued into the
+                 * host controller and at the device are considered aborted
+                 * and the queue for that device is stopped. Now, after
+                 * clearing the device error, we can issue commands to the
+                 * device to interrogate it to find the source of the error.
+                 */
+                abort = 1;
+                DPRINTK("single device error, CE=0x%x, DE=0x%x\n",
+                        ioread32(hcr_base + CE), ioread32(hcr_base + DE));
-        if (qc)
+                /* find out the offending link and qc */
+                if (ap->nr_pmp_links) {
+                        dereg = ioread32(hcr_base + DE);
+                        iowrite32(dereg, hcr_base + DE);
+                        iowrite32(cereg, hcr_base + CE);
+                        if (dereg < ap->nr_pmp_links) {
+                                link = &ap->pmp_link[dereg];
+                                ehi = &link->eh_info;
+                                qc = ata_qc_from_tag(ap, link->active_tag);
+                                /*
+                                 * We should consider this as non fatal error,
+                                 * and TF must be updated as done below.
+                                 */
+                                err_mask |= AC_ERR_DEV;
+                        } else {
+                                err_mask |= AC_ERR_HSM;
+                                action |= ATA_EH_HARDRESET;
+                                freeze = 1;
+                        }
+                } else {
+                        dereg = ioread32(hcr_base + DE);
+                        iowrite32(dereg, hcr_base + DE);
+                        iowrite32(cereg, hcr_base + CE);
+                        qc = ata_qc_from_tag(ap, link->active_tag);
+                        /*
+                         * We should consider this as non fatal error,
+                         * and TF must be updated as done below.
+                        */
+                        err_mask |= AC_ERR_DEV;
+                }
+        }
+        /* record error info */
+        if (qc) {
                qc->err_mask |= err_mask;
-        else
+        } else
                ehi->err_mask |= err_mask;
        ehi->action |= action;
-        ehi->serror |= SError;
        /* freeze or abort */
        if (freeze)
                ata_port_freeze(ap);
-        else
+        else if (abort) {
-                ata_port_abort(ap);
+                if (qc)
+                        ata_link_abort(qc->dev->link);
+                else
+                        ata_port_abort(ap);
+        }
 }
 static void sata_fsl_host_intr(struct ata_port *ap)
 {
-        struct ata_link *link = &ap->link;
        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
        void __iomem *hcr_base = host_priv->hcr_base;
        u32 hstatus, qc_active = 0;
@@ -1017,10 +1105,19 @@ static void sata_fsl_host_intr(struct ata_port *ap)
                return;
        }
-        if (link->sactive) {    /* only true for NCQ commands */
+        /* Read command completed register */
+        qc_active = ioread32(hcr_base + CC);
+        VPRINTK("Status of all queues :\n");
+        VPRINTK("qc_active/CC = 0x%x, CA = 0x%x, CE=0x%x,CQ=0x%x,apqa=0x%x\n",
+                qc_active,
+                ioread32(hcr_base + CA),
+                ioread32(hcr_base + CE),
+                ioread32(hcr_base + CQ),
+                ap->qc_active);
+        if (qc_active & ap->qc_active) {
                int i;
-                /* Read command completed register */
-                qc_active = ioread32(hcr_base + CC);
                /* clear CC bit, this will also complete the interrupt */
                iowrite32(qc_active, hcr_base + CC);
@@ -1032,8 +1129,9 @@ static void sata_fsl_host_intr(struct ata_port *ap)
                for (i = 0; i < SATA_FSL_QUEUE_DEPTH; i++) {
                        if (qc_active & (1 << i)) {
                                qc = ata_qc_from_tag(ap, i);
-                                if (qc)
+                                if (qc) {
                                        ata_qc_complete(qc);
+                                }
                                DPRINTK
                                    ("completing ncq cmd,tag=%d,CC=0x%x,CA=0x%x\n",
                                     i, ioread32(hcr_base + CC),
@@ -1042,19 +1140,21 @@ static void sata_fsl_host_intr(struct ata_port *ap)
                }
                return;
-        } else if (ap->qc_active) {
+        } else if ((ap->qc_active & (1 << ATA_TAG_INTERNAL))) {
                iowrite32(1, hcr_base + CC);
-                qc = ata_qc_from_tag(ap, link->active_tag);
+                qc = ata_qc_from_tag(ap, ATA_TAG_INTERNAL);
-                DPRINTK("completing non-ncq cmd, tag=%d,CC=0x%x\n",
+                DPRINTK("completing non-ncq cmd, CC=0x%x\n",
-                        link->active_tag, ioread32(hcr_base + CC));
+                         ioread32(hcr_base + CC));
-                if (qc)
+                if (qc) {
                        ata_qc_complete(qc);
+                }
        } else {
                /* Spurious Interrupt!! */
                DPRINTK("spurious interrupt!!, CC = 0x%x\n",
                        ioread32(hcr_base + CC));
+                iowrite32(qc_active, hcr_base + CC);
                return;
        }
 }
@@ -1130,9 +1230,6 @@ static int sata_fsl_init_controller(struct ata_host *host)
        iowrite32(0x00000FFFF, hcr_base + CE);
        iowrite32(0x00000FFFF, hcr_base + DE);
-        /* initially assuming no Port multiplier, set CQPMP to 0 */
-        iowrite32(0x0, hcr_base + CQPMP);
        /*
         * host controller will be brought on-line, during xx_port_start()
         * callback, that should also initiate the OOB, COMINIT sequence
@@ -1154,8 +1251,8 @@ static struct scsi_host_template sata_fsl_sht = {
        .dma_boundary = ATA_DMA_BOUNDARY,
 };
-static const struct ata_port_operations sata_fsl_ops = {
+static struct ata_port_operations sata_fsl_ops = {
-        .inherits = &sata_port_ops,
+        .inherits               = &sata_pmp_port_ops,
        .qc_prep = sata_fsl_qc_prep,
        .qc_issue = sata_fsl_qc_issue,
@@ -1168,10 +1265,15 @@ static const struct ata_port_operations sata_fsl_ops = {
        .thaw = sata_fsl_thaw,
        .prereset = sata_fsl_prereset,
        .softreset = sata_fsl_softreset,
+        .pmp_softreset = sata_fsl_softreset,
+        .error_handler = sata_fsl_error_handler,
        .post_internal_cmd = sata_fsl_post_internal_cmd,
        .port_start = sata_fsl_port_start,
        .port_stop = sata_fsl_port_stop,
+        .pmp_attach = sata_fsl_pmp_attach,
+        .pmp_detach = sata_fsl_pmp_detach,
 };
 static const struct ata_port_info sata_fsl_port_info[] = {
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index fb81f0c7a8c2..60391e9a84db 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -72,7 +72,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "sata_mv"
-#define DRV_VERSION     "1.21"
+#define DRV_VERSION     "1.24"
 enum {
        /* BAR's are enumerated in terms of pci_resource_start() terms */
@@ -122,8 +122,6 @@ enum {
        /* Host Flags */
        MV_FLAG_DUAL_HC         = (1 << 30),  /* two SATA Host Controllers */
        MV_FLAG_IRQ_COALESCE    = (1 << 29),  /* IRQ coalescing capability */
-        /* SoC integrated controllers, no PCI interface */
-        MV_FLAG_SOC             = (1 << 28),
        MV_COMMON_FLAGS         = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
                                  ATA_FLAG_MMIO | ATA_FLAG_NO_ATAPI |
@@ -226,6 +224,11 @@ enum {
        PHY_MODE3               = 0x310,
        PHY_MODE4               = 0x314,
+        PHY_MODE4_CFG_MASK      = 0x00000003,   /* phy internal config field */
+        PHY_MODE4_CFG_VALUE     = 0x00000001,   /* phy internal config field */
+        PHY_MODE4_RSVD_ZEROS    = 0x5de3fffa,   /* Gen2e always write zeros */
+        PHY_MODE4_RSVD_ONES     = 0x00000005,   /* Gen2e always write ones */
        PHY_MODE2               = 0x330,
        SATA_IFCTL_OFS          = 0x344,
        SATA_TESTCTL_OFS        = 0x348,
@@ -356,12 +359,12 @@ enum {
        MV_HP_ERRATA_50XXB2     = (1 << 2),
        MV_HP_ERRATA_60X1B2     = (1 << 3),
        MV_HP_ERRATA_60X1C0     = (1 << 4),
-        MV_HP_ERRATA_XX42A0     = (1 << 5),
        MV_HP_GEN_I             = (1 << 6),     /* Generation I: 50xx */
        MV_HP_GEN_II            = (1 << 7),     /* Generation II: 60xx */
        MV_HP_GEN_IIE           = (1 << 8),     /* Generation IIE: 6042/7042 */
        MV_HP_PCIE              = (1 << 9),     /* PCIe bus/regs: 7042 */
        MV_HP_CUT_THROUGH       = (1 << 10),    /* can use EDMA cut-through */
+        MV_HP_FLAG_SOC          = (1 << 11),    /* SystemOnChip, no PCI */
        /* Port private flags (pp_flags) */
        MV_PP_FLAG_EDMA_EN      = (1 << 0),     /* is EDMA engine enabled? */
@@ -374,7 +377,7 @@ enum {
 #define IS_GEN_II(hpriv) ((hpriv)->hp_flags & MV_HP_GEN_II)
 #define IS_GEN_IIE(hpriv) ((hpriv)->hp_flags & MV_HP_GEN_IIE)
 #define IS_PCIE(hpriv) ((hpriv)->hp_flags & MV_HP_PCIE)
-#define HAS_PCI(host) (!((host)->ports[0]->flags & MV_FLAG_SOC))
+#define IS_SOC(hpriv) ((hpriv)->hp_flags & MV_HP_FLAG_SOC)
 #define WINDOW_CTRL(i)          (0x20030 + ((i) << 4))
 #define WINDOW_BASE(i)          (0x20034 + ((i) << 4))
@@ -652,7 +655,7 @@ static const struct ata_port_info mv_port_info[] = {
                .port_ops       = &mv_iie_ops,
        },
        {  /* chip_soc */
-                .flags          = MV_GENIIE_FLAGS | MV_FLAG_SOC,
+                .flags          = MV_GENIIE_FLAGS,
                .pio_mask       = 0x1f, /* pio0-4 */
                .udma_mask      = ATA_UDMA6,
                .port_ops       = &mv_iie_ops,
@@ -812,12 +815,7 @@ static void mv_set_edma_ptrs(void __iomem *port_mmio,
        writel((pp->crqb_dma >> 16) >> 16, port_mmio + EDMA_REQ_Q_BASE_HI_OFS);
        writelfl((pp->crqb_dma & EDMA_REQ_Q_BASE_LO_MASK) | index,
                 port_mmio + EDMA_REQ_Q_IN_PTR_OFS);
+        writelfl(index, port_mmio + EDMA_REQ_Q_OUT_PTR_OFS);
-        if (hpriv->hp_flags & MV_HP_ERRATA_XX42A0)
-                writelfl((pp->crqb_dma & 0xffffffff) | index,
-                         port_mmio + EDMA_REQ_Q_OUT_PTR_OFS);
-        else
-                writelfl(index, port_mmio + EDMA_REQ_Q_OUT_PTR_OFS);
        /*
         * initialize response queue
@@ -827,13 +825,7 @@ static void mv_set_edma_ptrs(void __iomem *port_mmio,
        WARN_ON(pp->crpb_dma & 0xff);
        writel((pp->crpb_dma >> 16) >> 16, port_mmio + EDMA_RSP_Q_BASE_HI_OFS);
+        writelfl(index, port_mmio + EDMA_RSP_Q_IN_PTR_OFS);
-        if (hpriv->hp_flags & MV_HP_ERRATA_XX42A0)
-                writelfl((pp->crpb_dma & 0xffffffff) | index,
-                         port_mmio + EDMA_RSP_Q_IN_PTR_OFS);
-        else
-                writelfl(index, port_mmio + EDMA_RSP_Q_IN_PTR_OFS);
        writelfl((pp->crpb_dma & EDMA_RSP_Q_BASE_LO_MASK) | index,
                 port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
 }
@@ -1254,7 +1246,7 @@ static void mv_edma_cfg(struct ata_port *ap, int want_ncq)
                cfg |= (1 << 23);       /* do not mask PM field in rx'd FIS */
                cfg |= (1 << 22);       /* enab 4-entry host queue cache */
-                if (HAS_PCI(ap->host))
+                if (!IS_SOC(hpriv))
                        cfg |= (1 << 18);       /* enab early completion */
                if (hpriv->hp_flags & MV_HP_CUT_THROUGH)
                        cfg |= (1 << 17); /* enab cut-thru (dis stor&forwrd) */
@@ -2225,7 +2217,7 @@ static irqreturn_t mv_interrupt(int irq, void *dev_instance)
         * a bogus register value which can indicate HW removal or PCI fault.
         */
        if (pending_irqs && main_irq_cause != 0xffffffffU) {
-                if (unlikely((pending_irqs & PCI_ERR) && HAS_PCI(host)))
+                if (unlikely((pending_irqs & PCI_ERR) && !IS_SOC(hpriv)))
                        handled = mv_pci_error(host, hpriv->base);
                else
                        handled = mv_host_intr(host, pending_irqs);
@@ -2547,7 +2539,7 @@ static void mv6_phy_errata(struct mv_host_priv *hpriv, void __iomem *mmio,
                hp_flags & (MV_HP_ERRATA_60X1B2 | MV_HP_ERRATA_60X1C0);
        int fix_phy_mode4 =
                hp_flags & (MV_HP_ERRATA_60X1B2 | MV_HP_ERRATA_60X1C0);
-        u32 m2, tmp;
+        u32 m2, m3;
        if (fix_phy_mode2) {
                m2 = readl(port_mmio + PHY_MODE2);
@@ -2564,28 +2556,36 @@ static void mv6_phy_errata(struct mv_host_priv *hpriv, void __iomem *mmio,
                udelay(200);
        }
-        /* who knows what this magic does */
+        /*
-        tmp = readl(port_mmio + PHY_MODE3);
+         * Gen-II/IIe PHY_MODE3 errata RM#2:
-        tmp &= ~0x7F800000;
+         * Achieves better receiver noise performance than the h/w default:
-        tmp |= 0x2A800000;
+         */
-        writel(tmp, port_mmio + PHY_MODE3);
+        m3 = readl(port_mmio + PHY_MODE3);
+        m3 = (m3 & 0x1f) | (0x5555601 << 5);
-        if (fix_phy_mode4) {
-                u32 m4;
-                m4 = readl(port_mmio + PHY_MODE4);
-                if (hp_flags & MV_HP_ERRATA_60X1B2)
-                        tmp = readl(port_mmio + PHY_MODE3);
-                /* workaround for errata FEr SATA#10 (part 1) */
+        /* Guideline 88F5182 (GL# SATA-S11) */
-                m4 = (m4 & ~(1 << 1)) | (1 << 0);
+        if (IS_SOC(hpriv))
+                m3 &= ~0x1c;
+        if (fix_phy_mode4) {
+                u32 m4 = readl(port_mmio + PHY_MODE4);
+                /*
+                 * Enforce reserved-bit restrictions on GenIIe devices only.
+                 * For earlier chipsets, force only the internal config field
+                 *  (workaround for errata FEr SATA#10 part 1).
+                 */
+                if (IS_GEN_IIE(hpriv))
+                        m4 = (m4 & ~PHY_MODE4_RSVD_ZEROS) | PHY_MODE4_RSVD_ONES;
+                else
+                        m4 = (m4 & ~PHY_MODE4_CFG_MASK) | PHY_MODE4_CFG_VALUE;
                writel(m4, port_mmio + PHY_MODE4);
-                if (hp_flags & MV_HP_ERRATA_60X1B2)
-                        writel(tmp, port_mmio + PHY_MODE3);
        }
+        /*
+         * Workaround for 60x1-B2 errata SATA#13:
+         * Any write to PHY_MODE4 (above) may corrupt PHY_MODE3,
+         * so we must always rewrite PHY_MODE3 after PHY_MODE4.
+         */
+        writel(m3, port_mmio + PHY_MODE3);
        /* Revert values of pre-emphasis and signal amps to the saved ones */
        m2 = readl(port_mmio + PHY_MODE2);
@@ -2876,7 +2876,7 @@ static unsigned int mv_in_pcix_mode(struct ata_host *host)
        void __iomem *mmio = hpriv->base;
        u32 reg;
-        if (!HAS_PCI(host) || !IS_PCIE(hpriv))
+        if (IS_SOC(hpriv) || !IS_PCIE(hpriv))
                return 0;       /* not PCI-X capable */
        reg = readl(mmio + MV_PCI_MODE_OFS);
        if ((reg & MV_PCI_MODE_MASK) == 0)
@@ -3003,10 +3003,7 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
                        hp_flags |= MV_HP_CUT_THROUGH;
                switch (pdev->revision) {
-                case 0x0:
+                case 0x2: /* Rev.B0: the first/only public release */
-                        hp_flags |= MV_HP_ERRATA_XX42A0;
-                        break;
-                case 0x1:
                        hp_flags |= MV_HP_ERRATA_60X1C0;
                        break;
                default:
@@ -3018,7 +3015,7 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
                break;
        case chip_soc:
                hpriv->ops = &mv_soc_ops;
-                hp_flags |= MV_HP_ERRATA_60X1C0;
+                hp_flags |= MV_HP_FLAG_SOC | MV_HP_ERRATA_60X1C0;
                break;
        default:
@@ -3062,12 +3059,12 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
        if (rc)
                goto done;
-        if (HAS_PCI(host)) {
+        if (IS_SOC(hpriv)) {
-                hpriv->main_irq_cause_addr = mmio + PCI_HC_MAIN_IRQ_CAUSE_OFS;
-                hpriv->main_irq_mask_addr  = mmio + PCI_HC_MAIN_IRQ_MASK_OFS;
-        } else {
                hpriv->main_irq_cause_addr = mmio + SOC_HC_MAIN_IRQ_CAUSE_OFS;
                hpriv->main_irq_mask_addr  = mmio + SOC_HC_MAIN_IRQ_MASK_OFS;
+        } else {
+                hpriv->main_irq_cause_addr = mmio + PCI_HC_MAIN_IRQ_CAUSE_OFS;
+                hpriv->main_irq_mask_addr  = mmio + PCI_HC_MAIN_IRQ_MASK_OFS;
        }
        /* global interrupt mask: 0 == mask everything */
@@ -3093,7 +3090,7 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
                mv_port_init(&ap->ioaddr, port_mmio);
 #ifdef CONFIG_PCI
-                if (HAS_PCI(host)) {
+                if (!IS_SOC(hpriv)) {
                        unsigned int offset = port_mmio - mmio;
                        ata_port_pbar_desc(ap, MV_PRIMARY_BAR, -1, "mmio");
                        ata_port_pbar_desc(ap, MV_PRIMARY_BAR, offset, "port");
@@ -3113,7 +3110,7 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
                writelfl(0, hc_mmio + HC_IRQ_CAUSE_OFS);
        }
-        if (HAS_PCI(host)) {
+        if (!IS_SOC(hpriv)) {
                /* Clear any currently outstanding host interrupt conditions */
                writelfl(0, mmio + hpriv->irq_cause_ofs);
diff --git a/drivers/atm/eni.h b/drivers/atm/eni.h
index d04fefb0841f..e4c9525e60b3 100644
--- a/drivers/atm/eni.h
+++ b/drivers/atm/eni.h
@@ -18,7 +18,6 @@
 #include "midway.h"
-#define KERNEL_OFFSET   0xC0000000      /* kernel 0x0 is at phys 0xC0000000 */
 #define DEV_LABEL       "eni"
 #define UBR_BUFFER      (128*1024)      /* UBR buffer size */
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 72eccae4904b..ee0a51a3a41d 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -760,6 +760,22 @@ static void device_remove_class_symlinks(struct device *dev)
 }
 /**
+ * dev_set_name - set a device name
+ * @dev: device
+ * @fmt: format string for the device's name
+ */
+int dev_set_name(struct device *dev, const char *fmt, ...)
+{
+        va_list vargs;
+        va_start(vargs, fmt);
+        vsnprintf(dev->bus_id, sizeof(dev->bus_id), fmt, vargs);
+        va_end(vargs);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dev_set_name);
+/**
 * device_add - add device to device hierarchy.
 * @dev: device.
 *
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index a196ef7f147f..24b97b0bef99 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -397,6 +397,7 @@ module_param(max_part, int, 0);
 MODULE_PARM_DESC(max_part, "Maximum number of partitions per RAM disk");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_BLOCKDEV_MAJOR(RAMDISK_MAJOR);
+MODULE_ALIAS("rd");
 #ifndef MODULE
 /* Legacy boot options - nonmodular */
@@ -447,6 +448,7 @@ static struct brd_device *brd_alloc(int i)
        disk->fops              = &brd_fops;
        disk->private_data      = brd;
        disk->queue             = brd->brd_queue;
+        disk->flags |= GENHD_FL_SUPPRESS_PARTITION_INFO;
        sprintf(disk->disk_name, "ram%d", i);
        set_capacity(disk, rd_size * 2);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index e336b05fe4a7..5f1e1cc6165a 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -53,15 +53,16 @@
 #include <linux/scatterlist.h>
 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
-#define DRIVER_NAME "HP CISS Driver (v 3.6.14)"
+#define DRIVER_NAME "HP CISS Driver (v 3.6.20)"
-#define DRIVER_VERSION CCISS_DRIVER_VERSION(3,6,14)
+#define DRIVER_VERSION CCISS_DRIVER_VERSION(3, 6, 20)
 /* Embedded module documentation macros - see modules.h */
 MODULE_AUTHOR("Hewlett-Packard Company");
-MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 3.6.14");
+MODULE_DESCRIPTION("Driver for HP Smart Array Controllers");
 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
-                        " SA6i P600 P800 P400 P400i E200 E200i E500");
+                        " SA6i P600 P800 P400 P400i E200 E200i E500 P700m"
-MODULE_VERSION("3.6.14");
+                        " Smart Array G2 Series SAS/SATA Controllers");
+MODULE_VERSION("3.6.20");
 MODULE_LICENSE("GPL");
 #include "cciss_cmd.h"
@@ -90,6 +91,11 @@ static const struct pci_device_id cciss_pci_device_id[] = {
        {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
        {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3237},
        {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x323D},
+        {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3241},
+        {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3243},
+        {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3245},
+        {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3247},
+        {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3249},
        {PCI_VENDOR_ID_HP,     PCI_ANY_ID,      PCI_ANY_ID, PCI_ANY_ID,
                PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
        {0,}
@@ -123,6 +129,11 @@ static struct board_type products[] = {
        {0x3215103C, "Smart Array E200i", &SA5_access, 120},
        {0x3237103C, "Smart Array E500", &SA5_access, 512},
        {0x323D103C, "Smart Array P700m", &SA5_access, 512},
+        {0x3241103C, "Smart Array P212", &SA5_access, 384},
+        {0x3243103C, "Smart Array P410", &SA5_access, 384},
+        {0x3245103C, "Smart Array P410i", &SA5_access, 384},
+        {0x3247103C, "Smart Array P411", &SA5_access, 384},
+        {0x3249103C, "Smart Array P812", &SA5_access, 384},
        {0xFFFF103C, "Unknown Smart Array", &SA5_access, 120},
 };
diff --git a/drivers/block/viodasd.c b/drivers/block/viodasd.c
index ebfe038d859e..f1c8feb5510b 100644
--- a/drivers/block/viodasd.c
+++ b/drivers/block/viodasd.c
@@ -3,7 +3,7 @@
 *  Authors: Dave Boutcher <boutcher@us.ibm.com>
 *           Ryan Arnold <ryanarn@us.ibm.com>
 *           Colin Devilbiss <devilbis@us.ibm.com>
- *           Stephen Rothwell <sfr@au1.ibm.com>
+ *           Stephen Rothwell
 *
 * (C) Copyright 2000-2004 IBM Corporation
 *
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 84e064ffee52..dd7ea203f940 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -260,6 +260,10 @@ static int virtblk_probe(struct virtio_device *vdev)
        if (virtio_has_feature(vdev, VIRTIO_BLK_F_BARRIER))
                blk_queue_ordered(vblk->disk->queue, QUEUE_ORDERED_TAG, NULL);
+        /* If disk is read-only in the host, the guest should obey */
+        if (virtio_has_feature(vdev, VIRTIO_BLK_F_RO))
+                set_disk_ro(vblk->disk, 1);
        /* Host must always specify the capacity. */
        vdev->config->get(vdev, offsetof(struct virtio_blk_config, capacity),
                          &cap, sizeof(cap));
@@ -311,6 +315,7 @@ static void virtblk_remove(struct virtio_device *vdev)
        /* Stop all the virtqueues. */
        vdev->config->reset(vdev);
+        del_gendisk(vblk->disk);
        blk_cleanup_queue(vblk->disk->queue);
        put_disk(vblk->disk);
        mempool_destroy(vblk->pool);
@@ -325,7 +330,7 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
        VIRTIO_BLK_F_BARRIER, VIRTIO_BLK_F_SEG_MAX, VIRTIO_BLK_F_SIZE_MAX,
-        VIRTIO_BLK_F_GEOMETRY,
+        VIRTIO_BLK_F_GEOMETRY, VIRTIO_BLK_F_RO,
 };
 static struct virtio_driver virtio_blk = {
diff --git a/drivers/cdrom/viocd.c b/drivers/cdrom/viocd.c
index 5245a4a0ba74..9d0dfe6e0d63 100644
--- a/drivers/cdrom/viocd.c
+++ b/drivers/cdrom/viocd.c
@@ -6,7 +6,7 @@
 *  Authors: Dave Boutcher <boutcher@us.ibm.com>
 *           Ryan Arnold <ryanarn@us.ibm.com>
 *           Colin Devilbiss <devilbis@us.ibm.com>
- *           Stephen Rothwell <sfr@au1.ibm.com>
+ *           Stephen Rothwell
 *
 * (C) Copyright 2000-2004 IBM Corporation
 *
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 595a925c62a9..2d854bb9373e 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -118,8 +118,8 @@ config COMPUTONE
          order to become a dial-in server. If you have a card like that, say
          Y here and read <file:Documentation/computone.txt>.
-          To compile this driver as modules, choose M here: the
+          To compile this driver as module, choose M here: the
-          modules will be called ip2 and ip2main.
+          module will be called ip2.
 config ROCKETPORT
        tristate "Comtrol RocketPort support"
@@ -749,7 +749,7 @@ config NVRAM
 if RTC_LIB=n
 config RTC
-        tristate "Enhanced Real Time Clock Support"
+        tristate "Enhanced Real Time Clock Support (legacy PC RTC driver)"
        depends on !PPC && !PARISC && !IA64 && !M68K && !SPARC && !FRV \
                        && !ARM && !SUPERH && !S390 && !AVR32
        ---help---
@@ -1036,9 +1036,9 @@ config HPET
          non-periodic and/or periodic.
 config HPET_RTC_IRQ
-        bool "HPET Control RTC IRQ" if !HPET_EMULATE_RTC
+        bool
-        default n
+        default HPET_EMULATE_RTC
-        depends on HPET
+        depends on RTC && HPET
        help
          If you say Y here, you will disable RTC_IRQ in drivers/char/rtc.c. It
          is assumed the platform called hpet_alloc with the RTC IRQ values for
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index 55c97f623242..07b4d8ff56e5 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -458,6 +458,10 @@ static struct agp_device_ids ati_agp_device_ids[] __devinitdata =
                .chipset_name   = "IGP9100/M",
        },
        {
+                .device_id      = PCI_DEVICE_ID_ATI_RS350_133,
+                .chipset_name   = "IGP9000/M",
+        },
+        {
                .device_id      = PCI_DEVICE_ID_ATI_RS350_200,
                .chipset_name   = "IGP9100/M",
        },
diff --git a/drivers/char/drm/drm_sysfs.c b/drivers/char/drm/drm_sysfs.c
index 9a32169e88fb..af211a0ef179 100644
--- a/drivers/char/drm/drm_sysfs.c
+++ b/drivers/char/drm/drm_sysfs.c
@@ -34,8 +34,6 @@ static int drm_sysfs_suspend(struct device *dev, pm_message_t state)
        struct drm_minor *drm_minor = to_drm_minor(dev);
        struct drm_device *drm_dev = drm_minor->dev;
-        printk(KERN_ERR "%s\n", __func__);
        if (drm_dev->driver->suspend)
                return drm_dev->driver->suspend(drm_dev, state);
diff --git a/drivers/char/generic_nvram.c b/drivers/char/generic_nvram.c
index 2398e864c28d..a00869c650d5 100644
--- a/drivers/char/generic_nvram.c
+++ b/drivers/char/generic_nvram.c
@@ -133,7 +133,7 @@ static struct miscdevice nvram_dev = {
 int __init nvram_init(void)
 {
-        printk(KERN_INFO "Macintosh non-volatile memory driver v%s\n",
+        printk(KERN_INFO "Generic non-volatile memory driver v%s\n",
                NVRAM_VERSION);
        return misc_register(&nvram_dev);
 }
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index 8d6c2089d2a8..efd0b4db7c8e 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -112,3 +112,12 @@ config HW_RANDOM_PASEMI
          If unsure, say Y.
+config HW_RANDOM_VIRTIO
+        tristate "VirtIO Random Number Generator support"
+        depends on HW_RANDOM && VIRTIO
+        ---help---
+          This driver provides kernel-side support for the virtual Random Number
+          Generator hardware.
+          To compile this driver as a module, choose M here: the
+          module will be called virtio-rng.  If unsure, say N.
diff --git a/drivers/char/hw_random/Makefile b/drivers/char/hw_random/Makefile
index c8b7300e2fb1..b4940ddbb35f 100644
--- a/drivers/char/hw_random/Makefile
+++ b/drivers/char/hw_random/Makefile
@@ -11,3 +11,4 @@ obj-$(CONFIG_HW_RANDOM_VIA) += via-rng.o
 obj-$(CONFIG_HW_RANDOM_IXP4XX) += ixp4xx-rng.o
 obj-$(CONFIG_HW_RANDOM_OMAP) += omap-rng.o
 obj-$(CONFIG_HW_RANDOM_PASEMI) += pasemi-rng.o
+obj-$(CONFIG_HW_RANDOM_VIRTIO) += virtio-rng.o
diff --git a/drivers/char/hw_random/intel-rng.c b/drivers/char/hw_random/intel-rng.c
index 5cc651ef75eb..27fdc0866496 100644
--- a/drivers/char/hw_random/intel-rng.c
+++ b/drivers/char/hw_random/intel-rng.c
@@ -273,7 +273,7 @@ static int __init intel_rng_hw_init(void *_intel_rng_hw)
        if (mfc != INTEL_FWH_MANUFACTURER_CODE ||
            (dvc != INTEL_FWH_DEVICE_CODE_8M &&
             dvc != INTEL_FWH_DEVICE_CODE_4M)) {
-                printk(KERN_ERR PFX "FWH not detected\n");
+                printk(KERN_NOTICE PFX "FWH not detected\n");
                return -ENODEV;
        }
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
new file mode 100644
index 000000000000..d0e563e4fc39
--- /dev/null
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -0,0 +1,155 @@
+/*
+ * Randomness driver for virtio
+ *  Copyright (C) 2007, 2008 Rusty Russell IBM Corporation
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+ */
+#include <linux/err.h>
+#include <linux/hw_random.h>
+#include <linux/scatterlist.h>
+#include <linux/spinlock.h>
+#include <linux/virtio.h>
+#include <linux/virtio_rng.h>
+/* The host will fill any buffer we give it with sweet, sweet randomness.  We
+ * give it 64 bytes at a time, and the hwrng framework takes it 4 bytes at a
+ * time. */
+#define RANDOM_DATA_SIZE 64
+static struct virtqueue *vq;
+static u32 *random_data;
+static unsigned int data_left;
+static DECLARE_COMPLETION(have_data);
+static void random_recv_done(struct virtqueue *vq)
+{
+        int len;
+        /* We never get spurious callbacks. */
+        if (!vq->vq_ops->get_buf(vq, &len))
+                BUG();
+        data_left = len / sizeof(random_data[0]);
+        complete(&have_data);
+}
+static void register_buffer(void)
+{
+        struct scatterlist sg;
+        sg_init_one(&sg, random_data, RANDOM_DATA_SIZE);
+        /* There should always be room for one buffer. */
+        if (vq->vq_ops->add_buf(vq, &sg, 0, 1, random_data) != 0)
+                BUG();
+        vq->vq_ops->kick(vq);
+}
+/* At least we don't udelay() in a loop like some other drivers. */
+static int virtio_data_present(struct hwrng *rng, int wait)
+{
+        if (data_left)
+                return 1;
+        if (!wait)
+                return 0;
+        wait_for_completion(&have_data);
+        return 1;
+}
+/* virtio_data_present() must have succeeded before this is called. */
+static int virtio_data_read(struct hwrng *rng, u32 *data)
+{
+        BUG_ON(!data_left);
+        *data = random_data[--data_left];
+        if (!data_left) {
+                init_completion(&have_data);
+                register_buffer();
+        }
+        return sizeof(*data);
+}
+static struct hwrng virtio_hwrng = {
+        .name = "virtio",
+        .data_present = virtio_data_present,
+        .data_read = virtio_data_read,
+};
+static int virtrng_probe(struct virtio_device *vdev)
+{
+        int err;
+        /* We expect a single virtqueue. */
+        vq = vdev->config->find_vq(vdev, 0, random_recv_done);
+        if (IS_ERR(vq))
+                return PTR_ERR(vq);
+        err = hwrng_register(&virtio_hwrng);
+        if (err) {
+                vdev->config->del_vq(vq);
+                return err;
+        }
+        register_buffer();
+        return 0;
+}
+static void virtrng_remove(struct virtio_device *vdev)
+{
+        vdev->config->reset(vdev);
+        hwrng_unregister(&virtio_hwrng);
+        vdev->config->del_vq(vq);
+}
+static struct virtio_device_id id_table[] = {
+        { VIRTIO_ID_RNG, VIRTIO_DEV_ANY_ID },
+        { 0 },
+};
+static struct virtio_driver virtio_rng = {
+        .driver.name =  KBUILD_MODNAME,
+        .driver.owner = THIS_MODULE,
+        .id_table =     id_table,
+        .probe =        virtrng_probe,
+        .remove =       __devexit_p(virtrng_remove),
+};
+static int __init init(void)
+{
+        int err;
+        random_data = kmalloc(RANDOM_DATA_SIZE, GFP_KERNEL);
+        if (!random_data)
+                return -ENOMEM;
+        err = register_virtio_driver(&virtio_rng);
+        if (err)
+                kfree(random_data);
+        return err;
+}
+static void __exit fini(void)
+{
+        kfree(random_data);
+        unregister_virtio_driver(&virtio_rng);
+}
+module_init(init);
+module_exit(fini);
+MODULE_DEVICE_TABLE(virtio, id_table);
+MODULE_DESCRIPTION("Virtio random number driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/ip2/Makefile b/drivers/char/ip2/Makefile
index 6bfe2543ddc2..939618f62fe1 100644
--- a/drivers/char/ip2/Makefile
+++ b/drivers/char/ip2/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the Computone IntelliPort Plus Driver
 #
-obj-$(CONFIG_COMPUTONE)         += ip2.o ip2main.o
+obj-$(CONFIG_COMPUTONE)         += ip2.o
-ip2-objs                        := ip2base.o
+ip2-objs                        := ip2base.o ip2main.o
diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
index 70957acaa960..c12cf8fc4be0 100644
--- a/drivers/char/ip2/ip2main.c
+++ b/drivers/char/ip2/ip2main.c
@@ -346,27 +346,6 @@ have_requested_irq( char irq )
 }
 /******************************************************************************/
-/* Function:   init_module()                                                  */
-/* Parameters: None                                                           */
-/* Returns:    Success (0)                                                    */
-/*                                                                            */
-/* Description:                                                               */
-/* This is a required entry point for an installable module. It simply calls  */
-/* the driver initialisation function and returns what it returns.            */
-/******************************************************************************/
-#ifdef MODULE
-static int __init
-ip2_init_module(void)
-{
-#ifdef IP2DEBUG_INIT
-        printk (KERN_DEBUG "Loading module ...\n" );
-#endif
-    return 0;
-}
-module_init(ip2_init_module);
-#endif /* MODULE */
-/******************************************************************************/
 /* Function:   cleanup_module()                                               */
 /* Parameters: None                                                           */
 /* Returns:    Nothing                                                        */
@@ -779,8 +758,6 @@ out:
        return err;
 }
-EXPORT_SYMBOL(ip2_loadmain);
 /******************************************************************************/
 /* Function:   ip2_init_board()                                               */
 /* Parameters: Index of board in configuration structure                      */
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 7f7e798c1384..d9a0a53c842d 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -677,12 +677,7 @@ static void k_deadunicode(struct vc_data *vc, unsigned int value, char up_flag)
 static void k_self(struct vc_data *vc, unsigned char value, char up_flag)
 {
-        unsigned int uni;
+        k_unicode(vc, conv_8bit_to_uni(value), up_flag);
-        if (kbd->kbdmode == VC_UNICODE)
-                uni = value;
-        else
-                uni = conv_8bit_to_uni(value);
-        k_unicode(vc, uni, up_flag);
 }
 static void k_dead2(struct vc_data *vc, unsigned char value, char up_flag)
diff --git a/drivers/char/pcmcia/ipwireless/hardware.c b/drivers/char/pcmcia/ipwireless/hardware.c
index fa9d3c945f31..ba6340ae98af 100644
--- a/drivers/char/pcmcia/ipwireless/hardware.c
+++ b/drivers/char/pcmcia/ipwireless/hardware.c
@@ -251,10 +251,11 @@ struct ipw_hardware {
        int init_loops;
        struct timer_list setup_timer;
+        /* Flag if hw is ready to send next packet */
        int tx_ready;
-        struct list_head tx_queue[NL_NUM_OF_PRIORITIES];
+        /* Count of pending packets to be sent */
-        /* True if any packets are queued for transmission */
        int tx_queued;
+        struct list_head tx_queue[NL_NUM_OF_PRIORITIES];
        int rx_bytes_queued;
        struct list_head rx_queue;
@@ -404,6 +405,8 @@ static int do_send_fragment(struct ipw_hardware *hw, const unsigned char *data,
        spin_lock_irqsave(&hw->spinlock, flags);
+        hw->tx_ready = 0;
        if (hw->hw_version == HW_VERSION_1) {
                outw((unsigned short) length, hw->base_port + IODWR);
@@ -492,6 +495,7 @@ static int do_send_packet(struct ipw_hardware *hw, struct ipw_tx_packet *packet)
                spin_lock_irqsave(&hw->spinlock, flags);
                list_add(&packet->queue, &hw->tx_queue[0]);
+                hw->tx_queued++;
                spin_unlock_irqrestore(&hw->spinlock, flags);
        } else {
                if (packet->packet_callback)
@@ -949,12 +953,10 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
        unsigned long flags;
        spin_lock_irqsave(&hw->spinlock, flags);
-        if (hw->tx_queued && hw->tx_ready != 0) {
+        if (hw->tx_queued && hw->tx_ready) {
                int priority;
                struct ipw_tx_packet *packet = NULL;
-                hw->tx_ready--;
                /* Pick a packet */
                for (priority = 0; priority < priority_limit; priority++) {
                        if (!list_empty(&hw->tx_queue[priority])) {
@@ -963,6 +965,7 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
                                                struct ipw_tx_packet,
                                                queue);
+                                hw->tx_queued--;
                                list_del(&packet->queue);
                                break;
@@ -973,6 +976,7 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
                        spin_unlock_irqrestore(&hw->spinlock, flags);
                        return 0;
                }
                spin_unlock_irqrestore(&hw->spinlock, flags);
                /* Send */
@@ -1063,7 +1067,7 @@ static irqreturn_t ipwireless_handle_v1_interrupt(int irq,
                if (irqn & IR_TXINTR) {
                        ack |= IR_TXINTR;
                        spin_lock_irqsave(&hw->spinlock, flags);
-                        hw->tx_ready++;
+                        hw->tx_ready = 1;
                        spin_unlock_irqrestore(&hw->spinlock, flags);
                }
                /* Received data */
@@ -1170,7 +1174,7 @@ static irqreturn_t ipwireless_handle_v2_v3_interrupt(int irq,
        if (memrxdone & MEMRX_RX_DONE) {
                writew(0, &hw->memory_info_regs->memreg_rx_done);
                spin_lock_irqsave(&hw->spinlock, flags);
-                hw->tx_ready++;
+                hw->tx_ready = 1;
                spin_unlock_irqrestore(&hw->spinlock, flags);
                tx = 1;
        }
@@ -1234,7 +1238,7 @@ static void send_packet(struct ipw_hardware *hw, int priority,
        spin_lock_irqsave(&hw->spinlock, flags);
        list_add_tail(&packet->queue, &hw->tx_queue[priority]);
-        hw->tx_queued = 1;
+        hw->tx_queued++;
        spin_unlock_irqrestore(&hw->spinlock, flags);
        flush_packets_to_hw(hw);
diff --git a/drivers/char/viocons.c b/drivers/char/viocons.c
index 3d3e1c2b310f..65fb848e1cce 100644
--- a/drivers/char/viocons.c
+++ b/drivers/char/viocons.c
@@ -7,7 +7,7 @@
 *  Authors: Dave Boutcher <boutcher@us.ibm.com>
 *           Ryan Arnold <ryanarn@us.ibm.com>
 *           Colin Devilbiss <devilbis@us.ibm.com>
- *           Stephen Rothwell <sfr@au1.ibm.com>
+ *           Stephen Rothwell
 *
 * (C) Copyright 2000, 2001, 2002, 2003, 2004 IBM Corporation
 *
diff --git a/drivers/char/viotape.c b/drivers/char/viotape.c
index 58aad63831f4..c39ddaff5e8f 100644
--- a/drivers/char/viotape.c
+++ b/drivers/char/viotape.c
@@ -6,7 +6,7 @@
 *  Authors: Dave Boutcher <boutcher@us.ibm.com>
 *           Ryan Arnold <ryanarn@us.ibm.com>
 *           Colin Devilbiss <devilbis@us.ibm.com>
- *           Stephen Rothwell <sfr@au1.ibm.com>
+ *           Stephen Rothwell
 *
 * (C) Copyright 2000-2004 IBM Corporation
 *
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index fa1ffbf2c621..935f1c207a1f 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -434,7 +434,7 @@ static void update_attr(struct vc_data *vc)
                      vc->vc_blink, vc->vc_underline,
                      vc->vc_reverse ^ vc->vc_decscnm, vc->vc_italic);
        vc->vc_video_erase_char = (build_attr(vc, vc->vc_color, 1, vc->vc_blink, 0, vc->vc_decscnm, 0) << 8) | ' ';
-        vc->vc_scrl_erase_char = (build_attr(vc, vc->vc_def_color, 1, false, false, false, false) << 8) | ' ';
+        vc->vc_scrl_erase_char = (build_attr(vc, vc->vc_def_color, 1, false, false, vc->vc_decscnm, false) << 8) | ' ';
 }
 /* Note: inverting the screen twice should revert to the original state */
@@ -909,7 +909,7 @@ int vc_resize(struct vc_data *vc, unsigned int cols, unsigned int lines)
        if (vc->vc_tty) {
                struct winsize ws, *cws = &vc->vc_tty->winsize;
-                unsigned long flags;
+                struct pid *pgrp = NULL;
                memset(&ws, 0, sizeof(ws));
                ws.ws_row = vc->vc_rows;
@@ -917,11 +917,14 @@ int vc_resize(struct vc_data *vc, unsigned int cols, unsigned int lines)
                ws.ws_ypixel = vc->vc_scan_lines;
                mutex_lock(&vc->vc_tty->termios_mutex);
-                spin_lock_irqsave(&vc->vc_tty->ctrl_lock, flags);
+                spin_lock_irq(&vc->vc_tty->ctrl_lock);
-                if ((ws.ws_row != cws->ws_row || ws.ws_col != cws->ws_col) &&
+                if ((ws.ws_row != cws->ws_row || ws.ws_col != cws->ws_col))
-                    vc->vc_tty->pgrp)
+                        pgrp = get_pid(vc->vc_tty->pgrp);
+                spin_unlock_irq(&vc->vc_tty->ctrl_lock);
+                if (pgrp) {
                        kill_pgrp(vc->vc_tty->pgrp, SIGWINCH, 1);
-                spin_unlock_irqrestore(&vc->vc_tty->ctrl_lock, flags);
+                        put_pid(pgrp);
+                }
                *cws = ws;
                mutex_unlock(&vc->vc_tty->termios_mutex);
        }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 7fce038fa57e..1d41496ed2f8 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -412,7 +412,7 @@ static int cpufreq_parse_governor(char *str_governor, unsigned int *policy,
                                int ret;
                                mutex_unlock(&cpufreq_governor_mutex);
-                                ret = request_module(name);
+                                ret = request_module("%s", name);
                                mutex_lock(&cpufreq_governor_mutex);
                                if (ret == 0)
@@ -625,7 +625,7 @@ static ssize_t store_scaling_setspeed(struct cpufreq_policy *policy,
        unsigned int freq = 0;
        unsigned int ret;
-        if (!policy->governor->store_setspeed)
+        if (!policy->governor || !policy->governor->store_setspeed)
                return -EINVAL;
        ret = sscanf(buf, "%u", &freq);
@@ -639,7 +639,7 @@ static ssize_t store_scaling_setspeed(struct cpufreq_policy *policy,
 static ssize_t show_scaling_setspeed(struct cpufreq_policy *policy, char *buf)
 {
-        if (!policy->governor->show_setspeed)
+        if (!policy->governor || !policy->governor->show_setspeed)
                return sprintf(buf, "<unsupported>\n");
        return policy->governor->show_setspeed(policy, buf);
@@ -928,13 +928,13 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
        policy->user_policy.policy = policy->policy;
        policy->user_policy.governor = policy->governor;
-        unlock_policy_rwsem_write(cpu);
        if (ret) {
                dprintk("setting policy failed\n");
                goto err_out_unregister;
        }
+        unlock_policy_rwsem_write(cpu);
        kobject_uevent(&policy->kobj, KOBJ_ADD);
        module_put(cpufreq_driver->owner);
        dprintk("initialization complete\n");
diff --git a/drivers/cpufreq/freq_table.c b/drivers/cpufreq/freq_table.c
index ae6cd60d5c14..b64c6bc445e3 100644
--- a/drivers/cpufreq/freq_table.c
+++ b/drivers/cpufreq/freq_table.c
@@ -2,6 +2,11 @@
 * linux/drivers/cpufreq/freq_table.c
 *
 * Copyright (C) 2002 - 2003 Dominik Brodowski
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
 */
 #include <linux/kernel.h>
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index fc555a90bb21..23554b676d6e 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -38,6 +38,8 @@ static void cpuidle_kick_cpus(void)
 static void cpuidle_kick_cpus(void) {}
 #endif
+static int __cpuidle_register_device(struct cpuidle_device *dev);
 /**
 * cpuidle_idle_call - the main idle loop
 *
@@ -138,6 +140,12 @@ int cpuidle_enable_device(struct cpuidle_device *dev)
        if (!dev->state_count)
                return -EINVAL;
+        if (dev->registered == 0) {
+                ret = __cpuidle_register_device(dev);
+                if (ret)
+                        return ret;
+        }
        if ((ret = cpuidle_add_state_sysfs(dev)))
                return ret;
@@ -232,10 +240,13 @@ static void poll_idle_init(struct cpuidle_device *dev) {}
 #endif /* CONFIG_ARCH_HAS_CPU_RELAX */
 /**
- * cpuidle_register_device - registers a CPU's idle PM feature
+ * __cpuidle_register_device - internal register function called before register
+ * and enable routines
 * @dev: the cpu
+ *
+ * cpuidle_lock mutex must be held before this is called
 */
-int cpuidle_register_device(struct cpuidle_device *dev)
+static int __cpuidle_register_device(struct cpuidle_device *dev)
 {
        int ret;
        struct sys_device *sys_dev = get_cpu_sysdev((unsigned long)dev->cpu);
@@ -247,18 +258,34 @@ int cpuidle_register_device(struct cpuidle_device *dev)
        init_completion(&dev->kobj_unregister);
-        mutex_lock(&cpuidle_lock);
        poll_idle_init(dev);
        per_cpu(cpuidle_devices, dev->cpu) = dev;
        list_add(&dev->device_list, &cpuidle_detected_devices);
        if ((ret = cpuidle_add_sysfs(sys_dev))) {
-                mutex_unlock(&cpuidle_lock);
                module_put(cpuidle_curr_driver->owner);
                return ret;
        }
+        dev->registered = 1;
+        return 0;
+}
+/**
+ * cpuidle_register_device - registers a CPU's idle PM feature
+ * @dev: the cpu
+ */
+int cpuidle_register_device(struct cpuidle_device *dev)
+{
+        int ret;
+        mutex_lock(&cpuidle_lock);
+        if ((ret = __cpuidle_register_device(dev))) {
+                mutex_unlock(&cpuidle_lock);
+                return ret;
+        }
        cpuidle_enable_device(dev);
        cpuidle_install_idle_handler();
@@ -278,6 +305,9 @@ void cpuidle_unregister_device(struct cpuidle_device *dev)
 {
        struct sys_device *sys_dev = get_cpu_sysdev((unsigned long)dev->cpu);
+        if (dev->registered == 0)
+                return;
        cpuidle_pause_and_lock();
        cpuidle_disable_device(dev);
diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index 065732ddf40c..d49361bfe670 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -20,7 +20,6 @@
 #include <linux/of_platform.h>
 #include <linux/of_device.h>
-#include <asm/mpc85xx.h>
 #include "edac_module.h"
 #include "edac_core.h"
 #include "mpc85xx_edac.h"
@@ -43,8 +42,6 @@ static u32 orig_pci_err_en;
 static u32 orig_l2_err_disable;
 static u32 orig_hid1;
-static const char *mpc85xx_ctl_name = "MPC85xx";
 /************************ MC SYSFS parts ***********************************/
 static ssize_t mpc85xx_mc_inject_data_hi_show(struct mem_ctl_info *mci,
diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
index 744011989044..9e4f59dc7f1e 100644
--- a/drivers/firmware/edd.c
+++ b/drivers/firmware/edd.c
@@ -753,7 +753,7 @@ edd_init(void)
        if (!edd_num_devices()) {
                printk(KERN_INFO "EDD information not available.\n");
-                return 1;
+                return -ENODEV;
        }
        edd_kset = kset_create_and_add("edd", NULL, firmware_kobj);
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 7f138c6195ff..beaf6b3a37dc 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -127,7 +127,7 @@ int __init gpiochip_reserve(int start, int ngpio)
        unsigned long flags;
        int i;
-        if (!gpio_is_valid(start) || !gpio_is_valid(start + ngpio))
+        if (!gpio_is_valid(start) || !gpio_is_valid(start + ngpio - 1))
                return -EINVAL;
        spin_lock_irqsave(&gpio_lock, flags);
@@ -170,7 +170,7 @@ int gpiochip_add(struct gpio_chip *chip)
        unsigned        id;
        int             base = chip->base;
-        if ((!gpio_is_valid(base) || !gpio_is_valid(base + chip->ngpio))
+        if ((!gpio_is_valid(base) || !gpio_is_valid(base + chip->ngpio - 1))
                        && base >= 0) {
                status = -EINVAL;
                goto fail;
@@ -207,7 +207,7 @@ fail:
        /* failures here can mean systems won't boot... */
        if (status)
                pr_err("gpiochip_add: gpios %d..%d (%s) not registered\n",
-                        chip->base, chip->base + chip->ngpio,
+                        chip->base, chip->base + chip->ngpio - 1,
                        chip->label ? : "generic");
        return status;
 }
diff --git a/drivers/gpio/mcp23s08.c b/drivers/gpio/mcp23s08.c
index 7fb5b9d009d4..7f92fdd5f0e2 100644
--- a/drivers/gpio/mcp23s08.c
+++ b/drivers/gpio/mcp23s08.c
@@ -168,7 +168,7 @@ static void mcp23s08_dbg_show(struct seq_file *s, struct gpio_chip *chip)
 {
        struct mcp23s08 *mcp;
        char            bank;
-        unsigned        t;
+        int             t;
        unsigned        mask;
        mcp = container_of(chip, struct mcp23s08, chip);
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 93f916720b13..7e40e8a55edf 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -30,6 +30,7 @@ static const struct i2c_device_id pca953x_id[] = {
        { "pca9537", 4, },
        { "pca9538", 8, },
        { "pca9539", 16, },
+        { "pca9554", 8, },
        { "pca9555", 16, },
        { "pca9557", 8, },
        /* REVISIT several pca955x parts should work here too */
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 4dc76bc45c9d..00ff53348491 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -330,6 +330,20 @@ config SENSORS_CORETEMP
          sensor inside your CPU. Supported all are all known variants
          of Intel Core family.
+config SENSORS_IBMAEM
+        tristate "IBM Active Energy Manager temperature/power sensors and control"
+        select IPMI_SI
+        depends on IPMI_HANDLER
+        help
+          If you say yes here you get support for the temperature and
+          power sensors and capping hardware in various IBM System X
+          servers that support Active Energy Manager.  This includes
+          the x3350, x3550, x3650, x3655, x3755, x3850 M2, x3950 M2,
+          and certain HS2x/LS2x/QS2x blades.
+          This driver can also be built as a module.  If so, the module
+          will be called ibmaem.
 config SENSORS_IBMPEX
        tristate "IBM PowerExecutive temperature/power sensors"
        select IPMI_SI
diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
index 3bdb05a5cbd7..d098677e08de 100644
--- a/drivers/hwmon/Makefile
+++ b/drivers/hwmon/Makefile
@@ -41,6 +41,7 @@ obj-$(CONFIG_SENSORS_GL518SM)	+= gl518sm.o
 obj-$(CONFIG_SENSORS_GL520SM)   += gl520sm.o
 obj-$(CONFIG_SENSORS_HDAPS)     += hdaps.o
 obj-$(CONFIG_SENSORS_I5K_AMB)   += i5k_amb.o
+obj-$(CONFIG_SENSORS_IBMAEM)    += ibmaem.o
 obj-$(CONFIG_SENSORS_IBMPEX)    += ibmpex.o
 obj-$(CONFIG_SENSORS_IT87)      += it87.o
 obj-$(CONFIG_SENSORS_K8TEMP)    += k8temp.o
diff --git a/drivers/hwmon/hdaps.c b/drivers/hwmon/hdaps.c
index bab5fd2e4dfd..26df06f840eb 100644
--- a/drivers/hwmon/hdaps.c
+++ b/drivers/hwmon/hdaps.c
@@ -515,12 +515,14 @@ static struct dmi_system_id __initdata hdaps_whitelist[] = {
        HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R50"),
        HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R51"),
        HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R52"),
+        HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad R61i"),
        HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad T41p"),
        HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T41"),
        HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad T42p"),
        HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T42"),
        HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T43"),
        HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T60"),
+        HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T61"),
        HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad X40"),
        HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad X41"),
        HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X60"),
diff --git a/drivers/hwmon/i5k_amb.c b/drivers/hwmon/i5k_amb.c
index 6ac5c6f53585..f9e2ed621f7b 100644
--- a/drivers/hwmon/i5k_amb.c
+++ b/drivers/hwmon/i5k_amb.c
@@ -111,6 +111,7 @@ struct i5k_amb_data {
        void __iomem *amb_mmio;
        struct i5k_device_attribute *attrs;
        unsigned int num_attrs;
+        unsigned long chipset_id;
 };
 static ssize_t show_name(struct device *dev, struct device_attribute *devattr,
@@ -382,7 +383,8 @@ err:
        return res;
 }
-static int __devinit i5k_find_amb_registers(struct i5k_amb_data *data)
+static int __devinit i5k_find_amb_registers(struct i5k_amb_data *data,
+                                            unsigned long devid)
 {
        struct pci_dev *pcidev;
        u32 val32;
@@ -390,7 +392,7 @@ static int __devinit i5k_find_amb_registers(struct i5k_amb_data *data)
        /* Find AMB register memory space */
        pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
-                                PCI_DEVICE_ID_INTEL_5000_ERR,
+                                devid,
                                NULL);
        if (!pcidev)
                return -ENODEV;
@@ -409,6 +411,8 @@ static int __devinit i5k_find_amb_registers(struct i5k_amb_data *data)
                goto out;
        }
+        data->chipset_id = devid;
        res = 0;
 out:
        pci_dev_put(pcidev);
@@ -441,10 +445,30 @@ out:
        return res;
 }
+static unsigned long i5k_channel_pci_id(struct i5k_amb_data *data,
+                                        unsigned long channel)
+{
+        switch (data->chipset_id) {
+        case PCI_DEVICE_ID_INTEL_5000_ERR:
+                return PCI_DEVICE_ID_INTEL_5000_FBD0 + channel;
+        case PCI_DEVICE_ID_INTEL_5400_ERR:
+                return PCI_DEVICE_ID_INTEL_5400_FBD0 + channel;
+        default:
+                BUG();
+        }
+}
+static unsigned long chipset_ids[] = {
+        PCI_DEVICE_ID_INTEL_5000_ERR,
+        PCI_DEVICE_ID_INTEL_5400_ERR,
+        0
+};
 static int __devinit i5k_amb_probe(struct platform_device *pdev)
 {
        struct i5k_amb_data *data;
        struct resource *reso;
+        int i;
        int res = -ENODEV;
        data = kzalloc(sizeof(*data), GFP_KERNEL);
@@ -452,19 +476,24 @@ static int __devinit i5k_amb_probe(struct platform_device *pdev)
                return -ENOMEM;
        /* Figure out where the AMB registers live */
-        res = i5k_find_amb_registers(data);
+        i = 0;
+        do {
+                res = i5k_find_amb_registers(data, chipset_ids[i]);
+                i++;
+        } while (res && chipset_ids[i]);
        if (res)
                goto err;
        /* Copy the DIMM presence map for the first two channels */
        res = i5k_channel_probe(&data->amb_present[0],
-                                PCI_DEVICE_ID_INTEL_5000_FBD0);
+                                i5k_channel_pci_id(data, 0));
        if (res)
                goto err;
        /* Copy the DIMM presence map for the optional second two channels */
        i5k_channel_probe(&data->amb_present[2],
-                          PCI_DEVICE_ID_INTEL_5000_FBD1);
+                          i5k_channel_pci_id(data, 1));
        /* Set up resource regions */
        reso = request_mem_region(data->amb_base, data->amb_len, DRVNAME);
diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
new file mode 100644
index 000000000000..c9416e657487
--- /dev/null
+++ b/drivers/hwmon/ibmaem.c
@@ -0,0 +1,1111 @@
+/*
+ * A hwmon driver for the IBM Active Energy Manager temperature/power sensors
+ * and capping functionality.
+ * Copyright (C) 2008 IBM
+ *
+ * Author: Darrick J. Wong <djwong@us.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#include <linux/ipmi.h>
+#include <linux/module.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/jiffies.h>
+#include <linux/mutex.h>
+#include <linux/kdev_t.h>
+#include <linux/spinlock.h>
+#include <linux/idr.h>
+#include <linux/sched.h>
+#include <linux/platform_device.h>
+#include <linux/math64.h>
+#include <linux/time.h>
+#define REFRESH_INTERVAL        (HZ)
+#define IPMI_TIMEOUT            (30 * HZ)
+#define DRVNAME                 "aem"
+#define AEM_NETFN               0x2E
+#define AEM_FIND_FW_CMD         0x80
+#define AEM_ELEMENT_CMD         0x81
+#define AEM_FW_INSTANCE_CMD     0x82
+#define AEM_READ_ELEMENT_CFG    0x80
+#define AEM_READ_BUFFER         0x81
+#define AEM_READ_REGISTER       0x82
+#define AEM_WRITE_REGISTER      0x83
+#define AEM_SET_REG_MASK        0x84
+#define AEM_CLEAR_REG_MASK      0x85
+#define AEM_READ_ELEMENT_CFG2   0x86
+#define AEM_CONTROL_ELEMENT     0
+#define AEM_ENERGY_ELEMENT      1
+#define AEM_CLOCK_ELEMENT       4
+#define AEM_POWER_CAP_ELEMENT   7
+#define AEM_EXHAUST_ELEMENT     9
+#define AEM_POWER_ELEMENT       10
+#define AEM_MODULE_TYPE_ID      0x0001
+#define AEM2_NUM_ENERGY_REGS    2
+#define AEM2_NUM_PCAP_REGS      6
+#define AEM2_NUM_TEMP_REGS      2
+#define AEM2_NUM_SENSORS        14
+#define AEM1_NUM_ENERGY_REGS    1
+#define AEM1_NUM_SENSORS        3
+/* AEM 2.x has more energy registers */
+#define AEM_NUM_ENERGY_REGS     AEM2_NUM_ENERGY_REGS
+/* AEM 2.x needs more sensor files */
+#define AEM_NUM_SENSORS         AEM2_NUM_SENSORS
+#define POWER_CAP               0
+#define POWER_CAP_MAX_HOTPLUG   1
+#define POWER_CAP_MAX           2
+#define POWER_CAP_MIN_WARNING   3
+#define POWER_CAP_MIN           4
+#define POWER_AUX               5
+#define AEM_DEFAULT_POWER_INTERVAL 1000
+#define AEM_MIN_POWER_INTERVAL  200
+#define UJ_PER_MJ               1000L
+static DEFINE_IDR(aem_idr);
+static DEFINE_SPINLOCK(aem_idr_lock);
+static struct device_driver aem_driver = {
+        .name = DRVNAME,
+        .bus = &platform_bus_type,
+};
+struct aem_ipmi_data {
+        struct completion       read_complete;
+        struct ipmi_addr        address;
+        ipmi_user_t             user;
+        int                     interface;
+        struct kernel_ipmi_msg  tx_message;
+        long                    tx_msgid;
+        void                    *rx_msg_data;
+        unsigned short          rx_msg_len;
+        unsigned char           rx_result;
+        int                     rx_recv_type;
+        struct device           *bmc_device;
+};
+struct aem_ro_sensor_template {
+        char *label;
+        ssize_t (*show)(struct device *dev,
+                        struct device_attribute *devattr,
+                        char *buf);
+        int index;
+};
+struct aem_rw_sensor_template {
+        char *label;
+        ssize_t (*show)(struct device *dev,
+                        struct device_attribute *devattr,
+                        char *buf);
+        ssize_t (*set)(struct device *dev,
+                       struct device_attribute *devattr,
+                       const char *buf, size_t count);
+        int index;
+};
+struct aem_data {
+        struct list_head        list;
+        struct device           *hwmon_dev;
+        struct platform_device  *pdev;
+        struct mutex            lock;
+        char                    valid;
+        unsigned long           last_updated;   /* In jiffies */
+        u8                      ver_major;
+        u8                      ver_minor;
+        u8                      module_handle;
+        int                     id;
+        struct aem_ipmi_data    ipmi;
+        /* Function to update sensors */
+        void (*update)(struct aem_data *data);
+        /*
+         * AEM 1.x sensors:
+         * Available sensors:
+         * Energy meter
+         * Power meter
+         *
+         * AEM 2.x sensors:
+         * Two energy meters
+         * Two power meters
+         * Two temperature sensors
+         * Six power cap registers
+         */
+        /* sysfs attrs */
+        struct sensor_device_attribute  sensors[AEM_NUM_SENSORS];
+        /* energy use in mJ */
+        u64                     energy[AEM_NUM_ENERGY_REGS];
+        /* power sampling interval in ms */
+        unsigned long           power_period[AEM_NUM_ENERGY_REGS];
+        /* Everything past here is for AEM2 only */
+        /* power caps in dW */
+        u16                     pcap[AEM2_NUM_PCAP_REGS];
+        /* exhaust temperature in C */
+        u8                      temp[AEM2_NUM_TEMP_REGS];
+};
+/* Data structures returned by the AEM firmware */
+struct aem_iana_id {
+        u8                      bytes[3];
+};
+static struct aem_iana_id system_x_id = {
+        .bytes = {0x4D, 0x4F, 0x00}
+};
+/* These are used to find AEM1 instances */
+struct aem_find_firmware_req {
+        struct aem_iana_id      id;
+        u8                      rsvd;
+        __be16                  index;
+        __be16                  module_type_id;
+} __packed;
+struct aem_find_firmware_resp {
+        struct aem_iana_id      id;
+        u8                      num_instances;
+} __packed;
+/* These are used to find AEM2 instances */
+struct aem_find_instance_req {
+        struct aem_iana_id      id;
+        u8                      instance_number;
+        __be16                  module_type_id;
+} __packed;
+struct aem_find_instance_resp {
+        struct aem_iana_id      id;
+        u8                      num_instances;
+        u8                      major;
+        u8                      minor;
+        u8                      module_handle;
+        u16                     record_id;
+} __packed;
+/* These are used to query sensors */
+struct aem_read_sensor_req {
+        struct aem_iana_id      id;
+        u8                      module_handle;
+        u8                      element;
+        u8                      subcommand;
+        u8                      reg;
+        u8                      rx_buf_size;
+} __packed;
+struct aem_read_sensor_resp {
+        struct aem_iana_id      id;
+        u8                      bytes[0];
+} __packed;
+/* Data structures to talk to the IPMI layer */
+struct aem_driver_data {
+        struct list_head        aem_devices;
+        struct ipmi_smi_watcher bmc_events;
+        struct ipmi_user_hndl   ipmi_hndlrs;
+};
+static void aem_register_bmc(int iface, struct device *dev);
+static void aem_bmc_gone(int iface);
+static void aem_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data);
+static void aem_remove_sensors(struct aem_data *data);
+static int aem_init_aem1(struct aem_ipmi_data *probe);
+static int aem_init_aem2(struct aem_ipmi_data *probe);
+static int aem1_find_sensors(struct aem_data *data);
+static int aem2_find_sensors(struct aem_data *data);
+static void update_aem1_sensors(struct aem_data *data);
+static void update_aem2_sensors(struct aem_data *data);
+static struct aem_driver_data driver_data = {
+        .aem_devices = LIST_HEAD_INIT(driver_data.aem_devices),
+        .bmc_events = {
+                .owner = THIS_MODULE,
+                .new_smi = aem_register_bmc,
+                .smi_gone = aem_bmc_gone,
+        },
+        .ipmi_hndlrs = {
+                .ipmi_recv_hndl = aem_msg_handler,
+        },
+};
+/* Functions to talk to the IPMI layer */
+/* Initialize IPMI address, message buffers and user data */
+static int aem_init_ipmi_data(struct aem_ipmi_data *data, int iface,
+                              struct device *bmc)
+{
+        int err;
+        init_completion(&data->read_complete);
+        data->bmc_device = bmc;
+        /* Initialize IPMI address */
+        data->address.addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
+        data->address.channel = IPMI_BMC_CHANNEL;
+        data->address.data[0] = 0;
+        data->interface = iface;
+        /* Initialize message buffers */
+        data->tx_msgid = 0;
+        data->tx_message.netfn = AEM_NETFN;
+        /* Create IPMI messaging interface user */
+        err = ipmi_create_user(data->interface, &driver_data.ipmi_hndlrs,
+                               data, &data->user);
+        if (err < 0) {
+                dev_err(bmc, "Unable to register user with IPMI "
+                        "interface %d\n", data->interface);
+                return -EACCES;
+        }
+        return 0;
+}
+/* Send an IPMI command */
+static int aem_send_message(struct aem_ipmi_data *data)
+{
+        int err;
+        err = ipmi_validate_addr(&data->address, sizeof(data->address));
+        if (err)
+                goto out;
+        data->tx_msgid++;
+        err = ipmi_request_settime(data->user, &data->address, data->tx_msgid,
+                                   &data->tx_message, data, 0, 0, 0);
+        if (err)
+                goto out1;
+        return 0;
+out1:
+        dev_err(data->bmc_device, "request_settime=%x\n", err);
+        return err;
+out:
+        dev_err(data->bmc_device, "validate_addr=%x\n", err);
+        return err;
+}
+/* Dispatch IPMI messages to callers */
+static void aem_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
+{
+        unsigned short rx_len;
+        struct aem_ipmi_data *data = user_msg_data;
+        if (msg->msgid != data->tx_msgid) {
+                dev_err(data->bmc_device, "Mismatch between received msgid "
+                        "(%02x) and transmitted msgid (%02x)!\n",
+                        (int)msg->msgid,
+                        (int)data->tx_msgid);
+                ipmi_free_recv_msg(msg);
+                return;
+        }
+        data->rx_recv_type = msg->recv_type;
+        if (msg->msg.data_len > 0)
+                data->rx_result = msg->msg.data[0];
+        else
+                data->rx_result = IPMI_UNKNOWN_ERR_COMPLETION_CODE;
+        if (msg->msg.data_len > 1) {
+                rx_len = msg->msg.data_len - 1;
+                if (data->rx_msg_len < rx_len)
+                        rx_len = data->rx_msg_len;
+                data->rx_msg_len = rx_len;
+                memcpy(data->rx_msg_data, msg->msg.data + 1, data->rx_msg_len);
+        } else
+                data->rx_msg_len = 0;
+        ipmi_free_recv_msg(msg);
+        complete(&data->read_complete);
+}
+/* ID functions */
+/* Obtain an id */
+static int aem_idr_get(int *id)
+{
+        int i, err;
+again:
+        if (unlikely(!idr_pre_get(&aem_idr, GFP_KERNEL)))
+                return -ENOMEM;
+        spin_lock(&aem_idr_lock);
+        err = idr_get_new(&aem_idr, NULL, &i);
+        spin_unlock(&aem_idr_lock);
+        if (unlikely(err == -EAGAIN))
+                goto again;
+        else if (unlikely(err))
+                return err;
+        *id = i & MAX_ID_MASK;
+        return 0;
+}
+/* Release an object ID */
+static void aem_idr_put(int id)
+{
+        spin_lock(&aem_idr_lock);
+        idr_remove(&aem_idr, id);
+        spin_unlock(&aem_idr_lock);
+}
+/* Sensor support functions */
+/* Read a sensor value */
+static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg,
+                           void *buf, size_t size)
+{
+        int rs_size, res;
+        struct aem_read_sensor_req rs_req;
+        struct aem_read_sensor_resp *rs_resp;
+        struct aem_ipmi_data *ipmi = &data->ipmi;
+        /* AEM registers are 1, 2, 4 or 8 bytes */
+        switch (size) {
+        case 1:
+        case 2:
+        case 4:
+        case 8:
+                break;
+        default:
+                return -EINVAL;
+        }
+        rs_req.id = system_x_id;
+        rs_req.module_handle = data->module_handle;
+        rs_req.element = elt;
+        rs_req.subcommand = AEM_READ_REGISTER;
+        rs_req.reg = reg;
+        rs_req.rx_buf_size = size;
+        ipmi->tx_message.cmd = AEM_ELEMENT_CMD;
+        ipmi->tx_message.data = (char *)&rs_req;
+        ipmi->tx_message.data_len = sizeof(rs_req);
+        rs_size = sizeof(*rs_resp) + size;
+        rs_resp = kzalloc(rs_size, GFP_KERNEL);
+        if (!rs_resp)
+                return -ENOMEM;
+        ipmi->rx_msg_data = rs_resp;
+        ipmi->rx_msg_len = rs_size;
+        aem_send_message(ipmi);
+        res = wait_for_completion_timeout(&ipmi->read_complete, IPMI_TIMEOUT);
+        if (!res)
+                return -ETIMEDOUT;
+        if (ipmi->rx_result || ipmi->rx_msg_len != rs_size ||
+            memcmp(&rs_resp->id, &system_x_id, sizeof(system_x_id))) {
+                kfree(rs_resp);
+                return -ENOENT;
+        }
+        switch (size) {
+        case 1: {
+                u8 *x = buf;
+                *x = rs_resp->bytes[0];
+                break;
+        }
+        case 2: {
+                u16 *x = buf;
+                *x = be16_to_cpup((__be16 *)rs_resp->bytes);
+                break;
+        }
+        case 4: {
+                u32 *x = buf;
+                *x = be32_to_cpup((__be32 *)rs_resp->bytes);
+                break;
+        }
+        case 8: {
+                u64 *x = buf;
+                *x = be64_to_cpup((__be64 *)rs_resp->bytes);
+                break;
+        }
+        }
+        return 0;
+}
+/* Update AEM energy registers */
+static void update_aem_energy(struct aem_data *data)
+{
+        aem_read_sensor(data, AEM_ENERGY_ELEMENT, 0, &data->energy[0], 8);
+        if (data->ver_major < 2)
+                return;
+        aem_read_sensor(data, AEM_ENERGY_ELEMENT, 1, &data->energy[1], 8);
+}
+/* Update all AEM1 sensors */
+static void update_aem1_sensors(struct aem_data *data)
+{
+        mutex_lock(&data->lock);
+        if (time_before(jiffies, data->last_updated + REFRESH_INTERVAL) &&
+            data->valid)
+                goto out;
+        update_aem_energy(data);
+out:
+        mutex_unlock(&data->lock);
+}
+/* Update all AEM2 sensors */
+static void update_aem2_sensors(struct aem_data *data)
+{
+        int i;
+        mutex_lock(&data->lock);
+        if (time_before(jiffies, data->last_updated + REFRESH_INTERVAL) &&
+            data->valid)
+                goto out;
+        update_aem_energy(data);
+        aem_read_sensor(data, AEM_EXHAUST_ELEMENT, 0, &data->temp[0], 1);
+        aem_read_sensor(data, AEM_EXHAUST_ELEMENT, 1, &data->temp[1], 1);
+        for (i = POWER_CAP; i <= POWER_AUX; i++)
+                aem_read_sensor(data, AEM_POWER_CAP_ELEMENT, i,
+                                &data->pcap[i], 2);
+out:
+        mutex_unlock(&data->lock);
+}
+/* Delete an AEM instance */
+static void aem_delete(struct aem_data *data)
+{
+        list_del(&data->list);
+        aem_remove_sensors(data);
+        hwmon_device_unregister(data->hwmon_dev);
+        ipmi_destroy_user(data->ipmi.user);
+        dev_set_drvdata(&data->pdev->dev, NULL);
+        platform_device_unregister(data->pdev);
+        aem_idr_put(data->id);
+        kfree(data);
+}
+/* Probe functions for AEM1 devices */
+/* Retrieve version and module handle for an AEM1 instance */
+static int aem_find_aem1_count(struct aem_ipmi_data *data)
+{
+        int res;
+        struct aem_find_firmware_req    ff_req;
+        struct aem_find_firmware_resp   ff_resp;
+        ff_req.id = system_x_id;
+        ff_req.index = 0;
+        ff_req.module_type_id = cpu_to_be16(AEM_MODULE_TYPE_ID);
+        data->tx_message.cmd = AEM_FIND_FW_CMD;
+        data->tx_message.data = (char *)&ff_req;
+        data->tx_message.data_len = sizeof(ff_req);
+        data->rx_msg_data = &ff_resp;
+        data->rx_msg_len = sizeof(ff_resp);
+        aem_send_message(data);
+        res = wait_for_completion_timeout(&data->read_complete, IPMI_TIMEOUT);
+        if (!res)
+                return -ETIMEDOUT;
+        if (data->rx_result || data->rx_msg_len != sizeof(ff_resp) ||
+            memcmp(&ff_resp.id, &system_x_id, sizeof(system_x_id)))
+                return -ENOENT;
+        return ff_resp.num_instances;
+}
+/* Find and initialize one AEM1 instance */
+static int aem_init_aem1_inst(struct aem_ipmi_data *probe, u8 module_handle)
+{
+        struct aem_data *data;
+        int i;
+        int res = -ENOMEM;
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return res;
+        mutex_init(&data->lock);
+        /* Copy instance data */
+        data->ver_major = 1;
+        data->ver_minor = 0;
+        data->module_handle = module_handle;
+        for (i = 0; i < AEM1_NUM_ENERGY_REGS; i++)
+                data->power_period[i] = AEM_DEFAULT_POWER_INTERVAL;
+        /* Create sub-device for this fw instance */
+        if (aem_idr_get(&data->id))
+                goto id_err;
+        data->pdev = platform_device_alloc(DRVNAME, data->id);
+        if (!data->pdev)
+                goto dev_err;
+        data->pdev->dev.driver = &aem_driver;
+        res = platform_device_add(data->pdev);
+        if (res)
+                goto ipmi_err;
+        dev_set_drvdata(&data->pdev->dev, data);
+        /* Set up IPMI interface */
+        if (aem_init_ipmi_data(&data->ipmi, probe->interface,
+                               probe->bmc_device))
+                goto ipmi_err;
+        /* Register with hwmon */
+        data->hwmon_dev = hwmon_device_register(&data->pdev->dev);
+        if (IS_ERR(data->hwmon_dev)) {
+                dev_err(&data->pdev->dev, "Unable to register hwmon "
+                        "device for IPMI interface %d\n",
+                        probe->interface);
+                goto hwmon_reg_err;
+        }
+        data->update = update_aem1_sensors;
+        /* Find sensors */
+        if (aem1_find_sensors(data))
+                goto sensor_err;
+        /* Add to our list of AEM devices */
+        list_add_tail(&data->list, &driver_data.aem_devices);
+        dev_info(data->ipmi.bmc_device, "Found AEM v%d.%d at 0x%X\n",
+                 data->ver_major, data->ver_minor,
+                 data->module_handle);
+        return 0;
+sensor_err:
+        hwmon_device_unregister(data->hwmon_dev);
+hwmon_reg_err:
+        ipmi_destroy_user(data->ipmi.user);
+ipmi_err:
+        dev_set_drvdata(&data->pdev->dev, NULL);
+        platform_device_unregister(data->pdev);
+dev_err:
+        aem_idr_put(data->id);
+id_err:
+        kfree(data);
+        return res;
+}
+/* Find and initialize all AEM1 instances */
+static int aem_init_aem1(struct aem_ipmi_data *probe)
+{
+        int num, i, err;
+        num = aem_find_aem1_count(probe);
+        for (i = 0; i < num; i++) {
+                err = aem_init_aem1_inst(probe, i);
+                if (err) {
+                        dev_err(probe->bmc_device,
+                                "Error %d initializing AEM1 0x%X\n",
+                                err, i);
+                        return err;
+                }
+        }
+        return 0;
+}
+/* Probe functions for AEM2 devices */
+/* Retrieve version and module handle for an AEM2 instance */
+static int aem_find_aem2(struct aem_ipmi_data *data,
+                            struct aem_find_instance_resp *fi_resp,
+                            int instance_num)
+{
+        int res;
+        struct aem_find_instance_req fi_req;
+        fi_req.id = system_x_id;
+        fi_req.instance_number = instance_num;
+        fi_req.module_type_id = cpu_to_be16(AEM_MODULE_TYPE_ID);
+        data->tx_message.cmd = AEM_FW_INSTANCE_CMD;
+        data->tx_message.data = (char *)&fi_req;
+        data->tx_message.data_len = sizeof(fi_req);
+        data->rx_msg_data = fi_resp;
+        data->rx_msg_len = sizeof(*fi_resp);
+        aem_send_message(data);
+        res = wait_for_completion_timeout(&data->read_complete, IPMI_TIMEOUT);
+        if (!res)
+                return -ETIMEDOUT;
+        if (data->rx_result || data->rx_msg_len != sizeof(*fi_resp) ||
+            memcmp(&fi_resp->id, &system_x_id, sizeof(system_x_id)))
+                return -ENOENT;
+        return 0;
+}
+/* Find and initialize one AEM2 instance */
+static int aem_init_aem2_inst(struct aem_ipmi_data *probe,
+                              struct aem_find_instance_resp *fi_resp)
+{
+        struct aem_data *data;
+        int i;
+        int res = -ENOMEM;
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return res;
+        mutex_init(&data->lock);
+        /* Copy instance data */
+        data->ver_major = fi_resp->major;
+        data->ver_minor = fi_resp->minor;
+        data->module_handle = fi_resp->module_handle;
+        for (i = 0; i < AEM2_NUM_ENERGY_REGS; i++)
+                data->power_period[i] = AEM_DEFAULT_POWER_INTERVAL;
+        /* Create sub-device for this fw instance */
+        if (aem_idr_get(&data->id))
+                goto id_err;
+        data->pdev = platform_device_alloc(DRVNAME, data->id);
+        if (!data->pdev)
+                goto dev_err;
+        data->pdev->dev.driver = &aem_driver;
+        res = platform_device_add(data->pdev);
+        if (res)
+                goto ipmi_err;
+        dev_set_drvdata(&data->pdev->dev, data);
+        /* Set up IPMI interface */
+        if (aem_init_ipmi_data(&data->ipmi, probe->interface,
+                               probe->bmc_device))
+                goto ipmi_err;
+        /* Register with hwmon */
+        data->hwmon_dev = hwmon_device_register(&data->pdev->dev);
+        if (IS_ERR(data->hwmon_dev)) {
+                dev_err(&data->pdev->dev, "Unable to register hwmon "
+                        "device for IPMI interface %d\n",
+                        probe->interface);
+                goto hwmon_reg_err;
+        }
+        data->update = update_aem2_sensors;
+        /* Find sensors */
+        if (aem2_find_sensors(data))
+                goto sensor_err;
+        /* Add to our list of AEM devices */
+        list_add_tail(&data->list, &driver_data.aem_devices);
+        dev_info(data->ipmi.bmc_device, "Found AEM v%d.%d at 0x%X\n",
+                 data->ver_major, data->ver_minor,
+                 data->module_handle);
+        return 0;
+sensor_err:
+        hwmon_device_unregister(data->hwmon_dev);
+hwmon_reg_err:
+        ipmi_destroy_user(data->ipmi.user);
+ipmi_err:
+        dev_set_drvdata(&data->pdev->dev, NULL);
+        platform_device_unregister(data->pdev);
+dev_err:
+        aem_idr_put(data->id);
+id_err:
+        kfree(data);
+        return res;
+}
+/* Find and initialize all AEM2 instances */
+static int aem_init_aem2(struct aem_ipmi_data *probe)
+{
+        struct aem_find_instance_resp fi_resp;
+        int err;
+        int i = 0;
+        while (!aem_find_aem2(probe, &fi_resp, i)) {
+                if (fi_resp.major != 2) {
+                        dev_err(probe->bmc_device, "Unknown AEM v%d; please "
+                                "report this to the maintainer.\n",
+                                fi_resp.major);
+                        i++;
+                        continue;
+                }
+                err = aem_init_aem2_inst(probe, &fi_resp);
+                if (err) {
+                        dev_err(probe->bmc_device,
+                                "Error %d initializing AEM2 0x%X\n",
+                                err, fi_resp.module_handle);
+                        return err;
+                }
+                i++;
+        }
+        return 0;
+}
+/* Probe a BMC for AEM firmware instances */
+static void aem_register_bmc(int iface, struct device *dev)
+{
+        struct aem_ipmi_data probe;
+        if (aem_init_ipmi_data(&probe, iface, dev))
+                return;
+        /* Ignore probe errors; they won't cause problems */
+        aem_init_aem1(&probe);
+        aem_init_aem2(&probe);
+        ipmi_destroy_user(probe.user);
+}
+/* Handle BMC deletion */
+static void aem_bmc_gone(int iface)
+{
+        struct aem_data *p1, *next1;
+        list_for_each_entry_safe(p1, next1, &driver_data.aem_devices, list)
+                if (p1->ipmi.interface == iface)
+                        aem_delete(p1);
+}
+/* sysfs support functions */
+/* AEM device name */
+static ssize_t show_name(struct device *dev, struct device_attribute *devattr,
+                         char *buf)
+{
+        struct aem_data *data = dev_get_drvdata(dev);
+        return sprintf(buf, "%s%d\n", DRVNAME, data->ver_major);
+}
+static SENSOR_DEVICE_ATTR(name, S_IRUGO, show_name, NULL, 0);
+/* AEM device version */
+static ssize_t show_version(struct device *dev,
+                            struct device_attribute *devattr,
+                            char *buf)
+{
+        struct aem_data *data = dev_get_drvdata(dev);
+        return sprintf(buf, "%d.%d\n", data->ver_major, data->ver_minor);
+}
+static SENSOR_DEVICE_ATTR(version, S_IRUGO, show_version, NULL, 0);
+/* Display power use */
+static ssize_t aem_show_power(struct device *dev,
+                              struct device_attribute *devattr,
+                              char *buf)
+{
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct aem_data *data = dev_get_drvdata(dev);
+        u64 before, after, delta, time;
+        signed long leftover;
+        struct timespec b, a;
+        mutex_lock(&data->lock);
+        update_aem_energy(data);
+        getnstimeofday(&b);
+        before = data->energy[attr->index];
+        leftover = schedule_timeout_interruptible(
+                        msecs_to_jiffies(data->power_period[attr->index])
+                   );
+        if (leftover) {
+                mutex_unlock(&data->lock);
+                return 0;
+        }
+        update_aem_energy(data);
+        getnstimeofday(&a);
+        after = data->energy[attr->index];
+        mutex_unlock(&data->lock);
+        time = timespec_to_ns(&a) - timespec_to_ns(&b);
+        delta = (after - before) * UJ_PER_MJ;
+        return sprintf(buf, "%llu\n",
+                (unsigned long long)div64_u64(delta * NSEC_PER_SEC, time));
+}
+/* Display energy use */
+static ssize_t aem_show_energy(struct device *dev,
+                               struct device_attribute *devattr,
+                               char *buf)
+{
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct aem_data *a = dev_get_drvdata(dev);
+        a->update(a);
+        return sprintf(buf, "%llu\n",
+                        (unsigned long long)a->energy[attr->index] * 1000);
+}
+/* Display power interval registers */
+static ssize_t aem_show_power_period(struct device *dev,
+                                     struct device_attribute *devattr,
+                                     char *buf)
+{
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct aem_data *a = dev_get_drvdata(dev);
+        a->update(a);
+        return sprintf(buf, "%lu\n", a->power_period[attr->index]);
+}
+/* Set power interval registers */
+static ssize_t aem_set_power_period(struct device *dev,
+                                    struct device_attribute *devattr,
+                                    const char *buf, size_t count)
+{
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct aem_data *a = dev_get_drvdata(dev);
+        unsigned long temp;
+        int res;
+        res = strict_strtoul(buf, 10, &temp);
+        if (res)
+                return res;
+        if (temp < AEM_MIN_POWER_INTERVAL)
+                return -EINVAL;
+        mutex_lock(&a->lock);
+        a->power_period[attr->index] = temp;
+        mutex_unlock(&a->lock);
+        return count;
+}
+/* Discover sensors on an AEM device */
+static int aem_register_sensors(struct aem_data *data,
+                                struct aem_ro_sensor_template *ro,
+                                struct aem_rw_sensor_template *rw)
+{
+        struct device *dev = &data->pdev->dev;
+        struct sensor_device_attribute *sensors = data->sensors;
+        int err;
+        /* Set up read-only sensors */
+        while (ro->label) {
+                sensors->dev_attr.attr.name = ro->label;
+                sensors->dev_attr.attr.mode = S_IRUGO;
+                sensors->dev_attr.show = ro->show;
+                sensors->index = ro->index;
+                err = device_create_file(dev, &sensors->dev_attr);
+                if (err) {
+                        sensors->dev_attr.attr.name = NULL;
+                        goto error;
+                }
+                sensors++;
+                ro++;
+        }
+        /* Set up read-write sensors */
+        while (rw->label) {
+                sensors->dev_attr.attr.name = rw->label;
+                sensors->dev_attr.attr.mode = S_IRUGO | S_IWUSR;
+                sensors->dev_attr.show = rw->show;
+                sensors->dev_attr.store = rw->set;
+                sensors->index = rw->index;
+                err = device_create_file(dev, &sensors->dev_attr);
+                if (err) {
+                        sensors->dev_attr.attr.name = NULL;
+                        goto error;
+                }
+                sensors++;
+                rw++;
+        }
+        err = device_create_file(dev, &sensor_dev_attr_name.dev_attr);
+        if (err)
+                goto error;
+        err = device_create_file(dev, &sensor_dev_attr_version.dev_attr);
+        return err;
+error:
+        aem_remove_sensors(data);
+        return err;
+}
+/* sysfs support functions for AEM2 sensors */
+/* Display temperature use */
+static ssize_t aem2_show_temp(struct device *dev,
+                              struct device_attribute *devattr,
+                              char *buf)
+{
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct aem_data *a = dev_get_drvdata(dev);
+        a->update(a);
+        return sprintf(buf, "%u\n", a->temp[attr->index] * 1000);
+}
+/* Display power-capping registers */
+static ssize_t aem2_show_pcap_value(struct device *dev,
+                                    struct device_attribute *devattr,
+                                    char *buf)
+{
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct aem_data *a = dev_get_drvdata(dev);
+        a->update(a);
+        return sprintf(buf, "%u\n", a->pcap[attr->index] * 100000);
+}
+/* Remove sensors attached to an AEM device */
+static void aem_remove_sensors(struct aem_data *data)
+{
+        int i;
+        for (i = 0; i < AEM_NUM_SENSORS; i++) {
+                if (!data->sensors[i].dev_attr.attr.name)
+                        continue;
+                device_remove_file(&data->pdev->dev,
+                                   &data->sensors[i].dev_attr);
+        }
+        device_remove_file(&data->pdev->dev,
+                           &sensor_dev_attr_name.dev_attr);
+        device_remove_file(&data->pdev->dev,
+                           &sensor_dev_attr_version.dev_attr);
+}
+/* Sensor probe functions */
+/* Description of AEM1 sensors */
+static struct aem_ro_sensor_template aem1_ro_sensors[] = {
+{"energy1_input",  aem_show_energy, 0},
+{"power1_average", aem_show_power,  0},
+{NULL,             NULL,            0},
+};
+static struct aem_rw_sensor_template aem1_rw_sensors[] = {
+{"power1_average_interval", aem_show_power_period, aem_set_power_period, 0},
+{NULL,                      NULL,                  NULL,                 0},
+};
+/* Description of AEM2 sensors */
+static struct aem_ro_sensor_template aem2_ro_sensors[] = {
+{"energy1_input",         aem_show_energy,      0},
+{"energy2_input",         aem_show_energy,      1},
+{"power1_average",        aem_show_power,       0},
+{"power2_average",        aem_show_power,       1},
+{"temp1_input",           aem2_show_temp,       0},
+{"temp2_input",           aem2_show_temp,       1},
+{"power4_average",        aem2_show_pcap_value, POWER_CAP_MAX_HOTPLUG},
+{"power5_average",        aem2_show_pcap_value, POWER_CAP_MAX},
+{"power6_average",        aem2_show_pcap_value, POWER_CAP_MIN_WARNING},
+{"power7_average",        aem2_show_pcap_value, POWER_CAP_MIN},
+{"power3_average",        aem2_show_pcap_value, POWER_AUX},
+{"power_cap",             aem2_show_pcap_value, POWER_CAP},
+{NULL,                    NULL,                 0},
+};
+static struct aem_rw_sensor_template aem2_rw_sensors[] = {
+{"power1_average_interval", aem_show_power_period, aem_set_power_period, 0},
+{"power2_average_interval", aem_show_power_period, aem_set_power_period, 1},
+{NULL,                      NULL,                  NULL,                 0},
+};
+/* Set up AEM1 sensor attrs */
+static int aem1_find_sensors(struct aem_data *data)
+{
+        return aem_register_sensors(data, aem1_ro_sensors, aem1_rw_sensors);
+}
+/* Set up AEM2 sensor attrs */
+static int aem2_find_sensors(struct aem_data *data)
+{
+        return aem_register_sensors(data, aem2_ro_sensors, aem2_rw_sensors);
+}
+/* Module init/exit routines */
+static int __init aem_init(void)
+{
+        int res;
+        res = driver_register(&aem_driver);
+        if (res) {
+                printk(KERN_ERR "Can't register aem driver\n");
+                return res;
+        }
+        res = ipmi_smi_watcher_register(&driver_data.bmc_events);
+        if (res)
+                goto ipmi_reg_err;
+        return 0;
+ipmi_reg_err:
+        driver_unregister(&aem_driver);
+        return res;
+}
+static void __exit aem_exit(void)
+{
+        struct aem_data *p1, *next1;
+        ipmi_smi_watcher_unregister(&driver_data.bmc_events);
+        driver_unregister(&aem_driver);
+        list_for_each_entry_safe(p1, next1, &driver_data.aem_devices, list)
+                aem_delete(p1);
+}
+MODULE_AUTHOR("Darrick J. Wong <djwong@us.ibm.com>");
+MODULE_DESCRIPTION("IBM Active Energy Manager power/temp sensor driver");
+MODULE_LICENSE("GPL");
+module_init(aem_init);
+module_exit(aem_exit);
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index b4f3aefa12b6..1607536ff5fb 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -1028,6 +1028,7 @@ endif
 config BLK_DEV_HD_ONLY
        bool "Old hard disk (MFM/RLL/IDE) driver"
+        depends on !ARM || ARCH_RPC || ARCH_SHARK || BROKEN
        help
          There are two drivers for MFM/RLL/IDE hard disks. Most people use
          the newer enhanced driver, but this old one is still around for two
diff --git a/drivers/ide/arm/bast-ide.c b/drivers/ide/arm/bast-ide.c
index 713cef20622e..8e8c28104b45 100644
--- a/drivers/ide/arm/bast-ide.c
+++ b/drivers/ide/arm/bast-ide.c
@@ -42,6 +42,7 @@ static int __init bastide_register(unsigned int base, unsigned int aux, int irq)
        hw.io_ports.ctl_addr = aux + (6 * 0x20);
        hw.irq = irq;
+        hw.chipset = ide_generic;
        hwif = ide_find_port();
        if (hwif == NULL)
diff --git a/drivers/ide/arm/ide_arm.c b/drivers/ide/arm/ide_arm.c
index 4263ffd4ab20..2f311da4c963 100644
--- a/drivers/ide/arm/ide_arm.c
+++ b/drivers/ide/arm/ide_arm.c
@@ -49,6 +49,7 @@ static int __init ide_arm_init(void)
        memset(&hw, 0, sizeof(hw));
        ide_std_init_ports(&hw, base, ctl);
        hw.irq = IDE_ARM_IRQ;
+        hw.chipset = ide_generic;
        hwif = ide_find_port();
        if (hwif) {
diff --git a/drivers/ide/arm/palm_bk3710.c b/drivers/ide/arm/palm_bk3710.c
index 96378ebfb31f..d024ac8fad14 100644
--- a/drivers/ide/arm/palm_bk3710.c
+++ b/drivers/ide/arm/palm_bk3710.c
@@ -409,9 +409,6 @@ static int __devinit palm_bk3710_probe(struct platform_device *pdev)
        ide_device_add(idx, &palm_bk3710_port_info);
-        if (!hwif->present)
-                goto out;
        return 0;
 out:
        printk(KERN_WARNING "Palm Chip BK3710 IDE Register Fail\n");
diff --git a/drivers/ide/ide-generic.c b/drivers/ide/ide-generic.c
index a6073e248f45..2d92214096ab 100644
--- a/drivers/ide/ide-generic.c
+++ b/drivers/ide/ide-generic.c
@@ -22,6 +22,10 @@
 #define DRV_NAME        "ide_generic"
+static int probe_mask = 0x03;
+module_param(probe_mask, int, 0);
+MODULE_PARM_DESC(probe_mask, "probe mask for legacy ISA IDE ports");
 static ssize_t store_add(struct class *cls, const char *buf, size_t n)
 {
        ide_hwif_t *hwif;
@@ -89,6 +93,9 @@ static int __init ide_generic_init(void)
        u8 idx[MAX_HWIFS];
        int i;
+        printk(KERN_INFO DRV_NAME ": please use \"probe_mask=0x3f\" module "
+                         "parameter for probing all legacy ISA IDE ports\n");
        for (i = 0; i < MAX_HWIFS; i++) {
                ide_hwif_t *hwif;
                unsigned long io_addr = ide_default_io_base(i);
@@ -96,7 +103,7 @@ static int __init ide_generic_init(void)
                idx[i] = 0xff;
-                if (io_addr) {
+                if ((probe_mask & (1 << i)) && io_addr) {
                        if (!request_region(io_addr, 8, DRV_NAME)) {
                                printk(KERN_ERR "%s: I/O resource 0x%lX-0x%lX "
                                                "not free.\n",
@@ -125,6 +132,7 @@ static int __init ide_generic_init(void)
                        memset(&hw, 0, sizeof(hw));
                        ide_std_init_ports(&hw, io_addr, io_addr + 0x206);
                        hw.irq = ide_default_irq(io_addr);
+                        hw.chipset = ide_generic;
                        ide_init_port_hw(hwif, &hw);
                        idx[i] = i;
diff --git a/drivers/ide/ide-pnp.c b/drivers/ide/ide-pnp.c
index 6a8953f68e9f..adbd01784162 100644
--- a/drivers/ide/ide-pnp.c
+++ b/drivers/ide/ide-pnp.c
@@ -55,6 +55,7 @@ static int idepnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
        memset(&hw, 0, sizeof(hw));
        ide_std_init_ports(&hw, base, ctl);
        hw.irq = pnp_irq(dev, 0);
+        hw.chipset = ide_generic;
        hwif = ide_find_port();
        if (hwif) {
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 655ec7ef568a..380fa0c8cc84 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1333,8 +1333,7 @@ static void ide_port_init_devices(ide_hwif_t *hwif)
 static void ide_init_port(ide_hwif_t *hwif, unsigned int port,
                          const struct ide_port_info *d)
 {
-        if (d->chipset != ide_etrax100)
+        hwif->channel = port;
-                hwif->channel = port;
        if (d->chipset)
                hwif->chipset = d->chipset;
@@ -1519,7 +1518,7 @@ int ide_device_add_all(u8 *idx, const struct ide_port_info *d)
                        continue;
                }
-                if (d->chipset != ide_etrax100 && (i & 1) && mate) {
+                if ((i & 1) && mate) {
                        hwif->mate = mate;
                        mate->mate = hwif;
                }
@@ -1665,6 +1664,7 @@ static void ide_legacy_init_one(u8 *idx, hw_regs_t *hw, u8 port_no,
        ide_std_init_ports(hw, base, ctl);
        hw->irq = irq;
+        hw->chipset = d->chipset;
        hwif = ide_find_port_slot(d);
        if (hwif) {
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 8d6ad812a014..55ec7f798772 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -63,7 +63,6 @@ static int proc_ide_read_imodel
        case ide_pmac:          name = "mac-io";        break;
        case ide_au1xxx:        name = "au1xxx";        break;
        case ide_palm3710:      name = "palm3710";      break;
-        case ide_etrax100:      name = "etrax100";      break;
        case ide_acorn:         name = "acorn";         break;
        default:                name = "(unknown)";     break;
        }
diff --git a/drivers/ide/legacy/buddha.c b/drivers/ide/legacy/buddha.c
index 5c730e4dd735..9a1d27ef3f8a 100644
--- a/drivers/ide/legacy/buddha.c
+++ b/drivers/ide/legacy/buddha.c
@@ -138,6 +138,8 @@ static void __init buddha_setup_ports(hw_regs_t *hw, unsigned long base,
        hw->irq = IRQ_AMIGA_PORTS;
        hw->ack_intr = ack_intr;
+        hw->chipset = ide_generic;
 }
    /*
diff --git a/drivers/ide/legacy/falconide.c b/drivers/ide/legacy/falconide.c
index 9e449a0c623f..af11028b4794 100644
--- a/drivers/ide/legacy/falconide.c
+++ b/drivers/ide/legacy/falconide.c
@@ -81,6 +81,8 @@ static void __init falconide_setup_ports(hw_regs_t *hw)
        hw->irq = IRQ_MFP_IDE;
        hw->ack_intr = NULL;
+        hw->chipset = ide_generic;
 }
    /*
diff --git a/drivers/ide/legacy/gayle.c b/drivers/ide/legacy/gayle.c
index a9c2593a898c..fed7d812761c 100644
--- a/drivers/ide/legacy/gayle.c
+++ b/drivers/ide/legacy/gayle.c
@@ -16,6 +16,7 @@
 #include <linux/ide.h>
 #include <linux/init.h>
 #include <linux/zorro.h>
+#include <linux/module.h>
 #include <asm/setup.h>
 #include <asm/amigahw.h>
@@ -62,7 +63,10 @@
                                               GAYLE_NUM_HWIFS-1)
 #define GAYLE_HAS_CONTROL_REG   (!ide_doubler)
 #define GAYLE_IDEREG_SIZE       (ide_doubler ? 0x1000 : 0x2000)
 int ide_doubler = 0;    /* support IDE doublers? */
+EXPORT_SYMBOL_GPL(ide_doubler);
 module_param_named(doubler, ide_doubler, bool, 0);
 MODULE_PARM_DESC(doubler, "enable support for IDE doublers");
 #endif /* CONFIG_BLK_DEV_IDEDOUBLER */
@@ -112,6 +116,8 @@ static void __init gayle_setup_ports(hw_regs_t *hw, unsigned long base,
        hw->irq = IRQ_AMIGA_PORTS;
        hw->ack_intr = ack_intr;
+        hw->chipset = ide_generic;
 }
    /*
diff --git a/drivers/ide/legacy/ide-cs.c b/drivers/ide/legacy/ide-cs.c
index aa2ea3deac85..f633b6b3c7f3 100644
--- a/drivers/ide/legacy/ide-cs.c
+++ b/drivers/ide/legacy/ide-cs.c
@@ -135,13 +135,17 @@ static void ide_detach(struct pcmcia_device *link)
 {
    ide_info_t *info = link->priv;
    ide_hwif_t *hwif = info->hwif;
+    unsigned long data_addr, ctl_addr;
    DEBUG(0, "ide_detach(0x%p)\n", link);
+    data_addr = hwif->io_ports.data_addr;
+    ctl_addr  = hwif->io_ports.ctl_addr;
    ide_release(link);
-    release_region(hwif->io_ports.ctl_addr, 1);
+    release_region(ctl_addr, 1);
-    release_region(hwif->io_ports.data_addr, 8);
+    release_region(data_addr, 8);
    kfree(info);
 } /* ide_detach */
@@ -194,6 +198,16 @@ static ide_hwif_t *idecs_register(unsigned long io, unsigned long ctl,
    if (hwif->present)
        return hwif;
+    /* retry registration in case device is still spinning up */
+    for (i = 0; i < 10; i++) {
+        msleep(100);
+        ide_port_scan(hwif);
+        if (hwif->present)
+            return hwif;
+    }
+    return hwif;
 out_release:
    release_region(ctl, 1);
    release_region(io, 8);
@@ -222,7 +236,7 @@ static int ide_config(struct pcmcia_device *link)
        cistpl_cftable_entry_t dflt;
    } *stk = NULL;
    cistpl_cftable_entry_t *cfg;
-    int i, pass, last_ret = 0, last_fn = 0, is_kme = 0;
+    int pass, last_ret = 0, last_fn = 0, is_kme = 0;
    unsigned long io_base, ctl_base;
    ide_hwif_t *hwif;
@@ -319,30 +333,15 @@ static int ide_config(struct pcmcia_device *link)
    if (is_kme)
        outb(0x81, ctl_base+1);
-    /* retry registration in case device is still spinning up */
+     hwif = idecs_register(io_base, ctl_base, link->irq.AssignedIRQ, link);
-    for (i = 0; i < 10; i++) {
+     if (hwif == NULL && link->io.NumPorts1 == 0x20) {
-        hwif = idecs_register(io_base, ctl_base, link->irq.AssignedIRQ, link);
-        if (hwif)
-            break;
-        if (link->io.NumPorts1 == 0x20) {
            outb(0x02, ctl_base + 0x10);
            hwif = idecs_register(io_base + 0x10, ctl_base + 0x10,
                                  link->irq.AssignedIRQ, link);
-            if (hwif) {
-                io_base += 0x10;
-                ctl_base += 0x10;
-                break;
-            }
-        }
-        msleep(100);
    }
-    if (hwif == NULL) {
+    if (hwif == NULL)
-        printk(KERN_NOTICE "ide-cs: ide_register() at 0x%3lx & 0x%3lx"
-               ", irq %u failed\n", io_base, ctl_base,
-               link->irq.AssignedIRQ);
        goto failed;
-    }
    info->ndev = 1;
    sprintf(info->node.dev_name, "hd%c", 'a' + hwif->index * 2);
diff --git a/drivers/ide/legacy/macide.c b/drivers/ide/legacy/macide.c
index caa2632dd08e..2e84290d0bcc 100644
--- a/drivers/ide/legacy/macide.c
+++ b/drivers/ide/legacy/macide.c
@@ -78,6 +78,8 @@ static void __init macide_setup_ports(hw_regs_t *hw, unsigned long base,
        hw->irq = irq;
        hw->ack_intr = ack_intr;
+        hw->chipset = ide_generic;
 }
 static const char *mac_ide_name[] =
diff --git a/drivers/ide/legacy/q40ide.c b/drivers/ide/legacy/q40ide.c
index 6f535d00e638..8ff6e2d20834 100644
--- a/drivers/ide/legacy/q40ide.c
+++ b/drivers/ide/legacy/q40ide.c
@@ -70,6 +70,8 @@ static void q40_ide_setup_ports(hw_regs_t *hw, unsigned long base,
        hw->irq = irq;
        hw->ack_intr = ack_intr;
+        hw->chipset = ide_generic;
 }
 static void q40ide_input_data(ide_drive_t *drive, struct request *rq,
diff --git a/drivers/ide/pci/cmd640.c b/drivers/ide/pci/cmd640.c
index aaf38109eaec..b38a1980dcd5 100644
--- a/drivers/ide/pci/cmd640.c
+++ b/drivers/ide/pci/cmd640.c
@@ -747,9 +747,11 @@ static int __init cmd640x_init(void)
        ide_std_init_ports(&hw[0], 0x1f0, 0x3f6);
        hw[0].irq = 14;
+        hw[0].chipset = ide_cmd640;
        ide_std_init_ports(&hw[1], 0x170, 0x376);
        hw[1].irq = 15;
+        hw[1].chipset = ide_cmd640;
        printk(KERN_INFO "cmd640: buggy cmd640%c interface on %s, config=0x%02x"
                         "\n", 'a' + cmd640_chip_version - 1, bus_type, cfr);
diff --git a/drivers/ide/pci/delkin_cb.c b/drivers/ide/pci/delkin_cb.c
index b9e457996d0e..af0f30051d5a 100644
--- a/drivers/ide/pci/delkin_cb.c
+++ b/drivers/ide/pci/delkin_cb.c
@@ -47,13 +47,18 @@ static const struct ide_port_ops delkin_cb_port_ops = {
        .quirkproc              = ide_undecoded_slave,
 };
+static const struct ide_port_info delkin_cb_port_info = {
+        .port_ops               = &delkin_cb_port_ops,
+        .host_flags             = IDE_HFLAG_IO_32BIT | IDE_HFLAG_UNMASK_IRQS |
+                                  IDE_HFLAG_NO_DMA,
+};
 static int __devinit
 delkin_cb_probe (struct pci_dev *dev, const struct pci_device_id *id)
 {
        unsigned long base;
        hw_regs_t hw;
        ide_hwif_t *hwif = NULL;
-        ide_drive_t *drive;
        int i, rc;
        u8 idx[4] = { 0xff, 0xff, 0xff, 0xff };
@@ -79,6 +84,7 @@ delkin_cb_probe (struct pci_dev *dev, const struct pci_device_id *id)
        memset(&hw, 0, sizeof(hw));
        ide_std_init_ports(&hw, base + 0x10, base + 0x1e);
        hw.irq = dev->irq;
+        hw.dev = &dev->dev;
        hw.chipset = ide_pci;           /* this enables IRQ sharing */
        hwif = ide_find_port();
@@ -89,26 +95,16 @@ delkin_cb_probe (struct pci_dev *dev, const struct pci_device_id *id)
        ide_init_port_data(hwif, i);
        ide_init_port_hw(hwif, &hw);
-        hwif->port_ops = &delkin_cb_port_ops;
        idx[0] = i;
-        ide_device_add(idx, NULL);
+        ide_device_add(idx, &delkin_cb_port_info);
-        if (!hwif->present)
-                goto out_disable;
        pci_set_drvdata(dev, hwif);
-        hwif->dev = &dev->dev;
-        drive = &hwif->drives[0];
-        if (drive->present) {
-                drive->io_32bit = 1;
-                drive->unmask   = 1;
-        }
        return 0;
 out_disable:
-        printk(KERN_ERR "delkin_cb: no IDE devices found\n");
        pci_release_regions(dev);
        pci_disable_device(dev);
        return -ENODEV;
@@ -139,14 +135,12 @@ static struct pci_driver driver = {
        .remove         = delkin_cb_remove,
 };
-static int
+static int __init delkin_cb_init(void)
-delkin_cb_init (void)
 {
        return pci_register_driver(&driver);
 }
-static void
+static void __exit delkin_cb_exit(void)
-delkin_cb_exit (void)
 {
        pci_unregister_driver(&driver);
 }
diff --git a/drivers/ide/pci/opti621.c b/drivers/ide/pci/opti621.c
index 6e99080497bf..725c80508d90 100644
--- a/drivers/ide/pci/opti621.c
+++ b/drivers/ide/pci/opti621.c
@@ -81,8 +81,6 @@
 * 0.5 doesn't work.
 */
-#define OPTI621_DEBUG           /* define for debug messages */
 #include <linux/types.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -92,28 +90,6 @@
 #include <asm/io.h>
-//#define OPTI621_MAX_PIO 3
-/* In fact, I do not have any PIO 4 drive
- * (address: 25 ns, data: 70 ns, recovery: 35 ns),
- * but OPTi 82C621 is programmable and it can do (minimal values):
- * on 40MHz PCI bus (pulse 25 ns):
- *  address: 25 ns, data: 25 ns, recovery: 50 ns;
- * on 20MHz PCI bus (pulse 50 ns):
- *  address: 50 ns, data: 50 ns, recovery: 100 ns.
- */
-/* #define READ_PREFETCH 0 */
-/* Uncomment for disable read prefetch.
- * There is some readprefetch capatibility in hdparm,
- * but when I type hdparm -P 1 /dev/hda, I got errors
- * and till reset drive is inaccessible.
- * This (hw) read prefetch is safe on my drive.
- */
-#ifndef READ_PREFETCH
-#define READ_PREFETCH 0x40 /* read prefetch is enabled */
-#endif /* else read prefetch is disabled */
 #define READ_REG 0      /* index of Read cycle timing register */
 #define WRITE_REG 1     /* index of Write cycle timing register */
 #define CNTRL_REG 3     /* index of Control register */
@@ -122,51 +98,8 @@
 static int reg_base;
-#define PIO_NOT_EXIST 254
-#define PIO_DONT_KNOW 255
 static DEFINE_SPINLOCK(opti621_lock);
-/* there are stored pio numbers from other calls of opti621_set_pio_mode */
-static void compute_pios(ide_drive_t *drive, const u8 pio)
-/* Store values into drive->drive_data
- *      second_contr - 0 for primary controller, 1 for secondary
- *      slave_drive - 0 -> pio is for master, 1 -> pio is for slave
- *      pio - PIO mode for selected drive (for other we don't know)
- */
-{
-        int d;
-        ide_hwif_t *hwif = HWIF(drive);
-        drive->drive_data = pio;
-        for (d = 0; d < 2; ++d) {
-                drive = &hwif->drives[d];
-                if (drive->present) {
-                        if (drive->drive_data == PIO_DONT_KNOW)
-                                drive->drive_data = ide_get_best_pio_mode(drive, 255, 3);
-#ifdef OPTI621_DEBUG
-                        printk("%s: Selected PIO mode %d\n",
-                                drive->name, drive->drive_data);
-#endif
-                } else {
-                        drive->drive_data = PIO_NOT_EXIST;
-                }
-        }
-}
-static int cmpt_clk(int time, int bus_speed)
-/* Returns (rounded up) time in clocks for time in ns,
- * with bus_speed in MHz.
- * Example: bus_speed = 40 MHz, time = 80 ns
- * 1000/40 = 25 ns (clk value),
- * 80/25 = 3.2, rounded up to 4 (I hope ;-)).
- * Use idebus=xx to select right frequency.
- */
-{
-        return ((time*bus_speed+999)/1000);
-}
 /* Write value to register reg, base of register
 * is at reg_base (0x1f0 primary, 0x170 secondary,
 * if not changed by PCI configuration).
@@ -199,83 +132,29 @@ static u8 read_reg(int reg)
        return ret;
 }
-typedef struct pio_clocks_s {
-        int     address_time;   /* Address setup (clocks) */
-        int     data_time;      /* Active/data pulse (clocks) */
-        int     recovery_time;  /* Recovery time (clocks) */
-} pio_clocks_t;
-static void compute_clocks(int pio, pio_clocks_t *clks)
-{
-        if (pio != PIO_NOT_EXIST) {
-                int adr_setup, data_pls;
-                int bus_speed = ide_pci_clk ? ide_pci_clk : system_bus_clock();
-                adr_setup = ide_pio_timings[pio].setup_time;
-                data_pls = ide_pio_timings[pio].active_time;
-                clks->address_time = cmpt_clk(adr_setup, bus_speed);
-                clks->data_time = cmpt_clk(data_pls, bus_speed);
-                clks->recovery_time = cmpt_clk(ide_pio_timings[pio].cycle_time
-                        - adr_setup-data_pls, bus_speed);
-                if (clks->address_time < 1)
-                        clks->address_time = 1;
-                if (clks->address_time > 4)
-                        clks->address_time = 4;
-                if (clks->data_time < 1)
-                        clks->data_time = 1;
-                if (clks->data_time > 16)
-                        clks->data_time = 16;
-                if (clks->recovery_time < 2)
-                        clks->recovery_time = 2;
-                if (clks->recovery_time > 17)
-                        clks->recovery_time = 17;
-        } else {
-                clks->address_time = 1;
-                clks->data_time = 1;
-                clks->recovery_time = 2;
-                /* minimal values */
-        }
-}
 static void opti621_set_pio_mode(ide_drive_t *drive, const u8 pio)
 {
-        /* primary and secondary drives share some registers,
+        ide_hwif_t *hwif = drive->hwif;
-         * so we have to program both drives
+        ide_drive_t *pair = ide_get_paired_drive(drive);
-         */
        unsigned long flags;
-        u8 pio1 = 0, pio2 = 0;
+        u8 tim, misc, addr_pio = pio, clk;
-        pio_clocks_t first, second;
-        int ax, drdy;
+        /* DRDY is default 2 (by OPTi Databook) */
-        u8 cycle1, cycle2, misc;
+        static const u8 addr_timings[2][5] = {
-        ide_hwif_t *hwif = HWIF(drive);
+                { 0x20, 0x10, 0x00, 0x00, 0x00 },       /* 33 MHz */
+                { 0x10, 0x10, 0x00, 0x00, 0x00 },       /* 25 MHz */
-        /* sets drive->drive_data for both drives */
+        };
-        compute_pios(drive, pio);
+        static const u8 data_rec_timings[2][5] = {
-        pio1 = hwif->drives[0].drive_data;
+                { 0x5b, 0x45, 0x32, 0x21, 0x20 },       /* 33 MHz */
-        pio2 = hwif->drives[1].drive_data;
+                { 0x48, 0x34, 0x21, 0x10, 0x10 }        /* 25 MHz */
+        };
-        compute_clocks(pio1, &first);
-        compute_clocks(pio2, &second);
+        drive->drive_data = XFER_PIO_0 + pio;
-        /* ax = max(a1,a2) */
+        if (pair->present) {
-        ax = (first.address_time < second.address_time) ? second.address_time : first.address_time;
+                if (pair->drive_data && pair->drive_data < drive->drive_data)
+                        addr_pio = pair->drive_data - XFER_PIO_0;
-        drdy = 2; /* DRDY is default 2 (by OPTi Databook) */
+        }
-        cycle1 = ((first.data_time-1)<<4)  | (first.recovery_time-2);
-        cycle2 = ((second.data_time-1)<<4) | (second.recovery_time-2);
-        misc = READ_PREFETCH | ((ax-1)<<4) | ((drdy-2)<<1);
-#ifdef OPTI621_DEBUG
-        printk("%s: master: address: %d, data: %d, "
-                "recovery: %d, drdy: %d [clk]\n",
-                hwif->name, ax, first.data_time,
-                first.recovery_time, drdy);
-        printk("%s: slave:  address: %d, data: %d, "
-                "recovery: %d, drdy: %d [clk]\n",
-                hwif->name, ax, second.data_time,
-                second.recovery_time, drdy);
-#endif
        spin_lock_irqsave(&opti621_lock, flags);
@@ -289,24 +168,21 @@ static void opti621_set_pio_mode(ide_drive_t *drive, const u8 pio)
        (void)inb(reg_base + CNTRL_REG);
        /* if reads 0xc0, no interface exist? */
        read_reg(CNTRL_REG);
-        /* read version, probably 0 */
-        read_reg(STRAP_REG);
-        /* program primary drive */
+        /* check CLK speed */
-        /* select Index-0 for Register-A */
+        clk = read_reg(STRAP_REG) & 1;
-        write_reg(0, MISC_REG);
-        /* set read cycle timings */
+        printk(KERN_INFO "%s: CLK = %d MHz\n", hwif->name, clk ? 25 : 33);
-        write_reg(cycle1, READ_REG);
-        /* set write cycle timings */
-        write_reg(cycle1, WRITE_REG);
-        /* program secondary drive */
+        tim  = data_rec_timings[clk][pio];
-        /* select Index-1 for Register-B */
+        misc = addr_timings[clk][addr_pio];
-        write_reg(1, MISC_REG);
+        /* select Index-0/1 for Register-A/B */
+        write_reg(drive->select.b.unit, MISC_REG);
        /* set read cycle timings */
-        write_reg(cycle2, READ_REG);
+        write_reg(tim, READ_REG);
        /* set write cycle timings */
-        write_reg(cycle2, WRITE_REG);
+        write_reg(tim, WRITE_REG);
        /* use Register-A for drive 0 */
        /* use Register-B for drive 1 */
@@ -319,45 +195,26 @@ static void opti621_set_pio_mode(ide_drive_t *drive, const u8 pio)
        spin_unlock_irqrestore(&opti621_lock, flags);
 }
-static void __devinit opti621_port_init_devs(ide_hwif_t *hwif)
-{
-        hwif->drives[0].drive_data = PIO_DONT_KNOW;
-        hwif->drives[1].drive_data = PIO_DONT_KNOW;
-}
 static const struct ide_port_ops opti621_port_ops = {
-        .port_init_devs         = opti621_port_init_devs,
        .set_pio_mode           = opti621_set_pio_mode,
 };
-static const struct ide_port_info opti621_chipsets[] __devinitdata = {
+static const struct ide_port_info opti621_chipset __devinitdata = {
-        {       /* 0 */
+        .name           = "OPTI621/X",
-                .name           = "OPTI621",
+        .enablebits     = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
-                .enablebits     = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
+        .port_ops       = &opti621_port_ops,
-                .port_ops       = &opti621_port_ops,
+        .host_flags     = IDE_HFLAG_NO_DMA,
-                .host_flags     = IDE_HFLAG_TRUST_BIOS_FOR_DMA,
+        .pio_mask       = ATA_PIO4,
-                .pio_mask       = ATA_PIO3,
-                .swdma_mask     = ATA_SWDMA2,
-                .mwdma_mask     = ATA_MWDMA2,
-        }, {    /* 1 */
-                .name           = "OPTI621X",
-                .enablebits     = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
-                .port_ops       = &opti621_port_ops,
-                .host_flags     = IDE_HFLAG_TRUST_BIOS_FOR_DMA,
-                .pio_mask       = ATA_PIO3,
-                .swdma_mask     = ATA_SWDMA2,
-                .mwdma_mask     = ATA_MWDMA2,
-        }
 };
 static int __devinit opti621_init_one(struct pci_dev *dev, const struct pci_device_id *id)
 {
-        return ide_setup_pci_device(dev, &opti621_chipsets[id->driver_data]);
+        return ide_setup_pci_device(dev, &opti621_chipset);
 }
 static const struct pci_device_id opti621_pci_tbl[] = {
        { PCI_VDEVICE(OPTI, PCI_DEVICE_ID_OPTI_82C621), 0 },
-        { PCI_VDEVICE(OPTI, PCI_DEVICE_ID_OPTI_82C825), 1 },
+        { PCI_VDEVICE(OPTI, PCI_DEVICE_ID_OPTI_82C825), 0 },
        { 0, },
 };
 MODULE_DEVICE_TABLE(pci, opti621_pci_tbl);
diff --git a/drivers/ide/pci/sis5513.c b/drivers/ide/pci/sis5513.c
index 4b0b85d8faf5..e127eb25ab63 100644
--- a/drivers/ide/pci/sis5513.c
+++ b/drivers/ide/pci/sis5513.c
@@ -569,6 +569,11 @@ static int __devinit sis5513_init_one(struct pci_dev *dev, const struct pci_devi
 {
        struct ide_port_info d = sis5513_chipset;
        u8 udma_rates[] = { 0x00, 0x00, 0x07, 0x1f, 0x3f, 0x3f, 0x7f, 0x7f };
+        int rc;
+        rc = pci_enable_device(dev);
+        if (rc)
+                return rc;
        if (sis_find_family(dev) == 0)
                return -ENOTSUPP;
diff --git a/drivers/ide/ppc/mpc8xx.c b/drivers/ide/ppc/mpc8xx.c
index f0e638dcc3ab..236f9c38e519 100644
--- a/drivers/ide/ppc/mpc8xx.c
+++ b/drivers/ide/ppc/mpc8xx.c
@@ -303,6 +303,8 @@ static int __init m8xx_ide_init_ports(hw_regs_t *hw, unsigned long data_port)
        pcmp->pcmc_per = 0x100000 >> (16 * _slot_);
 #endif  /* CONFIG_IDE_8xx_PCCARD */
+        hw->chipset = ide_generic;
        return 0;
 }
 #endif /* CONFIG_IDE_8xx_PCCARD || CONFIG_IDE_8xx_DIRECT */
@@ -377,6 +379,8 @@ static int __init m8xx_ide_init_ports(hw_regs_t *hw, unsigned long data_port)
        ((immap_t *) IMAP_ADDR)->im_siu_conf.sc_siel |=
                        (0x80000000 >> ioport_dsc[data_port].irq);
+        hw->chipset = ide_generic;
        return 0;
 }
 #endif  /* CONFIG_IDE_8xx_DIRECT */
diff --git a/drivers/ide/ppc/pmac.c b/drivers/ide/ppc/pmac.c
index 48aa019127bc..ba2d58727964 100644
--- a/drivers/ide/ppc/pmac.c
+++ b/drivers/ide/ppc/pmac.c
@@ -59,7 +59,6 @@ typedef struct pmac_ide_hwif {
        int                             irq;
        int                             kind;
        int                             aapl_bus_id;
-        unsigned                        cable_80 : 1;
        unsigned                        mediabay : 1;
        unsigned                        broken_dma : 1;
        unsigned                        broken_dma_warn : 1;
@@ -918,10 +917,40 @@ pmac_ide_do_resume(ide_hwif_t *hwif)
        return 0;
 }
+static u8 pmac_ide_cable_detect(ide_hwif_t *hwif)
+{
+        pmac_ide_hwif_t *pmif = (pmac_ide_hwif_t *)ide_get_hwifdata(hwif);
+        struct device_node *np = pmif->node;
+        const char *cable = of_get_property(np, "cable-type", NULL);
+        /* Get cable type from device-tree. */
+        if (cable && !strncmp(cable, "80-", 3))
+                return ATA_CBL_PATA80;
+        /*
+         * G5's seem to have incorrect cable type in device-tree.
+         * Let's assume they have a 80 conductor cable, this seem
+         * to be always the case unless the user mucked around.
+         */
+        if (of_device_is_compatible(np, "K2-UATA") ||
+            of_device_is_compatible(np, "shasta-ata"))
+                return ATA_CBL_PATA80;
+        return ATA_CBL_PATA40;
+}
 static const struct ide_port_ops pmac_ide_ata6_port_ops = {
        .set_pio_mode           = pmac_ide_set_pio_mode,
        .set_dma_mode           = pmac_ide_set_dma_mode,
        .selectproc             = pmac_ide_kauai_selectproc,
+        .cable_detect           = pmac_ide_cable_detect,
+};
+static const struct ide_port_ops pmac_ide_ata4_port_ops = {
+        .set_pio_mode           = pmac_ide_set_pio_mode,
+        .set_dma_mode           = pmac_ide_set_dma_mode,
+        .selectproc             = pmac_ide_selectproc,
+        .cable_detect           = pmac_ide_cable_detect,
 };
 static const struct ide_port_ops pmac_ide_port_ops = {
@@ -949,10 +978,7 @@ static const struct ide_port_info pmac_port_info = {
 /*
 * Setup, register & probe an IDE channel driven by this driver, this is
- * called by one of the 2 probe functions (macio or PCI). Note that a channel
+ * called by one of the 2 probe functions (macio or PCI).
- * that ends up beeing free of any device is not kept around by this driver
- * (it is kept in 2.4). This introduce an interface numbering change on some
- * rare machines unfortunately, but it's better this way.
 */
 static int __devinit
 pmac_ide_setup_device(pmac_ide_hwif_t *pmif, ide_hwif_t *hwif, hw_regs_t *hw)
@@ -962,7 +988,6 @@ pmac_ide_setup_device(pmac_ide_hwif_t *pmif, ide_hwif_t *hwif, hw_regs_t *hw)
        u8 idx[4] = { 0xff, 0xff, 0xff, 0xff };
        struct ide_port_info d = pmac_port_info;
-        pmif->cable_80 = 0;
        pmif->broken_dma = pmif->broken_dma_warn = 0;
        if (of_device_is_compatible(np, "shasta-ata")) {
                pmif->kind = controller_sh_ata6;
@@ -979,6 +1004,7 @@ pmac_ide_setup_device(pmac_ide_hwif_t *pmif, ide_hwif_t *hwif, hw_regs_t *hw)
        } else if (of_device_is_compatible(np, "keylargo-ata")) {
                if (strcmp(np->name, "ata-4") == 0) {
                        pmif->kind = controller_kl_ata4;
+                        d.port_ops = &pmac_ide_ata4_port_ops;
                        d.udma_mask = ATA_UDMA4;
                } else
                        pmif->kind = controller_kl_ata3;
@@ -992,22 +1018,6 @@ pmac_ide_setup_device(pmac_ide_hwif_t *pmif, ide_hwif_t *hwif, hw_regs_t *hw)
        bidp = of_get_property(np, "AAPL,bus-id", NULL);
        pmif->aapl_bus_id =  bidp ? *bidp : 0;
-        /* Get cable type from device-tree */
-        if (pmif->kind == controller_kl_ata4 || pmif->kind == controller_un_ata6
-            || pmif->kind == controller_k2_ata6
-            || pmif->kind == controller_sh_ata6) {
-                const char* cable = of_get_property(np, "cable-type", NULL);
-                if (cable && !strncmp(cable, "80-", 3))
-                        pmif->cable_80 = 1;
-        }
-        /* G5's seem to have incorrect cable type in device-tree. Let's assume
-         * they have a 80 conductor cable, this seem to be always the case unless
-         * the user mucked around
-         */
-        if (of_device_is_compatible(np, "K2-UATA") ||
-            of_device_is_compatible(np, "shasta-ata"))
-                pmif->cable_80 = 1;
        /* On Kauai-type controllers, we make sure the FCR is correct */
        if (pmif->kauai_fcr)
                writel(KAUAI_FCR_UATA_MAGIC |
@@ -1053,7 +1063,6 @@ pmac_ide_setup_device(pmac_ide_hwif_t *pmif, ide_hwif_t *hwif, hw_regs_t *hw)
        hwif->hwif_data = pmif;
        ide_init_port_hw(hwif, hw);
-        hwif->cbl = pmif->cable_80 ? ATA_CBL_PATA80 : ATA_CBL_PATA40;
        printk(KERN_INFO "ide%d: Found Apple %s controller, bus ID %d%s, irq %d\n",
               hwif->index, model_name[pmif->kind], pmif->aapl_bus_id,
@@ -1070,11 +1079,6 @@ pmac_ide_setup_device(pmac_ide_hwif_t *pmif, ide_hwif_t *hwif, hw_regs_t *hw)
                }
        }
-#ifdef CONFIG_BLK_DEV_IDEDMA_PMAC
-        if (pmif->cable_80 == 0)
-                d.udma_mask &= ATA_UDMA2;
-#endif
        idx[0] = hwif->index;
        ide_device_add(idx, &d);
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index fbe16d5250a4..1adf2efd3cb3 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -747,7 +747,9 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
                break;
        case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_CONSUMED:
                kmem_cache_free(ib_mad_cache, mad_priv);
-                break;
+                kfree(local);
+                ret = 1;
+                goto out;
        case IB_MAD_RESULT_SUCCESS:
                /* Treat like an incoming receive MAD */
                port_priv = ib_get_mad_port(mad_agent_priv->agent.device,
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index fe78f7d25099..a1768dbb0720 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -150,7 +150,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
        ret = 0;
        while (npages) {
                ret = get_user_pages(current, current->mm, cur_base,
-                                     min_t(int, npages,
+                                     min_t(unsigned long, npages,
                                           PAGE_SIZE / sizeof (struct page *)),
                                     1, !umem->writable, page_list, vma_list);
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index 9a054c6941a4..b1441aeb60c2 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -455,8 +455,7 @@ int __devinit c2_rnic_init(struct c2_dev *c2dev)
             IB_DEVICE_CURR_QP_STATE_MOD |
             IB_DEVICE_SYS_IMAGE_GUID |
             IB_DEVICE_ZERO_STAG |
-             IB_DEVICE_MEM_WINDOW |
+             IB_DEVICE_MEM_WINDOW);
-             IB_DEVICE_SEND_W_INV);
        /* Allocate the qptr_array */
        c2dev->qptr_array = vmalloc(C2_MAX_CQS * sizeof(void *));
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index 79dbe5beae52..992613799228 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -229,7 +229,7 @@ int iwch_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                      struct ib_send_wr **bad_wr)
 {
        int err = 0;
-        u8 t3_wr_flit_cnt;
+        u8 uninitialized_var(t3_wr_flit_cnt);
        enum t3_wr_opcode t3_wr_opcode = 0;
        enum t3_wr_flags t3_wr_flags;
        struct iwch_qp *qhp;
diff --git a/drivers/infiniband/hw/ehca/ehca_reqs.c b/drivers/infiniband/hw/ehca/ehca_reqs.c
index bbe0436f4f75..f093b0033daf 100644
--- a/drivers/infiniband/hw/ehca/ehca_reqs.c
+++ b/drivers/infiniband/hw/ehca/ehca_reqs.c
@@ -421,8 +421,10 @@ int ehca_post_send(struct ib_qp *qp,
        int ret = 0;
        unsigned long flags;
-        if (unlikely(my_qp->state != IB_QPS_RTS)) {
+        /* Reject WR if QP is in RESET, INIT or RTR state */
-                ehca_err(qp->device, "QP not in RTS state  qpn=%x", qp->qp_num);
+        if (unlikely(my_qp->state < IB_QPS_RTS)) {
+                ehca_err(qp->device, "Invalid QP state  qp_state=%d qpn=%x",
+                         my_qp->state, qp->qp_num);
                return -EINVAL;
        }
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 59a8b254b97f..0bd8bcb184a1 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -232,6 +232,11 @@ struct ipath_sdma_desc {
 #define IPATH_SDMA_TXREQ_S_ABORTED   2
 #define IPATH_SDMA_TXREQ_S_SHUTDOWN  3
+#define IPATH_SDMA_STATUS_SCORE_BOARD_DRAIN_IN_PROG     (1ull << 63)
+#define IPATH_SDMA_STATUS_ABORT_IN_PROG                 (1ull << 62)
+#define IPATH_SDMA_STATUS_INTERNAL_SDMA_ENABLE          (1ull << 61)
+#define IPATH_SDMA_STATUS_SCB_EMPTY                     (1ull << 30)
 /* max dwords in small buffer packet */
 #define IPATH_SMALLBUF_DWORDS (dd->ipath_piosize2k >> 2)
diff --git a/drivers/infiniband/hw/ipath/ipath_mad.c b/drivers/infiniband/hw/ipath/ipath_mad.c
index 1ff46ae7dd99..5f9315d77a43 100644
--- a/drivers/infiniband/hw/ipath/ipath_mad.c
+++ b/drivers/infiniband/hw/ipath/ipath_mad.c
@@ -1492,6 +1492,10 @@ static int process_subn(struct ib_device *ibdev, int mad_flags,
                        goto bail;
                }
+        case IB_MGMT_METHOD_TRAP:
+        case IB_MGMT_METHOD_REPORT:
+        case IB_MGMT_METHOD_REPORT_RESP:
+        case IB_MGMT_METHOD_TRAP_REPRESS:
        case IB_MGMT_METHOD_GET_RESP:
                /*
                 * The ib_mad module will call us to process responses
diff --git a/drivers/infiniband/hw/ipath/ipath_sdma.c b/drivers/infiniband/hw/ipath/ipath_sdma.c
index 3697449c1ba4..eaba03273e4f 100644
--- a/drivers/infiniband/hw/ipath/ipath_sdma.c
+++ b/drivers/infiniband/hw/ipath/ipath_sdma.c
@@ -263,14 +263,10 @@ static void sdma_abort_task(unsigned long opaque)
                hwstatus = ipath_read_kreg64(dd,
                                dd->ipath_kregs->kr_senddmastatus);
-                if (/* ScoreBoardDrainInProg */
+                if ((hwstatus & (IPATH_SDMA_STATUS_SCORE_BOARD_DRAIN_IN_PROG |
-                    test_bit(63, &hwstatus) ||
+                                 IPATH_SDMA_STATUS_ABORT_IN_PROG             |
-                    /* AbortInProg */
+                                 IPATH_SDMA_STATUS_INTERNAL_SDMA_ENABLE)) ||
-                    test_bit(62, &hwstatus) ||
+                    !(hwstatus & IPATH_SDMA_STATUS_SCB_EMPTY)) {
-                    /* InternalSDmaEnable */
-                    test_bit(61, &hwstatus) ||
-                    /* ScbEmpty */
-                    !test_bit(30, &hwstatus)) {
                        if (dd->ipath_sdma_reset_wait > 0) {
                                /* not done shutting down sdma */
                                --dd->ipath_sdma_reset_wait;
@@ -345,7 +341,7 @@ resched:
         * state change
         */
        if (jiffies > dd->ipath_sdma_abort_jiffies) {
-                ipath_dbg("looping with status 0x%016llx\n",
+                ipath_dbg("looping with status 0x%08lx\n",
                          dd->ipath_sdma_status);
                dd->ipath_sdma_abort_jiffies = jiffies + 5 * HZ;
        }
@@ -615,7 +611,7 @@ void ipath_restart_sdma(struct ipath_devdata *dd)
        }
        spin_unlock_irqrestore(&dd->ipath_sdma_lock, flags);
        if (!needed) {
-                ipath_dbg("invalid attempt to restart SDMA, status 0x%016llx\n",
+                ipath_dbg("invalid attempt to restart SDMA, status 0x%08lx\n",
                        dd->ipath_sdma_status);
                goto bail;
        }
diff --git a/drivers/infiniband/hw/ipath/ipath_uc.c b/drivers/infiniband/hw/ipath/ipath_uc.c
index 7fd18e833907..0596ec16fcbd 100644
--- a/drivers/infiniband/hw/ipath/ipath_uc.c
+++ b/drivers/infiniband/hw/ipath/ipath_uc.c
@@ -407,12 +407,11 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                        dev->n_pkt_drops++;
                        goto done;
                }
-                /* XXX Need to free SGEs */
+                wc.opcode = IB_WC_RECV;
        last_imm:
                ipath_copy_sge(&qp->r_sge, data, tlen);
                wc.wr_id = qp->r_wr_id;
                wc.status = IB_WC_SUCCESS;
-                wc.opcode = IB_WC_RECV;
                wc.qp = &qp->ibqp;
                wc.src_qp = qp->remote_qpn;
                wc.slid = qp->remote_ah_attr.dlid;
@@ -514,6 +513,7 @@ void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                        goto done;
                }
                wc.byte_len = qp->r_len;
+                wc.opcode = IB_WC_RECV_RDMA_WITH_IMM;
                goto last_imm;
        case OP(RDMA_WRITE_LAST):
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index e0ec540042bf..7779165b2c2c 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -1494,7 +1494,8 @@ static int ipath_query_device(struct ib_device *ibdev,
        props->device_cap_flags = IB_DEVICE_BAD_PKEY_CNTR |
                IB_DEVICE_BAD_QKEY_CNTR | IB_DEVICE_SHUTDOWN_PORT |
-                IB_DEVICE_SYS_IMAGE_GUID;
+                IB_DEVICE_SYS_IMAGE_GUID | IB_DEVICE_RC_RNR_NAK_GEN |
+                IB_DEVICE_PORT_ACTIVE_EVENT | IB_DEVICE_SRQ_RESIZE;
        props->page_size_cap = PAGE_SIZE;
        props->vendor_id = dev->dd->ipath_vendorid;
        props->vendor_part_id = dev->dd->ipath_deviceid;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 8e02ecfec188..a80df22deae8 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -333,6 +333,9 @@ static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
                cap->max_inline_data + sizeof (struct mlx4_wqe_inline_seg)) +
                send_wqe_overhead(type, qp->flags);
+        if (s > dev->dev->caps.max_sq_desc_sz)
+                return -EINVAL;
        /*
         * Hermon supports shrinking WQEs, such that a single work
         * request can include multiple units of 1 << wqe_shift.  This
@@ -372,9 +375,6 @@ static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
                qp->sq.wqe_shift = ilog2(roundup_pow_of_two(s));
        for (;;) {
-                if (1 << qp->sq.wqe_shift > dev->dev->caps.max_sq_desc_sz)
-                        return -EINVAL;
                qp->sq_max_wqes_per_wr = DIV_ROUND_UP(s, 1U << qp->sq.wqe_shift);
                /*
@@ -395,7 +395,8 @@ static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
                ++qp->sq.wqe_shift;
        }
-        qp->sq.max_gs = ((qp->sq_max_wqes_per_wr << qp->sq.wqe_shift) -
+        qp->sq.max_gs = (min(dev->dev->caps.max_sq_desc_sz,
+                             (qp->sq_max_wqes_per_wr << qp->sq.wqe_shift)) -
                         send_wqe_overhead(type, qp->flags)) /
                sizeof (struct mlx4_wqe_data_seg);
@@ -411,7 +412,9 @@ static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
        cap->max_send_wr  = qp->sq.max_post =
                (qp->sq.wqe_cnt - qp->sq_spare_wqes) / qp->sq_max_wqes_per_wr;
-        cap->max_send_sge = qp->sq.max_gs;
+        cap->max_send_sge = min(qp->sq.max_gs,
+                                min(dev->dev->caps.max_sq_sg,
+                                    dev->dev->caps.max_rq_sg));
        /* We don't support inline sends for kernel QPs (yet) */
        cap->max_inline_data = 0;
@@ -1457,7 +1460,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
        unsigned ind;
        int uninitialized_var(stamp);
        int uninitialized_var(size);
-        unsigned seglen;
+        unsigned uninitialized_var(seglen);
        int i;
        spin_lock_irqsave(&qp->sq.lock, flags);
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 9ebadd6e0cfb..200cf13fc9bb 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -45,6 +45,7 @@
 #include "mthca_cmd.h"
 #include "mthca_profile.h"
 #include "mthca_memfree.h"
+#include "mthca_wqe.h"
 MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("Mellanox InfiniBand HCA low-level driver");
@@ -200,7 +201,18 @@ static int mthca_dev_lim(struct mthca_dev *mdev, struct mthca_dev_lim *dev_lim)
        mdev->limits.gid_table_len      = dev_lim->max_gids;
        mdev->limits.pkey_table_len     = dev_lim->max_pkeys;
        mdev->limits.local_ca_ack_delay = dev_lim->local_ca_ack_delay;
-        mdev->limits.max_sg             = dev_lim->max_sg;
+        /*
+         * Need to allow for worst case send WQE overhead and check
+         * whether max_desc_sz imposes a lower limit than max_sg; UD
+         * send has the biggest overhead.
+         */
+        mdev->limits.max_sg             = min_t(int, dev_lim->max_sg,
+                                              (dev_lim->max_desc_sz -
+                                               sizeof (struct mthca_next_seg) -
+                                               (mthca_is_memfree(mdev) ?
+                                                sizeof (struct mthca_arbel_ud_seg) :
+                                                sizeof (struct mthca_tavor_ud_seg))) /
+                                                sizeof (struct mthca_data_seg));
        mdev->limits.max_wqes           = dev_lim->max_qp_sz;
        mdev->limits.max_qp_init_rdma   = dev_lim->max_requester_per_qp;
        mdev->limits.reserved_qps       = dev_lim->reserved_qps;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index d00a2c174aee..3f663fb852c1 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -194,7 +194,13 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
        /* Set the cached Q_Key before we attach if it's the broadcast group */
        if (!memcmp(mcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
                    sizeof (union ib_gid))) {
+                spin_lock_irq(&priv->lock);
+                if (!priv->broadcast) {
+                        spin_unlock_irq(&priv->lock);
+                        return -EAGAIN;
+                }
                priv->qkey = be32_to_cpu(priv->broadcast->mcmember.qkey);
+                spin_unlock_irq(&priv->lock);
                priv->tx_wr.wr.ud.remote_qkey = priv->qkey;
        }
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 4a95adc4cc78..af58a6f1e898 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -807,6 +807,8 @@ static int atkbd_activate(struct atkbd *atkbd)
 static void atkbd_cleanup(struct serio *serio)
 {
        struct atkbd *atkbd = serio_get_drvdata(serio);
+        atkbd_disable(atkbd);
        ps2_command(&atkbd->ps2dev, NULL, ATKBD_CMD_RESET_BAT);
 }
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index 3dea0c5077a9..45767e73f071 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -136,6 +136,9 @@ static void pxa27x_keypad_build_keycode(struct pxa27x_keypad *keypad)
                set_bit(code, input_dev->keybit);
        }
+        for (i = 0; i < pdata->direct_key_num; i++)
+                set_bit(pdata->direct_key_map[i], input_dev->keybit);
        keypad->rotary_up_key[0] = pdata->rotary0_up_key;
        keypad->rotary_up_key[1] = pdata->rotary1_up_key;
        keypad->rotary_down_key[0] = pdata->rotary0_down_key;
@@ -143,17 +146,21 @@ static void pxa27x_keypad_build_keycode(struct pxa27x_keypad *keypad)
        keypad->rotary_rel_code[0] = pdata->rotary0_rel_code;
        keypad->rotary_rel_code[1] = pdata->rotary1_rel_code;
-        if (pdata->rotary0_up_key && pdata->rotary0_down_key) {
+        if (pdata->enable_rotary0) {
-                set_bit(pdata->rotary0_up_key, input_dev->keybit);
+                if (pdata->rotary0_up_key && pdata->rotary0_down_key) {
-                set_bit(pdata->rotary0_down_key, input_dev->keybit);
+                        set_bit(pdata->rotary0_up_key, input_dev->keybit);
-        } else
+                        set_bit(pdata->rotary0_down_key, input_dev->keybit);
-                set_bit(pdata->rotary0_rel_code, input_dev->relbit);
+                } else
+                        set_bit(pdata->rotary0_rel_code, input_dev->relbit);
-        if (pdata->rotary1_up_key && pdata->rotary1_down_key) {
+        }
-                set_bit(pdata->rotary1_up_key, input_dev->keybit);
-                set_bit(pdata->rotary1_down_key, input_dev->keybit);
+        if (pdata->enable_rotary1) {
-        } else
+                if (pdata->rotary1_up_key && pdata->rotary1_down_key) {
-                set_bit(pdata->rotary1_rel_code, input_dev->relbit);
+                        set_bit(pdata->rotary1_up_key, input_dev->keybit);
+                        set_bit(pdata->rotary1_down_key, input_dev->keybit);
+                } else
+                        set_bit(pdata->rotary1_rel_code, input_dev->relbit);
+        }
 }
 static inline unsigned int lookup_matrix_keycode(
@@ -484,8 +491,13 @@ static int __devinit pxa27x_keypad_probe(struct platform_device *pdev)
        keypad->input_dev = input_dev;
        input_set_drvdata(input_dev, keypad);
-        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP) |
+        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
-                BIT_MASK(EV_REL);
+        if ((keypad->pdata->enable_rotary0 &&
+                        keypad->pdata->rotary0_rel_code) ||
+            (keypad->pdata->enable_rotary1 &&
+                        keypad->pdata->rotary1_rel_code)) {
+                input_dev->evbit[0] |= BIT_MASK(EV_REL);
+        }
        pxa27x_keypad_build_keycode(keypad);
        platform_set_drvdata(pdev, keypad);
diff --git a/drivers/input/misc/apanel.c b/drivers/input/misc/apanel.c
index 9531d8c7444f..d82f7f727f7a 100644
--- a/drivers/input/misc/apanel.c
+++ b/drivers/input/misc/apanel.c
@@ -20,7 +20,6 @@
 #include <linux/module.h>
 #include <linux/ioport.h>
 #include <linux/io.h>
-#include <linux/module.h>
 #include <linux/input-polldev.h>
 #include <linux/i2c.h>
 #include <linux/workqueue.h>
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 5ece9f56babc..9aafa96cb746 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -331,6 +331,13 @@ static struct dmi_system_id __initdata i8042_dmi_dritek_table[] = {
                },
        },
        {
+                .ident = "Acer TravelMate 660",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 660"),
+                },
+        },
+        {
                .ident = "Acer TravelMate 2490",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 65a74cfc187b..592ff55b62d0 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -885,6 +885,20 @@ static long i8042_panic_blink(long count)
 #undef DELAY
+#ifdef CONFIG_X86
+static void i8042_dritek_enable(void)
+{
+        char param = 0x90;
+        int error;
+        error = i8042_command(&param, 0x1059);
+        if (error)
+                printk(KERN_WARNING
+                        "Failed to enable DRITEK extension: %d\n",
+                        error);
+}
+#endif
 #ifdef CONFIG_PM
 /*
 * Here we try to restore the original BIOS settings. We only want to
@@ -942,6 +956,12 @@ static int i8042_resume(struct platform_device *dev)
                return -EIO;
        }
+#ifdef CONFIG_X86
+        if (i8042_dritek)
+                i8042_dritek_enable();
+#endif
        if (i8042_mux_present) {
                if (i8042_set_mux_mode(1, NULL) || i8042_enable_mux_ports())
                        printk(KERN_WARNING
@@ -1160,6 +1180,11 @@ static int __devinit i8042_probe(struct platform_device *dev)
        if (error)
                return error;
+#ifdef CONFIG_X86
+        if (i8042_dritek)
+                i8042_dritek_enable();
+#endif
        if (!i8042_noaux) {
                error = i8042_setup_aux();
                if (error && error != -ENODEV && error != -EBUSY)
@@ -1171,14 +1196,6 @@ static int __devinit i8042_probe(struct platform_device *dev)
                if (error)
                        goto out_fail;
        }
-#ifdef CONFIG_X86
-        if (i8042_dritek) {
-                char param = 0x90;
-                error = i8042_command(&param, 0x1059);
-                if (error)
-                        goto out_fail;
-        }
-#endif
 /*
 * Ok, everything is ready, let's register all serio ports
 */
diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
index c5a8661a1baa..1e748e46d12e 100644
--- a/drivers/input/tablet/gtco.c
+++ b/drivers/input/tablet/gtco.c
@@ -830,7 +830,7 @@ static int gtco_probe(struct usb_interface *usbinterface,
        struct gtco             *gtco;
        struct input_dev        *input_dev;
        struct hid_descriptor   *hid_desc;
-        char                    *report = NULL;
+        char                    *report;
        int                     result = 0, retry;
        int                     error;
        struct usb_endpoint_descriptor *endpoint;
@@ -916,12 +916,16 @@ static int gtco_probe(struct usb_interface *usbinterface,
                                         le16_to_cpu(hid_desc->wDescriptorLength),
                                         5000); /* 5 secs */
-                if (result == le16_to_cpu(hid_desc->wDescriptorLength))
+                dbg("usb_control_msg result: %d", result);
+                if (result == le16_to_cpu(hid_desc->wDescriptorLength)) {
+                        parse_hid_report_descriptor(gtco, report, result);
                        break;
+                }
        }
+        kfree(report);
        /* If we didn't get the report, fail */
-        dbg("usb_control_msg result: :%d", result);
        if (result != le16_to_cpu(hid_desc->wDescriptorLength)) {
                err("Failed to get HID Report Descriptor of size: %d",
                    hid_desc->wDescriptorLength);
@@ -929,12 +933,6 @@ static int gtco_probe(struct usb_interface *usbinterface,
                goto err_free_urb;
        }
-        /* Now we parse the report */
-        parse_hid_report_descriptor(gtco, report, result);
-        /* Now we delete it */
-        kfree(report);
        /* Create a device file node */
        usb_make_path(gtco->usbdev, gtco->usbpath, sizeof(gtco->usbpath));
        strlcat(gtco->usbpath, "/input0", sizeof(gtco->usbpath));
@@ -988,7 +986,6 @@ static int gtco_probe(struct usb_interface *usbinterface,
        usb_buffer_free(gtco->usbdev, REPORT_MAX_SIZE,
                        gtco->buffer, gtco->buf_dma);
 err_free_devs:
-        kfree(report);
        input_free_device(input_dev);
        kfree(gtco);
        return error;
diff --git a/drivers/input/touchscreen/wm9713.c b/drivers/input/touchscreen/wm9713.c
index 01278bd7e65c..838458792ea0 100644
--- a/drivers/input/touchscreen/wm9713.c
+++ b/drivers/input/touchscreen/wm9713.c
@@ -85,6 +85,15 @@ module_param(delay, int, 0);
 MODULE_PARM_DESC(delay, "Set adc sample delay.");
 /*
+ * Set five_wire = 1 to use a 5 wire touchscreen.
+ *
+ * NOTE: Five wire mode does not allow for readback of pressure.
+ */
+static int five_wire;
+module_param(five_wire, int, 0);
+MODULE_PARM_DESC(five_wire, "Set to '1' to use 5-wire touchscreen.");
+/*
 * Set adc mask function.
 *
 * Sources of glitch noise, such as signals driving an LCD display, may feed
@@ -162,6 +171,19 @@ static void wm9713_phy_init(struct wm97xx *wm)
                         64000 / rpu);
        }
+        /* Five wire panel? */
+        if (five_wire) {
+                dig3 |= WM9713_45W;
+                dev_info(wm->dev, "setting 5-wire touchscreen mode.");
+                if (pil) {
+                        dev_warn(wm->dev,
+                                 "Pressure measurement not supported in 5 "
+                                 "wire mode, disabling\n");
+                        pil = 0;
+                }
+        }
        /* touchpanel pressure */
        if (pil == 2) {
                dig3 |= WM9712_PIL;
diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c
index e9c7ea46b6e3..cdc24ad314e0 100644
--- a/drivers/input/touchscreen/wm97xx-core.c
+++ b/drivers/input/touchscreen/wm97xx-core.c
@@ -608,6 +608,17 @@ static int wm97xx_probe(struct device *dev)
                goto alloc_err;
        }
+        /* set up physical characteristics */
+        wm->codec->phy_init(wm);
+        /* load gpio cache */
+        wm->gpio[0] = wm97xx_reg_read(wm, AC97_GPIO_CFG);
+        wm->gpio[1] = wm97xx_reg_read(wm, AC97_GPIO_POLARITY);
+        wm->gpio[2] = wm97xx_reg_read(wm, AC97_GPIO_STICKY);
+        wm->gpio[3] = wm97xx_reg_read(wm, AC97_GPIO_WAKEUP);
+        wm->gpio[4] = wm97xx_reg_read(wm, AC97_GPIO_STATUS);
+        wm->gpio[5] = wm97xx_reg_read(wm, AC97_MISC_AFE);
        wm->input_dev = input_allocate_device();
        if (wm->input_dev == NULL) {
                ret = -ENOMEM;
@@ -616,6 +627,7 @@ static int wm97xx_probe(struct device *dev)
        /* set up touch configuration */
        wm->input_dev->name = "wm97xx touchscreen";
+        wm->input_dev->phys = "wm97xx";
        wm->input_dev->open = wm97xx_ts_input_open;
        wm->input_dev->close = wm97xx_ts_input_close;
        set_bit(EV_ABS, wm->input_dev->evbit);
@@ -634,17 +646,6 @@ static int wm97xx_probe(struct device *dev)
        if (ret < 0)
                goto dev_alloc_err;
-        /* set up physical characteristics */
-        wm->codec->phy_init(wm);
-        /* load gpio cache */
-        wm->gpio[0] = wm97xx_reg_read(wm, AC97_GPIO_CFG);
-        wm->gpio[1] = wm97xx_reg_read(wm, AC97_GPIO_POLARITY);
-        wm->gpio[2] = wm97xx_reg_read(wm, AC97_GPIO_STICKY);
-        wm->gpio[3] = wm97xx_reg_read(wm, AC97_GPIO_WAKEUP);
-        wm->gpio[4] = wm97xx_reg_read(wm, AC97_GPIO_STATUS);
-        wm->gpio[5] = wm97xx_reg_read(wm, AC97_MISC_AFE);
        /* register our battery device */
        wm->battery_dev = platform_device_alloc("wm97xx-battery", -1);
        if (!wm->battery_dev) {
@@ -801,7 +802,7 @@ void wm97xx_unregister_mach_ops(struct wm97xx *wm)
 EXPORT_SYMBOL_GPL(wm97xx_unregister_mach_ops);
 static struct device_driver wm97xx_driver = {
-        .name =         "ac97",
+        .name =         "wm97xx-ts",
        .bus =          &ac97_bus_type,
        .owner =        THIS_MODULE,
        .probe =        wm97xx_probe,
diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c
index 5fcbdccd7a53..16a874bb1561 100644
--- a/drivers/isdn/hardware/eicon/divasmain.c
+++ b/drivers/isdn/hardware/eicon/divasmain.c
@@ -806,7 +806,6 @@ static int DIVA_INIT_FUNCTION divas_init(void)
        if (!create_divas_proc()) {
 #ifdef MODULE
-                remove_divas_proc();
                divas_unregister_chrdev();
                divasfunc_exit();
 #endif
diff --git a/drivers/isdn/hardware/eicon/divasproc.c b/drivers/isdn/hardware/eicon/divasproc.c
index fae895828a17..040827288ec9 100644
--- a/drivers/isdn/hardware/eicon/divasproc.c
+++ b/drivers/isdn/hardware/eicon/divasproc.c
@@ -125,8 +125,8 @@ static const struct file_operations divas_fops = {
 int create_divas_proc(void)
 {
-        proc_create(divas_proc_name, S_IFREG | S_IRUGO, proc_net_eicon,
+        divas_proc_entry = proc_create(divas_proc_name, S_IFREG | S_IRUGO,
-                    &divas_fops);
+                                        proc_net_eicon, &divas_fops);
        if (!divas_proc_entry)
                return (0);
diff --git a/drivers/isdn/hysdn/hycapi.c b/drivers/isdn/hysdn/hycapi.c
index d3999a8e9f88..53f6ad1235db 100644
--- a/drivers/isdn/hysdn/hycapi.c
+++ b/drivers/isdn/hysdn/hycapi.c
@@ -462,11 +462,11 @@ static int hycapi_read_proc(char *page, char **start, off_t off,
                default: s = "???"; break;
        }
        len += sprintf(page+len, "%-16s %s\n", "type", s);
-        if ((s = cinfo->version[VER_DRIVER]) != 0)
+        if ((s = cinfo->version[VER_DRIVER]) != NULL)
                len += sprintf(page+len, "%-16s %s\n", "ver_driver", s);
-        if ((s = cinfo->version[VER_CARDTYPE]) != 0)
+        if ((s = cinfo->version[VER_CARDTYPE]) != NULL)
                len += sprintf(page+len, "%-16s %s\n", "ver_cardtype", s);
-        if ((s = cinfo->version[VER_SERIAL]) != 0)
+        if ((s = cinfo->version[VER_SERIAL]) != NULL)
                len += sprintf(page+len, "%-16s %s\n", "ver_serial", s);
    
        len += sprintf(page+len, "%-16s %s\n", "cardname", cinfo->cardname);
diff --git a/drivers/isdn/hysdn/hysdn_procconf.c b/drivers/isdn/hysdn/hysdn_procconf.c
index 15906d005b05..484299b031f8 100644
--- a/drivers/isdn/hysdn/hysdn_procconf.c
+++ b/drivers/isdn/hysdn/hysdn_procconf.c
@@ -207,30 +207,17 @@ hysdn_conf_write(struct file *file, const char __user *buf, size_t count, loff_t
 /* read conf file -> output card info data */
 /*******************************************/
 static ssize_t
-hysdn_conf_read(struct file *file, char __user *buf, size_t count, loff_t * off)
+hysdn_conf_read(struct file *file, char __user *buf, size_t count, loff_t *off)
 {
        char *cp;
-        int i;
-        if (file->f_mode & FMODE_READ) {
+        if (!(file->f_mode & FMODE_READ))
-                if (!(cp = file->private_data))
+                return -EPERM;  /* no permission to read */
-                        return (-EFAULT);       /* should never happen */
-                i = strlen(cp); /* get total string length */
+        if (!(cp = file->private_data))
-                if (*off < i) {
+                return -EFAULT; /* should never happen */
-                        /* still bytes to transfer */
-                        cp += *off;     /* point to desired data offset */
+        return simple_read_from_buffer(buf, count, off, cp, strlen(cp));
-                        i -= *off;      /* remaining length */
-                        if (i > count)
-                                i = count;      /* limit length to transfer */
-                        if (copy_to_user(buf, cp, i))
-                                return (-EFAULT);       /* copy error */
-                        *off += i;      /* adjust offset */
-                } else
-                        return (0);
-        } else
-                return (-EPERM);        /* no permission to read */
-        return (i);
 }                               /* hysdn_conf_read */
 /******************/
diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c
index 7817d2244921..1081091bbfaf 100644
--- a/drivers/isdn/sc/ioctl.c
+++ b/drivers/isdn/sc/ioctl.c
@@ -226,6 +226,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                 */
                if (copy_from_user(spid, data->dataptr, SCIOC_SPIDSIZE)) {
                        kfree(rcvmsg);
+                        kfree(spid);
                        return -EFAULT;
                }
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 8080249957af..1a8de57289eb 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -20,14 +20,11 @@
 /* The pointer to our (page) of device descriptions. */
 static void *lguest_devices;
-/* Unique numbering for lguest devices. */
-static unsigned int dev_index;
 /* For Guests, device memory can be used as normal memory, so we cast away the
 * __iomem to quieten sparse. */
 static inline void *lguest_map(unsigned long phys_addr, unsigned long pages)
 {
-        return (__force void *)ioremap(phys_addr, PAGE_SIZE*pages);
+        return (__force void *)ioremap_cache(phys_addr, PAGE_SIZE*pages);
 }
 static inline void lguest_unmap(void *addr)
@@ -325,8 +322,10 @@ static struct device lguest_root = {
 * As Andrew Tridgell says, "Untested code is buggy code".
 *
 * It's worth reading this carefully: we start with a pointer to the new device
- * descriptor in the "lguest_devices" page. */
+ * descriptor in the "lguest_devices" page, and the offset into the device
-static void add_lguest_device(struct lguest_device_desc *d)
+ * descriptor page so we can uniquely identify it if things go badly wrong. */
+static void add_lguest_device(struct lguest_device_desc *d,
+                              unsigned int offset)
 {
        struct lguest_device *ldev;
@@ -334,18 +333,14 @@ static void add_lguest_device(struct lguest_device_desc *d)
         * it. */
        ldev = kzalloc(sizeof(*ldev), GFP_KERNEL);
        if (!ldev) {
-                printk(KERN_EMERG "Cannot allocate lguest dev %u\n",
+                printk(KERN_EMERG "Cannot allocate lguest dev %u type %u\n",
-                       dev_index++);
+                       offset, d->type);
                return;
        }
        /* This devices' parent is the lguest/ dir. */
        ldev->vdev.dev.parent = &lguest_root;
        /* We have a unique device index thanks to the dev_index counter. */
-        ldev->vdev.index = dev_index++;
-        /* The device type comes straight from the descriptor.  There's also a
-         * device vendor field in the virtio_device struct, which we leave as
-         * 0. */
        ldev->vdev.id.device = d->type;
        /* We have a simple set of routines for querying the device's
         * configuration information and setting its status. */
@@ -357,8 +352,8 @@ static void add_lguest_device(struct lguest_device_desc *d)
         * virtio_device and calls device_register().  This makes the bus
         * infrastructure look for a matching driver. */
        if (register_virtio_device(&ldev->vdev) != 0) {
-                printk(KERN_ERR "Failed to register lguest device %u\n",
+                printk(KERN_ERR "Failed to register lguest dev %u type %u\n",
-                       ldev->vdev.index);
+                       offset, d->type);
                kfree(ldev);
        }
 }
@@ -379,7 +374,7 @@ static void scan_devices(void)
                        break;
                printk("Device at %i has size %u\n", i, desc_size(d));
-                add_lguest_device(d);
+                add_lguest_device(d, i);
        }
 }
diff --git a/drivers/macintosh/mediabay.c b/drivers/macintosh/mediabay.c
index 82add26cc665..c34bdf852e32 100644
--- a/drivers/macintosh/mediabay.c
+++ b/drivers/macintosh/mediabay.c
@@ -556,7 +556,8 @@ static void media_bay_step(int i)
                                printk("mediabay %d, registering IDE...\n", i);
                                pmu_suspend();
                                ide_port_scan(bay->cd_port);
-                                bay->cd_index = bay->cd_port->index;
+                                if (bay->cd_port->present)
+                                        bay->cd_index = bay->cd_port->index;
                                pmu_resume();
                        }
                        if (bay->cd_index == -1) {
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index c14dacdacfac..b26927ce889c 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -203,17 +203,6 @@ static void bitmap_checkfree(struct bitmap *bitmap, unsigned long page)
 * bitmap file handling - read and write the bitmap file and its superblock
 */
-/* copy the pathname of a file to a buffer */
-char *file_path(struct file *file, char *buf, int count)
-{
-        if (!buf)
-                return NULL;
-        buf = d_path(&file->f_path, buf, count);
-        return IS_ERR(buf) ? NULL : buf;
-}
 /*
 * basic page I/O operations
 */
@@ -721,11 +710,13 @@ static void bitmap_file_kick(struct bitmap *bitmap)
                if (bitmap->file) {
                        path = kmalloc(PAGE_SIZE, GFP_KERNEL);
                        if (path)
-                                ptr = file_path(bitmap->file, path, PAGE_SIZE);
+                                ptr = d_path(&bitmap->file->f_path, path,
+                                             PAGE_SIZE);
                        printk(KERN_ALERT
                              "%s: kicking failed bitmap file %s from array!\n",
-                              bmname(bitmap), ptr ? ptr : "");
+                              bmname(bitmap), IS_ERR(ptr) ? "" : ptr);
                        kfree(path);
                } else
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 83eb78b00137..7cf512a34ccf 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -74,6 +74,8 @@ static DEFINE_SPINLOCK(pers_lock);
 static void md_print_devices(void);
+static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
 #define MD_BUG(x...) { printk("md: bug in file %s, line %d\n", __FILE__, __LINE__); md_print_devices(); }
 /*
@@ -274,6 +276,7 @@ static mddev_t * mddev_find(dev_t unit)
        atomic_set(&new->active, 1);
        spin_lock_init(&new->write_lock);
        init_waitqueue_head(&new->sb_wait);
+        init_waitqueue_head(&new->recovery_wait);
        new->reshape_position = MaxSector;
        new->resync_max = MaxSector;
        new->level = LEVEL_NONE;
@@ -3013,6 +3016,36 @@ degraded_show(mddev_t *mddev, char *page)
 static struct md_sysfs_entry md_degraded = __ATTR_RO(degraded);
 static ssize_t
+sync_force_parallel_show(mddev_t *mddev, char *page)
+{
+        return sprintf(page, "%d\n", mddev->parallel_resync);
+}
+static ssize_t
+sync_force_parallel_store(mddev_t *mddev, const char *buf, size_t len)
+{
+        long n;
+        if (strict_strtol(buf, 10, &n))
+                return -EINVAL;
+        if (n != 0 && n != 1)
+                return -EINVAL;
+        mddev->parallel_resync = n;
+        if (mddev->sync_thread)
+                wake_up(&resync_wait);
+        return len;
+}
+/* force parallel resync, even with shared block devices */
+static struct md_sysfs_entry md_sync_force_parallel =
+__ATTR(sync_force_parallel, S_IRUGO|S_IWUSR,
+       sync_force_parallel_show, sync_force_parallel_store);
+static ssize_t
 sync_speed_show(mddev_t *mddev, char *page)
 {
        unsigned long resync, dt, db;
@@ -3187,6 +3220,7 @@ static struct attribute *md_redundancy_attrs[] = {
        &md_sync_min.attr,
        &md_sync_max.attr,
        &md_sync_speed.attr,
+        &md_sync_force_parallel.attr,
        &md_sync_completed.attr,
        &md_max_sync.attr,
        &md_suspend_lo.attr,
@@ -3691,6 +3725,8 @@ static int do_md_stop(mddev_t * mddev, int mode)
                        module_put(mddev->pers->owner);
                        mddev->pers = NULL;
+                        /* tell userspace to handle 'inactive' */
+                        sysfs_notify(&mddev->kobj, NULL, "array_state");
                        set_capacity(disk, 0);
                        mddev->changed = 1;
@@ -3987,8 +4023,8 @@ static int get_bitmap_file(mddev_t * mddev, void __user * arg)
        if (!buf)
                goto out;
-        ptr = file_path(mddev->bitmap->file, buf, sizeof(file->pathname));
+        ptr = d_path(&mddev->bitmap->file->f_path, buf, sizeof(file->pathname));
-        if (!ptr)
+        if (IS_ERR(ptr))
                goto out;
        strcpy(file->pathname, ptr);
@@ -5399,7 +5435,7 @@ void md_done_sync(mddev_t *mddev, int blocks, int ok)
        atomic_sub(blocks, &mddev->recovery_active);
        wake_up(&mddev->recovery_wait);
        if (!ok) {
-                set_bit(MD_RECOVERY_ERR, &mddev->recovery);
+                set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                md_wakeup_thread(mddev->thread);
                // stop recovery, signal do_sync ....
        }
@@ -5435,8 +5471,11 @@ void md_write_start(mddev_t *mddev, struct bio *bi)
                        md_wakeup_thread(mddev->thread);
                }
                spin_unlock_irq(&mddev->write_lock);
+                sysfs_notify(&mddev->kobj, NULL, "array_state");
        }
-        wait_event(mddev->sb_wait, mddev->flags==0);
+        wait_event(mddev->sb_wait,
+                   !test_bit(MD_CHANGE_CLEAN, &mddev->flags) &&
+                   !test_bit(MD_CHANGE_PENDING, &mddev->flags));
 }
 void md_write_end(mddev_t *mddev)
@@ -5471,13 +5510,17 @@ void md_allow_write(mddev_t *mddev)
                        mddev->safemode = 1;
                spin_unlock_irq(&mddev->write_lock);
                md_update_sb(mddev, 0);
+                sysfs_notify(&mddev->kobj, NULL, "array_state");
+                /* wait for the dirty state to be recorded in the metadata */
+                wait_event(mddev->sb_wait,
+                           !test_bit(MD_CHANGE_CLEAN, &mddev->flags) &&
+                           !test_bit(MD_CHANGE_PENDING, &mddev->flags));
        } else
                spin_unlock_irq(&mddev->write_lock);
 }
 EXPORT_SYMBOL_GPL(md_allow_write);
-static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
 #define SYNC_MARKS      10
 #define SYNC_MARK_STEP  (3*HZ)
 void md_do_sync(mddev_t *mddev)
@@ -5541,8 +5584,9 @@ void md_do_sync(mddev_t *mddev)
                for_each_mddev(mddev2, tmp) {
                        if (mddev2 == mddev)
                                continue;
-                        if (mddev2->curr_resync && 
+                        if (!mddev->parallel_resync
-                            match_mddev_units(mddev,mddev2)) {
+                        &&  mddev2->curr_resync
+                        &&  match_mddev_units(mddev, mddev2)) {
                                DEFINE_WAIT(wq);
                                if (mddev < mddev2 && mddev->curr_resync == 2) {
                                        /* arbitrarily yield */
@@ -5622,7 +5666,6 @@ void md_do_sync(mddev_t *mddev)
                window/2,(unsigned long long) max_sectors/2);
        atomic_set(&mddev->recovery_active, 0);
-        init_waitqueue_head(&mddev->recovery_wait);
        last_check = 0;
        if (j>2) {
@@ -5647,7 +5690,7 @@ void md_do_sync(mddev_t *mddev)
                sectors = mddev->pers->sync_request(mddev, j, &skipped,
                                                  currspeed < speed_min(mddev));
                if (sectors == 0) {
-                        set_bit(MD_RECOVERY_ERR, &mddev->recovery);
+                        set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                        goto out;
                }
@@ -5670,8 +5713,7 @@ void md_do_sync(mddev_t *mddev)
                last_check = io_sectors;
-                if (test_bit(MD_RECOVERY_INTR, &mddev->recovery) ||
+                if (test_bit(MD_RECOVERY_INTR, &mddev->recovery))
-                    test_bit(MD_RECOVERY_ERR, &mddev->recovery))
                        break;
        repeat:
@@ -5725,8 +5767,7 @@ void md_do_sync(mddev_t *mddev)
        /* tell personality that we are finished */
        mddev->pers->sync_request(mddev, max_sectors, &skipped, 1);
-        if (!test_bit(MD_RECOVERY_ERR, &mddev->recovery) &&
+        if (!test_bit(MD_RECOVERY_CHECK, &mddev->recovery) &&
-            !test_bit(MD_RECOVERY_CHECK, &mddev->recovery) &&
            mddev->curr_resync > 2) {
                if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
                        if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
@@ -5795,7 +5836,10 @@ static int remove_and_add_spares(mddev_t *mddev)
                }
        if (mddev->degraded) {
-                rdev_for_each(rdev, rtmp, mddev)
+                rdev_for_each(rdev, rtmp, mddev) {
+                        if (rdev->raid_disk >= 0 &&
+                            !test_bit(In_sync, &rdev->flags))
+                                spares++;
                        if (rdev->raid_disk < 0
                            && !test_bit(Faulty, &rdev->flags)) {
                                rdev->recovery_offset = 0;
@@ -5813,6 +5857,7 @@ static int remove_and_add_spares(mddev_t *mddev)
                                } else
                                        break;
                        }
+                }
        }
        return spares;
 }
@@ -5826,7 +5871,7 @@ static int remove_and_add_spares(mddev_t *mddev)
 * to do that as needed.
 * When it is determined that resync is needed, we set MD_RECOVERY_RUNNING in
 * "->recovery" and create a thread at ->sync_thread.
- * When the thread finishes it sets MD_RECOVERY_DONE (and might set MD_RECOVERY_ERR)
+ * When the thread finishes it sets MD_RECOVERY_DONE
 * and wakeups up this thread which will reap the thread and finish up.
 * This thread also removes any faulty devices (with nr_pending == 0).
 *
@@ -5901,8 +5946,7 @@ void md_check_recovery(mddev_t *mddev)
                        /* resync has finished, collect result */
                        md_unregister_thread(mddev->sync_thread);
                        mddev->sync_thread = NULL;
-                        if (!test_bit(MD_RECOVERY_ERR, &mddev->recovery) &&
+                        if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
-                            !test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
                                /* success...*/
                                /* activate any spares */
                                mddev->pers->spare_active(mddev);
@@ -5926,7 +5970,6 @@ void md_check_recovery(mddev_t *mddev)
                 * might be left set
                 */
                clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
-                clear_bit(MD_RECOVERY_ERR, &mddev->recovery);
                clear_bit(MD_RECOVERY_INTR, &mddev->recovery);
                clear_bit(MD_RECOVERY_DONE, &mddev->recovery);
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 4f4d1f383842..e968116e0de9 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -327,7 +327,8 @@ static int multipath_remove_disk(mddev_t *mddev, int number)
        if (rdev) {
                if (test_bit(In_sync, &rdev->flags) ||
                    atomic_read(&rdev->nr_pending)) {
-                        printk(KERN_ERR "hot-remove-disk, slot %d is identified"                                " but is still operational!\n", number);
+                        printk(KERN_ERR "hot-remove-disk, slot %d is identified"
+                               " but is still operational!\n", number);
                        err = -EBUSY;
                        goto abort;
                }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index ac409b7d83f5..c610b947218a 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -773,7 +773,7 @@ static int make_request(struct request_queue *q, struct bio * bio)
        r1bio_t *r1_bio;
        struct bio *read_bio;
        int i, targets = 0, disks;
-        struct bitmap *bitmap = mddev->bitmap;
+        struct bitmap *bitmap;
        unsigned long flags;
        struct bio_list bl;
        struct page **behind_pages = NULL;
@@ -802,6 +802,8 @@ static int make_request(struct request_queue *q, struct bio * bio)
        wait_barrier(conf);
+        bitmap = mddev->bitmap;
        disk_stat_inc(mddev->gendisk, ios[rw]);
        disk_stat_add(mddev->gendisk, sectors[rw], bio_sectors(bio));
@@ -1025,7 +1027,7 @@ static void error(mddev_t *mddev, mdk_rdev_t *rdev)
                /*
                 * if recovery is running, make sure it aborts.
                 */
-                set_bit(MD_RECOVERY_ERR, &mddev->recovery);
+                set_bit(MD_RECOVERY_INTR, &mddev->recovery);
        } else
                set_bit(Faulty, &rdev->flags);
        set_bit(MD_CHANGE_DEVS, &mddev->flags);
@@ -1146,6 +1148,14 @@ static int raid1_remove_disk(mddev_t *mddev, int number)
                        err = -EBUSY;
                        goto abort;
                }
+                /* Only remove non-faulty devices is recovery
+                 * is not possible.
+                 */
+                if (!test_bit(Faulty, &rdev->flags) &&
+                    mddev->degraded < conf->raid_disks) {
+                        err = -EBUSY;
+                        goto abort;
+                }
                p->rdev = NULL;
                synchronize_rcu();
                if (atomic_read(&rdev->nr_pending)) {
@@ -1282,6 +1292,7 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
                                        rdev_dec_pending(conf->mirrors[i].rdev, mddev);
                                } else {
                                        /* fixup the bio for reuse */
+                                        int size;
                                        sbio->bi_vcnt = vcnt;
                                        sbio->bi_size = r1_bio->sectors << 9;
                                        sbio->bi_idx = 0;
@@ -1295,10 +1306,20 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
                                        sbio->bi_sector = r1_bio->sector +
                                                conf->mirrors[i].rdev->data_offset;
                                        sbio->bi_bdev = conf->mirrors[i].rdev->bdev;
-                                        for (j = 0; j < vcnt ; j++)
+                                        size = sbio->bi_size;
-                                                memcpy(page_address(sbio->bi_io_vec[j].bv_page),
+                                        for (j = 0; j < vcnt ; j++) {
+                                                struct bio_vec *bi;
+                                                bi = &sbio->bi_io_vec[j];
+                                                bi->bv_offset = 0;
+                                                if (size > PAGE_SIZE)
+                                                        bi->bv_len = PAGE_SIZE;
+                                                else
+                                                        bi->bv_len = size;
+                                                size -= PAGE_SIZE;
+                                                memcpy(page_address(bi->bv_page),
                                                       page_address(pbio->bi_io_vec[j].bv_page),
                                                       PAGE_SIZE);
+                                        }
                                }
                        }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 8536ede1e712..1de17da34a95 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1020,7 +1020,7 @@ static void error(mddev_t *mddev, mdk_rdev_t *rdev)
                /*
                 * if recovery is running, make sure it aborts.
                 */
-                set_bit(MD_RECOVERY_ERR, &mddev->recovery);
+                set_bit(MD_RECOVERY_INTR, &mddev->recovery);
        }
        set_bit(Faulty, &rdev->flags);
        set_bit(MD_CHANGE_DEVS, &mddev->flags);
@@ -1171,6 +1171,14 @@ static int raid10_remove_disk(mddev_t *mddev, int number)
                        err = -EBUSY;
                        goto abort;
                }
+                /* Only remove faulty devices in recovery
+                 * is not possible.
+                 */
+                if (!test_bit(Faulty, &rdev->flags) &&
+                    enough(conf)) {
+                        err = -EBUSY;
+                        goto abort;
+                }
                p->rdev = NULL;
                synchronize_rcu();
                if (atomic_read(&rdev->nr_pending)) {
@@ -1237,6 +1245,7 @@ static void end_sync_write(struct bio *bio, int error)
        if (!uptodate)
                md_error(mddev, conf->mirrors[d].rdev);
        update_head_pos(i, r10_bio);
        while (atomic_dec_and_test(&r10_bio->remaining)) {
@@ -1844,7 +1853,8 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                                        if (rb2)
                                                atomic_dec(&rb2->remaining);
                                        r10_bio = rb2;
-                                        if (!test_and_set_bit(MD_RECOVERY_ERR, &mddev->recovery))
+                                        if (!test_and_set_bit(MD_RECOVERY_INTR,
+                                                              &mddev->recovery))
                                                printk(KERN_INFO "raid10: %s: insufficient working devices for recovery.\n",
                                                       mdname(mddev));
                                        break;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 93fde48c0f42..c37e256b1176 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -94,6 +94,8 @@
 #define __inline__
 #endif
+#define printk_rl(args...) ((void) (printk_ratelimit() && printk(args)))
 #if !RAID6_USE_EMPTY_ZERO_PAGE
 /* In .bss so it's zeroed */
 const char raid6_empty_zero_page[PAGE_SIZE] __attribute__((aligned(256)));
@@ -1143,10 +1145,12 @@ static void raid5_end_read_request(struct bio * bi, int error)
                set_bit(R5_UPTODATE, &sh->dev[i].flags);
                if (test_bit(R5_ReadError, &sh->dev[i].flags)) {
                        rdev = conf->disks[i].rdev;
-                        printk(KERN_INFO "raid5:%s: read error corrected (%lu sectors at %llu on %s)\n",
+                        printk_rl(KERN_INFO "raid5:%s: read error corrected"
-                               mdname(conf->mddev), STRIPE_SECTORS,
+                                  " (%lu sectors at %llu on %s)\n",
-                               (unsigned long long)(sh->sector + rdev->data_offset),
+                                  mdname(conf->mddev), STRIPE_SECTORS,
-                               bdevname(rdev->bdev, b));
+                                  (unsigned long long)(sh->sector
+                                                       + rdev->data_offset),
+                                  bdevname(rdev->bdev, b));
                        clear_bit(R5_ReadError, &sh->dev[i].flags);
                        clear_bit(R5_ReWrite, &sh->dev[i].flags);
                }
@@ -1160,16 +1164,22 @@ static void raid5_end_read_request(struct bio * bi, int error)
                clear_bit(R5_UPTODATE, &sh->dev[i].flags);
                atomic_inc(&rdev->read_errors);
                if (conf->mddev->degraded)
-                        printk(KERN_WARNING "raid5:%s: read error not correctable (sector %llu on %s).\n",
+                        printk_rl(KERN_WARNING
-                               mdname(conf->mddev),
+                                  "raid5:%s: read error not correctable "
-                               (unsigned long long)(sh->sector + rdev->data_offset),
+                                  "(sector %llu on %s).\n",
-                               bdn);
+                                  mdname(conf->mddev),
+                                  (unsigned long long)(sh->sector
+                                                       + rdev->data_offset),
+                                  bdn);
                else if (test_bit(R5_ReWrite, &sh->dev[i].flags))
                        /* Oh, no!!! */
-                        printk(KERN_WARNING "raid5:%s: read error NOT corrected!! (sector %llu on %s).\n",
+                        printk_rl(KERN_WARNING
-                               mdname(conf->mddev),
+                                  "raid5:%s: read error NOT corrected!! "
-                               (unsigned long long)(sh->sector + rdev->data_offset),
+                                  "(sector %llu on %s).\n",
-                               bdn);
+                                  mdname(conf->mddev),
+                                  (unsigned long long)(sh->sector
+                                                       + rdev->data_offset),
+                                  bdn);
                else if (atomic_read(&rdev->read_errors)
                         > conf->max_nr_stripes)
                        printk(KERN_WARNING
@@ -1258,7 +1268,7 @@ static void error(mddev_t *mddev, mdk_rdev_t *rdev)
                        /*
                         * if recovery was running, make sure it aborts.
                         */
-                        set_bit(MD_RECOVERY_ERR, &mddev->recovery);
+                        set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                }
                set_bit(Faulty, &rdev->flags);
                printk (KERN_ALERT
@@ -1992,6 +2002,7 @@ static int __handle_issuing_new_read_requests5(struct stripe_head *sh,
                 * have quiesced.
                 */
                if ((s->uptodate == disks - 1) &&
+                    (s->failed && disk_idx == s->failed_num) &&
                    !test_bit(STRIPE_OP_CHECK, &sh->ops.pending)) {
                        set_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
                        set_bit(R5_Wantcompute, &dev->flags);
@@ -2077,7 +2088,9 @@ static void handle_issuing_new_read_requests6(struct stripe_head *sh,
                        /* we would like to get this block, possibly
                         * by computing it, but we might not be able to
                         */
-                        if (s->uptodate == disks-1) {
+                        if ((s->uptodate == disks - 1) &&
+                            (s->failed && (i == r6s->failed_num[0] ||
+                                           i == r6s->failed_num[1]))) {
                                pr_debug("Computing stripe %llu block %d\n",
                                       (unsigned long long)sh->sector, i);
                                compute_block_1(sh, i, 0);
@@ -2635,6 +2648,7 @@ static void handle_stripe5(struct stripe_head *sh)
        struct r5dev *dev;
        unsigned long pending = 0;
        mdk_rdev_t *blocked_rdev = NULL;
+        int prexor;
        memset(&s, 0, sizeof(s));
        pr_debug("handling stripe %llu, state=%#lx cnt=%d, pd_idx=%d "
@@ -2764,9 +2778,11 @@ static void handle_stripe5(struct stripe_head *sh)
        /* leave prexor set until postxor is done, allows us to distinguish
         * a rmw from a rcw during biodrain
         */
+        prexor = 0;
        if (test_bit(STRIPE_OP_PREXOR, &sh->ops.complete) &&
                test_bit(STRIPE_OP_POSTXOR, &sh->ops.complete)) {
+                prexor = 1;
                clear_bit(STRIPE_OP_PREXOR, &sh->ops.complete);
                clear_bit(STRIPE_OP_PREXOR, &sh->ops.ack);
                clear_bit(STRIPE_OP_PREXOR, &sh->ops.pending);
@@ -2800,6 +2816,8 @@ static void handle_stripe5(struct stripe_head *sh)
                                if (!test_and_set_bit(
                                    STRIPE_OP_IO, &sh->ops.pending))
                                        sh->ops.count++;
+                                if (prexor)
+                                        continue;
                                if (!test_bit(R5_Insync, &dev->flags) ||
                                    (i == sh->pd_idx && s.failed == 0))
                                        set_bit(STRIPE_INSYNC, &sh->state);
@@ -4564,6 +4582,14 @@ static int raid5_remove_disk(mddev_t *mddev, int number)
                        err = -EBUSY;
                        goto abort;
                }
+                /* Only remove non-faulty devices if recovery
+                 * isn't possible.
+                 */
+                if (!test_bit(Faulty, &rdev->flags) &&
+                    mddev->degraded <= conf->max_degraded) {
+                        err = -EBUSY;
+                        goto abort;
+                }
                p->rdev = NULL;
                synchronize_rcu();
                if (atomic_read(&rdev->nr_pending)) {
diff --git a/drivers/media/Makefile b/drivers/media/Makefile
index cc11c4c0e7e7..09a829d8a7e7 100644
--- a/drivers/media/Makefile
+++ b/drivers/media/Makefile
@@ -2,12 +2,7 @@
 # Makefile for the kernel multimedia device drivers.
 #
-obj-y := common/
+obj-y += common/ video/
-obj-$(CONFIG_VIDEO_MEDIA) += common/
-# Since hybrid devices are here, should be compiled if DVB and/or V4L
-obj-$(CONFIG_VIDEO_MEDIA) += video/
 obj-$(CONFIG_VIDEO_DEV) += radio/
 obj-$(CONFIG_DVB_CORE)  += dvb/
diff --git a/drivers/media/common/tuners/Kconfig b/drivers/media/common/tuners/Kconfig
index d6206540476b..85482960d012 100644
--- a/drivers/media/common/tuners/Kconfig
+++ b/drivers/media/common/tuners/Kconfig
@@ -21,6 +21,7 @@ config MEDIA_TUNER
        tristate
        default VIDEO_MEDIA && I2C
        depends on VIDEO_MEDIA && I2C
+        select FW_LOADER if !MEDIA_TUNER_CUSTOMIZE && HOTPLUG
        select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMIZE && HOTPLUG
        select MEDIA_TUNER_XC5000 if !MEDIA_TUNER_CUSTOMIZE && HOTPLUG
        select MEDIA_TUNER_MT20XX if !MEDIA_TUNER_CUSTOMIZE
diff --git a/drivers/media/common/tuners/mxl5005s.c b/drivers/media/common/tuners/mxl5005s.c
index 5d05b5390f66..0dc2bef9f6a3 100644
--- a/drivers/media/common/tuners/mxl5005s.c
+++ b/drivers/media/common/tuners/mxl5005s.c
@@ -101,7 +101,7 @@ enum {
        MXL_QAM,
        MXL_ANALOG_CABLE,
        MXL_ANALOG_OTA
-} tuner_modu_type;
+};
 /* MXL5005 Tuner Register Struct */
 struct TunerReg {
@@ -194,7 +194,7 @@ enum {
        RFSYN_DIVM,                /* 88 */
        DN_BYPASS_AGC_I2C          /* 89 */
 #endif
-} MXL5005_ControlName;
+};
 /*
 * The following context is source code provided by MaxLinear.
diff --git a/drivers/media/common/tuners/tda18271-common.c b/drivers/media/common/tuners/tda18271-common.c
index 42b5f5d4bfe6..f1894fec32b9 100644
--- a/drivers/media/common/tuners/tda18271-common.c
+++ b/drivers/media/common/tuners/tda18271-common.c
@@ -648,11 +648,11 @@ int tda18271_calc_rf_cal(struct dvb_frontend *fe, u32 *freq)
        unsigned char *regs = priv->tda18271_regs;
        u8 val;
-        tda18271_lookup_map(fe, RF_CAL, freq, &val);
+        int ret = tda18271_lookup_map(fe, RF_CAL, freq, &val);
        regs[R_EB14] = val;
-        return 0;
+        return ret;
 }
 /*
diff --git a/drivers/media/common/tuners/tda827x.c b/drivers/media/common/tuners/tda827x.c
index d30d2c9094d9..8555d9cf9051 100644
--- a/drivers/media/common/tuners/tda827x.c
+++ b/drivers/media/common/tuners/tda827x.c
@@ -418,13 +418,13 @@ static void tda827xa_lna_gain(struct dvb_frontend *fe, int high,
        unsigned char buf[] = {0x22, 0x01};
        int arg;
        int gp_func;
-        struct i2c_msg msg = { .addr = priv->cfg->switch_addr, .flags = 0,
+        struct i2c_msg msg = { .flags = 0, .buf = buf, .len = sizeof(buf) };
-                               .buf = buf, .len = sizeof(buf) };
        if (NULL == priv->cfg) {
                dprintk("tda827x_config not defined, cannot set LNA gain!\n");
                return;
        }
+        msg.addr = priv->cfg->switch_addr;
        if (priv->cfg->config) {
                if (high)
                        dprintk("setting LNA to high gain\n");
diff --git a/drivers/media/common/tuners/tea5761.c b/drivers/media/common/tuners/tea5761.c
index b93cdef9ac73..b23dadeecd05 100644
--- a/drivers/media/common/tuners/tea5761.c
+++ b/drivers/media/common/tuners/tea5761.c
@@ -295,7 +295,7 @@ struct dvb_frontend *tea5761_attach(struct dvb_frontend *fe,
 {
        struct tea5761_priv *priv = NULL;
-        if (tea5761_autodetection(i2c_adap, i2c_addr) == EINVAL)
+        if (tea5761_autodetection(i2c_adap, i2c_addr) != 0)
                return NULL;
        priv = kzalloc(sizeof(struct tea5761_priv), GFP_KERNEL);
diff --git a/drivers/media/common/tuners/tuner-i2c.h b/drivers/media/common/tuners/tuner-i2c.h
index 3ad6c8e0b04c..cb1c7141f0c6 100644
--- a/drivers/media/common/tuners/tuner-i2c.h
+++ b/drivers/media/common/tuners/tuner-i2c.h
@@ -170,4 +170,12 @@ __fail:									\
        __ret;                                                          \
 })
+#define hybrid_tuner_report_instance_count(state)                       \
+({                                                                      \
+        int __ret = 0;                                                  \
+        if (state)                                                      \
+                __ret = state->i2c_props.count;                         \
+        __ret;                                                          \
+})
 #endif /* __TUNER_I2C_H__ */
diff --git a/drivers/media/common/tuners/tuner-simple.c b/drivers/media/common/tuners/tuner-simple.c
index be8d903171b7..266c255cf0d8 100644
--- a/drivers/media/common/tuners/tuner-simple.c
+++ b/drivers/media/common/tuners/tuner-simple.c
@@ -1018,8 +1018,10 @@ struct dvb_frontend *simple_tuner_attach(struct dvb_frontend *fe,
                        fe->ops.i2c_gate_ctrl(fe, 1);
                if (1 != i2c_transfer(i2c_adap, &msg, 1))
-                        tuner_warn("unable to probe %s, proceeding anyway.",
+                        printk(KERN_WARNING "tuner-simple %d-%04x: "
-                                   tuners[type].name);
+                               "unable to probe %s, proceeding anyway.",
+                               i2c_adapter_id(i2c_adap), i2c_addr,
+                               tuners[type].name);
                if (fe->ops.i2c_gate_ctrl)
                        fe->ops.i2c_gate_ctrl(fe, 0);
diff --git a/drivers/media/common/tuners/tuner-xc2028.c b/drivers/media/common/tuners/tuner-xc2028.c
index 9e9003cffc7f..0cbde17bfbb7 100644
--- a/drivers/media/common/tuners/tuner-xc2028.c
+++ b/drivers/media/common/tuners/tuner-xc2028.c
@@ -46,7 +46,7 @@ module_param_string(firmware_name, firmware_name, sizeof(firmware_name), 0);
 MODULE_PARM_DESC(firmware_name, "Firmware file name. Allows overriding the "
                                "default firmware name\n");
-static LIST_HEAD(xc2028_list);
+static LIST_HEAD(hybrid_tuner_instance_list);
 static DEFINE_MUTEX(xc2028_list_mutex);
 /* struct for storing firmware table */
@@ -68,12 +68,11 @@ struct firmware_properties {
 };
 struct xc2028_data {
-        struct list_head        xc2028_list;
+        struct list_head        hybrid_tuner_instance_list;
        struct tuner_i2c_props  i2c_props;
        int                     (*tuner_callback) (void *dev,
                                                   int command, int arg);
        void                    *video_dev;
-        int                     count;
        __u32                   frequency;
        struct firmware_description *firm;
@@ -1072,20 +1071,19 @@ static int xc2028_dvb_release(struct dvb_frontend *fe)
        mutex_lock(&xc2028_list_mutex);
-        priv->count--;
+        /* only perform final cleanup if this is the last instance */
+        if (hybrid_tuner_report_instance_count(priv) == 1) {
-        if (!priv->count) {
-                list_del(&priv->xc2028_list);
                kfree(priv->ctrl.fname);
                free_firmware(priv);
-                kfree(priv);
-                fe->tuner_priv = NULL;
        }
+        if (priv)
+                hybrid_tuner_release_state(priv);
        mutex_unlock(&xc2028_list_mutex);
+        fe->tuner_priv = NULL;
        return 0;
 }
@@ -1150,7 +1148,7 @@ struct dvb_frontend *xc2028_attach(struct dvb_frontend *fe,
                                   struct xc2028_config *cfg)
 {
        struct xc2028_data *priv;
-        void               *video_dev;
+        int instance;
        if (debug)
                printk(KERN_DEBUG "xc2028: Xcv2028/3028 init called!\n");
@@ -1163,48 +1161,40 @@ struct dvb_frontend *xc2028_attach(struct dvb_frontend *fe,
                return NULL;
        }
-        video_dev = cfg->i2c_adap->algo_data;
-        if (debug)
-                printk(KERN_DEBUG "xc2028: video_dev =%p\n", video_dev);
        mutex_lock(&xc2028_list_mutex);
-        list_for_each_entry(priv, &xc2028_list, xc2028_list) {
+        instance = hybrid_tuner_request_state(struct xc2028_data, priv,
-                if (&priv->i2c_props.adap->dev == &cfg->i2c_adap->dev) {
+                                              hybrid_tuner_instance_list,
-                        video_dev = NULL;
+                                              cfg->i2c_adap, cfg->i2c_addr,
-                        if (debug)
+                                              "xc2028");
-                                printk(KERN_DEBUG "xc2028: reusing device\n");
+        switch (instance) {
+        case 0:
-                        break;
+                /* memory allocation failure */
-                }
+                goto fail;
-        }
+                break;
+        case 1:
-        if (video_dev) {
+                /* new tuner instance */
-                priv = kzalloc(sizeof(*priv), GFP_KERNEL);
-                if (priv == NULL) {
-                        mutex_unlock(&xc2028_list_mutex);
-                        return NULL;
-                }
-                priv->i2c_props.addr = cfg->i2c_addr;
-                priv->i2c_props.adap = cfg->i2c_adap;
-                priv->i2c_props.name = "xc2028";
-                priv->video_dev = video_dev;
                priv->tuner_callback = cfg->callback;
                priv->ctrl.max_len = 13;
                mutex_init(&priv->lock);
-                list_add_tail(&priv->xc2028_list, &xc2028_list);
+                /* analog side (tuner-core) uses i2c_adap->algo_data.
-        }
+                 * digital side is not guaranteed to have algo_data defined.
+                 *
-        fe->tuner_priv = priv;
+                 * digital side will always have fe->dvb defined.
-        priv->count++;
+                 * analog side (tuner-core) doesn't (yet) define fe->dvb.
+                 */
+                priv->video_dev = ((fe->dvb) && (fe->dvb->priv)) ?
+                                   fe->dvb->priv : cfg->i2c_adap->algo_data;
-        if (debug)
+                fe->tuner_priv = priv;
-                printk(KERN_DEBUG "xc2028: usage count is %i\n", priv->count);
+                break;
+        case 2:
+                /* existing tuner instance */
+                fe->tuner_priv = priv;
+                break;
+        }
        memcpy(&fe->ops.tuner_ops, &xc2028_dvb_tuner_ops,
               sizeof(xc2028_dvb_tuner_ops));
@@ -1217,6 +1207,11 @@ struct dvb_frontend *xc2028_attach(struct dvb_frontend *fe,
        mutex_unlock(&xc2028_list_mutex);
        return fe;
+fail:
+        mutex_unlock(&xc2028_list_mutex);
+        xc2028_dvb_release(fe);
+        return NULL;
 }
 EXPORT_SYMBOL(xc2028_attach);
diff --git a/drivers/media/dvb/b2c2/flexcop-usb.c b/drivers/media/dvb/b2c2/flexcop-usb.c
index 449fb5c3d0b1..ae0d76a5d51d 100644
--- a/drivers/media/dvb/b2c2/flexcop-usb.c
+++ b/drivers/media/dvb/b2c2/flexcop-usb.c
@@ -379,7 +379,7 @@ static void flexcop_usb_transfer_exit(struct flexcop_usb *fc_usb)
 static int flexcop_usb_transfer_init(struct flexcop_usb *fc_usb)
 {
-        u16 frame_size = fc_usb->uintf->cur_altsetting->endpoint[0].desc.wMaxPacketSize;
+        u16 frame_size = le16_to_cpu(fc_usb->uintf->cur_altsetting->endpoint[0].desc.wMaxPacketSize);
        int bufsize = B2C2_USB_NUM_ISO_URB * B2C2_USB_FRAMES_PER_ISO * frame_size,i,j,ret;
        int buffer_offset = 0;
diff --git a/drivers/media/dvb/cinergyT2/cinergyT2.c b/drivers/media/dvb/cinergyT2/cinergyT2.c
index f5010e8671b8..a824f3719f81 100644
--- a/drivers/media/dvb/cinergyT2/cinergyT2.c
+++ b/drivers/media/dvb/cinergyT2/cinergyT2.c
@@ -82,22 +82,22 @@ enum cinergyt2_ep1_cmd {
 struct dvbt_set_parameters_msg {
        uint8_t cmd;
-        uint32_t freq;
+        __le32 freq;
        uint8_t bandwidth;
-        uint16_t tps;
+        __le16 tps;
        uint8_t flags;
 } __attribute__((packed));
 struct dvbt_get_status_msg {
-        uint32_t freq;
+        __le32 freq;
        uint8_t bandwidth;
-        uint16_t tps;
+        __le16 tps;
        uint8_t flags;
-        uint16_t gain;
+        __le16 gain;
        uint8_t snr;
-        uint32_t viterbi_error_rate;
+        __le32 viterbi_error_rate;
-        uint32_t rs_error_rate;
+        __le32 rs_error_rate;
-        uint32_t uncorrected_block_count;
+        __le32 uncorrected_block_count;
        uint8_t lock_bits;
        uint8_t prev_lock_bits;
 } __attribute__((packed));
@@ -136,6 +136,7 @@ struct cinergyt2 {
        wait_queue_head_t poll_wq;
        int pending_fe_events;
        int disconnect_pending;
+        unsigned int uncorrected_block_count;
        atomic_t inuse;
        void *streambuf;
@@ -147,7 +148,7 @@ struct cinergyt2 {
        char phys[64];
        struct delayed_work rc_query_work;
        int rc_input_event;
-        u32 rc_last_code;
+        __le32 rc_last_code;
        unsigned long last_event_jiffies;
 #endif
 };
@@ -160,7 +161,7 @@ enum {
 struct cinergyt2_rc_event {
        char type;
-        uint32_t value;
+        __le32 value;
 } __attribute__((packed));
 static const uint32_t rc_keys[] = {
@@ -619,8 +620,11 @@ static int cinergyt2_ioctl (struct inode *inode, struct file *file,
        {
                uint32_t unc_count;
-                unc_count = stat->uncorrected_block_count;
+                if (mutex_lock_interruptible(&cinergyt2->sem))
-                stat->uncorrected_block_count = 0;
+                        return -ERESTARTSYS;
+                unc_count = cinergyt2->uncorrected_block_count;
+                cinergyt2->uncorrected_block_count = 0;
+                mutex_unlock(&cinergyt2->sem);
                /* UNC are already converted to host byte order... */
                return put_user(unc_count,(__u32 __user *) arg);
@@ -769,7 +773,7 @@ static void cinergyt2_query_rc (struct work_struct *work)
                                input_sync(cinergyt2->rc_input_dev);
                                cinergyt2->rc_input_event = KEY_MAX;
                        }
-                        cinergyt2->rc_last_code = ~0;
+                        cinergyt2->rc_last_code = cpu_to_le32(~0);
                }
                goto out;
        }
@@ -780,7 +784,7 @@ static void cinergyt2_query_rc (struct work_struct *work)
                        n, le32_to_cpu(rc_events[n].value), rc_events[n].type);
                if (rc_events[n].type == CINERGYT2_RC_EVENT_TYPE_NEC &&
-                    rc_events[n].value == ~0) {
+                    rc_events[n].value == cpu_to_le32(~0)) {
                        /* keyrepeat bit -> just repeat last rc_input_event */
                } else {
                        cinergyt2->rc_input_event = KEY_MAX;
@@ -795,7 +799,7 @@ static void cinergyt2_query_rc (struct work_struct *work)
                if (cinergyt2->rc_input_event != KEY_MAX) {
                        if (rc_events[n].value == cinergyt2->rc_last_code &&
-                            cinergyt2->rc_last_code != ~0) {
+                            cinergyt2->rc_last_code != cpu_to_le32(~0)) {
                                /* emit a key-up so the double event is recognized */
                                dprintk(1, "rc_input_event=%d UP\n", cinergyt2->rc_input_event);
                                input_report_key(cinergyt2->rc_input_dev,
@@ -829,7 +833,7 @@ static int cinergyt2_register_rc(struct cinergyt2 *cinergyt2)
        usb_make_path(cinergyt2->udev, cinergyt2->phys, sizeof(cinergyt2->phys));
        strlcat(cinergyt2->phys, "/input0", sizeof(cinergyt2->phys));
        cinergyt2->rc_input_event = KEY_MAX;
-        cinergyt2->rc_last_code = ~0;
+        cinergyt2->rc_last_code = cpu_to_le32(~0);
        INIT_DELAYED_WORK(&cinergyt2->rc_query_work, cinergyt2_query_rc);
        input_dev->name = DRIVER_NAME " remote control";
@@ -840,8 +844,8 @@ static int cinergyt2_register_rc(struct cinergyt2 *cinergyt2)
        input_dev->keycodesize = 0;
        input_dev->keycodemax = 0;
        input_dev->id.bustype = BUS_USB;
-        input_dev->id.vendor = cinergyt2->udev->descriptor.idVendor;
+        input_dev->id.vendor = le16_to_cpu(cinergyt2->udev->descriptor.idVendor);
-        input_dev->id.product = cinergyt2->udev->descriptor.idProduct;
+        input_dev->id.product = le16_to_cpu(cinergyt2->udev->descriptor.idProduct);
        input_dev->id.version = 1;
        input_dev->dev.parent = &cinergyt2->udev->dev;
@@ -889,18 +893,16 @@ static void cinergyt2_query (struct work_struct *work)
        char cmd [] = { CINERGYT2_EP1_GET_TUNER_STATUS };
        struct dvbt_get_status_msg *s = &cinergyt2->status;
        uint8_t lock_bits;
-        uint32_t unc;
        if (cinergyt2->disconnect_pending || mutex_lock_interruptible(&cinergyt2->sem))
                return;
-        unc = s->uncorrected_block_count;
        lock_bits = s->lock_bits;
        cinergyt2_command(cinergyt2, cmd, sizeof(cmd), (char *) s, sizeof(*s));
-        unc += le32_to_cpu(s->uncorrected_block_count);
+        cinergyt2->uncorrected_block_count +=
-        s->uncorrected_block_count = unc;
+                le32_to_cpu(s->uncorrected_block_count);
        if (lock_bits != s->lock_bits) {
                wake_up_interruptible(&cinergyt2->poll_wq);
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
index 56d871cfd7fc..c2334aef4143 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -168,7 +168,7 @@ struct dvb_net_priv {
 *  stolen from eth.c out of the linux kernel, hacked for dvb-device
 *  by Michael Holzt <kju@debian.org>
 */
-static unsigned short dvb_net_eth_type_trans(struct sk_buff *skb,
+static __be16 dvb_net_eth_type_trans(struct sk_buff *skb,
                                      struct net_device *dev)
 {
        struct ethhdr *eth;
@@ -277,10 +277,10 @@ static int handle_one_ule_extension( struct dvb_net_priv *p )
                        if(ext_len >= 0) {
                                p->ule_next_hdr += ext_len;
                                if (!p->ule_bridged) {
-                                        p->ule_sndu_type = ntohs(*(unsigned short *)p->ule_next_hdr);
+                                        p->ule_sndu_type = ntohs(*(__be16 *)p->ule_next_hdr);
                                        p->ule_next_hdr += 2;
                                } else {
-                                        p->ule_sndu_type = ntohs(*(unsigned short *)(p->ule_next_hdr + ((p->ule_dbit ? 2 : 3) * ETH_ALEN)));
+                                        p->ule_sndu_type = ntohs(*(__be16 *)(p->ule_next_hdr + ((p->ule_dbit ? 2 : 3) * ETH_ALEN)));
                                        /* This assures the extension handling loop will terminate. */
                                }
                        }
@@ -294,7 +294,7 @@ static int handle_one_ule_extension( struct dvb_net_priv *p )
                if (ule_optional_ext_handlers[htype])
                        (void)ule_optional_ext_handlers[htype]( p );
                p->ule_next_hdr += ext_len;
-                p->ule_sndu_type = ntohs( *(unsigned short *)(p->ule_next_hdr-2) );
+                p->ule_sndu_type = ntohs( *(__be16 *)(p->ule_next_hdr-2) );
                /*
                 * note: the length of the next header type is included in the
                 * length of THIS optional extension header
@@ -594,8 +594,8 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
                /* Check for complete payload. */
                if (priv->ule_sndu_remain <= 0) {
                        /* Check CRC32, we've got it in our skb already. */
-                        unsigned short ulen = htons(priv->ule_sndu_len);
+                        __be16 ulen = htons(priv->ule_sndu_len);
-                        unsigned short utype = htons(priv->ule_sndu_type);
+                        __be16 utype = htons(priv->ule_sndu_type);
                        const u8 *tail;
                        struct kvec iov[3] = {
                                { &ulen, sizeof ulen },
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index cf4584e48b6d..f00a0eb40420 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -1,6 +1,6 @@
 config DVB_USB
        tristate "Support for various USB DVB devices"
-        depends on DVB_CORE && USB && I2C
+        depends on DVB_CORE && USB && I2C && INPUT
        depends on HOTPLUG      # due to FW_LOADER
        select FW_LOADER
        help
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 346223856f59..c4d40fe01d57 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -111,8 +111,8 @@ static int bristol_tuner_attach(struct dvb_usb_adapter *adap)
        struct i2c_adapter *tun_i2c = dib3000mc_get_tuner_i2c_master(adap->fe, 1);
        s8 a;
        int if1=1220;
-        if (adap->dev->udev->descriptor.idVendor  == USB_VID_HAUPPAUGE &&
+        if (adap->dev->udev->descriptor.idVendor  == cpu_to_le16(USB_VID_HAUPPAUGE) &&
-                adap->dev->udev->descriptor.idProduct == USB_PID_HAUPPAUGE_NOVA_T_500_2) {
+                adap->dev->udev->descriptor.idProduct == cpu_to_le16(USB_PID_HAUPPAUGE_NOVA_T_500_2)) {
                if (!eeprom_read(prim_i2c,0x59 + adap->id,&a)) if1=1220+a;
        }
        return dvb_attach(mt2060_attach,adap->fe, tun_i2c,&bristol_mt2060_config[adap->id],
@@ -402,8 +402,8 @@ static int stk7700ph_frontend_attach(struct dvb_usb_adapter *adap)
 {
        struct usb_device_descriptor *desc = &adap->dev->udev->descriptor;
-        if (desc->idVendor  == USB_VID_PINNACLE &&
+        if (desc->idVendor  == cpu_to_le16(USB_VID_PINNACLE) &&
-            desc->idProduct == USB_PID_PINNACLE_EXPRESSCARD_320CX)
+            desc->idProduct == cpu_to_le16(USB_PID_PINNACLE_EXPRESSCARD_320CX))
        dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
        else
        dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
@@ -845,8 +845,8 @@ static int stk7700p_tuner_attach(struct dvb_usb_adapter *adap)
        struct i2c_adapter *tun_i2c;
        s8 a;
        int if1=1220;
-        if (adap->dev->udev->descriptor.idVendor  == USB_VID_HAUPPAUGE &&
+        if (adap->dev->udev->descriptor.idVendor  == cpu_to_le16(USB_VID_HAUPPAUGE) &&
-                adap->dev->udev->descriptor.idProduct == USB_PID_HAUPPAUGE_NOVA_T_STICK) {
+                adap->dev->udev->descriptor.idProduct == cpu_to_le16(USB_PID_HAUPPAUGE_NOVA_T_STICK)) {
                if (!eeprom_read(prim_i2c,0x58,&a)) if1=1220+a;
        }
        if (st->is_dib7000pc)
@@ -990,11 +990,12 @@ static struct dib7000p_config dib7070p_dib7000p_config = {
 /* STK7070P */
 static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        if (adap->dev->udev->descriptor.idVendor  == USB_VID_PINNACLE &&
+        struct usb_device_descriptor *p = &adap->dev->udev->descriptor;
-        adap->dev->udev->descriptor.idProduct == USB_PID_PINNACLE_PCTV72E)
+        if (p->idVendor  == cpu_to_le16(USB_VID_PINNACLE) &&
-        dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
+            p->idProduct == cpu_to_le16(USB_PID_PINNACLE_PCTV72E))
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
        else
-        dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
        msleep(10);
        dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1);
        dib0700_set_gpio(adap->dev, GPIO4, GPIO_OUT, 1);
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c b/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c
index e1112e39fb63..733a7ff7b207 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c
@@ -127,7 +127,7 @@ int dvb_usb_get_hexline(const struct firmware *fw, struct hexline *hx,
        if ((*pos + hx->len + 4) >= fw->size)
                return -EINVAL;
-        hx->addr = le16_to_cpu( *((u16 *) &b[1]) );
+        hx->addr = b[1] | (b[2] << 8);
        hx->type = b[3];
        if (hx->type == 0x04) {
diff --git a/drivers/media/dvb/dvb-usb/gp8psk.c b/drivers/media/dvb/dvb-usb/gp8psk.c
index 9a942afaf0af..2653120673b7 100644
--- a/drivers/media/dvb/dvb-usb/gp8psk.c
+++ b/drivers/media/dvb/dvb-usb/gp8psk.c
@@ -146,24 +146,24 @@ static int gp8psk_power_ctrl(struct dvb_usb_device *d, int onoff)
                if (gp_product_id == USB_PID_GENPIX_8PSK_REV_1_WARM)
                        if (! (status & bm8pskFW_Loaded)) /* BCM4500 firmware loaded */
                                if(gp8psk_load_bcm4500fw(d))
-                                        return EINVAL;
+                                        return -EINVAL;
                if (! (status & bmIntersilOn)) /* LNB Power */
                        if (gp8psk_usb_in_op(d, START_INTERSIL, 1, 0,
                                        &buf, 1))
-                                return EINVAL;
+                                return -EINVAL;
                /* Set DVB mode to 1 */
                if (gp_product_id == USB_PID_GENPIX_8PSK_REV_1_WARM)
                        if (gp8psk_usb_out_op(d, SET_DVB_MODE, 1, 0, NULL, 0))
-                                return EINVAL;
+                                return -EINVAL;
                /* Abort possible TS (if previous tune crashed) */
                if (gp8psk_usb_out_op(d, ARM_TRANSFER, 0, 0, NULL, 0))
-                        return EINVAL;
+                        return -EINVAL;
        } else {
                /* Turn off LNB power */
                if (gp8psk_usb_in_op(d, START_INTERSIL, 0, 0, &buf, 1))
-                        return EINVAL;
+                        return -EINVAL;
                /* Turn off 8psk power */
                if (gp8psk_usb_in_op(d, BOOT_8PSK, 0, 0, &buf, 1))
                        return -EINVAL;
diff --git a/drivers/media/dvb/dvb-usb/m920x.c b/drivers/media/dvb/dvb-usb/m920x.c
index a12e6f784fda..54626a0dbf68 100644
--- a/drivers/media/dvb/dvb-usb/m920x.c
+++ b/drivers/media/dvb/dvb-usb/m920x.c
@@ -16,6 +16,7 @@
 #include "qt1010.h"
 #include "tda1004x.h"
 #include "tda827x.h"
+#include <asm/unaligned.h>
 /* debug */
 static int dvb_usb_m920x_debug;
@@ -347,13 +348,13 @@ static int m920x_firmware_download(struct usb_device *udev, const struct firmwar
        for (pass = 0; pass < 2; pass++) {
                for (i = 0; i + (sizeof(u16) * 3) < fw->size;) {
-                        value = le16_to_cpu(*(u16 *)(fw->data + i));
+                        value = get_unaligned_le16(fw->data + i);
                        i += sizeof(u16);
-                        index = le16_to_cpu(*(u16 *)(fw->data + i));
+                        index = get_unaligned_le16(fw->data + i);
                        i += sizeof(u16);
-                        size = le16_to_cpu(*(u16 *)(fw->data + i));
+                        size = get_unaligned_le16(fw->data + i);
                        i += sizeof(u16);
                        if (pass == 1) {
diff --git a/drivers/media/dvb/frontends/dib0070.h b/drivers/media/dvb/frontends/dib0070.h
index 786e37d33889..3eedfdf505bc 100644
--- a/drivers/media/dvb/frontends/dib0070.h
+++ b/drivers/media/dvb/frontends/dib0070.h
@@ -37,7 +37,20 @@ struct dib0070_config {
        u8 flip_chip;
 };
-extern struct dvb_frontend * dib0070_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct dib0070_config *cfg);
+#if defined(CONFIG_DVB_TUNER_DIB0070) || (defined(CONFIG_DVB_TUNER_DIB0070_MODULE) && defined(MODULE))
+extern struct dvb_frontend *dib0070_attach(struct dvb_frontend *fe,
+                                           struct i2c_adapter *i2c,
+                                           struct dib0070_config *cfg);
+#else
+static inline struct dvb_frontend *dib0070_attach(struct dvb_frontend *fe,
+                                                  struct i2c_adapter *i2c,
+                                                  struct dib0070_config *cfg)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+        return NULL;
+}
+#endif
 extern void dib0070_ctrl_agc_filter(struct dvb_frontend *, uint8_t open);
 extern u16 dib0070_wbd_offset(struct dvb_frontend *);
diff --git a/drivers/media/dvb/frontends/dib7000p.h b/drivers/media/dvb/frontends/dib7000p.h
index 081bd81f3da2..07c4d12ed5b7 100644
--- a/drivers/media/dvb/frontends/dib7000p.h
+++ b/drivers/media/dvb/frontends/dib7000p.h
@@ -37,7 +37,20 @@ struct dib7000p_config {
 #define DEFAULT_DIB7000P_I2C_ADDRESS 18
-extern struct dvb_frontend * dib7000p_attach(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib7000p_config *cfg);
+#if defined(CONFIG_DVB_DIB7000P) || (defined(CONFIG_DVB_DIB7000P_MODULE) && defined(MODULE))
+extern struct dvb_frontend *dib7000p_attach(struct i2c_adapter *i2c_adap,
+                                            u8 i2c_addr,
+                                            struct dib7000p_config *cfg);
+#else
+static inline struct dvb_frontend *dib7000p_attach(struct i2c_adapter *i2c_adap,
+                                                   u8 i2c_addr,
+                                                   struct dib7000p_config *cfg)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+        return NULL;
+}
+#endif
 extern int dib7000p_i2c_enumeration(struct i2c_adapter *i2c, int no_of_demods, u8 default_addr, struct dib7000p_config cfg[]);
 extern struct i2c_adapter * dib7000p_get_i2c_master(struct dvb_frontend *, enum dibx000_i2c_interface, int);
diff --git a/drivers/media/dvb/frontends/or51132.c b/drivers/media/dvb/frontends/or51132.c
index c7b5785f81f2..5ed32544de39 100644
--- a/drivers/media/dvb/frontends/or51132.c
+++ b/drivers/media/dvb/frontends/or51132.c
@@ -126,7 +126,7 @@ static int or51132_readreg(struct or51132_state *state, u8 reg)
                       reg, err);
                return -EREMOTEIO;
        }
-        return le16_to_cpup((u16*)buf);
+        return buf[0] | (buf[1] << 8);
 }
 static int or51132_load_firmware (struct dvb_frontend* fe, const struct firmware *fw)
@@ -140,9 +140,9 @@ static int or51132_load_firmware (struct dvb_frontend* fe, const struct firmware
        dprintk("Firmware is %Zd bytes\n",fw->size);
        /* Get size of firmware A and B */
-        firmwareAsize = le32_to_cpu(*((u32*)fw->data));
+        firmwareAsize = le32_to_cpu(*((__le32*)fw->data));
        dprintk("FirmwareA is %i bytes\n",firmwareAsize);
-        firmwareBsize = le32_to_cpu(*((u32*)(fw->data+4)));
+        firmwareBsize = le32_to_cpu(*((__le32*)(fw->data+4)));
        dprintk("FirmwareB is %i bytes\n",firmwareBsize);
        /* Upload firmware */
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 747e7f1a6267..f05d43d8b5cf 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -51,6 +51,7 @@
 #include <linux/crc32.h>
 #include <linux/i2c.h>
 #include <linux/kthread.h>
+#include <asm/unaligned.h>
 #include <asm/system.h>
@@ -1461,9 +1462,9 @@ static int check_firmware(struct av7110* av7110)
        ptr += 4;
        /* check dpram file */
-        crc = ntohl(*(u32*) ptr);
+        crc = get_unaligned_be32(ptr);
        ptr += 4;
-        len = ntohl(*(u32*) ptr);
+        len = get_unaligned_be32(ptr);
        ptr += 4;
        if (len >= 512) {
                printk("dvb-ttpci: dpram file is way too big.\n");
@@ -1478,9 +1479,9 @@ static int check_firmware(struct av7110* av7110)
        ptr += len;
        /* check root file */
-        crc = ntohl(*(u32*) ptr);
+        crc = get_unaligned_be32(ptr);
        ptr += 4;
-        len = ntohl(*(u32*) ptr);
+        len = get_unaligned_be32(ptr);
        ptr += 4;
        if (len <= 200000 || len >= 300000 ||
diff --git a/drivers/media/dvb/ttpci/av7110_av.c b/drivers/media/dvb/ttpci/av7110_av.c
index 3e6b650fbb81..ec55a968f204 100644
--- a/drivers/media/dvb/ttpci/av7110_av.c
+++ b/drivers/media/dvb/ttpci/av7110_av.c
@@ -965,8 +965,9 @@ static u8 iframe_header[] = { 0x00, 0x00, 0x01, 0xe0, 0x00, 0x00, 0x80, 0x00, 0x
 static int play_iframe(struct av7110 *av7110, char __user *buf, unsigned int len, int nonblock)
 {
-        int i, n;
+        unsigned i, n;
        int progressive = 0;
+        int match = 0;
        dprintk(2, "av7110:%p, \n", av7110);
@@ -975,12 +976,31 @@ static int play_iframe(struct av7110 *av7110, char __user *buf, unsigned int len
                        return -EBUSY;
        }
-        for (i = 0; i < len - 5; i++) {
+        /* search in buf for instances of 00 00 01 b5 1? */
-                /* get progressive flag from picture extension */
+        for (i = 0; i < len; i++) {
-                if (buf[i] == 0x00 && buf[i+1] == 0x00 &&
+                unsigned char c;
-                    buf[i+2] == 0x01 && (unsigned char)buf[i+3] == 0xb5 &&
+                if (get_user(c, buf + i))
-                    (buf[i+4] & 0xf0) == 0x10)
+                        return -EFAULT;
-                        progressive = buf[i+5] & 0x08;
+                if (match == 5) {
+                        progressive = c & 0x08;
+                        match = 0;
+                }
+                if (c == 0x00) {
+                        match = (match == 1 || match == 2) ? 2 : 1;
+                        continue;
+                }
+                switch (match++) {
+                case 2: if (c == 0x01)
+                                continue;
+                        break;
+                case 3: if (c == 0xb5)
+                                continue;
+                        break;
+                case 4: if ((c & 0xf0) == 0x10)
+                                continue;
+                        break;
+                }
+                match = 0;
        }
        /* setting n always > 1, fixes problems when playing stillframes
diff --git a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
index 732ce4de512e..5d2d81ab2371 100644
--- a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
+++ b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
@@ -552,7 +552,7 @@ static void ttusb_process_muxpack(struct ttusb *ttusb, const u8 * muxpack,
        u16 csum = 0, cc;
        int i;
        for (i = 0; i < len; i += 2)
-                csum ^= le16_to_cpup((u16 *) (muxpack + i));
+                csum ^= le16_to_cpup((__le16 *) (muxpack + i));
        if (csum) {
                printk("%s: muxpack with incorrect checksum, ignoring\n",
                       __func__);
diff --git a/drivers/media/dvb/ttusb-dec/Kconfig b/drivers/media/dvb/ttusb-dec/Kconfig
index 0712899e39a4..a23cc0aa17d3 100644
--- a/drivers/media/dvb/ttusb-dec/Kconfig
+++ b/drivers/media/dvb/ttusb-dec/Kconfig
@@ -1,6 +1,6 @@
 config DVB_TTUSB_DEC
        tristate "Technotrend/Hauppauge USB DEC devices"
-        depends on DVB_CORE && USB
+        depends on DVB_CORE && USB && INPUT
        depends on HOTPLUG      # due to FW_LOADER
        select FW_LOADER
        select CRC32
diff --git a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
index 42eee04daa5d..fefdc05e84ac 100644
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
@@ -343,7 +343,7 @@ static int ttusb_dec_get_stb_state (struct ttusb_dec *dec, unsigned int *mode,
        u8 c[COMMAND_PACKET_SIZE];
        int c_length;
        int result;
-        unsigned int tmp;
+        __be32 tmp;
        dprintk("%s\n", __func__);
@@ -398,9 +398,9 @@ static void ttusb_dec_set_pids(struct ttusb_dec *dec)
                   0x00, 0x00, 0xff, 0xff,
                   0xff, 0xff, 0xff, 0xff };
-        u16 pcr = htons(dec->pid[DMX_PES_PCR]);
+        __be16 pcr = htons(dec->pid[DMX_PES_PCR]);
-        u16 audio = htons(dec->pid[DMX_PES_AUDIO]);
+        __be16 audio = htons(dec->pid[DMX_PES_AUDIO]);
-        u16 video = htons(dec->pid[DMX_PES_VIDEO]);
+        __be16 video = htons(dec->pid[DMX_PES_VIDEO]);
        dprintk("%s\n", __func__);
@@ -435,7 +435,7 @@ static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length)
        case 0x01: {            /* VideoStream */
                int prebytes = pva[5] & 0x03;
                int postbytes = (pva[5] & 0x0c) >> 2;
-                u16 v_pes_payload_length;
+                __be16 v_pes_payload_length;
                if (output_pva) {
                        dec->video_filter->feed->cb.ts(pva, length, NULL, 0,
@@ -1006,7 +1006,7 @@ static int ttusb_dec_start_sec_feed(struct dvb_demux_feed *dvbdmxfeed)
                    0x00, 0x00, 0x00, 0x00,
                    0x00, 0x00, 0x00, 0x00,
                    0x00 };
-        u16 pid;
+        __be16 pid;
        u8 c[COMMAND_PACKET_SIZE];
        int c_length;
        int result;
@@ -1278,9 +1278,10 @@ static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
        u8 *firmware = NULL;
        size_t firmware_size = 0;
        u16 firmware_csum = 0;
-        u16 firmware_csum_ns;
+        __be16 firmware_csum_ns;
-        u32 firmware_size_nl;
+        __be32 firmware_size_nl;
-        u32 crc32_csum, crc32_check, tmp;
+        u32 crc32_csum, crc32_check;
+        __be32 tmp;
        const struct firmware *fw_entry = NULL;
        dprintk("%s\n", __func__);
@@ -1306,7 +1307,7 @@ static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
           valid. */
        crc32_csum = crc32(~0L, firmware, 56) ^ ~0L;
        memcpy(&tmp, &firmware[56], 4);
-        crc32_check = htonl(tmp);
+        crc32_check = ntohl(tmp);
        if (crc32_csum != crc32_check) {
                printk("%s: crc32 check of DSP code failed (calculated "
                       "0x%08x != 0x%08x in file), file invalid.\n",
@@ -1627,7 +1628,7 @@ static int ttusb_dec_probe(struct usb_interface *intf,
        usb_set_intfdata(intf, (void *)dec);
-        switch (le16_to_cpu(id->idProduct)) {
+        switch (id->idProduct) {
        case 0x1006:
                ttusb_dec_set_model(dec, TTUSB_DEC3000S);
                break;
@@ -1652,7 +1653,7 @@ static int ttusb_dec_probe(struct usb_interface *intf,
        ttusb_dec_init_dvb(dec);
        dec->adapter.priv = dec;
-        switch (le16_to_cpu(id->idProduct)) {
+        switch (id->idProduct) {
        case 0x1006:
                dec->fe = ttusbdecfe_dvbs_attach(&fe_config);
                break;
diff --git a/drivers/media/dvb/ttusb-dec/ttusbdecfe.c b/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
index eb5eaeccd7c4..443af24097f3 100644
--- a/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
+++ b/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
@@ -86,7 +86,7 @@ static int ttusbdecfe_dvbt_set_frontend(struct dvb_frontend* fe, struct dvb_fron
                   0x00, 0x00, 0x00, 0xff,
                   0x00, 0x00, 0x00, 0xff };
-        u32 freq = htonl(p->frequency / 1000);
+        __be32 freq = htonl(p->frequency / 1000);
        memcpy(&b[4], &freq, sizeof (u32));
        state->config->send_command(fe, 0x71, sizeof(b), b, NULL, NULL);
@@ -117,10 +117,10 @@ static int ttusbdecfe_dvbs_set_frontend(struct dvb_frontend* fe, struct dvb_fron
                   0x00, 0x00, 0x00, 0x00,
                   0x00, 0x00, 0x00, 0x00,
                   0x00, 0x00, 0x00, 0x00 };
-        u32 freq;
+        __be32 freq;
-        u32 sym_rate;
+        __be32 sym_rate;
-        u32 band;
+        __be32 band;
-        u32 lnb_voltage;
+        __be32 lnb_voltage;
        freq = htonl(p->frequency +
               (state->hi_band ? LOF_HI : LOF_LO));
diff --git a/drivers/media/video/au0828/Kconfig b/drivers/media/video/au0828/Kconfig
index def10d086373..52b2491581a8 100644
--- a/drivers/media/video/au0828/Kconfig
+++ b/drivers/media/video/au0828/Kconfig
@@ -1,7 +1,7 @@
 config VIDEO_AU0828
        tristate "Auvitek AU0828 support"
-        depends on VIDEO_DEV && I2C && INPUT && DVB_CORE && USB
+        depends on I2C && INPUT && DVB_CORE && USB
        select I2C_ALGOBIT
        select VIDEO_TVEEPROM
        select DVB_AU8522 if !DVB_FE_CUSTOMIZE
diff --git a/drivers/media/video/au0828/au0828-dvb.c b/drivers/media/video/au0828/au0828-dvb.c
index c86a5f17eca8..c6d470590380 100644
--- a/drivers/media/video/au0828/au0828-dvb.c
+++ b/drivers/media/video/au0828/au0828-dvb.c
@@ -353,12 +353,6 @@ int au0828_dvb_register(struct au0828_dev *dev)
                return -1;
        }
-        /* Put the analog decoder in standby to keep it quiet */
-        au0828_call_i2c_clients(dev, TUNER_SET_STANDBY, NULL);
-        if (dvb->frontend->ops.analog_ops.standby)
-                dvb->frontend->ops.analog_ops.standby(dvb->frontend);
        /* register everything */
        ret = dvb_register(dev);
        if (ret < 0) {
diff --git a/drivers/media/video/bt8xx/bttv-cards.c b/drivers/media/video/bt8xx/bttv-cards.c
index f20a01cfc73e..8ef0424c26c4 100644
--- a/drivers/media/video/bt8xx/bttv-cards.c
+++ b/drivers/media/video/bt8xx/bttv-cards.c
@@ -34,6 +34,7 @@
 #include <linux/firmware.h>
 #include <net/checksum.h>
+#include <asm/unaligned.h>
 #include <asm/io.h>
 #include "bttvp.h"
@@ -3858,7 +3859,7 @@ static void __devinit osprey_eeprom(struct bttv *btv, const u8 ee[256])
                ee += i;
                /* found a valid descriptor */
-                type = be16_to_cpup((u16*)(ee+4));
+                type = get_unaligned_be16((__be16 *)(ee+4));
                switch(type) {
                /* 848 based */
@@ -3918,7 +3919,7 @@ static void __devinit osprey_eeprom(struct bttv *btv, const u8 ee[256])
                               btv->c.nr, type);
                        break;
                }
-                serial = be32_to_cpup((u32*)(ee+6));
+                serial = get_unaligned_be32((__be32 *)(ee+6));
        }
        printk(KERN_INFO "bttv%d: osprey eeprom: card=%d '%s' serial=%u\n",
diff --git a/drivers/media/video/bt8xx/bttv-risc.c b/drivers/media/video/bt8xx/bttv-risc.c
index e5979f77504c..0af586876e72 100644
--- a/drivers/media/video/bt8xx/bttv-risc.c
+++ b/drivers/media/video/bt8xx/bttv-risc.c
@@ -48,7 +48,7 @@ bttv_risc_packed(struct bttv *btv, struct btcx_riscmem *risc,
 {
        u32 instructions,line,todo;
        struct scatterlist *sg;
-        u32 *rp;
+        __le32 *rp;
        int rc;
        /* estimate risc mem: worst case is one write per page border +
@@ -128,7 +128,8 @@ bttv_risc_planar(struct bttv *btv, struct btcx_riscmem *risc,
                 unsigned int cpadding)
 {
        unsigned int instructions,line,todo,ylen,chroma;
-        u32 *rp,ri;
+        __le32 *rp;
+        u32 ri;
        struct scatterlist *ysg;
        struct scatterlist *usg;
        struct scatterlist *vsg;
@@ -244,7 +245,8 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
 {
        int dwords,rc,line,maxy,start,end,skip,nskips;
        struct btcx_skiplist *skips;
-        u32 *rp,ri,ra;
+        __le32 *rp;
+        u32 ri,ra;
        u32 addr;
        /* skip list for window clipping */
diff --git a/drivers/media/video/btcx-risc.c b/drivers/media/video/btcx-risc.c
index ce0840ccd594..f42701f82e7f 100644
--- a/drivers/media/video/btcx-risc.c
+++ b/drivers/media/video/btcx-risc.c
@@ -63,7 +63,7 @@ int btcx_riscmem_alloc(struct pci_dev *pci,
                       struct btcx_riscmem *risc,
                       unsigned int size)
 {
-        u32 *cpu;
+        __le32 *cpu;
        dma_addr_t dma;
        if (NULL != risc->cpu && risc->size < size)
diff --git a/drivers/media/video/btcx-risc.h b/drivers/media/video/btcx-risc.h
index 503e6c6d7b69..861bc8112824 100644
--- a/drivers/media/video/btcx-risc.h
+++ b/drivers/media/video/btcx-risc.h
@@ -2,8 +2,8 @@
 */
 struct btcx_riscmem {
        unsigned int   size;
-        u32            *cpu;
+        __le32         *cpu;
-        u32            *jmp;
+        __le32         *jmp;
        dma_addr_t     dma;
 };
diff --git a/drivers/media/video/cx18/cx18-av-core.c b/drivers/media/video/cx18/cx18-av-core.c
index 66864904c99b..9a26751615c6 100644
--- a/drivers/media/video/cx18/cx18-av-core.c
+++ b/drivers/media/video/cx18/cx18-av-core.c
@@ -182,14 +182,16 @@ static void input_change(struct cx18 *cx)
                if (std == V4L2_STD_NTSC_M_JP) {
                        /* Japan uses EIAJ audio standard */
                        cx18_av_write(cx, 0x808, 0xf7);
+                        cx18_av_write(cx, 0x80b, 0x02);
                } else if (std == V4L2_STD_NTSC_M_KR) {
                        /* South Korea uses A2 audio standard */
                        cx18_av_write(cx, 0x808, 0xf8);
+                        cx18_av_write(cx, 0x80b, 0x03);
                } else {
                        /* Others use the BTSC audio standard */
                        cx18_av_write(cx, 0x808, 0xf6);
+                        cx18_av_write(cx, 0x80b, 0x01);
                }
-                cx18_av_write(cx, 0x80b, 0x00);
        } else if (std & V4L2_STD_PAL) {
                /* Follow tuner change procedure for PAL */
                cx18_av_write(cx, 0x808, 0xff);
@@ -741,8 +743,8 @@ static void log_audio_status(struct cx18 *cx)
 {
        struct cx18_av_state *state = &cx->av_state;
        u8 download_ctl = cx18_av_read(cx, 0x803);
-        u8 mod_det_stat0 = cx18_av_read(cx, 0x805);
+        u8 mod_det_stat0 = cx18_av_read(cx, 0x804);
-        u8 mod_det_stat1 = cx18_av_read(cx, 0x804);
+        u8 mod_det_stat1 = cx18_av_read(cx, 0x805);
        u8 audio_config = cx18_av_read(cx, 0x808);
        u8 pref_mode = cx18_av_read(cx, 0x809);
        u8 afc0 = cx18_av_read(cx, 0x80b);
@@ -760,12 +762,12 @@ static void log_audio_status(struct cx18 *cx)
        case 0x12: p = "dual with SAP"; break;
        case 0x14: p = "tri with SAP"; break;
        case 0xfe: p = "forced mode"; break;
-        default: p = "not defined";
+        default: p = "not defined"; break;
        }
        CX18_INFO("Detected audio mode:       %s\n", p);
        switch (mod_det_stat1) {
-        case 0x00: p = "BTSC"; break;
+        case 0x00: p = "not defined"; break;
        case 0x01: p = "EIAJ"; break;
        case 0x02: p = "A2-M"; break;
        case 0x03: p = "A2-BG"; break;
@@ -779,8 +781,13 @@ static void log_audio_status(struct cx18 *cx)
        case 0x0b: p = "NICAM-I"; break;
        case 0x0c: p = "NICAM-L"; break;
        case 0x0d: p = "BTSC/EIAJ/A2-M Mono (4.5 MHz FMMono)"; break;
+        case 0x0e: p = "IF FM Radio"; break;
+        case 0x0f: p = "BTSC"; break;
+        case 0x10: p = "detected chrominance"; break;
+        case 0xfd: p = "unknown audio standard"; break;
+        case 0xfe: p = "forced audio standard"; break;
        case 0xff: p = "no detected audio standard"; break;
-        default: p = "not defined";
+        default: p = "not defined"; break;
        }
        CX18_INFO("Detected audio standard:   %s\n", p);
        CX18_INFO("Audio muted:               %s\n",
@@ -789,22 +796,23 @@ static void log_audio_status(struct cx18 *cx)
                    (download_ctl & 0x10) ? "running" : "stopped");
        switch (audio_config >> 4) {
-        case 0x00: p = "BTSC"; break;
+        case 0x00: p = "undefined"; break;
-        case 0x01: p = "EIAJ"; break;
+        case 0x01: p = "BTSC"; break;
-        case 0x02: p = "A2-M"; break;
+        case 0x02: p = "EIAJ"; break;
-        case 0x03: p = "A2-BG"; break;
+        case 0x03: p = "A2-M"; break;
-        case 0x04: p = "A2-DK1"; break;
+        case 0x04: p = "A2-BG"; break;
-        case 0x05: p = "A2-DK2"; break;
+        case 0x05: p = "A2-DK1"; break;
-        case 0x06: p = "A2-DK3"; break;
+        case 0x06: p = "A2-DK2"; break;
-        case 0x07: p = "A1 (6.0 MHz FM Mono)"; break;
+        case 0x07: p = "A2-DK3"; break;
-        case 0x08: p = "AM-L"; break;
+        case 0x08: p = "A1 (6.0 MHz FM Mono)"; break;
-        case 0x09: p = "NICAM-BG"; break;
+        case 0x09: p = "AM-L"; break;
-        case 0x0a: p = "NICAM-DK"; break;
+        case 0x0a: p = "NICAM-BG"; break;
-        case 0x0b: p = "NICAM-I"; break;
+        case 0x0b: p = "NICAM-DK"; break;
-        case 0x0c: p = "NICAM-L"; break;
+        case 0x0c: p = "NICAM-I"; break;
-        case 0x0d: p = "FM radio"; break;
+        case 0x0d: p = "NICAM-L"; break;
+        case 0x0e: p = "FM radio"; break;
        case 0x0f: p = "automatic detection"; break;
-        default: p = "undefined";
+        default: p = "undefined"; break;
        }
        CX18_INFO("Configured audio standard: %s\n", p);
@@ -815,12 +823,9 @@ static void log_audio_status(struct cx18 *cx)
                case 0x02: p = "MONO3 (STEREO forced MONO)"; break;
                case 0x03: p = "MONO4 (NICAM ANALOG-Language C/Analog Fallback)"; break;
                case 0x04: p = "STEREO"; break;
-                case 0x05: p = "DUAL1 (AB)"; break;
+                case 0x05: p = "DUAL1 (AC)"; break;
-                case 0x06: p = "DUAL2 (AC) (FM)"; break;
+                case 0x06: p = "DUAL2 (BC)"; break;
-                case 0x07: p = "DUAL3 (BC) (FM)"; break;
+                case 0x07: p = "DUAL3 (AB)"; break;
-                case 0x08: p = "DUAL4 (AC) (AM)"; break;
-                case 0x09: p = "DUAL5 (BC) (AM)"; break;
-                case 0x0a: p = "SAP"; break;
                default: p = "undefined";
                }
                CX18_INFO("Configured audio mode:     %s\n", p);
@@ -835,9 +840,11 @@ static void log_audio_status(struct cx18 *cx)
                case 0x06: p = "BTSC"; break;
                case 0x07: p = "EIAJ"; break;
                case 0x08: p = "A2-M"; break;
-                case 0x09: p = "FM Radio"; break;
+                case 0x09: p = "FM Radio (4.5 MHz)"; break;
+                case 0x0a: p = "FM Radio (5.5 MHz)"; break;
+                case 0x0b: p = "S-Video"; break;
                case 0x0f: p = "automatic standard and mode detection"; break;
-                default: p = "undefined";
+                default: p = "undefined"; break;
                }
                CX18_INFO("Configured audio system:   %s\n", p);
        }
@@ -857,22 +864,24 @@ static void log_audio_status(struct cx18 *cx)
        case 5: p = "language AC"; break;
        case 6: p = "language BC"; break;
        case 7: p = "language AB"; break;
-        default: p = "undefined";
+        default: p = "undefined"; break;
        }
        CX18_INFO("Preferred audio mode:      %s\n", p);
        if ((audio_config & 0xf) == 0xf) {
-                switch ((afc0 >> 2) & 0x1) {
+                switch ((afc0 >> 3) & 0x1) {
                case 0: p = "system DK"; break;
                case 1: p = "system L"; break;
                }
                CX18_INFO("Selected 65 MHz format:    %s\n", p);
-                switch (afc0 & 0x3) {
+                switch (afc0 & 0x7) {
-                case 0: p = "BTSC"; break;
+                case 0: p = "Chroma"; break;
-                case 1: p = "EIAJ"; break;
+                case 1: p = "BTSC"; break;
-                case 2: p = "A2-M"; break;
+                case 2: p = "EIAJ"; break;
-                default: p = "undefined";
+                case 3: p = "A2-M"; break;
+                case 4: p = "autodetect"; break;
+                default: p = "undefined"; break;
                }
                CX18_INFO("Selected 45 MHz format:    %s\n", p);
        }
diff --git a/drivers/media/video/cx18/cx18-cards.c b/drivers/media/video/cx18/cx18-cards.c
index 553adbf2cd44..baccd079243d 100644
--- a/drivers/media/video/cx18/cx18-cards.c
+++ b/drivers/media/video/cx18/cx18-cards.c
@@ -126,7 +126,7 @@ static const struct cx18_card cx18_card_hvr1600_samsung = {
 /* ------------------------------------------------------------------------- */
-/* Compro VideoMate H900: not working at the moment! */
+/* Compro VideoMate H900: note that this card is analog only! */
 static const struct cx18_card_pci_info cx18_pci_h900[] = {
        { PCI_DEVICE_ID_CX23418, CX18_PCI_ID_COMPRO, 0xe100 },
@@ -136,7 +136,7 @@ static const struct cx18_card_pci_info cx18_pci_h900[] = {
 static const struct cx18_card cx18_card_h900 = {
        .type = CX18_CARD_COMPRO_H900,
        .name = "Compro VideoMate H900",
-        .comment = "DVB & VBI are not yet supported\n",
+        .comment = "VBI is not yet supported\n",
        .v4l2_capabilities = CX18_CAP_ENCODER,
        .hw_audio_ctrl = CX18_HW_CX23418,
        .hw_all = CX18_HW_TUNER,
diff --git a/drivers/media/video/cx18/cx18-controls.c b/drivers/media/video/cx18/cx18-controls.c
index 2bdac5ebbb0d..87cf41021665 100644
--- a/drivers/media/video/cx18/cx18-controls.c
+++ b/drivers/media/video/cx18/cx18-controls.c
@@ -159,7 +159,7 @@ static int cx18_setup_vbi_fmt(struct cx18 *cx, enum v4l2_mpeg_stream_vbi_fmt fmt
 {
        if (!(cx->v4l2_cap & V4L2_CAP_SLICED_VBI_CAPTURE))
                return -EINVAL;
-        if (atomic_read(&cx->capturing) > 0)
+        if (atomic_read(&cx->ana_capturing) > 0)
                return -EBUSY;
        /* First try to allocate sliced VBI buffers if needed. */
@@ -235,7 +235,7 @@ int cx18_control_ioctls(struct cx18 *cx, unsigned int cmd, void *arg)
                CX18_DEBUG_IOCTL("VIDIOC_S_EXT_CTRLS\n");
                if (c->ctrl_class == V4L2_CTRL_CLASS_MPEG) {
                        struct cx2341x_mpeg_params p = cx->params;
-                        int err = cx2341x_ext_ctrls(&p, atomic_read(&cx->capturing), arg, cmd);
+                        int err = cx2341x_ext_ctrls(&p, atomic_read(&cx->ana_capturing), arg, cmd);
                        if (err)
                                return err;
@@ -295,7 +295,7 @@ int cx18_control_ioctls(struct cx18 *cx, unsigned int cmd, void *arg)
                CX18_DEBUG_IOCTL("VIDIOC_TRY_EXT_CTRLS\n");
                if (c->ctrl_class == V4L2_CTRL_CLASS_MPEG)
                        return cx2341x_ext_ctrls(&cx->params,
-                                        atomic_read(&cx->capturing), arg, cmd);
+                                        atomic_read(&cx->ana_capturing), arg, cmd);
                return -EINVAL;
        }
diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
index 0dd4e0529970..2b810bb2a4c7 100644
--- a/drivers/media/video/cx18/cx18-driver.c
+++ b/drivers/media/video/cx18/cx18-driver.c
@@ -670,7 +670,7 @@ static int __devinit cx18_probe(struct pci_dev *dev,
        cx18_init_power(cx, 1);
        cx18_init_memory(cx);
-        cx->scb = (struct cx18_scb *)(cx->enc_mem + SCB_OFFSET);
+        cx->scb = (struct cx18_scb __iomem *)(cx->enc_mem + SCB_OFFSET);
        cx18_init_scb(cx);
        cx18_gpio_init(cx);
@@ -751,17 +751,6 @@ static int __devinit cx18_probe(struct pci_dev *dev,
        if (cx->options.radio > 0)
                cx->v4l2_cap |= V4L2_CAP_RADIO;
-        retval = cx18_streams_setup(cx);
-        if (retval) {
-                CX18_ERR("Error %d setting up streams\n", retval);
-                goto free_irq;
-        }
-        retval = cx18_streams_register(cx);
-        if (retval) {
-                CX18_ERR("Error %d registering devices\n", retval);
-                goto free_streams;
-        }
        if (cx->options.tuner > -1) {
                struct tuner_setup setup;
@@ -788,7 +777,16 @@ static int __devinit cx18_probe(struct pci_dev *dev,
           are not. */
        cx->tuner_std = cx->std;
-        cx18_init_on_first_open(cx);
+        retval = cx18_streams_setup(cx);
+        if (retval) {
+                CX18_ERR("Error %d setting up streams\n", retval);
+                goto free_irq;
+        }
+        retval = cx18_streams_register(cx);
+        if (retval) {
+                CX18_ERR("Error %d registering devices\n", retval);
+                goto free_streams;
+        }
        CX18_INFO("Initialized card #%d: %s\n", cx->num, cx->card_name);
@@ -889,7 +887,7 @@ static void cx18_remove(struct pci_dev *pci_dev)
        /* Stop all captures */
        CX18_DEBUG_INFO("Stopping all streams\n");
-        if (atomic_read(&cx->capturing) > 0)
+        if (atomic_read(&cx->tot_capturing) > 0)
                cx18_stop_all_captures(cx);
        /* Interrupts */
diff --git a/drivers/media/video/cx18/cx18-driver.h b/drivers/media/video/cx18/cx18-driver.h
index a2a6c58d12fe..de14ab59a206 100644
--- a/drivers/media/video/cx18/cx18-driver.h
+++ b/drivers/media/video/cx18/cx18-driver.h
@@ -358,7 +358,7 @@ struct cx18 {
        u32 v4l2_cap;           /* V4L2 capabilities of card */
        u32 hw_flags;           /* Hardware description of the board */
        unsigned mdl_offset;
-        struct cx18_scb *scb;   /* pointer to SCB */
+        struct cx18_scb __iomem *scb;   /* pointer to SCB */
        struct cx18_av_state av_state;
@@ -380,7 +380,8 @@ struct cx18 {
        int stream_buf_size[CX18_MAX_STREAMS]; /* Stream buffer size */
        struct cx18_stream streams[CX18_MAX_STREAMS];   /* Stream data */
        unsigned long i_flags;  /* global cx18 flags */
-        atomic_t capturing;     /* count number of active capture streams */
+        atomic_t ana_capturing; /* count number of active analog capture streams */
+        atomic_t tot_capturing; /* total count number of active capture streams */
        spinlock_t lock;        /* lock access to this struct */
        int search_pack_header;
@@ -423,6 +424,10 @@ struct cx18 {
        struct mutex i2c_bus_lock[2];
        struct i2c_client *i2c_clients[I2C_CLIENTS_MAX];
+        /* gpio */
+        u32 gpio_dir;
+        u32 gpio_val;
        /* v4l2 and User settings */
        /* codec settings */
diff --git a/drivers/media/video/cx18/cx18-fileops.c b/drivers/media/video/cx18/cx18-fileops.c
index 0b3141db174b..1e537fe04a23 100644
--- a/drivers/media/video/cx18/cx18-fileops.c
+++ b/drivers/media/video/cx18/cx18-fileops.c
@@ -318,7 +318,7 @@ static ssize_t cx18_read(struct cx18_stream *s, char __user *ubuf,
        size_t tot_written = 0;
        int single_frame = 0;
-        if (atomic_read(&cx->capturing) == 0 && s->id == -1) {
+        if (atomic_read(&cx->ana_capturing) == 0 && s->id == -1) {
                /* shouldn't happen */
                CX18_DEBUG_WARN("Stream %s not initialized before read\n",
                                s->name);
@@ -361,7 +361,8 @@ static ssize_t cx18_read(struct cx18_stream *s, char __user *ubuf,
                                cx18_enqueue(s, buf, &s->q_free);
                                cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5,
                                        s->handle,
-                                        (void *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
+                                        (void __iomem *)&cx->scb->cpu_mdl[buf->id] -
+                                          cx->enc_mem,
                                        1, buf->id, s->buf_size);
                        } else
                                cx18_enqueue(s, buf, &s->q_io);
@@ -581,7 +582,7 @@ int cx18_v4l2_close(struct inode *inode, struct file *filp)
                cx18_call_i2c_clients(cx, VIDIOC_S_STD, &cx->std);
                /* Select correct audio input (i.e. TV tuner or Line in) */
                cx18_audio_set_io(cx);
-                if (atomic_read(&cx->capturing) > 0) {
+                if (atomic_read(&cx->ana_capturing) > 0) {
                        /* Undo video mute */
                        cx18_vapi(cx, CX18_CPU_SET_VIDEO_MUTE, 2, s->handle,
                                cx->params.video_mute |
@@ -627,7 +628,7 @@ static int cx18_serialized_open(struct cx18_stream *s, struct file *filp)
                }
                if (!test_bit(CX18_F_I_RADIO_USER, &cx->i_flags)) {
-                        if (atomic_read(&cx->capturing) > 0) {
+                        if (atomic_read(&cx->ana_capturing) > 0) {
                                /* switching to radio while capture is
                                   in progress is not polite */
                                cx18_release_stream(s);
@@ -694,7 +695,7 @@ int cx18_v4l2_open(struct inode *inode, struct file *filp)
 void cx18_mute(struct cx18 *cx)
 {
-        if (atomic_read(&cx->capturing))
+        if (atomic_read(&cx->ana_capturing))
                cx18_vapi(cx, CX18_CPU_SET_AUDIO_MUTE, 2,
                                cx18_find_handle(cx), 1);
        CX18_DEBUG_INFO("Mute\n");
@@ -702,7 +703,7 @@ void cx18_mute(struct cx18 *cx)
 void cx18_unmute(struct cx18 *cx)
 {
-        if (atomic_read(&cx->capturing)) {
+        if (atomic_read(&cx->ana_capturing)) {
                cx18_msleep_timeout(100, 0);
                cx18_vapi(cx, CX18_CPU_SET_MISC_PARAMETERS, 2,
                                cx18_find_handle(cx), 12);
diff --git a/drivers/media/video/cx18/cx18-gpio.c b/drivers/media/video/cx18/cx18-gpio.c
index bb8bc86086d0..ceb63653c926 100644
--- a/drivers/media/video/cx18/cx18-gpio.c
+++ b/drivers/media/video/cx18/cx18-gpio.c
@@ -35,9 +35,6 @@
 #define CX18_REG_GPIO_OUT2   0xc78104
 #define CX18_REG_GPIO_DIR2   0xc7810c
-static u32 gpio_dir;
-static u32 gpio_val;
 /*
 * HVR-1600 GPIO pins, courtesy of Hauppauge:
 *
@@ -49,24 +46,29 @@ static u32 gpio_val;
 static void gpio_write(struct cx18 *cx)
 {
-        write_reg((gpio_dir & 0xffff) << 16, CX18_REG_GPIO_DIR1);
+        u32 dir = cx->gpio_dir;
-        write_reg(((gpio_dir & 0xffff) << 16) | (gpio_val & 0xffff),
+        u32 val = cx->gpio_val;
+        write_reg((dir & 0xffff) << 16, CX18_REG_GPIO_DIR1);
+        write_reg(((dir & 0xffff) << 16) | (val & 0xffff),
                        CX18_REG_GPIO_OUT1);
-        write_reg(gpio_dir & 0xffff0000, CX18_REG_GPIO_DIR2);
+        write_reg(dir & 0xffff0000, CX18_REG_GPIO_DIR2);
-        write_reg((gpio_dir & 0xffff0000) | ((gpio_val & 0xffff0000) >> 16),
+        write_reg((dir & 0xffff0000) | ((val & 0xffff0000) >> 16),
                        CX18_REG_GPIO_OUT2);
 }
 void cx18_gpio_init(struct cx18 *cx)
 {
-        gpio_dir = cx->card->gpio_init.direction;
+        cx->gpio_dir = cx->card->gpio_init.direction;
-        gpio_val = cx->card->gpio_init.initial_value;
+        cx->gpio_val = cx->card->gpio_init.initial_value;
-        if (gpio_dir == 0)
+        if (cx->card->tuners[0].tuner == TUNER_XC2028) {
-                return;
+                cx->gpio_dir |= 1 << cx->card->xceive_pin;
+                cx->gpio_val |= 1 << cx->card->xceive_pin;
+        }
-        gpio_dir |= 1 << cx->card->xceive_pin;
+        if (cx->gpio_dir == 0)
-        gpio_val |= 1 << cx->card->xceive_pin;
+                return;
        CX18_DEBUG_INFO("GPIO initial dir: %08x/%08x out: %08x/%08x\n",
                   read_reg(CX18_REG_GPIO_DIR1), read_reg(CX18_REG_GPIO_DIR2),
@@ -86,13 +88,12 @@ int cx18_reset_tuner_gpio(void *dev, int cmd, int value)
                return 0;
        CX18_DEBUG_INFO("Resetting tuner\n");
-        gpio_dir |= 1 << cx->card->xceive_pin;
+        cx->gpio_val &= ~(1 << cx->card->xceive_pin);
-        gpio_val &= ~(1 << cx->card->xceive_pin);
        gpio_write(cx);
        schedule_timeout_interruptible(msecs_to_jiffies(1));
-        gpio_val |= 1 << cx->card->xceive_pin;
+        cx->gpio_val |= 1 << cx->card->xceive_pin;
        gpio_write(cx);
        schedule_timeout_interruptible(msecs_to_jiffies(1));
        return 0;
diff --git a/drivers/media/video/cx18/cx18-ioctl.c b/drivers/media/video/cx18/cx18-ioctl.c
index dbdcb86ec5aa..4151f1e5493f 100644
--- a/drivers/media/video/cx18/cx18-ioctl.c
+++ b/drivers/media/video/cx18/cx18-ioctl.c
@@ -247,7 +247,7 @@ static int cx18_try_or_set_fmt(struct cx18 *cx, int streamtype,
                if (!set_fmt || (cx->params.width == w && cx->params.height == h))
                        return 0;
-                if (atomic_read(&cx->capturing) > 0)
+                if (atomic_read(&cx->ana_capturing) > 0)
                        return -EBUSY;
                cx->params.width = w;
@@ -264,7 +264,7 @@ static int cx18_try_or_set_fmt(struct cx18 *cx, int streamtype,
        if (fmt->type == V4L2_BUF_TYPE_VBI_CAPTURE) {
                if (set_fmt && streamtype == CX18_ENC_STREAM_TYPE_VBI &&
                    cx->vbi.sliced_in->service_set &&
-                    atomic_read(&cx->capturing) > 0)
+                    atomic_read(&cx->ana_capturing) > 0)
                        return -EBUSY;
                if (set_fmt) {
                        cx->vbi.sliced_in->service_set = 0;
@@ -293,7 +293,7 @@ static int cx18_try_or_set_fmt(struct cx18 *cx, int streamtype,
                return 0;
        if (set == 0)
                return -EINVAL;
-        if (atomic_read(&cx->capturing) > 0 && cx->vbi.sliced_in->service_set == 0)
+        if (atomic_read(&cx->ana_capturing) > 0 && cx->vbi.sliced_in->service_set == 0)
                return -EBUSY;
        cx18_av_cmd(cx, VIDIOC_S_FMT, fmt);
        memcpy(cx->vbi.sliced_in, vbifmt, sizeof(*cx->vbi.sliced_in));
@@ -581,7 +581,7 @@ int cx18_v4l2_ioctls(struct cx18 *cx, struct file *filp, unsigned cmd, void *arg
                        break;
                if (test_bit(CX18_F_I_RADIO_USER, &cx->i_flags) ||
-                    atomic_read(&cx->capturing) > 0) {
+                    atomic_read(&cx->ana_capturing) > 0) {
                        /* Switching standard would turn off the radio or mess
                           with already running streams, prevent that by
                           returning EBUSY. */
@@ -677,7 +677,7 @@ int cx18_v4l2_ioctls(struct cx18 *cx, struct file *filp, unsigned cmd, void *arg
                        enc->flags = 0;
                        if (try)
                                return 0;
-                        if (!atomic_read(&cx->capturing))
+                        if (!atomic_read(&cx->ana_capturing))
                                return -EPERM;
                        if (test_and_set_bit(CX18_F_I_ENC_PAUSED, &cx->i_flags))
                                return 0;
@@ -689,7 +689,7 @@ int cx18_v4l2_ioctls(struct cx18 *cx, struct file *filp, unsigned cmd, void *arg
                        enc->flags = 0;
                        if (try)
                                return 0;
-                        if (!atomic_read(&cx->capturing))
+                        if (!atomic_read(&cx->ana_capturing))
                                return -EPERM;
                        if (!test_and_clear_bit(CX18_F_I_ENC_PAUSED, &cx->i_flags))
                                return 0;
diff --git a/drivers/media/video/cx18/cx18-irq.c b/drivers/media/video/cx18/cx18-irq.c
index 6e14f8bda559..25114a5cbd57 100644
--- a/drivers/media/video/cx18/cx18-irq.c
+++ b/drivers/media/video/cx18/cx18-irq.c
@@ -75,7 +75,7 @@ static void epu_dma_done(struct cx18 *cx, struct cx18_mailbox *mb)
                        cx18_buf_sync_for_device(s, buf);
                        cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5, s->handle,
-                            (void *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
+                            (void __iomem *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
                            1, buf->id, s->buf_size);
                } else
                        set_bit(CX18_F_B_NEED_BUF_SWAP, &buf->b_flags);
@@ -161,13 +161,15 @@ irqreturn_t cx18_irq_handler(int irq, void *dev_id)
        */
        if (sw2) {
-                if (sw2 & (cx->scb->cpu2hpu_irq_ack | cx->scb->cpu2epu_irq_ack))
+                if (sw2 & (readl(&cx->scb->cpu2hpu_irq_ack) |
+                           readl(&cx->scb->cpu2epu_irq_ack)))
                        wake_up(&cx->mb_cpu_waitq);
-                if (sw2 & (cx->scb->apu2hpu_irq_ack | cx->scb->apu2epu_irq_ack))
+                if (sw2 & (readl(&cx->scb->apu2hpu_irq_ack) |
+                           readl(&cx->scb->apu2epu_irq_ack)))
                        wake_up(&cx->mb_apu_waitq);
-                if (sw2 & cx->scb->epu2hpu_irq_ack)
+                if (sw2 & readl(&cx->scb->epu2hpu_irq_ack))
                        wake_up(&cx->mb_epu_waitq);
-                if (sw2 & cx->scb->hpu2epu_irq_ack)
+                if (sw2 & readl(&cx->scb->hpu2epu_irq_ack))
                        wake_up(&cx->mb_hpu_waitq);
        }
diff --git a/drivers/media/video/cx18/cx18-mailbox.c b/drivers/media/video/cx18/cx18-mailbox.c
index 0c5f328bca54..2a5ccef9185b 100644
--- a/drivers/media/video/cx18/cx18-mailbox.c
+++ b/drivers/media/video/cx18/cx18-mailbox.c
@@ -94,10 +94,10 @@ static const struct cx18_api_info *find_api_info(u32 cmd)
        return NULL;
 }
-static struct cx18_mailbox *cx18_mb_is_complete(struct cx18 *cx, int rpu,
+static struct cx18_mailbox __iomem *cx18_mb_is_complete(struct cx18 *cx, int rpu,
                u32 *state, u32 *irq, u32 *req)
 {
-        struct cx18_mailbox *mb = NULL;
+        struct cx18_mailbox __iomem *mb = NULL;
        int wait_count = 0;
        u32 ack;
@@ -142,7 +142,7 @@ static struct cx18_mailbox *cx18_mb_is_complete(struct cx18 *cx, int rpu,
 long cx18_mb_ack(struct cx18 *cx, const struct cx18_mailbox *mb)
 {
        const struct cx18_api_info *info = find_api_info(mb->cmd);
-        struct cx18_mailbox *ack_mb;
+        struct cx18_mailbox __iomem *ack_mb;
        u32 ack_irq;
        u8 rpu = CPU;
@@ -182,7 +182,7 @@ static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
 {
        const struct cx18_api_info *info = find_api_info(cmd);
        u32 state = 0, irq = 0, req, oldreq, err;
-        struct cx18_mailbox *mb;
+        struct cx18_mailbox __iomem *mb;
        wait_queue_head_t *waitq;
        int timeout = 100;
        int cnt = 0;
diff --git a/drivers/media/video/cx18/cx18-streams.c b/drivers/media/video/cx18/cx18-streams.c
index 4ca9d847f1b1..1b921a336092 100644
--- a/drivers/media/video/cx18/cx18-streams.c
+++ b/drivers/media/video/cx18/cx18-streams.c
@@ -36,12 +36,13 @@
 #define CX18_DSP0_INTERRUPT_MASK        0xd0004C
 static struct file_operations cx18_v4l2_enc_fops = {
-      .owner = THIS_MODULE,
+        .owner = THIS_MODULE,
-      .read = cx18_v4l2_read,
+        .read = cx18_v4l2_read,
-      .open = cx18_v4l2_open,
+        .open = cx18_v4l2_open,
-      .ioctl = cx18_v4l2_ioctl,
+        .ioctl = cx18_v4l2_ioctl,
-      .release = cx18_v4l2_close,
+        .compat_ioctl = v4l_compat_ioctl32,
-      .poll = cx18_v4l2_enc_poll,
+        .release = cx18_v4l2_close,
+        .poll = cx18_v4l2_enc_poll,
 };
 /* offset from 0 to register ts v4l2 minors on */
@@ -443,7 +444,7 @@ int cx18_start_v4l2_encode_stream(struct cx18_stream *s)
        s->handle = data[0];
        cx18_vapi(cx, CX18_CPU_SET_CHANNEL_TYPE, 2, s->handle, captype);
-        if (atomic_read(&cx->capturing) == 0 && !ts) {
+        if (atomic_read(&cx->ana_capturing) == 0 && !ts) {
                /* Stuff from Windows, we don't know what it is */
                cx18_vapi(cx, CX18_CPU_SET_VER_CROP_LINE, 2, s->handle, 0);
                cx18_vapi(cx, CX18_CPU_SET_MISC_PARAMETERS, 3, s->handle, 3, 1);
@@ -466,14 +467,14 @@ int cx18_start_v4l2_encode_stream(struct cx18_stream *s)
                cx2341x_update(cx, cx18_api_func, NULL, &cx->params);
        }
-        if (atomic_read(&cx->capturing) == 0) {
+        if (atomic_read(&cx->tot_capturing) == 0) {
                clear_bit(CX18_F_I_EOS, &cx->i_flags);
                write_reg(7, CX18_DSP0_INTERRUPT_MASK);
        }
        cx18_vapi(cx, CX18_CPU_DE_SET_MDL_ACK, 3, s->handle,
-                (void *)&cx->scb->cpu_mdl_ack[s->type][0] - cx->enc_mem,
+                (void __iomem *)&cx->scb->cpu_mdl_ack[s->type][0] - cx->enc_mem,
-                (void *)&cx->scb->cpu_mdl_ack[s->type][1] - cx->enc_mem);
+                (void __iomem *)&cx->scb->cpu_mdl_ack[s->type][1] - cx->enc_mem);
        list_for_each(p, &s->q_free.list) {
                struct cx18_buffer *buf = list_entry(p, struct cx18_buffer, list);
@@ -481,8 +482,8 @@ int cx18_start_v4l2_encode_stream(struct cx18_stream *s)
                writel(buf->dma_handle, &cx->scb->cpu_mdl[buf->id].paddr);
                writel(s->buf_size, &cx->scb->cpu_mdl[buf->id].length);
                cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5, s->handle,
-                        (void *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem, 1,
+                        (void __iomem *)&cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
-                        buf->id, s->buf_size);
+                        1, buf->id, s->buf_size);
        }
        /* begin_capture */
        if (cx18_vapi(cx, CX18_CPU_CAPTURE_START, 1, s->handle)) {
@@ -492,7 +493,9 @@ int cx18_start_v4l2_encode_stream(struct cx18_stream *s)
        }
        /* you're live! sit back and await interrupts :) */
-        atomic_inc(&cx->capturing);
+        if (!ts)
+                atomic_inc(&cx->ana_capturing);
+        atomic_inc(&cx->tot_capturing);
        return 0;
 }
@@ -523,7 +526,7 @@ int cx18_stop_v4l2_encode_stream(struct cx18_stream *s, int gop_end)
        CX18_DEBUG_INFO("Stop Capture\n");
-        if (atomic_read(&cx->capturing) == 0)
+        if (atomic_read(&cx->tot_capturing) == 0)
                return 0;
        if (s->type == CX18_ENC_STREAM_TYPE_MPG)
@@ -537,7 +540,9 @@ int cx18_stop_v4l2_encode_stream(struct cx18_stream *s, int gop_end)
                CX18_INFO("ignoring gop_end: not (yet?) supported by the firmware\n");
        }
-        atomic_dec(&cx->capturing);
+        if (s->type != CX18_ENC_STREAM_TYPE_TS)
+                atomic_dec(&cx->ana_capturing);
+        atomic_dec(&cx->tot_capturing);
        /* Clear capture and no-read bits */
        clear_bit(CX18_F_S_STREAMING, &s->s_flags);
@@ -545,7 +550,7 @@ int cx18_stop_v4l2_encode_stream(struct cx18_stream *s, int gop_end)
        cx18_vapi(cx, CX18_DESTROY_TASK, 1, s->handle);
        s->handle = 0xffffffff;
-        if (atomic_read(&cx->capturing) > 0)
+        if (atomic_read(&cx->tot_capturing) > 0)
                return 0;
        write_reg(5, CX18_DSP0_INTERRUPT_MASK);
diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c
index f24abcd06dea..c4cc2f3b8876 100644
--- a/drivers/media/video/cx23885/cx23885-core.c
+++ b/drivers/media/video/cx23885/cx23885-core.c
@@ -823,7 +823,7 @@ static void cx23885_dev_unregister(struct cx23885_dev *dev)
        iounmap(dev->lmmio);
 }
-static u32* cx23885_risc_field(u32 *rp, struct scatterlist *sglist,
+static __le32* cx23885_risc_field(__le32 *rp, struct scatterlist *sglist,
                               unsigned int offset, u32 sync_line,
                               unsigned int bpl, unsigned int padding,
                               unsigned int lines)
@@ -883,7 +883,7 @@ int cx23885_risc_buffer(struct pci_dev *pci, struct btcx_riscmem *risc,
                        unsigned int padding, unsigned int lines)
 {
        u32 instructions, fields;
-        u32 *rp;
+        __le32 *rp;
        int rc;
        fields = 0;
@@ -924,7 +924,7 @@ static int cx23885_risc_databuffer(struct pci_dev *pci,
                                   unsigned int lines)
 {
        u32 instructions;
-        u32 *rp;
+        __le32 *rp;
        int rc;
        /* estimate risc mem: worst case is one write per page border +
@@ -951,7 +951,7 @@ static int cx23885_risc_databuffer(struct pci_dev *pci,
 int cx23885_risc_stopper(struct pci_dev *pci, struct btcx_riscmem *risc,
                                u32 reg, u32 mask, u32 value)
 {
-        u32 *rp;
+        __le32 *rp;
        int rc;
        if ((rc = btcx_riscmem_alloc(pci, risc, 4*16)) < 0)
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index aeba26dc0a37..fa6d398e97b9 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -1493,10 +1493,16 @@ static const struct cx88_board cx88_boards[] = {
                },
        },
        [CX88_BOARD_POWERCOLOR_REAL_ANGEL] = {
-                .name           = "PowerColor Real Angel 330",
+                .name           = "PowerColor RA330",   /* Long names may confuse LIRC. */
                .tuner_type     = TUNER_XC2028,
                .tuner_addr     = 0x61,
                .input          = { {
+                        .type   = CX88_VMUX_DEBUG,
+                        .vmux   = 3,            /* Due to the way the cx88 driver is written,   */
+                        .gpio0 = 0x00ff,        /* there is no way to deactivate audio pass-    */
+                        .gpio1 = 0xf39d,        /* through without this entry. Furthermore, if  */
+                        .gpio3 = 0x0000,        /* the TV mux entry is first, you get audio     */
+                }, {                            /* from the tuner on boot for a little while.   */
                        .type   = CX88_VMUX_TELEVISION,
                        .vmux   = 0,
                        .gpio0 = 0x00ff,
@@ -2424,8 +2430,9 @@ void cx88_setup_xc3028(struct cx88_core *core, struct xc2028_ctrl *ctl)
        switch (core->boardnr) {
        case CX88_BOARD_POWERCOLOR_REAL_ANGEL:
-                /* Doesn't work with firmware version 2.7 */
+                /* Now works with firmware version 2.7 */
-                ctl->fname = "xc3028-v25.fw";
+                if (core->i2c_algo.udelay < 16)
+                        core->i2c_algo.udelay = 16;
                break;
        case CX88_BOARD_DVICO_FUSIONHDTV_DVB_T_PRO:
                ctl->scode_table = XC3028_FE_ZARLINK456;
diff --git a/drivers/media/video/cx88/cx88-core.c b/drivers/media/video/cx88/cx88-core.c
index c4d1aff1fdb4..60eeda3057e9 100644
--- a/drivers/media/video/cx88/cx88-core.c
+++ b/drivers/media/video/cx88/cx88-core.c
@@ -70,7 +70,7 @@ static DEFINE_MUTEX(devlist);
 /* @lpi: lines per IRQ, or 0 to not generate irqs. Note: IRQ to be
         generated _after_ lpi lines are transferred. */
-static u32* cx88_risc_field(u32 *rp, struct scatterlist *sglist,
+static __le32* cx88_risc_field(__le32 *rp, struct scatterlist *sglist,
                            unsigned int offset, u32 sync_line,
                            unsigned int bpl, unsigned int padding,
                            unsigned int lines, unsigned int lpi)
@@ -130,7 +130,7 @@ int cx88_risc_buffer(struct pci_dev *pci, struct btcx_riscmem *risc,
                     unsigned int bpl, unsigned int padding, unsigned int lines)
 {
        u32 instructions,fields;
-        u32 *rp;
+        __le32 *rp;
        int rc;
        fields = 0;
@@ -168,7 +168,7 @@ int cx88_risc_databuffer(struct pci_dev *pci, struct btcx_riscmem *risc,
                         unsigned int lines, unsigned int lpi)
 {
        u32 instructions;
-        u32 *rp;
+        __le32 *rp;
        int rc;
        /* estimate risc mem: worst case is one write per page border +
@@ -193,7 +193,7 @@ int cx88_risc_databuffer(struct pci_dev *pci, struct btcx_riscmem *risc,
 int cx88_risc_stopper(struct pci_dev *pci, struct btcx_riscmem *risc,
                      u32 reg, u32 mask, u32 value)
 {
-        u32 *rp;
+        __le32 *rp;
        int rc;
        if ((rc = btcx_riscmem_alloc(pci, risc, 4*16)) < 0)
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 8996175cc950..fb163ecd9216 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -1166,13 +1166,13 @@ static int vidioc_g_register(struct file *file, void *priv,
                reg->val = ret;
        } else {
-                u64 val = 0;
+                __le64 val = 0;
                ret = em28xx_read_reg_req_len(dev, USB_REQ_GET_STATUS,
                                                   reg->reg, (char *)&val, 2);
                if (ret < 0)
                        return ret;
-                reg->val = cpu_to_le64((__u64)val);
+                reg->val = le64_to_cpu(val);
        }
        return 0;
@@ -1183,9 +1183,9 @@ static int vidioc_s_register(struct file *file, void *priv,
 {
        struct em28xx_fh      *fh  = priv;
        struct em28xx         *dev = fh->dev;
-        u64 buf;
+        __le64 buf;
-        buf = le64_to_cpu((__u64)reg->val);
+        buf = cpu_to_le64(reg->val);
        return em28xx_write_regs(dev, reg->reg, (char *)&buf,
                                 em28xx_reg_len(reg->reg));
diff --git a/drivers/media/video/ivtv/ivtv-driver.h b/drivers/media/video/ivtv/ivtv-driver.h
index ba06e813c58c..9d23b1efd36d 100644
--- a/drivers/media/video/ivtv/ivtv-driver.h
+++ b/drivers/media/video/ivtv/ivtv-driver.h
@@ -259,6 +259,12 @@ struct ivtv_mailbox_data {
 /* Scatter-Gather array element, used in DMA transfers */
 struct ivtv_sg_element {
+        __le32 src;
+        __le32 dst;
+        __le32 size;
+};
+struct ivtv_sg_host_element {
        u32 src;
        u32 dst;
        u32 size;
@@ -349,8 +355,8 @@ struct ivtv_stream {
        u16 dma_xfer_cnt;
        /* Base Dev SG Array for cx23415/6 */
-        struct ivtv_sg_element *sg_pending;
+        struct ivtv_sg_host_element *sg_pending;
-        struct ivtv_sg_element *sg_processing;
+        struct ivtv_sg_host_element *sg_processing;
        struct ivtv_sg_element *sg_dma;
        dma_addr_t sg_handle;
        int sg_pending_size;
diff --git a/drivers/media/video/ivtv/ivtv-fileops.c b/drivers/media/video/ivtv/ivtv-fileops.c
index f2fa434b677b..db813e071ce6 100644
--- a/drivers/media/video/ivtv/ivtv-fileops.c
+++ b/drivers/media/video/ivtv/ivtv-fileops.c
@@ -587,7 +587,7 @@ retry:
        since we may get here before the stream has been fully set-up */
        if (mode == OUT_YUV && s->q_full.length == 0 && itv->dma_data_req_size) {
                while (count >= itv->dma_data_req_size) {
-                        if (!ivtv_yuv_udma_stream_frame (itv, (void *)user_buf)) {
+                        if (!ivtv_yuv_udma_stream_frame (itv, (void __user *)user_buf)) {
                                bytes_written += itv->dma_data_req_size;
                                user_buf += itv->dma_data_req_size;
                                count -= itv->dma_data_req_size;
diff --git a/drivers/media/video/ivtv/ivtv-irq.c b/drivers/media/video/ivtv/ivtv-irq.c
index d8ba3a4a8761..fba150a6cd23 100644
--- a/drivers/media/video/ivtv/ivtv-irq.c
+++ b/drivers/media/video/ivtv/ivtv-irq.c
@@ -231,14 +231,14 @@ static void dma_post(struct ivtv_stream *s)
        struct ivtv_buffer *buf = NULL;
        struct list_head *p;
        u32 offset;
-        u32 *u32buf;
+        __le32 *u32buf;
        int x = 0;
        IVTV_DEBUG_HI_DMA("%s %s completed (%x)\n", ivtv_use_pio(s) ? "PIO" : "DMA",
                        s->name, s->dma_offset);
        list_for_each(p, &s->q_dma.list) {
                buf = list_entry(p, struct ivtv_buffer, list);
-                u32buf = (u32 *)buf->buf;
+                u32buf = (__le32 *)buf->buf;
                /* Sync Buffer */
                ivtv_buf_sync_for_cpu(s, buf);
@@ -444,7 +444,7 @@ static void ivtv_dma_enc_start(struct ivtv_stream *s)
        }
        s->dma_xfer_cnt++;
-        memcpy(s->sg_processing, s->sg_pending, sizeof(struct ivtv_sg_element) * s->sg_pending_size);
+        memcpy(s->sg_processing, s->sg_pending, sizeof(struct ivtv_sg_host_element) * s->sg_pending_size);
        s->sg_processing_size = s->sg_pending_size;
        s->sg_pending_size = 0;
        s->sg_processed = 0;
@@ -473,7 +473,7 @@ static void ivtv_dma_dec_start(struct ivtv_stream *s)
        if (s->q_predma.bytesused)
                ivtv_queue_move(s, &s->q_predma, NULL, &s->q_dma, s->q_predma.bytesused);
        s->dma_xfer_cnt++;
-        memcpy(s->sg_processing, s->sg_pending, sizeof(struct ivtv_sg_element) * s->sg_pending_size);
+        memcpy(s->sg_processing, s->sg_pending, sizeof(struct ivtv_sg_host_element) * s->sg_pending_size);
        s->sg_processing_size = s->sg_pending_size;
        s->sg_pending_size = 0;
        s->sg_processed = 0;
diff --git a/drivers/media/video/ivtv/ivtv-queue.c b/drivers/media/video/ivtv/ivtv-queue.c
index fc8b1eaa333b..71bd13e22e2e 100644
--- a/drivers/media/video/ivtv/ivtv-queue.c
+++ b/drivers/media/video/ivtv/ivtv-queue.c
@@ -193,7 +193,7 @@ void ivtv_flush_queues(struct ivtv_stream *s)
 int ivtv_stream_alloc(struct ivtv_stream *s)
 {
        struct ivtv *itv = s->itv;
-        int SGsize = sizeof(struct ivtv_sg_element) * s->buffers;
+        int SGsize = sizeof(struct ivtv_sg_host_element) * s->buffers;
        int i;
        if (s->buffers == 0)
diff --git a/drivers/media/video/ivtv/ivtv-streams.c b/drivers/media/video/ivtv/ivtv-streams.c
index c47c2b945147..c854285a4371 100644
--- a/drivers/media/video/ivtv/ivtv-streams.c
+++ b/drivers/media/video/ivtv/ivtv-streams.c
@@ -44,23 +44,25 @@
 #include "ivtv-streams.h"
 static const struct file_operations ivtv_v4l2_enc_fops = {
-      .owner = THIS_MODULE,
+        .owner = THIS_MODULE,
-      .read = ivtv_v4l2_read,
+        .read = ivtv_v4l2_read,
-      .write = ivtv_v4l2_write,
+        .write = ivtv_v4l2_write,
-      .open = ivtv_v4l2_open,
+        .open = ivtv_v4l2_open,
-      .ioctl = ivtv_v4l2_ioctl,
+        .ioctl = ivtv_v4l2_ioctl,
-      .release = ivtv_v4l2_close,
+        .compat_ioctl = v4l_compat_ioctl32,
-      .poll = ivtv_v4l2_enc_poll,
+        .release = ivtv_v4l2_close,
+        .poll = ivtv_v4l2_enc_poll,
 };
 static const struct file_operations ivtv_v4l2_dec_fops = {
-      .owner = THIS_MODULE,
+        .owner = THIS_MODULE,
-      .read = ivtv_v4l2_read,
+        .read = ivtv_v4l2_read,
-      .write = ivtv_v4l2_write,
+        .write = ivtv_v4l2_write,
-      .open = ivtv_v4l2_open,
+        .open = ivtv_v4l2_open,
-      .ioctl = ivtv_v4l2_ioctl,
+        .ioctl = ivtv_v4l2_ioctl,
-      .release = ivtv_v4l2_close,
+        .compat_ioctl = v4l_compat_ioctl32,
-      .poll = ivtv_v4l2_dec_poll,
+        .release = ivtv_v4l2_close,
+        .poll = ivtv_v4l2_dec_poll,
 };
 #define IVTV_V4L2_DEC_MPG_OFFSET  16    /* offset from 0 to register decoder mpg v4l2 minors on */
diff --git a/drivers/media/video/ivtv/ivtv-version.h b/drivers/media/video/ivtv/ivtv-version.h
index 02c5ab071d1b..442f43f11b73 100644
--- a/drivers/media/video/ivtv/ivtv-version.h
+++ b/drivers/media/video/ivtv/ivtv-version.h
@@ -22,8 +22,8 @@
 #define IVTV_DRIVER_NAME "ivtv"
 #define IVTV_DRIVER_VERSION_MAJOR 1
-#define IVTV_DRIVER_VERSION_MINOR 2
+#define IVTV_DRIVER_VERSION_MINOR 3
-#define IVTV_DRIVER_VERSION_PATCHLEVEL 1
+#define IVTV_DRIVER_VERSION_PATCHLEVEL 0
 #define IVTV_VERSION __stringify(IVTV_DRIVER_VERSION_MAJOR) "." __stringify(IVTV_DRIVER_VERSION_MINOR) "." __stringify(IVTV_DRIVER_VERSION_PATCHLEVEL)
 #define IVTV_DRIVER_VERSION KERNEL_VERSION(IVTV_DRIVER_VERSION_MAJOR,IVTV_DRIVER_VERSION_MINOR,IVTV_DRIVER_VERSION_PATCHLEVEL)
diff --git a/drivers/media/video/ivtv/ivtv-yuv.c b/drivers/media/video/ivtv/ivtv-yuv.c
index a9417f6e4087..3092ff1d00a0 100644
--- a/drivers/media/video/ivtv/ivtv-yuv.c
+++ b/drivers/media/video/ivtv/ivtv-yuv.c
@@ -1116,7 +1116,7 @@ void ivtv_yuv_setup_stream_frame(struct ivtv *itv)
 }
 /* Attempt to dma a frame from a user buffer */
-int ivtv_yuv_udma_stream_frame(struct ivtv *itv, void *src)
+int ivtv_yuv_udma_stream_frame(struct ivtv *itv, void __user *src)
 {
        struct yuv_playback_info *yi = &itv->yuv_info;
        struct ivtv_dma_frame dma_args;
diff --git a/drivers/media/video/ivtv/ivtv-yuv.h b/drivers/media/video/ivtv/ivtv-yuv.h
index 2fe5f1250762..ca5173fbf006 100644
--- a/drivers/media/video/ivtv/ivtv-yuv.h
+++ b/drivers/media/video/ivtv/ivtv-yuv.h
@@ -35,7 +35,7 @@ extern const u32 yuv_offset[IVTV_YUV_BUFFERS];
 int ivtv_yuv_filter_check(struct ivtv *itv);
 void ivtv_yuv_setup_stream_frame(struct ivtv *itv);
-int ivtv_yuv_udma_stream_frame(struct ivtv *itv, void *src);
+int ivtv_yuv_udma_stream_frame(struct ivtv *itv, void __user *src);
 void ivtv_yuv_frame_complete(struct ivtv *itv);
 int ivtv_yuv_prep_frame(struct ivtv *itv, struct ivtv_dma_frame *args);
 void ivtv_yuv_close(struct ivtv *itv);
diff --git a/drivers/media/video/saa7134/saa7134-empress.c b/drivers/media/video/saa7134/saa7134-empress.c
index 1314522a8130..81431ee41842 100644
--- a/drivers/media/video/saa7134/saa7134-empress.c
+++ b/drivers/media/video/saa7134/saa7134-empress.c
@@ -163,8 +163,7 @@ ts_mmap(struct file *file, struct vm_area_struct * vma)
 static int empress_querycap(struct file *file, void  *priv,
                                        struct v4l2_capability *cap)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        strcpy(cap->driver, "saa7134");
        strlcpy(cap->card, saa7134_boards[dev->board].name,
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index 198f0afb812e..0d12ace61665 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -92,6 +92,7 @@ struct tuner {
        unsigned int        type; /* chip type id */
        unsigned int        config;
        int (*tuner_callback) (void *dev, int command, int arg);
+        const char          *name;
 };
 /* standard i2c insmod options */
@@ -330,13 +331,13 @@ static void tuner_i2c_address_check(struct tuner *t)
        tuner_warn("Support for tuners in i2c address range 0x64 thru 0x6f\n");
        tuner_warn("will soon be dropped. This message indicates that your\n");
        tuner_warn("hardware has a %s tuner at i2c address 0x%02x.\n",
-                   t->i2c->name, t->i2c->addr);
+                   t->name, t->i2c->addr);
        tuner_warn("To ensure continued support for your device, please\n");
        tuner_warn("send a copy of this message, along with full dmesg\n");
        tuner_warn("output to v4l-dvb-maintainer@linuxtv.org\n");
        tuner_warn("Please use subject line: \"obsolete tuner i2c address.\"\n");
        tuner_warn("driver: %s, addr: 0x%02x, type: %d (%s)\n",
-                   t->i2c->adapter->name, t->i2c->addr, t->type, t->i2c->name);
+                   t->i2c->adapter->name, t->i2c->addr, t->type, t->name);
        tuner_warn("====================== WARNING! ======================\n");
 }
@@ -470,19 +471,17 @@ static void set_type(struct i2c_client *c, unsigned int type,
        if ((NULL == analog_ops->set_params) &&
            (fe_tuner_ops->set_analog_params)) {
-                strlcpy(t->i2c->name, fe_tuner_ops->info.name,
+                t->name = fe_tuner_ops->info.name;
-                        sizeof(t->i2c->name));
                t->fe.analog_demod_priv = t;
                memcpy(analog_ops, &tuner_core_ops,
                       sizeof(struct analog_demod_ops));
        } else {
-                strlcpy(t->i2c->name, analog_ops->info.name,
+                t->name = analog_ops->info.name;
-                        sizeof(t->i2c->name));
        }
-        tuner_dbg("type set to %s\n", t->i2c->name);
+        tuner_dbg("type set to %s\n", t->name);
        if (t->mode_mask == T_UNINITIALIZED)
                t->mode_mask = new_mode_mask;
@@ -537,7 +536,7 @@ static void set_addr(struct i2c_client *c, struct tuner_setup *tun_setup)
 static inline int check_mode(struct tuner *t, char *cmd)
 {
        if ((1 << t->mode & t->mode_mask) == 0) {
-                return EINVAL;
+                return -EINVAL;
        }
        switch (t->mode) {
@@ -731,11 +730,11 @@ static inline int set_mode(struct i2c_client *client, struct tuner *t, int mode,
        t->mode = mode;
-        if (check_mode(t, cmd) == EINVAL) {
+        if (check_mode(t, cmd) == -EINVAL) {
                t->mode = T_STANDBY;
                if (analog_ops->standby)
                        analog_ops->standby(&t->fe);
-                return EINVAL;
+                return -EINVAL;
        }
        return 0;
 }
@@ -777,13 +776,13 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                break;
        case AUDC_SET_RADIO:
                if (set_mode(client, t, V4L2_TUNER_RADIO, "AUDC_SET_RADIO")
-                                == EINVAL)
+                                == -EINVAL)
                        return 0;
                if (t->radio_freq)
                        set_freq(client, t->radio_freq);
                break;
        case TUNER_SET_STANDBY:
-                if (check_mode(t, "TUNER_SET_STANDBY") == EINVAL)
+                if (check_mode(t, "TUNER_SET_STANDBY") == -EINVAL)
                        return 0;
                t->mode = T_STANDBY;
                if (analog_ops->standby)
@@ -791,9 +790,9 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                break;
 #ifdef CONFIG_VIDEO_ALLOW_V4L1
        case VIDIOCSAUDIO:
-                if (check_mode(t, "VIDIOCSAUDIO") == EINVAL)
+                if (check_mode(t, "VIDIOCSAUDIO") == -EINVAL)
                        return 0;
-                if (check_v4l2(t) == EINVAL)
+                if (check_v4l2(t) == -EINVAL)
                        return 0;
                /* Should be implemented, since bttv calls it */
@@ -811,10 +810,10 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                        };
                        struct video_channel *vc = arg;
-                        if (check_v4l2(t) == EINVAL)
+                        if (check_v4l2(t) == -EINVAL)
                                return 0;
-                        if (set_mode(client,t,V4L2_TUNER_ANALOG_TV, "VIDIOCSCHAN")==EINVAL)
+                        if (set_mode(client,t,V4L2_TUNER_ANALOG_TV, "VIDIOCSCHAN")==-EINVAL)
                                return 0;
                        if (vc->norm < ARRAY_SIZE(map))
@@ -828,9 +827,9 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                {
                        unsigned long *v = arg;
-                        if (check_mode(t, "VIDIOCSFREQ") == EINVAL)
+                        if (check_mode(t, "VIDIOCSFREQ") == -EINVAL)
                                return 0;
-                        if (check_v4l2(t) == EINVAL)
+                        if (check_v4l2(t) == -EINVAL)
                                return 0;
                        set_freq(client, *v);
@@ -840,9 +839,9 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                {
                        struct video_tuner *vt = arg;
-                        if (check_mode(t, "VIDIOCGTUNER") == EINVAL)
+                        if (check_mode(t, "VIDIOCGTUNER") == -EINVAL)
                                return 0;
-                        if (check_v4l2(t) == EINVAL)
+                        if (check_v4l2(t) == -EINVAL)
                                return 0;
                        if (V4L2_TUNER_RADIO == t->mode) {
@@ -884,9 +883,9 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                {
                        struct video_audio *va = arg;
-                        if (check_mode(t, "VIDIOCGAUDIO") == EINVAL)
+                        if (check_mode(t, "VIDIOCGAUDIO") == -EINVAL)
                                return 0;
-                        if (check_v4l2(t) == EINVAL)
+                        if (check_v4l2(t) == -EINVAL)
                                return 0;
                        if (V4L2_TUNER_RADIO == t->mode) {
@@ -926,7 +925,7 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                        v4l2_std_id *id = arg;
                        if (set_mode (client, t, V4L2_TUNER_ANALOG_TV, "VIDIOC_S_STD")
-                                        == EINVAL)
+                                        == -EINVAL)
                                return 0;
                        switch_v4l2();
@@ -942,7 +941,7 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                        struct v4l2_frequency *f = arg;
                        if (set_mode (client, t, f->type, "VIDIOC_S_FREQUENCY")
-                                        == EINVAL)
+                                        == -EINVAL)
                                return 0;
                        switch_v4l2();
                        set_freq(client,f->frequency);
@@ -953,7 +952,7 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                {
                        struct v4l2_frequency *f = arg;
-                        if (check_mode(t, "VIDIOC_G_FREQUENCY") == EINVAL)
+                        if (check_mode(t, "VIDIOC_G_FREQUENCY") == -EINVAL)
                                return 0;
                        switch_v4l2();
                        f->type = t->mode;
@@ -974,7 +973,7 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                {
                        struct v4l2_tuner *tuner = arg;
-                        if (check_mode(t, "VIDIOC_G_TUNER") == EINVAL)
+                        if (check_mode(t, "VIDIOC_G_TUNER") == -EINVAL)
                                return 0;
                        switch_v4l2();
@@ -1021,7 +1020,7 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                {
                        struct v4l2_tuner *tuner = arg;
-                        if (check_mode(t, "VIDIOC_S_TUNER") == EINVAL)
+                        if (check_mode(t, "VIDIOC_S_TUNER") == -EINVAL)
                                return 0;
                        switch_v4l2();
@@ -1115,6 +1114,7 @@ static int tuner_probe(struct i2c_client *client,
        if (NULL == t)
                return -ENOMEM;
        t->i2c = client;
+        t->name = "(tuner unset)";
        i2c_set_clientdata(client, t);
        t->type = UNSET;
        t->audmode = V4L2_TUNER_MODE_STEREO;
@@ -1272,12 +1272,6 @@ static int tuner_remove(struct i2c_client *client)
        list_del(&t->list);
        kfree(t);
-        /* The probing code has overwritten the device name, restore it so
-           that reloading the driver will work. Ideally the device name
-           should not be overwritten in the first place, but for now that
-           will do. */
-        strlcpy(client->name, "tuner", I2C_NAME_SIZE);
        return 0;
 }
diff --git a/drivers/media/video/usbvideo/quickcam_messenger.c b/drivers/media/video/usbvideo/quickcam_messenger.c
index 32e536edf09d..3d26a30abe1e 100644
--- a/drivers/media/video/usbvideo/quickcam_messenger.c
+++ b/drivers/media/video/usbvideo/quickcam_messenger.c
@@ -210,7 +210,7 @@ static int qcm_stv_setb(struct usb_device *dev, u16 reg, u8 val)
        return ret;
 }
-static int qcm_stv_setw(struct usb_device *dev, u16 reg, u16 val)
+static int qcm_stv_setw(struct usb_device *dev, u16 reg, __le16 val)
 {
        int ret;
diff --git a/drivers/media/video/zoran.h b/drivers/media/video/zoran.h
index 81cc3b00a079..46b7ad477ceb 100644
--- a/drivers/media/video/zoran.h
+++ b/drivers/media/video/zoran.h
@@ -285,7 +285,7 @@ struct zoran_mapping {
 struct zoran_jpg_buffer {
        struct zoran_mapping *map;
-        u32 *frag_tab;          /* addresses of frag table */
+        __le32 *frag_tab;               /* addresses of frag table */
        u32 frag_tab_bus;       /* same value cached to save time in ISR */
        enum zoran_buffer_state state;  /* non-zero if corresponding buffer is in use in grab queue */
        struct zoran_sync bs;   /* DONE: info to return to application */
@@ -450,7 +450,7 @@ struct zoran {
        unsigned long jpg_queued_num;   /* count of frames queued since grab/play started */
        /* zr36057's code buffer table */
-        u32 *stat_com;          /* stat_com[i] is indexed by dma_head/tail & BUZ_MASK_STAT_COM */
+        __le32 *stat_com;               /* stat_com[i] is indexed by dma_head/tail & BUZ_MASK_STAT_COM */
        /* (value & BUZ_MASK_FRAME) corresponds to index in pend[] queue */
        int jpg_pend[BUZ_MAX_FRAME];
diff --git a/drivers/media/video/zoran_device.c b/drivers/media/video/zoran_device.c
index 37629ffd34c3..88d369708e4c 100644
--- a/drivers/media/video/zoran_device.c
+++ b/drivers/media/video/zoran_device.c
@@ -1320,7 +1320,7 @@ error_handler (struct zoran *zr,
                        if (i) {
                                /* Rotate stat_comm entries to make current entry first */
                                int j;
-                                u32 bus_addr[BUZ_NUM_STAT_COM];
+                                __le32 bus_addr[BUZ_NUM_STAT_COM];
                                /* Here we are copying the stat_com array, which
                                 * is already in little endian format, so
diff --git a/drivers/media/video/zoran_driver.c b/drivers/media/video/zoran_driver.c
index 345c77e46837..5394d7a5cfee 100644
--- a/drivers/media/video/zoran_driver.c
+++ b/drivers/media/video/zoran_driver.c
@@ -495,7 +495,7 @@ jpg_fbuffer_alloc (struct file *file)
                        jpg_fbuffer_free(file);
                        return -ENOBUFS;
                }
-                fh->jpg_buffers.buffer[i].frag_tab = (u32 *) mem;
+                fh->jpg_buffers.buffer[i].frag_tab = (__le32 *) mem;
                fh->jpg_buffers.buffer[i].frag_tab_bus =
                    virt_to_bus((void *) mem);
@@ -1167,7 +1167,7 @@ zoran_close_end_session (struct file *file)
        /* v4l capture */
        if (fh->v4l_buffers.active != ZORAN_FREE) {
-                long flags;
+                unsigned long flags;
                spin_lock_irqsave(&zr->spinlock, flags);
                zr36057_set_memgrab(zr, 0);
@@ -3436,7 +3436,7 @@ zoran_do_ioctl (struct inode *inode,
                        /* unload capture */
                        if (zr->v4l_memgrab_active) {
-                                long flags;
+                                unsigned long flags;
                                spin_lock_irqsave(&zr->spinlock, flags);
                                zr36057_set_memgrab(zr, 0);
@@ -4375,7 +4375,7 @@ zoran_vm_close (struct vm_area_struct *vma)
                                mutex_lock(&zr->resource_lock);
                                if (fh->v4l_buffers.active != ZORAN_FREE) {
-                                        long flags;
+                                        unsigned long flags;
                                        spin_lock_irqsave(&zr->spinlock, flags);
                                        zr36057_set_memgrab(zr, 0);
@@ -4506,7 +4506,7 @@ zoran_mmap (struct file           *file,
                                if (todo > fraglen)
                                        todo = fraglen;
                                pos =
-                                    le32_to_cpu((unsigned long) fh->jpg_buffers.
+                                    le32_to_cpu(fh->jpg_buffers.
                                    buffer[i].frag_tab[2 * j]);
                                /* should just be pos on i386 */
                                page = virt_to_phys(bus_to_virt(pos))
diff --git a/drivers/message/fusion/mptfc.c b/drivers/message/fusion/mptfc.c
index 3cdd4e962115..1e24ab4ac38c 100644
--- a/drivers/message/fusion/mptfc.c
+++ b/drivers/message/fusion/mptfc.c
@@ -1238,8 +1238,6 @@ mptfc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        sh->max_id = ioc->pfacts->MaxDevices;
        sh->max_lun = max_lun;
-        sh->this_id = ioc->pfacts[0].PortSCSIID;
        /* Required entry.
         */
        sh->unique_id = ioc->id;
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index 468480771f13..4d492ba232b0 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -3193,8 +3193,6 @@ mptsas_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        sh->transportt = mptsas_transport_template;
-        sh->this_id = ioc->pfacts[0].PortSCSIID;
        /* Required entry.
         */
        sh->unique_id = ioc->id;
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index b109bd8a4d19..c68ef00c2f92 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -2451,12 +2451,6 @@ mptscsih_slave_configure(struct scsi_device *sdev)
                    ioc->name, sdev->sdtr, sdev->wdtr,
                    sdev->ppr, sdev->inquiry_len));
-        if (sdev->id > sh->max_id) {
-                /* error case, should never happen */
-                scsi_adjust_queue_depth(sdev, 0, 1);
-                goto slave_configure_exit;
-        }
        vdevice->configured_lun = 1;
        mptscsih_change_queue_depth(sdev, MPT_SCSI_CMD_PER_DEV_HIGH);
@@ -2470,8 +2464,6 @@ mptscsih_slave_configure(struct scsi_device *sdev)
                    ioc->name, vtarget->negoFlags, vtarget->maxOffset,
                    vtarget->minSyncFactor));
-slave_configure_exit:
        dsprintk(ioc, printk(MYIOC_s_DEBUG_FMT
                "tagged %d, simple %d, ordered %d\n",
                ioc->name,sdev->tagged_supported, sdev->simple_tags,
diff --git a/drivers/misc/fujitsu-laptop.c b/drivers/misc/fujitsu-laptop.c
index e2e7c05a147b..6d14e8fe1537 100644
--- a/drivers/misc/fujitsu-laptop.c
+++ b/drivers/misc/fujitsu-laptop.c
@@ -352,3 +352,9 @@ MODULE_AUTHOR("Jonathan Woithe");
 MODULE_DESCRIPTION("Fujitsu laptop extras support");
 MODULE_VERSION(FUJITSU_DRIVER_VERSION);
 MODULE_LICENSE("GPL");
+static struct pnp_device_id pnp_ids[] = {
+        { .id = "FUJ02bf" },
+        { .id = "" }
+};
+MODULE_DEVICE_TABLE(pnp, pnp_ids);
diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index fa394104339c..e4ff50b95a5e 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -102,7 +102,6 @@
 #include <linux/nmi.h>
 #include <linux/delay.h>
 #include <linux/kthread.h>
-#include <linux/delay.h>
 #define v1printk(a...) do { \
        if (verbose) \
@@ -119,7 +118,6 @@
        } while (0)
 #define MAX_CONFIG_LEN          40
-static const char hexchars[] = "0123456789abcdef";
 static struct kgdb_io kgdbts_io_ops;
 static char get_buf[BUFMAX];
 static int get_buf_cnt;
@@ -131,6 +129,8 @@ static int repeat_test;
 static int test_complete;
 static int send_ack;
 static int final_ack;
+static int force_hwbrks;
+static int hwbreaks_ok;
 static int hw_break_val;
 static int hw_break_val2;
 #if defined(CONFIG_ARM) || defined(CONFIG_MIPS) || defined(CONFIG_SPARC)
@@ -234,12 +234,12 @@ static void break_helper(char *bp_type, char *arg, unsigned long vaddr)
 static void sw_break(char *arg)
 {
-        break_helper("Z0", arg, 0);
+        break_helper(force_hwbrks ? "Z1" : "Z0", arg, 0);
 }
 static void sw_rem_break(char *arg)
 {
-        break_helper("z0", arg, 0);
+        break_helper(force_hwbrks ? "z1" : "z0", arg, 0);
 }
 static void hw_break(char *arg)
@@ -619,8 +619,8 @@ static void fill_get_buf(char *buf)
                count++;
        }
        strcat(get_buf, "#");
-        get_buf[count + 2] = hexchars[checksum >> 4];
+        get_buf[count + 2] = hex_asc_hi(checksum);
-        get_buf[count + 3] = hexchars[checksum & 0xf];
+        get_buf[count + 3] = hex_asc_lo(checksum);
        get_buf[count + 4] = '\0';
        v2printk("get%i: %s\n", ts.idx, get_buf);
 }
@@ -781,6 +781,8 @@ static void run_breakpoint_test(int is_hw_breakpoint)
                return;
        eprintk("kgdbts: ERROR %s test failed\n", ts.name);
+        if (is_hw_breakpoint)
+                hwbreaks_ok = 0;
 }
 static void run_hw_break_test(int is_write_test)
@@ -798,9 +800,11 @@ static void run_hw_break_test(int is_write_test)
        kgdb_breakpoint();
        hw_break_val_access();
        if (is_write_test) {
-                if (test_complete == 2)
+                if (test_complete == 2) {
                        eprintk("kgdbts: ERROR %s broke on access\n",
                                ts.name);
+                        hwbreaks_ok = 0;
+                }
                hw_break_val_write();
        }
        kgdb_breakpoint();
@@ -809,6 +813,7 @@ static void run_hw_break_test(int is_write_test)
                return;
        eprintk("kgdbts: ERROR %s test failed\n", ts.name);
+        hwbreaks_ok = 0;
 }
 static void run_nmi_sleep_test(int nmi_sleep)
@@ -912,6 +917,7 @@ static void kgdbts_run_tests(void)
        /* All HW break point tests */
        if (arch_kgdb_ops.flags & KGDB_HW_BREAKPOINT) {
+                hwbreaks_ok = 1;
                v1printk("kgdbts:RUN hw breakpoint test\n");
                run_breakpoint_test(1);
                v1printk("kgdbts:RUN hw write breakpoint test\n");
@@ -925,6 +931,19 @@ static void kgdbts_run_tests(void)
                run_nmi_sleep_test(nmi_sleep);
        }
+#ifdef CONFIG_DEBUG_RODATA
+        /* Until there is an api to write to read-only text segments, use
+         * HW breakpoints for the remainder of any tests, else print a
+         * failure message if hw breakpoints do not work.
+         */
+        if (!(arch_kgdb_ops.flags & KGDB_HW_BREAKPOINT && hwbreaks_ok)) {
+                eprintk("kgdbts: HW breakpoints do not work,"
+                        "skipping remaining tests\n");
+                return;
+        }
+        force_hwbrks = 1;
+#endif /* CONFIG_DEBUG_RODATA */
        /* If the do_fork test is run it will be the last test that is
         * executed because a kernel thread will be spawned at the very
         * end to unregister the debug hooks.
diff --git a/drivers/misc/thinkpad_acpi.c b/drivers/misc/thinkpad_acpi.c
index 3f28f6eabdbf..b5969298f3d3 100644
--- a/drivers/misc/thinkpad_acpi.c
+++ b/drivers/misc/thinkpad_acpi.c
@@ -1293,7 +1293,7 @@ static void tpacpi_input_send_radiosw(void)
                mutex_lock(&tpacpi_inputdev_send_mutex);
                input_report_switch(tpacpi_inputdev,
-                                    SW_RADIO, !!wlsw);
+                                    SW_RFKILL_ALL, !!wlsw);
                input_sync(tpacpi_inputdev);
                mutex_unlock(&tpacpi_inputdev_send_mutex);
@@ -1921,6 +1921,29 @@ static struct attribute *hotkey_mask_attributes[] __initdata = {
        &dev_attr_hotkey_wakeup_hotunplug_complete.attr,
 };
+static void hotkey_exit(void)
+{
+#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
+        hotkey_poll_stop_sync();
+#endif
+        if (hotkey_dev_attributes)
+                delete_attr_set(hotkey_dev_attributes, &tpacpi_pdev->dev.kobj);
+        kfree(hotkey_keycode_map);
+        if (tp_features.hotkey) {
+                dbg_printk(TPACPI_DBG_EXIT,
+                           "restoring original hot key mask\n");
+                /* no short-circuit boolean operator below! */
+                if ((hotkey_mask_set(hotkey_orig_mask) |
+                     hotkey_status_set(hotkey_orig_status)) != 0)
+                        printk(TPACPI_ERR
+                               "failed to restore hot key mask "
+                               "to BIOS defaults\n");
+        }
+}
 static int __init hotkey_init(struct ibm_init_struct *iibm)
 {
        /* Requirements for changing the default keymaps:
@@ -2060,226 +2083,220 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
        vdbg_printk(TPACPI_DBG_INIT, "hotkeys are %s\n",
                str_supported(tp_features.hotkey));
-        if (tp_features.hotkey) {
+        if (!tp_features.hotkey)
-                hotkey_dev_attributes = create_attr_set(13, NULL);
+                return 1;
-                if (!hotkey_dev_attributes)
-                        return -ENOMEM;
-                res = add_many_to_attr_set(hotkey_dev_attributes,
-                                hotkey_attributes,
-                                ARRAY_SIZE(hotkey_attributes));
-                if (res)
-                        return res;
-                /* mask not supported on 570, 600e/x, 770e, 770x, A21e, A2xm/p,
+        hotkey_dev_attributes = create_attr_set(13, NULL);
-                   A30, R30, R31, T20-22, X20-21, X22-24.  Detected by checking
+        if (!hotkey_dev_attributes)
-                   for HKEY interface version 0x100 */
+                return -ENOMEM;
-                if (acpi_evalf(hkey_handle, &hkeyv, "MHKV", "qd")) {
+        res = add_many_to_attr_set(hotkey_dev_attributes,
-                        if ((hkeyv >> 8) != 1) {
+                        hotkey_attributes,
-                                printk(TPACPI_ERR "unknown version of the "
+                        ARRAY_SIZE(hotkey_attributes));
-                                       "HKEY interface: 0x%x\n", hkeyv);
+        if (res)
-                                printk(TPACPI_ERR "please report this to %s\n",
+                goto err_exit;
-                                       TPACPI_MAIL);
-                        } else {
+        /* mask not supported on 570, 600e/x, 770e, 770x, A21e, A2xm/p,
-                                /*
+           A30, R30, R31, T20-22, X20-21, X22-24.  Detected by checking
-                                 * MHKV 0x100 in A31, R40, R40e,
+           for HKEY interface version 0x100 */
-                                 * T4x, X31, and later
+        if (acpi_evalf(hkey_handle, &hkeyv, "MHKV", "qd")) {
-                                 */
+                if ((hkeyv >> 8) != 1) {
-                                tp_features.hotkey_mask = 1;
+                        printk(TPACPI_ERR "unknown version of the "
-                        }
+                               "HKEY interface: 0x%x\n", hkeyv);
+                        printk(TPACPI_ERR "please report this to %s\n",
+                               TPACPI_MAIL);
+                } else {
+                        /*
+                         * MHKV 0x100 in A31, R40, R40e,
+                         * T4x, X31, and later
+                         */
+                        tp_features.hotkey_mask = 1;
                }
+        }
-                vdbg_printk(TPACPI_DBG_INIT, "hotkey masks are %s\n",
+        vdbg_printk(TPACPI_DBG_INIT, "hotkey masks are %s\n",
-                        str_supported(tp_features.hotkey_mask));
+                str_supported(tp_features.hotkey_mask));
-                if (tp_features.hotkey_mask) {
+        if (tp_features.hotkey_mask) {
-                        if (!acpi_evalf(hkey_handle, &hotkey_all_mask,
+                if (!acpi_evalf(hkey_handle, &hotkey_all_mask,
-                                        "MHKA", "qd")) {
+                                "MHKA", "qd")) {
-                                printk(TPACPI_ERR
+                        printk(TPACPI_ERR
-                                       "missing MHKA handler, "
+                               "missing MHKA handler, "
-                                       "please report this to %s\n",
+                               "please report this to %s\n",
-                                       TPACPI_MAIL);
+                               TPACPI_MAIL);
-                                /* FN+F12, FN+F4, FN+F3 */
+                        /* FN+F12, FN+F4, FN+F3 */
-                                hotkey_all_mask = 0x080cU;
+                        hotkey_all_mask = 0x080cU;
-                        }
                }
+        }
-                /* hotkey_source_mask *must* be zero for
+        /* hotkey_source_mask *must* be zero for
-                 * the first hotkey_mask_get */
+         * the first hotkey_mask_get */
-                res = hotkey_status_get(&hotkey_orig_status);
+        res = hotkey_status_get(&hotkey_orig_status);
-                if (!res && tp_features.hotkey_mask) {
+        if (res)
-                        res = hotkey_mask_get();
+                goto err_exit;
-                        hotkey_orig_mask = hotkey_mask;
-                        if (!res) {
+        if (tp_features.hotkey_mask) {
-                                res = add_many_to_attr_set(
+                res = hotkey_mask_get();
-                                        hotkey_dev_attributes,
+                if (res)
-                                        hotkey_mask_attributes,
+                        goto err_exit;
-                                        ARRAY_SIZE(hotkey_mask_attributes));
-                        }
+                hotkey_orig_mask = hotkey_mask;
-                }
+                res = add_many_to_attr_set(
+                                hotkey_dev_attributes,
+                                hotkey_mask_attributes,
+                                ARRAY_SIZE(hotkey_mask_attributes));
+                if (res)
+                        goto err_exit;
+        }
 #ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
-                if (tp_features.hotkey_mask) {
+        if (tp_features.hotkey_mask) {
-                        hotkey_source_mask = TPACPI_HKEY_NVRAM_GOOD_MASK
+                hotkey_source_mask = TPACPI_HKEY_NVRAM_GOOD_MASK
-                                                & ~hotkey_all_mask;
+                                        & ~hotkey_all_mask;
-                } else {
+        } else {
-                        hotkey_source_mask = TPACPI_HKEY_NVRAM_GOOD_MASK;
+                hotkey_source_mask = TPACPI_HKEY_NVRAM_GOOD_MASK;
-                }
+        }
-                vdbg_printk(TPACPI_DBG_INIT,
+        vdbg_printk(TPACPI_DBG_INIT,
-                            "hotkey source mask 0x%08x, polling freq %d\n",
+                    "hotkey source mask 0x%08x, polling freq %d\n",
-                            hotkey_source_mask, hotkey_poll_freq);
+                    hotkey_source_mask, hotkey_poll_freq);
 #endif
-                /* Not all thinkpads have a hardware radio switch */
+        /* Not all thinkpads have a hardware radio switch */
-                if (!res && acpi_evalf(hkey_handle, &status, "WLSW", "qd")) {
+        if (acpi_evalf(hkey_handle, &status, "WLSW", "qd")) {
-                        tp_features.hotkey_wlsw = 1;
+                tp_features.hotkey_wlsw = 1;
-                        printk(TPACPI_INFO
+                printk(TPACPI_INFO
-                                "radio switch found; radios are %s\n",
+                        "radio switch found; radios are %s\n",
-                                enabled(status, 0));
+                        enabled(status, 0));
-                        res = add_to_attr_set(hotkey_dev_attributes,
+                res = add_to_attr_set(hotkey_dev_attributes,
-                                        &dev_attr_hotkey_radio_sw.attr);
+                                &dev_attr_hotkey_radio_sw.attr);
-                }
+        }
-                /* For X41t, X60t, X61t Tablets... */
+        /* For X41t, X60t, X61t Tablets... */
-                if (!res && acpi_evalf(hkey_handle, &status, "MHKG", "qd")) {
+        if (!res && acpi_evalf(hkey_handle, &status, "MHKG", "qd")) {
-                        tp_features.hotkey_tablet = 1;
+                tp_features.hotkey_tablet = 1;
-                        printk(TPACPI_INFO
+                printk(TPACPI_INFO
-                                "possible tablet mode switch found; "
+                        "possible tablet mode switch found; "
-                                "ThinkPad in %s mode\n",
+                        "ThinkPad in %s mode\n",
-                                (status & TP_HOTKEY_TABLET_MASK)?
+                        (status & TP_HOTKEY_TABLET_MASK)?
-                                        "tablet" : "laptop");
+                                "tablet" : "laptop");
-                        res = add_to_attr_set(hotkey_dev_attributes,
+                res = add_to_attr_set(hotkey_dev_attributes,
-                                        &dev_attr_hotkey_tablet_mode.attr);
+                                &dev_attr_hotkey_tablet_mode.attr);
-                }
+        }
-                if (!res)
+        if (!res)
-                        res = register_attr_set_with_sysfs(
+                res = register_attr_set_with_sysfs(
-                                        hotkey_dev_attributes,
+                                hotkey_dev_attributes,
-                                        &tpacpi_pdev->dev.kobj);
+                                &tpacpi_pdev->dev.kobj);
-                if (res)
+        if (res)
-                        return res;
+                goto err_exit;
-                /* Set up key map */
+        /* Set up key map */
-                hotkey_keycode_map = kmalloc(TPACPI_HOTKEY_MAP_SIZE,
+        hotkey_keycode_map = kmalloc(TPACPI_HOTKEY_MAP_SIZE,
-                                                GFP_KERNEL);
+                                        GFP_KERNEL);
-                if (!hotkey_keycode_map) {
+        if (!hotkey_keycode_map) {
-                        printk(TPACPI_ERR
+                printk(TPACPI_ERR
-                                "failed to allocate memory for key map\n");
+                        "failed to allocate memory for key map\n");
-                        return -ENOMEM;
+                res = -ENOMEM;
-                }
+                goto err_exit;
+        }
-                if (thinkpad_id.vendor == PCI_VENDOR_ID_LENOVO) {
+        if (thinkpad_id.vendor == PCI_VENDOR_ID_LENOVO) {
-                        dbg_printk(TPACPI_DBG_INIT,
+                dbg_printk(TPACPI_DBG_INIT,
-                                   "using Lenovo default hot key map\n");
+                           "using Lenovo default hot key map\n");
-                        memcpy(hotkey_keycode_map, &lenovo_keycode_map,
+                memcpy(hotkey_keycode_map, &lenovo_keycode_map,
-                                TPACPI_HOTKEY_MAP_SIZE);
+                        TPACPI_HOTKEY_MAP_SIZE);
+        } else {
+                dbg_printk(TPACPI_DBG_INIT,
+                           "using IBM default hot key map\n");
+                memcpy(hotkey_keycode_map, &ibm_keycode_map,
+                        TPACPI_HOTKEY_MAP_SIZE);
+        }
+        set_bit(EV_KEY, tpacpi_inputdev->evbit);
+        set_bit(EV_MSC, tpacpi_inputdev->evbit);
+        set_bit(MSC_SCAN, tpacpi_inputdev->mscbit);
+        tpacpi_inputdev->keycodesize = TPACPI_HOTKEY_MAP_TYPESIZE;
+        tpacpi_inputdev->keycodemax = TPACPI_HOTKEY_MAP_LEN;
+        tpacpi_inputdev->keycode = hotkey_keycode_map;
+        for (i = 0; i < TPACPI_HOTKEY_MAP_LEN; i++) {
+                if (hotkey_keycode_map[i] != KEY_RESERVED) {
+                        set_bit(hotkey_keycode_map[i],
+                                tpacpi_inputdev->keybit);
                } else {
-                        dbg_printk(TPACPI_DBG_INIT,
+                        if (i < sizeof(hotkey_reserved_mask)*8)
-                                   "using IBM default hot key map\n");
+                                hotkey_reserved_mask |= 1 << i;
-                        memcpy(hotkey_keycode_map, &ibm_keycode_map,
-                                TPACPI_HOTKEY_MAP_SIZE);
-                }
-                set_bit(EV_KEY, tpacpi_inputdev->evbit);
-                set_bit(EV_MSC, tpacpi_inputdev->evbit);
-                set_bit(MSC_SCAN, tpacpi_inputdev->mscbit);
-                tpacpi_inputdev->keycodesize = TPACPI_HOTKEY_MAP_TYPESIZE;
-                tpacpi_inputdev->keycodemax = TPACPI_HOTKEY_MAP_LEN;
-                tpacpi_inputdev->keycode = hotkey_keycode_map;
-                for (i = 0; i < TPACPI_HOTKEY_MAP_LEN; i++) {
-                        if (hotkey_keycode_map[i] != KEY_RESERVED) {
-                                set_bit(hotkey_keycode_map[i],
-                                        tpacpi_inputdev->keybit);
-                        } else {
-                                if (i < sizeof(hotkey_reserved_mask)*8)
-                                        hotkey_reserved_mask |= 1 << i;
-                        }
-                }
-                if (tp_features.hotkey_wlsw) {
-                        set_bit(EV_SW, tpacpi_inputdev->evbit);
-                        set_bit(SW_RADIO, tpacpi_inputdev->swbit);
-                }
-                if (tp_features.hotkey_tablet) {
-                        set_bit(EV_SW, tpacpi_inputdev->evbit);
-                        set_bit(SW_TABLET_MODE, tpacpi_inputdev->swbit);
                }
+        }
-                /* Do not issue duplicate brightness change events to
+        if (tp_features.hotkey_wlsw) {
-                 * userspace */
+                set_bit(EV_SW, tpacpi_inputdev->evbit);
-                if (!tp_features.bright_acpimode)
+                set_bit(SW_RFKILL_ALL, tpacpi_inputdev->swbit);
-                        /* update bright_acpimode... */
+        }
-                        tpacpi_check_std_acpi_brightness_support();
+        if (tp_features.hotkey_tablet) {
+                set_bit(EV_SW, tpacpi_inputdev->evbit);
-                if (tp_features.bright_acpimode) {
+                set_bit(SW_TABLET_MODE, tpacpi_inputdev->swbit);
-                        printk(TPACPI_INFO
+        }
-                               "This ThinkPad has standard ACPI backlight "
-                               "brightness control, supported by the ACPI "
-                               "video driver\n");
-                        printk(TPACPI_NOTICE
-                               "Disabling thinkpad-acpi brightness events "
-                               "by default...\n");
-                        /* The hotkey_reserved_mask change below is not
-                         * necessary while the keys are at KEY_RESERVED in the
-                         * default map, but better safe than sorry, leave it
-                         * here as a marker of what we have to do, especially
-                         * when we finally become able to set this at runtime
-                         * on response to X.org requests */
-                        hotkey_reserved_mask |=
-                                (1 << TP_ACPI_HOTKEYSCAN_FNHOME)
-                                | (1 << TP_ACPI_HOTKEYSCAN_FNEND);
-                }
-                dbg_printk(TPACPI_DBG_INIT,
+        /* Do not issue duplicate brightness change events to
-                                "enabling hot key handling\n");
+         * userspace */
-                res = hotkey_status_set(1);
+        if (!tp_features.bright_acpimode)
-                if (res)
+                /* update bright_acpimode... */
-                        return res;
+                tpacpi_check_std_acpi_brightness_support();
-                res = hotkey_mask_set(((hotkey_all_mask | hotkey_source_mask)
-                                        & ~hotkey_reserved_mask)
-                                        | hotkey_orig_mask);
-                if (res < 0 && res != -ENXIO)
-                        return res;
-                dbg_printk(TPACPI_DBG_INIT,
+        if (tp_features.bright_acpimode) {
-                                "legacy hot key reporting over procfs %s\n",
+                printk(TPACPI_INFO
-                                (hotkey_report_mode < 2) ?
+                       "This ThinkPad has standard ACPI backlight "
-                                        "enabled" : "disabled");
+                       "brightness control, supported by the ACPI "
+                       "video driver\n");
+                printk(TPACPI_NOTICE
+                       "Disabling thinkpad-acpi brightness events "
+                       "by default...\n");
+                /* The hotkey_reserved_mask change below is not
+                 * necessary while the keys are at KEY_RESERVED in the
+                 * default map, but better safe than sorry, leave it
+                 * here as a marker of what we have to do, especially
+                 * when we finally become able to set this at runtime
+                 * on response to X.org requests */
+                hotkey_reserved_mask |=
+                        (1 << TP_ACPI_HOTKEYSCAN_FNHOME)
+                        | (1 << TP_ACPI_HOTKEYSCAN_FNEND);
+        }
+        dbg_printk(TPACPI_DBG_INIT, "enabling hot key handling\n");
+        res = hotkey_status_set(1);
+        if (res) {
+                hotkey_exit();
+                return res;
+        }
+        res = hotkey_mask_set(((hotkey_all_mask | hotkey_source_mask)
+                                & ~hotkey_reserved_mask)
+                                | hotkey_orig_mask);
+        if (res < 0 && res != -ENXIO) {
+                hotkey_exit();
+                return res;
+        }
-                tpacpi_inputdev->open = &hotkey_inputdev_open;
+        dbg_printk(TPACPI_DBG_INIT,
-                tpacpi_inputdev->close = &hotkey_inputdev_close;
+                        "legacy hot key reporting over procfs %s\n",
+                        (hotkey_report_mode < 2) ?
+                                "enabled" : "disabled");
-                hotkey_poll_setup_safe(1);
+        tpacpi_inputdev->open = &hotkey_inputdev_open;
-                tpacpi_input_send_radiosw();
+        tpacpi_inputdev->close = &hotkey_inputdev_close;
-                tpacpi_input_send_tabletsw();
-        }
-        return (tp_features.hotkey)? 0 : 1;
+        hotkey_poll_setup_safe(1);
-}
+        tpacpi_input_send_radiosw();
+        tpacpi_input_send_tabletsw();
-static void hotkey_exit(void)
+        return 0;
-{
-#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
-        hotkey_poll_stop_sync();
-#endif
-        if (tp_features.hotkey) {
+err_exit:
-                dbg_printk(TPACPI_DBG_EXIT,
+        delete_attr_set(hotkey_dev_attributes, &tpacpi_pdev->dev.kobj);
-                           "restoring original hot key mask\n");
+        hotkey_dev_attributes = NULL;
-                /* no short-circuit boolean operator below! */
-                if ((hotkey_mask_set(hotkey_orig_mask) |
-                     hotkey_status_set(hotkey_orig_status)) != 0)
-                        printk(TPACPI_ERR
-                               "failed to restore hot key mask "
-                               "to BIOS defaults\n");
-        }
-        if (hotkey_dev_attributes) {
+        return (res < 0)? res : 1;
-                delete_attr_set(hotkey_dev_attributes, &tpacpi_pdev->dev.kobj);
-                hotkey_dev_attributes = NULL;
-        }
 }
 static void hotkey_notify(struct ibm_struct *ibm, u32 event)
@@ -3319,7 +3336,7 @@ static struct tpacpi_led_classdev tpacpi_led_thinklight = {
 static int __init light_init(struct ibm_init_struct *iibm)
 {
-        int rc = 0;
+        int rc;
        vdbg_printk(TPACPI_DBG_INIT, "initializing light subdriver\n");
@@ -3337,20 +3354,23 @@ static int __init light_init(struct ibm_init_struct *iibm)
                tp_features.light_status =
                        acpi_evalf(ec_handle, NULL, "KBLT", "qv");
-        vdbg_printk(TPACPI_DBG_INIT, "light is %s\n",
+        vdbg_printk(TPACPI_DBG_INIT, "light is %s, light status is %s\n",
-                str_supported(tp_features.light));
+                str_supported(tp_features.light),
+                str_supported(tp_features.light_status));
-        if (tp_features.light) {
+        if (!tp_features.light)
-                rc = led_classdev_register(&tpacpi_pdev->dev,
+                return 1;
-                                           &tpacpi_led_thinklight.led_classdev);
-        }
+        rc = led_classdev_register(&tpacpi_pdev->dev,
+                                   &tpacpi_led_thinklight.led_classdev);
        if (rc < 0) {
                tp_features.light = 0;
                tp_features.light_status = 0;
-        } else {
+        } else  {
-                rc = (tp_features.light)? 0 : 1;
+                rc = 0;
        }
        return rc;
 }
@@ -3821,7 +3841,7 @@ TPACPI_HANDLE(led, ec, "SLED",	/* 570 */
 #define TPACPI_LED_NUMLEDS 8
 static struct tpacpi_led_classdev *tpacpi_leds;
 static enum led_status_t tpacpi_led_state_cache[TPACPI_LED_NUMLEDS];
-static const char const *tpacpi_led_names[TPACPI_LED_NUMLEDS] = {
+static const char * const tpacpi_led_names[TPACPI_LED_NUMLEDS] = {
        /* there's a limit of 19 chars + NULL before 2.6.26 */
        "tpacpi::power",
        "tpacpi:orange:batt",
@@ -3833,7 +3853,7 @@ static const char const *tpacpi_led_names[TPACPI_LED_NUMLEDS] = {
        "tpacpi::standby",
 };
-static int led_get_status(unsigned int led)
+static int led_get_status(const unsigned int led)
 {
        int status;
        enum led_status_t led_s;
@@ -3857,41 +3877,42 @@ static int led_get_status(unsigned int led)
        /* not reached */
 }
-static int led_set_status(unsigned int led, enum led_status_t ledstatus)
+static int led_set_status(const unsigned int led,
+                          const enum led_status_t ledstatus)
 {
        /* off, on, blink. Index is led_status_t */
-        static const int const led_sled_arg1[] = { 0, 1, 3 };
+        static const unsigned int led_sled_arg1[] = { 0, 1, 3 };
-        static const int const led_exp_hlbl[] = { 0, 0, 1 };    /* led# * */
+        static const unsigned int led_led_arg1[] = { 0, 0x80, 0xc0 };
-        static const int const led_exp_hlcl[] = { 0, 1, 1 };    /* led# * */
-        static const int const led_led_arg1[] = { 0, 0x80, 0xc0 };
        int rc = 0;
        switch (led_supported) {
        case TPACPI_LED_570:
-                        /* 570 */
+                /* 570 */
-                        led = 1 << led;
+                if (led > 7)
-                        if (!acpi_evalf(led_handle, NULL, NULL, "vdd",
+                        return -EINVAL;
-                                        led, led_sled_arg1[ledstatus]))
+                if (!acpi_evalf(led_handle, NULL, NULL, "vdd",
-                                rc = -EIO;
+                                (1 << led), led_sled_arg1[ledstatus]))
-                        break;
+                        rc = -EIO;
+                break;
        case TPACPI_LED_OLD:
-                        /* 600e/x, 770e, 770x, A21e, A2xm/p, T20-22, X20 */
+                /* 600e/x, 770e, 770x, A21e, A2xm/p, T20-22, X20 */
-                        led = 1 << led;
+                if (led > 7)
-                        rc = ec_write(TPACPI_LED_EC_HLMS, led);
+                        return -EINVAL;
-                        if (rc >= 0)
+                rc = ec_write(TPACPI_LED_EC_HLMS, (1 << led));
-                                rc = ec_write(TPACPI_LED_EC_HLBL,
+                if (rc >= 0)
-                                              led * led_exp_hlbl[ledstatus]);
+                        rc = ec_write(TPACPI_LED_EC_HLBL,
-                        if (rc >= 0)
+                                      (ledstatus == TPACPI_LED_BLINK) << led);
-                                rc = ec_write(TPACPI_LED_EC_HLCL,
+                if (rc >= 0)
-                                              led * led_exp_hlcl[ledstatus]);
+                        rc = ec_write(TPACPI_LED_EC_HLCL,
-                        break;
+                                      (ledstatus != TPACPI_LED_OFF) << led);
+                break;
        case TPACPI_LED_NEW:
-                        /* all others */
+                /* all others */
-                        if (!acpi_evalf(led_handle, NULL, NULL, "vdd",
+                if (!acpi_evalf(led_handle, NULL, NULL, "vdd",
-                                        led, led_led_arg1[ledstatus]))
+                                led, led_led_arg1[ledstatus]))
-                                rc = -EIO;
+                        rc = -EIO;
-                        break;
+                break;
        default:
                rc = -ENXIO;
        }
@@ -3978,7 +3999,6 @@ static void led_exit(void)
        }
        kfree(tpacpi_leds);
-        tpacpi_leds = NULL;
 }
 static int __init led_init(struct ibm_init_struct *iibm)
@@ -4802,7 +4822,6 @@ static void brightness_exit(void)
                vdbg_printk(TPACPI_DBG_EXIT,
                            "calling backlight_device_unregister()\n");
                backlight_device_unregister(ibm_backlight_device);
-                ibm_backlight_device = NULL;
        }
 }
@@ -5764,11 +5783,16 @@ static int __init fan_init(struct ibm_init_struct *iibm)
            fan_control_access_mode != TPACPI_FAN_WR_NONE) {
                rc = sysfs_create_group(&tpacpi_sensors_pdev->dev.kobj,
                                         &fan_attr_group);
-                if (!(rc < 0))
-                        rc = driver_create_file(&tpacpi_hwmon_pdriver.driver,
-                                        &driver_attr_fan_watchdog);
                if (rc < 0)
                        return rc;
+                rc = driver_create_file(&tpacpi_hwmon_pdriver.driver,
+                                        &driver_attr_fan_watchdog);
+                if (rc < 0) {
+                        sysfs_remove_group(&tpacpi_sensors_pdev->dev.kobj,
+                                        &fan_attr_group);
+                        return rc;
+                }
                return 0;
        } else
                return 1;
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 91ded3e82401..f9ad960d7c1a 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -46,7 +46,7 @@
 #define MMC_SHIFT       3
 #define MMC_NUM_MINORS  (256 >> MMC_SHIFT)
-static unsigned long dev_use[MMC_NUM_MINORS/(8*sizeof(unsigned long))];
+static DECLARE_BITMAP(dev_use, MMC_NUM_MINORS);
 /*
 * There is one mmc_blk_data per slot.
diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c
index be624a049c67..c303e7f57ab4 100644
--- a/drivers/mmc/host/wbsd.c
+++ b/drivers/mmc/host/wbsd.c
@@ -1457,17 +1457,7 @@ static int __devinit wbsd_request_irq(struct wbsd_host *host, int irq)
        int ret;
        /*
-         * Allocate interrupt.
+         * Set up tasklets. Must be done before requesting interrupt.
-         */
-        ret = request_irq(irq, wbsd_irq, IRQF_SHARED, DRIVER_NAME, host);
-        if (ret)
-                return ret;
-        host->irq = irq;
-        /*
-         * Set up tasklets.
         */
        tasklet_init(&host->card_tasklet, wbsd_tasklet_card,
                        (unsigned long)host);
@@ -1480,6 +1470,15 @@ static int __devinit wbsd_request_irq(struct wbsd_host *host, int irq)
        tasklet_init(&host->finish_tasklet, wbsd_tasklet_finish,
                        (unsigned long)host);
+        /*
+         * Allocate interrupt.
+         */
+        ret = request_irq(irq, wbsd_irq, IRQF_SHARED, DRIVER_NAME, host);
+        if (ret)
+                return ret;
+        host->irq = irq;
        return 0;
 }
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 25efd331ef28..b402269301f6 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -346,8 +346,10 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
        mutex_lock(&flash->lock);
        /* Wait until finished previous write command. */
-        if (wait_till_ready(flash))
+        if (wait_till_ready(flash)) {
+                mutex_unlock(&flash->lock);
                return 1;
+        }
        write_enable(flash);
diff --git a/drivers/mtd/maps/ck804xrom.c b/drivers/mtd/maps/ck804xrom.c
index 59d8fb49270a..effaf7cdefab 100644
--- a/drivers/mtd/maps/ck804xrom.c
+++ b/drivers/mtd/maps/ck804xrom.c
@@ -331,15 +331,15 @@ static void __devexit ck804xrom_remove_one (struct pci_dev *pdev)
 }
 static struct pci_device_id ck804xrom_pci_tbl[] = {
-        { PCI_VENDOR_ID_NVIDIA, 0x0051, PCI_ANY_ID, PCI_ANY_ID, DEV_CK804 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, 0x0051), .driver_data = DEV_CK804 },
-        { PCI_VENDOR_ID_NVIDIA, 0x0360, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, 0x0360), .driver_data = DEV_MCP55 },
-        { PCI_VENDOR_ID_NVIDIA, 0x0361, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, 0x0361), .driver_data = DEV_MCP55 },
-        { PCI_VENDOR_ID_NVIDIA, 0x0362, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, 0x0362), .driver_data = DEV_MCP55 },
-        { PCI_VENDOR_ID_NVIDIA, 0x0363, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, 0x0363), .driver_data = DEV_MCP55 },
-        { PCI_VENDOR_ID_NVIDIA, 0x0364, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, 0x0364), .driver_data = DEV_MCP55 },
-        { PCI_VENDOR_ID_NVIDIA, 0x0365, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, 0x0365), .driver_data = DEV_MCP55 },
-        { PCI_VENDOR_ID_NVIDIA, 0x0366, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, 0x0366), .driver_data = DEV_MCP55 },
-        { PCI_VENDOR_ID_NVIDIA, 0x0367, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, 0x0367), .driver_data = DEV_MCP55 },
        { 0, }
 };
diff --git a/drivers/mtd/maps/omap_nor.c b/drivers/mtd/maps/omap_nor.c
index 240b0e2d095d..c12d8056bebd 100644
--- a/drivers/mtd/maps/omap_nor.c
+++ b/drivers/mtd/maps/omap_nor.c
@@ -110,7 +110,7 @@ static int __init omapflash_probe(struct platform_device *pdev)
        err = parse_mtd_partitions(info->mtd, part_probes, &info->parts, 0);
        if (err > 0)
                add_mtd_partitions(info->mtd, info->parts, err);
-        else if (err < 0 && pdata->parts)
+        else if (err <= 0 && pdata->parts)
                add_mtd_partitions(info->mtd, pdata->parts, pdata->nr_parts);
        else
 #endif
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index fceb468ccdec..fe2bc7e42119 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1216,7 +1216,7 @@ static int pxa3xx_nand_resume(struct platform_device *pdev)
        clk_enable(info->clk);
-        return pxa3xx_nand_config_flash(info);
+        return pxa3xx_nand_config_flash(info, info->flash_info);
 }
 #else
 #define pxa3xx_nand_suspend     NULL
diff --git a/drivers/mtd/onenand/generic.c b/drivers/mtd/onenand/generic.c
index 3d44d040a47d..ad81ab8e95e2 100644
--- a/drivers/mtd/onenand/generic.c
+++ b/drivers/mtd/onenand/generic.c
@@ -76,7 +76,7 @@ static int __devinit generic_onenand_probe(struct device *dev)
        err = parse_mtd_partitions(&info->mtd, part_probes, &info->parts, 0);
        if (err > 0)
                add_mtd_partitions(&info->mtd, info->parts, err);
-        else if (err < 0 && pdata->parts)
+        else if (err <= 0 && pdata->parts)
                add_mtd_partitions(&info->mtd, pdata->parts, pdata->nr_parts);
        else
 #endif
diff --git a/drivers/mtd/redboot.c b/drivers/mtd/redboot.c
index 47474903263c..c5030f94f04e 100644
--- a/drivers/mtd/redboot.c
+++ b/drivers/mtd/redboot.c
@@ -295,5 +295,5 @@ module_init(redboot_parser_init);
 module_exit(redboot_parser_exit);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Red Hat, Inc. - David Woodhouse <dwmw2@cambridge.redhat.com>");
+MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org>");
 MODULE_DESCRIPTION("Parsing code for RedBoot Flash Image System (FIS) tables");
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index 87d8795823d7..b9d097c9f6bb 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -1062,7 +1062,6 @@ el3_rx(struct net_device *dev)
                        struct sk_buff *skb;
                        skb = dev_alloc_skb(pkt_len+5);
-                        dev->stats.rx_bytes += pkt_len;
                        if (el3_debug > 4)
                                printk("Receiving packet size %d status %4.4x.\n",
                                           pkt_len, rx_status);
@@ -1077,6 +1076,7 @@ el3_rx(struct net_device *dev)
                                skb->protocol = eth_type_trans(skb,dev);
                                netif_rx(skb);
                                dev->last_rx = jiffies;
+                                dev->stats.rx_bytes += pkt_len;
                                dev->stats.rx_packets++;
                                continue;
                        }
diff --git a/drivers/net/7990.c b/drivers/net/7990.c
index 750a46f4bc58..ad6b8a5b6574 100644
--- a/drivers/net/7990.c
+++ b/drivers/net/7990.c
@@ -506,6 +506,7 @@ int lance_open (struct net_device *dev)
        return res;
 }
+EXPORT_SYMBOL_GPL(lance_open);
 int lance_close (struct net_device *dev)
 {
@@ -521,6 +522,7 @@ int lance_close (struct net_device *dev)
        return 0;
 }
+EXPORT_SYMBOL_GPL(lance_close);
 void lance_tx_timeout(struct net_device *dev)
 {
@@ -529,7 +531,7 @@ void lance_tx_timeout(struct net_device *dev)
        dev->trans_start = jiffies;
        netif_wake_queue (dev);
 }
+EXPORT_SYMBOL_GPL(lance_tx_timeout);
 int lance_start_xmit (struct sk_buff *skb, struct net_device *dev)
 {
@@ -586,6 +588,7 @@ int lance_start_xmit (struct sk_buff *skb, struct net_device *dev)
        return 0;
 }
+EXPORT_SYMBOL_GPL(lance_start_xmit);
 /* taken from the depca driver via a2065.c */
 static void lance_load_multicast (struct net_device *dev)
@@ -654,6 +657,7 @@ void lance_set_multicast (struct net_device *dev)
        if (!stopped)
                netif_start_queue (dev);
 }
+EXPORT_SYMBOL_GPL(lance_set_multicast);
 #ifdef CONFIG_NET_POLL_CONTROLLER
 void lance_poll(struct net_device *dev)
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index dd0ec9ebc939..f4182cfffe9d 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2426,7 +2426,7 @@ config CHELSIO_T3
 config EHEA
        tristate "eHEA Ethernet support"
-        depends on IBMEBUS && INET && SPARSEMEM && MEMORY_HOTPLUG
+        depends on IBMEBUS && INET && SPARSEMEM
        select INET_LRO
        ---help---
          This driver supports the IBM pSeries eHEA ethernet adapter.
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 6e4c80d41b08..99e0b4cdc56f 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -637,22 +637,6 @@ static s32 atl1_phy_leave_power_saving(struct atl1_hw *hw)
 }
 /*
- * Force the PHY into power saving mode using vendor magic.
- */
-#ifdef CONFIG_PM
-static void atl1_phy_enter_power_saving(struct atl1_hw *hw)
-{
-        atl1_write_phy_reg(hw, MII_DBG_ADDR, 0);
-        atl1_write_phy_reg(hw, MII_DBG_DATA, 0x124E);
-        atl1_write_phy_reg(hw, MII_DBG_ADDR, 2);
-        atl1_write_phy_reg(hw, MII_DBG_DATA, 0x3000);
-        atl1_write_phy_reg(hw, MII_DBG_ADDR, 3);
-        atl1_write_phy_reg(hw, MII_DBG_DATA, 0);
-}
-#endif
-/*
 * Resets the PHY and make all config validate
 * hw - Struct containing variables accessed by shared code
 *
@@ -2023,6 +2007,7 @@ rrd_ok:
                /* Good Receive */
                pci_unmap_page(adapter->pdev, buffer_info->dma,
                               buffer_info->length, PCI_DMA_FROMDEVICE);
+                buffer_info->dma = 0;
                skb = buffer_info->skb;
                length = le16_to_cpu(rrd->xsz.xsum_sz.pkt_size);
@@ -2859,7 +2844,6 @@ disable_wol:
        ctrl |= PCIE_PHYMISC_FORCE_RCV_DET;
        iowrite32(ctrl, hw->hw_addr + REG_PCIE_PHYMISC);
        ioread32(hw->hw_addr + REG_PCIE_PHYMISC);
-        atl1_phy_enter_power_saving(hw);
        hw->phy_configured = false;
        pci_enable_wake(pdev, pci_choose_state(pdev, state), 0);
 exit:
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index 3634b5fd7919..7023d77bf380 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -1239,12 +1239,7 @@ static int au1000_rx(struct net_device *dev)
 */
 static irqreturn_t au1000_interrupt(int irq, void *dev_id)
 {
-        struct net_device *dev = (struct net_device *) dev_id;
+        struct net_device *dev = dev_id;
-        if (dev == NULL) {
-                printk(KERN_ERR "%s: isr: null dev ptr\n", dev->name);
-                return IRQ_RETVAL(1);
-        }
        /* Handle RX interrupts first to minimize chance of overrun */
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 89c0018132ec..41443435ab1c 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -22,7 +22,6 @@
 #include <linux/crc32.h>
 #include <linux/device.h>
 #include <linux/spinlock.h>
-#include <linux/ethtool.h>
 #include <linux/mii.h>
 #include <linux/phy.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 4b46e68183e0..367b6d462708 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -5724,14 +5724,12 @@ bnx2_reset_task(struct work_struct *work)
        if (!netif_running(bp->dev))
                return;
-        bp->in_reset_task = 1;
        bnx2_netif_stop(bp);
        bnx2_init_nic(bp);
        atomic_set(&bp->intr_sem, 1);
        bnx2_netif_start(bp);
-        bp->in_reset_task = 0;
 }
 static void
@@ -5907,12 +5905,7 @@ bnx2_close(struct net_device *dev)
        struct bnx2 *bp = netdev_priv(dev);
        u32 reset_code;
-        /* Calling flush_scheduled_work() may deadlock because
+        cancel_work_sync(&bp->reset_task);
-         * linkwatch_event() may be on the workqueue and it will try to get
-         * the rtnl_lock which we are holding.
-         */
-        while (bp->in_reset_task)
-                msleep(1);
        bnx2_disable_int_sync(bp);
        bnx2_napi_disable(bp);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 1eaf5bb3d9c2..2377cc13bf61 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6656,7 +6656,6 @@ struct bnx2 {
        int                     current_interval;
        struct                  timer_list timer;
        struct work_struct      reset_task;
-        int                     in_reset_task;
        /* Used to synchronize phy accesses. */
        spinlock_t              phy_lock;
diff --git a/drivers/net/bnx2x.c b/drivers/net/bnx2x.c
index 7bdb5af35951..70cba64732ca 100644
--- a/drivers/net/bnx2x.c
+++ b/drivers/net/bnx2x.c
@@ -6,7 +6,8 @@
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation.
 *
- * Written by: Eliezer Tamir <eliezert@broadcom.com>
+ * Maintained by: Eilon Greenstein <eilong@broadcom.com>
+ * Written by: Eliezer Tamir
 * Based on code from Michael Chan's bnx2 driver
 * UDP CSUM errata workaround by Arik Gendelman
 * Slowpath rework by Vladislav Zolotarov
@@ -74,7 +75,7 @@ static char version[] __devinitdata =
        "Broadcom NetXtreme II 5771X 10Gigabit Ethernet Driver "
        DRV_MODULE_NAME " " DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
-MODULE_AUTHOR("Eliezer Tamir <eliezert@broadcom.com>");
+MODULE_AUTHOR("Eliezer Tamir");
 MODULE_DESCRIPTION("Broadcom NetXtreme II BCM57710 Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_MODULE_VERSION);
diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h
index 4f0c0d31e7c1..8e68d06510a6 100644
--- a/drivers/net/bnx2x.h
+++ b/drivers/net/bnx2x.h
@@ -6,7 +6,8 @@
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation.
 *
- * Written by: Eliezer Tamir <eliezert@broadcom.com>
+ * Maintained by: Eilon Greenstein <eilong@broadcom.com>
+ * Written by: Eliezer Tamir
 * Based on code from Michael Chan's bnx2 driver
 */
diff --git a/drivers/net/bnx2x_init.h b/drivers/net/bnx2x_init.h
index dcaecc53bdb1..370686eef97c 100644
--- a/drivers/net/bnx2x_init.h
+++ b/drivers/net/bnx2x_init.h
@@ -6,7 +6,8 @@
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation.
 *
- * Written by: Eliezer Tamir <eliezert@broadcom.com>
+ * Maintained by: Eilon Greenstein <eilong@broadcom.com>
+ * Written by: Eliezer Tamir
 */
 #ifndef BNX2X_INIT_H
diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
index 2b5740b3d182..7f3f62e1b113 100644
--- a/drivers/net/cpmac.c
+++ b/drivers/net/cpmac.c
@@ -38,6 +38,7 @@
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <asm/gpio.h>
+#include <asm/atomic.h>
 MODULE_AUTHOR("Eugene Konev <ejka@imfi.kspu.ru>");
 MODULE_DESCRIPTION("TI AR7 ethernet driver (CPMAC)");
@@ -187,6 +188,7 @@ struct cpmac_desc {
 #define CPMAC_EOQ                       0x1000
        struct sk_buff *skb;
        struct cpmac_desc *next;
+        struct cpmac_desc *prev;
        dma_addr_t mapping;
        dma_addr_t data_mapping;
 };
@@ -208,6 +210,7 @@ struct cpmac_priv {
        struct work_struct reset_work;
        struct platform_device *pdev;
        struct napi_struct napi;
+        atomic_t reset_pending;
 };
 static irqreturn_t cpmac_irq(int, void *);
@@ -241,6 +244,16 @@ static void cpmac_dump_desc(struct net_device *dev, struct cpmac_desc *desc)
        printk("\n");
 }
+static void cpmac_dump_all_desc(struct net_device *dev)
+{
+        struct cpmac_priv *priv = netdev_priv(dev);
+        struct cpmac_desc *dump = priv->rx_head;
+        do {
+                cpmac_dump_desc(dev, dump);
+                dump = dump->next;
+        } while (dump != priv->rx_head);
+}
 static void cpmac_dump_skb(struct net_device *dev, struct sk_buff *skb)
 {
        int i;
@@ -412,21 +425,42 @@ static struct sk_buff *cpmac_rx_one(struct cpmac_priv *priv,
 static int cpmac_poll(struct napi_struct *napi, int budget)
 {
        struct sk_buff *skb;
-        struct cpmac_desc *desc;
+        struct cpmac_desc *desc, *restart;
-        int received = 0;
        struct cpmac_priv *priv = container_of(napi, struct cpmac_priv, napi);
+        int received = 0, processed = 0;
        spin_lock(&priv->rx_lock);
        if (unlikely(!priv->rx_head)) {
                if (netif_msg_rx_err(priv) && net_ratelimit())
                        printk(KERN_WARNING "%s: rx: polling, but no queue\n",
                               priv->dev->name);
+                spin_unlock(&priv->rx_lock);
                netif_rx_complete(priv->dev, napi);
                return 0;
        }
        desc = priv->rx_head;
+        restart = NULL;
        while (((desc->dataflags & CPMAC_OWN) == 0) && (received < budget)) {
+                processed++;
+                if ((desc->dataflags & CPMAC_EOQ) != 0) {
+                        /* The last update to eoq->hw_next didn't happen
+                        * soon enough, and the receiver stopped here.
+                        *Remember this descriptor so we can restart
+                        * the receiver after freeing some space.
+                        */
+                        if (unlikely(restart)) {
+                                if (netif_msg_rx_err(priv))
+                                        printk(KERN_ERR "%s: poll found a"
+                                                " duplicate EOQ: %p and %p\n",
+                                                priv->dev->name, restart, desc);
+                                goto fatal_error;
+                        }
+                        restart = desc->next;
+                }
                skb = cpmac_rx_one(priv, desc);
                if (likely(skb)) {
                        netif_receive_skb(skb);
@@ -435,19 +469,90 @@ static int cpmac_poll(struct napi_struct *napi, int budget)
                desc = desc->next;
        }
+        if (desc != priv->rx_head) {
+                /* We freed some buffers, but not the whole ring,
+                 * add what we did free to the rx list */
+                desc->prev->hw_next = (u32)0;
+                priv->rx_head->prev->hw_next = priv->rx_head->mapping;
+        }
+        /* Optimization: If we did not actually process an EOQ (perhaps because
+         * of quota limits), check to see if the tail of the queue has EOQ set.
+        * We should immediately restart in that case so that the receiver can
+        * restart and run in parallel with more packet processing.
+        * This lets us handle slightly larger bursts before running
+        * out of ring space (assuming dev->weight < ring_size) */
+        if (!restart &&
+             (priv->rx_head->prev->dataflags & (CPMAC_OWN|CPMAC_EOQ))
+                    == CPMAC_EOQ &&
+             (priv->rx_head->dataflags & CPMAC_OWN) != 0) {
+                /* reset EOQ so the poll loop (above) doesn't try to
+                * restart this when it eventually gets to this descriptor.
+                */
+                priv->rx_head->prev->dataflags &= ~CPMAC_EOQ;
+                restart = priv->rx_head;
+        }
+        if (restart) {
+                priv->dev->stats.rx_errors++;
+                priv->dev->stats.rx_fifo_errors++;
+                if (netif_msg_rx_err(priv) && net_ratelimit())
+                        printk(KERN_WARNING "%s: rx dma ring overrun\n",
+                               priv->dev->name);
+                if (unlikely((restart->dataflags & CPMAC_OWN) == 0)) {
+                        if (netif_msg_drv(priv))
+                                printk(KERN_ERR "%s: cpmac_poll is trying to "
+                                        "restart rx from a descriptor that's "
+                                        "not free: %p\n",
+                                        priv->dev->name, restart);
+                                goto fatal_error;
+                }
+                cpmac_write(priv->regs, CPMAC_RX_PTR(0), restart->mapping);
+        }
        priv->rx_head = desc;
        spin_unlock(&priv->rx_lock);
        if (unlikely(netif_msg_rx_status(priv)))
                printk(KERN_DEBUG "%s: poll processed %d packets\n",
                       priv->dev->name, received);
-        if (desc->dataflags & CPMAC_OWN) {
+        if (processed == 0) {
+                /* we ran out of packets to read,
+                 * revert to interrupt-driven mode */
                netif_rx_complete(priv->dev, napi);
-                cpmac_write(priv->regs, CPMAC_RX_PTR(0), (u32)desc->mapping);
                cpmac_write(priv->regs, CPMAC_RX_INT_ENABLE, 1);
                return 0;
        }
        return 1;
+fatal_error:
+        /* Something went horribly wrong.
+         * Reset hardware to try to recover rather than wedging. */
+        if (netif_msg_drv(priv)) {
+                printk(KERN_ERR "%s: cpmac_poll is confused. "
+                                "Resetting hardware\n", priv->dev->name);
+                cpmac_dump_all_desc(priv->dev);
+                printk(KERN_DEBUG "%s: RX_PTR(0)=0x%08x RX_ACK(0)=0x%08x\n",
+                        priv->dev->name,
+                        cpmac_read(priv->regs, CPMAC_RX_PTR(0)),
+                        cpmac_read(priv->regs, CPMAC_RX_ACK(0)));
+        }
+        spin_unlock(&priv->rx_lock);
+        netif_rx_complete(priv->dev, napi);
+        netif_stop_queue(priv->dev);
+        napi_disable(&priv->napi);
+        atomic_inc(&priv->reset_pending);
+        cpmac_hw_stop(priv->dev);
+        if (!schedule_work(&priv->reset_work))
+                atomic_dec(&priv->reset_pending);
+        return 0;
 }
 static int cpmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -456,6 +561,9 @@ static int cpmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
        struct cpmac_desc *desc;
        struct cpmac_priv *priv = netdev_priv(dev);
+        if (unlikely(atomic_read(&priv->reset_pending)))
+                return NETDEV_TX_BUSY;
        if (unlikely(skb_padto(skb, ETH_ZLEN)))
                return NETDEV_TX_OK;
@@ -621,8 +729,10 @@ static void cpmac_clear_rx(struct net_device *dev)
                        desc->dataflags = CPMAC_OWN;
                        dev->stats.rx_dropped++;
                }
+                desc->hw_next = desc->next->mapping;
                desc = desc->next;
        }
+        priv->rx_head->prev->hw_next = 0;
 }
 static void cpmac_clear_tx(struct net_device *dev)
@@ -635,14 +745,14 @@ static void cpmac_clear_tx(struct net_device *dev)
                priv->desc_ring[i].dataflags = 0;
                if (priv->desc_ring[i].skb) {
                        dev_kfree_skb_any(priv->desc_ring[i].skb);
-                        if (netif_subqueue_stopped(dev, i))
+                        priv->desc_ring[i].skb = NULL;
-                            netif_wake_subqueue(dev, i);
                }
        }
 }
 static void cpmac_hw_error(struct work_struct *work)
 {
+        int i;
        struct cpmac_priv *priv =
                container_of(work, struct cpmac_priv, reset_work);
@@ -651,8 +761,48 @@ static void cpmac_hw_error(struct work_struct *work)
        spin_unlock(&priv->rx_lock);
        cpmac_clear_tx(priv->dev);
        cpmac_hw_start(priv->dev);
-        napi_enable(&priv->napi);
+        barrier();
-        netif_start_queue(priv->dev);
+        atomic_dec(&priv->reset_pending);
+        for (i = 0; i < CPMAC_QUEUES; i++)
+                netif_wake_subqueue(priv->dev, i);
+        netif_wake_queue(priv->dev);
+        cpmac_write(priv->regs, CPMAC_MAC_INT_ENABLE, 3);
+}
+static void cpmac_check_status(struct net_device *dev)
+{
+        struct cpmac_priv *priv = netdev_priv(dev);
+        u32 macstatus = cpmac_read(priv->regs, CPMAC_MAC_STATUS);
+        int rx_channel = (macstatus >> 8) & 7;
+        int rx_code = (macstatus >> 12) & 15;
+        int tx_channel = (macstatus >> 16) & 7;
+        int tx_code = (macstatus >> 20) & 15;
+        if (rx_code || tx_code) {
+                if (netif_msg_drv(priv) && net_ratelimit()) {
+                        /* Can't find any documentation on what these
+                         *error codes actually are. So just log them and hope..
+                         */
+                        if (rx_code)
+                                printk(KERN_WARNING "%s: host error %d on rx "
+                                     "channel %d (macstatus %08x), resetting\n",
+                                     dev->name, rx_code, rx_channel, macstatus);
+                        if (tx_code)
+                                printk(KERN_WARNING "%s: host error %d on tx "
+                                     "channel %d (macstatus %08x), resetting\n",
+                                     dev->name, tx_code, tx_channel, macstatus);
+                }
+                netif_stop_queue(dev);
+                cpmac_hw_stop(dev);
+                if (schedule_work(&priv->reset_work))
+                        atomic_inc(&priv->reset_pending);
+                if (unlikely(netif_msg_hw(priv)))
+                        cpmac_dump_regs(dev);
+        }
+        cpmac_write(priv->regs, CPMAC_MAC_INT_CLEAR, 0xff);
 }
 static irqreturn_t cpmac_irq(int irq, void *dev_id)
@@ -683,49 +833,32 @@ static irqreturn_t cpmac_irq(int irq, void *dev_id)
        cpmac_write(priv->regs, CPMAC_MAC_EOI_VECTOR, 0);
-        if (unlikely(status & (MAC_INT_HOST | MAC_INT_STATUS))) {
+        if (unlikely(status & (MAC_INT_HOST | MAC_INT_STATUS)))
-                if (netif_msg_drv(priv) && net_ratelimit())
+                cpmac_check_status(dev);
-                        printk(KERN_ERR "%s: hw error, resetting...\n",
-                               dev->name);
-                netif_stop_queue(dev);
-                napi_disable(&priv->napi);
-                cpmac_hw_stop(dev);
-                schedule_work(&priv->reset_work);
-                if (unlikely(netif_msg_hw(priv)))
-                        cpmac_dump_regs(dev);
-        }
        return IRQ_HANDLED;
 }
 static void cpmac_tx_timeout(struct net_device *dev)
 {
-        struct cpmac_priv *priv = netdev_priv(dev);
        int i;
+        struct cpmac_priv *priv = netdev_priv(dev);
        spin_lock(&priv->lock);
        dev->stats.tx_errors++;
        spin_unlock(&priv->lock);
        if (netif_msg_tx_err(priv) && net_ratelimit())
                printk(KERN_WARNING "%s: transmit timeout\n", dev->name);
-        /* 
-         * FIXME: waking up random queue is not the best thing to
+        atomic_inc(&priv->reset_pending);
-         * do... on the other hand why we got here at all?
+        barrier();
-         */
+        cpmac_clear_tx(dev);
-#ifdef CONFIG_NETDEVICES_MULTIQUEUE
+        barrier();
+        atomic_dec(&priv->reset_pending);
+        netif_wake_queue(priv->dev);
        for (i = 0; i < CPMAC_QUEUES; i++)
-                if (priv->desc_ring[i].skb) {
+                netif_wake_subqueue(dev, i);
-                        priv->desc_ring[i].dataflags = 0;
-                        dev_kfree_skb_any(priv->desc_ring[i].skb);
-                        netif_wake_subqueue(dev, i);
-                        break;
-                }
-#else
-        priv->desc_ring[0].dataflags = 0;
-        if (priv->desc_ring[0].skb)
-                dev_kfree_skb_any(priv->desc_ring[0].skb);
-        netif_wake_queue(dev);
-#endif
 }
 static int cpmac_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -901,9 +1034,12 @@ static int cpmac_open(struct net_device *dev)
                desc->buflen = CPMAC_SKB_SIZE;
                desc->dataflags = CPMAC_OWN;
                desc->next = &priv->rx_head[(i + 1) % priv->ring_size];
+                desc->next->prev = desc;
                desc->hw_next = (u32)desc->next->mapping;
        }
+        priv->rx_head->prev->hw_next = (u32)0;
        if ((res = request_irq(dev->irq, cpmac_irq, IRQF_SHARED,
                               dev->name, dev))) {
                if (netif_msg_drv(priv))
@@ -912,6 +1048,7 @@ static int cpmac_open(struct net_device *dev)
                goto fail_irq;
        }
+        atomic_set(&priv->reset_pending, 0);
        INIT_WORK(&priv->reset_work, cpmac_hw_error);
        cpmac_hw_start(dev);
@@ -1007,21 +1144,10 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
        if (phy_id == PHY_MAX_ADDR) {
                if (external_switch || dumb_switch) {
-                        struct fixed_phy_status status = {};
+                        mdio_bus_id = 0; /* fixed phys bus */
+                        phy_id = pdev->id;
-                        /*
-                         * FIXME: this should be in the platform code!
-                         * Since there is not platform code at all (that is,
-                         * no mainline users of that driver), place it here
-                         * for now.
-                         */
-                        phy_id = 0;
-                        status.link = 1;
-                        status.duplex = 1;
-                        status.speed = 100;
-                        fixed_phy_add(PHY_POLL, phy_id, &status);
                } else {
-                        printk(KERN_ERR "cpmac: no PHY present\n");
+                        dev_err(&pdev->dev, "no PHY present\n");
                        return -ENODEV;
                }
        }
@@ -1064,10 +1190,8 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
        priv->msg_enable = netif_msg_init(debug_level, 0xff);
        memcpy(dev->dev_addr, pdata->dev_addr, sizeof(dev->dev_addr));
-        snprintf(priv->phy_name, BUS_ID_SIZE, PHY_ID_FMT, mdio_bus_id, phy_id);
+        priv->phy = phy_connect(dev, cpmac_mii.phy_map[phy_id]->dev.bus_id,
+                                &cpmac_adjust_link, 0, PHY_INTERFACE_MODE_MII);
-        priv->phy = phy_connect(dev, priv->phy_name, &cpmac_adjust_link, 0,
-                                PHY_INTERFACE_MODE_MII);
        if (IS_ERR(priv->phy)) {
                if (netif_msg_drv(priv))
                        printk(KERN_ERR "%s: Could not attach to PHY\n",
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index 348371fda597..fba87abe78ee 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -1394,7 +1394,11 @@ net_open(struct net_device *dev)
 #endif
        if (!result) {
                printk(KERN_ERR "%s: EEPROM is configured for unavailable media\n", dev->name);
-        release_irq:
+release_dma:
+#if ALLOW_DMA
+                free_dma(dev->dma);
+#endif
+release_irq:
 #if ALLOW_DMA
                release_dma_buff(lp);
 #endif
@@ -1442,12 +1446,12 @@ net_open(struct net_device *dev)
                        if ((result = detect_bnc(dev)) != DETECTED_NONE)
                                break;
                printk(KERN_ERR "%s: no media detected\n", dev->name);
-                goto release_irq;
+                goto release_dma;
        }
        switch(result) {
        case DETECTED_NONE:
                printk(KERN_ERR "%s: no network cable attached to configured media\n", dev->name);
-                goto release_irq;
+                goto release_dma;
        case DETECTED_RJ45H:
                printk(KERN_INFO "%s: using half-duplex 10Base-T (RJ-45)\n", dev->name);
                break;
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index d45bcd2660af..864295e081b6 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -903,7 +903,7 @@ dm9000_stop(struct net_device *ndev)
        if (netif_msg_ifdown(db))
                dev_dbg(db->dev, "shutting down %s\n", ndev->name);
-        cancel_delayed_work(&db->phy_poll);
+        cancel_delayed_work_sync(&db->phy_poll);
        netif_stop_queue(ndev);
        netif_carrier_off(ndev);
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 8cbb40f3a506..cab1835173cd 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4201,8 +4201,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        struct e1000_adapter *adapter;
        struct e1000_hw *hw;
        const struct e1000_info *ei = e1000_info_tbl[ent->driver_data];
-        unsigned long mmio_start, mmio_len;
+        resource_size_t mmio_start, mmio_len;
-        unsigned long flash_start, flash_len;
+        resource_size_t flash_start, flash_len;
        static int cards_found;
        int i, err, pci_using_dac;
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index d1b6d4e7495d..075fd547421e 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -1766,16 +1766,20 @@ static int ehea_set_mac_addr(struct net_device *dev, void *sa)
        mutex_lock(&ehea_bcmc_regs.lock);
        /* Deregister old MAC in pHYP */
-        ret = ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
+        if (port->state == EHEA_PORT_UP) {
-        if (ret)
+                ret = ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
-                goto out_upregs;
+                if (ret)
+                        goto out_upregs;
+        }
        port->mac_addr = cb0->port_mac_addr << 16;
        /* Register new MAC in pHYP */
-        ret = ehea_broadcast_reg_helper(port, H_REG_BCMC);
+        if (port->state == EHEA_PORT_UP) {
-        if (ret)
+                ret = ehea_broadcast_reg_helper(port, H_REG_BCMC);
-                goto out_upregs;
+                if (ret)
+                        goto out_upregs;
+        }
        ret = 0;
@@ -2213,8 +2217,6 @@ static void ehea_vlan_rx_register(struct net_device *dev,
                goto out;
        }
-        memset(cb1->vlan_filter, 0, sizeof(cb1->vlan_filter));
        hret = ehea_h_modify_ehea_port(adapter->handle, port->logical_port_id,
                                       H_PORT_CB1, H_PORT_CB1_ALL, cb1);
        if (hret != H_SUCCESS)
@@ -2603,7 +2605,8 @@ static int ehea_stop(struct net_device *dev)
        if (netif_msg_ifdown(port))
                ehea_info("disabling port %s", dev->name);
-        flush_scheduled_work();
+        cancel_work_sync(&port->reset_task);
        mutex_lock(&port->port_lock);
        netif_stop_queue(dev);
        port_napi_disable(port);
@@ -3178,11 +3181,12 @@ out_err:
 static void ehea_shutdown_single_port(struct ehea_port *port)
 {
+        struct ehea_adapter *adapter = port->adapter;
        unregister_netdev(port->netdev);
        ehea_unregister_port(port);
        kfree(port->mc_list);
        free_netdev(port->netdev);
-        port->adapter->active_ports--;
+        adapter->active_ports--;
 }
 static int ehea_setup_ports(struct ehea_adapter *adapter)
diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index 5f9c42e7a7f1..329edd9c08fc 100644
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -78,7 +78,7 @@ module_param_array_named(mac, mpc52xx_fec_mac_addr, byte, NULL, 0);
 MODULE_PARM_DESC(mac, "six hex digits, ie. 0x1,0x2,0xc0,0x01,0xba,0xbe");
 #define MPC52xx_MESSAGES_DEFAULT ( NETIF_MSG_DRV | NETIF_MSG_PROBE | \
-                NETIF_MSG_LINK | NETIF_MSG_IFDOWN | NETIF_MSG_IFDOWN )
+                NETIF_MSG_LINK | NETIF_MSG_IFDOWN | NETIF_MSG_IFUP)
 static int debug = -1;  /* the above default */
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "debugging messages level");
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 35f66d4a4595..2cb244763292 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -3273,6 +3273,20 @@ static void nv_link_irq(struct net_device *dev)
        dprintk(KERN_DEBUG "%s: link change notification done.\n", dev->name);
 }
+static void nv_msi_workaround(struct fe_priv *np)
+{
+        /* Need to toggle the msi irq mask within the ethernet device,
+         * otherwise, future interrupts will not be detected.
+         */
+        if (np->msi_flags & NV_MSI_ENABLED) {
+                u8 __iomem *base = np->base;
+                writel(0, base + NvRegMSIIrqMask);
+                writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
+        }
+}
 static irqreturn_t nv_nic_irq(int foo, void *data)
 {
        struct net_device *dev = (struct net_device *) data;
@@ -3295,6 +3309,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
                if (!(events & np->irqmask))
                        break;
+                nv_msi_workaround(np);
                spin_lock(&np->lock);
                nv_tx_done(dev);
                spin_unlock(&np->lock);
@@ -3410,6 +3426,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
                if (!(events & np->irqmask))
                        break;
+                nv_msi_workaround(np);
                spin_lock(&np->lock);
                nv_tx_done_optimized(dev, TX_WORK_PER_LOOP);
                spin_unlock(&np->lock);
@@ -3750,6 +3768,8 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
        if (!(events & NVREG_IRQ_TIMER))
                return IRQ_RETVAL(0);
+        nv_msi_workaround(np);
        spin_lock(&np->lock);
        np->intr_test = 1;
        spin_unlock(&np->lock);
@@ -5823,6 +5843,7 @@ static int nv_resume(struct pci_dev *pdev)
        writel(txreg, base + NvRegTransmitPoll);
        rc = nv_open(dev);
+        nv_set_multicast(dev);
 out:
        return rc;
 }
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index 67b4b0728fce..a5baaf59ff66 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -1093,7 +1093,7 @@ err:
                if (registered)
                        unregister_netdev(ndev);
-                if (fep != NULL) {
+                if (fep && fep->ops) {
                        (*fep->ops->free_bd)(ndev);
                        (*fep->ops->cleanup_data)(ndev);
                }
diff --git a/drivers/net/hamradio/baycom_epp.c b/drivers/net/hamradio/baycom_epp.c
index dde9c7e6408a..00bc7fbb6b37 100644
--- a/drivers/net/hamradio/baycom_epp.c
+++ b/drivers/net/hamradio/baycom_epp.c
@@ -959,7 +959,7 @@ static int epp_close(struct net_device *dev)
        unsigned char tmp[1];
        bc->work_running = 0;
-        flush_scheduled_work();
+        cancel_delayed_work_sync(&bc->run_work);
        bc->stat = EPP_DCDBIT;
        tmp[0] = 0;
        pp->ops->epp_write_addr(pp, tmp, 1, 0);
diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c
index f90515935833..45ae9d1191d7 100644
--- a/drivers/net/hamradio/scc.c
+++ b/drivers/net/hamradio/scc.c
@@ -1340,9 +1340,10 @@ static unsigned int scc_set_param(struct scc_channel *scc, unsigned int cmd, uns
                case PARAM_RTS: 
                        if ( !(scc->wreg[R5] & RTS) )
                        {
-                                if (arg != TX_OFF)
+                                if (arg != TX_OFF) {
                                        scc_key_trx(scc, TX_ON);
                                        scc_start_tx_timer(scc, t_txdelay, scc->kiss.txdelay);
+                                }
                        } else {
                                if (arg == TX_OFF)
                                {
diff --git a/drivers/net/ipg.c b/drivers/net/ipg.c
index 9b358f61ed7f..679a0826780e 100644
--- a/drivers/net/ipg.c
+++ b/drivers/net/ipg.c
@@ -577,12 +577,12 @@ static void ipg_nic_set_multicast_list(struct net_device *dev)
                /* NIC to be configured in promiscuous mode. */
                receivemode = IPG_RM_RECEIVEALLFRAMES;
        } else if ((dev->flags & IFF_ALLMULTI) ||
-                   (dev->flags & IFF_MULTICAST &
+                   ((dev->flags & IFF_MULTICAST) &&
                    (dev->mc_count > IPG_MULTICAST_HASHTABLE_SIZE))) {
                /* NIC to be configured to receive all multicast
                 * frames. */
                receivemode |= IPG_RM_RECEIVEMULTICAST;
-        } else if (dev->flags & IFF_MULTICAST & (dev->mc_count > 0)) {
+        } else if ((dev->flags & IFF_MULTICAST) && (dev->mc_count > 0)) {
                /* NIC to be configured to receive selected
                 * multicast addresses. */
                receivemode |= IPG_RM_RECEIVEMULTICASTHASH;
diff --git a/drivers/net/irda/Kconfig b/drivers/net/irda/Kconfig
index ce816ba9c40d..e6317557a531 100644
--- a/drivers/net/irda/Kconfig
+++ b/drivers/net/irda/Kconfig
@@ -329,6 +329,7 @@ config PXA_FICP
 config MCS_FIR
        tristate "MosChip MCS7780 IrDA-USB dongle"
        depends on IRDA && USB && EXPERIMENTAL
+        select CRC32
        help
          Say Y or M here if you want to build support for the MosChip
          MCS7780 IrDA-USB bridge device driver.
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index 6321b059ce13..2f38e847e2cd 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -58,8 +58,8 @@ static s32 ixgbe_reset_hw_82598(struct ixgbe_hw *hw);
 static s32 ixgbe_get_invariants_82598(struct ixgbe_hw *hw)
 {
-        hw->mac.num_rx_queues = IXGBE_82598_MAX_TX_QUEUES;
+        hw->mac.num_rx_queues = IXGBE_82598_MAX_RX_QUEUES;
-        hw->mac.num_tx_queues = IXGBE_82598_MAX_RX_QUEUES;
+        hw->mac.num_tx_queues = IXGBE_82598_MAX_TX_QUEUES;
        hw->mac.num_rx_addrs = IXGBE_82598_RAR_ENTRIES;
        /* PHY ops are filled in by default properly for Fiber only */
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index c91b12ea26ad..e0d76c75aea0 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -75,7 +75,7 @@
 #include "myri10ge_mcp.h"
 #include "myri10ge_mcp_gen_header.h"
-#define MYRI10GE_VERSION_STR "1.3.2-1.287"
+#define MYRI10GE_VERSION_STR "1.3.99-1.347"
 MODULE_DESCRIPTION("Myricom 10G driver (10GbE)");
 MODULE_AUTHOR("Maintainer: help@myri.com");
@@ -631,7 +631,7 @@ static int myri10ge_adopt_running_firmware(struct myri10ge_priv *mgp)
        return status;
 }
-int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
+static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
 {
        struct myri10ge_cmd cmd;
        int status;
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index 8f328a03847b..a550c9bd126f 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -391,7 +391,9 @@ static int fmvj18x_config(struct pcmcia_device *link)
            cardtype = CONTEC;
            break;
        case MANFID_FUJITSU:
-            if (link->card_id == PRODID_FUJITSU_MBH10302)
+            if (link->conf.ConfigBase == 0x0fe0)
+                cardtype = MBH10302;
+            else if (link->card_id == PRODID_FUJITSU_MBH10302) 
                /* RATOC REX-5588/9822/4886's PRODID are 0004(=MBH10302),
                   but these are MBH10304 based card. */ 
                cardtype = MBH10304;
diff --git a/drivers/net/pcmcia/xirc2ps_cs.c b/drivers/net/pcmcia/xirc2ps_cs.c
index d041f831a18d..f6c4698ce738 100644
--- a/drivers/net/pcmcia/xirc2ps_cs.c
+++ b/drivers/net/pcmcia/xirc2ps_cs.c
@@ -1461,22 +1461,25 @@ static void
 set_multicast_list(struct net_device *dev)
 {
    unsigned int ioaddr = dev->base_addr;
+    unsigned value;
    SelectPage(0x42);
+    value = GetByte(XIRCREG42_SWC1) & 0xC0;
    if (dev->flags & IFF_PROMISC) { /* snoop */
-        PutByte(XIRCREG42_SWC1, 0x06); /* set MPE and PME */
+        PutByte(XIRCREG42_SWC1, value | 0x06); /* set MPE and PME */
    } else if (dev->mc_count > 9 || (dev->flags & IFF_ALLMULTI)) {
-        PutByte(XIRCREG42_SWC1, 0x02); /* set MPE */
+        PutByte(XIRCREG42_SWC1, value | 0x02); /* set MPE */
    } else if (dev->mc_count) {
        /* the chip can filter 9 addresses perfectly */
-        PutByte(XIRCREG42_SWC1, 0x01);
+        PutByte(XIRCREG42_SWC1, value | 0x01);
        SelectPage(0x40);
        PutByte(XIRCREG40_CMD0, Offline);
        set_addresses(dev);
        SelectPage(0x40);
        PutByte(XIRCREG40_CMD0, EnableRecv | Online);
    } else { /* standard usage */
-        PutByte(XIRCREG42_SWC1, 0x00);
+        PutByte(XIRCREG42_SWC1, value | 0x00);
    }
    SelectPage(0);
 }
@@ -1722,6 +1725,7 @@ do_reset(struct net_device *dev, int full)
    /* enable receiver and put the mac online */
    if (full) {
+        set_multicast_list(dev);
        SelectPage(0x40);
        PutByte(XIRCREG40_CMD0, EnableRecv | Online);
    }
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index a1c454dbc164..1c89b97f4e09 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -325,7 +325,7 @@ static int pcnet32_get_regs_len(struct net_device *dev);
 static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
                             void *ptr);
 static void pcnet32_purge_tx_ring(struct net_device *dev);
-static int pcnet32_alloc_ring(struct net_device *dev, char *name);
+static int pcnet32_alloc_ring(struct net_device *dev, const char *name);
 static void pcnet32_free_ring(struct net_device *dev);
 static void pcnet32_check_media(struct net_device *dev, int verbose);
@@ -1983,7 +1983,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 }
 /* if any allocation fails, caller must also call pcnet32_free_ring */
-static int pcnet32_alloc_ring(struct net_device *dev, char *name)
+static int pcnet32_alloc_ring(struct net_device *dev, const char *name)
 {
        struct pcnet32_private *lp = netdev_priv(dev);
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 6bf9e76b0a00..6eb2d31d1e34 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -5,7 +5,7 @@
 menuconfig PHYLIB
        tristate "PHY Device support and infrastructure"
        depends on !S390
-        depends on NET_ETHERNET && (BROKEN || !S390)
+        depends on NET_ETHERNET
        help
          Ethernet controllers are usually attached to PHY
          devices.  This option provides infrastructure for
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index ac3c01d28fdf..16a0e7de5888 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -207,6 +207,7 @@ int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id)
        return 0;
 }
+EXPORT_SYMBOL(get_phy_id);
 /**
 * get_phy_device - reads the specified PHY device and returns its @phy_device struct
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 58a26a47af29..bafb69b6f7cb 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -341,12 +341,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
        struct pppox_sock *relay_po;
        if (sk->sk_state & PPPOX_BOUND) {
-                struct pppoe_hdr *ph = pppoe_hdr(skb);
-                int len = ntohs(ph->length);
-                skb_pull_rcsum(skb, sizeof(struct pppoe_hdr));
-                if (pskb_trim_rcsum(skb, len))
-                        goto abort_kfree;
                ppp_input(&po->chan, skb);
        } else if (sk->sk_state & PPPOX_RELAY) {
                relay_po = get_item_by_addr(&po->pppoe_relay);
@@ -357,7 +351,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
                if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
                        goto abort_put;
-                skb_pull(skb, sizeof(struct pppoe_hdr));
                if (!__pppoe_xmit(sk_pppox(relay_po), skb))
                        goto abort_put;
        } else {
@@ -388,6 +381,7 @@ static int pppoe_rcv(struct sk_buff *skb,
 {
        struct pppoe_hdr *ph;
        struct pppox_sock *po;
+        int len;
        if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                goto out;
@@ -399,10 +393,21 @@ static int pppoe_rcv(struct sk_buff *skb,
                goto drop;
        ph = pppoe_hdr(skb);
+        len = ntohs(ph->length);
+        skb_pull_rcsum(skb, sizeof(*ph));
+        if (skb->len < len)
+                goto drop;
        po = get_item(ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
-        if (po != NULL)
+        if (!po)
-                return sk_receive_skb(sk_pppox(po), skb, 0);
+                goto drop;
+        if (pskb_trim_rcsum(skb, len))
+                goto drop;
+        return sk_receive_skb(sk_pppox(po), skb, 0);
 drop:
        kfree_skb(skb);
 out:
@@ -427,12 +432,12 @@ static int pppoe_disc_rcv(struct sk_buff *skb,
        if (dev_net(dev) != &init_net)
                goto abort;
-        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
-                goto abort;
        if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                goto out;
+        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
+                goto abort;
        ph = pppoe_hdr(skb);
        if (ph->code != PADT_CODE)
                goto abort;
@@ -937,12 +942,10 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
        m->msg_namelen = 0;
        if (skb) {
-                struct pppoe_hdr *ph = pppoe_hdr(skb);
+                total_len = min(total_len, skb->len);
-                const int len = ntohs(ph->length);
+                error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
-                error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len);
                if (error == 0)
-                        error = len;
+                        error = total_len;
        }
        kfree_skb(skb);
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index 8db342f2fdc9..f9298827a76c 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -240,12 +240,15 @@ static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)
        if (sk == NULL)
                return NULL;
+        sock_hold(sk);
        session = (struct pppol2tp_session *)(sk->sk_user_data);
-        if (session == NULL)
+        if (session == NULL) {
-                return NULL;
+                sock_put(sk);
+                goto out;
+        }
        BUG_ON(session->magic != L2TP_SESSION_MAGIC);
+out:
        return session;
 }
@@ -256,12 +259,15 @@ static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)
        if (sk == NULL)
                return NULL;
+        sock_hold(sk);
        tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);
-        if (tunnel == NULL)
+        if (tunnel == NULL) {
-                return NULL;
+                sock_put(sk);
+                goto out;
+        }
        BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
+out:
        return tunnel;
 }
@@ -716,12 +722,14 @@ discard:
        session->stats.rx_errors++;
        kfree_skb(skb);
        sock_put(session->sock);
+        sock_put(sock);
        return 0;
 error:
        /* Put UDP header back */
        __skb_push(skb, sizeof(struct udphdr));
+        sock_put(sock);
 no_tunnel:
        return 1;
@@ -745,10 +753,13 @@ static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
               "%s: received %d bytes\n", tunnel->name, skb->len);
        if (pppol2tp_recv_core(sk, skb))
-                goto pass_up;
+                goto pass_up_put;
+        sock_put(sk);
        return 0;
+pass_up_put:
+        sock_put(sk);
 pass_up:
        return 1;
 }
@@ -772,14 +783,18 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
        err = 0;
        skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                flags & MSG_DONTWAIT, &err);
-        if (skb) {
+        if (!skb)
-                err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data,
+                goto end;
-                                     skb->len);
-                if (err < 0)
+        if (len > skb->len)
-                        goto do_skb_free;
+                len = skb->len;
-                err = skb->len;
+        else if (len < skb->len)
-        }
+                msg->msg_flags |= MSG_TRUNC;
-do_skb_free:
+        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len);
+        if (likely(err == 0))
+                err = len;
        kfree_skb(skb);
 end:
        return err;
@@ -858,7 +873,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
        tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
        if (tunnel == NULL)
-                goto error;
+                goto error_put_sess;
        /* What header length is configured for this session? */
        hdr_len = pppol2tp_l2tp_header_len(session);
@@ -870,7 +885,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
                           sizeof(ppph) + total_len,
                           0, GFP_KERNEL);
        if (!skb)
-                goto error;
+                goto error_put_sess_tun;
        /* Reserve space for headers. */
        skb_reserve(skb, NET_SKB_PAD);
@@ -900,7 +915,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
        error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
        if (error < 0) {
                kfree_skb(skb);
-                goto error;
+                goto error_put_sess_tun;
        }
        skb_put(skb, total_len);
@@ -947,10 +962,33 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
                session->stats.tx_errors++;
        }
+        return error;
+error_put_sess_tun:
+        sock_put(session->tunnel_sock);
+error_put_sess:
+        sock_put(sk);
 error:
        return error;
 }
+/* Automatically called when the skb is freed.
+ */
+static void pppol2tp_sock_wfree(struct sk_buff *skb)
+{
+        sock_put(skb->sk);
+}
+/* For data skbs that we transmit, we associate with the tunnel socket
+ * but don't do accounting.
+ */
+static inline void pppol2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
+{
+        sock_hold(sk);
+        skb->sk = sk;
+        skb->destructor = pppol2tp_sock_wfree;
+}
 /* Transmit function called by generic PPP driver.  Sends PPP frame
 * over PPPoL2TP socket.
 *
@@ -993,10 +1031,10 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        sk_tun = session->tunnel_sock;
        if (sk_tun == NULL)
-                goto abort;
+                goto abort_put_sess;
        tunnel = pppol2tp_sock_to_tunnel(sk_tun);
        if (tunnel == NULL)
-                goto abort;
+                goto abort_put_sess;
        /* What header length is configured for this session? */
        hdr_len = pppol2tp_l2tp_header_len(session);
@@ -1009,7 +1047,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                sizeof(struct udphdr) + hdr_len + sizeof(ppph);
        old_headroom = skb_headroom(skb);
        if (skb_cow_head(skb, headroom))
-                goto abort;
+                goto abort_put_sess_tun;
        new_headroom = skb_headroom(skb);
        skb_orphan(skb);
@@ -1069,7 +1107,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        /* Get routing info from the tunnel socket */
        dst_release(skb->dst);
        skb->dst = dst_clone(__sk_dst_get(sk_tun));
-        skb->sk = sk_tun;
+        pppol2tp_skb_set_owner_w(skb, sk_tun);
        /* Queue the packet to IP for output */
        len = skb->len;
@@ -1086,8 +1124,14 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                session->stats.tx_errors++;
        }
+        sock_put(sk_tun);
+        sock_put(sk);
        return 1;
+abort_put_sess_tun:
+        sock_put(sk_tun);
+abort_put_sess:
+        sock_put(sk);
 abort:
        /* Free the original skb */
        kfree_skb(skb);
@@ -1191,7 +1235,7 @@ static void pppol2tp_tunnel_destruct(struct sock *sk)
 {
        struct pppol2tp_tunnel *tunnel;
-        tunnel = pppol2tp_sock_to_tunnel(sk);
+        tunnel = sk->sk_user_data;
        if (tunnel == NULL)
                goto end;
@@ -1230,10 +1274,12 @@ static void pppol2tp_session_destruct(struct sock *sk)
        if (sk->sk_user_data != NULL) {
                struct pppol2tp_tunnel *tunnel;
-                session = pppol2tp_sock_to_session(sk);
+                session = sk->sk_user_data;
                if (session == NULL)
                        goto out;
+                BUG_ON(session->magic != L2TP_SESSION_MAGIC);
                /* Don't use pppol2tp_sock_to_tunnel() here to
                 * get the tunnel context because the tunnel
                 * socket might have already been closed (its
@@ -1279,6 +1325,7 @@ out:
 static int pppol2tp_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
+        struct pppol2tp_session *session;
        int error;
        if (!sk)
@@ -1296,9 +1343,18 @@ static int pppol2tp_release(struct socket *sock)
        sock_orphan(sk);
        sock->sk = NULL;
+        session = pppol2tp_sock_to_session(sk);
        /* Purge any queued data */
        skb_queue_purge(&sk->sk_receive_queue);
        skb_queue_purge(&sk->sk_write_queue);
+        if (session != NULL) {
+                struct sk_buff *skb;
+                while ((skb = skb_dequeue(&session->reorder_q))) {
+                        kfree_skb(skb);
+                        sock_put(sk);
+                }
+        }
        release_sock(sk);
@@ -1601,7 +1657,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        error = ppp_register_channel(&po->chan);
        if (error)
-                goto end;
+                goto end_put_tun;
        /* This is how we get the session context from the socket. */
        sk->sk_user_data = session;
@@ -1621,6 +1677,8 @@ out_no_ppp:
        PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
               "%s: created\n", session->name);
+end_put_tun:
+        sock_put(tunnel_sock);
 end:
        release_sock(sk);
@@ -1668,6 +1726,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
        *usockaddr_len = len;
        error = 0;
+        sock_put(sock->sk);
 end:
        return error;
@@ -1906,14 +1965,17 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
                err = -EBADF;
                tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
                if (tunnel == NULL)
-                        goto end;
+                        goto end_put_sess;
                err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
-                goto end;
+                sock_put(session->tunnel_sock);
+                goto end_put_sess;
        }
        err = pppol2tp_session_ioctl(session, cmd, arg);
+end_put_sess:
+        sock_put(sk);
 end:
        return err;
 }
@@ -2059,14 +2121,17 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
                err = -EBADF;
                tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
                if (tunnel == NULL)
-                        goto end;
+                        goto end_put_sess;
                err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
+                sock_put(session->tunnel_sock);
        } else
                err = pppol2tp_session_setsockopt(sk, session, optname, val);
        err = 0;
+end_put_sess:
+        sock_put(sk);
 end:
        return err;
 }
@@ -2181,20 +2246,24 @@ static int pppol2tp_getsockopt(struct socket *sock, int level,
                err = -EBADF;
                tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
                if (tunnel == NULL)
-                        goto end;
+                        goto end_put_sess;
                err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
+                sock_put(session->tunnel_sock);
        } else
                err = pppol2tp_session_getsockopt(sk, session, optname, &val);
        err = -EFAULT;
        if (put_user(len, (int __user *) optlen))
-                goto end;
+                goto end_put_sess;
        if (copy_to_user((void __user *) optval, &val, len))
-                goto end;
+                goto end_put_sess;
        err = 0;
+end_put_sess:
+        sock_put(sk);
 end:
        return err;
 }
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 169edc154928..858b191517b3 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -733,7 +733,7 @@ static void r6040_timer(unsigned long data)
        }
        /* Timer active again */
-        mod_timer(&lp->timer, jiffies + round_jiffies(HZ));
+        mod_timer(&lp->timer, round_jiffies(jiffies + HZ));
 }
 /* Read/set MAC address routines */
diff --git a/drivers/net/s2io-regs.h b/drivers/net/s2io-regs.h
index 2109508c047a..f8274f8941ea 100644
--- a/drivers/net/s2io-regs.h
+++ b/drivers/net/s2io-regs.h
@@ -250,7 +250,7 @@ struct XENA_dev_config {
        u64 tx_mat0_n[0x8];
 #define TX_MAT_SET(fifo, msi)                   vBIT(msi, (8 * fifo), 8)
-        u8 unused_1[0x8];
+        u64 xmsi_mask_reg;
        u64 stat_byte_cnt;
 #define STAT_BC(n)                              vBIT(n,4,12)
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 523478ebfd69..b5c1e663417d 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -86,7 +86,7 @@
 #include "s2io.h"
 #include "s2io-regs.h"
-#define DRV_VERSION "2.0.26.23"
+#define DRV_VERSION "2.0.26.24"
 /* S2io Driver name & version. */
 static char s2io_driver_name[] = "Neterion";
@@ -1113,9 +1113,10 @@ static int s2io_on_nec_bridge(struct pci_dev *s2io_pdev)
        struct pci_dev *tdev = NULL;
        while ((tdev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, tdev)) != NULL) {
                if (tdev->vendor == NEC_VENID && tdev->device == NEC_DEVID) {
-                        if (tdev->bus == s2io_pdev->bus->parent)
+                        if (tdev->bus == s2io_pdev->bus->parent) {
                                pci_dev_put(tdev);
                                return 1;
+                        }
                }
        }
        return 0;
@@ -1219,15 +1220,33 @@ static int init_tti(struct s2io_nic *nic, int link)
                                TTI_DATA1_MEM_TX_URNG_B(0x10) |
                                TTI_DATA1_MEM_TX_URNG_C(0x30) |
                                TTI_DATA1_MEM_TX_TIMER_AC_EN;
+                if (i == 0)
-                if (use_continuous_tx_intrs && (link == LINK_UP))
+                        if (use_continuous_tx_intrs && (link == LINK_UP))
-                        val64 |= TTI_DATA1_MEM_TX_TIMER_CI_EN;
+                                val64 |= TTI_DATA1_MEM_TX_TIMER_CI_EN;
                writeq(val64, &bar0->tti_data1_mem);
-                val64 = TTI_DATA2_MEM_TX_UFC_A(0x10) |
+                if (nic->config.intr_type == MSI_X) {
-                                TTI_DATA2_MEM_TX_UFC_B(0x20) |
+                        val64 = TTI_DATA2_MEM_TX_UFC_A(0x10) |
-                                TTI_DATA2_MEM_TX_UFC_C(0x40) |
+                                TTI_DATA2_MEM_TX_UFC_B(0x100) |
-                                TTI_DATA2_MEM_TX_UFC_D(0x80);
+                                TTI_DATA2_MEM_TX_UFC_C(0x200) |
+                                TTI_DATA2_MEM_TX_UFC_D(0x300);
+                } else {
+                        if ((nic->config.tx_steering_type ==
+                                TX_DEFAULT_STEERING) &&
+                                (config->tx_fifo_num > 1) &&
+                                (i >= nic->udp_fifo_idx) &&
+                                (i < (nic->udp_fifo_idx +
+                                nic->total_udp_fifos)))
+                                val64 = TTI_DATA2_MEM_TX_UFC_A(0x50) |
+                                        TTI_DATA2_MEM_TX_UFC_B(0x80) |
+                                        TTI_DATA2_MEM_TX_UFC_C(0x100) |
+                                        TTI_DATA2_MEM_TX_UFC_D(0x120);
+                        else
+                                val64 = TTI_DATA2_MEM_TX_UFC_A(0x10) |
+                                        TTI_DATA2_MEM_TX_UFC_B(0x20) |
+                                        TTI_DATA2_MEM_TX_UFC_C(0x40) |
+                                        TTI_DATA2_MEM_TX_UFC_D(0x80);
+                }
                writeq(val64, &bar0->tti_data2_mem);
@@ -2813,6 +2832,15 @@ static void free_rx_buffers(struct s2io_nic *sp)
        }
 }
+static int s2io_chk_rx_buffers(struct ring_info *ring)
+{
+        if (fill_rx_buffers(ring) == -ENOMEM) {
+                DBG_PRINT(INFO_DBG, "%s:Out of memory", ring->dev->name);
+                DBG_PRINT(INFO_DBG, " in Rx Intr!!\n");
+        }
+        return 0;
+}
 /**
 * s2io_poll - Rx interrupt handler for NAPI support
 * @napi : pointer to the napi structure.
@@ -2826,57 +2854,73 @@ static void free_rx_buffers(struct s2io_nic *sp)
 * 0 on success and 1 if there are No Rx packets to be processed.
 */
-static int s2io_poll(struct napi_struct *napi, int budget)
+static int s2io_poll_msix(struct napi_struct *napi, int budget)
 {
-        struct s2io_nic *nic = container_of(napi, struct s2io_nic, napi);
+        struct ring_info *ring = container_of(napi, struct ring_info, napi);
-        struct net_device *dev = nic->dev;
+        struct net_device *dev = ring->dev;
-        int pkt_cnt = 0, org_pkts_to_process;
-        struct mac_info *mac_control;
        struct config_param *config;
+        struct mac_info *mac_control;
+        int pkts_processed = 0;
+        u8 __iomem *addr = NULL;
+        u8 val8 = 0;
+        struct s2io_nic *nic = dev->priv;
        struct XENA_dev_config __iomem *bar0 = nic->bar0;
-        int i;
+        int budget_org = budget;
-        mac_control = &nic->mac_control;
        config = &nic->config;
+        mac_control = &nic->mac_control;
-        nic->pkts_to_process = budget;
+        if (unlikely(!is_s2io_card_up(nic)))
-        org_pkts_to_process = nic->pkts_to_process;
+                return 0;
-        writeq(S2IO_MINUS_ONE, &bar0->rx_traffic_int);
+        pkts_processed = rx_intr_handler(ring, budget);
-        readl(&bar0->rx_traffic_int);
+        s2io_chk_rx_buffers(ring);
-        for (i = 0; i < config->rx_ring_num; i++) {
+        if (pkts_processed < budget_org) {
-                rx_intr_handler(&mac_control->rings[i]);
+                netif_rx_complete(dev, napi);
-                pkt_cnt = org_pkts_to_process - nic->pkts_to_process;
+                /*Re Enable MSI-Rx Vector*/
-                if (!nic->pkts_to_process) {
+                addr = (u8 __iomem *)&bar0->xmsi_mask_reg;
-                        /* Quota for the current iteration has been met */
+                addr += 7 - ring->ring_no;
-                        goto no_rx;
+                val8 = (ring->ring_no == 0) ? 0x3f : 0xbf;
-                }
+                writeb(val8, addr);
+                val8 = readb(addr);
        }
+        return pkts_processed;
+}
+static int s2io_poll_inta(struct napi_struct *napi, int budget)
+{
+        struct s2io_nic *nic = container_of(napi, struct s2io_nic, napi);
+        struct ring_info *ring;
+        struct net_device *dev = nic->dev;
+        struct config_param *config;
+        struct mac_info *mac_control;
+        int pkts_processed = 0;
+        int ring_pkts_processed, i;
+        struct XENA_dev_config __iomem *bar0 = nic->bar0;
+        int budget_org = budget;
-        netif_rx_complete(dev, napi);
+        config = &nic->config;
+        mac_control = &nic->mac_control;
-        for (i = 0; i < config->rx_ring_num; i++) {
+        if (unlikely(!is_s2io_card_up(nic)))
-                if (fill_rx_buffers(&mac_control->rings[i]) == -ENOMEM) {
+                return 0;
-                        DBG_PRINT(INFO_DBG, "%s:Out of memory", dev->name);
-                        DBG_PRINT(INFO_DBG, " in Rx Poll!!\n");
-                        break;
-                }
-        }
-        /* Re enable the Rx interrupts. */
-        writeq(0x0, &bar0->rx_traffic_mask);
-        readl(&bar0->rx_traffic_mask);
-        return pkt_cnt;
-no_rx:
        for (i = 0; i < config->rx_ring_num; i++) {
-                if (fill_rx_buffers(&mac_control->rings[i]) == -ENOMEM) {
+                ring = &mac_control->rings[i];
-                        DBG_PRINT(INFO_DBG, "%s:Out of memory", dev->name);
+                ring_pkts_processed = rx_intr_handler(ring, budget);
-                        DBG_PRINT(INFO_DBG, " in Rx Poll!!\n");
+                s2io_chk_rx_buffers(ring);
+                pkts_processed += ring_pkts_processed;
+                budget -= ring_pkts_processed;
+                if (budget <= 0)
                        break;
-                }
        }
-        return pkt_cnt;
+        if (pkts_processed < budget_org) {
+                netif_rx_complete(dev, napi);
+                /* Re enable the Rx interrupts for the ring */
+                writeq(0, &bar0->rx_traffic_mask);
+                readl(&bar0->rx_traffic_mask);
+        }
+        return pkts_processed;
 }
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -2918,7 +2962,7 @@ static void s2io_netpoll(struct net_device *dev)
        /* check for received packet and indicate up to network */
        for (i = 0; i < config->rx_ring_num; i++)
-                rx_intr_handler(&mac_control->rings[i]);
+                rx_intr_handler(&mac_control->rings[i], 0);
        for (i = 0; i < config->rx_ring_num; i++) {
                if (fill_rx_buffers(&mac_control->rings[i]) == -ENOMEM) {
@@ -2934,7 +2978,8 @@ static void s2io_netpoll(struct net_device *dev)
 /**
 *  rx_intr_handler - Rx interrupt handler
- *  @nic: device private variable.
+ *  @ring_info: per ring structure.
+ *  @budget: budget for napi processing.
 *  Description:
 *  If the interrupt is because of a received frame or if the
 *  receive ring contains fresh as yet un-processed frames,this function is
@@ -2942,15 +2987,15 @@ static void s2io_netpoll(struct net_device *dev)
 *  stopped and sends the skb to the OSM's Rx handler and then increments
 *  the offset.
 *  Return Value:
- *  NONE.
+ *  No. of napi packets processed.
 */
-static void rx_intr_handler(struct ring_info *ring_data)
+static int rx_intr_handler(struct ring_info *ring_data, int budget)
 {
        int get_block, put_block;
        struct rx_curr_get_info get_info, put_info;
        struct RxD_t *rxdp;
        struct sk_buff *skb;
-        int pkt_cnt = 0;
+        int pkt_cnt = 0, napi_pkts = 0;
        int i;
        struct RxD1* rxdp1;
        struct RxD3* rxdp3;
@@ -2977,7 +3022,7 @@ static void rx_intr_handler(struct ring_info *ring_data)
                        DBG_PRINT(ERR_DBG, "%s: The skb is ",
                                  ring_data->dev->name);
                        DBG_PRINT(ERR_DBG, "Null in Rx Intr\n");
-                        return;
+                        return 0;
                }
                if (ring_data->rxd_mode == RXD_MODE_1) {
                        rxdp1 = (struct RxD1*)rxdp;
@@ -3014,9 +3059,10 @@ static void rx_intr_handler(struct ring_info *ring_data)
                        rxdp = ring_data->rx_blocks[get_block].block_virt_addr;
                }
-                if(ring_data->nic->config.napi){
+                if (ring_data->nic->config.napi) {
-                        ring_data->nic->pkts_to_process -= 1;
+                        budget--;
-                        if (!ring_data->nic->pkts_to_process)
+                        napi_pkts++;
+                        if (!budget)
                                break;
                }
                pkt_cnt++;
@@ -3034,6 +3080,7 @@ static void rx_intr_handler(struct ring_info *ring_data)
                        }
                }
        }
+        return(napi_pkts);
 }
 /**
@@ -3730,14 +3777,19 @@ static void restore_xmsi_data(struct s2io_nic *nic)
 {
        struct XENA_dev_config __iomem *bar0 = nic->bar0;
        u64 val64;
-        int i;
+        int i, msix_index;
+        if (nic->device_type == XFRAME_I_DEVICE)
+                return;
        for (i=0; i < MAX_REQUESTED_MSI_X; i++) {
+                msix_index = (i) ? ((i-1) * 8 + 1): 0;
                writeq(nic->msix_info[i].addr, &bar0->xmsi_address);
                writeq(nic->msix_info[i].data, &bar0->xmsi_data);
-                val64 = (s2BIT(7) | s2BIT(15) | vBIT(i, 26, 6));
+                val64 = (s2BIT(7) | s2BIT(15) | vBIT(msix_index, 26, 6));
                writeq(val64, &bar0->xmsi_access);
-                if (wait_for_msix_trans(nic, i)) {
+                if (wait_for_msix_trans(nic, msix_index)) {
                        DBG_PRINT(ERR_DBG, "failed in %s\n", __FUNCTION__);
                        continue;
                }
@@ -3748,13 +3800,17 @@ static void store_xmsi_data(struct s2io_nic *nic)
 {
        struct XENA_dev_config __iomem *bar0 = nic->bar0;
        u64 val64, addr, data;
-        int i;
+        int i, msix_index;
+        if (nic->device_type == XFRAME_I_DEVICE)
+                return;
        /* Store and display */
        for (i=0; i < MAX_REQUESTED_MSI_X; i++) {
-                val64 = (s2BIT(15) | vBIT(i, 26, 6));
+                msix_index = (i) ? ((i-1) * 8 + 1): 0;
+                val64 = (s2BIT(15) | vBIT(msix_index, 26, 6));
                writeq(val64, &bar0->xmsi_access);
-                if (wait_for_msix_trans(nic, i)) {
+                if (wait_for_msix_trans(nic, msix_index)) {
                        DBG_PRINT(ERR_DBG, "failed in %s\n", __FUNCTION__);
                        continue;
                }
@@ -3770,11 +3826,11 @@ static void store_xmsi_data(struct s2io_nic *nic)
 static int s2io_enable_msi_x(struct s2io_nic *nic)
 {
        struct XENA_dev_config __iomem *bar0 = nic->bar0;
-        u64 tx_mat, rx_mat;
+        u64 rx_mat;
        u16 msi_control; /* Temp variable */
        int ret, i, j, msix_indx = 1;
-        nic->entries = kcalloc(MAX_REQUESTED_MSI_X, sizeof(struct msix_entry),
+        nic->entries = kmalloc(nic->num_entries * sizeof(struct msix_entry),
                               GFP_KERNEL);
        if (!nic->entries) {
                DBG_PRINT(INFO_DBG, "%s: Memory allocation failed\n", \
@@ -3783,10 +3839,12 @@ static int s2io_enable_msi_x(struct s2io_nic *nic)
                return -ENOMEM;
        }
        nic->mac_control.stats_info->sw_stat.mem_allocated
-                += (MAX_REQUESTED_MSI_X * sizeof(struct msix_entry));
+                += (nic->num_entries * sizeof(struct msix_entry));
+        memset(nic->entries, 0, nic->num_entries * sizeof(struct msix_entry));
        nic->s2io_entries =
-                kcalloc(MAX_REQUESTED_MSI_X, sizeof(struct s2io_msix_entry),
+                kmalloc(nic->num_entries * sizeof(struct s2io_msix_entry),
                                   GFP_KERNEL);
        if (!nic->s2io_entries) {
                DBG_PRINT(INFO_DBG, "%s: Memory allocation failed\n",
@@ -3794,60 +3852,52 @@ static int s2io_enable_msi_x(struct s2io_nic *nic)
                nic->mac_control.stats_info->sw_stat.mem_alloc_fail_cnt++;
                kfree(nic->entries);
                nic->mac_control.stats_info->sw_stat.mem_freed
-                        += (MAX_REQUESTED_MSI_X * sizeof(struct msix_entry));
+                        += (nic->num_entries * sizeof(struct msix_entry));
                return -ENOMEM;
        }
         nic->mac_control.stats_info->sw_stat.mem_allocated
-                += (MAX_REQUESTED_MSI_X * sizeof(struct s2io_msix_entry));
+                += (nic->num_entries * sizeof(struct s2io_msix_entry));
+        memset(nic->s2io_entries, 0,
-        for (i=0; i< MAX_REQUESTED_MSI_X; i++) {
+                nic->num_entries * sizeof(struct s2io_msix_entry));
-                nic->entries[i].entry = i;
-                nic->s2io_entries[i].entry = i;
+        nic->entries[0].entry = 0;
+        nic->s2io_entries[0].entry = 0;
+        nic->s2io_entries[0].in_use = MSIX_FLG;
+        nic->s2io_entries[0].type = MSIX_ALARM_TYPE;
+        nic->s2io_entries[0].arg = &nic->mac_control.fifos;
+        for (i = 1; i < nic->num_entries; i++) {
+                nic->entries[i].entry = ((i - 1) * 8) + 1;
+                nic->s2io_entries[i].entry = ((i - 1) * 8) + 1;
                nic->s2io_entries[i].arg = NULL;
                nic->s2io_entries[i].in_use = 0;
        }
-        tx_mat = readq(&bar0->tx_mat0_n[0]);
-        for (i=0; i<nic->config.tx_fifo_num; i++, msix_indx++) {
-                tx_mat |= TX_MAT_SET(i, msix_indx);
-                nic->s2io_entries[msix_indx].arg = &nic->mac_control.fifos[i];
-                nic->s2io_entries[msix_indx].type = MSIX_FIFO_TYPE;
-                nic->s2io_entries[msix_indx].in_use = MSIX_FLG;
-        }
-        writeq(tx_mat, &bar0->tx_mat0_n[0]);
        rx_mat = readq(&bar0->rx_mat);
-        for (j = 0; j < nic->config.rx_ring_num; j++, msix_indx++) {
+        for (j = 0; j < nic->config.rx_ring_num; j++) {
                rx_mat |= RX_MAT_SET(j, msix_indx);
-                nic->s2io_entries[msix_indx].arg
+                nic->s2io_entries[j+1].arg = &nic->mac_control.rings[j];
-                        = &nic->mac_control.rings[j];
+                nic->s2io_entries[j+1].type = MSIX_RING_TYPE;
-                nic->s2io_entries[msix_indx].type = MSIX_RING_TYPE;
+                nic->s2io_entries[j+1].in_use = MSIX_FLG;
-                nic->s2io_entries[msix_indx].in_use = MSIX_FLG;
+                msix_indx += 8;
        }
        writeq(rx_mat, &bar0->rx_mat);
+        readq(&bar0->rx_mat);
-        nic->avail_msix_vectors = 0;
+        ret = pci_enable_msix(nic->pdev, nic->entries, nic->num_entries);
-        ret = pci_enable_msix(nic->pdev, nic->entries, MAX_REQUESTED_MSI_X);
        /* We fail init if error or we get less vectors than min required */
-        if (ret >= (nic->config.tx_fifo_num + nic->config.rx_ring_num + 1)) {
-                nic->avail_msix_vectors = ret;
-                ret = pci_enable_msix(nic->pdev, nic->entries, ret);
-        }
        if (ret) {
                DBG_PRINT(ERR_DBG, "%s: Enabling MSIX failed\n", nic->dev->name);
                kfree(nic->entries);
                nic->mac_control.stats_info->sw_stat.mem_freed
-                        += (MAX_REQUESTED_MSI_X * sizeof(struct msix_entry));
+                        += (nic->num_entries * sizeof(struct msix_entry));
                kfree(nic->s2io_entries);
                nic->mac_control.stats_info->sw_stat.mem_freed
-                += (MAX_REQUESTED_MSI_X * sizeof(struct s2io_msix_entry));
+                        += (nic->num_entries * sizeof(struct s2io_msix_entry));
                nic->entries = NULL;
                nic->s2io_entries = NULL;
-                nic->avail_msix_vectors = 0;
                return -ENOMEM;
        }
-        if (!nic->avail_msix_vectors)
-                nic->avail_msix_vectors = MAX_REQUESTED_MSI_X;
        /*
         * To enable MSI-X, MSI also needs to be enabled, due to a bug
@@ -3919,7 +3969,7 @@ static void remove_msix_isr(struct s2io_nic *sp)
        int i;
        u16 msi_control;
-        for (i = 0; i < MAX_REQUESTED_MSI_X; i++) {
+        for (i = 0; i < sp->num_entries; i++) {
                if (sp->s2io_entries[i].in_use ==
                        MSIX_REGISTERED_SUCCESS) {
                        int vector = sp->entries[i].vector;
@@ -3975,29 +4025,6 @@ static int s2io_open(struct net_device *dev)
        netif_carrier_off(dev);
        sp->last_link_state = 0;
-        if (sp->config.intr_type == MSI_X) {
-                int ret = s2io_enable_msi_x(sp);
-                if (!ret) {
-                        ret = s2io_test_msi(sp);
-                        /* rollback MSI-X, will re-enable during add_isr() */
-                        remove_msix_isr(sp);
-                }
-                if (ret) {
-                        DBG_PRINT(ERR_DBG,
-                          "%s: MSI-X requested but failed to enable\n",
-                          dev->name);
-                        sp->config.intr_type = INTA;
-                }
-        }
-        /* NAPI doesn't work well with MSI(X) */
-         if (sp->config.intr_type != INTA) {
-                if(sp->config.napi)
-                        sp->config.napi = 0;
-        }
        /* Initialize H/W and enable interrupts */
        err = s2io_card_up(sp);
        if (err) {
@@ -4020,12 +4047,12 @@ hw_init_failed:
                if (sp->entries) {
                        kfree(sp->entries);
                        sp->mac_control.stats_info->sw_stat.mem_freed
-                        += (MAX_REQUESTED_MSI_X * sizeof(struct msix_entry));
+                        += (sp->num_entries * sizeof(struct msix_entry));
                }
                if (sp->s2io_entries) {
                        kfree(sp->s2io_entries);
                        sp->mac_control.stats_info->sw_stat.mem_freed
-                        += (MAX_REQUESTED_MSI_X * sizeof(struct s2io_msix_entry));
+                        += (sp->num_entries * sizeof(struct s2io_msix_entry));
                }
        }
        return err;
@@ -4327,40 +4354,65 @@ s2io_alarm_handle(unsigned long data)
        mod_timer(&sp->alarm_timer, jiffies + HZ / 2);
 }
-static int s2io_chk_rx_buffers(struct ring_info *ring)
-{
-        if (fill_rx_buffers(ring) == -ENOMEM) {
-                DBG_PRINT(INFO_DBG, "%s:Out of memory", ring->dev->name);
-                DBG_PRINT(INFO_DBG, " in Rx Intr!!\n");
-        }
-        return 0;
-}
 static irqreturn_t s2io_msix_ring_handle(int irq, void *dev_id)
 {
        struct ring_info *ring = (struct ring_info *)dev_id;
        struct s2io_nic *sp = ring->nic;
+        struct XENA_dev_config __iomem *bar0 = sp->bar0;
+        struct net_device *dev = sp->dev;
-        if (!is_s2io_card_up(sp))
+        if (unlikely(!is_s2io_card_up(sp)))
                return IRQ_HANDLED;
-        rx_intr_handler(ring);
+        if (sp->config.napi) {
-        s2io_chk_rx_buffers(ring);
+                u8 __iomem *addr = NULL;
+                u8 val8 = 0;
+                addr = (u8 __iomem *)&bar0->xmsi_mask_reg;
+                addr += (7 - ring->ring_no);
+                val8 = (ring->ring_no == 0) ? 0x7f : 0xff;
+                writeb(val8, addr);
+                val8 = readb(addr);
+                netif_rx_schedule(dev, &ring->napi);
+        } else {
+                rx_intr_handler(ring, 0);
+                s2io_chk_rx_buffers(ring);
+        }
        return IRQ_HANDLED;
 }
 static irqreturn_t s2io_msix_fifo_handle(int irq, void *dev_id)
 {
-        struct fifo_info *fifo = (struct fifo_info *)dev_id;
+        int i;
-        struct s2io_nic *sp = fifo->nic;
+        struct fifo_info *fifos = (struct fifo_info *)dev_id;
+        struct s2io_nic *sp = fifos->nic;
+        struct XENA_dev_config __iomem *bar0 = sp->bar0;
+        struct config_param *config  = &sp->config;
+        u64 reason;
-        if (!is_s2io_card_up(sp))
+        if (unlikely(!is_s2io_card_up(sp)))
+                return IRQ_NONE;
+        reason = readq(&bar0->general_int_status);
+        if (unlikely(reason == S2IO_MINUS_ONE))
+                /* Nothing much can be done. Get out */
                return IRQ_HANDLED;
-        tx_intr_handler(fifo);
+        writeq(S2IO_MINUS_ONE, &bar0->general_int_mask);
+        if (reason & GEN_INTR_TXTRAFFIC)
+                writeq(S2IO_MINUS_ONE, &bar0->tx_traffic_int);
+        for (i = 0; i < config->tx_fifo_num; i++)
+                tx_intr_handler(&fifos[i]);
+        writeq(sp->general_int_mask, &bar0->general_int_mask);
+        readl(&bar0->general_int_status);
        return IRQ_HANDLED;
 }
 static void s2io_txpic_intr_handle(struct s2io_nic *sp)
 {
        struct XENA_dev_config __iomem *bar0 = sp->bar0;
@@ -4762,14 +4814,10 @@ static irqreturn_t s2io_isr(int irq, void *dev_id)
                if (config->napi) {
                        if (reason & GEN_INTR_RXTRAFFIC) {
-                                if (likely(netif_rx_schedule_prep(dev,
+                                netif_rx_schedule(dev, &sp->napi);
-                                                        &sp->napi))) {
+                                writeq(S2IO_MINUS_ONE, &bar0->rx_traffic_mask);
-                                        __netif_rx_schedule(dev, &sp->napi);
+                                writeq(S2IO_MINUS_ONE, &bar0->rx_traffic_int);
-                                        writeq(S2IO_MINUS_ONE,
+                                readl(&bar0->rx_traffic_int);
-                                               &bar0->rx_traffic_mask);
-                                } else
-                                        writeq(S2IO_MINUS_ONE,
-                                               &bar0->rx_traffic_int);
                        }
                } else {
                        /*
@@ -4781,7 +4829,7 @@ static irqreturn_t s2io_isr(int irq, void *dev_id)
                                writeq(S2IO_MINUS_ONE, &bar0->rx_traffic_int);
                        for (i = 0; i < config->rx_ring_num; i++)
-                                rx_intr_handler(&mac_control->rings[i]);
+                                rx_intr_handler(&mac_control->rings[i], 0);
                }
                /*
@@ -6984,62 +7032,62 @@ static int s2io_add_isr(struct s2io_nic * sp)
        /* After proper initialization of H/W, register ISR */
        if (sp->config.intr_type == MSI_X) {
-                int i, msix_tx_cnt=0,msix_rx_cnt=0;
+                int i, msix_rx_cnt = 0;
-                for (i=1; (sp->s2io_entries[i].in_use == MSIX_FLG); i++) {
+                for (i = 0; i < sp->num_entries; i++) {
-                        if (sp->s2io_entries[i].type == MSIX_FIFO_TYPE) {
+                        if (sp->s2io_entries[i].in_use == MSIX_FLG) {
-                                sprintf(sp->desc[i], "%s:MSI-X-%d-TX",
+                                if (sp->s2io_entries[i].type ==
+                                        MSIX_RING_TYPE) {
+                                        sprintf(sp->desc[i], "%s:MSI-X-%d-RX",
+                                                dev->name, i);
+                                        err = request_irq(sp->entries[i].vector,
+                                                s2io_msix_ring_handle, 0,
+                                                sp->desc[i],
+                                                sp->s2io_entries[i].arg);
+                                } else if (sp->s2io_entries[i].type ==
+                                        MSIX_ALARM_TYPE) {
+                                        sprintf(sp->desc[i], "%s:MSI-X-%d-TX",
                                        dev->name, i);
-                                err = request_irq(sp->entries[i].vector,
+                                        err = request_irq(sp->entries[i].vector,
-                                          s2io_msix_fifo_handle, 0, sp->desc[i],
+                                                s2io_msix_fifo_handle, 0,
-                                                  sp->s2io_entries[i].arg);
+                                                sp->desc[i],
-                                /* If either data or addr is zero print it */
+                                                sp->s2io_entries[i].arg);
-                                if(!(sp->msix_info[i].addr &&
-                                        sp->msix_info[i].data)) {
-                                        DBG_PRINT(ERR_DBG, "%s @ Addr:0x%llx "
-                                                "Data:0x%llx\n",sp->desc[i],
-                                                (unsigned long long)
-                                                sp->msix_info[i].addr,
-                                                (unsigned long long)
-                                                sp->msix_info[i].data);
-                                } else {
-                                        msix_tx_cnt++;
                                }
-                        } else {
+                                /* if either data or addr is zero print it. */
-                                sprintf(sp->desc[i], "%s:MSI-X-%d-RX",
+                                if (!(sp->msix_info[i].addr &&
-                                        dev->name, i);
-                                err = request_irq(sp->entries[i].vector,
-                                          s2io_msix_ring_handle, 0, sp->desc[i],
-                                                  sp->s2io_entries[i].arg);
-                                /* If either data or addr is zero print it */
-                                if(!(sp->msix_info[i].addr &&
                                        sp->msix_info[i].data)) {
-                                        DBG_PRINT(ERR_DBG, "%s @ Addr:0x%llx "
+                                        DBG_PRINT(ERR_DBG,
-                                                "Data:0x%llx\n",sp->desc[i],
+                                                "%s @Addr:0x%llx Data:0x%llx\n",
+                                                sp->desc[i],
                                                (unsigned long long)
                                                sp->msix_info[i].addr,
                                                (unsigned long long)
-                                                sp->msix_info[i].data);
+                                                ntohl(sp->msix_info[i].data));
-                                } else {
+                                } else
                                        msix_rx_cnt++;
+                                if (err) {
+                                        remove_msix_isr(sp);
+                                        DBG_PRINT(ERR_DBG,
+                                                "%s:MSI-X-%d registration "
+                                                "failed\n", dev->name, i);
+                                        DBG_PRINT(ERR_DBG,
+                                                "%s: Defaulting to INTA\n",
+                                                dev->name);
+                                        sp->config.intr_type = INTA;
+                                        break;
                                }
+                                sp->s2io_entries[i].in_use =
+                                        MSIX_REGISTERED_SUCCESS;
                        }
-                        if (err) {
-                                remove_msix_isr(sp);
-                                DBG_PRINT(ERR_DBG,"%s:MSI-X-%d registration "
-                                          "failed\n", dev->name, i);
-                                DBG_PRINT(ERR_DBG, "%s: defaulting to INTA\n",
-                                                 dev->name);
-                                sp->config.intr_type = INTA;
-                                break;
-                        }
-                        sp->s2io_entries[i].in_use = MSIX_REGISTERED_SUCCESS;
                }
                if (!err) {
-                        printk(KERN_INFO "MSI-X-TX %d entries enabled\n",
-                                msix_tx_cnt);
                        printk(KERN_INFO "MSI-X-RX %d entries enabled\n",
-                                msix_rx_cnt);
+                                --msix_rx_cnt);
+                        DBG_PRINT(INFO_DBG, "MSI-X-TX entries enabled"
+                                                " through alarm vector\n");
                }
        }
        if (sp->config.intr_type == INTA) {
@@ -7080,8 +7128,15 @@ static void do_s2io_card_down(struct s2io_nic * sp, int do_io)
        clear_bit(__S2IO_STATE_CARD_UP, &sp->state);
        /* Disable napi */
-        if (config->napi)
+        if (sp->config.napi) {
-                napi_disable(&sp->napi);
+                int off = 0;
+                if (config->intr_type ==  MSI_X) {
+                        for (; off < sp->config.rx_ring_num; off++)
+                                napi_disable(&sp->mac_control.rings[off].napi);
+                        }
+                else
+                        napi_disable(&sp->napi);
+        }
        /* disable Tx and Rx traffic on the NIC */
        if (do_io)
@@ -7173,8 +7228,15 @@ static int s2io_card_up(struct s2io_nic * sp)
        }
        /* Initialise napi */
-        if (config->napi)
+        if (config->napi) {
-                napi_enable(&sp->napi);
+                int i;
+                if (config->intr_type ==  MSI_X) {
+                        for (i = 0; i < sp->config.rx_ring_num; i++)
+                                napi_enable(&sp->mac_control.rings[i].napi);
+                } else {
+                        napi_enable(&sp->napi);
+                }
+        }
        /* Maintain the state prior to the open */
        if (sp->promisc_flg)
@@ -7217,7 +7279,7 @@ static int s2io_card_up(struct s2io_nic * sp)
        /*  Enable select interrupts */
        en_dis_err_alarms(sp, ENA_ALL_INTRS, ENABLE_INTRS);
        if (sp->config.intr_type != INTA)
-                en_dis_able_nic_intrs(sp, ENA_ALL_INTRS, DISABLE_INTRS);
+                en_dis_able_nic_intrs(sp, TX_TRAFFIC_INTR, ENABLE_INTRS);
        else {
                interruptible = TX_TRAFFIC_INTR | RX_TRAFFIC_INTR;
                interruptible |= TX_PIC_INTR;
@@ -7615,9 +7677,6 @@ static int s2io_verify_parm(struct pci_dev *pdev, u8 *dev_intr_type,
                rx_ring_num = MAX_RX_RINGS;
        }
-        if (*dev_intr_type != INTA)
-                napi = 0;
        if ((*dev_intr_type != INTA) && (*dev_intr_type != MSI_X)) {
                DBG_PRINT(ERR_DBG, "s2io: Wrong intr_type requested. "
                          "Defaulting to INTA\n");
@@ -7918,8 +7977,6 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         * will use eth_mac_addr() for  dev->set_mac_address
         * mac address will be set every time dev->open() is called
         */
-        netif_napi_add(dev, &sp->napi, s2io_poll, 32);
 #ifdef CONFIG_NET_POLL_CONTROLLER
        dev->poll_controller = s2io_netpoll;
 #endif
@@ -7963,6 +8020,32 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
                }
        }
+        if (sp->config.intr_type == MSI_X) {
+                sp->num_entries = config->rx_ring_num + 1;
+                ret = s2io_enable_msi_x(sp);
+                if (!ret) {
+                        ret = s2io_test_msi(sp);
+                        /* rollback MSI-X, will re-enable during add_isr() */
+                        remove_msix_isr(sp);
+                }
+                if (ret) {
+                        DBG_PRINT(ERR_DBG,
+                          "%s: MSI-X requested but failed to enable\n",
+                          dev->name);
+                        sp->config.intr_type = INTA;
+                }
+        }
+        if (config->intr_type ==  MSI_X) {
+                for (i = 0; i < config->rx_ring_num ; i++)
+                        netif_napi_add(dev, &mac_control->rings[i].napi,
+                                s2io_poll_msix, 64);
+        } else {
+                netif_napi_add(dev, &sp->napi, s2io_poll_inta, 64);
+        }
        /* Not needed for Herc */
        if (sp->device_type & XFRAME_I_DEVICE) {
                /*
@@ -8013,6 +8096,11 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
        /* store mac addresses from CAM to s2io_nic structure */
        do_s2io_store_unicast_mc(sp);
+        /* Configure MSIX vector for number of rings configured plus one */
+        if ((sp->device_type == XFRAME_II_DEVICE) &&
+                (config->intr_type == MSI_X))
+                sp->num_entries = config->rx_ring_num + 1;
         /* Store the values of the MSIX table in the s2io_nic structure */
        store_xmsi_data(sp);
        /* reset Nic and bring it to known state */
@@ -8078,8 +8166,14 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
                    break;
        }
-        if (napi)
+        switch (sp->config.napi) {
+        case 0:
+                DBG_PRINT(ERR_DBG, "%s: NAPI disabled\n", dev->name);
+                break;
+        case 1:
                DBG_PRINT(ERR_DBG, "%s: NAPI enabled\n", dev->name);
+                break;
+        }
        DBG_PRINT(ERR_DBG, "%s: Using %d Tx fifo(s)\n", dev->name,
                sp->config.tx_fifo_num);
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index 0709ebae9139..4706f7f9acb6 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -706,7 +706,7 @@ struct ring_info {
        /* per-ring buffer counter */
        u32 rx_bufs_left;
-        #define MAX_LRO_SESSIONS        32
+#define MAX_LRO_SESSIONS       32
        struct lro lro0_n[MAX_LRO_SESSIONS];
        u8              lro;
@@ -725,6 +725,11 @@ struct ring_info {
        /* copy of sp->pdev pointer */
        struct pci_dev *pdev;
+        /* Per ring napi struct */
+        struct napi_struct napi;
+        unsigned long interrupt_count;
        /*
         *  Place holders for the virtual and physical addresses of
         *  all the Rx Blocks
@@ -841,7 +846,7 @@ struct usr_addr {
 * Structure to keep track of the MSI-X vectors and the corresponding
 * argument registered against each vector
 */
-#define MAX_REQUESTED_MSI_X     17
+#define MAX_REQUESTED_MSI_X     9
 struct s2io_msix_entry
 {
        u16 vector;
@@ -849,8 +854,8 @@ struct s2io_msix_entry
        void *arg;
        u8 type;
-#define MSIX_FIFO_TYPE  1
+#define        MSIX_ALARM_TYPE         1
-#define MSIX_RING_TYPE  2
+#define        MSIX_RING_TYPE          2
        u8 in_use;
 #define MSIX_REGISTERED_SUCCESS 0xAA
@@ -877,7 +882,6 @@ struct s2io_nic {
         */
        int pkts_to_process;
        struct net_device *dev;
-        struct napi_struct napi;
        struct mac_info mac_control;
        struct config_param config;
        struct pci_dev *pdev;
@@ -948,6 +952,7 @@ struct s2io_nic {
        */
        u8 other_fifo_idx;
+        struct napi_struct napi;
        /*  after blink, the adapter must be restored with original
         *  values.
         */
@@ -962,6 +967,7 @@ struct s2io_nic {
        unsigned long long start_time;
        struct vlan_group *vlgrp;
 #define MSIX_FLG                0xA5
+        int num_entries;
        struct msix_entry *entries;
        int msi_detected;
        wait_queue_head_t msi_wait;
@@ -982,6 +988,7 @@ struct s2io_nic {
        u16             lro_max_aggr_per_sess;
        volatile unsigned long state;
        u64             general_int_mask;
 #define VPD_STRING_LEN 80
        u8  product_name[VPD_STRING_LEN];
        u8  serial_num[VPD_STRING_LEN];
@@ -1103,7 +1110,7 @@ static void __devexit s2io_rem_nic(struct pci_dev *pdev);
 static int init_shared_mem(struct s2io_nic *sp);
 static void free_shared_mem(struct s2io_nic *sp);
 static int init_nic(struct s2io_nic *nic);
-static void rx_intr_handler(struct ring_info *ring_data);
+static int rx_intr_handler(struct ring_info *ring_data, int budget);
 static void tx_intr_handler(struct fifo_info *fifo_data);
 static void s2io_handle_errors(void * dev_id);
@@ -1114,7 +1121,8 @@ static void s2io_set_multicast(struct net_device *dev);
 static int rx_osm_handler(struct ring_info *ring_data, struct RxD_t * rxdp);
 static void s2io_link(struct s2io_nic * sp, int link);
 static void s2io_reset(struct s2io_nic * sp);
-static int s2io_poll(struct napi_struct *napi, int budget);
+static int s2io_poll_msix(struct napi_struct *napi, int budget);
+static int s2io_poll_inta(struct napi_struct *napi, int budget);
 static void s2io_init_pci(struct s2io_nic * sp);
 static int do_s2io_prog_unicast(struct net_device *dev, u8 *addr);
 static void s2io_alarm_handle(unsigned long data);
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 888b7dec9866..33bb18f810fb 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -179,8 +179,7 @@ enum sbmac_state {
 #define SBMAC_MAX_TXDESCR       256
 #define SBMAC_MAX_RXDESCR       256
-#define ETHER_ALIGN     2
+#define ETHER_ADDR_LEN          6
-#define ETHER_ADDR_LEN  6
 #define ENET_PACKET_SIZE        1518
 /*#define ENET_PACKET_SIZE      9216 */
@@ -262,8 +261,6 @@ struct sbmac_softc {
        spinlock_t              sbm_lock;       /* spin lock */
        int                     sbm_devflags;   /* current device flags */
-        int                     sbm_buffersize;
        /*
         * Controller-specific things
         */
@@ -305,10 +302,11 @@ struct sbmac_softc {
 static void sbdma_initctx(struct sbmacdma *d, struct sbmac_softc *s, int chan,
                          int txrx, int maxdescr);
 static void sbdma_channel_start(struct sbmacdma *d, int rxtx);
-static int sbdma_add_rcvbuffer(struct sbmacdma *d, struct sk_buff *m);
+static int sbdma_add_rcvbuffer(struct sbmac_softc *sc, struct sbmacdma *d,
+                               struct sk_buff *m);
 static int sbdma_add_txbuffer(struct sbmacdma *d, struct sk_buff *m);
 static void sbdma_emptyring(struct sbmacdma *d);
-static void sbdma_fillring(struct sbmacdma *d);
+static void sbdma_fillring(struct sbmac_softc *sc, struct sbmacdma *d);
 static int sbdma_rx_process(struct sbmac_softc *sc, struct sbmacdma *d,
                            int work_to_do, int poll);
 static void sbdma_tx_process(struct sbmac_softc *sc, struct sbmacdma *d,
@@ -777,16 +775,13 @@ static void sbdma_channel_stop(struct sbmacdma *d)
        d->sbdma_remptr = NULL;
 }
-static void sbdma_align_skb(struct sk_buff *skb,int power2,int offset)
+static inline void sbdma_align_skb(struct sk_buff *skb,
+                                   unsigned int power2, unsigned int offset)
 {
-        unsigned long addr;
+        unsigned char *addr = skb->data;
-        unsigned long newaddr;
+        unsigned char *newaddr = PTR_ALIGN(addr, power2);
-        addr = (unsigned long) skb->data;
-        newaddr = (addr + power2 - 1) & ~(power2 - 1);
-        skb_reserve(skb,newaddr-addr+offset);
+        skb_reserve(skb, newaddr - addr + offset);
 }
@@ -797,7 +792,8 @@ static void sbdma_align_skb(struct sk_buff *skb,int power2,int offset)
 *  this queues a buffer for inbound packets.
 *
 *  Input parameters:
- *         d - DMA channel descriptor
+ *         sc - softc structure
+ *          d - DMA channel descriptor
 *         sb - sk_buff to add, or NULL if we should allocate one
 *
 *  Return value:
@@ -806,8 +802,10 @@ static void sbdma_align_skb(struct sk_buff *skb,int power2,int offset)
 ********************************************************************* */
-static int sbdma_add_rcvbuffer(struct sbmacdma *d, struct sk_buff *sb)
+static int sbdma_add_rcvbuffer(struct sbmac_softc *sc, struct sbmacdma *d,
+                               struct sk_buff *sb)
 {
+        struct net_device *dev = sc->sbm_dev;
        struct sbdmadscr *dsc;
        struct sbdmadscr *nextdsc;
        struct sk_buff *sb_new = NULL;
@@ -848,14 +846,16 @@ static int sbdma_add_rcvbuffer(struct sbmacdma *d, struct sk_buff *sb)
         */
        if (sb == NULL) {
-                sb_new = dev_alloc_skb(ENET_PACKET_SIZE + SMP_CACHE_BYTES * 2 + ETHER_ALIGN);
+                sb_new = netdev_alloc_skb(dev, ENET_PACKET_SIZE +
+                                               SMP_CACHE_BYTES * 2 +
+                                               NET_IP_ALIGN);
                if (sb_new == NULL) {
                        pr_info("%s: sk_buff allocation failed\n",
                               d->sbdma_eth->sbm_dev->name);
                        return -ENOBUFS;
                }
-                sbdma_align_skb(sb_new, SMP_CACHE_BYTES, ETHER_ALIGN);
+                sbdma_align_skb(sb_new, SMP_CACHE_BYTES, NET_IP_ALIGN);
        }
        else {
                sb_new = sb;
@@ -874,10 +874,10 @@ static int sbdma_add_rcvbuffer(struct sbmacdma *d, struct sk_buff *sb)
         * Do not interrupt per DMA transfer.
         */
        dsc->dscr_a = virt_to_phys(sb_new->data) |
-                V_DMA_DSCRA_A_SIZE(NUMCACHEBLKS(pktsize+ETHER_ALIGN)) | 0;
+                V_DMA_DSCRA_A_SIZE(NUMCACHEBLKS(pktsize + NET_IP_ALIGN)) | 0;
 #else
        dsc->dscr_a = virt_to_phys(sb_new->data) |
-                V_DMA_DSCRA_A_SIZE(NUMCACHEBLKS(pktsize+ETHER_ALIGN)) |
+                V_DMA_DSCRA_A_SIZE(NUMCACHEBLKS(pktsize + NET_IP_ALIGN)) |
                M_DMA_DSCRA_INTERRUPT;
 #endif
@@ -1032,18 +1032,19 @@ static void sbdma_emptyring(struct sbmacdma *d)
 *  with sk_buffs
 *
 *  Input parameters:
- *         d - DMA channel
+ *         sc - softc structure
+ *          d - DMA channel
 *
 *  Return value:
 *         nothing
 ********************************************************************* */
-static void sbdma_fillring(struct sbmacdma *d)
+static void sbdma_fillring(struct sbmac_softc *sc, struct sbmacdma *d)
 {
        int idx;
-        for (idx = 0; idx < SBMAC_MAX_RXDESCR-1; idx++) {
+        for (idx = 0; idx < SBMAC_MAX_RXDESCR - 1; idx++) {
-                if (sbdma_add_rcvbuffer(d,NULL) != 0)
+                if (sbdma_add_rcvbuffer(sc, d, NULL) != 0)
                        break;
        }
 }
@@ -1159,10 +1160,11 @@ again:
                         * packet and put it right back on the receive ring.
                         */
-                        if (unlikely (sbdma_add_rcvbuffer(d,NULL) ==
+                        if (unlikely(sbdma_add_rcvbuffer(sc, d, NULL) ==
-                                      -ENOBUFS)) {
+                                     -ENOBUFS)) {
                                dev->stats.rx_dropped++;
-                                sbdma_add_rcvbuffer(d,sb); /* re-add old buffer */
+                                /* Re-add old buffer */
+                                sbdma_add_rcvbuffer(sc, d, sb);
                                /* No point in continuing at the moment */
                                printk(KERN_ERR "dropped packet (1)\n");
                                d->sbdma_remptr = SBDMA_NEXTBUF(d,sbdma_remptr);
@@ -1212,7 +1214,7 @@ again:
                         * put it back on the receive ring.
                         */
                        dev->stats.rx_errors++;
-                        sbdma_add_rcvbuffer(d,sb);
+                        sbdma_add_rcvbuffer(sc, d, sb);
                }
@@ -1570,7 +1572,7 @@ static void sbmac_channel_start(struct sbmac_softc *s)
         * Fill the receive ring
         */
-        sbdma_fillring(&(s->sbm_rxdma));
+        sbdma_fillring(s, &(s->sbm_rxdma));
        /*
         * Turn on the rest of the bits in the enable register
@@ -2312,13 +2314,6 @@ static int sbmac_init(struct platform_device *pldev, long long base)
                dev->dev_addr[i] = eaddr[i];
        }
-        /*
-         * Init packet size
-         */
-        sc->sbm_buffersize = ENET_PACKET_SIZE + SMP_CACHE_BYTES * 2 + ETHER_ALIGN;
        /*
         * Initialize context (get pointers to registers and stuff), then
         * allocate the memory for the descriptor tables.
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index f64a860029b7..61955f8d8011 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -953,9 +953,6 @@ static int sc92031_start_xmit(struct sk_buff *skb, struct net_device *dev)
        unsigned entry;
        u32 tx_status;
-        if (skb_padto(skb, ETH_ZLEN))
-                return NETDEV_TX_OK;
        if (unlikely(skb->len > TX_BUF_SIZE)) {
                dev->stats.tx_dropped++;
                goto out;
@@ -975,6 +972,11 @@ static int sc92031_start_xmit(struct sk_buff *skb, struct net_device *dev)
        skb_copy_and_csum_dev(skb, priv->tx_bufs + entry * TX_BUF_SIZE);
        len = skb->len;
+        if (len < ETH_ZLEN) {
+                memset(priv->tx_bufs + entry * TX_BUF_SIZE + len,
+                                0, ETH_ZLEN - len);
+                len = ETH_ZLEN;
+        }
        wmb();
diff --git a/drivers/net/sfc/bitfield.h b/drivers/net/sfc/bitfield.h
index 2806201644cc..2c79d27404e0 100644
--- a/drivers/net/sfc/bitfield.h
+++ b/drivers/net/sfc/bitfield.h
@@ -483,7 +483,7 @@ typedef union efx_oword {
 #endif
 #define EFX_SET_OWORD_FIELD_VER(efx, oword, field, value) do { \
-        if (FALCON_REV(efx) >= FALCON_REV_B0) {                    \
+        if (falcon_rev(efx) >= FALCON_REV_B0) {                    \
                EFX_SET_OWORD_FIELD((oword), field##_B0, (value)); \
        } else { \
                EFX_SET_OWORD_FIELD((oword), field##_A1, (value)); \
@@ -491,7 +491,7 @@ typedef union efx_oword {
 } while (0)
 #define EFX_QWORD_FIELD_VER(efx, qword, field)  \
-        (FALCON_REV(efx) >= FALCON_REV_B0 ?     \
+        (falcon_rev(efx) >= FALCON_REV_B0 ?     \
         EFX_QWORD_FIELD((qword), field##_B0) : \
         EFX_QWORD_FIELD((qword), field##_A1))
@@ -501,8 +501,5 @@ typedef union efx_oword {
 #define DMA_ADDR_T_WIDTH        (8 * sizeof(dma_addr_t))
 #define EFX_DMA_TYPE_WIDTH(width) \
        (((width) < DMA_ADDR_T_WIDTH) ? (width) : DMA_ADDR_T_WIDTH)
-#define EFX_DMA_MAX_MASK ((DMA_ADDR_T_WIDTH == 64) ? \
-                          ~((u64) 0) : ~((u32) 0))
-#define EFX_DMA_MASK(mask) ((mask) & EFX_DMA_MAX_MASK)
 #endif /* EFX_BITFIELD_H */
diff --git a/drivers/net/sfc/boards.c b/drivers/net/sfc/boards.c
index eecaa6d58584..7fc0328dc055 100644
--- a/drivers/net/sfc/boards.c
+++ b/drivers/net/sfc/boards.c
@@ -27,10 +27,8 @@ static void blink_led_timer(unsigned long context)
        struct efx_blinker *bl = &efx->board_info.blinker;
        efx->board_info.set_fault_led(efx, bl->state);
        bl->state = !bl->state;
-        if (bl->resubmit) {
+        if (bl->resubmit)
-                bl->timer.expires = jiffies + BLINK_INTERVAL;
+                mod_timer(&bl->timer, jiffies + BLINK_INTERVAL);
-                add_timer(&bl->timer);
-        }
 }
 static void board_blink(struct efx_nic *efx, int blink)
@@ -44,8 +42,7 @@ static void board_blink(struct efx_nic *efx, int blink)
                blinker->state = 0;
                setup_timer(&blinker->timer, blink_led_timer,
                            (unsigned long)efx);
-                blinker->timer.expires = jiffies + BLINK_INTERVAL;
+                mod_timer(&blinker->timer, jiffies + BLINK_INTERVAL);
-                add_timer(&blinker->timer);
        } else {
                blinker->resubmit = 0;
                if (blinker->timer.function)
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 418f2e53a95b..449760642e31 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -199,11 +199,12 @@ static inline int efx_process_channel(struct efx_channel *channel, int rx_quota)
 */
 static inline void efx_channel_processed(struct efx_channel *channel)
 {
-        /* Write to EVQ_RPTR_REG.  If a new event arrived in a race
+        /* The interrupt handler for this channel may set work_pending
-         * with finishing processing, a new interrupt will be raised.
+         * as soon as we acknowledge the events we've seen.  Make sure
-         */
+         * it's cleared before then. */
        channel->work_pending = 0;
-        smp_wmb(); /* Ensure channel updated before any new interrupt. */
+        smp_wmb();
        falcon_eventq_read_ack(channel);
 }
@@ -265,7 +266,7 @@ void efx_process_channel_now(struct efx_channel *channel)
        napi_disable(&channel->napi_str);
        /* Poll the channel */
-        (void) efx_process_channel(channel, efx->type->evq_size);
+        efx_process_channel(channel, efx->type->evq_size);
        /* Ack the eventq. This may cause an interrupt to be generated
         * when they are reenabled */
@@ -317,26 +318,6 @@ static void efx_remove_eventq(struct efx_channel *channel)
 *
 *************************************************************************/
-/* Setup per-NIC RX buffer parameters.
- * Calculate the rx buffer allocation parameters required to support
- * the current MTU, including padding for header alignment and overruns.
- */
-static void efx_calc_rx_buffer_params(struct efx_nic *efx)
-{
-        unsigned int order, len;
-        len = (max(EFX_PAGE_IP_ALIGN, NET_IP_ALIGN) +
-               EFX_MAX_FRAME_LEN(efx->net_dev->mtu) +
-               efx->type->rx_buffer_padding);
-        /* Calculate page-order */
-        for (order = 0; ((1u << order) * PAGE_SIZE) < len; ++order)
-                ;
-        efx->rx_buffer_len = len;
-        efx->rx_buffer_order = order;
-}
 static int efx_probe_channel(struct efx_channel *channel)
 {
        struct efx_tx_queue *tx_queue;
@@ -387,7 +368,14 @@ static int efx_init_channels(struct efx_nic *efx)
        struct efx_channel *channel;
        int rc = 0;
-        efx_calc_rx_buffer_params(efx);
+        /* Calculate the rx buffer allocation parameters required to
+         * support the current MTU, including padding for header
+         * alignment and overruns.
+         */
+        efx->rx_buffer_len = (max(EFX_PAGE_IP_ALIGN, NET_IP_ALIGN) +
+                              EFX_MAX_FRAME_LEN(efx->net_dev->mtu) +
+                              efx->type->rx_buffer_padding);
+        efx->rx_buffer_order = get_order(efx->rx_buffer_len);
        /* Initialise the channels */
        efx_for_each_channel(channel, efx) {
@@ -440,9 +428,12 @@ static void efx_start_channel(struct efx_channel *channel)
                netif_napi_add(channel->napi_dev, &channel->napi_str,
                               efx_poll, napi_weight);
+        /* The interrupt handler for this channel may set work_pending
+         * as soon as we enable it.  Make sure it's cleared before
+         * then.  Similarly, make sure it sees the enabled flag set. */
        channel->work_pending = 0;
        channel->enabled = 1;
-        smp_wmb(); /* ensure channel updated before first interrupt */
+        smp_wmb();
        napi_enable(&channel->napi_str);
@@ -704,7 +695,7 @@ static void efx_stop_port(struct efx_nic *efx)
        mutex_unlock(&efx->mac_lock);
        /* Serialise against efx_set_multicast_list() */
-        if (NET_DEV_REGISTERED(efx)) {
+        if (efx_dev_registered(efx)) {
                netif_tx_lock_bh(efx->net_dev);
                netif_tx_unlock_bh(efx->net_dev);
        }
@@ -791,22 +782,23 @@ static int efx_init_io(struct efx_nic *efx)
        efx->membase = ioremap_nocache(efx->membase_phys,
                                       efx->type->mem_map_size);
        if (!efx->membase) {
-                EFX_ERR(efx, "could not map memory BAR %d at %lx+%x\n",
+                EFX_ERR(efx, "could not map memory BAR %d at %llx+%x\n",
-                        efx->type->mem_bar, efx->membase_phys,
+                        efx->type->mem_bar,
+                        (unsigned long long)efx->membase_phys,
                        efx->type->mem_map_size);
                rc = -ENOMEM;
                goto fail4;
        }
-        EFX_LOG(efx, "memory BAR %u at %lx+%x (virtual %p)\n",
+        EFX_LOG(efx, "memory BAR %u at %llx+%x (virtual %p)\n",
-                efx->type->mem_bar, efx->membase_phys, efx->type->mem_map_size,
+                efx->type->mem_bar, (unsigned long long)efx->membase_phys,
-                efx->membase);
+                efx->type->mem_map_size, efx->membase);
        return 0;
 fail4:
        release_mem_region(efx->membase_phys, efx->type->mem_map_size);
 fail3:
-        efx->membase_phys = 0UL;
+        efx->membase_phys = 0;
 fail2:
        pci_disable_device(efx->pci_dev);
 fail1:
@@ -824,7 +816,7 @@ static void efx_fini_io(struct efx_nic *efx)
        if (efx->membase_phys) {
                pci_release_region(efx->pci_dev, efx->type->mem_bar);
-                efx->membase_phys = 0UL;
+                efx->membase_phys = 0;
        }
        pci_disable_device(efx->pci_dev);
@@ -1043,7 +1035,7 @@ static void efx_start_all(struct efx_nic *efx)
                return;
        if ((efx->state != STATE_RUNNING) && (efx->state != STATE_INIT))
                return;
-        if (NET_DEV_REGISTERED(efx) && !netif_running(efx->net_dev))
+        if (efx_dev_registered(efx) && !netif_running(efx->net_dev))
                return;
        /* Mark the port as enabled so port reconfigurations can start, then
@@ -1073,9 +1065,8 @@ static void efx_flush_all(struct efx_nic *efx)
        cancel_delayed_work_sync(&efx->monitor_work);
        /* Ensure that all RX slow refills are complete. */
-        efx_for_each_rx_queue(rx_queue, efx) {
+        efx_for_each_rx_queue(rx_queue, efx)
                cancel_delayed_work_sync(&rx_queue->work);
-        }
        /* Stop scheduled port reconfigurations */
        cancel_work_sync(&efx->reconfigure_work);
@@ -1101,9 +1092,10 @@ static void efx_stop_all(struct efx_nic *efx)
        falcon_disable_interrupts(efx);
        if (efx->legacy_irq)
                synchronize_irq(efx->legacy_irq);
-        efx_for_each_channel_with_interrupt(channel, efx)
+        efx_for_each_channel_with_interrupt(channel, efx) {
                if (channel->irq)
                        synchronize_irq(channel->irq);
+        }
        /* Stop all NAPI processing and synchronous rx refills */
        efx_for_each_channel(channel, efx)
@@ -1125,7 +1117,7 @@ static void efx_stop_all(struct efx_nic *efx)
        /* Stop the kernel transmit interface late, so the watchdog
         * timer isn't ticking over the flush */
        efx_stop_queue(efx);
-        if (NET_DEV_REGISTERED(efx)) {
+        if (efx_dev_registered(efx)) {
                netif_tx_lock_bh(efx->net_dev);
                netif_tx_unlock_bh(efx->net_dev);
        }
@@ -1344,13 +1336,17 @@ static int efx_net_stop(struct net_device *net_dev)
        return 0;
 }
-/* Context: process, dev_base_lock held, non-blocking. */
+/* Context: process, dev_base_lock or RTNL held, non-blocking. */
 static struct net_device_stats *efx_net_stats(struct net_device *net_dev)
 {
        struct efx_nic *efx = net_dev->priv;
        struct efx_mac_stats *mac_stats = &efx->mac_stats;
        struct net_device_stats *stats = &net_dev->stats;
+        /* Update stats if possible, but do not wait if another thread
+         * is updating them (or resetting the NIC); slightly stale
+         * stats are acceptable.
+         */
        if (!spin_trylock(&efx->stats_lock))
                return stats;
        if (efx->state == STATE_RUNNING) {
@@ -1494,7 +1490,7 @@ static void efx_set_multicast_list(struct net_device *net_dev)
 static int efx_netdev_event(struct notifier_block *this,
                            unsigned long event, void *ptr)
 {
-        struct net_device *net_dev = (struct net_device *)ptr;
+        struct net_device *net_dev = ptr;
        if (net_dev->open == efx_net_open && event == NETDEV_CHANGENAME) {
                struct efx_nic *efx = net_dev->priv;
@@ -1563,7 +1559,7 @@ static void efx_unregister_netdev(struct efx_nic *efx)
        efx_for_each_tx_queue(tx_queue, efx)
                efx_release_tx_buffers(tx_queue);
-        if (NET_DEV_REGISTERED(efx)) {
+        if (efx_dev_registered(efx)) {
                strlcpy(efx->name, pci_name(efx->pci_dev), sizeof(efx->name));
                unregister_netdev(efx->net_dev);
        }
@@ -1688,7 +1684,7 @@ static int efx_reset(struct efx_nic *efx)
        if (method == RESET_TYPE_DISABLE) {
                /* Reinitialise the device anyway so the driver unload sequence
                 * can talk to the external SRAM */
-                (void) falcon_init_nic(efx);
+                falcon_init_nic(efx);
                rc = -EIO;
                goto fail4;
        }
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index b57cc68058c0..790db89db345 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -116,17 +116,8 @@ MODULE_PARM_DESC(rx_xon_thresh_bytes, "RX fifo XON threshold");
 **************************************************************************
 */
-/* DMA address mask (up to 46-bit, avoiding compiler warnings)
+/* DMA address mask */
- *
+#define FALCON_DMA_MASK DMA_BIT_MASK(46)
- * Note that it is possible to have a platform with 64-bit longs and
- * 32-bit DMA addresses, or vice versa.  EFX_DMA_MASK takes care of the
- * platform DMA mask.
- */
-#if BITS_PER_LONG == 64
-#define FALCON_DMA_MASK EFX_DMA_MASK(0x00003fffffffffffUL)
-#else
-#define FALCON_DMA_MASK EFX_DMA_MASK(0x00003fffffffffffULL)
-#endif
 /* TX DMA length mask (13-bit) */
 #define FALCON_TX_DMA_MASK (4096 - 1)
@@ -145,7 +136,7 @@ MODULE_PARM_DESC(rx_xon_thresh_bytes, "RX fifo XON threshold");
 #define PCI_EXP_LNKSTA_LNK_WID_LBN      4
 #define FALCON_IS_DUAL_FUNC(efx)                \
-        (FALCON_REV(efx) < FALCON_REV_B0)
+        (falcon_rev(efx) < FALCON_REV_B0)
 /**************************************************************************
 *
@@ -465,7 +456,7 @@ int falcon_init_tx(struct efx_tx_queue *tx_queue)
                              TX_DESCQ_TYPE, 0,
                              TX_NON_IP_DROP_DIS_B0, 1);
-        if (FALCON_REV(efx) >= FALCON_REV_B0) {
+        if (falcon_rev(efx) >= FALCON_REV_B0) {
                int csum = !(efx->net_dev->features & NETIF_F_IP_CSUM);
                EFX_SET_OWORD_FIELD(tx_desc_ptr, TX_IP_CHKSM_DIS_B0, csum);
                EFX_SET_OWORD_FIELD(tx_desc_ptr, TX_TCP_CHKSM_DIS_B0, csum);
@@ -474,7 +465,7 @@ int falcon_init_tx(struct efx_tx_queue *tx_queue)
        falcon_write_table(efx, &tx_desc_ptr, efx->type->txd_ptr_tbl_base,
                           tx_queue->queue);
-        if (FALCON_REV(efx) < FALCON_REV_B0) {
+        if (falcon_rev(efx) < FALCON_REV_B0) {
                efx_oword_t reg;
                BUG_ON(tx_queue->queue >= 128); /* HW limit */
@@ -635,7 +626,7 @@ int falcon_init_rx(struct efx_rx_queue *rx_queue)
        efx_oword_t rx_desc_ptr;
        struct efx_nic *efx = rx_queue->efx;
        int rc;
-        int is_b0 = FALCON_REV(efx) >= FALCON_REV_B0;
+        int is_b0 = falcon_rev(efx) >= FALCON_REV_B0;
        int iscsi_digest_en = is_b0;
        EFX_LOG(efx, "RX queue %d ring in special buffers %d-%d\n",
@@ -742,8 +733,10 @@ void falcon_fini_rx(struct efx_rx_queue *rx_queue)
                        continue;
                break;
        }
-        if (rc)
+        if (rc) {
                EFX_ERR(efx, "failed to flush rx queue %d\n", rx_queue->queue);
+                efx_schedule_reset(efx, RESET_TYPE_INVISIBLE);
+        }
        /* Remove RX descriptor ring from card */
        EFX_ZERO_OWORD(rx_desc_ptr);
@@ -822,10 +815,10 @@ static inline void falcon_handle_tx_event(struct efx_channel *channel,
                tx_ev_q_label = EFX_QWORD_FIELD(*event, TX_EV_Q_LABEL);
                tx_queue = &efx->tx_queue[tx_ev_q_label];
-                if (NET_DEV_REGISTERED(efx))
+                if (efx_dev_registered(efx))
                        netif_tx_lock(efx->net_dev);
                falcon_notify_tx_desc(tx_queue);
-                if (NET_DEV_REGISTERED(efx))
+                if (efx_dev_registered(efx))
                        netif_tx_unlock(efx->net_dev);
        } else if (EFX_QWORD_FIELD(*event, TX_EV_PKT_ERR) &&
                   EFX_WORKAROUND_10727(efx)) {
@@ -884,7 +877,7 @@ static void falcon_handle_rx_not_ok(struct efx_rx_queue *rx_queue,
                                                   RX_EV_TCP_UDP_CHKSUM_ERR);
        rx_ev_eth_crc_err = EFX_QWORD_FIELD(*event, RX_EV_ETH_CRC_ERR);
        rx_ev_frm_trunc = EFX_QWORD_FIELD(*event, RX_EV_FRM_TRUNC);
-        rx_ev_drib_nib = ((FALCON_REV(efx) >= FALCON_REV_B0) ?
+        rx_ev_drib_nib = ((falcon_rev(efx) >= FALCON_REV_B0) ?
                          0 : EFX_QWORD_FIELD(*event, RX_EV_DRIB_NIB));
        rx_ev_pause_frm = EFX_QWORD_FIELD(*event, RX_EV_PAUSE_FRM_ERR);
@@ -1065,7 +1058,7 @@ static void falcon_handle_global_event(struct efx_channel *channel,
            EFX_QWORD_FIELD(*event, XG_PHY_INTR))
                is_phy_event = 1;
-        if ((FALCON_REV(efx) >= FALCON_REV_B0) &&
+        if ((falcon_rev(efx) >= FALCON_REV_B0) &&
            EFX_OWORD_FIELD(*event, XG_MNT_INTR_B0))
                is_phy_event = 1;
@@ -1405,7 +1398,7 @@ static inline void falcon_irq_ack_a1(struct efx_nic *efx)
 static irqreturn_t falcon_fatal_interrupt(struct efx_nic *efx)
 {
        struct falcon_nic_data *nic_data = efx->nic_data;
-        efx_oword_t *int_ker = (efx_oword_t *) efx->irq_status.addr;
+        efx_oword_t *int_ker = efx->irq_status.addr;
        efx_oword_t fatal_intr;
        int error, mem_perr;
        static int n_int_errors;
@@ -1451,8 +1444,8 @@ out:
 */
 static irqreturn_t falcon_legacy_interrupt_b0(int irq, void *dev_id)
 {
-        struct efx_nic *efx = (struct efx_nic *)dev_id;
+        struct efx_nic *efx = dev_id;
-        efx_oword_t *int_ker = (efx_oword_t *) efx->irq_status.addr;
+        efx_oword_t *int_ker = efx->irq_status.addr;
        struct efx_channel *channel;
        efx_dword_t reg;
        u32 queues;
@@ -1489,8 +1482,8 @@ static irqreturn_t falcon_legacy_interrupt_b0(int irq, void *dev_id)
 static irqreturn_t falcon_legacy_interrupt_a1(int irq, void *dev_id)
 {
-        struct efx_nic *efx = (struct efx_nic *)dev_id;
+        struct efx_nic *efx = dev_id;
-        efx_oword_t *int_ker = (efx_oword_t *) efx->irq_status.addr;
+        efx_oword_t *int_ker = efx->irq_status.addr;
        struct efx_channel *channel;
        int syserr;
        int queues;
@@ -1542,9 +1535,9 @@ static irqreturn_t falcon_legacy_interrupt_a1(int irq, void *dev_id)
 */
 static irqreturn_t falcon_msi_interrupt(int irq, void *dev_id)
 {
-        struct efx_channel *channel = (struct efx_channel *)dev_id;
+        struct efx_channel *channel = dev_id;
        struct efx_nic *efx = channel->efx;
-        efx_oword_t *int_ker = (efx_oword_t *) efx->irq_status.addr;
+        efx_oword_t *int_ker = efx->irq_status.addr;
        int syserr;
        efx->last_irq_cpu = raw_smp_processor_id();
@@ -1572,7 +1565,7 @@ static void falcon_setup_rss_indir_table(struct efx_nic *efx)
        unsigned long offset;
        efx_dword_t dword;
-        if (FALCON_REV(efx) < FALCON_REV_B0)
+        if (falcon_rev(efx) < FALCON_REV_B0)
                return;
        for (offset = RX_RSS_INDIR_TBL_B0;
@@ -1595,7 +1588,7 @@ int falcon_init_interrupt(struct efx_nic *efx)
        if (!EFX_INT_MODE_USE_MSI(efx)) {
                irq_handler_t handler;
-                if (FALCON_REV(efx) >= FALCON_REV_B0)
+                if (falcon_rev(efx) >= FALCON_REV_B0)
                        handler = falcon_legacy_interrupt_b0;
                else
                        handler = falcon_legacy_interrupt_a1;
@@ -1636,12 +1629,13 @@ void falcon_fini_interrupt(struct efx_nic *efx)
        efx_oword_t reg;
        /* Disable MSI/MSI-X interrupts */
-        efx_for_each_channel_with_interrupt(channel, efx)
+        efx_for_each_channel_with_interrupt(channel, efx) {
                if (channel->irq)
                        free_irq(channel->irq, channel);
+        }
        /* ACK legacy interrupt */
-        if (FALCON_REV(efx) >= FALCON_REV_B0)
+        if (falcon_rev(efx) >= FALCON_REV_B0)
                falcon_read(efx, &reg, INT_ISR0_B0);
        else
                falcon_irq_ack_a1(efx);
@@ -1732,7 +1726,7 @@ void falcon_drain_tx_fifo(struct efx_nic *efx)
        efx_oword_t temp;
        int count;
-        if ((FALCON_REV(efx) < FALCON_REV_B0) ||
+        if ((falcon_rev(efx) < FALCON_REV_B0) ||
            (efx->loopback_mode != LOOPBACK_NONE))
                return;
@@ -1785,7 +1779,7 @@ void falcon_deconfigure_mac_wrapper(struct efx_nic *efx)
 {
        efx_oword_t temp;
-        if (FALCON_REV(efx) < FALCON_REV_B0)
+        if (falcon_rev(efx) < FALCON_REV_B0)
                return;
        /* Isolate the MAC -> RX */
@@ -1823,7 +1817,7 @@ void falcon_reconfigure_mac_wrapper(struct efx_nic *efx)
                             MAC_SPEED, link_speed);
        /* On B0, MAC backpressure can be disabled and packets get
         * discarded. */
-        if (FALCON_REV(efx) >= FALCON_REV_B0) {
+        if (falcon_rev(efx) >= FALCON_REV_B0) {
                EFX_SET_OWORD_FIELD(reg, TXFIFO_DRAIN_EN_B0,
                                    !efx->link_up);
        }
@@ -1841,7 +1835,7 @@ void falcon_reconfigure_mac_wrapper(struct efx_nic *efx)
        EFX_SET_OWORD_FIELD_VER(efx, reg, RX_XOFF_MAC_EN, tx_fc);
        /* Unisolate the MAC -> RX */
-        if (FALCON_REV(efx) >= FALCON_REV_B0)
+        if (falcon_rev(efx) >= FALCON_REV_B0)
                EFX_SET_OWORD_FIELD(reg, RX_INGR_EN_B0, 1);
        falcon_write(efx, &reg, RX_CFG_REG_KER);
 }
@@ -1856,7 +1850,7 @@ int falcon_dma_stats(struct efx_nic *efx, unsigned int done_offset)
                return 0;
        /* Statistics fetch will fail if the MAC is in TX drain */
-        if (FALCON_REV(efx) >= FALCON_REV_B0) {
+        if (falcon_rev(efx) >= FALCON_REV_B0) {
                efx_oword_t temp;
                falcon_read(efx, &temp, MAC0_CTRL_REG_KER);
                if (EFX_OWORD_FIELD(temp, TXFIFO_DRAIN_EN_B0))
@@ -1940,7 +1934,7 @@ static int falcon_gmii_wait(struct efx_nic *efx)
 static void falcon_mdio_write(struct net_device *net_dev, int phy_id,
                              int addr, int value)
 {
-        struct efx_nic *efx = (struct efx_nic *)net_dev->priv;
+        struct efx_nic *efx = net_dev->priv;
        unsigned int phy_id2 = phy_id & FALCON_PHY_ID_ID_MASK;
        efx_oword_t reg;
@@ -2008,7 +2002,7 @@ static void falcon_mdio_write(struct net_device *net_dev, int phy_id,
 * could be read, -1 will be returned. */
 static int falcon_mdio_read(struct net_device *net_dev, int phy_id, int addr)
 {
-        struct efx_nic *efx = (struct efx_nic *)net_dev->priv;
+        struct efx_nic *efx = net_dev->priv;
        unsigned int phy_addr = phy_id & FALCON_PHY_ID_ID_MASK;
        efx_oword_t reg;
        int value = -1;
@@ -2113,7 +2107,7 @@ int falcon_probe_port(struct efx_nic *efx)
        falcon_init_mdio(&efx->mii);
        /* Hardware flow ctrl. FalconA RX FIFO too small for pause generation */
-        if (FALCON_REV(efx) >= FALCON_REV_B0)
+        if (falcon_rev(efx) >= FALCON_REV_B0)
                efx->flow_control = EFX_FC_RX | EFX_FC_TX;
        else
                efx->flow_control = EFX_FC_RX;
@@ -2373,7 +2367,7 @@ static int falcon_probe_nic_variant(struct efx_nic *efx)
                return -ENODEV;
        }
-        switch (FALCON_REV(efx)) {
+        switch (falcon_rev(efx)) {
        case FALCON_REV_A0:
        case 0xff:
                EFX_ERR(efx, "Falcon rev A0 not supported\n");
@@ -2399,7 +2393,7 @@ static int falcon_probe_nic_variant(struct efx_nic *efx)
                break;
        default:
-                EFX_ERR(efx, "Unknown Falcon rev %d\n", FALCON_REV(efx));
+                EFX_ERR(efx, "Unknown Falcon rev %d\n", falcon_rev(efx));
                return -ENODEV;
        }
@@ -2419,7 +2413,7 @@ int falcon_probe_nic(struct efx_nic *efx)
        /* Allocate storage for hardware specific data */
        nic_data = kzalloc(sizeof(*nic_data), GFP_KERNEL);
-        efx->nic_data = (void *) nic_data;
+        efx->nic_data = nic_data;
        /* Determine number of ports etc. */
        rc = falcon_probe_nic_variant(efx);
@@ -2489,13 +2483,10 @@ int falcon_probe_nic(struct efx_nic *efx)
 */
 int falcon_init_nic(struct efx_nic *efx)
 {
-        struct falcon_nic_data *data;
        efx_oword_t temp;
        unsigned thresh;
        int rc;
-        data = (struct falcon_nic_data *)efx->nic_data;
        /* Set up the address region register. This is only needed
         * for the B0 FPGA, but since we are just pushing in the
         * reset defaults this may as well be unconditional. */
@@ -2562,7 +2553,7 @@ int falcon_init_nic(struct efx_nic *efx)
        /* Set number of RSS queues for receive path. */
        falcon_read(efx, &temp, RX_FILTER_CTL_REG);
-        if (FALCON_REV(efx) >= FALCON_REV_B0)
+        if (falcon_rev(efx) >= FALCON_REV_B0)
                EFX_SET_OWORD_FIELD(temp, NUM_KER, 0);
        else
                EFX_SET_OWORD_FIELD(temp, NUM_KER, efx->rss_queues - 1);
@@ -2600,7 +2591,7 @@ int falcon_init_nic(struct efx_nic *efx)
        /* Prefetch threshold 2 => fetch when descriptor cache half empty */
        EFX_SET_OWORD_FIELD(temp, TX_PREF_THRESHOLD, 2);
        /* Squash TX of packets of 16 bytes or less */
-        if (FALCON_REV(efx) >= FALCON_REV_B0 && EFX_WORKAROUND_9141(efx))
+        if (falcon_rev(efx) >= FALCON_REV_B0 && EFX_WORKAROUND_9141(efx))
                EFX_SET_OWORD_FIELD(temp, TX_FLUSH_MIN_LEN_EN_B0, 1);
        falcon_write(efx, &temp, TX_CFG2_REG_KER);
@@ -2617,7 +2608,7 @@ int falcon_init_nic(struct efx_nic *efx)
        if (EFX_WORKAROUND_7575(efx))
                EFX_SET_OWORD_FIELD_VER(efx, temp, RX_USR_BUF_SIZE,
                                        (3 * 4096) / 32);
-        if (FALCON_REV(efx) >= FALCON_REV_B0)
+        if (falcon_rev(efx) >= FALCON_REV_B0)
                EFX_SET_OWORD_FIELD(temp, RX_INGR_EN_B0, 1);
        /* RX FIFO flow control thresholds */
@@ -2633,7 +2624,7 @@ int falcon_init_nic(struct efx_nic *efx)
        falcon_write(efx, &temp, RX_CFG_REG_KER);
        /* Set destination of both TX and RX Flush events */
-        if (FALCON_REV(efx) >= FALCON_REV_B0) {
+        if (falcon_rev(efx) >= FALCON_REV_B0) {
                EFX_POPULATE_OWORD_1(temp, FLS_EVQ_ID, 0);
                falcon_write(efx, &temp, DP_CTRL_REG);
        }
@@ -2647,7 +2638,7 @@ void falcon_remove_nic(struct efx_nic *efx)
        falcon_free_buffer(efx, &efx->irq_status);
-        (void) falcon_reset_hw(efx, RESET_TYPE_ALL);
+        falcon_reset_hw(efx, RESET_TYPE_ALL);
        /* Release the second function after the reset */
        if (nic_data->pci_dev2) {
diff --git a/drivers/net/sfc/falcon.h b/drivers/net/sfc/falcon.h
index 6117403b0c03..492f9bc28840 100644
--- a/drivers/net/sfc/falcon.h
+++ b/drivers/net/sfc/falcon.h
@@ -23,7 +23,10 @@ enum falcon_revision {
        FALCON_REV_B0 = 2,
 };
-#define FALCON_REV(efx) ((efx)->pci_dev->revision)
+static inline int falcon_rev(struct efx_nic *efx)
+{
+        return efx->pci_dev->revision;
+}
 extern struct efx_nic_type falcon_a_nic_type;
 extern struct efx_nic_type falcon_b_nic_type;
diff --git a/drivers/net/sfc/falcon_hwdefs.h b/drivers/net/sfc/falcon_hwdefs.h
index 06e2d68fc3d1..6d003114eeab 100644
--- a/drivers/net/sfc/falcon_hwdefs.h
+++ b/drivers/net/sfc/falcon_hwdefs.h
@@ -1125,7 +1125,7 @@ struct falcon_nvconfig_board_v2 {
        u8 port1_phy_type;
        __le16 asic_sub_revision;
        __le16 board_revision;
-} __attribute__ ((packed));
+} __packed;
 #define NVCONFIG_BASE 0x300
 #define NVCONFIG_BOARD_MAGIC_NUM 0xFA1C
@@ -1144,6 +1144,6 @@ struct falcon_nvconfig {
        __le16 board_struct_ver;
        __le16 board_checksum;
        struct falcon_nvconfig_board_v2 board_v2;
-} __attribute__ ((packed));
+} __packed;
 #endif /* EFX_FALCON_HWDEFS_H */
diff --git a/drivers/net/sfc/falcon_io.h b/drivers/net/sfc/falcon_io.h
index ea08184ddfa9..6670cdfc41ab 100644
--- a/drivers/net/sfc/falcon_io.h
+++ b/drivers/net/sfc/falcon_io.h
@@ -56,14 +56,27 @@
 #define FALCON_USE_QWORD_IO 1
 #endif
-#define _falcon_writeq(efx, value, reg) \
+#ifdef FALCON_USE_QWORD_IO
-        __raw_writeq((__force u64) (value), (efx)->membase + (reg))
+static inline void _falcon_writeq(struct efx_nic *efx, __le64 value,
-#define _falcon_writel(efx, value, reg) \
+                                  unsigned int reg)
-        __raw_writel((__force u32) (value), (efx)->membase + (reg))
+{
-#define _falcon_readq(efx, reg) \
+        __raw_writeq((__force u64)value, efx->membase + reg);
-        ((__force __le64) __raw_readq((efx)->membase + (reg)))
+}
-#define _falcon_readl(efx, reg) \
+static inline __le64 _falcon_readq(struct efx_nic *efx, unsigned int reg)
-        ((__force __le32) __raw_readl((efx)->membase + (reg)))
+{
+        return (__force __le64)__raw_readq(efx->membase + reg);
+}
+#endif
+static inline void _falcon_writel(struct efx_nic *efx, __le32 value,
+                                  unsigned int reg)
+{
+        __raw_writel((__force u32)value, efx->membase + reg);
+}
+static inline __le32 _falcon_readl(struct efx_nic *efx, unsigned int reg)
+{
+        return (__force __le32)__raw_readl(efx->membase + reg);
+}
 /* Writes to a normal 16-byte Falcon register, locking as appropriate. */
 static inline void falcon_write(struct efx_nic *efx, efx_oword_t *value,
diff --git a/drivers/net/sfc/falcon_xmac.c b/drivers/net/sfc/falcon_xmac.c
index a74b7931a3c4..55c0d9760be8 100644
--- a/drivers/net/sfc/falcon_xmac.c
+++ b/drivers/net/sfc/falcon_xmac.c
@@ -221,7 +221,7 @@ static int falcon_xgmii_status(struct efx_nic *efx)
 {
        efx_dword_t reg;
-        if (FALCON_REV(efx) < FALCON_REV_B0)
+        if (falcon_rev(efx) < FALCON_REV_B0)
                return 1;
        /* The ISR latches, so clear it and re-read */
@@ -241,7 +241,7 @@ static void falcon_mask_status_intr(struct efx_nic *efx, int enable)
 {
        efx_dword_t reg;
-        if ((FALCON_REV(efx) < FALCON_REV_B0) || LOOPBACK_INTERNAL(efx))
+        if ((falcon_rev(efx) < FALCON_REV_B0) || LOOPBACK_INTERNAL(efx))
                return;
        /* Flush the ISR */
@@ -454,12 +454,12 @@ static int falcon_check_xaui_link_up(struct efx_nic *efx)
                EFX_LOG(efx, "%s Clobbering XAUI (%d tries left).\n",
                        __func__, tries);
-                (void) falcon_reset_xaui(efx);
+                falcon_reset_xaui(efx);
                udelay(200);
                tries--;
        }
-        EFX_ERR(efx, "Failed to bring XAUI link back up in %d tries!\n",
+        EFX_LOG(efx, "Failed to bring XAUI link back up in %d tries!\n",
                max_tries);
        return 0;
 }
@@ -572,7 +572,7 @@ int falcon_check_xmac(struct efx_nic *efx)
        xaui_link_ok = falcon_xaui_link_ok(efx);
        if (EFX_WORKAROUND_5147(efx) && !xaui_link_ok)
-                (void) falcon_reset_xaui(efx);
+                falcon_reset_xaui(efx);
        /* Call the PHY check_hw routine */
        rc = efx->phy_op->check_hw(efx);
@@ -639,7 +639,7 @@ int falcon_xmac_set_pause(struct efx_nic *efx, enum efx_fc_type flow_control)
        reset = ((flow_control & EFX_FC_TX) &&
                 !(efx->flow_control & EFX_FC_TX));
        if (EFX_WORKAROUND_11482(efx) && reset) {
-                if (FALCON_REV(efx) >= FALCON_REV_B0) {
+                if (falcon_rev(efx) >= FALCON_REV_B0) {
                        /* Recover by resetting the EM block */
                        if (efx->link_up)
                                falcon_drain_tx_fifo(efx);
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 59f261b4171f..5e20e7551dae 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -42,7 +42,7 @@
 #ifndef EFX_DRIVER_NAME
 #define EFX_DRIVER_NAME "sfc"
 #endif
-#define EFX_DRIVER_VERSION      "2.2.0136"
+#define EFX_DRIVER_VERSION      "2.2"
 #ifdef EFX_ENABLE_DEBUG
 #define EFX_BUG_ON_PARANOID(x) BUG_ON(x)
@@ -52,28 +52,19 @@
 #define EFX_WARN_ON_PARANOID(x) do {} while (0)
 #endif
-#define NET_DEV_REGISTERED(efx)                                 \
-        ((efx)->net_dev->reg_state == NETREG_REGISTERED)
-/* Include net device name in log messages if it has been registered.
- * Use efx->name not efx->net_dev->name so that races with (un)registration
- * are harmless.
- */
-#define NET_DEV_NAME(efx) (NET_DEV_REGISTERED(efx) ? (efx)->name : "")
 /* Un-rate-limited logging */
 #define EFX_ERR(efx, fmt, args...) \
-dev_err(&((efx)->pci_dev->dev), "ERR: %s " fmt, NET_DEV_NAME(efx), ##args)
+dev_err(&((efx)->pci_dev->dev), "ERR: %s " fmt, efx_dev_name(efx), ##args)
 #define EFX_INFO(efx, fmt, args...) \
-dev_info(&((efx)->pci_dev->dev), "INFO: %s " fmt, NET_DEV_NAME(efx), ##args)
+dev_info(&((efx)->pci_dev->dev), "INFO: %s " fmt, efx_dev_name(efx), ##args)
 #ifdef EFX_ENABLE_DEBUG
 #define EFX_LOG(efx, fmt, args...) \
-dev_info(&((efx)->pci_dev->dev), "DBG: %s " fmt, NET_DEV_NAME(efx), ##args)
+dev_info(&((efx)->pci_dev->dev), "DBG: %s " fmt, efx_dev_name(efx), ##args)
 #else
 #define EFX_LOG(efx, fmt, args...) \
-dev_dbg(&((efx)->pci_dev->dev), "DBG: %s " fmt, NET_DEV_NAME(efx), ##args)
+dev_dbg(&((efx)->pci_dev->dev), "DBG: %s " fmt, efx_dev_name(efx), ##args)
 #endif
 #define EFX_TRACE(efx, fmt, args...) do {} while (0)
@@ -90,11 +81,6 @@ do {if (net_ratelimit()) EFX_INFO(efx, fmt, ##args); } while (0)
 #define EFX_LOG_RL(efx, fmt, args...) \
 do {if (net_ratelimit()) EFX_LOG(efx, fmt, ##args); } while (0)
-/* Kernel headers may redefine inline anyway */
-#ifndef inline
-#define inline inline __attribute__ ((always_inline))
-#endif
 /**************************************************************************
 *
 * Efx data structures
@@ -695,7 +681,7 @@ struct efx_nic {
        struct workqueue_struct *workqueue;
        struct work_struct reset_work;
        struct delayed_work monitor_work;
-        unsigned long membase_phys;
+        resource_size_t membase_phys;
        void __iomem *membase;
        spinlock_t biu_lock;
        enum efx_int_mode interrupt_mode;
@@ -719,7 +705,7 @@ struct efx_nic {
        unsigned n_rx_nodesc_drop_cnt;
-        void *nic_data;
+        struct falcon_nic_data *nic_data;
        struct mutex mac_lock;
        int port_enabled;
@@ -760,6 +746,20 @@ struct efx_nic {
        void *loopback_selftest;
 };
+static inline int efx_dev_registered(struct efx_nic *efx)
+{
+        return efx->net_dev->reg_state == NETREG_REGISTERED;
+}
+/* Net device name, for inclusion in log messages if it has been registered.
+ * Use efx->name not efx->net_dev->name so that races with (un)registration
+ * are harmless.
+ */
+static inline const char *efx_dev_name(struct efx_nic *efx)
+{
+        return efx_dev_registered(efx) ? efx->name : "";
+}
 /**
 * struct efx_nic_type - Efx device type definition
 * @mem_bar: Memory BAR number
@@ -795,7 +795,7 @@ struct efx_nic_type {
        unsigned int txd_ring_mask;
        unsigned int rxd_ring_mask;
        unsigned int evq_size;
-        dma_addr_t max_dma_mask;
+        u64 max_dma_mask;
        unsigned int tx_dma_mask;
        unsigned bug5391_mask;
diff --git a/drivers/net/sfc/rx.c b/drivers/net/sfc/rx.c
index 670622373ddf..601b001437c0 100644
--- a/drivers/net/sfc/rx.c
+++ b/drivers/net/sfc/rx.c
@@ -86,14 +86,17 @@ static unsigned int rx_refill_limit = 95;
 */
 #define EFX_RXD_HEAD_ROOM 2
-/* Macros for zero-order pages (potentially) containing multiple RX buffers */
+static inline unsigned int efx_rx_buf_offset(struct efx_rx_buffer *buf)
-#define RX_DATA_OFFSET(_data)                           \
+{
-        (((unsigned long) (_data)) & (PAGE_SIZE-1))
+        /* Offset is always within one page, so we don't need to consider
-#define RX_BUF_OFFSET(_rx_buf)                          \
+         * the page order.
-        RX_DATA_OFFSET((_rx_buf)->data)
+         */
+        return (__force unsigned long) buf->data & (PAGE_SIZE - 1);
-#define RX_PAGE_SIZE(_efx)                              \
+}
-        (PAGE_SIZE * (1u << (_efx)->rx_buffer_order))
+static inline unsigned int efx_rx_buf_size(struct efx_nic *efx)
+{
+        return PAGE_SIZE << efx->rx_buffer_order;
+}
 /**************************************************************************
@@ -106,7 +109,7 @@ static unsigned int rx_refill_limit = 95;
 static int efx_lro_get_skb_hdr(struct sk_buff *skb, void **ip_hdr,
                               void **tcpudp_hdr, u64 *hdr_flags, void *priv)
 {
-        struct efx_channel *channel = (struct efx_channel *)priv;
+        struct efx_channel *channel = priv;
        struct iphdr *iph;
        struct tcphdr *th;
@@ -131,12 +134,12 @@ static int efx_get_frag_hdr(struct skb_frag_struct *frag, void **mac_hdr,
                            void **ip_hdr, void **tcpudp_hdr, u64 *hdr_flags,
                            void *priv)
 {
-        struct efx_channel *channel = (struct efx_channel *)priv;
+        struct efx_channel *channel = priv;
        struct ethhdr *eh;
        struct iphdr *iph;
        /* We support EtherII and VLAN encapsulated IPv4 */
-        eh = (struct ethhdr *)(page_address(frag->page) + frag->page_offset);
+        eh = page_address(frag->page) + frag->page_offset;
        *mac_hdr = eh;
        if (eh->h_proto == htons(ETH_P_IP)) {
@@ -269,7 +272,7 @@ static inline int efx_init_rx_buffer_page(struct efx_rx_queue *rx_queue,
                        return -ENOMEM;
                dma_addr = pci_map_page(efx->pci_dev, rx_buf->page,
-                                        0, RX_PAGE_SIZE(efx),
+                                        0, efx_rx_buf_size(efx),
                                        PCI_DMA_FROMDEVICE);
                if (unlikely(pci_dma_mapping_error(dma_addr))) {
@@ -280,14 +283,14 @@ static inline int efx_init_rx_buffer_page(struct efx_rx_queue *rx_queue,
                rx_queue->buf_page = rx_buf->page;
                rx_queue->buf_dma_addr = dma_addr;
-                rx_queue->buf_data = ((char *) page_address(rx_buf->page) +
+                rx_queue->buf_data = (page_address(rx_buf->page) +
                                      EFX_PAGE_IP_ALIGN);
        }
-        offset = RX_DATA_OFFSET(rx_queue->buf_data);
        rx_buf->len = bytes;
-        rx_buf->dma_addr = rx_queue->buf_dma_addr + offset;
        rx_buf->data = rx_queue->buf_data;
+        offset = efx_rx_buf_offset(rx_buf);
+        rx_buf->dma_addr = rx_queue->buf_dma_addr + offset;
        /* Try to pack multiple buffers per page */
        if (efx->rx_buffer_order == 0) {
@@ -295,7 +298,7 @@ static inline int efx_init_rx_buffer_page(struct efx_rx_queue *rx_queue,
                rx_queue->buf_data += ((bytes + 0x1ff) & ~0x1ff);
                offset += ((bytes + 0x1ff) & ~0x1ff);
-                space = RX_PAGE_SIZE(efx) - offset;
+                space = efx_rx_buf_size(efx) - offset;
                if (space >= bytes) {
                        /* Refs dropped on kernel releasing each skb */
                        get_page(rx_queue->buf_page);
@@ -344,7 +347,8 @@ static inline void efx_unmap_rx_buffer(struct efx_nic *efx,
                EFX_BUG_ON_PARANOID(rx_buf->skb);
                if (rx_buf->unmap_addr) {
                        pci_unmap_page(efx->pci_dev, rx_buf->unmap_addr,
-                                       RX_PAGE_SIZE(efx), PCI_DMA_FROMDEVICE);
+                                       efx_rx_buf_size(efx),
+                                       PCI_DMA_FROMDEVICE);
                        rx_buf->unmap_addr = 0;
                }
        } else if (likely(rx_buf->skb)) {
@@ -400,9 +404,10 @@ static int __efx_fast_push_rx_descriptors(struct efx_rx_queue *rx_queue,
                return 0;
        /* Record minimum fill level */
-        if (unlikely(fill_level < rx_queue->min_fill))
+        if (unlikely(fill_level < rx_queue->min_fill)) {
                if (fill_level)
                        rx_queue->min_fill = fill_level;
+        }
        /* Acquire RX add lock.  If this lock is contended, then a fast
         * fill must already be in progress (e.g. in the refill
@@ -552,7 +557,7 @@ static inline void efx_rx_packet_lro(struct efx_channel *channel,
                struct skb_frag_struct frags;
                frags.page = rx_buf->page;
-                frags.page_offset = RX_BUF_OFFSET(rx_buf);
+                frags.page_offset = efx_rx_buf_offset(rx_buf);
                frags.size = rx_buf->len;
                lro_receive_frags(lro_mgr, &frags, rx_buf->len,
@@ -597,7 +602,7 @@ static inline struct sk_buff *efx_rx_mk_skb(struct efx_rx_buffer *rx_buf,
        if (unlikely(rx_buf->len > hdr_len)) {
                struct skb_frag_struct *frag = skb_shinfo(skb)->frags;
                frag->page = rx_buf->page;
-                frag->page_offset = RX_BUF_OFFSET(rx_buf) + hdr_len;
+                frag->page_offset = efx_rx_buf_offset(rx_buf) + hdr_len;
                frag->size = skb->len - hdr_len;
                skb_shinfo(skb)->nr_frags = 1;
                skb->data_len = frag->size;
@@ -851,7 +856,8 @@ void efx_fini_rx_queue(struct efx_rx_queue *rx_queue)
        /* For a page that is part-way through splitting into RX buffers */
        if (rx_queue->buf_page != NULL) {
                pci_unmap_page(rx_queue->efx->pci_dev, rx_queue->buf_dma_addr,
-                               RX_PAGE_SIZE(rx_queue->efx), PCI_DMA_FROMDEVICE);
+                               efx_rx_buf_size(rx_queue->efx),
+                               PCI_DMA_FROMDEVICE);
                __free_pages(rx_queue->buf_page,
                             rx_queue->efx->rx_buffer_order);
                rx_queue->buf_page = NULL;
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index cbda15946e8f..3b2de9fe7f27 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -290,7 +290,7 @@ void efx_loopback_rx_packet(struct efx_nic *efx,
        payload = &state->payload;
        
-        received = (struct efx_loopback_payload *)(char *) buf_ptr;
+        received = (struct efx_loopback_payload *) buf_ptr;
        received->ip.saddr = payload->ip.saddr;
        received->ip.check = payload->ip.check;
        
@@ -424,10 +424,10 @@ static int efx_tx_loopback(struct efx_tx_queue *tx_queue)
                 * interrupt handler. */
                smp_wmb();
-                if (NET_DEV_REGISTERED(efx))
+                if (efx_dev_registered(efx))
                        netif_tx_lock_bh(efx->net_dev);
                rc = efx_xmit(efx, tx_queue, skb);
-                if (NET_DEV_REGISTERED(efx))
+                if (efx_dev_registered(efx))
                        netif_tx_unlock_bh(efx->net_dev);
                if (rc != NETDEV_TX_OK) {
@@ -453,7 +453,7 @@ static int efx_rx_loopback(struct efx_tx_queue *tx_queue,
        int tx_done = 0, rx_good, rx_bad;
        int i, rc = 0;
-        if (NET_DEV_REGISTERED(efx))
+        if (efx_dev_registered(efx))
                netif_tx_lock_bh(efx->net_dev);
        /* Count the number of tx completions, and decrement the refcnt. Any
@@ -465,7 +465,7 @@ static int efx_rx_loopback(struct efx_tx_queue *tx_queue,
                dev_kfree_skb_any(skb);
        }
-        if (NET_DEV_REGISTERED(efx))
+        if (efx_dev_registered(efx))
                netif_tx_unlock_bh(efx->net_dev);
        /* Check TX completion and received packet counts */
@@ -517,6 +517,8 @@ efx_test_loopback(struct efx_tx_queue *tx_queue,
                state->packet_count = min(1 << (i << 2), state->packet_count);
                state->skbs = kzalloc(sizeof(state->skbs[0]) *
                                      state->packet_count, GFP_KERNEL);
+                if (!state->skbs)
+                        return -ENOMEM;
                state->flush = 0;
                EFX_LOG(efx, "TX queue %d testing %s loopback with %d "
@@ -700,7 +702,7 @@ int efx_offline_test(struct efx_nic *efx,
         * "flushing" so all inflight packets are dropped */
        BUG_ON(efx->loopback_selftest);
        state->flush = 1;
-        efx->loopback_selftest = (void *)state;
+        efx->loopback_selftest = state;
        rc = efx_test_loopbacks(efx, tests, loopback_modes);
diff --git a/drivers/net/sfc/sfe4001.c b/drivers/net/sfc/sfe4001.c
index 725d1a539c49..66a0d1442aba 100644
--- a/drivers/net/sfc/sfe4001.c
+++ b/drivers/net/sfc/sfe4001.c
@@ -116,18 +116,18 @@ void sfe4001_poweroff(struct efx_nic *efx)
        /* Turn off all power rails */
        out = 0xff;
-        (void) efx_i2c_write(i2c, PCA9539, P0_OUT, &out, 1);
+        efx_i2c_write(i2c, PCA9539, P0_OUT, &out, 1);
        /* Disable port 1 outputs on IO expander */
        cfg = 0xff;
-        (void) efx_i2c_write(i2c, PCA9539, P1_CONFIG, &cfg, 1);
+        efx_i2c_write(i2c, PCA9539, P1_CONFIG, &cfg, 1);
        /* Disable port 0 outputs on IO expander */
        cfg = 0xff;
-        (void) efx_i2c_write(i2c, PCA9539, P0_CONFIG, &cfg, 1);
+        efx_i2c_write(i2c, PCA9539, P0_CONFIG, &cfg, 1);
        /* Clear any over-temperature alert */
-        (void) efx_i2c_read(i2c, MAX6647, RSL, &in, 1);
+        efx_i2c_read(i2c, MAX6647, RSL, &in, 1);
 }
 /* The P0_EN_3V3X line on SFE4001 boards (from A2 onward) is connected
@@ -253,14 +253,14 @@ done:
 fail3:
        /* Turn off all power rails */
        out = 0xff;
-        (void) efx_i2c_write(i2c, PCA9539, P0_OUT, &out, 1);
+        efx_i2c_write(i2c, PCA9539, P0_OUT, &out, 1);
        /* Disable port 1 outputs on IO expander */
        out = 0xff;
-        (void) efx_i2c_write(i2c, PCA9539, P1_CONFIG, &out, 1);
+        efx_i2c_write(i2c, PCA9539, P1_CONFIG, &out, 1);
 fail2:
        /* Disable port 0 outputs on IO expander */
        out = 0xff;
-        (void) efx_i2c_write(i2c, PCA9539, P0_CONFIG, &out, 1);
+        efx_i2c_write(i2c, PCA9539, P0_CONFIG, &out, 1);
 fail1:
        return rc;
 }
diff --git a/drivers/net/sfc/tenxpress.c b/drivers/net/sfc/tenxpress.c
index b1cd6deec01f..c0146061c326 100644
--- a/drivers/net/sfc/tenxpress.c
+++ b/drivers/net/sfc/tenxpress.c
@@ -211,6 +211,8 @@ static int tenxpress_phy_init(struct efx_nic *efx)
        int rc = 0;
        phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
+        if (!phy_data)
+                return -ENOMEM;
        efx->phy_data = phy_data;
        tenxpress_set_state(efx, TENXPRESS_STATUS_NORMAL);
@@ -376,7 +378,7 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
         * perform a special software reset */
        if ((phy_data->tx_disabled && !efx->tx_disabled) ||
            loop_change) {
-                (void) tenxpress_special_reset(efx);
+                tenxpress_special_reset(efx);
                falcon_reset_xaui(efx);
        }
diff --git a/drivers/net/sfc/tx.c b/drivers/net/sfc/tx.c
index 9b436f5b4888..5cdd082ab8f6 100644
--- a/drivers/net/sfc/tx.c
+++ b/drivers/net/sfc/tx.c
@@ -387,7 +387,7 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
        if (unlikely(tx_queue->stopped)) {
                fill_level = tx_queue->insert_count - tx_queue->read_count;
                if (fill_level < EFX_NETDEV_TX_THRESHOLD(tx_queue)) {
-                        EFX_BUG_ON_PARANOID(!NET_DEV_REGISTERED(efx));
+                        EFX_BUG_ON_PARANOID(!efx_dev_registered(efx));
                        /* Do this under netif_tx_lock(), to avoid racing
                         * with efx_xmit(). */
@@ -639,11 +639,12 @@ static void efx_tsoh_block_free(struct efx_tx_queue *tx_queue,
        base_dma = tsoh->dma_addr & PAGE_MASK;
        p = &tx_queue->tso_headers_free;
-        while (*p != NULL)
+        while (*p != NULL) {
                if (((unsigned long)*p & PAGE_MASK) == base_kva)
                        *p = (*p)->next;
                else
                        p = &(*p)->next;
+        }
        pci_free_consistent(pci_dev, PAGE_SIZE, (void *)base_kva, base_dma);
 }
@@ -939,9 +940,10 @@ static inline int tso_start_new_packet(struct efx_tx_queue *tx_queue,
        /* Allocate a DMA-mapped header buffer. */
        if (likely(TSOH_SIZE(st->p.header_length) <= TSOH_STD_SIZE)) {
-                if (tx_queue->tso_headers_free == NULL)
+                if (tx_queue->tso_headers_free == NULL) {
                        if (efx_tsoh_block_alloc(tx_queue))
                                return -1;
+                }
                EFX_BUG_ON_PARANOID(!tx_queue->tso_headers_free);
                tsoh = tx_queue->tso_headers_free;
                tx_queue->tso_headers_free = tsoh->next;
@@ -1106,9 +1108,10 @@ static void efx_fini_tso(struct efx_tx_queue *tx_queue)
 {
        unsigned i;
-        if (tx_queue->buffer)
+        if (tx_queue->buffer) {
                for (i = 0; i <= tx_queue->efx->type->txd_ring_mask; ++i)
                        efx_tsoh_free(tx_queue, &tx_queue->buffer[i]);
+        }
        while (tx_queue->tso_headers_free != NULL)
                efx_tsoh_block_free(tx_queue, tx_queue->tso_headers_free,
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index dca62f190198..35ab19c27f8d 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -16,7 +16,7 @@
 */
 #define EFX_WORKAROUND_ALWAYS(efx) 1
-#define EFX_WORKAROUND_FALCON_A(efx) (FALCON_REV(efx) <= FALCON_REV_A1)
+#define EFX_WORKAROUND_FALCON_A(efx) (falcon_rev(efx) <= FALCON_REV_A1)
 /* XAUI resets if link not detected */
 #define EFX_WORKAROUND_5147 EFX_WORKAROUND_ALWAYS
diff --git a/drivers/net/sfc/xfp_phy.c b/drivers/net/sfc/xfp_phy.c
index 3b9f9ddbc372..f3684ad28887 100644
--- a/drivers/net/sfc/xfp_phy.c
+++ b/drivers/net/sfc/xfp_phy.c
@@ -85,7 +85,9 @@ static int xfp_phy_init(struct efx_nic *efx)
        int rc;
        phy_data = kzalloc(sizeof(struct xfp_phy_data), GFP_KERNEL);
-        efx->phy_data = (void *) phy_data;
+        if (!phy_data)
+                return -ENOMEM;
+        efx->phy_data = phy_data;
        EFX_INFO(efx, "XFP: PHY ID reg %x (OUI %x model %x revision"
                 " %x)\n", devid, MDIO_ID_OUI(devid), MDIO_ID_MODEL(devid),
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index f226bcac7d17..62436b3a18c6 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1159,17 +1159,9 @@ static int sky2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 }
 #ifdef SKY2_VLAN_TAG_USED
-static void sky2_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
+static void sky2_set_vlan_mode(struct sky2_hw *hw, u16 port, bool onoff)
 {
-        struct sky2_port *sky2 = netdev_priv(dev);
+        if (onoff) {
-        struct sky2_hw *hw = sky2->hw;
-        u16 port = sky2->port;
-        netif_tx_lock_bh(dev);
-        napi_disable(&hw->napi);
-        sky2->vlgrp = grp;
-        if (grp) {
                sky2_write32(hw, SK_REG(port, RX_GMF_CTRL_T),
                             RX_VLAN_STRIP_ON);
                sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
@@ -1180,6 +1172,19 @@ static void sky2_vlan_rx_register(struct net_device *dev, struct vlan_group *grp
                sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
                             TX_VLAN_TAG_OFF);
        }
+}
+static void sky2_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
+{
+        struct sky2_port *sky2 = netdev_priv(dev);
+        struct sky2_hw *hw = sky2->hw;
+        u16 port = sky2->port;
+        netif_tx_lock_bh(dev);
+        napi_disable(&hw->napi);
+        sky2->vlgrp = grp;
+        sky2_set_vlan_mode(hw, port, grp != NULL);
        sky2_read32(hw, B0_Y2_SP_LISR);
        napi_enable(&hw->napi);
@@ -1418,6 +1423,10 @@ static int sky2_up(struct net_device *dev)
        sky2_prefetch_init(hw, txqaddr[port], sky2->tx_le_map,
                           TX_RING_SIZE - 1);
+#ifdef SKY2_VLAN_TAG_USED
+        sky2_set_vlan_mode(hw, port, sky2->vlgrp != NULL);
+#endif
        err = sky2_rx_start(sky2);
        if (err)
                goto err_out;
@@ -4395,7 +4404,9 @@ static int sky2_resume(struct pci_dev *pdev)
                        if (err) {
                                printk(KERN_ERR PFX "%s: could not up: %d\n",
                                       dev->name, err);
+                                rtnl_lock();
                                dev_close(dev);
+                                rtnl_unlock();
                                goto out;
                        }
                }
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index 4e2800205189..e2ee91a6ae7e 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -136,7 +136,6 @@ struct smc911x_local {
        /* work queue */
        struct work_struct phy_configure;
-        int work_pending;
        int tx_throttle;
        spinlock_t lock;
@@ -960,11 +959,11 @@ static void smc911x_phy_configure(struct work_struct *work)
         * We should not be called if phy_type is zero.
         */
        if (lp->phy_type == 0)
-                 goto smc911x_phy_configure_exit_nolock;
+                return;
        if (smc911x_phy_reset(dev, phyaddr)) {
                printk("%s: PHY reset timed out\n", dev->name);
-                goto smc911x_phy_configure_exit_nolock;
+                return;
        }
        spin_lock_irqsave(&lp->lock, flags);
@@ -1033,8 +1032,6 @@ static void smc911x_phy_configure(struct work_struct *work)
 smc911x_phy_configure_exit:
        spin_unlock_irqrestore(&lp->lock, flags);
-smc911x_phy_configure_exit_nolock:
-        lp->work_pending = 0;
 }
 /*
@@ -1356,11 +1353,8 @@ static void smc911x_timeout(struct net_device *dev)
         * smc911x_phy_configure() calls msleep() which calls schedule_timeout()
         * which calls schedule().       Hence we use a work queue.
         */
-        if (lp->phy_type != 0) {
+        if (lp->phy_type != 0)
-                if (schedule_work(&lp->phy_configure)) {
+                schedule_work(&lp->phy_configure);
-                        lp->work_pending = 1;
-                }
-        }
        /* We can accept TX packets again */
        dev->trans_start = jiffies;
@@ -1531,16 +1525,8 @@ static int smc911x_close(struct net_device *dev)
        if (lp->phy_type != 0) {
                /* We need to ensure that no calls to
                 * smc911x_phy_configure are pending.
-                 * flush_scheduled_work() cannot be called because we
-                 * are running with the netlink semaphore held (from
-                 * devinet_ioctl()) and the pending work queue
-                 * contains linkwatch_event() (scheduled by
-                 * netif_carrier_off() above). linkwatch_event() also
-                 * wants the netlink semaphore.
                 */
-                while (lp->work_pending)
+                cancel_work_sync(&lp->phy_configure);
-                        schedule();
                smc911x_phy_powerdown(dev, lp->mii.phy_id);
        }
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index a188e33484e6..f2051b209da2 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -1016,15 +1016,8 @@ static void smc_phy_powerdown(struct net_device *dev)
        /* We need to ensure that no calls to smc_phy_configure are
           pending.
-           flush_scheduled_work() cannot be called because we are
-           running with the netlink semaphore held (from
-           devinet_ioctl()) and the pending work queue contains
-           linkwatch_event() (scheduled by netif_carrier_off()
-           above). linkwatch_event() also wants the netlink semaphore.
        */
-        while(lp->work_pending)
+        cancel_work_sync(&lp->phy_configure);
-                yield();
        bmcr = smc_phy_read(dev, phy, MII_BMCR);
        smc_phy_write(dev, phy, MII_BMCR, bmcr | BMCR_PDOWN);
@@ -1161,7 +1154,6 @@ static void smc_phy_configure(struct work_struct *work)
 smc_phy_configure_exit:
        SMC_SELECT_BANK(lp, 2);
        spin_unlock_irq(&lp->lock);
-        lp->work_pending = 0;
 }
 /*
@@ -1389,11 +1381,8 @@ static void smc_timeout(struct net_device *dev)
         * smc_phy_configure() calls msleep() which calls schedule_timeout()
         * which calls schedule().  Hence we use a work queue.
         */
-        if (lp->phy_type != 0) {
+        if (lp->phy_type != 0)
-                if (schedule_work(&lp->phy_configure)) {
+                schedule_work(&lp->phy_configure);
-                        lp->work_pending = 1;
-                }
-        }
        /* We can accept TX packets again */
        dev->trans_start = jiffies;
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index 69e97a1cb1c4..8606818653f8 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -93,14 +93,14 @@
 #define SMC_insw(a, r, p, l)    insw ((unsigned long *)((a) + (r)), p, l)
 # endif
 /* check if the mac in reg is valid */
-#define SMC_GET_MAC_ADDR(addr)                                  \
+#define SMC_GET_MAC_ADDR(lp, addr)                              \
        do {                                                    \
                unsigned int __v;                               \
-                __v = SMC_inw(ioaddr, ADDR0_REG);               \
+                __v = SMC_inw(ioaddr, ADDR0_REG(lp));           \
                addr[0] = __v; addr[1] = __v >> 8;              \
-                __v = SMC_inw(ioaddr, ADDR1_REG);               \
+                __v = SMC_inw(ioaddr, ADDR1_REG(lp));           \
                addr[2] = __v; addr[3] = __v >> 8;              \
-                __v = SMC_inw(ioaddr, ADDR2_REG);               \
+                __v = SMC_inw(ioaddr, ADDR2_REG(lp));           \
                addr[4] = __v; addr[5] = __v >> 8;              \
                if (*(u32 *)(&addr[0]) == 0xFFFFFFFF) {         \
                        random_ether_addr(addr);                \
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index b4e7f30ea4e8..1aa425be3067 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -111,7 +111,7 @@ static __inline__ void tx_add_log(struct happy_meal *hp, unsigned int a, unsigne
        struct hme_tx_logent *tlp;
        unsigned long flags;
-        save_and_cli(flags);
+        local_irq_save(flags);
        tlp = &tx_log[txlog_cur_entry];
        tlp->tstamp = (unsigned int)jiffies;
        tlp->tx_new = hp->tx_new;
@@ -119,7 +119,7 @@ static __inline__ void tx_add_log(struct happy_meal *hp, unsigned int a, unsigne
        tlp->action = a;
        tlp->status = s;
        txlog_cur_entry = (txlog_cur_entry + 1) & (TX_LOG_LEN - 1);
-        restore_flags(flags);
+        local_irq_restore(flags);
 }
 static __inline__ void tx_dump_log(void)
 {
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 07b3f77e7626..cc4bde852542 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.92"
+#define DRV_MODULE_VERSION      "3.92.1"
-#define DRV_MODULE_RELDATE      "May 2, 2008"
+#define DRV_MODULE_RELDATE      "June 9, 2008"
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -1295,6 +1295,21 @@ static void tg3_frob_aux_power(struct tg3 *tp)
                                     GRC_LCLCTRL_GPIO_OUTPUT0 |
                                     GRC_LCLCTRL_GPIO_OUTPUT1),
                                    100);
+                } else if (tp->pdev->device == PCI_DEVICE_ID_TIGON3_5761) {
+                        /* The 5761 non-e device swaps GPIO 0 and GPIO 2. */
+                        u32 grc_local_ctrl = GRC_LCLCTRL_GPIO_OE0 |
+                                             GRC_LCLCTRL_GPIO_OE1 |
+                                             GRC_LCLCTRL_GPIO_OE2 |
+                                             GRC_LCLCTRL_GPIO_OUTPUT0 |
+                                             GRC_LCLCTRL_GPIO_OUTPUT1 |
+                                             tp->grc_local_ctrl;
+                        tw32_wait_f(GRC_LOCAL_CTRL, grc_local_ctrl, 100);
+                        grc_local_ctrl |= GRC_LCLCTRL_GPIO_OUTPUT2;
+                        tw32_wait_f(GRC_LOCAL_CTRL, grc_local_ctrl, 100);
+                        grc_local_ctrl &= ~GRC_LCLCTRL_GPIO_OUTPUT0;
+                        tw32_wait_f(GRC_LOCAL_CTRL, grc_local_ctrl, 100);
                } else {
                        u32 no_gpio2;
                        u32 grc_local_ctrl = 0;
@@ -3168,8 +3183,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, int force_reset)
        err |= tg3_readphy(tp, MII_BMCR, &bmcr);
        if ((tp->link_config.autoneg == AUTONEG_ENABLE) && !force_reset &&
-            (tp->tg3_flags2 & TG3_FLG2_PARALLEL_DETECT) &&
+            (tp->tg3_flags2 & TG3_FLG2_PARALLEL_DETECT)) {
-             tp->link_config.flowctrl == tp->link_config.active_flowctrl) {
                /* do nothing, just check for link up at the end */
        } else if (tp->link_config.autoneg == AUTONEG_ENABLE) {
                u32 adv, new_adv;
@@ -8599,7 +8613,7 @@ static int tg3_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                   (cmd->speed == SPEED_1000))
                return -EINVAL;
        else if ((cmd->speed == SPEED_1000) &&
-                 (tp->tg3_flags2 & TG3_FLAG_10_100_ONLY))
+                 (tp->tg3_flags & TG3_FLAG_10_100_ONLY))
                return -EINVAL;
        tg3_full_lock(tp, 0);
@@ -11768,6 +11782,15 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5755)
                tp->grc_local_ctrl |= GRC_LCLCTRL_GPIO_UART_SEL;
+        if (tp->pdev->device == PCI_DEVICE_ID_TIGON3_5761) {
+                /* Turn off the debug UART. */
+                tp->grc_local_ctrl |= GRC_LCLCTRL_GPIO_UART_SEL;
+                if (tp->tg3_flags2 & TG3_FLG2_IS_NIC)
+                        /* Keep VMain power. */
+                        tp->grc_local_ctrl |= GRC_LCLCTRL_GPIO_OE0 |
+                                              GRC_LCLCTRL_GPIO_OUTPUT0;
+        }
        /* Force the chip into D0. */
        err = tg3_set_power_state(tp, PCI_D0);
        if (err) {
diff --git a/drivers/net/tokenring/3c359.h b/drivers/net/tokenring/3c359.h
index b880cba0f6fd..74cf8e1a181b 100644
--- a/drivers/net/tokenring/3c359.h
+++ b/drivers/net/tokenring/3c359.h
@@ -264,7 +264,7 @@ struct xl_private {
        u16 asb;
        u8 __iomem *xl_mmio;
-        char *xl_card_name;
+        const char *xl_card_name;
        struct pci_dev *pdev ; 
        
        spinlock_t xl_lock ; 
diff --git a/drivers/net/tokenring/olympic.h b/drivers/net/tokenring/olympic.h
index c91956310fb2..10fbba08978f 100644
--- a/drivers/net/tokenring/olympic.h
+++ b/drivers/net/tokenring/olympic.h
@@ -254,7 +254,7 @@ struct olympic_private {
        u8 __iomem *olympic_mmio;
        u8 __iomem *olympic_lap;
        struct pci_dev *pdev ; 
-        char *olympic_card_name ; 
+        const char *olympic_card_name;
        spinlock_t olympic_lock ; 
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index f9d13fa05d64..af8d2c436efd 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -731,7 +731,7 @@ static void tulip_down (struct net_device *dev)
        void __iomem *ioaddr = tp->base_addr;
        unsigned long flags;
-        flush_scheduled_work();
+        cancel_work_sync(&tp->media_work);
 #ifdef CONFIG_TULIP_NAPI
        napi_disable(&tp->napi);
@@ -1729,12 +1729,15 @@ static int tulip_suspend (struct pci_dev *pdev, pm_message_t state)
        if (!dev)
                return -EINVAL;
-        if (netif_running(dev))
+        if (!netif_running(dev))
-                tulip_down(dev);
+                goto save_state;
+        tulip_down(dev);
        netif_device_detach(dev);
        free_irq(dev->irq, dev);
+save_state:
        pci_save_state(pdev);
        pci_disable_device(pdev);
        pci_set_power_state(pdev, pci_choose_state(pdev, state));
@@ -1754,6 +1757,9 @@ static int tulip_resume(struct pci_dev *pdev)
        pci_set_power_state(pdev, PCI_D0);
        pci_restore_state(pdev);
+        if (!netif_running(dev))
+                return 0;
        if ((retval = pci_enable_device(pdev))) {
                printk (KERN_ERR "tulip: pci_enable_device failed in resume\n");
                return retval;
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
index 2511ca7a12aa..e9e628621639 100644
--- a/drivers/net/tulip/uli526x.c
+++ b/drivers/net/tulip/uli526x.c
@@ -225,6 +225,9 @@ static void uli526x_set_filter_mode(struct net_device *);
 static const struct ethtool_ops netdev_ethtool_ops;
 static u16 read_srom_word(long, int);
 static irqreturn_t uli526x_interrupt(int, void *);
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void uli526x_poll(struct net_device *dev);
+#endif
 static void uli526x_descriptor_init(struct uli526x_board_info *, unsigned long);
 static void allocate_rx_buffer(struct uli526x_board_info *);
 static void update_cr6(u32, unsigned long);
@@ -339,6 +342,9 @@ static int __devinit uli526x_init_one (struct pci_dev *pdev,
        dev->get_stats = &uli526x_get_stats;
        dev->set_multicast_list = &uli526x_set_filter_mode;
        dev->ethtool_ops = &netdev_ethtool_ops;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        dev->poll_controller = &uli526x_poll;
+#endif
        spin_lock_init(&db->lock);
@@ -681,8 +687,9 @@ static irqreturn_t uli526x_interrupt(int irq, void *dev_id)
        db->cr5_data = inl(ioaddr + DCR5);
        outl(db->cr5_data, ioaddr + DCR5);
        if ( !(db->cr5_data & 0x180c1) ) {
-                spin_unlock_irqrestore(&db->lock, flags);
+                /* Restore CR7 to enable interrupt mask */
                outl(db->cr7_data, ioaddr + DCR7);
+                spin_unlock_irqrestore(&db->lock, flags);
                return IRQ_HANDLED;
        }
@@ -715,6 +722,13 @@ static irqreturn_t uli526x_interrupt(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void uli526x_poll(struct net_device *dev)
+{
+        /* ISR grabs the irqsave lock, so this should be safe */
+        uli526x_interrupt(dev->irq, dev);
+}
+#endif
 /*
 *      Free TX resource after TX complete
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index ca0bdac07a78..fb0b918e5ccb 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -237,7 +237,7 @@ static struct sk_buff *get_new_skb(struct ucc_geth_private *ugeth,
        skb->dev = ugeth->dev;
        out_be32(&((struct qe_bd __iomem *)bd)->buf,
-                      dma_map_single(NULL,
+                      dma_map_single(&ugeth->dev->dev,
                                     skb->data,
                                     ugeth->ug_info->uf_info.max_rx_buf_length +
                                     UCC_GETH_RX_DATA_BUF_ALIGNMENT,
@@ -2158,7 +2158,7 @@ static void ucc_geth_memclean(struct ucc_geth_private *ugeth)
                        continue;
                for (j = 0; j < ugeth->ug_info->bdRingLenTx[i]; j++) {
                        if (ugeth->tx_skbuff[i][j]) {
-                                dma_unmap_single(NULL,
+                                dma_unmap_single(&ugeth->dev->dev,
                                                 in_be32(&((struct qe_bd __iomem *)bd)->buf),
                                                 (in_be32((u32 __iomem *)bd) &
                                                  BD_LENGTH_MASK),
@@ -2186,7 +2186,7 @@ static void ucc_geth_memclean(struct ucc_geth_private *ugeth)
                        bd = ugeth->p_rx_bd_ring[i];
                        for (j = 0; j < ugeth->ug_info->bdRingLenRx[i]; j++) {
                                if (ugeth->rx_skbuff[i][j]) {
-                                        dma_unmap_single(NULL,
+                                        dma_unmap_single(&ugeth->dev->dev,
                                                in_be32(&((struct qe_bd __iomem *)bd)->buf),
                                                ugeth->ug_info->
                                                uf_info.max_rx_buf_length +
@@ -3406,7 +3406,8 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* set up the buffer descriptor */
        out_be32(&((struct qe_bd __iomem *)bd)->buf,
-                      dma_map_single(NULL, skb->data, skb->len, DMA_TO_DEVICE));
+                      dma_map_single(&ugeth->dev->dev, skb->data,
+                              skb->len, DMA_TO_DEVICE));
        /* printk(KERN_DEBUG"skb->data is 0x%x\n",skb->data); */
diff --git a/drivers/net/ucc_geth_ethtool.c b/drivers/net/ucc_geth_ethtool.c
index 299b7f176950..f5839c4a5cbd 100644
--- a/drivers/net/ucc_geth_ethtool.c
+++ b/drivers/net/ucc_geth_ethtool.c
@@ -73,6 +73,7 @@ static char tx_fw_stat_gstrings[][ETH_GSTRING_LEN] = {
        "tx-frames-ok",
        "tx-excessive-differ-frames",
        "tx-256-511-frames",
+        "tx-512-1023-frames",
        "tx-1024-1518-frames",
        "tx-jumbo-frames",
 };
@@ -308,7 +309,7 @@ static void uec_get_strings(struct net_device *netdev, u32 stringset, u8 *buf)
                buf += UEC_TX_FW_STATS_LEN * ETH_GSTRING_LEN;
        }
        if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX)
-                memcpy(buf, tx_fw_stat_gstrings, UEC_RX_FW_STATS_LEN *
+                memcpy(buf, rx_fw_stat_gstrings, UEC_RX_FW_STATS_LEN *
                                ETH_GSTRING_LEN);
 }
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index dc6f097062df..37ecf845edfe 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1440,6 +1440,10 @@ static const struct usb_device_id	products [] = {
        // Belkin F5D5055
        USB_DEVICE(0x050d, 0x5055),
        .driver_info = (unsigned long) &ax88178_info,
+}, {
+        // Apple USB Ethernet Adapter
+        USB_DEVICE(0x05ac, 0x1402),
+        .driver_info = (unsigned long) &ax88772_info,
 },
        { },            // END
 };
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 0dcfc0310264..7c66b052f55a 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -706,7 +706,7 @@ static void kaweth_kill_urbs(struct kaweth_device *kaweth)
        usb_kill_urb(kaweth->rx_urb);
        usb_kill_urb(kaweth->tx_urb);
-        flush_scheduled_work();
+        cancel_delayed_work_sync(&kaweth->lowmem_work);
        /* a scheduled work may have resubmitted,
           we hit them again */
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index 3969b7a2b8e6..ae467f182c40 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -194,7 +194,7 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf)
                        dev_dbg(&info->control->dev,
                                "rndis response error, code %d\n", retval);
                }
-                msleep(2);
+                msleep(20);
        }
        dev_dbg(&info->control->dev, "rndis response timeout\n");
        return -ETIMEDOUT;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f926b5ab3d09..4452306d5328 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -44,9 +44,16 @@ struct virtnet_info
        /* The skb we couldn't send because buffers were full. */
        struct sk_buff *last_xmit_skb;
+        /* If we need to free in a timer, this is it. */
+        struct timer_list xmit_free_timer;
        /* Number of input buffers, and max we've ever had. */
        unsigned int num, max;
+        /* For cleaning up after transmission. */
+        struct tasklet_struct tasklet;
+        bool free_in_tasklet;
        /* Receive & send queues. */
        struct sk_buff_head recv;
        struct sk_buff_head send;
@@ -68,8 +75,13 @@ static void skb_xmit_done(struct virtqueue *svq)
        /* Suppress further interrupts. */
        svq->vq_ops->disable_cb(svq);
-        /* We were waiting for more output buffers. */
+        /* We were probably waiting for more output buffers. */
        netif_wake_queue(vi->dev);
+        /* Make sure we re-xmit last_xmit_skb: if there are no more packets
+         * queued, start_xmit won't be called. */
+        tasklet_schedule(&vi->tasklet);
 }
 static void receive_skb(struct net_device *dev, struct sk_buff *skb,
@@ -86,9 +98,7 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
        BUG_ON(len > MAX_PACKET_LEN);
        skb_trim(skb, len);
-        skb->protocol = eth_type_trans(skb, dev);
-        pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
-                 ntohs(skb->protocol), skb->len, skb->pkt_type);
        dev->stats.rx_bytes += skb->len;
        dev->stats.rx_packets++;
@@ -98,6 +108,10 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
                        goto frame_err;
        }
+        skb->protocol = eth_type_trans(skb, dev);
+        pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
+                 ntohs(skb->protocol), skb->len, skb->pkt_type);
        if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
                pr_debug("GSO!\n");
                switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
@@ -230,9 +244,25 @@ static void free_old_xmit_skbs(struct virtnet_info *vi)
        }
 }
+/* If the virtio transport doesn't always notify us when all in-flight packets
+ * are consumed, we fall back to using this function on a timer to free them. */
+static void xmit_free(unsigned long data)
+{
+        struct virtnet_info *vi = (void *)data;
+        netif_tx_lock(vi->dev);
+        free_old_xmit_skbs(vi);
+        if (!skb_queue_empty(&vi->send))
+                mod_timer(&vi->xmit_free_timer, jiffies + (HZ/10));
+        netif_tx_unlock(vi->dev);
+}
 static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
 {
-        int num;
+        int num, err;
        struct scatterlist sg[2+MAX_SKB_FRAGS];
        struct virtio_net_hdr *hdr;
        const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
@@ -275,7 +305,25 @@ static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
        vnet_hdr_to_sg(sg, skb);
        num = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
-        return vi->svq->vq_ops->add_buf(vi->svq, sg, num, 0, skb);
+        err = vi->svq->vq_ops->add_buf(vi->svq, sg, num, 0, skb);
+        if (!err && !vi->free_in_tasklet)
+                mod_timer(&vi->xmit_free_timer, jiffies + (HZ/10));
+        return err;
+}
+static void xmit_tasklet(unsigned long data)
+{
+        struct virtnet_info *vi = (void *)data;
+        netif_tx_lock_bh(vi->dev);
+        if (vi->last_xmit_skb && xmit_skb(vi, vi->last_xmit_skb) == 0) {
+                vi->svq->vq_ops->kick(vi->svq);
+                vi->last_xmit_skb = NULL;
+        }
+        if (vi->free_in_tasklet)
+                free_old_xmit_skbs(vi);
+        netif_tx_unlock_bh(vi->dev);
 }
 static int start_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -287,21 +335,25 @@ again:
        free_old_xmit_skbs(vi);
        /* If we has a buffer left over from last time, send it now. */
-        if (vi->last_xmit_skb) {
+        if (unlikely(vi->last_xmit_skb)) {
                if (xmit_skb(vi, vi->last_xmit_skb) != 0) {
                        /* Drop this skb: we only queue one. */
                        vi->dev->stats.tx_dropped++;
                        kfree_skb(skb);
+                        skb = NULL;
                        goto stop_queue;
                }
                vi->last_xmit_skb = NULL;
        }
        /* Put new one in send queue and do transmit */
-        __skb_queue_head(&vi->send, skb);
+        if (likely(skb)) {
-        if (xmit_skb(vi, skb) != 0) {
+                __skb_queue_head(&vi->send, skb);
-                vi->last_xmit_skb = skb;
+                if (xmit_skb(vi, skb) != 0) {
-                goto stop_queue;
+                        vi->last_xmit_skb = skb;
+                        skb = NULL;
+                        goto stop_queue;
+                }
        }
 done:
        vi->svq->vq_ops->kick(vi->svq);
@@ -411,6 +463,10 @@ static int virtnet_probe(struct virtio_device *vdev)
        vi->vdev = vdev;
        vdev->priv = vi;
+        /* If they give us a callback when all buffers are done, we don't need
+         * the timer. */
+        vi->free_in_tasklet = virtio_has_feature(vdev,VIRTIO_F_NOTIFY_ON_EMPTY);
        /* We expect two virtqueues, receive then send. */
        vi->rvq = vdev->config->find_vq(vdev, 0, skb_recv_done);
        if (IS_ERR(vi->rvq)) {
@@ -428,6 +484,11 @@ static int virtnet_probe(struct virtio_device *vdev)
        skb_queue_head_init(&vi->recv);
        skb_queue_head_init(&vi->send);
+        tasklet_init(&vi->tasklet, xmit_tasklet, (unsigned long)vi);
+        if (!vi->free_in_tasklet)
+                setup_timer(&vi->xmit_free_timer, xmit_free, (unsigned long)vi);
        err = register_netdev(dev);
        if (err) {
                pr_debug("virtio_net: registering device failed\n");
@@ -465,13 +526,15 @@ static void virtnet_remove(struct virtio_device *vdev)
        /* Stop all the virtqueues. */
        vdev->config->reset(vdev);
+        if (!vi->free_in_tasklet)
+                del_timer_sync(&vi->xmit_free_timer);
        /* Free our skbs in send and recv queues, if any. */
        while ((skb = __skb_dequeue(&vi->recv)) != NULL) {
                kfree_skb(skb);
                vi->num--;
        }
-        while ((skb = __skb_dequeue(&vi->send)) != NULL)
+        __skb_queue_purge(&vi->send);
-                kfree_skb(skb);
        BUG_ON(vi->num != 0);
@@ -489,7 +552,7 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
-        VIRTIO_NET_F_HOST_ECN,
+        VIRTIO_NET_F_HOST_ECN, VIRTIO_F_NOTIFY_ON_EMPTY,
 };
 static struct virtio_driver virtio_net = {
diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c
index 9a83c9d5b8cf..7f984895b0d5 100644
--- a/drivers/net/wan/hdlc.c
+++ b/drivers/net/wan/hdlc.c
@@ -43,8 +43,7 @@ static const char* version = "HDLC support module revision 1.22";
 #undef DEBUG_LINK
-static struct hdlc_proto *first_proto = NULL;
+static struct hdlc_proto *first_proto;
 static int hdlc_change_mtu(struct net_device *dev, int new_mtu)
 {
@@ -314,21 +313,25 @@ void detach_hdlc_protocol(struct net_device *dev)
 void register_hdlc_protocol(struct hdlc_proto *proto)
 {
+        rtnl_lock();
        proto->next = first_proto;
        first_proto = proto;
+        rtnl_unlock();
 }
 void unregister_hdlc_protocol(struct hdlc_proto *proto)
 {
-        struct hdlc_proto **p = &first_proto;
+        struct hdlc_proto **p;
-        while (*p) {
-                if (*p == proto) {
+        rtnl_lock();
-                        *p = proto->next;
+        p = &first_proto;
-                        return;
+        while (*p != proto) {
-                }
+                BUG_ON(!*p);
                p = &((*p)->next);
        }
+        *p = proto->next;
+        rtnl_unlock();
 }
diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index 7133c688cf20..762d21c1c703 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -56,6 +56,7 @@ struct cisco_state {
        cisco_proto settings;
        struct timer_list timer;
+        spinlock_t lock;
        unsigned long last_poll;
        int up;
        int request_sent;
@@ -158,6 +159,7 @@ static int cisco_rx(struct sk_buff *skb)
 {
        struct net_device *dev = skb->dev;
        hdlc_device *hdlc = dev_to_hdlc(dev);
+        struct cisco_state *st = state(hdlc);
        struct hdlc_header *data = (struct hdlc_header*)skb->data;
        struct cisco_packet *cisco_data;
        struct in_device *in_dev;
@@ -220,11 +222,12 @@ static int cisco_rx(struct sk_buff *skb)
                        goto rx_error;
                case CISCO_KEEPALIVE_REQ:
-                        state(hdlc)->rxseq = ntohl(cisco_data->par1);
+                        spin_lock(&st->lock);
-                        if (state(hdlc)->request_sent &&
+                        st->rxseq = ntohl(cisco_data->par1);
-                            ntohl(cisco_data->par2) == state(hdlc)->txseq) {
+                        if (st->request_sent &&
-                                state(hdlc)->last_poll = jiffies;
+                            ntohl(cisco_data->par2) == st->txseq) {
-                                if (!state(hdlc)->up) {
+                                st->last_poll = jiffies;
+                                if (!st->up) {
                                        u32 sec, min, hrs, days;
                                        sec = ntohl(cisco_data->time) / 1000;
                                        min = sec / 60; sec -= min * 60;
@@ -232,12 +235,12 @@ static int cisco_rx(struct sk_buff *skb)
                                        days = hrs / 24; hrs -= days * 24;
                                        printk(KERN_INFO "%s: Link up (peer "
                                               "uptime %ud%uh%um%us)\n",
-                                               dev->name, days, hrs,
+                                               dev->name, days, hrs, min, sec);
-                                               min, sec);
                                        netif_dormant_off(dev);
-                                        state(hdlc)->up = 1;
+                                        st->up = 1;
                                }
                        }
+                        spin_unlock(&st->lock);
                        dev_kfree_skb_any(skb);
                        return NET_RX_SUCCESS;
@@ -261,24 +264,25 @@ static void cisco_timer(unsigned long arg)
 {
        struct net_device *dev = (struct net_device *)arg;
        hdlc_device *hdlc = dev_to_hdlc(dev);
+        struct cisco_state *st = state(hdlc);
-        if (state(hdlc)->up &&
+        spin_lock(&st->lock);
-            time_after(jiffies, state(hdlc)->last_poll +
+        if (st->up &&
-                       state(hdlc)->settings.timeout * HZ)) {
+            time_after(jiffies, st->last_poll + st->settings.timeout * HZ)) {
-                state(hdlc)->up = 0;
+                st->up = 0;
                printk(KERN_INFO "%s: Link down\n", dev->name);
                netif_dormant_on(dev);
        }
-        cisco_keepalive_send(dev, CISCO_KEEPALIVE_REQ,
+        cisco_keepalive_send(dev, CISCO_KEEPALIVE_REQ, htonl(++st->txseq),
-                             htonl(++state(hdlc)->txseq),
+                             htonl(st->rxseq));
-                             htonl(state(hdlc)->rxseq));
+        st->request_sent = 1;
-        state(hdlc)->request_sent = 1;
+        spin_unlock(&st->lock);
-        state(hdlc)->timer.expires = jiffies +
-                state(hdlc)->settings.interval * HZ;
+        st->timer.expires = jiffies + st->settings.interval * HZ;
-        state(hdlc)->timer.function = cisco_timer;
+        st->timer.function = cisco_timer;
-        state(hdlc)->timer.data = arg;
+        st->timer.data = arg;
-        add_timer(&state(hdlc)->timer);
+        add_timer(&st->timer);
 }
@@ -286,15 +290,20 @@ static void cisco_timer(unsigned long arg)
 static void cisco_start(struct net_device *dev)
 {
        hdlc_device *hdlc = dev_to_hdlc(dev);
-        state(hdlc)->up = 0;
+        struct cisco_state *st = state(hdlc);
-        state(hdlc)->request_sent = 0;
+        unsigned long flags;
-        state(hdlc)->txseq = state(hdlc)->rxseq = 0;
+        spin_lock_irqsave(&st->lock, flags);
-        init_timer(&state(hdlc)->timer);
+        st->up = 0;
-        state(hdlc)->timer.expires = jiffies + HZ; /*First poll after 1s*/
+        st->request_sent = 0;
-        state(hdlc)->timer.function = cisco_timer;
+        st->txseq = st->rxseq = 0;
-        state(hdlc)->timer.data = (unsigned long)dev;
+        spin_unlock_irqrestore(&st->lock, flags);
-        add_timer(&state(hdlc)->timer);
+        init_timer(&st->timer);
+        st->timer.expires = jiffies + HZ; /* First poll after 1 s */
+        st->timer.function = cisco_timer;
+        st->timer.data = (unsigned long)dev;
+        add_timer(&st->timer);
 }
@@ -302,10 +311,16 @@ static void cisco_start(struct net_device *dev)
 static void cisco_stop(struct net_device *dev)
 {
        hdlc_device *hdlc = dev_to_hdlc(dev);
-        del_timer_sync(&state(hdlc)->timer);
+        struct cisco_state *st = state(hdlc);
+        unsigned long flags;
+        del_timer_sync(&st->timer);
+        spin_lock_irqsave(&st->lock, flags);
        netif_dormant_on(dev);
-        state(hdlc)->up = 0;
+        st->up = 0;
-        state(hdlc)->request_sent = 0;
+        st->request_sent = 0;
+        spin_unlock_irqrestore(&st->lock, flags);
 }
@@ -367,6 +382,7 @@ static int cisco_ioctl(struct net_device *dev, struct ifreq *ifr)
                        return result;
                memcpy(&state(hdlc)->settings, &new_settings, size);
+                spin_lock_init(&state(hdlc)->lock);
                dev->hard_start_xmit = hdlc->xmit;
                dev->header_ops = &cisco_header_ops;
                dev->type = ARPHRD_CISCO;
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 4e1c690ff45f..32019fb878d8 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -2905,7 +2905,7 @@ EXPORT_SYMBOL(init_airo_card);
 static int waitbusy (struct airo_info *ai) {
        int delay = 0;
-        while ((IN4500 (ai, COMMAND) & COMMAND_BUSY) && (delay < 10000)) {
+        while ((IN4500(ai, COMMAND) & COMMAND_BUSY) && (delay < 10000)) {
                udelay (10);
                if ((++delay % 20) == 0)
                        OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 37783cdd301a..dfa4bdd5597c 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -737,6 +737,7 @@ struct b43_wl {
        struct ieee80211_tx_control beacon_txctl;
        bool beacon0_uploaded;
        bool beacon1_uploaded;
+        bool beacon_templates_virgin; /* Never wrote the templates? */
        struct work_struct beacon_update_trigger;
        /* The current QOS parameters for the 4 queues.
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 8fdba9415c04..6c3d9ea0a9f8 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1544,6 +1544,30 @@ static void b43_write_probe_resp_template(struct b43_wldev *dev,
        kfree(probe_resp_data);
 }
+static void b43_upload_beacon0(struct b43_wldev *dev)
+{
+        struct b43_wl *wl = dev->wl;
+        if (wl->beacon0_uploaded)
+                return;
+        b43_write_beacon_template(dev, 0x68, 0x18);
+        /* FIXME: Probe resp upload doesn't really belong here,
+         *        but we don't use that feature anyway. */
+        b43_write_probe_resp_template(dev, 0x268, 0x4A,
+                                      &__b43_ratetable[3]);
+        wl->beacon0_uploaded = 1;
+}
+static void b43_upload_beacon1(struct b43_wldev *dev)
+{
+        struct b43_wl *wl = dev->wl;
+        if (wl->beacon1_uploaded)
+                return;
+        b43_write_beacon_template(dev, 0x468, 0x1A);
+        wl->beacon1_uploaded = 1;
+}
 static void handle_irq_beacon(struct b43_wldev *dev)
 {
        struct b43_wl *wl = dev->wl;
@@ -1568,24 +1592,27 @@ static void handle_irq_beacon(struct b43_wldev *dev)
                return;
        }
-        if (!beacon0_valid) {
+        if (unlikely(wl->beacon_templates_virgin)) {
-                if (!wl->beacon0_uploaded) {
+                /* We never uploaded a beacon before.
-                        b43_write_beacon_template(dev, 0x68, 0x18);
+                 * Upload both templates now, but only mark one valid. */
-                        b43_write_probe_resp_template(dev, 0x268, 0x4A,
+                wl->beacon_templates_virgin = 0;
-                                                      &__b43_ratetable[3]);
+                b43_upload_beacon0(dev);
-                        wl->beacon0_uploaded = 1;
+                b43_upload_beacon1(dev);
-                }
                cmd = b43_read32(dev, B43_MMIO_MACCMD);
                cmd |= B43_MACCMD_BEACON0_VALID;
                b43_write32(dev, B43_MMIO_MACCMD, cmd);
-        } else if (!beacon1_valid) {
+        } else {
-                if (!wl->beacon1_uploaded) {
+                if (!beacon0_valid) {
-                        b43_write_beacon_template(dev, 0x468, 0x1A);
+                        b43_upload_beacon0(dev);
-                        wl->beacon1_uploaded = 1;
+                        cmd = b43_read32(dev, B43_MMIO_MACCMD);
+                        cmd |= B43_MACCMD_BEACON0_VALID;
+                        b43_write32(dev, B43_MMIO_MACCMD, cmd);
+                } else if (!beacon1_valid) {
+                        b43_upload_beacon1(dev);
+                        cmd = b43_read32(dev, B43_MMIO_MACCMD);
+                        cmd |= B43_MACCMD_BEACON1_VALID;
+                        b43_write32(dev, B43_MMIO_MACCMD, cmd);
                }
-                cmd = b43_read32(dev, B43_MMIO_MACCMD);
-                cmd |= B43_MACCMD_BEACON1_VALID;
-                b43_write32(dev, B43_MMIO_MACCMD, cmd);
        }
 }
@@ -4073,6 +4100,9 @@ static int b43_op_start(struct ieee80211_hw *hw)
        wl->filter_flags = 0;
        wl->radiotap_enabled = 0;
        b43_qos_clear(wl);
+        wl->beacon0_uploaded = 0;
+        wl->beacon1_uploaded = 0;
+        wl->beacon_templates_virgin = 1;
        /* First register RFkill.
         * LEDs that are registered later depend on it. */
@@ -4241,7 +4271,9 @@ static void b43_chip_reset(struct work_struct *work)
                        goto out;
                }
        }
-      out:
+out:
+        if (err)
+                wl->current_dev = NULL; /* Failed to init the dev. */
        mutex_unlock(&wl->mutex);
        if (err)
                b43err(wl, "Controller restart FAILED\n");
@@ -4382,9 +4414,11 @@ static void b43_one_core_detach(struct ssb_device *dev)
        struct b43_wldev *wldev;
        struct b43_wl *wl;
+        /* Do not cancel ieee80211-workqueue based work here.
+         * See comment in b43_remove(). */
        wldev = ssb_get_drvdata(dev);
        wl = wldev->wl;
-        cancel_work_sync(&wldev->restart_work);
        b43_debugfs_remove_device(wldev);
        b43_wireless_core_detach(wldev);
        list_del(&wldev->list);
@@ -4569,6 +4603,10 @@ static void b43_remove(struct ssb_device *dev)
        struct b43_wl *wl = ssb_get_devtypedata(dev);
        struct b43_wldev *wldev = ssb_get_drvdata(dev);
+        /* We must cancel any work here before unregistering from ieee80211,
+         * as the ieee80211 unreg will destroy the workqueue. */
+        cancel_work_sync(&wldev->restart_work);
        B43_WARN_ON(!wl);
        if (wl->current_dev == wldev)
                ieee80211_unregister_hw(wl->hw);
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 14a5eea2573e..204077c13870 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3039,7 +3039,6 @@ static void b43legacy_set_pretbtt(struct b43legacy_wldev *dev)
 /* Locking: wl->mutex */
 static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
 {
-        struct b43legacy_wl *wl = dev->wl;
        struct b43legacy_phy *phy = &dev->phy;
        u32 macctl;
@@ -3054,12 +3053,6 @@ static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
        macctl |= B43legacy_MACCTL_PSM_JMP0;
        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
-        mutex_unlock(&wl->mutex);
-        /* Must unlock as it would otherwise deadlock. No races here.
-         * Cancel possibly pending workqueues. */
-        cancel_work_sync(&dev->restart_work);
-        mutex_lock(&wl->mutex);
        b43legacy_leds_exit(dev);
        b43legacy_rng_exit(dev->wl);
        b43legacy_pio_free(dev);
@@ -3486,6 +3479,8 @@ static void b43legacy_chip_reset(struct work_struct *work)
                }
        }
 out:
+        if (err)
+                wl->current_dev = NULL; /* Failed to init the dev. */
        mutex_unlock(&wl->mutex);
        if (err)
                b43legacyerr(wl, "Controller restart FAILED\n");
@@ -3618,9 +3613,11 @@ static void b43legacy_one_core_detach(struct ssb_device *dev)
        struct b43legacy_wldev *wldev;
        struct b43legacy_wl *wl;
+        /* Do not cancel ieee80211-workqueue based work here.
+         * See comment in b43legacy_remove(). */
        wldev = ssb_get_drvdata(dev);
        wl = wldev->wl;
-        cancel_work_sync(&wldev->restart_work);
        b43legacy_debugfs_remove_device(wldev);
        b43legacy_wireless_core_detach(wldev);
        list_del(&wldev->list);
@@ -3789,6 +3786,10 @@ static void b43legacy_remove(struct ssb_device *dev)
        struct b43legacy_wl *wl = ssb_get_devtypedata(dev);
        struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
+        /* We must cancel any work here before unregistering from ieee80211,
+         * as the ieee80211 unreg will destroy the workqueue. */
+        cancel_work_sync(&wldev->restart_work);
        B43legacy_WARN_ON(!wl);
        if (wl->current_dev == wldev)
                ieee80211_unregister_hw(wl->hw);
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index 20d387f6658c..f7aec9309d04 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -682,7 +682,13 @@ static int prism2_close(struct net_device *dev)
                netif_device_detach(dev);
        }
-        flush_scheduled_work();
+        cancel_work_sync(&local->reset_queue);
+        cancel_work_sync(&local->set_multicast_list_queue);
+        cancel_work_sync(&local->set_tim_queue);
+#ifndef PRISM2_NO_STATION_MODES
+        cancel_work_sync(&local->info_queue);
+#endif
+        cancel_work_sync(&local->comms_qual_update);
        module_put(local->hw_module);
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index d74c061994ae..6e704608947c 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -1753,6 +1753,8 @@ static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
                if (priv->workqueue) {
                        cancel_delayed_work(&priv->request_scan);
+                        cancel_delayed_work(&priv->request_direct_scan);
+                        cancel_delayed_work(&priv->request_passive_scan);
                        cancel_delayed_work(&priv->scan_event);
                }
                queue_work(priv->workqueue, &priv->down);
@@ -2005,6 +2007,8 @@ static void ipw_irq_tasklet(struct ipw_priv *priv)
                wake_up_interruptible(&priv->wait_command_queue);
                priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
                cancel_delayed_work(&priv->request_scan);
+                cancel_delayed_work(&priv->request_direct_scan);
+                cancel_delayed_work(&priv->request_passive_scan);
                cancel_delayed_work(&priv->scan_event);
                schedule_work(&priv->link_down);
                queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
@@ -4712,6 +4716,12 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                        priv->status &= ~STATUS_SCAN_FORCED;
 #endif                          /* CONFIG_IPW2200_MONITOR */
+                        /* Do queued direct scans first */
+                        if (priv->status & STATUS_DIRECT_SCAN_PENDING) {
+                                queue_delayed_work(priv->workqueue,
+                                                   &priv->request_direct_scan, 0);
+                        }
                        if (!(priv->status & (STATUS_ASSOCIATED |
                                              STATUS_ASSOCIATING |
                                              STATUS_ROAMING |
@@ -6267,7 +6277,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
        }
 }
-static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
+static int ipw_request_scan_helper(struct ipw_priv *priv, int type, int direct)
 {
        struct ipw_scan_request_ext scan;
        int err = 0, scan_type;
@@ -6278,22 +6288,31 @@ static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
        mutex_lock(&priv->mutex);
+        if (direct && (priv->direct_scan_ssid_len == 0)) {
+                IPW_DEBUG_HC("Direct scan requested but no SSID to scan for\n");
+                priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
+                goto done;
+        }
        if (priv->status & STATUS_SCANNING) {
-                IPW_DEBUG_HC("Concurrent scan requested.  Ignoring.\n");
+                IPW_DEBUG_HC("Concurrent scan requested.  Queuing.\n");
-                priv->status |= STATUS_SCAN_PENDING;
+                priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
+                                        STATUS_SCAN_PENDING;
                goto done;
        }
        if (!(priv->status & STATUS_SCAN_FORCED) &&
            priv->status & STATUS_SCAN_ABORTING) {
                IPW_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
-                priv->status |= STATUS_SCAN_PENDING;
+                priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
+                                        STATUS_SCAN_PENDING;
                goto done;
        }
        if (priv->status & STATUS_RF_KILL_MASK) {
-                IPW_DEBUG_HC("Aborting scan due to RF Kill activation\n");
+                IPW_DEBUG_HC("Queuing scan due to RF Kill activation\n");
-                priv->status |= STATUS_SCAN_PENDING;
+                priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
+                                        STATUS_SCAN_PENDING;
                goto done;
        }
@@ -6321,6 +6340,7 @@ static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
                cpu_to_le16(20);
        scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
+        scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
 #ifdef CONFIG_IPW2200_MONITOR
        if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
@@ -6360,13 +6380,23 @@ static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
                        cpu_to_le16(2000);
        } else {
 #endif                          /* CONFIG_IPW2200_MONITOR */
-                /* If we are roaming, then make this a directed scan for the
+                /* Honor direct scans first, otherwise if we are roaming make
-                 * current network.  Otherwise, ensure that every other scan
+                 * this a direct scan for the current network.  Finally,
-                 * is a fast channel hop scan */
+                 * ensure that every other scan is a fast channel hop scan */
-                if ((priv->status & STATUS_ROAMING)
+                if (direct) {
-                    || (!(priv->status & STATUS_ASSOCIATED)
+                        err = ipw_send_ssid(priv, priv->direct_scan_ssid,
-                        && (priv->config & CFG_STATIC_ESSID)
+                                            priv->direct_scan_ssid_len);
-                        && (le32_to_cpu(scan.full_scan_index) % 2))) {
+                        if (err) {
+                                IPW_DEBUG_HC("Attempt to send SSID command  "
+                                             "failed\n");
+                                goto done;
+                        }
+                        scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
+                } else if ((priv->status & STATUS_ROAMING)
+                           || (!(priv->status & STATUS_ASSOCIATED)
+                               && (priv->config & CFG_STATIC_ESSID)
+                               && (le32_to_cpu(scan.full_scan_index) % 2))) {
                        err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
                        if (err) {
                                IPW_DEBUG_HC("Attempt to send SSID command "
@@ -6391,7 +6421,12 @@ send_request:
        }
        priv->status |= STATUS_SCANNING;
-        priv->status &= ~STATUS_SCAN_PENDING;
+        if (direct) {
+                priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
+                priv->direct_scan_ssid_len = 0;
+        } else
+                priv->status &= ~STATUS_SCAN_PENDING;
        queue_delayed_work(priv->workqueue, &priv->scan_check,
                           IPW_SCAN_CHECK_WATCHDOG);
 done:
@@ -6402,15 +6437,22 @@ done:
 static void ipw_request_passive_scan(struct work_struct *work)
 {
        struct ipw_priv *priv =
-                container_of(work, struct ipw_priv, request_passive_scan);
+                container_of(work, struct ipw_priv, request_passive_scan.work);
-        ipw_request_scan_helper(priv, IW_SCAN_TYPE_PASSIVE);
+        ipw_request_scan_helper(priv, IW_SCAN_TYPE_PASSIVE, 0);
 }
 static void ipw_request_scan(struct work_struct *work)
 {
        struct ipw_priv *priv =
                container_of(work, struct ipw_priv, request_scan.work);
-        ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE);
+        ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 0);
+}
+static void ipw_request_direct_scan(struct work_struct *work)
+{
+        struct ipw_priv *priv =
+                container_of(work, struct ipw_priv, request_direct_scan.work);
+        ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 1);
 }
 static void ipw_bg_abort_scan(struct work_struct *work)
@@ -7558,8 +7600,31 @@ static int ipw_associate(void *data)
            priv->ieee->iw_mode == IW_MODE_ADHOC &&
            priv->config & CFG_ADHOC_CREATE &&
            priv->config & CFG_STATIC_ESSID &&
-            priv->config & CFG_STATIC_CHANNEL &&
+            priv->config & CFG_STATIC_CHANNEL) {
-            !list_empty(&priv->ieee->network_free_list)) {
+                /* Use oldest network if the free list is empty */
+                if (list_empty(&priv->ieee->network_free_list)) {
+                        struct ieee80211_network *oldest = NULL;
+                        struct ieee80211_network *target;
+                        DECLARE_MAC_BUF(mac);
+                        list_for_each_entry(target, &priv->ieee->network_list, list) {
+                                if ((oldest == NULL) ||
+                                    (target->last_scanned < oldest->last_scanned))
+                                        oldest = target;
+                        }
+                        /* If there are no more slots, expire the oldest */
+                        list_del(&oldest->list);
+                        target = oldest;
+                        IPW_DEBUG_ASSOC("Expired '%s' (%s) from "
+                                        "network list.\n",
+                                        escape_essid(target->ssid,
+                                                     target->ssid_len),
+                                        print_mac(mac, target->bssid));
+                        list_add_tail(&target->list,
+                                      &priv->ieee->network_free_list);
+                }
                element = priv->ieee->network_free_list.next;
                network = list_entry(element, struct ieee80211_network, list);
                ipw_adhoc_create(priv, network);
@@ -9454,99 +9519,38 @@ static int ipw_wx_get_retry(struct net_device *dev,
        return 0;
 }
-static int ipw_request_direct_scan(struct ipw_priv *priv, char *essid,
-                                   int essid_len)
-{
-        struct ipw_scan_request_ext scan;
-        int err = 0, scan_type;
-        if (!(priv->status & STATUS_INIT) ||
-            (priv->status & STATUS_EXIT_PENDING))
-                return 0;
-        mutex_lock(&priv->mutex);
-        if (priv->status & STATUS_RF_KILL_MASK) {
-                IPW_DEBUG_HC("Aborting scan due to RF kill activation\n");
-                priv->status |= STATUS_SCAN_PENDING;
-                goto done;
-        }
-        IPW_DEBUG_HC("starting request direct scan!\n");
-        if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
-                /* We should not sleep here; otherwise we will block most
-                 * of the system (for instance, we hold rtnl_lock when we
-                 * get here).
-                 */
-                err = -EAGAIN;
-                goto done;
-        }
-        memset(&scan, 0, sizeof(scan));
-        if (priv->config & CFG_SPEED_SCAN)
-                scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
-                    cpu_to_le16(30);
-        else
-                scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
-                    cpu_to_le16(20);
-        scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
-            cpu_to_le16(20);
-        scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
-        scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
-        scan.full_scan_index = cpu_to_le32(ieee80211_get_scans(priv->ieee));
-        err = ipw_send_ssid(priv, essid, essid_len);
-        if (err) {
-                IPW_DEBUG_HC("Attempt to send SSID command failed\n");
-                goto done;
-        }
-        scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
-        ipw_add_scan_channels(priv, &scan, scan_type);
-        err = ipw_send_scan_request_ext(priv, &scan);
-        if (err) {
-                IPW_DEBUG_HC("Sending scan command failed: %08X\n", err);
-                goto done;
-        }
-        priv->status |= STATUS_SCANNING;
-      done:
-        mutex_unlock(&priv->mutex);
-        return err;
-}
 static int ipw_wx_set_scan(struct net_device *dev,
                           struct iw_request_info *info,
                           union iwreq_data *wrqu, char *extra)
 {
        struct ipw_priv *priv = ieee80211_priv(dev);
        struct iw_scan_req *req = (struct iw_scan_req *)extra;
+        struct delayed_work *work = NULL;
        mutex_lock(&priv->mutex);
        priv->user_requested_scan = 1;
-        mutex_unlock(&priv->mutex);
        if (wrqu->data.length == sizeof(struct iw_scan_req)) {
                if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                        ipw_request_direct_scan(priv, req->essid,
+                        int len = min((int)req->essid_len,
-                                                req->essid_len);
+                                      (int)sizeof(priv->direct_scan_ssid));
-                        return 0;
+                        memcpy(priv->direct_scan_ssid, req->essid, len);
-                }
+                        priv->direct_scan_ssid_len = len;
-                if (req->scan_type == IW_SCAN_TYPE_PASSIVE) {
+                        work = &priv->request_direct_scan;
-                        queue_work(priv->workqueue,
+                } else if (req->scan_type == IW_SCAN_TYPE_PASSIVE) {
-                                   &priv->request_passive_scan);
+                        work = &priv->request_passive_scan;
-                        return 0;
                }
+        } else {
+                /* Normal active broadcast scan */
+                work = &priv->request_scan;
        }
+        mutex_unlock(&priv->mutex);
        IPW_DEBUG_WX("Start scan\n");
-        queue_delayed_work(priv->workqueue, &priv->request_scan, 0);
+        queue_delayed_work(priv->workqueue, work, 0);
        return 0;
 }
@@ -10708,6 +10712,8 @@ static void ipw_link_up(struct ipw_priv *priv)
        }
        cancel_delayed_work(&priv->request_scan);
+        cancel_delayed_work(&priv->request_direct_scan);
+        cancel_delayed_work(&priv->request_passive_scan);
        cancel_delayed_work(&priv->scan_event);
        ipw_reset_stats(priv);
        /* Ensure the rate is updated immediately */
@@ -10738,6 +10744,8 @@ static void ipw_link_down(struct ipw_priv *priv)
        /* Cancel any queued work ... */
        cancel_delayed_work(&priv->request_scan);
+        cancel_delayed_work(&priv->request_direct_scan);
+        cancel_delayed_work(&priv->request_passive_scan);
        cancel_delayed_work(&priv->adhoc_check);
        cancel_delayed_work(&priv->gather_stats);
@@ -10777,8 +10785,9 @@ static int __devinit ipw_setup_deferred_work(struct ipw_priv *priv)
        INIT_WORK(&priv->up, ipw_bg_up);
        INIT_WORK(&priv->down, ipw_bg_down);
        INIT_DELAYED_WORK(&priv->request_scan, ipw_request_scan);
+        INIT_DELAYED_WORK(&priv->request_direct_scan, ipw_request_direct_scan);
+        INIT_DELAYED_WORK(&priv->request_passive_scan, ipw_request_passive_scan);
        INIT_DELAYED_WORK(&priv->scan_event, ipw_scan_event);
-        INIT_WORK(&priv->request_passive_scan, ipw_request_passive_scan);
        INIT_DELAYED_WORK(&priv->gather_stats, ipw_bg_gather_stats);
        INIT_WORK(&priv->abort_scan, ipw_bg_abort_scan);
        INIT_WORK(&priv->roam, ipw_bg_roam);
@@ -11812,6 +11821,8 @@ static void __devexit ipw_pci_remove(struct pci_dev *pdev)
        cancel_delayed_work(&priv->adhoc_check);
        cancel_delayed_work(&priv->gather_stats);
        cancel_delayed_work(&priv->request_scan);
+        cancel_delayed_work(&priv->request_direct_scan);
+        cancel_delayed_work(&priv->request_passive_scan);
        cancel_delayed_work(&priv->scan_event);
        cancel_delayed_work(&priv->rf_kill);
        cancel_delayed_work(&priv->scan_check);
diff --git a/drivers/net/wireless/ipw2200.h b/drivers/net/wireless/ipw2200.h
index cd3295b66dd6..d4ab28b73b32 100644
--- a/drivers/net/wireless/ipw2200.h
+++ b/drivers/net/wireless/ipw2200.h
@@ -1037,6 +1037,7 @@ struct ipw_cmd {	 /* XXX */
 #define STATUS_DISASSOC_PENDING (1<<12)
 #define STATUS_STATE_PENDING    (1<<13)
+#define STATUS_DIRECT_SCAN_PENDING (1<<19)
 #define STATUS_SCAN_PENDING     (1<<20)
 #define STATUS_SCANNING         (1<<21)
 #define STATUS_SCAN_ABORTING    (1<<22)
@@ -1292,6 +1293,8 @@ struct ipw_priv {
        struct iw_public_data wireless_data;
        int user_requested_scan;
+        u8 direct_scan_ssid[IW_ESSID_MAX_SIZE];
+        u8 direct_scan_ssid_len;
        struct workqueue_struct *workqueue;
@@ -1301,8 +1304,9 @@ struct ipw_priv {
        struct work_struct system_config;
        struct work_struct rx_replenish;
        struct delayed_work request_scan;
+        struct delayed_work request_direct_scan;
+        struct delayed_work request_passive_scan;
        struct delayed_work scan_event;
-        struct work_struct request_passive_scan;
        struct work_struct adapter_restart;
        struct delayed_work rf_kill;
        struct work_struct up;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.c b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
index d200d08fb086..8b1528e52d43 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
@@ -229,14 +229,15 @@ static int iwl3945_led_register_led(struct iwl3945_priv *priv,
        led->led_dev.brightness_set = iwl3945_led_brightness_set;
        led->led_dev.default_trigger = trigger;
+        led->priv = priv;
+        led->type = type;
        ret = led_classdev_register(device, &led->led_dev);
        if (ret) {
                IWL_ERROR("Error: failed to register led handler.\n");
                return ret;
        }
-        led->priv = priv;
-        led->type = type;
        led->registered = 1;
        if (set_led && led->led_on)
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-rs.c b/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
index c9847b1a67f7..3a7f0cb710ec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
@@ -1162,7 +1162,6 @@ static s32 rs_get_best_rate(struct iwl_priv *priv,
                        /* Higher rate not available, use the original */
                        } else {
-                                new_rate = rate;
                                break;
                        }
                }
@@ -2009,7 +2008,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         * 2)  Not just finishing up a search
         * 3)  Allowing a new search
         */
-        if (!update_lq && !done_search && !lq_sta->stay_in_tbl) {
+        if (!update_lq && !done_search && !lq_sta->stay_in_tbl && window->counter) {
                /* Save current throughput to compare with "search" throughput*/
                lq_sta->last_tpt = current_tpt;
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 6328b9593877..8124fd9b1353 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1842,6 +1842,9 @@ static void lbs_send_confirmsleep(struct lbs_private *priv)
        spin_lock_irqsave(&priv->driver_lock, flags);
+        /* We don't get a response on the sleep-confirmation */
+        priv->dnld_sent = DNLD_RES_RECEIVED;
        /* If nothing to do, go back to sleep (?) */
        if (!__kfifo_len(priv->event_fifo) && !priv->resp_len[priv->resp_idx])
                priv->psstate = PS_STATE_SLEEP;
@@ -1904,12 +1907,12 @@ void lbs_ps_confirm_sleep(struct lbs_private *priv)
        lbs_deb_enter(LBS_DEB_HOST);
+        spin_lock_irqsave(&priv->driver_lock, flags);
        if (priv->dnld_sent) {
                allowed = 0;
                lbs_deb_host("dnld_sent was set\n");
        }
-        spin_lock_irqsave(&priv->driver_lock, flags);
        /* In-progress command? */
        if (priv->cur_cmd) {
                allowed = 0;
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index ad2fabca9116..0aa0ce3b2c42 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -312,8 +312,8 @@ static ssize_t lbs_threshold_write(uint16_t tlv_type, uint16_t event_mask,
        if (tlv_type != TLV_TYPE_BCNMISS)
                tlv->freq = freq;
-        /* The command header, the event mask, and the one TLV */
+        /* The command header, the action, the event mask, and one TLV */
-        events->hdr.size = cpu_to_le16(sizeof(events->hdr) + 2 + sizeof(*tlv));
+        events->hdr.size = cpu_to_le16(sizeof(events->hdr) + 4 + sizeof(*tlv));
        ret = lbs_cmd_with_response(priv, CMD_802_11_SUBSCRIBE_EVENT, events);
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index e1f066068590..acfc4bfcc262 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -732,8 +732,8 @@ static int lbs_thread(void *data)
                lbs_deb_thread("4: currenttxskb %p, dnld_sent %d\n",
                       priv->currenttxskb, priv->dnld_sent);
-                spin_lock_irq(&priv->driver_lock);
                /* Process any pending command response */
+                spin_lock_irq(&priv->driver_lock);
                resp_idx = priv->resp_idx;
                if (priv->resp_len[resp_idx]) {
                        spin_unlock_irq(&priv->driver_lock);
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 98ddbb3b3273..1610a7308c1d 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -49,6 +49,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
        {USB_DEVICE(0x5041, 0x2235)},   /* Linksys WUSB54G Portable */
        /* Version 2 devices (3887) */
+        {USB_DEVICE(0x0471, 0x1230)},   /* Philips CPWUA054/00 */
        {USB_DEVICE(0x050d, 0x7050)},   /* Belkin F5D7050 ver 1000 */
        {USB_DEVICE(0x0572, 0x2000)},   /* Cohiba Proto board */
        {USB_DEVICE(0x0572, 0x2002)},   /* Cohiba Proto board */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index d0b1fb15c709..18c9931e3267 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -116,6 +116,7 @@ MODULE_PARM_DESC(workaround_interval,
 #define OID_802_11_ENCRYPTION_STATUS            ccpu2(0x0d01011b)
 #define OID_802_11_ADD_KEY                      ccpu2(0x0d01011d)
 #define OID_802_11_REMOVE_KEY                   ccpu2(0x0d01011e)
+#define OID_802_11_ASSOCIATION_INFORMATION      ccpu2(0x0d01011f)
 #define OID_802_11_PMKID                        ccpu2(0x0d010123)
 #define OID_802_11_NETWORK_TYPES_SUPPORTED      ccpu2(0x0d010203)
 #define OID_802_11_NETWORK_TYPE_IN_USE          ccpu2(0x0d010204)
@@ -271,6 +272,26 @@ struct ndis_config_param {
        __le32 value_length;
 } __attribute__((packed));
+struct ndis_80211_assoc_info {
+        __le32 length;
+        __le16 req_ies;
+        struct req_ie {
+                __le16 capa;
+                __le16 listen_interval;
+                u8 cur_ap_address[6];
+        } req_ie;
+        __le32 req_ie_length;
+        __le32 offset_req_ies;
+        __le16 resp_ies;
+        struct resp_ie {
+                __le16 capa;
+                __le16 status_code;
+                __le16 assoc_id;
+        } resp_ie;
+        __le32 resp_ie_length;
+        __le32 offset_resp_ies;
+} __attribute__((packed));
 /* these have to match what is in wpa_supplicant */
 enum wpa_alg { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP };
 enum wpa_cipher { CIPHER_NONE, CIPHER_WEP40, CIPHER_TKIP, CIPHER_CCMP,
@@ -674,6 +695,12 @@ static int get_bssid(struct usbnet *usbdev, u8 bssid[ETH_ALEN])
        return ret;
 }
+static int get_association_info(struct usbnet *usbdev,
+                        struct ndis_80211_assoc_info *info, int len)
+{
+        return rndis_query_oid(usbdev, OID_802_11_ASSOCIATION_INFORMATION,
+                                info, &len);
+}
 static int is_associated(struct usbnet *usbdev)
 {
@@ -2182,11 +2209,40 @@ static void rndis_wext_worker(struct work_struct *work)
        struct usbnet *usbdev = priv->usbdev;
        union iwreq_data evt;
        unsigned char bssid[ETH_ALEN];
-        int ret;
+        struct ndis_80211_assoc_info *info;
+        int assoc_size = sizeof(*info) + IW_CUSTOM_MAX + 32;
+        int ret, offset;
        if (test_and_clear_bit(WORK_CONNECTION_EVENT, &priv->work_pending)) {
-                ret = get_bssid(usbdev, bssid);
+                info = kzalloc(assoc_size, GFP_KERNEL);
+                if (!info)
+                        goto get_bssid;
+                /* Get association info IEs from device and send them back to
+                 * userspace. */
+                ret = get_association_info(usbdev, info, assoc_size);
+                if (!ret) {
+                        evt.data.length = le32_to_cpu(info->req_ie_length);
+                        if (evt.data.length > 0) {
+                                offset = le32_to_cpu(info->offset_req_ies);
+                                wireless_send_event(usbdev->net,
+                                        IWEVASSOCREQIE, &evt,
+                                        (char *)info + offset);
+                        }
+                        evt.data.length = le32_to_cpu(info->resp_ie_length);
+                        if (evt.data.length > 0) {
+                                offset = le32_to_cpu(info->offset_resp_ies);
+                                wireless_send_event(usbdev->net,
+                                        IWEVASSOCRESPIE, &evt,
+                                        (char *)info + offset);
+                        }
+                }
+                kfree(info);
+get_bssid:
+                ret = get_bssid(usbdev, bssid);
                if (!ret) {
                        evt.data.flags = 0;
                        evt.data.length = 0;
@@ -2414,6 +2470,11 @@ static int bcm4320_early_init(struct usbnet *dev)
        else if (priv->param_power_save > 2)
                priv->param_power_save = 2;
+        if (priv->param_power_output < 0)
+                priv->param_power_output = 0;
+        else if (priv->param_power_output > 3)
+                priv->param_power_output = 3;
        if (priv->param_roamtrigger < -80)
                priv->param_roamtrigger = -80;
        else if (priv->param_roamtrigger > -60)
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 57bdc153952f..611d98320593 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -328,6 +328,11 @@ static inline int rt2x00_get_link_ant_rssi(struct link *link)
        return DEFAULT_RSSI;
 }
+static inline void rt2x00_reset_link_ant_rssi(struct link *link)
+{
+        link->ant.rssi_ant = 0;
+}
 static inline int rt2x00_get_link_ant_rssi_history(struct link *link,
                                                   enum antenna ant)
 {
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index a9930a03f450..48608e8cc8b4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -129,6 +129,7 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
         */
        rt2x00dev->ops->lib->config(rt2x00dev, &libconf, CONFIG_UPDATE_ANTENNA);
        rt2x00lib_reset_link_tuner(rt2x00dev);
+        rt2x00_reset_link_ant_rssi(&rt2x00dev->link);
        rt2x00dev->link.ant.active.rx = libconf.ant.rx;
        rt2x00dev->link.ant.active.tx = libconf.ant.tx;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index b22c02737185..2673d568bcac 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -483,9 +483,9 @@ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
                return;
-        ieee80211_iterate_active_interfaces(rt2x00dev->hw,
+        ieee80211_iterate_active_interfaces_atomic(rt2x00dev->hw,
-                                            rt2x00lib_beacondone_iter,
+                                                   rt2x00lib_beacondone_iter,
-                                            rt2x00dev);
+                                                   rt2x00dev);
        queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->intf_work);
 }
@@ -507,7 +507,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         * Update TX statistics.
         */
        rt2x00dev->link.qual.tx_success += success;
-        rt2x00dev->link.qual.tx_failed += txdesc->retry + fail;
+        rt2x00dev->link.qual.tx_failed += fail;
        /*
         * Initialize TX status
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index c206b5092070..87e280a21971 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -93,6 +93,7 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
         */
        if (!test_bit(DEVICE_PRESENT, &rt2x00dev->flags)) {
                ieee80211_stop_queues(hw);
+                dev_kfree_skb_any(skb);
                return NETDEV_TX_OK;
        }
diff --git a/drivers/net/wireless/rtl8180_grf5101.c b/drivers/net/wireless/rtl8180_grf5101.c
index 5d47935dbac3..947ee55f18b2 100644
--- a/drivers/net/wireless/rtl8180_grf5101.c
+++ b/drivers/net/wireless/rtl8180_grf5101.c
@@ -88,7 +88,7 @@ static void grf5101_rf_set_channel(struct ieee80211_hw *dev,
        write_grf5101(dev, 0x0B, chan);
        write_grf5101(dev, 0x07, 0x1000);
-        grf5101_write_phy_antenna(dev, chan);
+        grf5101_write_phy_antenna(dev, channel);
 }
 static void grf5101_rf_stop(struct ieee80211_hw *dev)
diff --git a/drivers/net/wireless/rtl8180_max2820.c b/drivers/net/wireless/rtl8180_max2820.c
index a34dfd382b6d..6c825fd7f3b6 100644
--- a/drivers/net/wireless/rtl8180_max2820.c
+++ b/drivers/net/wireless/rtl8180_max2820.c
@@ -78,7 +78,8 @@ static void max2820_rf_set_channel(struct ieee80211_hw *dev,
                                   struct ieee80211_conf *conf)
 {
        struct rtl8180_priv *priv = dev->priv;
-        int channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
+        int channel = conf ?
+                ieee80211_frequency_to_channel(conf->channel->center_freq) : 1;
        unsigned int chan_idx = channel - 1;
        u32 txpw = priv->channels[chan_idx].hw_value & 0xFF;
        u32 chan = max2820_chan[chan_idx];
@@ -87,7 +88,7 @@ static void max2820_rf_set_channel(struct ieee80211_hw *dev,
         * sa2400, for MAXIM we do this directly from BB */
        rtl8180_write_phy(dev, 3, txpw);
-        max2820_write_phy_antenna(dev, chan);
+        max2820_write_phy_antenna(dev, channel);
        write_max2820(dev, 3, chan);
 }
diff --git a/drivers/net/wireless/rtl8180_sa2400.c b/drivers/net/wireless/rtl8180_sa2400.c
index 0311b4ea124c..cea4e0ccb92d 100644
--- a/drivers/net/wireless/rtl8180_sa2400.c
+++ b/drivers/net/wireless/rtl8180_sa2400.c
@@ -86,7 +86,7 @@ static void sa2400_rf_set_channel(struct ieee80211_hw *dev,
        write_sa2400(dev, 7, txpw);
-        sa2400_write_phy_antenna(dev, chan);
+        sa2400_write_phy_antenna(dev, channel);
        write_sa2400(dev, 0, chan);
        write_sa2400(dev, 1, 0xbb50);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 6424e5a2c83d..418606ac1c3b 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -719,7 +719,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
        fc = le16_to_cpu(*((__le16 *) buffer));
        is_qos = ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
-                 ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_QOS_DATA);
+                 (fc & IEEE80211_STYPE_QOS_DATA);
        is_4addr = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
                   (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
        need_padding = is_qos ^ is_4addr;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 8bddff150c70..d26f69b0184f 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -946,8 +946,7 @@ err:
                work_done++;
        }
-        while ((skb = __skb_dequeue(&errq)))
+        __skb_queue_purge(&errq);
-                kfree_skb(skb);
        work_done -= handle_incoming_queue(dev, &rxq);
@@ -1079,8 +1078,7 @@ static void xennet_release_rx_bufs(struct netfront_info *np)
                }
        }
-        while ((skb = __skb_dequeue(&free_list)) != NULL)
+        __skb_queue_purge(&free_list);
-                dev_kfree_skb(skb);
        spin_unlock_bh(&np->rx_lock);
 }
diff --git a/drivers/of/of_i2c.c b/drivers/of/of_i2c.c
index 715a44471617..b2ccdcbeb896 100644
--- a/drivers/of/of_i2c.c
+++ b/drivers/of/of_i2c.c
@@ -21,7 +21,6 @@ struct i2c_driver_device {
 };
 static struct i2c_driver_device i2c_devices[] = {
-        { "dallas,ds1374", "rtc-ds1374" },
 };
 static int of_find_i2c_driver(struct device_node *node,
diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c
index 925ba16355ce..a11021e8ce37 100644
--- a/drivers/pci/hotplug/pci_hotplug_core.c
+++ b/drivers/pci/hotplug/pci_hotplug_core.c
@@ -619,6 +619,7 @@ static struct hotplug_slot *get_slot_from_name (const char *name)
 int pci_hp_register (struct hotplug_slot *slot)
 {
        int result;
+        struct hotplug_slot *tmp;
        if (slot == NULL)
                return -ENODEV;
@@ -630,7 +631,11 @@ int pci_hp_register (struct hotplug_slot *slot)
                return -EINVAL;
        }
-        /* this can fail if we have already registered a slot with the same name */
+        /* Check if we have already registered a slot with the same name. */
+        tmp = get_slot_from_name(slot->name);
+        if (tmp)
+                return -EEXIST;
        slot->kobj.kset = pci_hotplug_slots_kset;
        result = kobject_init_and_add(&slot->kobj, &hotplug_slot_ktype, NULL,
                                      "%s", slot->name);
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index 8264a7680435..79c9ddaad3fb 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -97,6 +97,7 @@ struct controller {
        u8 cap_base;
        struct timer_list poll_timer;
        volatile int cmd_busy;
+        unsigned int no_cmd_complete:1;
 };
 #define INT_BUTTON_IGNORE               0
@@ -135,6 +136,7 @@ struct controller {
 #define PWR_LED_PRSN    0x00000010
 #define HP_SUPR_RM_SUP  0x00000020
 #define EMI_PRSN        0x00020000
+#define NO_CMD_CMPL_SUP 0x00040000
 #define ATTN_BUTTN(ctrl)        ((ctrl)->slot_cap & ATTN_BUTTN_PRSN)
 #define POWER_CTRL(ctrl)        ((ctrl)->slot_cap & PWR_CTRL_PRSN)
@@ -143,13 +145,14 @@ struct controller {
 #define PWR_LED(ctrl)           ((ctrl)->slot_cap & PWR_LED_PRSN)
 #define HP_SUPR_RM(ctrl)        ((ctrl)->slot_cap & HP_SUPR_RM_SUP)
 #define EMI(ctrl)               ((ctrl)->slot_cap & EMI_PRSN)
+#define NO_CMD_CMPL(ctrl)       ((ctrl)->slot_cap & NO_CMD_CMPL_SUP)
 extern int pciehp_sysfs_enable_slot(struct slot *slot);
 extern int pciehp_sysfs_disable_slot(struct slot *slot);
-extern u8 pciehp_handle_attention_button(u8 hp_slot, struct controller *ctrl);
+extern u8 pciehp_handle_attention_button(struct slot *p_slot);
-extern u8 pciehp_handle_switch_change(u8 hp_slot, struct controller *ctrl);
+  extern u8 pciehp_handle_switch_change(struct slot *p_slot);
-extern u8 pciehp_handle_presence_change(u8 hp_slot, struct controller *ctrl);
+extern u8 pciehp_handle_presence_change(struct slot *p_slot);
-extern u8 pciehp_handle_power_fault(u8 hp_slot, struct controller *ctrl);
+extern u8 pciehp_handle_power_fault(struct slot *p_slot);
 extern int pciehp_configure_device(struct slot *p_slot);
 extern int pciehp_unconfigure_device(struct slot *p_slot);
 extern void pciehp_queue_pushbutton_work(struct work_struct *work);
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index 43d8ddb2d679..48a2ed378914 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -254,7 +254,11 @@ static int init_slots(struct controller *ctrl)
                    slot->hp_slot, slot->number, ctrl->slot_device_offset);
                retval = pci_hp_register(hotplug_slot);
                if (retval) {
-                        err ("pci_hp_register failed with error %d\n", retval);
+                        err("pci_hp_register failed with error %d\n", retval);
+                        if (retval == -EEXIST)
+                                err("Failed to register slot because of name "
+                                    "collision. Try \'pciehp_slot_with_bus\' "
+                                    "module option.\n");
                        goto error_info;
                }
                /* create additional sysfs entries */
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 0a7aa628e955..96a5d55a4983 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -55,16 +55,13 @@ static int queue_interrupt_event(struct slot *p_slot, u32 event_type)
        return 0;
 }
-u8 pciehp_handle_attention_button(u8 hp_slot, struct controller *ctrl)
+u8 pciehp_handle_attention_button(struct slot *p_slot)
 {
-        struct slot *p_slot;
        u32 event_type;
        /* Attention Button Change */
        dbg("pciehp:  Attention button interrupt received.\n");
-        p_slot = pciehp_find_slot(ctrl, hp_slot + ctrl->slot_device_offset);
        /*
         *  Button pressed - See if need to TAKE ACTION!!!
         */
@@ -76,18 +73,15 @@ u8 pciehp_handle_attention_button(u8 hp_slot, struct controller *ctrl)
        return 0;
 }
-u8 pciehp_handle_switch_change(u8 hp_slot, struct controller *ctrl)
+u8 pciehp_handle_switch_change(struct slot *p_slot)
 {
-        struct slot *p_slot;
        u8 getstatus;
        u32 event_type;
        /* Switch Change */
        dbg("pciehp:  Switch interrupt received.\n");
-        p_slot = pciehp_find_slot(ctrl, hp_slot + ctrl->slot_device_offset);
        p_slot->hpc_ops->get_latch_status(p_slot, &getstatus);
        if (getstatus) {
                /*
                 * Switch opened
@@ -107,17 +101,14 @@ u8 pciehp_handle_switch_change(u8 hp_slot, struct controller *ctrl)
        return 1;
 }
-u8 pciehp_handle_presence_change(u8 hp_slot, struct controller *ctrl)
+u8 pciehp_handle_presence_change(struct slot *p_slot)
 {
-        struct slot *p_slot;
        u32 event_type;
        u8 presence_save;
        /* Presence Change */
        dbg("pciehp:  Presence/Notify input change.\n");
-        p_slot = pciehp_find_slot(ctrl, hp_slot + ctrl->slot_device_offset);
        /* Switch is open, assume a presence change
         * Save the presence state
         */
@@ -141,16 +132,13 @@ u8 pciehp_handle_presence_change(u8 hp_slot, struct controller *ctrl)
        return 1;
 }
-u8 pciehp_handle_power_fault(u8 hp_slot, struct controller *ctrl)
+u8 pciehp_handle_power_fault(struct slot *p_slot)
 {
-        struct slot *p_slot;
        u32 event_type;
        /* power fault */
        dbg("pciehp:  Power fault interrupt received.\n");
-        p_slot = pciehp_find_slot(ctrl, hp_slot + ctrl->slot_device_offset);
        if ( !(p_slot->hpc_ops->query_power_fault(p_slot))) {
                /*
                 * power fault Cleared
@@ -163,7 +151,7 @@ u8 pciehp_handle_power_fault(u8 hp_slot, struct controller *ctrl)
                 */
                info("Power fault on Slot(%s)\n", p_slot->name);
                event_type = INT_POWER_FAULT;
-                info("power fault bit %x set\n", hp_slot);
+                info("power fault bit %x set\n", 0);
        }
        queue_interrupt_event(p_slot, event_type);
@@ -186,6 +174,13 @@ static void set_slot_off(struct controller *ctrl, struct slot * pslot)
                }
        }
+        /*
+         * After turning power off, we must wait for at least 1 second
+         * before taking any action that relies on power having been
+         * removed from the slot/adapter.
+         */
+        msleep(1000);
        if (PWR_LED(ctrl))
                pslot->hpc_ops->green_led_off(pslot);
@@ -289,6 +284,13 @@ static int remove_board(struct slot *p_slot)
                }
        }
+        /*
+         * After turning power off, we must wait for at least 1 second
+         * before taking any action that relies on power having been
+         * removed from the slot/adapter.
+         */
+        msleep(1000);
        if (PWR_LED(ctrl))
                /* turn off Green LED */
                p_slot->hpc_ops->green_led_off(p_slot);
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 891f81a0400c..79f104963166 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -247,14 +247,38 @@ static inline void pciehp_free_irq(struct controller *ctrl)
                free_irq(ctrl->pci_dev->irq, ctrl);
 }
-static inline int pcie_wait_cmd(struct controller *ctrl)
+static inline int pcie_poll_cmd(struct controller *ctrl)
+{
+        u16 slot_status;
+        int timeout = 1000;
+        if (!pciehp_readw(ctrl, SLOTSTATUS, &slot_status))
+                if (slot_status & CMD_COMPLETED)
+                        goto completed;
+        for (timeout = 1000; timeout > 0; timeout -= 100) {
+                msleep(100);
+                if (!pciehp_readw(ctrl, SLOTSTATUS, &slot_status))
+                        if (slot_status & CMD_COMPLETED)
+                                goto completed;
+        }
+        return 0;       /* timeout */
+completed:
+        pciehp_writew(ctrl, SLOTSTATUS, CMD_COMPLETED);
+        return timeout;
+}
+static inline int pcie_wait_cmd(struct controller *ctrl, int poll)
 {
        int retval = 0;
        unsigned int msecs = pciehp_poll_mode ? 2500 : 1000;
        unsigned long timeout = msecs_to_jiffies(msecs);
        int rc;
-        rc = wait_event_interruptible_timeout(ctrl->queue,
+        if (poll)
+                rc = pcie_poll_cmd(ctrl);
+        else
+                rc = wait_event_interruptible_timeout(ctrl->queue,
                                              !ctrl->cmd_busy, timeout);
        if (!rc)
                dbg("Command not completed in 1000 msec\n");
@@ -286,12 +310,28 @@ static int pcie_write_cmd(struct controller *ctrl, u16 cmd, u16 mask)
                goto out;
        }
-        if ((slot_status & CMD_COMPLETED) == CMD_COMPLETED ) {
+        if (slot_status & CMD_COMPLETED) {
-                /* After 1 sec and CMD_COMPLETED still not set, just
+                if (!ctrl->no_cmd_complete) {
-                   proceed forward to issue the next command according
+                        /*
-                   to spec.  Just print out the error message */
+                         * After 1 sec and CMD_COMPLETED still not set, just
-                dbg("%s: CMD_COMPLETED not clear after 1 sec.\n",
+                         * proceed forward to issue the next command according
-                    __func__);
+                         * to spec. Just print out the error message.
+                         */
+                        dbg("%s: CMD_COMPLETED not clear after 1 sec.\n",
+                            __func__);
+                } else if (!NO_CMD_CMPL(ctrl)) {
+                        /*
+                         * This controller semms to notify of command completed
+                         * event even though it supports none of power
+                         * controller, attention led, power led and EMI.
+                         */
+                        dbg("%s: Unexpected CMD_COMPLETED. Need to wait for "
+                            "command completed event.\n", __func__);
+                        ctrl->no_cmd_complete = 0;
+                } else {
+                        dbg("%s: Unexpected CMD_COMPLETED. Maybe the "
+                            "controller is broken.\n", __func__);
+                }
        }
        retval = pciehp_readw(ctrl, SLOTCTRL, &slot_ctrl);
@@ -315,8 +355,18 @@ static int pcie_write_cmd(struct controller *ctrl, u16 cmd, u16 mask)
        /*
         * Wait for command completion.
         */
-        if (!retval)
+        if (!retval && !ctrl->no_cmd_complete) {
-                retval = pcie_wait_cmd(ctrl);
+                int poll = 0;
+                /*
+                 * if hotplug interrupt is not enabled or command
+                 * completed interrupt is not enabled, we need to poll
+                 * command completed event.
+                 */
+                if (!(slot_ctrl & HP_INTR_ENABLE) ||
+                    !(slot_ctrl & CMD_CMPL_INTR_ENABLE))
+                        poll = 1;
+                retval = pcie_wait_cmd(ctrl, poll);
+        }
 out:
        mutex_unlock(&ctrl->ctrl_lock);
        return retval;
@@ -704,13 +754,6 @@ static int hpc_power_off_slot(struct slot * slot)
        }
        dbg("%s: SLOTCTRL %x write cmd %x\n",
            __func__, ctrl->cap_base + SLOTCTRL, slot_cmd);
-        /*
-         * After turning power off, we must wait for at least 1 second
-         * before taking any action that relies on power having been
-         * removed from the slot/adapter.
-         */
-        msleep(1000);
 out:
        if (changed)
                pcie_unmask_bad_dllp(ctrl);
@@ -722,6 +765,7 @@ static irqreturn_t pcie_isr(int irq, void *dev_id)
 {
        struct controller *ctrl = (struct controller *)dev_id;
        u16 detected, intr_loc;
+        struct slot *p_slot;
        /*
         * In order to guarantee that all interrupt events are
@@ -756,21 +800,38 @@ static irqreturn_t pcie_isr(int irq, void *dev_id)
                wake_up_interruptible(&ctrl->queue);
        }
+        if (!(intr_loc & ~CMD_COMPLETED))
+                return IRQ_HANDLED;
+        /*
+         * Return without handling events if this handler routine is
+         * called before controller initialization is done. This may
+         * happen if hotplug event or another interrupt that shares
+         * the IRQ with pciehp arrives before slot initialization is
+         * done after interrupt handler is registered.
+         *
+         * FIXME - Need more structural fixes. We need to be ready to
+         * handle the event before installing interrupt handler.
+         */
+        p_slot = pciehp_find_slot(ctrl, ctrl->slot_device_offset);
+        if (!p_slot || !p_slot->hpc_ops)
+                return IRQ_HANDLED;
        /* Check MRL Sensor Changed */
        if (intr_loc & MRL_SENS_CHANGED)
-                pciehp_handle_switch_change(0, ctrl);
+                pciehp_handle_switch_change(p_slot);
        /* Check Attention Button Pressed */
        if (intr_loc & ATTN_BUTTN_PRESSED)
-                pciehp_handle_attention_button(0, ctrl);
+                pciehp_handle_attention_button(p_slot);
        /* Check Presence Detect Changed */
        if (intr_loc & PRSN_DETECT_CHANGED)
-                pciehp_handle_presence_change(0, ctrl);
+                pciehp_handle_presence_change(p_slot);
        /* Check Power Fault Detected */
        if (intr_loc & PWR_FAULT_DETECTED)
-                pciehp_handle_power_fault(0, ctrl);
+                pciehp_handle_power_fault(p_slot);
        return IRQ_HANDLED;
 }
@@ -1028,6 +1089,12 @@ static int pciehp_acpi_get_hp_hw_control_from_firmware(struct pci_dev *dev)
 static int pcie_init_hardware_part1(struct controller *ctrl,
                                    struct pcie_device *dev)
 {
+        /* Clear all remaining event bits in Slot Status register */
+        if (pciehp_writew(ctrl, SLOTSTATUS, 0x1f)) {
+                err("%s: Cannot write to SLOTSTATUS register\n", __func__);
+                return -1;
+        }
        /* Mask Hot-plug Interrupt Enable */
        if (pcie_write_cmd(ctrl, 0, HP_INTR_ENABLE | CMD_CMPL_INTR_ENABLE)) {
                err("%s: Cannot mask hotplug interrupt enable\n", __func__);
@@ -1040,16 +1107,6 @@ int pcie_init_hardware_part2(struct controller *ctrl, struct pcie_device *dev)
 {
        u16 cmd, mask;
-        /*
-         * We need to clear all events before enabling hotplug interrupt
-         * notification mechanism in order for hotplug controler to
-         * generate interrupts.
-         */
-        if (pciehp_writew(ctrl, SLOTSTATUS, 0x1f)) {
-                err("%s: Cannot write to SLOTSTATUS register\n", __FUNCTION__);
-                return -1;
-        }
        cmd = PRSN_DETECT_ENABLE;
        if (ATTN_BUTTN(ctrl))
                cmd |= ATTN_BUTTN_ENABLE;
@@ -1116,6 +1173,7 @@ static inline void dbg_ctrl(struct controller *ctrl)
        dbg("  Power Indicator      : %3s\n", PWR_LED(ctrl)    ? "yes" : "no");
        dbg("  Hot-Plug Surprise    : %3s\n", HP_SUPR_RM(ctrl) ? "yes" : "no");
        dbg("  EMI Present          : %3s\n", EMI(ctrl)        ? "yes" : "no");
+        dbg("  Comamnd Completed    : %3s\n", NO_CMD_CMPL(ctrl)? "no" : "yes");
        pciehp_readw(ctrl, SLOTSTATUS, &reg16);
        dbg("Slot Status            : 0x%04x\n", reg16);
        pciehp_readw(ctrl, SLOTSTATUS, &reg16);
@@ -1147,6 +1205,15 @@ int pcie_init(struct controller *ctrl, struct pcie_device *dev)
        mutex_init(&ctrl->ctrl_lock);
        init_waitqueue_head(&ctrl->queue);
        dbg_ctrl(ctrl);
+        /*
+         * Controller doesn't notify of command completion if the "No
+         * Command Completed Support" bit is set in Slot Capability
+         * register or the controller supports none of power
+         * controller, attention led, power led and EMI.
+         */
+        if (NO_CMD_CMPL(ctrl) ||
+            !(POWER_CTRL(ctrl) | ATTN_LED(ctrl) | PWR_LED(ctrl) | EMI(ctrl)))
+            ctrl->no_cmd_complete = 1;
        info("HPC vendor_id %x device_id %x ss_vid %x ss_did %x\n",
             pdev->vendor, pdev->device,
diff --git a/drivers/pci/hotplug/rpadlpar_sysfs.c b/drivers/pci/hotplug/rpadlpar_sysfs.c
index e32148a8fa12..779c5db71be4 100644
--- a/drivers/pci/hotplug/rpadlpar_sysfs.c
+++ b/drivers/pci/hotplug/rpadlpar_sysfs.c
@@ -18,8 +18,12 @@
 #include "rpadlpar.h"
 #define DLPAR_KOBJ_NAME       "control"
-#define ADD_SLOT_ATTR_NAME    "add_slot"
-#define REMOVE_SLOT_ATTR_NAME "remove_slot"
+/* Those two have no quotes because they are passed to __ATTR() which
+ * stringifies the argument (yuck !)
+ */
+#define ADD_SLOT_ATTR_NAME    add_slot
+#define REMOVE_SLOT_ATTR_NAME remove_slot
 #define MAX_DRC_NAME_LEN 64
diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
index 1648076600fc..97848654652a 100644
--- a/drivers/pci/hotplug/shpchp_core.c
+++ b/drivers/pci/hotplug/shpchp_core.c
@@ -162,6 +162,10 @@ static int init_slots(struct controller *ctrl)
                retval = pci_hp_register(slot->hotplug_slot);
                if (retval) {
                        err("pci_hp_register failed with error %d\n", retval);
+                        if (retval == -EEXIST)
+                                err("Failed to register slot because of name "
+                                    "collision. Try \'shpchp_slot_with_bus\' "
+                                    "module option.\n");
                        goto error_info;
                }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 72cf61ed8f96..e1637bd82b8e 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -181,7 +181,7 @@ static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev,
           any need to change it. */
        struct mempolicy *oldpol;
        cpumask_t oldmask = current->cpus_allowed;
-        int node = pcibus_to_node(dev->bus);
+        int node = dev_to_node(&dev->dev);
        if (node >= 0) {
                node_to_cpumask_ptr(nodecpumask, node);
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 271d41cc05ab..6f3c7446c329 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -489,13 +489,13 @@ pci_mmap_legacy_mem(struct kobject *kobj, struct bin_attribute *attr,
 * @kobj: kobject for mapping
 * @attr: struct bin_attribute for the file being mapped
 * @vma: struct vm_area_struct passed into the mmap
+ * @write_combine: 1 for write_combine mapping
 *
 * Use the regular PCI mapping routines to map a PCI resource into userspace.
- * FIXME: write combining?  maybe automatic for prefetchable regions?
 */
 static int
 pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
-                  struct vm_area_struct *vma)
+                  struct vm_area_struct *vma, int write_combine)
 {
        struct pci_dev *pdev = to_pci_dev(container_of(kobj,
                                                       struct device, kobj));
@@ -518,7 +518,21 @@ pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
        vma->vm_pgoff += start >> PAGE_SHIFT;
        mmap_type = res->flags & IORESOURCE_MEM ? pci_mmap_mem : pci_mmap_io;
-        return pci_mmap_page_range(pdev, vma, mmap_type, 0);
+        return pci_mmap_page_range(pdev, vma, mmap_type, write_combine);
+}
+static int
+pci_mmap_resource_uc(struct kobject *kobj, struct bin_attribute *attr,
+                     struct vm_area_struct *vma)
+{
+        return pci_mmap_resource(kobj, attr, vma, 0);
+}
+static int
+pci_mmap_resource_wc(struct kobject *kobj, struct bin_attribute *attr,
+                     struct vm_area_struct *vma)
+{
+        return pci_mmap_resource(kobj, attr, vma, 1);
 }
 /**
@@ -541,9 +555,46 @@ pci_remove_resource_files(struct pci_dev *pdev)
                        sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
                        kfree(res_attr);
                }
+                res_attr = pdev->res_attr_wc[i];
+                if (res_attr) {
+                        sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
+                        kfree(res_attr);
+                }
        }
 }
+static int pci_create_attr(struct pci_dev *pdev, int num, int write_combine)
+{
+        /* allocate attribute structure, piggyback attribute name */
+        int name_len = write_combine ? 13 : 10;
+        struct bin_attribute *res_attr;
+        int retval;
+        res_attr = kzalloc(sizeof(*res_attr) + name_len, GFP_ATOMIC);
+        if (res_attr) {
+                char *res_attr_name = (char *)(res_attr + 1);
+                if (write_combine) {
+                        pdev->res_attr_wc[num] = res_attr;
+                        sprintf(res_attr_name, "resource%d_wc", num);
+                        res_attr->mmap = pci_mmap_resource_wc;
+                } else {
+                        pdev->res_attr[num] = res_attr;
+                        sprintf(res_attr_name, "resource%d", num);
+                        res_attr->mmap = pci_mmap_resource_uc;
+                }
+                res_attr->attr.name = res_attr_name;
+                res_attr->attr.mode = S_IRUSR | S_IWUSR;
+                res_attr->size = pci_resource_len(pdev, num);
+                res_attr->private = &pdev->resource[num];
+                retval = sysfs_create_bin_file(&pdev->dev.kobj, res_attr);
+        } else
+                retval = -ENOMEM;
+        return retval;
+}
 /**
 * pci_create_resource_files - create resource files in sysfs for @dev
 * @dev: dev in question
@@ -557,31 +608,19 @@ static int pci_create_resource_files(struct pci_dev *pdev)
        /* Expose the PCI resources from this device as files */
        for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-                struct bin_attribute *res_attr;
                /* skip empty resources */
                if (!pci_resource_len(pdev, i))
                        continue;
-                /* allocate attribute structure, piggyback attribute name */
+                retval = pci_create_attr(pdev, i, 0);
-                res_attr = kzalloc(sizeof(*res_attr) + 10, GFP_ATOMIC);
+                /* for prefetchable resources, create a WC mappable file */
-                if (res_attr) {
+                if (!retval && pdev->resource[i].flags & IORESOURCE_PREFETCH)
-                        char *res_attr_name = (char *)(res_attr + 1);
+                        retval = pci_create_attr(pdev, i, 1);
-                        pdev->res_attr[i] = res_attr;
+                if (retval) {
-                        sprintf(res_attr_name, "resource%d", i);
+                        pci_remove_resource_files(pdev);
-                        res_attr->attr.name = res_attr_name;
+                        return retval;
-                        res_attr->attr.mode = S_IRUSR | S_IWUSR;
-                        res_attr->size = pci_resource_len(pdev, i);
-                        res_attr->mmap = pci_mmap_resource;
-                        res_attr->private = &pdev->resource[i];
-                        retval = sysfs_create_bin_file(&pdev->dev.kobj, res_attr);
-                        if (retval) {
-                                pci_remove_resource_files(pdev);
-                                return retval;
-                        }
-                } else {
-                        return -ENOMEM;
                }
        }
        return 0;
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 61fedb2448b6..f82495583e63 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -506,6 +506,23 @@ static void free_link_state(struct pci_dev *pdev)
        pdev->link_state = NULL;
 }
+static int pcie_aspm_sanity_check(struct pci_dev *pdev)
+{
+        struct pci_dev *child_dev;
+        int child_pos;
+        /*
+         * Some functions in a slot might not all be PCIE functions, very
+         * strange. Disable ASPM for the whole slot
+         */
+        list_for_each_entry(child_dev, &pdev->subordinate->devices, bus_list) {
+                child_pos = pci_find_capability(child_dev, PCI_CAP_ID_EXP);
+                if (!child_pos)
+                        return -EINVAL;
+        }
+        return 0;
+}
 /*
 * pcie_aspm_init_link_state: Initiate PCI express link state.
 * It is called after the pcie and its children devices are scaned.
@@ -526,6 +543,9 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
        if (list_empty(&pdev->subordinate->devices))
                goto out;
+        if (pcie_aspm_sanity_check(pdev))
+                goto out;
        mutex_lock(&aspm_lock);
        link_state = kzalloc(sizeof(*link_state), GFP_KERNEL);
diff --git a/drivers/pcmcia/electra_cf.c b/drivers/pcmcia/electra_cf.c
index 0a6cea1316b4..52d0aa8c2e7a 100644
--- a/drivers/pcmcia/electra_cf.c
+++ b/drivers/pcmcia/electra_cf.c
@@ -352,6 +352,7 @@ static struct of_device_id electra_cf_match[] = {
        },
        {},
 };
+MODULE_DEVICE_TABLE(of, electra_cf_match);
 static struct of_platform_driver electra_cf_driver = {
        .name      = (char *)driver_name,
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 0201c8adfda7..46c791adb894 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -50,15 +50,17 @@ static int irq_flags(int triggering, int polarity, int shareable)
                        flags = IORESOURCE_IRQ_HIGHEDGE;
        }
-        if (shareable)
+        if (shareable == ACPI_SHARED)
                flags |= IORESOURCE_IRQ_SHAREABLE;
        return flags;
 }
-static void decode_irq_flags(int flag, int *triggering, int *polarity)
+static void decode_irq_flags(struct pnp_dev *dev, int flags, int *triggering,
+                             int *polarity, int *shareable)
 {
-        switch (flag) {
+        switch (flags & (IORESOURCE_IRQ_LOWLEVEL | IORESOURCE_IRQ_HIGHLEVEL |
+                         IORESOURCE_IRQ_LOWEDGE  | IORESOURCE_IRQ_HIGHEDGE)) {
        case IORESOURCE_IRQ_LOWLEVEL:
                *triggering = ACPI_LEVEL_SENSITIVE;
                *polarity = ACPI_ACTIVE_LOW;
@@ -75,7 +77,18 @@ static void decode_irq_flags(int flag, int *triggering, int *polarity)
                *triggering = ACPI_EDGE_SENSITIVE;
                *polarity = ACPI_ACTIVE_HIGH;
                break;
+        default:
+                dev_err(&dev->dev, "can't encode invalid IRQ mode %#x\n",
+                        flags);
+                *triggering = ACPI_EDGE_SENSITIVE;
+                *polarity = ACPI_ACTIVE_HIGH;
+                break;
        }
+        if (flags & IORESOURCE_IRQ_SHAREABLE)
+                *shareable = ACPI_SHARED;
+        else
+                *shareable = ACPI_EXCLUSIVE;
 }
 static void pnpacpi_parse_allocated_irqresource(struct pnp_dev *dev,
@@ -742,6 +755,9 @@ static acpi_status pnpacpi_type_resources(struct acpi_resource *res, void *data)
        if (pnpacpi_supported_resource(res)) {
                (*resource)->type = res->type;
                (*resource)->length = sizeof(struct acpi_resource);
+                if (res->type == ACPI_RESOURCE_TYPE_IRQ)
+                        (*resource)->data.irq.descriptor_length =
+                                        res->data.irq.descriptor_length;
                (*resource)++;
        }
@@ -788,22 +804,21 @@ static void pnpacpi_encode_irq(struct pnp_dev *dev,
                               struct resource *p)
 {
        struct acpi_resource_irq *irq = &resource->data.irq;
-        int triggering, polarity;
+        int triggering, polarity, shareable;
-        decode_irq_flags(p->flags & IORESOURCE_BITS, &triggering, &polarity);
+        decode_irq_flags(dev, p->flags, &triggering, &polarity, &shareable);
        irq->triggering = triggering;
        irq->polarity = polarity;
-        if (triggering == ACPI_EDGE_SENSITIVE)
+        irq->sharable = shareable;
-                irq->sharable = ACPI_EXCLUSIVE;
-        else
-                irq->sharable = ACPI_SHARED;
        irq->interrupt_count = 1;
        irq->interrupts[0] = p->start;
-        dev_dbg(&dev->dev, "  encode irq %d %s %s %s\n", (int) p->start,
+        dev_dbg(&dev->dev, "  encode irq %d %s %s %s (%d-byte descriptor)\n",
+                (int) p->start,
                triggering == ACPI_LEVEL_SENSITIVE ? "level" : "edge",
                polarity == ACPI_ACTIVE_LOW ? "low" : "high",
-                irq->sharable == ACPI_SHARED ? "shared" : "exclusive");
+                irq->sharable == ACPI_SHARED ? "shared" : "exclusive",
+                irq->descriptor_length);
 }
 static void pnpacpi_encode_ext_irq(struct pnp_dev *dev,
@@ -811,16 +826,13 @@ static void pnpacpi_encode_ext_irq(struct pnp_dev *dev,
                                   struct resource *p)
 {
        struct acpi_resource_extended_irq *extended_irq = &resource->data.extended_irq;
-        int triggering, polarity;
+        int triggering, polarity, shareable;
-        decode_irq_flags(p->flags & IORESOURCE_BITS, &triggering, &polarity);
+        decode_irq_flags(dev, p->flags, &triggering, &polarity, &shareable);
        extended_irq->producer_consumer = ACPI_CONSUMER;
        extended_irq->triggering = triggering;
        extended_irq->polarity = polarity;
-        if (triggering == ACPI_EDGE_SENSITIVE)
+        extended_irq->sharable = shareable;
-                extended_irq->sharable = ACPI_EXCLUSIVE;
-        else
-                extended_irq->sharable = ACPI_SHARED;
        extended_irq->interrupt_count = 1;
        extended_irq->interrupts[0] = p->start;
diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
index e2b7de4cb05e..1ff3bb585ab2 100644
--- a/drivers/pnp/quirks.c
+++ b/drivers/pnp/quirks.c
@@ -286,7 +286,7 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)
                                        pci_name(pdev), i,
                                        (unsigned long long) pci_start,
                                        (unsigned long long) pci_end);
-                                res->flags = 0;
+                                res->flags |= IORESOURCE_DISABLED;
                        }
                }
        }
diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c
index 9c2496dbeee4..cf4e07b01d48 100644
--- a/drivers/pnp/system.c
+++ b/drivers/pnp/system.c
@@ -81,7 +81,7 @@ static void reserve_resources_of_dev(struct pnp_dev *dev)
        }
        for (i = 0; (res = pnp_get_resource(dev, IORESOURCE_MEM, i)); i++) {
-                if (res->flags & IORESOURCE_UNSET)
+                if (res->flags & (IORESOURCE_UNSET | IORESOURCE_DISABLED))
                        continue;
                reserve_range(dev, res->start, res->end, 0);
diff --git a/drivers/power/power_supply_sysfs.c b/drivers/power/power_supply_sysfs.c
index c444d6b10c58..49215da5249b 100644
--- a/drivers/power/power_supply_sysfs.c
+++ b/drivers/power/power_supply_sysfs.c
@@ -201,7 +201,7 @@ int power_supply_uevent(struct device *dev, struct kobj_uevent_env *env)
        dev_dbg(dev, "uevent\n");
-        if (!psy) {
+        if (!psy || !psy->dev) {
                dev_dbg(dev, "No power supply yet\n");
                return ret;
        }
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 6cc2c0330230..4949dc4859be 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -256,6 +256,17 @@ config RTC_DRV_S35390A
          This driver can also be built as a module. If so the module
          will be called rtc-s35390a.
+config RTC_DRV_FM3130
+        tristate "Ramtron FM3130"
+        help
+          If you say Y here you will get support for the
+          Ramtron FM3130 RTC chips.
+          Ramtron FM3130 is a chip with two separate devices inside,
+          RTC clock and FRAM. This driver provides only RTC functionality.
+          This driver can also be built as a module. If so the module
+          will be called rtc-fm3130.
 endif # I2C
 comment "SPI RTC drivers"
@@ -534,4 +545,12 @@ config RTC_DRV_RS5C313
        help
          If you say yes here you get support for the Ricoh RS5C313 RTC chips.
+config RTC_DRV_PPC
+       tristate "PowerPC machine dependent RTC support"
+       depends on PPC_MERGE
+       help
+         The PowerPC kernel has machine-specific functions for accessing
+         the RTC. This exposes that functionality through the generic RTC
+         class.
 endif # RTC_CLASS
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 872f1218ff9f..b6e14d51670b 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -31,6 +31,7 @@ obj-$(CONFIG_RTC_DRV_DS1553)	+= rtc-ds1553.o
 obj-$(CONFIG_RTC_DRV_DS1672)    += rtc-ds1672.o
 obj-$(CONFIG_RTC_DRV_DS1742)    += rtc-ds1742.o
 obj-$(CONFIG_RTC_DRV_EP93XX)    += rtc-ep93xx.o
+obj-$(CONFIG_RTC_DRV_FM3130)    += rtc-fm3130.o
 obj-$(CONFIG_RTC_DRV_ISL1208)   += rtc-isl1208.o
 obj-$(CONFIG_RTC_DRV_M41T80)    += rtc-m41t80.o
 obj-$(CONFIG_RTC_DRV_M48T59)    += rtc-m48t59.o
@@ -41,6 +42,7 @@ obj-$(CONFIG_RTC_DRV_OMAP)	+= rtc-omap.o
 obj-$(CONFIG_RTC_DRV_PCF8563)   += rtc-pcf8563.o
 obj-$(CONFIG_RTC_DRV_PCF8583)   += rtc-pcf8583.o
 obj-$(CONFIG_RTC_DRV_PL031)     += rtc-pl031.o
+obj-$(CONFIG_RTC_DRV_PPC)       += rtc-ppc.o
 obj-$(CONFIG_RTC_DRV_R9701)     += rtc-r9701.o
 obj-$(CONFIG_RTC_DRV_RS5C313)   += rtc-rs5c313.o
 obj-$(CONFIG_RTC_DRV_RS5C348)   += rtc-rs5c348.o
diff --git a/drivers/rtc/rtc-at32ap700x.c b/drivers/rtc/rtc-at32ap700x.c
index 42244f14b41c..2ef8cdfda4a7 100644
--- a/drivers/rtc/rtc-at32ap700x.c
+++ b/drivers/rtc/rtc-at32ap700x.c
@@ -94,8 +94,11 @@ static int at32_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
 {
        struct rtc_at32ap700x *rtc = dev_get_drvdata(dev);
+        spin_lock_irq(&rtc->lock);
        rtc_time_to_tm(rtc->alarm_time, &alrm->time);
-        alrm->pending = rtc_readl(rtc, IMR) & RTC_BIT(IMR_TOPI) ? 1 : 0;
+        alrm->enabled = rtc_readl(rtc, IMR) & RTC_BIT(IMR_TOPI) ? 1 : 0;
+        alrm->pending = rtc_readl(rtc, ISR) & RTC_BIT(ISR_TOPI) ? 1 : 0;
+        spin_unlock_irq(&rtc->lock);
        return 0;
 }
@@ -119,7 +122,7 @@ static int at32_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        spin_lock_irq(&rtc->lock);
        rtc->alarm_time = alarm_unix_time;
        rtc_writel(rtc, TOP, rtc->alarm_time);
-        if (alrm->pending)
+        if (alrm->enabled)
                rtc_writel(rtc, CTRL, rtc_readl(rtc, CTRL)
                                | RTC_BIT(CTRL_TOPEN));
        else
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index d060a06ce05b..d7bb9bac71df 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -905,19 +905,7 @@ static struct pnp_driver cmos_pnp_driver = {
        .resume         = cmos_pnp_resume,
 };
-static int __init cmos_init(void)
+#endif  /* CONFIG_PNP */
-{
-        return pnp_register_driver(&cmos_pnp_driver);
-}
-module_init(cmos_init);
-static void __exit cmos_exit(void)
-{
-        pnp_unregister_driver(&cmos_pnp_driver);
-}
-module_exit(cmos_exit);
-#else   /* no PNP */
 /*----------------------------------------------------------------*/
@@ -958,20 +946,33 @@ static struct platform_driver cmos_platform_driver = {
 static int __init cmos_init(void)
 {
+#ifdef  CONFIG_PNP
+        if (pnp_platform_devices)
+                return pnp_register_driver(&cmos_pnp_driver);
+        else
+                return platform_driver_probe(&cmos_platform_driver,
+                        cmos_platform_probe);
+#else
        return platform_driver_probe(&cmos_platform_driver,
                        cmos_platform_probe);
+#endif /* CONFIG_PNP */
 }
 module_init(cmos_init);
 static void __exit cmos_exit(void)
 {
+#ifdef  CONFIG_PNP
+        if (pnp_platform_devices)
+                pnp_unregister_driver(&cmos_pnp_driver);
+        else
+                platform_driver_unregister(&cmos_platform_driver);
+#else
        platform_driver_unregister(&cmos_platform_driver);
+#endif /* CONFIG_PNP */
 }
 module_exit(cmos_exit);
-#endif  /* !PNP */
 MODULE_AUTHOR("David Brownell");
 MODULE_DESCRIPTION("Driver for PC-style 'CMOS' RTCs");
 MODULE_LICENSE("GPL");
diff --git a/drivers/rtc/rtc-ds1374.c b/drivers/rtc/rtc-ds1374.c
index fa2d2f8b3f4d..640acd20fdde 100644
--- a/drivers/rtc/rtc-ds1374.c
+++ b/drivers/rtc/rtc-ds1374.c
@@ -42,7 +42,7 @@
 #define DS1374_REG_TCR          0x09 /* Trickle Charge */
 static const struct i2c_device_id ds1374_id[] = {
-        { "rtc-ds1374", 0 },
+        { "ds1374", 0 },
        { }
 };
 MODULE_DEVICE_TABLE(i2c, ds1374_id);
diff --git a/drivers/rtc/rtc-fm3130.c b/drivers/rtc/rtc-fm3130.c
new file mode 100644
index 000000000000..11644c8fca82
--- /dev/null
+++ b/drivers/rtc/rtc-fm3130.c
@@ -0,0 +1,501 @@
+/*
+ * rtc-fm3130.c - RTC driver for Ramtron FM3130 I2C chip.
+ *
+ *  Copyright (C) 2008 Sergey Lapin
+ *  Based on ds1307 driver by James Chapman and David Brownell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/rtc.h>
+#include <linux/bcd.h>
+#define FM3130_RTC_CONTROL      (0x0)
+#define FM3130_CAL_CONTROL      (0x1)
+#define FM3130_RTC_SECONDS      (0x2)
+#define FM3130_RTC_MINUTES      (0x3)
+#define FM3130_RTC_HOURS        (0x4)
+#define FM3130_RTC_DAY          (0x5)
+#define FM3130_RTC_DATE         (0x6)
+#define FM3130_RTC_MONTHS       (0x7)
+#define FM3130_RTC_YEARS        (0x8)
+#define FM3130_ALARM_SECONDS    (0x9)
+#define FM3130_ALARM_MINUTES    (0xa)
+#define FM3130_ALARM_HOURS      (0xb)
+#define FM3130_ALARM_DATE       (0xc)
+#define FM3130_ALARM_MONTHS     (0xd)
+#define FM3130_ALARM_WP_CONTROL (0xe)
+#define FM3130_CAL_CONTROL_BIT_nOSCEN (1 << 7) /* Osciallator enabled */
+#define FM3130_RTC_CONTROL_BIT_LB (1 << 7) /* Low battery */
+#define FM3130_RTC_CONTROL_BIT_AF (1 << 6) /* Alarm flag */
+#define FM3130_RTC_CONTROL_BIT_CF (1 << 5) /* Century overflow */
+#define FM3130_RTC_CONTROL_BIT_POR (1 << 4) /* Power on reset */
+#define FM3130_RTC_CONTROL_BIT_AEN (1 << 3) /* Alarm enable */
+#define FM3130_RTC_CONTROL_BIT_CAL (1 << 2) /* Calibration mode */
+#define FM3130_RTC_CONTROL_BIT_WRITE (1 << 1) /* W=1 -> write mode W=0 normal */
+#define FM3130_RTC_CONTROL_BIT_READ (1 << 0) /* R=1 -> read mode R=0 normal */
+#define FM3130_CLOCK_REGS 7
+#define FM3130_ALARM_REGS 5
+struct fm3130 {
+        u8                      reg_addr_time;
+        u8                      reg_addr_alarm;
+        u8                      regs[15];
+        struct i2c_msg          msg[4];
+        struct i2c_client       *client;
+        struct rtc_device       *rtc;
+        int                     data_valid;
+        int                     alarm;
+};
+static const struct i2c_device_id fm3130_id[] = {
+        { "fm3130-rtc", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, fm3130_id);
+#define FM3130_MODE_NORMAL              0
+#define FM3130_MODE_WRITE               1
+#define FM3130_MODE_READ                2
+static void fm3130_rtc_mode(struct device *dev, int mode)
+{
+        struct fm3130 *fm3130 = dev_get_drvdata(dev);
+        fm3130->regs[FM3130_RTC_CONTROL] =
+                i2c_smbus_read_byte_data(fm3130->client, FM3130_RTC_CONTROL);
+        switch (mode) {
+        case FM3130_MODE_NORMAL:
+                fm3130->regs[FM3130_RTC_CONTROL] &=
+                        ~(FM3130_RTC_CONTROL_BIT_WRITE |
+                        FM3130_RTC_CONTROL_BIT_READ);
+                break;
+        case FM3130_MODE_WRITE:
+                fm3130->regs[FM3130_RTC_CONTROL] |= FM3130_RTC_CONTROL_BIT_WRITE;
+                break;
+        case FM3130_MODE_READ:
+                fm3130->regs[FM3130_RTC_CONTROL] |= FM3130_RTC_CONTROL_BIT_READ;
+                break;
+        default:
+                dev_dbg(dev, "invalid mode %d\n", mode);
+                break;
+        }
+        /* Checking for alarm */
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_AF) {
+                fm3130->alarm = 1;
+                fm3130->regs[FM3130_RTC_CONTROL] &= ~FM3130_RTC_CONTROL_BIT_AF;
+        }
+        i2c_smbus_write_byte_data(fm3130->client,
+                 FM3130_RTC_CONTROL, fm3130->regs[FM3130_RTC_CONTROL]);
+}
+static int fm3130_get_time(struct device *dev, struct rtc_time *t)
+{
+        struct fm3130 *fm3130 = dev_get_drvdata(dev);
+        int             tmp;
+        if (!fm3130->data_valid) {
+                /* We have invalid data in RTC, probably due
+                to battery faults or other problems. Return EIO
+                for now, it will allow us to set data later insted
+                of error during probing which disables device */
+                return -EIO;
+        }
+        fm3130_rtc_mode(dev, FM3130_MODE_READ);
+        /* read the RTC date and time registers all at once */
+        tmp = i2c_transfer(to_i2c_adapter(fm3130->client->dev.parent),
+                        fm3130->msg, 2);
+        if (tmp != 2) {
+                dev_err(dev, "%s error %d\n", "read", tmp);
+                return -EIO;
+        }
+        fm3130_rtc_mode(dev, FM3130_MODE_NORMAL);
+        dev_dbg(dev, "%s: %02x %02x %02x %02x %02x %02x %02x %02x"
+                        "%02x %02x %02x %02x %02x %02x %02x\n",
+                        "read",
+                        fm3130->regs[0], fm3130->regs[1],
+                        fm3130->regs[2], fm3130->regs[3],
+                        fm3130->regs[4], fm3130->regs[5],
+                        fm3130->regs[6], fm3130->regs[7],
+                        fm3130->regs[8], fm3130->regs[9],
+                        fm3130->regs[0xa], fm3130->regs[0xb],
+                        fm3130->regs[0xc], fm3130->regs[0xd],
+                        fm3130->regs[0xe]);
+        t->tm_sec = BCD2BIN(fm3130->regs[FM3130_RTC_SECONDS] & 0x7f);
+        t->tm_min = BCD2BIN(fm3130->regs[FM3130_RTC_MINUTES] & 0x7f);
+        tmp = fm3130->regs[FM3130_RTC_HOURS] & 0x3f;
+        t->tm_hour = BCD2BIN(tmp);
+        t->tm_wday = BCD2BIN(fm3130->regs[FM3130_RTC_DAY] & 0x07) - 1;
+        t->tm_mday = BCD2BIN(fm3130->regs[FM3130_RTC_DATE] & 0x3f);
+        tmp = fm3130->regs[FM3130_RTC_MONTHS] & 0x1f;
+        t->tm_mon = BCD2BIN(tmp) - 1;
+        /* assume 20YY not 19YY, and ignore CF bit */
+        t->tm_year = BCD2BIN(fm3130->regs[FM3130_RTC_YEARS]) + 100;
+        dev_dbg(dev, "%s secs=%d, mins=%d, "
+                "hours=%d, mday=%d, mon=%d, year=%d, wday=%d\n",
+                "read", t->tm_sec, t->tm_min,
+                t->tm_hour, t->tm_mday,
+                t->tm_mon, t->tm_year, t->tm_wday);
+        /* initial clock setting can be undefined */
+        return rtc_valid_tm(t);
+}
+static int fm3130_set_time(struct device *dev, struct rtc_time *t)
+{
+        struct fm3130 *fm3130 = dev_get_drvdata(dev);
+        int             tmp, i;
+        u8              *buf = fm3130->regs;
+        dev_dbg(dev, "%s secs=%d, mins=%d, "
+                "hours=%d, mday=%d, mon=%d, year=%d, wday=%d\n",
+                "write", t->tm_sec, t->tm_min,
+                t->tm_hour, t->tm_mday,
+                t->tm_mon, t->tm_year, t->tm_wday);
+        /* first register addr */
+        buf[FM3130_RTC_SECONDS] = BIN2BCD(t->tm_sec);
+        buf[FM3130_RTC_MINUTES] = BIN2BCD(t->tm_min);
+        buf[FM3130_RTC_HOURS] = BIN2BCD(t->tm_hour);
+        buf[FM3130_RTC_DAY] = BIN2BCD(t->tm_wday + 1);
+        buf[FM3130_RTC_DATE] = BIN2BCD(t->tm_mday);
+        buf[FM3130_RTC_MONTHS] = BIN2BCD(t->tm_mon + 1);
+        /* assume 20YY not 19YY */
+        tmp = t->tm_year - 100;
+        buf[FM3130_RTC_YEARS] = BIN2BCD(tmp);
+        dev_dbg(dev, "%s: %02x %02x %02x %02x %02x %02x %02x"
+                "%02x %02x %02x %02x %02x %02x %02x %02x\n",
+                "write", buf[0], buf[1], buf[2], buf[3],
+                buf[4], buf[5], buf[6], buf[7],
+                buf[8], buf[9], buf[0xa], buf[0xb],
+                buf[0xc], buf[0xd], buf[0xe]);
+        fm3130_rtc_mode(dev, FM3130_MODE_WRITE);
+        /* Writing time registers, we don't support multibyte transfers */
+        for (i = 0; i < FM3130_CLOCK_REGS; i++) {
+                i2c_smbus_write_byte_data(fm3130->client,
+                                        FM3130_RTC_SECONDS + i,
+                                        fm3130->regs[FM3130_RTC_SECONDS + i]);
+        }
+        fm3130_rtc_mode(dev, FM3130_MODE_NORMAL);
+        /* We assume here that data are valid once written */
+        if (!fm3130->data_valid)
+                fm3130->data_valid = 1;
+        return 0;
+}
+static int fm3130_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+{
+        struct fm3130 *fm3130 = dev_get_drvdata(dev);
+        int tmp;
+        struct rtc_time *tm = &alrm->time;
+        /* read the RTC alarm registers all at once */
+        tmp = i2c_transfer(to_i2c_adapter(fm3130->client->dev.parent),
+                        &fm3130->msg[2], 2);
+        if (tmp != 2) {
+                dev_err(dev, "%s error %d\n", "read", tmp);
+                return -EIO;
+        }
+        dev_dbg(dev, "alarm read %02x %02x %02x %02x %02x\n",
+                        fm3130->regs[FM3130_ALARM_SECONDS],
+                        fm3130->regs[FM3130_ALARM_MINUTES],
+                        fm3130->regs[FM3130_ALARM_HOURS],
+                        fm3130->regs[FM3130_ALARM_DATE],
+                        fm3130->regs[FM3130_ALARM_MONTHS]);
+        tm->tm_sec      = BCD2BIN(fm3130->regs[FM3130_ALARM_SECONDS] & 0x7F);
+        tm->tm_min      = BCD2BIN(fm3130->regs[FM3130_ALARM_MINUTES] & 0x7F);
+        tm->tm_hour     = BCD2BIN(fm3130->regs[FM3130_ALARM_HOURS] & 0x3F);
+        tm->tm_mday     = BCD2BIN(fm3130->regs[FM3130_ALARM_DATE] & 0x3F);
+        tm->tm_mon      = BCD2BIN(fm3130->regs[FM3130_ALARM_MONTHS] & 0x1F);
+        if (tm->tm_mon > 0)
+                tm->tm_mon -= 1; /* RTC is 1-12, tm_mon is 0-11 */
+        dev_dbg(dev, "%s secs=%d, mins=%d, "
+                "hours=%d, mday=%d, mon=%d, year=%d, wday=%d\n",
+                "read alarm", tm->tm_sec, tm->tm_min,
+                tm->tm_hour, tm->tm_mday,
+                tm->tm_mon, tm->tm_year, tm->tm_wday);
+        return 0;
+}
+static int fm3130_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+{
+        struct fm3130 *fm3130 = dev_get_drvdata(dev);
+        struct rtc_time *tm = &alrm->time;
+        int i;
+        dev_dbg(dev, "%s secs=%d, mins=%d, "
+                "hours=%d, mday=%d, mon=%d, year=%d, wday=%d\n",
+                "write alarm", tm->tm_sec, tm->tm_min,
+                tm->tm_hour, tm->tm_mday,
+                tm->tm_mon, tm->tm_year, tm->tm_wday);
+        if (tm->tm_sec != -1)
+                fm3130->regs[FM3130_ALARM_SECONDS] =
+                        BIN2BCD(tm->tm_sec) | 0x80;
+        if (tm->tm_min != -1)
+                fm3130->regs[FM3130_ALARM_MINUTES] =
+                        BIN2BCD(tm->tm_min) | 0x80;
+        if (tm->tm_hour != -1)
+                fm3130->regs[FM3130_ALARM_HOURS] =
+                        BIN2BCD(tm->tm_hour) | 0x80;
+        if (tm->tm_mday != -1)
+                fm3130->regs[FM3130_ALARM_DATE] =
+                        BIN2BCD(tm->tm_mday) | 0x80;
+        if (tm->tm_mon != -1)
+                fm3130->regs[FM3130_ALARM_MONTHS] =
+                        BIN2BCD(tm->tm_mon + 1) | 0x80;
+        dev_dbg(dev, "alarm write %02x %02x %02x %02x %02x\n",
+                        fm3130->regs[FM3130_ALARM_SECONDS],
+                        fm3130->regs[FM3130_ALARM_MINUTES],
+                        fm3130->regs[FM3130_ALARM_HOURS],
+                        fm3130->regs[FM3130_ALARM_DATE],
+                        fm3130->regs[FM3130_ALARM_MONTHS]);
+        /* Writing time registers, we don't support multibyte transfers */
+        for (i = 0; i < FM3130_ALARM_REGS; i++) {
+                i2c_smbus_write_byte_data(fm3130->client,
+                                        FM3130_ALARM_SECONDS + i,
+                                        fm3130->regs[FM3130_ALARM_SECONDS + i]);
+        }
+        fm3130->regs[FM3130_RTC_CONTROL] =
+                i2c_smbus_read_byte_data(fm3130->client, FM3130_RTC_CONTROL);
+        /* Checking for alarm */
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_AF) {
+                fm3130->alarm = 1;
+                fm3130->regs[FM3130_RTC_CONTROL] &= ~FM3130_RTC_CONTROL_BIT_AF;
+        }
+        if (alrm->enabled) {
+                i2c_smbus_write_byte_data(fm3130->client, FM3130_RTC_CONTROL,
+                        (fm3130->regs[FM3130_RTC_CONTROL] &
+                                ~(FM3130_RTC_CONTROL_BIT_CAL)) |
+                                        FM3130_RTC_CONTROL_BIT_AEN);
+        } else {
+                i2c_smbus_write_byte_data(fm3130->client, FM3130_RTC_CONTROL,
+                        fm3130->regs[FM3130_RTC_CONTROL] &
+                                ~(FM3130_RTC_CONTROL_BIT_AEN));
+        }
+        return 0;
+}
+static const struct rtc_class_ops fm3130_rtc_ops = {
+        .read_time      = fm3130_get_time,
+        .set_time       = fm3130_set_time,
+        .read_alarm     = fm3130_read_alarm,
+        .set_alarm      = fm3130_set_alarm,
+};
+static struct i2c_driver fm3130_driver;
+static int __devinit fm3130_probe(struct i2c_client *client,
+                                  const struct i2c_device_id *id)
+{
+        struct fm3130           *fm3130;
+        int                     err = -ENODEV;
+        int                     tmp;
+        struct i2c_adapter      *adapter = to_i2c_adapter(client->dev.parent);
+        if (!i2c_check_functionality(adapter,
+                        I2C_FUNC_I2C | I2C_FUNC_SMBUS_WRITE_BYTE_DATA))
+                return -EIO;
+        fm3130 = kzalloc(sizeof(struct fm3130), GFP_KERNEL);
+        if (!fm3130)
+                return -ENOMEM;
+        fm3130->client = client;
+        i2c_set_clientdata(client, fm3130);
+        fm3130->reg_addr_time = FM3130_RTC_SECONDS;
+        fm3130->reg_addr_alarm = FM3130_ALARM_SECONDS;
+        /* Messages to read time */
+        fm3130->msg[0].addr = client->addr;
+        fm3130->msg[0].flags = 0;
+        fm3130->msg[0].len = 1;
+        fm3130->msg[0].buf = &fm3130->reg_addr_time;
+        fm3130->msg[1].addr = client->addr;
+        fm3130->msg[1].flags = I2C_M_RD;
+        fm3130->msg[1].len = FM3130_CLOCK_REGS;
+        fm3130->msg[1].buf = &fm3130->regs[FM3130_RTC_SECONDS];
+        /* Messages to read alarm */
+        fm3130->msg[2].addr = client->addr;
+        fm3130->msg[2].flags = 0;
+        fm3130->msg[2].len = 1;
+        fm3130->msg[2].buf = &fm3130->reg_addr_alarm;
+        fm3130->msg[3].addr = client->addr;
+        fm3130->msg[3].flags = I2C_M_RD;
+        fm3130->msg[3].len = FM3130_ALARM_REGS;
+        fm3130->msg[3].buf = &fm3130->regs[FM3130_ALARM_SECONDS];
+        fm3130->data_valid = 0;
+        tmp = i2c_transfer(adapter, fm3130->msg, 4);
+        if (tmp != 4) {
+                pr_debug("read error %d\n", tmp);
+                err = -EIO;
+                goto exit_free;
+        }
+        fm3130->regs[FM3130_RTC_CONTROL] =
+                i2c_smbus_read_byte_data(client, FM3130_RTC_CONTROL);
+        fm3130->regs[FM3130_CAL_CONTROL] =
+                i2c_smbus_read_byte_data(client, FM3130_CAL_CONTROL);
+        /* Checking for alarm */
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_AF) {
+                fm3130->alarm = 1;
+                fm3130->regs[FM3130_RTC_CONTROL] &= ~FM3130_RTC_CONTROL_BIT_AF;
+        }
+        /* Disabling calibration mode */
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_CAL)
+                i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
+                        fm3130->regs[FM3130_RTC_CONTROL] &
+                                ~(FM3130_RTC_CONTROL_BIT_CAL));
+                dev_warn(&client->dev, "Disabling calibration mode!\n");
+        /* Disabling read and write modes */
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_WRITE ||
+            fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_READ)
+                i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
+                        fm3130->regs[FM3130_RTC_CONTROL] &
+                                ~(FM3130_RTC_CONTROL_BIT_READ |
+                                        FM3130_RTC_CONTROL_BIT_WRITE));
+                dev_warn(&client->dev, "Disabling READ or WRITE mode!\n");
+        /* oscillator off?  turn it on, so clock can tick. */
+        if (fm3130->regs[FM3130_CAL_CONTROL] & FM3130_CAL_CONTROL_BIT_nOSCEN)
+                i2c_smbus_write_byte_data(client, FM3130_CAL_CONTROL,
+                        fm3130->regs[FM3130_CAL_CONTROL] &
+                                ~(FM3130_CAL_CONTROL_BIT_nOSCEN));
+        /* oscillator fault?  clear flag, and warn */
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_LB)
+                dev_warn(&client->dev, "Low battery!\n");
+        /* oscillator fault?  clear flag, and warn */
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_POR) {
+                i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
+                        fm3130->regs[FM3130_RTC_CONTROL] &
+                                ~FM3130_RTC_CONTROL_BIT_POR);
+                dev_warn(&client->dev, "SET TIME!\n");
+        }
+        /* ACS is controlled by alarm */
+        i2c_smbus_write_byte_data(client, FM3130_ALARM_WP_CONTROL, 0x80);
+        /* TODO */
+        /* TODO need to sanity check alarm */
+        tmp = fm3130->regs[FM3130_RTC_SECONDS];
+        tmp = BCD2BIN(tmp & 0x7f);
+        if (tmp > 60)
+                goto exit_bad;
+        tmp = BCD2BIN(fm3130->regs[FM3130_RTC_MINUTES] & 0x7f);
+        if (tmp > 60)
+                goto exit_bad;
+        tmp = BCD2BIN(fm3130->regs[FM3130_RTC_DATE] & 0x3f);
+        if (tmp == 0 || tmp > 31)
+                goto exit_bad;
+        tmp = BCD2BIN(fm3130->regs[FM3130_RTC_MONTHS] & 0x1f);
+        if (tmp == 0 || tmp > 12)
+                goto exit_bad;
+        tmp = fm3130->regs[FM3130_RTC_HOURS];
+        fm3130->data_valid = 1;
+exit_bad:
+        if (!fm3130->data_valid)
+                dev_dbg(&client->dev,
+                                "%s: %02x %02x %02x %02x %02x %02x %02x %02x"
+                                "%02x %02x %02x %02x %02x %02x %02x\n",
+                        "bogus registers",
+                        fm3130->regs[0], fm3130->regs[1],
+                        fm3130->regs[2], fm3130->regs[3],
+                        fm3130->regs[4], fm3130->regs[5],
+                        fm3130->regs[6], fm3130->regs[7],
+                        fm3130->regs[8], fm3130->regs[9],
+                        fm3130->regs[0xa], fm3130->regs[0xb],
+                        fm3130->regs[0xc], fm3130->regs[0xd],
+                        fm3130->regs[0xe]);
+        /* We won't bail out here because we just got invalid data.
+           Time setting from u-boot doesn't work anyway */
+        fm3130->rtc = rtc_device_register(client->name, &client->dev,
+                                &fm3130_rtc_ops, THIS_MODULE);
+        if (IS_ERR(fm3130->rtc)) {
+                err = PTR_ERR(fm3130->rtc);
+                dev_err(&client->dev,
+                        "unable to register the class device\n");
+                goto exit_free;
+        }
+        return 0;
+exit_free:
+        kfree(fm3130);
+        return err;
+}
+static int __devexit fm3130_remove(struct i2c_client *client)
+{
+        struct fm3130 *fm3130 = i2c_get_clientdata(client);
+        rtc_device_unregister(fm3130->rtc);
+        kfree(fm3130);
+        return 0;
+}
+static struct i2c_driver fm3130_driver = {
+        .driver = {
+                .name   = "rtc-fm3130",
+                .owner  = THIS_MODULE,
+        },
+        .probe          = fm3130_probe,
+        .remove         = __devexit_p(fm3130_remove),
+        .id_table       = fm3130_id,
+};
+static int __init fm3130_init(void)
+{
+        return i2c_add_driver(&fm3130_driver);
+}
+module_init(fm3130_init);
+static void __exit fm3130_exit(void)
+{
+        i2c_del_driver(&fm3130_driver);
+}
+module_exit(fm3130_exit);
+MODULE_DESCRIPTION("RTC driver for FM3130");
+MODULE_AUTHOR("Sergey Lapin <slapin@ossfans.org>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/rtc/rtc-ppc.c b/drivers/rtc/rtc-ppc.c
new file mode 100644
index 000000000000..c8e97e25ef7e
--- /dev/null
+++ b/drivers/rtc/rtc-ppc.c
@@ -0,0 +1,69 @@
+/*
+ * RTC driver for ppc_md RTC functions
+ *
+ * © 2007 Red Hat, Inc.
+ *
+ * Author: David Woodhouse <dwmw2@infradead.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/rtc.h>
+#include <linux/platform_device.h>
+#include <asm/machdep.h>
+static int ppc_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+        ppc_md.get_rtc_time(tm);
+        return 0;
+}
+static int ppc_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+        return ppc_md.set_rtc_time(tm);
+}
+static const struct rtc_class_ops ppc_rtc_ops = {
+        .set_time = ppc_rtc_set_time,
+        .read_time = ppc_rtc_read_time,
+};
+static struct rtc_device *rtc;
+static struct platform_device *ppc_rtc_pdev;
+static int __init ppc_rtc_init(void)
+{
+        if (!ppc_md.get_rtc_time || !ppc_md.set_rtc_time)
+                return -ENODEV;
+        ppc_rtc_pdev = platform_device_register_simple("ppc-rtc", 0, NULL, 0);
+        if (IS_ERR(ppc_rtc_pdev))
+                return PTR_ERR(ppc_rtc_pdev);
+        rtc = rtc_device_register("ppc_md", &ppc_rtc_pdev->dev,
+                                  &ppc_rtc_ops, THIS_MODULE);
+        if (IS_ERR(rtc)) {
+                platform_device_unregister(ppc_rtc_pdev);
+                return PTR_ERR(rtc);
+        }
+        return 0;
+}
+static void __exit ppc_rtc_exit(void)
+{
+        rtc_device_unregister(rtc);
+        platform_device_unregister(ppc_rtc_pdev);
+}
+module_init(ppc_rtc_init);
+module_exit(ppc_rtc_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org>");
+MODULE_DESCRIPTION("Generic RTC class driver for PowerPC");
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 8ba3f135da22..1a4025683362 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -63,6 +63,7 @@ static void dasd_return_cqr_cb(struct dasd_ccw_req *, void *);
 */
 static wait_queue_head_t dasd_init_waitq;
 static wait_queue_head_t dasd_flush_wq;
+static wait_queue_head_t generic_waitq;
 /*
 * Allocate memory for a new device structure.
@@ -1151,11 +1152,15 @@ static void __dasd_device_process_final_queue(struct dasd_device *device,
        struct list_head *l, *n;
        struct dasd_ccw_req *cqr;
        struct dasd_block *block;
+        void (*callback)(struct dasd_ccw_req *, void *data);
+        void *callback_data;
        list_for_each_safe(l, n, final_queue) {
                cqr = list_entry(l, struct dasd_ccw_req, devlist);
                list_del_init(&cqr->devlist);
                block = cqr->block;
+                callback = cqr->callback;
+                callback_data = cqr->callback_data;
                if (block)
                        spin_lock_bh(&block->queue_lock);
                switch (cqr->status) {
@@ -1176,7 +1181,7 @@ static void __dasd_device_process_final_queue(struct dasd_device *device,
                        BUG();
                }
                if (cqr->callback != NULL)
-                        (cqr->callback)(cqr, cqr->callback_data);
+                        (callback)(cqr, callback_data);
                if (block)
                        spin_unlock_bh(&block->queue_lock);
        }
@@ -1406,17 +1411,15 @@ static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
 */
 int dasd_sleep_on(struct dasd_ccw_req *cqr)
 {
-        wait_queue_head_t wait_q;
        struct dasd_device *device;
        int rc;
        device = cqr->startdev;
-        init_waitqueue_head (&wait_q);
        cqr->callback = dasd_wakeup_cb;
-        cqr->callback_data = (void *) &wait_q;
+        cqr->callback_data = (void *) &generic_waitq;
        dasd_add_request_tail(cqr);
-        wait_event(wait_q, _wait_for_wakeup(cqr));
+        wait_event(generic_waitq, _wait_for_wakeup(cqr));
        /* Request status is either done or failed. */
        rc = (cqr->status == DASD_CQR_DONE) ? 0 : -EIO;
@@ -1429,20 +1432,18 @@ int dasd_sleep_on(struct dasd_ccw_req *cqr)
 */
 int dasd_sleep_on_interruptible(struct dasd_ccw_req *cqr)
 {
-        wait_queue_head_t wait_q;
        struct dasd_device *device;
        int rc;
        device = cqr->startdev;
-        init_waitqueue_head (&wait_q);
        cqr->callback = dasd_wakeup_cb;
-        cqr->callback_data = (void *) &wait_q;
+        cqr->callback_data = (void *) &generic_waitq;
        dasd_add_request_tail(cqr);
-        rc = wait_event_interruptible(wait_q, _wait_for_wakeup(cqr));
+        rc = wait_event_interruptible(generic_waitq, _wait_for_wakeup(cqr));
        if (rc == -ERESTARTSYS) {
                dasd_cancel_req(cqr);
                /* wait (non-interruptible) for final status */
-                wait_event(wait_q, _wait_for_wakeup(cqr));
+                wait_event(generic_waitq, _wait_for_wakeup(cqr));
        }
        rc = (cqr->status == DASD_CQR_DONE) ? 0 : -EIO;
        return rc;
@@ -1466,7 +1467,6 @@ static inline int _dasd_term_running_cqr(struct dasd_device *device)
 int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
 {
-        wait_queue_head_t wait_q;
        struct dasd_device *device;
        int rc;
@@ -1478,9 +1478,8 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
                return rc;
        }
-        init_waitqueue_head (&wait_q);
        cqr->callback = dasd_wakeup_cb;
-        cqr->callback_data = (void *) &wait_q;
+        cqr->callback_data = (void *) &generic_waitq;
        cqr->status = DASD_CQR_QUEUED;
        list_add(&cqr->devlist, &device->ccw_queue);
@@ -1489,7 +1488,7 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
        spin_unlock_irq(get_ccwdev_lock(device->cdev));
-        wait_event(wait_q, _wait_for_wakeup(cqr));
+        wait_event(generic_waitq, _wait_for_wakeup(cqr));
        /* Request status is either done or failed. */
        rc = (cqr->status == DASD_CQR_DONE) ? 0 : -EIO;
@@ -2430,6 +2429,7 @@ static int __init dasd_init(void)
        init_waitqueue_head(&dasd_init_waitq);
        init_waitqueue_head(&dasd_flush_wq);
+        init_waitqueue_head(&generic_waitq);
        /* register 'common' DASD debug area, used for all DBF_XXX calls */
        dasd_debug_area = debug_register("dasd", 1, 1, 8 * sizeof(long));
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index 0d98f1ff2edd..848ef7e8523f 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -549,7 +549,6 @@ raw3270_start_init(struct raw3270 *rp, struct raw3270_view *view,
                   struct raw3270_request *rq)
 {
        unsigned long flags;
-        wait_queue_head_t wq;
        int rc;
 #ifdef CONFIG_TN3270_CONSOLE
@@ -566,20 +565,20 @@ raw3270_start_init(struct raw3270 *rp, struct raw3270_view *view,
                return rq->rc;
        }
 #endif
-        init_waitqueue_head(&wq);
        rq->callback = raw3270_wake_init;
-        rq->callback_data = &wq;
+        rq->callback_data = &raw3270_wait_queue;
        spin_lock_irqsave(get_ccwdev_lock(view->dev->cdev), flags);
        rc = __raw3270_start(rp, view, rq);
        spin_unlock_irqrestore(get_ccwdev_lock(view->dev->cdev), flags);
        if (rc)
                return rc;
        /* Now wait for the completion. */
-        rc = wait_event_interruptible(wq, raw3270_request_final(rq));
+        rc = wait_event_interruptible(raw3270_wait_queue,
+                                      raw3270_request_final(rq));
        if (rc == -ERESTARTSYS) {       /* Interrupted by a signal. */
                raw3270_halt_io(view->dev, rq);
                /* No wait for the halt to complete. */
-                wait_event(wq, raw3270_request_final(rq));
+                wait_event(raw3270_wait_queue, raw3270_request_final(rq));
                return -ERESTARTSYS;
        }
        return rq->rc;
diff --git a/drivers/s390/char/sclp_config.c b/drivers/s390/char/sclp_config.c
index 9e784d5f7f57..ad05a87bc480 100644
--- a/drivers/s390/char/sclp_config.c
+++ b/drivers/s390/char/sclp_config.c
@@ -40,7 +40,7 @@ static void sclp_cpu_capability_notify(struct work_struct *work)
        put_online_cpus();
 }
-static void sclp_cpu_change_notify(struct work_struct *work)
+static void __ref sclp_cpu_change_notify(struct work_struct *work)
 {
        smp_rescan_cpus();
 }
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index 35707c04e613..3e577f655b18 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -71,9 +71,6 @@ static struct list_head sclp_vt220_outqueue;
 /* Number of requests in outqueue */
 static int sclp_vt220_outqueue_count;
-/* Wait queue used to delay write requests while we've run out of buffers */
-static wait_queue_head_t sclp_vt220_waitq;
 /* Timer used for delaying write requests to merge subsequent messages into
 * a single buffer */
 static struct timer_list sclp_vt220_timer;
@@ -133,7 +130,6 @@ sclp_vt220_process_queue(struct sclp_vt220_request *request)
        } while (request && __sclp_vt220_emit(request));
        if (request == NULL && sclp_vt220_flush_later)
                sclp_vt220_emit_current();
-        wake_up(&sclp_vt220_waitq);
        /* Check if the tty needs a wake up call */
        if (sclp_vt220_tty != NULL) {
                tty_wakeup(sclp_vt220_tty);
@@ -383,7 +379,7 @@ sclp_vt220_timeout(unsigned long data)
 */
 static int
 __sclp_vt220_write(const unsigned char *buf, int count, int do_schedule,
-                   int convertlf, int may_schedule)
+                   int convertlf, int may_fail)
 {
        unsigned long flags;
        void *page;
@@ -395,15 +391,14 @@ __sclp_vt220_write(const unsigned char *buf, int count, int do_schedule,
        overall_written = 0;
        spin_lock_irqsave(&sclp_vt220_lock, flags);
        do {
-                /* Create a sclp output buffer if none exists yet */
+                /* Create an sclp output buffer if none exists yet */
                if (sclp_vt220_current_request == NULL) {
                        while (list_empty(&sclp_vt220_empty)) {
                                spin_unlock_irqrestore(&sclp_vt220_lock, flags);
-                                if (in_interrupt() || !may_schedule)
+                                if (may_fail)
-                                        sclp_sync_wait();
+                                        goto out;
                                else
-                                        wait_event(sclp_vt220_waitq,
+                                        sclp_sync_wait();
-                                                !list_empty(&sclp_vt220_empty));
                                spin_lock_irqsave(&sclp_vt220_lock, flags);
                        }
                        page = (void *) sclp_vt220_empty.next;
@@ -437,6 +432,7 @@ __sclp_vt220_write(const unsigned char *buf, int count, int do_schedule,
                add_timer(&sclp_vt220_timer);
        }
        spin_unlock_irqrestore(&sclp_vt220_lock, flags);
+out:
        return overall_written;
 }
@@ -520,19 +516,11 @@ sclp_vt220_close(struct tty_struct *tty, struct file *filp)
 * character to the tty device.  If the kernel uses this routine,
 * it must call the flush_chars() routine (if defined) when it is
 * done stuffing characters into the driver.
- *
- * NOTE: include/linux/tty_driver.h specifies that a character should be
- * ignored if there is no room in the queue. This driver implements a different
- * semantic in that it will block when there is no more room left.
- *
- * FIXME: putchar can currently be called from BH and other non blocking
- * handlers so  this semantic isn't a good idea.
 */
 static int
 sclp_vt220_put_char(struct tty_struct *tty, unsigned char ch)
 {
-        __sclp_vt220_write(&ch, 1, 0, 0, 1);
+        return __sclp_vt220_write(&ch, 1, 0, 0, 1);
-        return 1;
 }
 /*
@@ -653,7 +641,6 @@ static int __init __sclp_vt220_init(void)
        spin_lock_init(&sclp_vt220_lock);
        INIT_LIST_HEAD(&sclp_vt220_empty);
        INIT_LIST_HEAD(&sclp_vt220_outqueue);
-        init_waitqueue_head(&sclp_vt220_waitq);
        init_timer(&sclp_vt220_timer);
        sclp_vt220_current_request = NULL;
        sclp_vt220_buffered_chars = 0;
@@ -786,6 +773,7 @@ sclp_vt220_con_init(void)
 {
        int rc;
+        INIT_LIST_HEAD(&sclp_vt220_register.list);
        if (!CONSOLE_IS_SCLP)
                return 0;
        rc = __sclp_vt220_init();
diff --git a/drivers/s390/char/tape.h b/drivers/s390/char/tape.h
index dddf8d62c153..d0d565a05dfe 100644
--- a/drivers/s390/char/tape.h
+++ b/drivers/s390/char/tape.h
@@ -231,6 +231,9 @@ struct tape_device {
        /* Request queue. */
        struct list_head                req_queue;
+        /* Request wait queue. */
+        wait_queue_head_t               wait_queue;
        /* Each tape device has (currently) two minor numbers. */
        int                             first_minor;
diff --git a/drivers/s390/char/tape_3590.c b/drivers/s390/char/tape_3590.c
index 8246ef3ab095..42ce7915fc5d 100644
--- a/drivers/s390/char/tape_3590.c
+++ b/drivers/s390/char/tape_3590.c
@@ -1598,7 +1598,7 @@ tape_3590_setup_device(struct tape_device *device)
        rc = tape_3590_read_dev_chars(device, rdc_data);
        if (rc) {
                DBF_LH(3, "Read device characteristics failed!\n");
-                goto fail_kmalloc;
+                goto fail_rdc_data;
        }
        rc = tape_std_assign(device);
        if (rc)
diff --git a/drivers/s390/char/tape_block.c b/drivers/s390/char/tape_block.c
index ddc4a114e7f4..95da72bc17e8 100644
--- a/drivers/s390/char/tape_block.c
+++ b/drivers/s390/char/tape_block.c
@@ -179,11 +179,11 @@ tapeblock_requeue(struct work_struct *work) {
                        tapeblock_end_request(req, -EIO);
                        continue;
                }
+                blkdev_dequeue_request(req);
+                nr_queued++;
                spin_unlock_irq(&device->blk_data.request_queue_lock);
                rc = tapeblock_start_request(device, req);
                spin_lock_irq(&device->blk_data.request_queue_lock);
-                blkdev_dequeue_request(req);
-                nr_queued++;
        }
        spin_unlock_irq(&device->blk_data.request_queue_lock);
        atomic_set(&device->blk_data.requeue_scheduled, 0);
diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index 76e44eb7c47f..c20e3c548343 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -449,6 +449,7 @@ tape_alloc_device(void)
        INIT_LIST_HEAD(&device->req_queue);
        INIT_LIST_HEAD(&device->node);
        init_waitqueue_head(&device->state_change_wq);
+        init_waitqueue_head(&device->wait_queue);
        device->tape_state = TS_INIT;
        device->medium_state = MS_UNKNOWN;
        *device->modeset_byte = 0;
@@ -954,21 +955,19 @@ __tape_wake_up(struct tape_request *request, void *data)
 int
 tape_do_io(struct tape_device *device, struct tape_request *request)
 {
-        wait_queue_head_t wq;
        int rc;
-        init_waitqueue_head(&wq);
        spin_lock_irq(get_ccwdev_lock(device->cdev));
        /* Setup callback */
        request->callback = __tape_wake_up;
-        request->callback_data = &wq;
+        request->callback_data = &device->wait_queue;
        /* Add request to request queue and try to start it. */
        rc = __tape_start_request(device, request);
        spin_unlock_irq(get_ccwdev_lock(device->cdev));
        if (rc)
                return rc;
        /* Request added to the queue. Wait for its completion. */
-        wait_event(wq, (request->callback == NULL));
+        wait_event(device->wait_queue, (request->callback == NULL));
        /* Get rc from request */
        return request->rc;
 }
@@ -989,20 +988,19 @@ int
 tape_do_io_interruptible(struct tape_device *device,
                         struct tape_request *request)
 {
-        wait_queue_head_t wq;
        int rc;
-        init_waitqueue_head(&wq);
        spin_lock_irq(get_ccwdev_lock(device->cdev));
        /* Setup callback */
        request->callback = __tape_wake_up_interruptible;
-        request->callback_data = &wq;
+        request->callback_data = &device->wait_queue;
        rc = __tape_start_request(device, request);
        spin_unlock_irq(get_ccwdev_lock(device->cdev));
        if (rc)
                return rc;
        /* Request added to the queue. Wait for its completion. */
-        rc = wait_event_interruptible(wq, (request->callback == NULL));
+        rc = wait_event_interruptible(device->wait_queue,
+                                      (request->callback == NULL));
        if (rc != -ERESTARTSYS)
                /* Request finished normally. */
                return request->rc;
@@ -1015,7 +1013,7 @@ tape_do_io_interruptible(struct tape_device *device,
                /* Wait for the interrupt that acknowledges the halt. */
                do {
                        rc = wait_event_interruptible(
-                                wq,
+                                device->wait_queue,
                                (request->callback == NULL)
                        );
                } while (rc == -ERESTARTSYS);
diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
index a4a5f2efea48..0bfcbbe375c4 100644
--- a/drivers/s390/cio/blacklist.c
+++ b/drivers/s390/cio/blacklist.c
@@ -97,8 +97,8 @@ static int pure_hex(char **cp, unsigned int *val, int min_digit,
        return 0;
 }
-static int parse_busid(char *str, int *cssid, int *ssid, int *devno,
+static int parse_busid(char *str, unsigned int *cssid, unsigned int *ssid,
-                       int msgtrigger)
+                       unsigned int *devno, int msgtrigger)
 {
        char *str_work;
        int val, rc, ret;
@@ -148,7 +148,7 @@ out:
 static int blacklist_parse_parameters(char *str, range_action action,
                                      int msgtrigger)
 {
-        int from_cssid, to_cssid, from_ssid, to_ssid, from, to;
+        unsigned int from_cssid, to_cssid, from_ssid, to_ssid, from, to;
        int rc, totalrc;
        char *parm;
        range_action ra;
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 82c6a2d45128..b32d7eb3d81a 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -576,12 +576,14 @@ cio_validate_subchannel (struct subchannel *sch, struct subchannel_id schid)
                err = -ENODEV;
                goto out;
        }
-        if (cio_is_console(sch->schid))
+        if (cio_is_console(sch->schid)) {
                sch->opm = 0xff;
-        else
+                sch->isc = 1;
+        } else {
                sch->opm = chp_get_sch_opm(sch);
+                sch->isc = 3;
+        }
        sch->lpm = sch->schib.pmcw.pam & sch->opm;
-        sch->isc = 3;
        CIO_MSG_EVENT(6, "Detected device %04x on subchannel 0.%x.%04X "
                      "- PIM = %02X, PAM = %02X, POM = %02X\n",
@@ -704,9 +706,9 @@ void wait_cons_dev(void)
        if (!console_subchannel_in_use)
                return;
-        /* disable all but isc 7 (console device) */
+        /* disable all but isc 1 (console device) */
        __ctl_store (save_cr6, 6, 6);
-        cr6 = 0x01000000;
+        cr6 = 0x40000000;
        __ctl_load (cr6, 6, 6);
        do {
@@ -788,11 +790,11 @@ cio_probe_console(void)
        }
        /*
-         * enable console I/O-interrupt subclass 7
+         * enable console I/O-interrupt subclass 1
         */
-        ctl_set_bit(6, 24);
+        ctl_set_bit(6, 30);
-        console_subchannel.isc = 7;
+        console_subchannel.isc = 1;
-        console_subchannel.schib.pmcw.isc = 7;
+        console_subchannel.schib.pmcw.isc = 1;
        console_subchannel.schib.pmcw.intparm =
                (u32)(addr_t)&console_subchannel;
        ret = cio_modify(&console_subchannel);
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/kvm/kvm_virtio.c
index 9f55ce6f3c78..5ab34340919b 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/kvm/kvm_virtio.c
@@ -31,11 +31,6 @@
 */
 static void *kvm_devices;
-/*
- * Unique numbering for kvm devices.
- */
-static unsigned int dev_index;
 struct kvm_device {
        struct virtio_device vdev;
        struct kvm_device_desc *desc;
@@ -250,26 +245,25 @@ static struct device kvm_root = {
 * adds a new device and register it with virtio
 * appropriate drivers are loaded by the device model
 */
-static void add_kvm_device(struct kvm_device_desc *d)
+static void add_kvm_device(struct kvm_device_desc *d, unsigned int offset)
 {
        struct kvm_device *kdev;
        kdev = kzalloc(sizeof(*kdev), GFP_KERNEL);
        if (!kdev) {
-                printk(KERN_EMERG "Cannot allocate kvm dev %u\n",
+                printk(KERN_EMERG "Cannot allocate kvm dev %u type %u\n",
-                       dev_index++);
+                       offset, d->type);
                return;
        }
        kdev->vdev.dev.parent = &kvm_root;
-        kdev->vdev.index = dev_index++;
        kdev->vdev.id.device = d->type;
        kdev->vdev.config = &kvm_vq_configspace_ops;
        kdev->desc = d;
        if (register_virtio_device(&kdev->vdev) != 0) {
-                printk(KERN_ERR "Failed to register kvm device %u\n",
+                printk(KERN_ERR "Failed to register kvm device %u type %u\n",
-                       kdev->vdev.index);
+                       offset, d->type);
                kfree(kdev);
        }
 }
@@ -289,7 +283,7 @@ static void scan_devices(void)
                if (d->type == 0)
                        break;
-                add_kvm_device(d);
+                add_kvm_device(d, i);
        }
 }
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 436bf1f6d4a6..9a71dae223e8 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -290,9 +290,6 @@ int qeth_set_large_send(struct qeth_card *card,
                        card->dev->features |= NETIF_F_TSO | NETIF_F_SG |
                                                NETIF_F_HW_CSUM;
                } else {
-                        PRINT_WARN("TSO not supported on %s. "
-                                   "large_send set to 'no'.\n",
-                                   card->dev->name);
                        card->dev->features &= ~(NETIF_F_TSO | NETIF_F_SG |
                                                NETIF_F_HW_CSUM);
                        card->options.large_send = QETH_LARGE_SEND_NO;
@@ -1407,12 +1404,6 @@ static void qeth_init_func_level(struct qeth_card *card)
        }
 }
-static inline __u16 qeth_raw_devno_from_bus_id(char *id)
-{
-        id += (strlen(id) - 4);
-        return (__u16) simple_strtoul(id, &id, 16);
-}
 static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
                void (*idx_reply_cb)(struct qeth_channel *,
                        struct qeth_cmd_buffer *))
@@ -1439,7 +1430,7 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
        spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
        if (rc) {
-                PRINT_ERR("Error2 in activating channel rc=%d\n", rc);
+                QETH_DBF_MESSAGE(2, "Error2 in activating channel rc=%d\n", rc);
                QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
                atomic_set(&channel->irq_pending, 0);
                wake_up(&card->wait_q);
@@ -1468,6 +1459,7 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
        __u16 temp;
        __u8 tmp;
        int rc;
+        struct ccw_dev_id temp_devid;
        card = CARD_FROM_CDEV(channel->ccwdev);
@@ -1494,8 +1486,8 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
               &card->token.issuer_rm_w, QETH_MPC_TOKEN_LENGTH);
        memcpy(QETH_IDX_ACT_FUNC_LEVEL(iob->data),
               &card->info.func_level, sizeof(__u16));
-        temp = qeth_raw_devno_from_bus_id(CARD_DDEV_ID(card));
+        ccw_device_get_id(CARD_DDEV(card), &temp_devid);
-        memcpy(QETH_IDX_ACT_QDIO_DEV_CUA(iob->data), &temp, 2);
+        memcpy(QETH_IDX_ACT_QDIO_DEV_CUA(iob->data), &temp_devid.devno, 2);
        temp = (card->info.cula << 8) + card->info.unit_addr2;
        memcpy(QETH_IDX_ACT_QDIO_DEV_REALADDR(iob->data), &temp, 2);
@@ -1508,7 +1500,8 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
        spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
        if (rc) {
-                PRINT_ERR("Error1 in activating channel. rc=%d\n", rc);
+                QETH_DBF_MESSAGE(2, "Error1 in activating channel. rc=%d\n",
+                        rc);
                QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
                atomic_set(&channel->irq_pending, 0);
                wake_up(&card->wait_q);
@@ -1658,7 +1651,6 @@ int qeth_send_control_data(struct qeth_card *card, int len,
        reply = qeth_alloc_reply(card);
        if (!reply) {
-                PRINT_WARN("Could not alloc qeth_reply!\n");
                return -ENOMEM;
        }
        reply->callback = reply_cb;
@@ -2612,15 +2604,9 @@ void qeth_queue_input_buffer(struct qeth_card *card, int index)
                if (newcount < count) {
                        /* we are in memory shortage so we switch back to
                           traditional skb allocation and drop packages */
-                        if (!atomic_read(&card->force_alloc_skb) &&
-                            net_ratelimit())
-                                PRINT_WARN("Switch to alloc skb\n");
                        atomic_set(&card->force_alloc_skb, 3);
                        count = newcount;
                } else {
-                        if ((atomic_read(&card->force_alloc_skb) == 1) &&
-                            net_ratelimit())
-                                PRINT_WARN("Switch to sg\n");
                        atomic_add_unless(&card->force_alloc_skb, -1, 0);
                }
@@ -3034,7 +3020,7 @@ int qeth_get_elements_no(struct qeth_card *card, void *hdr,
                elements_needed = 1 + (((((unsigned long) hdr) % PAGE_SIZE)
                        + skb->len) >> PAGE_SHIFT);
        if ((elements_needed + elems) > QETH_MAX_BUFFER_ELEMENTS(card)) {
-                PRINT_ERR("Invalid size of IP packet "
+                QETH_DBF_MESSAGE(2, "Invalid size of IP packet "
                        "(Number=%d / Length=%d). Discarded.\n",
                        (elements_needed+elems), skb->len);
                return 0;
@@ -3247,8 +3233,6 @@ int qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                         * free buffers) to handle eddp context */
                        if (qeth_eddp_check_buffers_for_context(queue, ctx)
                                < 0) {
-                                if (net_ratelimit())
-                                        PRINT_WARN("eddp tx_dropped 1\n");
                                rc = -EBUSY;
                                goto out;
                        }
@@ -3260,7 +3244,6 @@ int qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                tmp = qeth_eddp_fill_buffer(queue, ctx,
                                                queue->next_buf_to_fill);
                if (tmp < 0) {
-                        PRINT_ERR("eddp tx_dropped 2\n");
                        rc = -EBUSY;
                        goto out;
                }
@@ -3602,8 +3585,6 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
        if ((!qeth_adp_supported(card, IPA_SETADP_SET_SNMP_CONTROL)) &&
            (!card->options.layer2)) {
-                PRINT_WARN("SNMP Query MIBS not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                return -EOPNOTSUPP;
        }
        /* skip 4 bytes (data_len struct member) to get req_len */
@@ -3634,7 +3615,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
        rc = qeth_send_ipa_snmp_cmd(card, iob, QETH_SETADP_BASE_LEN + req_len,
                                    qeth_snmp_command_cb, (void *)&qinfo);
        if (rc)
-                PRINT_WARN("SNMP command failed on %s: (0x%x)\n",
+                QETH_DBF_MESSAGE(2, "SNMP command failed on %s: (0x%x)\n",
                           QETH_CARD_IFNAME(card), rc);
        else {
                if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
@@ -3807,8 +3788,8 @@ retry:
        if (mpno)
                mpno = min(mpno - 1, QETH_MAX_PORTNO);
        if (card->info.portno > mpno) {
-                PRINT_ERR("Device %s does not offer port number %d \n.",
+                QETH_DBF_MESSAGE(2, "Device %s does not offer port number %d"
-                        CARD_BUS_ID(card), card->info.portno);
+                        "\n.", CARD_BUS_ID(card), card->info.portno);
                rc = -ENODEV;
                goto out;
        }
@@ -3985,8 +3966,6 @@ struct sk_buff *qeth_core_get_next_skb(struct qeth_card *card,
        return skb;
 no_mem:
        if (net_ratelimit()) {
-                PRINT_WARN("No memory for packet received on %s.\n",
-                           QETH_CARD_IFNAME(card));
                QETH_DBF_TEXT(TRACE, 2, "noskbmem");
                QETH_DBF_TEXT_(TRACE, 2, "%s", CARD_BUS_ID(card));
        }
@@ -4004,15 +3983,17 @@ static void qeth_unregister_dbf_views(void)
        }
 }
-void qeth_dbf_longtext(enum qeth_dbf_names dbf_nix, int level, char *text, ...)
+void qeth_dbf_longtext(enum qeth_dbf_names dbf_nix, int level, char *fmt, ...)
 {
        char dbf_txt_buf[32];
+        va_list args;
        if (level > (qeth_dbf[dbf_nix].id)->level)
                return;
-        snprintf(dbf_txt_buf, sizeof(dbf_txt_buf), text);
+        va_start(args, fmt);
+        vsnprintf(dbf_txt_buf, sizeof(dbf_txt_buf), fmt, args);
+        va_end(args);
        debug_text_event(qeth_dbf[dbf_nix].id, level, dbf_txt_buf);
-        
 }
 EXPORT_SYMBOL_GPL(qeth_dbf_longtext);
diff --git a/drivers/s390/net/qeth_core_offl.c b/drivers/s390/net/qeth_core_offl.c
index 822df8362856..452874e89740 100644
--- a/drivers/s390/net/qeth_core_offl.c
+++ b/drivers/s390/net/qeth_core_offl.c
@@ -122,8 +122,8 @@ int qeth_eddp_fill_buffer(struct qeth_qdio_out_q *queue,
                        if (element == 0)
                                return -EBUSY;
                        else {
-                                PRINT_WARN("could only partially fill eddp "
+                                QETH_DBF_MESSAGE(2, "could only partially fill"
-                                           "buffer!\n");
+                                        "eddp buffer!\n");
                                goto out;
                        }
                }
@@ -143,8 +143,6 @@ int qeth_eddp_fill_buffer(struct qeth_qdio_out_q *queue,
                if (must_refcnt) {
                        must_refcnt = 0;
                        if (qeth_eddp_buf_ref_context(buf, ctx)) {
-                                PRINT_WARN("no memory to create eddp context "
-                                           "reference\n");
                                goto out_check;
                        }
                }
diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
index 08a50f057284..c26e842ad905 100644
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -129,7 +129,6 @@ static ssize_t qeth_dev_portno_store(struct device *dev,
        portno = simple_strtoul(buf, &tmp, 16);
        if (portno > QETH_MAX_PORTNO) {
-                PRINT_WARN("portno 0x%X is out of range\n", portno);
                return -EINVAL;
        }
@@ -223,8 +222,6 @@ static ssize_t qeth_dev_prioqing_store(struct device *dev,
         * if though we have to permit priority queueing
         */
        if (card->qdio.no_out_queues == 1) {
-                PRINT_WARN("Priority queueing disabled due "
-                           "to hardware limitations!\n");
                card->qdio.do_prio_queueing = QETH_PRIOQ_DEFAULT;
                return -EPERM;
        }
@@ -250,7 +247,6 @@ static ssize_t qeth_dev_prioqing_store(struct device *dev,
                card->qdio.do_prio_queueing = QETH_NO_PRIO_QUEUEING;
                card->qdio.default_out_queue = QETH_DEFAULT_QUEUE;
        } else {
-                PRINT_WARN("Unknown queueing type '%s'\n", tmp);
                return -EINVAL;
        }
        return count;
@@ -291,9 +287,6 @@ static ssize_t qeth_dev_bufcnt_store(struct device *dev,
                ((cnt > QETH_IN_BUF_COUNT_MAX) ? QETH_IN_BUF_COUNT_MAX : cnt);
        if (old_cnt != cnt) {
                rc = qeth_realloc_buffer_pool(card, cnt);
-                if (rc)
-                        PRINT_WARN("Error (%d) while setting "
-                                   "buffer count.\n", rc);
        }
        return count;
 }
@@ -355,7 +348,6 @@ static ssize_t qeth_dev_performance_stats_store(struct device *dev,
                card->perf_stats.initial_rx_packets = card->stats.rx_packets;
                card->perf_stats.initial_tx_packets = card->stats.tx_packets;
        } else {
-                PRINT_WARN("performance_stats: write 0 or 1 to this file!\n");
                return -EINVAL;
        }
        return count;
@@ -399,7 +391,6 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
                newdis = QETH_DISCIPLINE_LAYER2;
                break;
        default:
-                PRINT_WARN("layer2: write 0 or 1 to this file!\n");
                return -EINVAL;
        }
@@ -463,7 +454,6 @@ static ssize_t qeth_dev_large_send_store(struct device *dev,
        } else if (!strcmp(tmp, "TSO")) {
                type = QETH_LARGE_SEND_TSO;
        } else {
-                PRINT_WARN("large_send: invalid mode %s!\n", tmp);
                return -EINVAL;
        }
        if (card->options.large_send == type)
@@ -503,8 +493,6 @@ static ssize_t qeth_dev_blkt_store(struct qeth_card *card,
        if (i <= max_value) {
                *value = i;
        } else {
-                PRINT_WARN("blkt total time: write values between"
-                           " 0 and %d to this file!\n", max_value);
                return -EINVAL;
        }
        return count;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 86ec50ddae13..f682f7b14480 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -101,19 +101,16 @@ static struct net_device *qeth_l2_netdev_by_devno(unsigned char *read_dev_no)
 {
        struct qeth_card *card;
        struct net_device *ndev;
-        unsigned char *readno;
+        __u16 temp_dev_no;
-        __u16 temp_dev_no, card_dev_no;
-        char *endp;
        unsigned long flags;
+        struct ccw_dev_id read_devid;
        ndev = NULL;
        memcpy(&temp_dev_no, read_dev_no, 2);
        read_lock_irqsave(&qeth_core_card_list.rwlock, flags);
        list_for_each_entry(card, &qeth_core_card_list.list, list) {
-                readno = CARD_RDEV_ID(card);
+                ccw_device_get_id(CARD_RDEV(card), &read_devid);
-                readno += (strlen(readno) - 4);
+                if (read_devid.devno == temp_dev_no) {
-                card_dev_no = simple_strtoul(readno, &endp, 16);
-                if (card_dev_no == temp_dev_no) {
                        ndev = card->dev;
                        break;
                }
@@ -134,14 +131,14 @@ static int qeth_l2_send_setgroupmac_cb(struct qeth_card *card,
        mac = &cmd->data.setdelmac.mac[0];
        /* MAC already registered, needed in couple/uncouple case */
        if (cmd->hdr.return_code == 0x2005) {
-                PRINT_WARN("Group MAC %02x:%02x:%02x:%02x:%02x:%02x " \
+                QETH_DBF_MESSAGE(2, "Group MAC %02x:%02x:%02x:%02x:%02x:%02x "
                          "already existing on %s \n",
                          mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
                          QETH_CARD_IFNAME(card));
                cmd->hdr.return_code = 0;
        }
        if (cmd->hdr.return_code)
-                PRINT_ERR("Could not set group MAC " \
+                QETH_DBF_MESSAGE(2, "Could not set group MAC "
                          "%02x:%02x:%02x:%02x:%02x:%02x on %s: %x\n",
                          mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
                          QETH_CARD_IFNAME(card), cmd->hdr.return_code);
@@ -166,7 +163,7 @@ static int qeth_l2_send_delgroupmac_cb(struct qeth_card *card,
        cmd = (struct qeth_ipa_cmd *) data;
        mac = &cmd->data.setdelmac.mac[0];
        if (cmd->hdr.return_code)
-                PRINT_ERR("Could not delete group MAC " \
+                QETH_DBF_MESSAGE(2, "Could not delete group MAC "
                          "%02x:%02x:%02x:%02x:%02x:%02x on %s: %x\n",
                          mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
                          QETH_CARD_IFNAME(card), cmd->hdr.return_code);
@@ -186,10 +183,8 @@ static void qeth_l2_add_mc(struct qeth_card *card, __u8 *mac)
        mc = kmalloc(sizeof(struct qeth_mc_mac), GFP_ATOMIC);
-        if (!mc) {
+        if (!mc)
-                PRINT_ERR("no mem vor mc mac address\n");
                return;
-        }
        memcpy(mc->mc_addr, mac, OSA_ADDR_LEN);
        mc->mc_addrlen = OSA_ADDR_LEN;
@@ -280,7 +275,7 @@ static int qeth_l2_send_setdelvlan_cb(struct qeth_card *card,
        QETH_DBF_TEXT(TRACE, 2, "L2sdvcb");
        cmd = (struct qeth_ipa_cmd *) data;
        if (cmd->hdr.return_code) {
-                PRINT_ERR("Error in processing VLAN %i on %s: 0x%x. "
+                QETH_DBF_MESSAGE(2, "Error in processing VLAN %i on %s: 0x%x. "
                          "Continuing\n", cmd->data.setdelvlan.vlan_id,
                          QETH_CARD_IFNAME(card), cmd->hdr.return_code);
                QETH_DBF_TEXT_(TRACE, 2, "L2VL%4x", cmd->hdr.command);
@@ -333,8 +328,6 @@ static void qeth_l2_vlan_rx_add_vid(struct net_device *dev, unsigned short vid)
                spin_lock_bh(&card->vlanlock);
                list_add_tail(&id->list, &card->vid_list);
                spin_unlock_bh(&card->vlanlock);
-        } else {
-                PRINT_ERR("no memory for vid\n");
        }
 }
@@ -550,16 +543,15 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
        rc = qeth_query_setadapterparms(card);
        if (rc) {
-                PRINT_WARN("could not query adapter parameters on device %s: "
+                QETH_DBF_MESSAGE(2, "could not query adapter parameters on "
-                           "x%x\n", CARD_BUS_ID(card), rc);
+                        "device %s: x%x\n", CARD_BUS_ID(card), rc);
        }
        if (card->info.guestlan) {
                rc = qeth_setadpparms_change_macaddr(card);
                if (rc) {
-                        PRINT_WARN("couldn't get MAC address on "
+                        QETH_DBF_MESSAGE(2, "couldn't get MAC address on "
-                           "device %s: x%x\n",
+                                "device %s: x%x\n", CARD_BUS_ID(card), rc);
-                           CARD_BUS_ID(card), rc);
                        QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
                        return rc;
                }
@@ -585,8 +577,6 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
        }
        if (card->info.type == QETH_CARD_TYPE_OSN) {
-                PRINT_WARN("Setting MAC address on %s is not supported.\n",
-                           dev->name);
                QETH_DBF_TEXT(TRACE, 3, "setmcOSN");
                return -EOPNOTSUPP;
        }
@@ -666,7 +656,7 @@ static int qeth_l2_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                ctx = qeth_eddp_create_context(card, new_skb, hdr,
                                                skb->sk->sk_protocol);
                if (ctx == NULL) {
-                        PRINT_WARN("could not create eddp context\n");
+                        QETH_DBF_MESSAGE(2, "could not create eddp context\n");
                        goto tx_drop;
                }
        } else {
@@ -731,6 +721,7 @@ tx_drop:
        if ((new_skb != skb) && new_skb)
                dev_kfree_skb_any(new_skb);
        dev_kfree_skb_any(skb);
+        netif_wake_queue(dev);
        return NETDEV_TX_OK;
 }
@@ -1155,7 +1146,7 @@ static int qeth_osn_send_control_data(struct qeth_card *card, int len,
                              (addr_t) iob, 0, 0);
        spin_unlock_irqrestore(get_ccwdev_lock(card->write.ccwdev), flags);
        if (rc) {
-                PRINT_WARN("qeth_osn_send_control_data: "
+                QETH_DBF_MESSAGE(2, "qeth_osn_send_control_data: "
                           "ccw_device_start rc = %i\n", rc);
                QETH_DBF_TEXT_(TRACE, 2, " err%d", rc);
                qeth_release_buffer(iob->channel, iob);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 94a8ead64ed4..999552c83bbe 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -311,7 +311,6 @@ static struct qeth_ipaddr *qeth_l3_get_addr_buffer(
        addr = kzalloc(sizeof(struct qeth_ipaddr), GFP_ATOMIC);
        if (addr == NULL) {
-                PRINT_WARN("Not enough memory to add address\n");
                return NULL;
        }
        addr->type = QETH_IP_TYPE_NORMAL;
@@ -649,15 +648,6 @@ static void qeth_l3_correct_routing_type(struct qeth_card *card,
                }
        }
 out_inval:
-        PRINT_WARN("Routing type '%s' not supported for interface %s.\n"
-                   "Router status set to 'no router'.\n",
-                   ((*type == PRIMARY_ROUTER)? "primary router" :
-                    (*type == SECONDARY_ROUTER)? "secondary router" :
-                    (*type == PRIMARY_CONNECTOR)? "primary connector" :
-                    (*type == SECONDARY_CONNECTOR)? "secondary connector" :
-                    (*type == MULTICAST_ROUTER)? "multicast router" :
-                    "unknown"),
-                   card->dev->name);
        *type = NO_ROUTER;
 }
@@ -674,9 +664,9 @@ int qeth_l3_setrouting_v4(struct qeth_card *card)
                                  QETH_PROT_IPV4);
        if (rc) {
                card->options.route4.type = NO_ROUTER;
-                PRINT_WARN("Error (0x%04x) while setting routing type on %s. "
+                QETH_DBF_MESSAGE(2, "Error (0x%04x) while setting routing type"
-                           "Type set to 'no router'.\n",
+                        " on %s. Type set to 'no router'.\n", rc,
-                           rc, QETH_CARD_IFNAME(card));
+                        QETH_CARD_IFNAME(card));
        }
        return rc;
 }
@@ -697,9 +687,9 @@ int qeth_l3_setrouting_v6(struct qeth_card *card)
                                  QETH_PROT_IPV6);
        if (rc) {
                card->options.route6.type = NO_ROUTER;
-                PRINT_WARN("Error (0x%04x) while setting routing type on %s. "
+                QETH_DBF_MESSAGE(2, "Error (0x%04x) while setting routing type"
-                           "Type set to 'no router'.\n",
+                        " on %s. Type set to 'no router'.\n", rc,
-                           rc, QETH_CARD_IFNAME(card));
+                        QETH_CARD_IFNAME(card));
        }
 #endif
        return rc;
@@ -737,7 +727,6 @@ int qeth_l3_add_ipato_entry(struct qeth_card *card,
                if (!memcmp(ipatoe->addr, new->addr,
                            (ipatoe->proto == QETH_PROT_IPV4)? 4:16) &&
                    (ipatoe->mask_bits == new->mask_bits)) {
-                        PRINT_WARN("ipato entry already exists!\n");
                        rc = -EEXIST;
                        break;
                }
@@ -802,7 +791,6 @@ int qeth_l3_add_vipa(struct qeth_card *card, enum qeth_prot_versions proto,
                rc = -EEXIST;
        spin_unlock_irqrestore(&card->ip_lock, flags);
        if (rc) {
-                PRINT_WARN("Cannot add VIPA. Address already exists!\n");
                return rc;
        }
        if (!qeth_l3_add_ip(card, ipaddr))
@@ -867,7 +855,6 @@ int qeth_l3_add_rxip(struct qeth_card *card, enum qeth_prot_versions proto,
                rc = -EEXIST;
        spin_unlock_irqrestore(&card->ip_lock, flags);
        if (rc) {
-                PRINT_WARN("Cannot add RXIP. Address already exists!\n");
                return rc;
        }
        if (!qeth_l3_add_ip(card, ipaddr))
@@ -1020,23 +1007,23 @@ static int qeth_l3_setadapter_hstr(struct qeth_card *card)
                                        IPA_SETADP_SET_BROADCAST_MODE,
                                        card->options.broadcast_mode);
                if (rc)
-                        PRINT_WARN("couldn't set broadcast mode on "
+                        QETH_DBF_MESSAGE(2, "couldn't set broadcast mode on "
                                   "device %s: x%x\n",
                                   CARD_BUS_ID(card), rc);
                rc = qeth_l3_send_setadp_mode(card,
                                        IPA_SETADP_ALTER_MAC_ADDRESS,
                                        card->options.macaddr_mode);
                if (rc)
-                        PRINT_WARN("couldn't set macaddr mode on "
+                        QETH_DBF_MESSAGE(2, "couldn't set macaddr mode on "
                                   "device %s: x%x\n", CARD_BUS_ID(card), rc);
                return rc;
        }
        if (card->options.broadcast_mode == QETH_TR_BROADCAST_LOCAL)
-                PRINT_WARN("set adapter parameters not available "
+                QETH_DBF_MESSAGE(2, "set adapter parameters not available "
                           "to set broadcast mode, using ALLRINGS "
                           "on device %s:\n", CARD_BUS_ID(card));
        if (card->options.macaddr_mode == QETH_TR_MACADDR_CANONICAL)
-                PRINT_WARN("set adapter parameters not available "
+                QETH_DBF_MESSAGE(2, "set adapter parameters not available "
                           "to set macaddr mode, using NONCANONICAL "
                           "on device %s:\n", CARD_BUS_ID(card));
        return 0;
@@ -2070,7 +2057,7 @@ static struct qeth_card *qeth_l3_get_card_from_dev(struct net_device *dev)
                card = netdev_priv(dev);
        else if (rc == QETH_VLAN_CARD)
                card = netdev_priv(vlan_dev_info(dev)->real_dev);
-        if (card->options.layer2)
+        if (card && card->options.layer2)
                card = NULL;
        QETH_DBF_TEXT_(TRACE, 4, "%d", rc);
        return card ;
@@ -2182,8 +2169,6 @@ static int qeth_l3_arp_set_no_entries(struct qeth_card *card, int no_entries)
        if (card->info.guestlan)
                return -EOPNOTSUPP;
        if (!qeth_is_supported(card, IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                return -EOPNOTSUPP;
        }
        rc = qeth_l3_send_simple_setassparms(card, IPA_ARP_PROCESSING,
@@ -2191,8 +2176,8 @@ static int qeth_l3_arp_set_no_entries(struct qeth_card *card, int no_entries)
                                          no_entries);
        if (rc) {
                tmp = rc;
-                PRINT_WARN("Could not set number of ARP entries on %s: "
+                QETH_DBF_MESSAGE(2, "Could not set number of ARP entries on "
-                        "%s (0x%x/%d)\n", QETH_CARD_IFNAME(card),
+                        "%s: %s (0x%x/%d)\n", QETH_CARD_IFNAME(card),
                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
        }
        return rc;
@@ -2260,9 +2245,6 @@ static int qeth_l3_arp_query_cb(struct qeth_card *card,
                        qdata->no_entries * uentry_size){
                QETH_DBF_TEXT_(TRACE, 4, "qaer3%i", -ENOMEM);
                cmd->hdr.return_code = -ENOMEM;
-                PRINT_WARN("query ARP user space buffer is too small for "
-                           "the returned number of ARP entries. "
-                           "Aborting query!\n");
                goto out_error;
        }
        QETH_DBF_TEXT_(TRACE, 4, "anore%i",
@@ -2324,8 +2306,6 @@ static int qeth_l3_arp_query(struct qeth_card *card, char __user *udata)
        if (!qeth_is_supported(card,/*IPA_QUERY_ARP_ADDR_INFO*/
                               IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                return -EOPNOTSUPP;
        }
        /* get size of userspace buffer and mask_bits -> 6 bytes */
@@ -2344,7 +2324,7 @@ static int qeth_l3_arp_query(struct qeth_card *card, char __user *udata)
                                   qeth_l3_arp_query_cb, (void *)&qinfo);
        if (rc) {
                tmp = rc;
-                PRINT_WARN("Error while querying ARP cache on %s: %s "
+                QETH_DBF_MESSAGE(2, "Error while querying ARP cache on %s: %s "
                        "(0x%x/%d)\n", QETH_CARD_IFNAME(card),
                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
                if (copy_to_user(udata, qinfo.udata, 4))
@@ -2375,8 +2355,6 @@ static int qeth_l3_arp_add_entry(struct qeth_card *card,
        if (card->info.guestlan)
                return -EOPNOTSUPP;
        if (!qeth_is_supported(card, IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                return -EOPNOTSUPP;
        }
@@ -2391,10 +2369,9 @@ static int qeth_l3_arp_add_entry(struct qeth_card *card,
        if (rc) {
                tmp = rc;
                qeth_l3_ipaddr4_to_string((u8 *)entry->ipaddr, buf);
-                PRINT_WARN("Could not add ARP entry for address %s on %s: "
+                QETH_DBF_MESSAGE(2, "Could not add ARP entry for address %s "
-                           "%s (0x%x/%d)\n",
+                        "on %s: %s (0x%x/%d)\n", buf, QETH_CARD_IFNAME(card),
-                           buf, QETH_CARD_IFNAME(card),
+                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
-                           qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
        }
        return rc;
 }
@@ -2417,8 +2394,6 @@ static int qeth_l3_arp_remove_entry(struct qeth_card *card,
        if (card->info.guestlan)
                return -EOPNOTSUPP;
        if (!qeth_is_supported(card, IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                return -EOPNOTSUPP;
        }
        memcpy(buf, entry, 12);
@@ -2433,10 +2408,9 @@ static int qeth_l3_arp_remove_entry(struct qeth_card *card,
                tmp = rc;
                memset(buf, 0, 16);
                qeth_l3_ipaddr4_to_string((u8 *)entry->ipaddr, buf);
-                PRINT_WARN("Could not delete ARP entry for address %s on %s: "
+                QETH_DBF_MESSAGE(2, "Could not delete ARP entry for address %s"
-                           "%s (0x%x/%d)\n",
+                        " on %s: %s (0x%x/%d)\n", buf, QETH_CARD_IFNAME(card),
-                           buf, QETH_CARD_IFNAME(card),
+                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
-                           qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
        }
        return rc;
 }
@@ -2456,16 +2430,14 @@ static int qeth_l3_arp_flush_cache(struct qeth_card *card)
        if (card->info.guestlan || (card->info.type == QETH_CARD_TYPE_IQD))
                return -EOPNOTSUPP;
        if (!qeth_is_supported(card, IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                return -EOPNOTSUPP;
        }
        rc = qeth_l3_send_simple_setassparms(card, IPA_ARP_PROCESSING,
                                          IPA_CMD_ASS_ARP_FLUSH_CACHE, 0);
        if (rc) {
                tmp = rc;
-                PRINT_WARN("Could not flush ARP cache on %s: %s (0x%x/%d)\n",
+                QETH_DBF_MESSAGE(2, "Could not flush ARP cache on %s: %s "
-                        QETH_CARD_IFNAME(card),
+                        "(0x%x/%d)\n", QETH_CARD_IFNAME(card),
                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
        }
        return rc;
@@ -2724,7 +2696,7 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                ctx = qeth_eddp_create_context(card, new_skb, hdr,
                                                skb->sk->sk_protocol);
                if (ctx == NULL) {
-                        PRINT_WARN("could not create eddp context\n");
+                        QETH_DBF_MESSAGE(2, "could not create eddp context\n");
                        goto tx_drop;
                }
        } else {
@@ -2792,6 +2764,7 @@ tx_drop:
        if ((new_skb != skb) && new_skb)
                dev_kfree_skb_any(new_skb);
        dev_kfree_skb_any(skb);
+        netif_wake_queue(dev);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index 08f51fd902c4..ac1993708ae9 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -85,7 +85,6 @@ static ssize_t qeth_l3_dev_route_store(struct qeth_card *card,
        } else if (!strcmp(tmp, "multicast_router")) {
                route->type = MULTICAST_ROUTER;
        } else {
-                PRINT_WARN("Invalid routing type '%s'.\n", tmp);
                return -EINVAL;
        }
        if (((card->state == CARD_STATE_SOFTSETUP) ||
@@ -137,9 +136,6 @@ static ssize_t qeth_l3_dev_route6_store(struct device *dev,
                return -EINVAL;
        if (!qeth_is_supported(card, IPA_IPV6)) {
-                PRINT_WARN("IPv6 not supported for interface %s.\n"
-                           "Routing status no changed.\n",
-                           QETH_CARD_IFNAME(card));
                return -ENOTSUPP;
        }
@@ -179,7 +175,6 @@ static ssize_t qeth_l3_dev_fake_broadcast_store(struct device *dev,
        if ((i == 0) || (i == 1))
                card->options.fake_broadcast = i;
        else {
-                PRINT_WARN("fake_broadcast: write 0 or 1 to this file!\n");
                return -EINVAL;
        }
        return count;
@@ -220,7 +215,6 @@ static ssize_t qeth_l3_dev_broadcast_mode_store(struct device *dev,
        if (!((card->info.link_type == QETH_LINK_TYPE_HSTR) ||
              (card->info.link_type == QETH_LINK_TYPE_LANE_TR))) {
-                PRINT_WARN("Device is not a tokenring device!\n");
                return -EINVAL;
        }
@@ -233,8 +227,6 @@ static ssize_t qeth_l3_dev_broadcast_mode_store(struct device *dev,
                card->options.broadcast_mode = QETH_TR_BROADCAST_ALLRINGS;
                return count;
        } else {
-                PRINT_WARN("broadcast_mode: invalid mode %s!\n",
-                           tmp);
                return -EINVAL;
        }
        return count;
@@ -275,7 +267,6 @@ static ssize_t qeth_l3_dev_canonical_macaddr_store(struct device *dev,
        if (!((card->info.link_type == QETH_LINK_TYPE_HSTR) ||
              (card->info.link_type == QETH_LINK_TYPE_LANE_TR))) {
-                PRINT_WARN("Device is not a tokenring device!\n");
                return -EINVAL;
        }
@@ -285,7 +276,6 @@ static ssize_t qeth_l3_dev_canonical_macaddr_store(struct device *dev,
                        QETH_TR_MACADDR_CANONICAL :
                        QETH_TR_MACADDR_NONCANONICAL;
        else {
-                PRINT_WARN("canonical_macaddr: write 0 or 1 to this file!\n");
                return -EINVAL;
        }
        return count;
@@ -327,7 +317,6 @@ static ssize_t qeth_l3_dev_checksum_store(struct device *dev,
        else if (!strcmp(tmp, "no_checksumming"))
                card->options.checksum_type = NO_CHECKSUMMING;
        else {
-                PRINT_WARN("Unknown checksumming type '%s'\n", tmp);
                return -EINVAL;
        }
        return count;
@@ -382,8 +371,6 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev,
        } else if (!strcmp(tmp, "0")) {
                card->ipato.enabled = 0;
        } else {
-                PRINT_WARN("ipato_enable: write 0, 1 or 'toggle' to "
-                           "this file\n");
                return -EINVAL;
        }
        return count;
@@ -422,8 +409,6 @@ static ssize_t qeth_l3_dev_ipato_invert4_store(struct device *dev,
        } else if (!strcmp(tmp, "0")) {
                card->ipato.invert4 = 0;
        } else {
-                PRINT_WARN("ipato_invert4: write 0, 1 or 'toggle' to "
-                           "this file\n");
                return -EINVAL;
        }
        return count;
@@ -486,13 +471,10 @@ static int qeth_l3_parse_ipatoe(const char *buf, enum qeth_prot_versions proto,
        /* get address string */
        end = strchr(start, '/');
        if (!end || (end - start >= 40)) {
-                PRINT_WARN("Invalid format for ipato_addx/delx. "
-                           "Use <ip addr>/<mask bits>\n");
                return -EINVAL;
        }
        strncpy(buffer, start, end - start);
        if (qeth_l3_string_to_ipaddr(buffer, proto, addr)) {
-                PRINT_WARN("Invalid IP address format!\n");
                return -EINVAL;
        }
        start = end + 1;
@@ -500,7 +482,6 @@ static int qeth_l3_parse_ipatoe(const char *buf, enum qeth_prot_versions proto,
        if (!strlen(start) ||
            (tmp == start) ||
            (*mask_bits > ((proto == QETH_PROT_IPV4) ? 32 : 128))) {
-                PRINT_WARN("Invalid mask bits for ipato_addx/delx !\n");
                return -EINVAL;
        }
        return 0;
@@ -520,7 +501,6 @@ static ssize_t qeth_l3_dev_ipato_add_store(const char *buf, size_t count,
        ipatoe = kzalloc(sizeof(struct qeth_ipato_entry), GFP_KERNEL);
        if (!ipatoe) {
-                PRINT_WARN("No memory to allocate ipato entry\n");
                return -ENOMEM;
        }
        ipatoe->proto = proto;
@@ -609,8 +589,6 @@ static ssize_t qeth_l3_dev_ipato_invert6_store(struct device *dev,
        } else if (!strcmp(tmp, "0")) {
                card->ipato.invert6 = 0;
        } else {
-                PRINT_WARN("ipato_invert6: write 0, 1 or 'toggle' to "
-                           "this file\n");
                return -EINVAL;
        }
        return count;
@@ -724,7 +702,6 @@ static int qeth_l3_parse_vipae(const char *buf, enum qeth_prot_versions proto,
                 u8 *addr)
 {
        if (qeth_l3_string_to_ipaddr(buf, proto, addr)) {
-                PRINT_WARN("Invalid IP address format!\n");
                return -EINVAL;
        }
        return 0;
@@ -891,7 +868,6 @@ static int qeth_l3_parse_rxipe(const char *buf, enum qeth_prot_versions proto,
                 u8 *addr)
 {
        if (qeth_l3_string_to_ipaddr(buf, proto, addr)) {
-                PRINT_WARN("Invalid IP address format!\n");
                return -EINVAL;
        }
        return 0;
diff --git a/drivers/s390/s390mach.c b/drivers/s390/s390mach.c
index 5080f343ad74..5bfbe7659830 100644
--- a/drivers/s390/s390mach.c
+++ b/drivers/s390/s390mach.c
@@ -207,6 +207,7 @@ s390_handle_mcck(void)
                do_exit(SIGSEGV);
        }
 }
+EXPORT_SYMBOL_GPL(s390_handle_mcck);
 /*
 * returns 0 if all registers could be validated
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index b31faeccb9cd..867f6fd5c2c0 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -1278,7 +1278,7 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
                        error = 0;
                        /* Check for command packet errors */
                        if (full_command_packet->command.newcommand.status != 0) {
-                                if (tw_dev->srb[request_id] != 0) {
+                                if (tw_dev->srb[request_id] != NULL) {
                                        error = twa_fill_sense(tw_dev, request_id, 1, 1);
                                } else {
                                        /* Skip ioctl error prints */
@@ -1290,7 +1290,7 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
                        /* Check for correct state */
                        if (tw_dev->state[request_id] != TW_S_POSTED) {
-                                if (tw_dev->srb[request_id] != 0) {
+                                if (tw_dev->srb[request_id] != NULL) {
                                        TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Received a request id that wasn't posted");
                                        TW_CLEAR_ALL_INTERRUPTS(tw_dev);
                                        goto twa_interrupt_bail;
@@ -1298,7 +1298,7 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
                        }
                        /* Check for internal command completion */
-                        if (tw_dev->srb[request_id] == 0) {
+                        if (tw_dev->srb[request_id] == NULL) {
                                if (request_id != tw_dev->chrdev_request_id) {
                                        if (twa_aen_complete(tw_dev, request_id))
                                                TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1b, "Error completing AEN during attention interrupt");
diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
index 1dca1775f4b1..0899cb61e3dd 100644
--- a/drivers/scsi/aha152x.c
+++ b/drivers/scsi/aha152x.c
@@ -3582,7 +3582,7 @@ static int checksetup(struct aha152x_setup *setup)
        if (i == ARRAY_SIZE(ports))
                return 0;
-        if ( request_region(setup->io_port, IO_RANGE, "aha152x")==0 ) {
+        if (!request_region(setup->io_port, IO_RANGE, "aha152x")) {
                printk(KERN_ERR "aha152x: io port 0x%x busy.\n", setup->io_port);
                return 0;
        }
@@ -3842,7 +3842,7 @@ static int __init aha152x_init(void)
                        if ((setup_count == 1) && (setup[0].io_port == ports[i]))
                                continue;
-                        if ( request_region(ports[i], IO_RANGE, "aha152x")==0 ) {
+                        if (!request_region(ports[i], IO_RANGE, "aha152x")) {
                                printk(KERN_ERR "aha152x: io port 0x%x busy.\n", ports[i]);
                                continue;
                        }
diff --git a/drivers/scsi/atp870u.c b/drivers/scsi/atp870u.c
index db6de5e6afb3..7d311541c76c 100644
--- a/drivers/scsi/atp870u.c
+++ b/drivers/scsi/atp870u.c
@@ -747,7 +747,7 @@ static void send_s870(struct atp_unit *dev,unsigned char c)
                dev->quhd[c] = 0;
        }
        workreq = dev->quereq[c][dev->quhd[c]];
-        if (dev->id[c][scmd_id(workreq)].curr_req == 0) {       
+        if (dev->id[c][scmd_id(workreq)].curr_req == NULL) {
                dev->id[c][scmd_id(workreq)].curr_req = workreq;
                dev->last_cmd[c] = scmd_id(workreq);
                goto cmd_subp;
diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
index aaa48e0c8ed0..da876d3924be 100644
--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -444,7 +444,7 @@ static void __iomem *hptiop_map_pci_bar(struct hptiop_hba *hba, int index)
        if (!(pci_resource_flags(pcidev, index) & IORESOURCE_MEM)) {
                printk(KERN_ERR "scsi%d: pci resource invalid\n",
                                hba->host->host_no);
-                return 0;
+                return NULL;
        }
        mem_base_phy = pci_resource_start(pcidev, index);
@@ -454,7 +454,7 @@ static void __iomem *hptiop_map_pci_bar(struct hptiop_hba *hba, int index)
        if (!mem_base_virt) {
                printk(KERN_ERR "scsi%d: Fail to ioremap memory space\n",
                                hba->host->host_no);
-                return 0;
+                return NULL;
        }
        return mem_base_virt;
 }
@@ -476,11 +476,11 @@ static void hptiop_unmap_pci_bar_itl(struct hptiop_hba *hba)
 static int hptiop_map_pci_bar_mv(struct hptiop_hba *hba)
 {
        hba->u.mv.regs = hptiop_map_pci_bar(hba, 0);
-        if (hba->u.mv.regs == 0)
+        if (hba->u.mv.regs == NULL)
                return -1;
        hba->u.mv.mu = hptiop_map_pci_bar(hba, 2);
-        if (hba->u.mv.mu == 0) {
+        if (hba->u.mv.mu == NULL) {
                iounmap(hba->u.mv.regs);
                return -1;
        }
@@ -1210,8 +1210,8 @@ static void hptiop_remove(struct pci_dev *pcidev)
 static struct hptiop_adapter_ops hptiop_itl_ops = {
        .iop_wait_ready    = iop_wait_ready_itl,
-        .internal_memalloc = 0,
+        .internal_memalloc = NULL,
-        .internal_memfree  = 0,
+        .internal_memfree  = NULL,
        .map_pci_bar       = hptiop_map_pci_bar_itl,
        .unmap_pci_bar     = hptiop_unmap_pci_bar_itl,
        .enable_intr       = hptiop_enable_intr_itl,
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index ccfd8aca3765..5d23368a1bce 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -1348,7 +1348,7 @@ void ibmvscsi_handle_crq(struct viosrp_crq *crq,
        del_timer(&evt_struct->timer);
-        if (crq->status != VIOSRP_OK && evt_struct->cmnd)
+        if ((crq->status != VIOSRP_OK && crq->status != VIOSRP_OK2) && evt_struct->cmnd)
                evt_struct->cmnd->result = DID_ERROR << 16;
        if (evt_struct->done)
                evt_struct->done(evt_struct);
diff --git a/drivers/scsi/ibmvscsi/viosrp.h b/drivers/scsi/ibmvscsi/viosrp.h
index 4c4aadb3e405..204604501ad8 100644
--- a/drivers/scsi/ibmvscsi/viosrp.h
+++ b/drivers/scsi/ibmvscsi/viosrp.h
@@ -65,7 +65,8 @@ enum viosrp_crq_status {
        VIOSRP_VIOLATES_MAX_XFER = 0x2,
        VIOSRP_PARTNER_PANIC = 0x3,
        VIOSRP_DEVICE_BUSY = 0x8,
-        VIOSRP_ADAPTER_FAIL = 0x10
+        VIOSRP_ADAPTER_FAIL = 0x10,
+        VIOSRP_OK2 = 0x99,
 };
 struct viosrp_crq {
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index 51e2f299dbbb..3754ab87f89a 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -2811,7 +2811,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
        /* Check for room in outstanding command list. */
        for (cnt = 0; cnt < MAX_OUTSTANDING_COMMANDS &&
-                     ha->outstanding_cmds[cnt] != 0; cnt++);
+                     ha->outstanding_cmds[cnt] != NULL; cnt++);
        if (cnt >= MAX_OUTSTANDING_COMMANDS) {
                status = 1;
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 287690853caf..8dd88fc1244a 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -70,6 +70,9 @@ qla2x00_sysfs_write_fw_dump(struct kobject *kobj,
        case 2:
                qla2x00_alloc_fw_dump(ha);
                break;
+        case 3:
+                qla2x00_system_error(ha);
+                break;
        }
        return (count);
 }
@@ -886,9 +889,13 @@ qla2x00_get_host_speed(struct Scsi_Host *shost)
 static void
 qla2x00_get_host_port_type(struct Scsi_Host *shost)
 {
-        scsi_qla_host_t *ha = to_qla_parent(shost_priv(shost));
+        scsi_qla_host_t *ha = shost_priv(shost);
        uint32_t port_type = FC_PORTTYPE_UNKNOWN;
+        if (ha->parent) {
+                fc_host_port_type(shost) = FC_PORTTYPE_NPIV;
+                return;
+        }
        switch (ha->current_topology) {
        case ISP_CFG_NL:
                port_type = FC_PORTTYPE_LPORT;
@@ -1172,10 +1179,10 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
        qla24xx_disable_vp(vha);
        qla24xx_deallocate_vp_id(vha);
-        down(&ha->vport_sem);
+        mutex_lock(&ha->vport_lock);
        ha->cur_vport_count--;
        clear_bit(vha->vp_idx, ha->vp_idx_map);
-        up(&ha->vport_sem);
+        mutex_unlock(&ha->vport_lock);
        kfree(vha->node_name);
        kfree(vha->port_name);
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 299eccf6cabd..8dd600013bd1 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -2457,7 +2457,7 @@ typedef struct scsi_qla_host {
 #define MBX_INTR_WAIT   2
 #define MBX_UPDATE_FLASH_ACTIVE 3
-        struct semaphore vport_sem;     /* Virtual port synchronization */
+        struct mutex vport_lock;        /* Virtual port synchronization */
        struct completion mbx_cmd_comp; /* Serialize mbx access */
        struct completion mbx_intr_comp;  /* Used for completion notification */
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index f8827068d30f..9b4bebee6879 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -228,6 +228,9 @@ extern int qla24xx_abort_target(struct fc_port *, unsigned int);
 extern int qla24xx_lun_reset(struct fc_port *, unsigned int);
 extern int
+qla2x00_system_error(scsi_qla_host_t *);
+extern int
 qla2x00_set_serdes_params(scsi_qla_host_t *, uint16_t, uint16_t, uint16_t);
 extern int
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index e9bae27737d1..92fafbdbbaab 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -34,7 +34,11 @@ qla2x00_debounce_register(volatile uint16_t __iomem *addr)
 static inline void
 qla2x00_poll(scsi_qla_host_t *ha)
 {
+        unsigned long flags;
+        local_irq_save(flags);
        ha->isp_ops->intr_handler(0, ha);
+        local_irq_restore(flags);
 }
 static __inline__ scsi_qla_host_t *
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 5d9a64a7879b..ec63b79f900a 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -272,8 +272,6 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
        uint32_t        rscn_entry, host_pid;
        uint8_t         rscn_queue_index;
        unsigned long   flags;
-        scsi_qla_host_t *vha;
-        int             i;
        /* Setup to process RIO completion. */
        handle_cnt = 0;
@@ -544,18 +542,10 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                break;
        case MBA_PORT_UPDATE:           /* Port database update */
-                if ((ha->flags.npiv_supported) && (ha->num_vhosts)) {
+                /* Only handle SCNs for our Vport index. */
-                        for_each_mapped_vp_idx(ha, i) {
+                if (ha->parent && ha->vp_idx != (mb[3] & 0xff))
-                                list_for_each_entry(vha, &ha->vp_list,
+                        break;
-                                    vp_list) {
-                                        if ((mb[3] & 0xff)
-                                            == vha->vp_idx) {
-                                                ha = vha;
-                                                break;
-                                        }
-                                }
-                        }
-                }
                /*
                 * If PORT UPDATE is global (recieved LIP_OCCURED/LIP_RESET
                 * event etc. earlier indicating loop is down) then process
@@ -590,18 +580,12 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                break;
        case MBA_RSCN_UPDATE:           /* State Change Registration */
-                if ((ha->flags.npiv_supported) && (ha->num_vhosts)) {
+                /* Check if the Vport has issued a SCR */
-                        for_each_mapped_vp_idx(ha, i) {
+                if (ha->parent && test_bit(VP_SCR_NEEDED, &ha->vp_flags))
-                                list_for_each_entry(vha, &ha->vp_list,
+                        break;
-                                    vp_list) {
+                /* Only handle SCNs for our Vport index. */
-                                        if ((mb[3] & 0xff)
+                if (ha->parent && ha->vp_idx != (mb[3] & 0xff))
-                                            == vha->vp_idx) {
+                        break;
-                                                ha = vha;
-                                                break;
-                                        }
-                                }
-                        }
-                }
                DEBUG2(printk("scsi(%ld): Asynchronous RSCR UPDATE.\n",
                    ha->host_no));
@@ -1132,25 +1116,6 @@ qla2x00_status_entry(scsi_qla_host_t *ha, void *pkt)
                                break;
                        qla2x00_handle_sense(sp, sense_data, sense_len);
-                        /*
-                         * In case of a Underrun condition, set both the lscsi
-                         * status and the completion status to appropriate
-                         * values.
-                         */
-                        if (resid &&
-                            ((unsigned)(scsi_bufflen(cp) - resid) <
-                             cp->underflow)) {
-                                DEBUG2(qla_printk(KERN_INFO, ha,
-                                    "scsi(%ld:%d:%d:%d): Mid-layer underflow "
-                                    "detected (%x of %x bytes)...returning "
-                                    "error status.\n", ha->host_no,
-                                    cp->device->channel, cp->device->id,
-                                    cp->device->lun, resid,
-                                    scsi_bufflen(cp)));
-                                cp->result = DID_ERROR << 16 | lscsi_status;
-                        }
                } else {
                        /*
                         * If RISC reports underrun and target does not report
@@ -1639,12 +1604,12 @@ qla24xx_msix_rsp_q(int irq, void *dev_id)
        ha = dev_id;
        reg = &ha->iobase->isp24;
-        spin_lock(&ha->hardware_lock);
+        spin_lock_irq(&ha->hardware_lock);
        qla24xx_process_response_queue(ha);
        WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
-        spin_unlock(&ha->hardware_lock);
+        spin_unlock_irq(&ha->hardware_lock);
        return IRQ_HANDLED;
 }
@@ -1663,7 +1628,7 @@ qla24xx_msix_default(int irq, void *dev_id)
        reg = &ha->iobase->isp24;
        status = 0;
-        spin_lock(&ha->hardware_lock);
+        spin_lock_irq(&ha->hardware_lock);
        do {
                stat = RD_REG_DWORD(&reg->host_status);
                if (stat & HSRX_RISC_PAUSED) {
@@ -1716,7 +1681,7 @@ qla24xx_msix_default(int irq, void *dev_id)
                }
                WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
        } while (0);
-        spin_unlock(&ha->hardware_lock);
+        spin_unlock_irq(&ha->hardware_lock);
        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
            (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 210060420809..250d2f604397 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -2303,8 +2303,6 @@ qla24xx_lun_reset(struct fc_port *fcport, unsigned int l)
        return __qla24xx_issue_tmf("Lun", TCF_LUN_RESET, fcport, l);
 }
-#if 0
 int
 qla2x00_system_error(scsi_qla_host_t *ha)
 {
@@ -2312,7 +2310,7 @@ qla2x00_system_error(scsi_qla_host_t *ha)
        mbx_cmd_t mc;
        mbx_cmd_t *mcp = &mc;
-        if (!IS_FWI2_CAPABLE(ha))
+        if (!IS_QLA23XX(ha) && !IS_FWI2_CAPABLE(ha))
                return QLA_FUNCTION_FAILED;
        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no));
@@ -2334,8 +2332,6 @@ qla2x00_system_error(scsi_qla_host_t *ha)
        return rval;
 }
-#endif  /*  0  */
 /**
 * qla2x00_set_serdes_params() -
 * @ha: HA context
@@ -2508,7 +2504,7 @@ qla2x00_enable_fce_trace(scsi_qla_host_t *ha, dma_addr_t fce_dma,
                if (mb)
                        memcpy(mb, mcp->mb, 8 * sizeof(*mb));
                if (dwords)
-                        *dwords = mcp->mb[6];
+                        *dwords = buffers;
        }
        return rval;
@@ -2807,9 +2803,9 @@ qla24xx_control_vp(scsi_qla_host_t *vha, int cmd)
         */
        map = (vp_index - 1) / 8;
        pos = (vp_index - 1) & 7;
-        down(&ha->vport_sem);
+        mutex_lock(&ha->vport_lock);
        vce->vp_idx_map[map] |= 1 << pos;
-        up(&ha->vport_sem);
+        mutex_unlock(&ha->vport_lock);
        rval = qla2x00_issue_iocb(ha, vce, vce_dma, 0);
        if (rval != QLA_SUCCESS) {
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index f2b04979e5f0..62a3ad6e8ecb 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -32,12 +32,12 @@ qla24xx_allocate_vp_id(scsi_qla_host_t *vha)
        scsi_qla_host_t *ha = vha->parent;
        /* Find an empty slot and assign an vp_id */
-        down(&ha->vport_sem);
+        mutex_lock(&ha->vport_lock);
        vp_id = find_first_zero_bit(ha->vp_idx_map, ha->max_npiv_vports + 1);
        if (vp_id > ha->max_npiv_vports) {
                DEBUG15(printk ("vp_id %d is bigger than max-supported %d.\n",
                    vp_id, ha->max_npiv_vports));
-                up(&ha->vport_sem);
+                mutex_unlock(&ha->vport_lock);
                return vp_id;
        }
@@ -45,7 +45,7 @@ qla24xx_allocate_vp_id(scsi_qla_host_t *vha)
        ha->num_vhosts++;
        vha->vp_idx = vp_id;
        list_add_tail(&vha->vp_list, &ha->vp_list);
-        up(&ha->vport_sem);
+        mutex_unlock(&ha->vport_lock);
        return vp_id;
 }
@@ -55,12 +55,12 @@ qla24xx_deallocate_vp_id(scsi_qla_host_t *vha)
        uint16_t vp_id;
        scsi_qla_host_t *ha = vha->parent;
-        down(&ha->vport_sem);
+        mutex_lock(&ha->vport_lock);
        vp_id = vha->vp_idx;
        ha->num_vhosts--;
        clear_bit(vp_id, ha->vp_idx_map);
        list_del(&vha->vp_list);
-        up(&ha->vport_sem);
+        mutex_unlock(&ha->vport_lock);
 }
 static scsi_qla_host_t *
@@ -145,9 +145,9 @@ qla24xx_enable_vp(scsi_qla_host_t *vha)
        }
        /* Initialize the new vport unless it is a persistent port */
-        down(&ha->vport_sem);
+        mutex_lock(&ha->vport_lock);
        ret = qla24xx_modify_vp_config(vha);
-        up(&ha->vport_sem);
+        mutex_unlock(&ha->vport_lock);
        if (ret != QLA_SUCCESS) {
                fc_vport_set_state(vha->fc_vport, FC_VPORT_FAILED);
@@ -406,6 +406,7 @@ qla24xx_create_vhost(struct fc_vport *fc_vport)
        INIT_LIST_HEAD(&vha->list);
        INIT_LIST_HEAD(&vha->fcports);
        INIT_LIST_HEAD(&vha->vp_fcports);
+        INIT_LIST_HEAD(&vha->work_list);
        vha->dpc_flags = 0L;
        set_bit(REGISTER_FDMI_NEEDED, &vha->dpc_flags);
@@ -437,10 +438,10 @@ qla24xx_create_vhost(struct fc_vport *fc_vport)
        vha->flags.init_done = 1;
        num_hosts++;
-        down(&ha->vport_sem);
+        mutex_lock(&ha->vport_lock);
        set_bit(vha->vp_idx, ha->vp_idx_map);
        ha->cur_vport_count++;
-        up(&ha->vport_sem);
+        mutex_unlock(&ha->vport_lock);
        return vha;
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 3223fd16bcfe..48eaa3bb5433 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -10,6 +10,7 @@
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
 #include <linux/kthread.h>
+#include <linux/mutex.h>
 #include <scsi/scsi_tcq.h>
 #include <scsi/scsicam.h>
@@ -1631,7 +1632,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        /* load the F/W, read paramaters, and init the H/W */
        ha->instance = num_hosts;
-        init_MUTEX(&ha->vport_sem);
+        mutex_init(&ha->vport_lock);
        init_completion(&ha->mbx_cmd_comp);
        complete(&ha->mbx_cmd_comp);
        init_completion(&ha->mbx_intr_comp);
@@ -2156,13 +2157,14 @@ static int
 qla2x00_post_work(struct scsi_qla_host *ha, struct qla_work_evt *e, int locked)
 {
        unsigned long flags;
+        scsi_qla_host_t *pha = to_qla_parent(ha);
        if (!locked)
-                spin_lock_irqsave(&ha->hardware_lock, flags);
+                spin_lock_irqsave(&pha->hardware_lock, flags);
        list_add_tail(&e->list, &ha->work_list);
        qla2xxx_wake_dpc(ha);
        if (!locked)
-                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                spin_unlock_irqrestore(&pha->hardware_lock, flags);
        return QLA_SUCCESS;
 }
@@ -2202,12 +2204,13 @@ static void
 qla2x00_do_work(struct scsi_qla_host *ha)
 {
        struct qla_work_evt *e;
+        scsi_qla_host_t *pha = to_qla_parent(ha);
-        spin_lock_irq(&ha->hardware_lock);
+        spin_lock_irq(&pha->hardware_lock);
        while (!list_empty(&ha->work_list)) {
                e = list_entry(ha->work_list.next, struct qla_work_evt, list);
                list_del_init(&e->list);
-                spin_unlock_irq(&ha->hardware_lock);
+                spin_unlock_irq(&pha->hardware_lock);
                switch (e->type) {
                case QLA_EVT_AEN:
@@ -2221,9 +2224,9 @@ qla2x00_do_work(struct scsi_qla_host *ha)
                }
                if (e->flags & QLA_EVT_FLAG_FREE)
                        kfree(e);
-                spin_lock_irq(&ha->hardware_lock);
+                spin_lock_irq(&pha->hardware_lock);
        }
-        spin_unlock_irq(&ha->hardware_lock);
+        spin_unlock_irq(&pha->hardware_lock);
 }
 /**************************************************************************
@@ -2634,7 +2637,7 @@ qla2x00_timer(scsi_qla_host_t *ha)
 #define FW_FILE_ISP24XX "ql2400_fw.bin"
 #define FW_FILE_ISP25XX "ql2500_fw.bin"
-static DECLARE_MUTEX(qla_fw_lock);
+static DEFINE_MUTEX(qla_fw_lock);
 static struct fw_blob qla_fw_blobs[FW_BLOBS] = {
        { .name = FW_FILE_ISP21XX, .segs = { 0x1000, 0 }, },
@@ -2665,7 +2668,7 @@ qla2x00_request_firmware(scsi_qla_host_t *ha)
                blob = &qla_fw_blobs[FW_ISP25XX];
        }
-        down(&qla_fw_lock);
+        mutex_lock(&qla_fw_lock);
        if (blob->fw)
                goto out;
@@ -2678,7 +2681,7 @@ qla2x00_request_firmware(scsi_qla_host_t *ha)
        }
 out:
-        up(&qla_fw_lock);
+        mutex_unlock(&qla_fw_lock);
        return blob;
 }
@@ -2687,11 +2690,11 @@ qla2x00_release_firmware(void)
 {
        int idx;
-        down(&qla_fw_lock);
+        mutex_lock(&qla_fw_lock);
        for (idx = 0; idx < FW_BLOBS; idx++)
                if (qla_fw_blobs[idx].fw)
                        release_firmware(qla_fw_blobs[idx].fw);
-        up(&qla_fw_lock);
+        mutex_unlock(&qla_fw_lock);
 }
 static pci_ers_result_t
@@ -2864,7 +2867,8 @@ qla2x00_module_init(void)
                return -ENODEV;
        }
-        printk(KERN_INFO "QLogic Fibre Channel HBA Driver\n");
+        printk(KERN_INFO "QLogic Fibre Channel HBA Driver: %s\n",
+            qla2x00_version_str);
        ret = pci_register_driver(&qla2xxx_pci_driver);
        if (ret) {
                kmem_cache_destroy(srb_cachep);
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index afeae2bfe7eb..d058c8862b35 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
 * Driver version
 */
-#define QLA2XXX_VERSION      "8.02.01-k2"
+#define QLA2XXX_VERSION      "8.02.01-k4"
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    2
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 049103f1d16f..93d2b6714453 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -359,7 +359,12 @@ static int scsi_bus_match(struct device *dev, struct device_driver *gendrv)
 static int scsi_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
 {
-        struct scsi_device *sdev = to_scsi_device(dev);
+        struct scsi_device *sdev;
+        if (dev->type != &scsi_dev_type)
+                return 0;
+        sdev = to_scsi_device(dev);
        add_uevent_var(env, "MODALIAS=" SCSI_DEVICE_MODALIAS_FMT, sdev->type);
        return 0;
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 1400ea6a2491..1bc00b721e9d 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -43,7 +43,6 @@
 #include <asm/io.h>
 #include <asm/irq.h>
-#include <asm/serial.h>
 #include "8250.h"
@@ -93,6 +92,7 @@ static unsigned int nr_uarts = CONFIG_SERIAL_8250_RUNTIME_UARTS;
 */
 #define CONFIG_HUB6 1
+#include <asm/serial.h>
 /*
 * SERIAL_PORT_DFNS tells us about built-in ports that have no
 * standard enumeration mechanism.   Platforms that can find all
@@ -1547,8 +1547,6 @@ static int serial_link_irq_chain(struct uart_8250_port *up)
                i->head = &up->list;
                spin_unlock_irq(&i->lock);
-                irq_flags |= SERIAL_EXTRA_IRQ_FLAGS;
                ret = request_irq(up->port.irq, serial8250_interrupt,
                                  irq_flags, "serial", i);
                if (ret < 0)
diff --git a/drivers/serial/8250.h b/drivers/serial/8250.h
index a10a40cc0d9e..91bd28f2bb47 100644
--- a/drivers/serial/8250.h
+++ b/drivers/serial/8250.h
@@ -78,8 +78,3 @@ struct serial8250_config {
 #else
 #define ALPHA_KLUDGE_MCR 0
 #endif
-#ifndef SERIAL_EXTRA_IRQ_FLAGS
-#define SERIAL_EXTRA_IRQ_FLAGS 0
-#endif
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index 53fa19cf2f06..788c3559522d 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -2602,7 +2602,12 @@ static struct pci_device_id serial_pci_tbl[] = {
        {       PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS200,
                PCI_ANY_ID, PCI_ANY_ID, 0, 0,   /* 135a.0811 */
                pbn_b2_2_115200 },
+        /*
+         * IntaShield IS-400
+         */
+        {       PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS400,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,    /* 135a.0dc0 */
+                pbn_b2_4_115200 },
        /*
         * Perle PCI-RAS cards
         */
diff --git a/drivers/serial/atmel_serial.c b/drivers/serial/atmel_serial.c
index c065a704a93a..42be8b01a40f 100644
--- a/drivers/serial/atmel_serial.c
+++ b/drivers/serial/atmel_serial.c
@@ -1318,7 +1318,7 @@ static void __init atmel_console_get_options(struct uart_port *port, int *baud,
         * If the baud rate generator isn't running, the port wasn't
         * initialized by the boot loader.
         */
-        quot = UART_GET_BRGR(port);
+        quot = UART_GET_BRGR(port) & ATMEL_US_CD;
        if (!quot)
                return;
diff --git a/drivers/serial/bfin_5xx.c b/drivers/serial/bfin_5xx.c
index d6b4ead693b7..f20952c43cb8 100644
--- a/drivers/serial/bfin_5xx.c
+++ b/drivers/serial/bfin_5xx.c
@@ -530,11 +530,7 @@ static unsigned int bfin_serial_get_mctrl(struct uart_port *port)
        if (uart->cts_pin < 0)
                return TIOCM_CTS | TIOCM_DSR | TIOCM_CAR;
-# ifdef BF54x
+        if (UART_GET_CTS(uart))
-        if (UART_GET_MSR(uart) & CTS)
-# else
-        if (gpio_get_value(uart->cts_pin))
-# endif
                return TIOCM_DSR | TIOCM_CAR;
        else
 #endif
@@ -549,17 +545,9 @@ static void bfin_serial_set_mctrl(struct uart_port *port, unsigned int mctrl)
                return;
        if (mctrl & TIOCM_RTS)
-# ifdef BF54x
+                UART_CLEAR_RTS(uart);
-                UART_PUT_MCR(uart, UART_GET_MCR(uart) & ~MRTS);
-# else
-                gpio_set_value(uart->rts_pin, 0);
-# endif
        else
-# ifdef BF54x
+                UART_SET_RTS(uart);
-                UART_PUT_MCR(uart, UART_GET_MCR(uart) | MRTS);
-# else
-                gpio_set_value(uart->rts_pin, 1);
-# endif
 #endif
 }
@@ -752,11 +740,7 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
        /* Disable UART */
        ier = UART_GET_IER(uart);
-#ifdef CONFIG_BF54x
+        UART_DISABLE_INTS(uart);
-        UART_CLEAR_IER(uart, 0xF);
-#else
-        UART_PUT_IER(uart, 0);
-#endif
        /* Set DLAB in LCR to Access DLL and DLH */
        UART_SET_DLAB(uart);
@@ -771,11 +755,7 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
        UART_PUT_LCR(uart, lcr);
        /* Enable UART */
-#ifdef CONFIG_BF54x
+        UART_ENABLE_INTS(uart, ier);
-        UART_SET_IER(uart, ier);
-#else
-        UART_PUT_IER(uart, ier);
-#endif
        val = UART_GET_GCTL(uart);
        val |= UCEN;
@@ -833,15 +813,15 @@ bfin_serial_verify_port(struct uart_port *port, struct serial_struct *ser)
 * Enable the IrDA function if tty->ldisc.num is N_IRDA.
 * In other cases, disable IrDA function.
 */
-static void bfin_set_ldisc(struct tty_struct *tty)
+static void bfin_serial_set_ldisc(struct uart_port *port)
 {
-        int line = tty->index;
+        int line = port->line;
        unsigned short val;
-        if (line >= tty->driver->num)
+        if (line >= port->info->tty->driver->num)
                return;
-        switch (tty->ldisc.num) {
+        switch (port->info->tty->ldisc.num) {
        case N_IRDA:
                val = UART_GET_GCTL(&bfin_serial_ports[line]);
                val |= (IREN | RPOLC);
@@ -866,6 +846,7 @@ static struct uart_ops bfin_serial_pops = {
        .startup        = bfin_serial_startup,
        .shutdown       = bfin_serial_shutdown,
        .set_termios    = bfin_serial_set_termios,
+        .set_ldisc      = bfin_serial_set_ldisc,
        .type           = bfin_serial_type,
        .release_port   = bfin_serial_release_port,
        .request_port   = bfin_serial_request_port,
@@ -1206,7 +1187,6 @@ static int __init bfin_serial_init(void)
        ret = uart_register_driver(&bfin_serial_reg);
        if (ret == 0) {
-                bfin_serial_reg.tty_driver->set_ldisc = bfin_set_ldisc;
                ret = platform_driver_register(&bfin_serial_driver);
                if (ret) {
                        pr_debug("uart register failed\n");
diff --git a/drivers/serial/sb1250-duart.c b/drivers/serial/sb1250-duart.c
index 2d6c08b3dbcf..f8e1447a022a 100644
--- a/drivers/serial/sb1250-duart.c
+++ b/drivers/serial/sb1250-duart.c
@@ -924,7 +924,7 @@ console_initcall(sbd_serial_console_init);
 static struct uart_driver sbd_reg = {
        .owner          = THIS_MODULE,
-        .driver_name    = "serial",
+        .driver_name    = "sb1250_duart",
        .dev_name       = "duart",
        .major          = TTY_MAJOR,
        .minor          = SB1250_DUART_MINOR_BASE,
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index eab032733790..c9b64e73c987 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -1165,6 +1165,15 @@ out:
        return ret;
 }
+static void uart_set_ldisc(struct tty_struct *tty)
+{
+        struct uart_state *state = tty->driver_data;
+        struct uart_port *port = state->port;
+        if (port->ops->set_ldisc)
+                port->ops->set_ldisc(port);
+}
 static void uart_set_termios(struct tty_struct *tty,
                                                struct ktermios *old_termios)
 {
@@ -2054,6 +2063,8 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *port)
 int uart_resume_port(struct uart_driver *drv, struct uart_port *port)
 {
        struct uart_state *state = drv->state + port->line;
+        struct device *tty_dev;
+        struct uart_match match = {port, drv};
        mutex_lock(&state->mutex);
@@ -2063,7 +2074,8 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *port)
                return 0;
        }
-        if (!port->suspended) {
+        tty_dev = device_find_child(port->dev, &match, serial_match_port);
+        if (!port->suspended && device_may_wakeup(tty_dev)) {
                disable_irq_wake(port->irq);
                mutex_unlock(&state->mutex);
                return 0;
@@ -2285,6 +2297,7 @@ static const struct tty_operations uart_ops = {
        .unthrottle     = uart_unthrottle,
        .send_xchar     = uart_send_xchar,
        .set_termios    = uart_set_termios,
+        .set_ldisc      = uart_set_ldisc,
        .stop           = uart_stop,
        .start          = uart_start,
        .hangup         = uart_hangup,
diff --git a/drivers/serial/ucc_uart.c b/drivers/serial/ucc_uart.c
index 01917c433f17..566a8b42e05a 100644
--- a/drivers/serial/ucc_uart.c
+++ b/drivers/serial/ucc_uart.c
@@ -195,7 +195,7 @@ struct uart_qe_port {
 static struct uart_driver ucc_uart_driver = {
        .owner          = THIS_MODULE,
-        .driver_name    = "serial",
+        .driver_name    = "ucc_uart",
        .dev_name       = "ttyQE",
        .major          = SERIAL_QE_MAJOR,
        .minor          = SERIAL_QE_MINOR,
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index b3518ca9f04e..799337f7fde1 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -25,6 +25,7 @@
 #include <linux/ioctl.h>
 #include <linux/fs.h>
 #include <linux/device.h>
+#include <linux/err.h>
 #include <linux/list.h>
 #include <linux/errno.h>
 #include <linux/mutex.h>
@@ -67,10 +68,12 @@ static unsigned long	minors[N_SPI_MINORS / BITS_PER_LONG];
                                | SPI_LSB_FIRST | SPI_3WIRE | SPI_LOOP)
 struct spidev_data {
-        struct device           dev;
+        dev_t                   devt;
+        spinlock_t              spi_lock;
        struct spi_device       *spi;
        struct list_head        device_entry;
+        /* buffer is NULL unless this device is open (users > 0) */
        struct mutex            buf_lock;
        unsigned                users;
        u8                      *buffer;
@@ -85,12 +88,75 @@ MODULE_PARM_DESC(bufsiz, "data bytes in biggest supported SPI message");
 /*-------------------------------------------------------------------------*/
+/*
+ * We can't use the standard synchronous wrappers for file I/O; we
+ * need to protect against async removal of the underlying spi_device.
+ */
+static void spidev_complete(void *arg)
+{
+        complete(arg);
+}
+static ssize_t
+spidev_sync(struct spidev_data *spidev, struct spi_message *message)
+{
+        DECLARE_COMPLETION_ONSTACK(done);
+        int status;
+        message->complete = spidev_complete;
+        message->context = &done;
+        spin_lock_irq(&spidev->spi_lock);
+        if (spidev->spi == NULL)
+                status = -ESHUTDOWN;
+        else
+                status = spi_async(spidev->spi, message);
+        spin_unlock_irq(&spidev->spi_lock);
+        if (status == 0) {
+                wait_for_completion(&done);
+                status = message->status;
+                if (status == 0)
+                        status = message->actual_length;
+        }
+        return status;
+}
+static inline ssize_t
+spidev_sync_write(struct spidev_data *spidev, size_t len)
+{
+        struct spi_transfer     t = {
+                        .tx_buf         = spidev->buffer,
+                        .len            = len,
+                };
+        struct spi_message      m;
+        spi_message_init(&m);
+        spi_message_add_tail(&t, &m);
+        return spidev_sync(spidev, &m);
+}
+static inline ssize_t
+spidev_sync_read(struct spidev_data *spidev, size_t len)
+{
+        struct spi_transfer     t = {
+                        .rx_buf         = spidev->buffer,
+                        .len            = len,
+                };
+        struct spi_message      m;
+        spi_message_init(&m);
+        spi_message_add_tail(&t, &m);
+        return spidev_sync(spidev, &m);
+}
+/*-------------------------------------------------------------------------*/
 /* Read-only message with current device setup */
 static ssize_t
 spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
 {
        struct spidev_data      *spidev;
-        struct spi_device       *spi;
        ssize_t                 status = 0;
        /* chipselect only toggles at start or end of operation */
@@ -98,10 +164,9 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
                return -EMSGSIZE;
        spidev = filp->private_data;
-        spi = spidev->spi;
        mutex_lock(&spidev->buf_lock);
-        status = spi_read(spi, spidev->buffer, count);
+        status = spidev_sync_read(spidev, count);
        if (status == 0) {
                unsigned long   missing;
@@ -122,7 +187,6 @@ spidev_write(struct file *filp, const char __user *buf,
                size_t count, loff_t *f_pos)
 {
        struct spidev_data      *spidev;
-        struct spi_device       *spi;
        ssize_t                 status = 0;
        unsigned long           missing;
@@ -131,12 +195,11 @@ spidev_write(struct file *filp, const char __user *buf,
                return -EMSGSIZE;
        spidev = filp->private_data;
-        spi = spidev->spi;
        mutex_lock(&spidev->buf_lock);
        missing = copy_from_user(spidev->buffer, buf, count);
        if (missing == 0) {
-                status = spi_write(spi, spidev->buffer, count);
+                status = spidev_sync_write(spidev, count);
                if (status == 0)
                        status = count;
        } else
@@ -153,7 +216,6 @@ static int spidev_message(struct spidev_data *spidev,
        struct spi_transfer     *k_xfers;
        struct spi_transfer     *k_tmp;
        struct spi_ioc_transfer *u_tmp;
-        struct spi_device       *spi = spidev->spi;
        unsigned                n, total;
        u8                      *buf;
        int                     status = -EFAULT;
@@ -215,7 +277,7 @@ static int spidev_message(struct spidev_data *spidev,
                spi_message_add_tail(k_tmp, &msg);
        }
-        status = spi_sync(spi, &msg);
+        status = spidev_sync(spidev, &msg);
        if (status < 0)
                goto done;
@@ -269,8 +331,16 @@ spidev_ioctl(struct inode *inode, struct file *filp,
        if (err)
                return -EFAULT;
+        /* guard against device removal before, or while,
+         * we issue this ioctl.
+         */
        spidev = filp->private_data;
-        spi = spidev->spi;
+        spin_lock_irq(&spidev->spi_lock);
+        spi = spi_dev_get(spidev->spi);
+        spin_unlock_irq(&spidev->spi_lock);
+        if (spi == NULL)
+                return -ESHUTDOWN;
        switch (cmd) {
        /* read requests */
@@ -356,8 +426,10 @@ spidev_ioctl(struct inode *inode, struct file *filp,
        default:
                /* segmented and/or full-duplex I/O request */
                if (_IOC_NR(cmd) != _IOC_NR(SPI_IOC_MESSAGE(0))
-                                || _IOC_DIR(cmd) != _IOC_WRITE)
+                                || _IOC_DIR(cmd) != _IOC_WRITE) {
-                        return -ENOTTY;
+                        retval = -ENOTTY;
+                        break;
+                }
                tmp = _IOC_SIZE(cmd);
                if ((tmp % sizeof(struct spi_ioc_transfer)) != 0) {
@@ -385,6 +457,7 @@ spidev_ioctl(struct inode *inode, struct file *filp,
                kfree(ioc);
                break;
        }
+        spi_dev_put(spi);
        return retval;
 }
@@ -396,7 +469,7 @@ static int spidev_open(struct inode *inode, struct file *filp)
        mutex_lock(&device_list_lock);
        list_for_each_entry(spidev, &device_list, device_entry) {
-                if (spidev->dev.devt == inode->i_rdev) {
+                if (spidev->devt == inode->i_rdev) {
                        status = 0;
                        break;
                }
@@ -429,10 +502,22 @@ static int spidev_release(struct inode *inode, struct file *filp)
        mutex_lock(&device_list_lock);
        spidev = filp->private_data;
        filp->private_data = NULL;
+        /* last close? */
        spidev->users--;
        if (!spidev->users) {
+                int             dofree;
                kfree(spidev->buffer);
                spidev->buffer = NULL;
+                /* ... after we unbound from the underlying device? */
+                spin_lock_irq(&spidev->spi_lock);
+                dofree = (spidev->spi == NULL);
+                spin_unlock_irq(&spidev->spi_lock);
+                if (dofree)
+                        kfree(spidev);
        }
        mutex_unlock(&device_list_lock);
@@ -459,19 +544,7 @@ static struct file_operations spidev_fops = {
 * It also simplifies memory management.
 */
-static void spidev_classdev_release(struct device *dev)
+static struct class *spidev_class;
-{
-        struct spidev_data      *spidev;
-        spidev = container_of(dev, struct spidev_data, dev);
-        kfree(spidev);
-}
-static struct class spidev_class = {
-        .name           = "spidev",
-        .owner          = THIS_MODULE,
-        .dev_release    = spidev_classdev_release,
-};
 /*-------------------------------------------------------------------------*/
@@ -488,6 +561,7 @@ static int spidev_probe(struct spi_device *spi)
        /* Initialize the driver data */
        spidev->spi = spi;
+        spin_lock_init(&spidev->spi_lock);
        mutex_init(&spidev->buf_lock);
        INIT_LIST_HEAD(&spidev->device_entry);
@@ -498,20 +572,20 @@ static int spidev_probe(struct spi_device *spi)
        mutex_lock(&device_list_lock);
        minor = find_first_zero_bit(minors, N_SPI_MINORS);
        if (minor < N_SPI_MINORS) {
-                spidev->dev.parent = &spi->dev;
+                struct device *dev;
-                spidev->dev.class = &spidev_class;
-                spidev->dev.devt = MKDEV(SPIDEV_MAJOR, minor);
+                spidev->devt = MKDEV(SPIDEV_MAJOR, minor);
-                snprintf(spidev->dev.bus_id, sizeof spidev->dev.bus_id,
+                dev = device_create(spidev_class, &spi->dev, spidev->devt,
                                "spidev%d.%d",
                                spi->master->bus_num, spi->chip_select);
-                status = device_register(&spidev->dev);
+                status = IS_ERR(dev) ? PTR_ERR(dev) : 0;
        } else {
                dev_dbg(&spi->dev, "no minor number available!\n");
                status = -ENODEV;
        }
        if (status == 0) {
                set_bit(minor, minors);
-                dev_set_drvdata(&spi->dev, spidev);
+                spi_set_drvdata(spi, spidev);
                list_add(&spidev->device_entry, &device_list);
        }
        mutex_unlock(&device_list_lock);
@@ -524,15 +598,21 @@ static int spidev_probe(struct spi_device *spi)
 static int spidev_remove(struct spi_device *spi)
 {
-        struct spidev_data      *spidev = dev_get_drvdata(&spi->dev);
+        struct spidev_data      *spidev = spi_get_drvdata(spi);
-        mutex_lock(&device_list_lock);
+        /* make sure ops on existing fds can abort cleanly */
+        spin_lock_irq(&spidev->spi_lock);
+        spidev->spi = NULL;
+        spi_set_drvdata(spi, NULL);
+        spin_unlock_irq(&spidev->spi_lock);
+        /* prevent new opens */
+        mutex_lock(&device_list_lock);
        list_del(&spidev->device_entry);
-        dev_set_drvdata(&spi->dev, NULL);
+        device_destroy(spidev_class, spidev->devt);
-        clear_bit(MINOR(spidev->dev.devt), minors);
+        clear_bit(MINOR(spidev->devt), minors);
-        device_unregister(&spidev->dev);
+        if (spidev->users == 0)
+                kfree(spidev);
        mutex_unlock(&device_list_lock);
        return 0;
@@ -568,15 +648,15 @@ static int __init spidev_init(void)
        if (status < 0)
                return status;
-        status = class_register(&spidev_class);
+        spidev_class = class_create(THIS_MODULE, "spidev");
-        if (status < 0) {
+        if (IS_ERR(spidev_class)) {
                unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name);
-                return status;
+                return PTR_ERR(spidev_class);
        }
        status = spi_register_driver(&spidev_spi);
        if (status < 0) {
-                class_unregister(&spidev_class);
+                class_destroy(spidev_class);
                unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name);
        }
        return status;
@@ -586,7 +666,7 @@ module_init(spidev_init);
 static void __exit spidev_exit(void)
 {
        spi_unregister_driver(&spidev_spi);
-        class_unregister(&spidev_class);
+        class_destroy(spidev_class);
        unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name);
 }
 module_exit(spidev_exit);
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 75def13e797d..d28c53868093 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -537,12 +537,12 @@ int ssb_pcicore_dev_irqvecs_enable(struct ssb_pcicore *pc,
        int err = 0;
        u32 tmp;
-        might_sleep();
        if (!pdev)
                goto out;
        bus = pdev->bus;
+        might_sleep_if(pdev->id.coreid != SSB_DEV_PCI);
        /* Enable interrupts for this device. */
        if (bus->host_pci &&
            ((pdev->id.revision >= 6) || (pdev->id.coreid == SSB_DEV_PCIE))) {
diff --git a/drivers/usb/c67x00/c67x00-ll-hpi.c b/drivers/usb/c67x00/c67x00-ll-hpi.c
index 5100fbbf6cb0..a9636f43bca2 100644
--- a/drivers/usb/c67x00/c67x00-ll-hpi.c
+++ b/drivers/usb/c67x00/c67x00-ll-hpi.c
@@ -120,7 +120,7 @@ static void hpi_write_word(struct c67x00_device *dev, u16 reg, u16 value)
 * Only data is little endian, addr has cpu endianess
 */
 static void hpi_write_words_le16(struct c67x00_device *dev, u16 addr,
-                                 u16 *data, u16 count)
+                                 __le16 *data, u16 count)
 {
        unsigned long flags;
        int i;
@@ -129,7 +129,7 @@ static void hpi_write_words_le16(struct c67x00_device *dev, u16 addr,
        hpi_write_reg(dev, HPI_ADDR, addr);
        for (i = 0; i < count; i++)
-                hpi_write_reg(dev, HPI_DATA, cpu_to_le16(*data++));
+                hpi_write_reg(dev, HPI_DATA, le16_to_cpu(*data++));
        spin_unlock_irqrestore(&dev->hpi.lock, flags);
 }
@@ -138,7 +138,7 @@ static void hpi_write_words_le16(struct c67x00_device *dev, u16 addr,
 * Only data is little endian, addr has cpu endianess
 */
 static void hpi_read_words_le16(struct c67x00_device *dev, u16 addr,
-                                u16 *data, u16 count)
+                                __le16 *data, u16 count)
 {
        unsigned long flags;
        int i;
@@ -146,7 +146,7 @@ static void hpi_read_words_le16(struct c67x00_device *dev, u16 addr,
        spin_lock_irqsave(&dev->hpi.lock, flags);
        hpi_write_reg(dev, HPI_ADDR, addr);
        for (i = 0; i < count; i++)
-                *data++ = le16_to_cpu(hpi_read_reg(dev, HPI_DATA));
+                *data++ = cpu_to_le16(hpi_read_reg(dev, HPI_DATA));
        spin_unlock_irqrestore(&dev->hpi.lock, flags);
 }
@@ -425,7 +425,7 @@ void c67x00_ll_write_mem_le16(struct c67x00_device *dev, u16 addr,
                len--;
        }
-        hpi_write_words_le16(dev, addr, (u16 *)buf, len / 2);
+        hpi_write_words_le16(dev, addr, (__le16 *)buf, len / 2);
        buf += len & ~0x01;
        addr += len & ~0x01;
        len &= 0x01;
@@ -456,7 +456,7 @@ void c67x00_ll_read_mem_le16(struct c67x00_device *dev, u16 addr,
                len--;
        }
-        hpi_read_words_le16(dev, addr, (u16 *)buf, len / 2);
+        hpi_read_words_le16(dev, addr, (__le16 *)buf, len / 2);
        buf += len & ~0x01;
        addr += len & ~0x01;
        len &= 0x01;
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 107666d4e2ec..731db051070a 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -611,8 +611,8 @@ next_desc:
                goto err;
        }
-        desc->wMaxPacketSize = ep->wMaxPacketSize;
+        desc->wMaxPacketSize = le16_to_cpu(ep->wMaxPacketSize);
-        desc->bMaxPacketSize0 = cpu_to_le16(udev->descriptor.bMaxPacketSize0);
+        desc->bMaxPacketSize0 = udev->descriptor.bMaxPacketSize0;
        desc->orq = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
        if (!desc->orq)
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index c1cb94e9f242..7e912f21fd36 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -155,9 +155,6 @@ static int generic_probe(struct usb_device *udev)
 {
        int err, c;
-        /* put device-specific files into sysfs */
-        usb_create_sysfs_dev_files(udev);
        /* Choose and set the configuration.  This registers the interfaces
         * with the driver core and lets interface drivers bind to them.
         */
@@ -189,8 +186,6 @@ static void generic_disconnect(struct usb_device *udev)
         * unconfigure the device */
        if (udev->actconfig)
                usb_set_configuration(udev, -1);
-        usb_remove_sysfs_dev_files(udev);
 }
 #ifdef  CONFIG_PM
diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
index 1e4b81e9eb50..a0bf5df6cb6f 100644
--- a/drivers/usb/core/hcd.h
+++ b/drivers/usb/core/hcd.h
@@ -213,6 +213,8 @@ struct hc_driver {
                /* force handover of high-speed port to full-speed companion */
        void    (*relinquish_port)(struct usb_hcd *, int);
+                /* has a port been handed over to a companion? */
+        int     (*port_handed_over)(struct usb_hcd *, int);
 };
 extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index eb57fcc701d7..94789be54ca3 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -644,6 +644,48 @@ static void hub_stop(struct usb_hub *hub)
 #ifdef CONFIG_PM
+/* Try to identify which devices need USB-PERSIST handling */
+static int persistent_device(struct usb_device *udev)
+{
+        int i;
+        int retval;
+        struct usb_host_config *actconfig;
+        /* Explicitly not marked persistent? */
+        if (!udev->persist_enabled)
+                return 0;
+        /* No active config? */
+        actconfig = udev->actconfig;
+        if (!actconfig)
+                return 0;
+        /* FIXME! We should check whether it's open here or not! */
+        /*
+         * Check that all the interface drivers have a
+         * 'reset_resume' entrypoint
+         */
+        retval = 0;
+        for (i = 0; i < actconfig->desc.bNumInterfaces; i++) {
+                struct usb_interface *intf;
+                struct usb_driver *driver;
+                intf = actconfig->interface[i];
+                if (!intf->dev.driver)
+                        continue;
+                driver = to_usb_driver(intf->dev.driver);
+                if (!driver->reset_resume)
+                        return 0;
+                /*
+                 * We have at least one driver, and that one
+                 * has a reset_resume method.
+                 */
+                retval = 1;
+        }
+        return retval;
+}
 static void hub_restart(struct usb_hub *hub, int type)
 {
        struct usb_device *hdev = hub->hdev;
@@ -689,8 +731,8 @@ static void hub_restart(struct usb_hub *hub, int type)
                 * turn off the various status changes to prevent
                 * khubd from disconnecting it later.
                 */
-                if (udev->persist_enabled && status == 0 &&
+                if (status == 0 && !(portstatus & USB_PORT_STAT_ENABLE) &&
-                                !(portstatus & USB_PORT_STAT_ENABLE)) {
+                                persistent_device(udev)) {
                        if (portchange & USB_PORT_STAT_C_ENABLE)
                                clear_port_feature(hub->hdev, port1,
                                                USB_PORT_FEAT_C_ENABLE);
@@ -1326,6 +1368,12 @@ void usb_disconnect(struct usb_device **pdev)
        usb_unlock_device(udev);
+        /* Remove the device-specific files from sysfs.  This must be
+         * done with udev unlocked, because some of the attribute
+         * routines try to acquire the device lock.
+         */
+        usb_remove_sysfs_dev_files(udev);
        /* Unregister the device.  The device driver is responsible
         * for removing the device files from usbfs and sysfs and for
         * de-configuring the device.
@@ -1541,6 +1589,9 @@ int usb_new_device(struct usb_device *udev)
                goto fail;
        }
+        /* put device-specific files into sysfs */
+        usb_create_sysfs_dev_files(udev);
        /* Tell the world! */
        announce_device(udev);
        return err;
@@ -2744,7 +2795,11 @@ loop:
                if ((status == -ENOTCONN) || (status == -ENOTSUPP))
                        break;
        }
-        dev_err(hub_dev, "unable to enumerate USB device on port %d\n", port1);
+        if (hub->hdev->parent ||
+                        !hcd->driver->port_handed_over ||
+                        !(hcd->driver->port_handed_over)(hcd, port1))
+                dev_err(hub_dev, "unable to enumerate USB device on port %d\n",
+                                port1);
 
 done:
        hub_port_disable(hub, port1, 1);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 2e2019390290..3da1ab4b389d 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -47,6 +47,10 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* Edirol SD-20 */
        { USB_DEVICE(0x0582, 0x0027), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* Avision AV600U */
+        { USB_DEVICE(0x0638, 0x0a13), .driver_info =
+          USB_QUIRK_STRING_FETCH_255 },
        /* M-Systems Flash Disk Pioneers */
        { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index c783cb111847..5e1f5d55bf04 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -588,35 +588,33 @@ read_descriptors(struct kobject *kobj, struct bin_attribute *attr,
                        container_of(kobj, struct device, kobj));
        size_t nleft = count;
        size_t srclen, n;
+        int cfgno;
+        void *src;
-        usb_lock_device(udev);
+        /* The binary attribute begins with the device descriptor.
+         * Following that are the raw descriptor entries for all the
-        /* The binary attribute begins with the device descriptor */
+         * configurations (config plus subsidiary descriptors).
-        srclen = sizeof(struct usb_device_descriptor);
-        if (off < srclen) {
-                n = min_t(size_t, nleft, srclen - off);
-                memcpy(buf, off + (char *) &udev->descriptor, n);
-                nleft -= n;
-                buf += n;
-                off = 0;
-        } else {
-                off -= srclen;
-        }
-        /* Then follows the raw descriptor entry for the current
-         * configuration (config plus subsidiary descriptors).
         */
-        if (udev->actconfig) {
+        for (cfgno = -1; cfgno < udev->descriptor.bNumConfigurations &&
-                int cfgno = udev->actconfig - udev->config;
+                        nleft > 0; ++cfgno) {
+                if (cfgno < 0) {
-                srclen = __le16_to_cpu(udev->actconfig->desc.wTotalLength);
+                        src = &udev->descriptor;
+                        srclen = sizeof(struct usb_device_descriptor);
+                } else {
+                        src = udev->rawdescriptors[cfgno];
+                        srclen = __le16_to_cpu(udev->config[cfgno].desc.
+                                        wTotalLength);
+                }
                if (off < srclen) {
-                        n = min_t(size_t, nleft, srclen - off);
+                        n = min(nleft, srclen - (size_t) off);
-                        memcpy(buf, off + udev->rawdescriptors[cfgno], n);
+                        memcpy(buf, src + off, n);
                        nleft -= n;
+                        buf += n;
+                        off = 0;
+                } else {
+                        off -= srclen;
                }
        }
-        usb_unlock_device(udev);
        return count - nleft;
 }
diff --git a/drivers/usb/gadget/fsl_usb2_udc.c b/drivers/usb/gadget/fsl_usb2_udc.c
index 651b82701394..18687543d7fa 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.c
+++ b/drivers/usb/gadget/fsl_usb2_udc.c
@@ -1627,7 +1627,9 @@ static int reset_queues(struct fsl_udc *udc)
                udc_reset_ep_queue(udc, pipe);
        /* report disconnect; the driver is already quiesced */
+        spin_unlock(&udc->lock);
        udc->driver->disconnect(&udc->gadget);
+        spin_lock(&udc->lock);
        return 0;
 }
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 1ef6df395e0c..228797e54f9c 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -300,8 +300,8 @@ config USB_R8A66597_HCD
          module will be called r8a66597-hcd.
 config SUPERH_ON_CHIP_R8A66597
-        boolean "Enable SuperH on-chip USB like the R8A66597"
+        boolean "Enable SuperH on-chip R8A66597 USB"
-        depends on USB_R8A66597_HCD && CPU_SUBTYPE_SH7366
+        depends on USB_R8A66597_HCD && (CPU_SUBTYPE_SH7366 || CPU_SUBTYPE_SH7723)
        help
-           Renesas SuperH processor has USB like the R8A66597.
+           This driver enables support for the on-chip R8A66597 in the
-           This driver supported processor is SH7366.
+           SH7366 and SH7723 processors.
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index 8b5f991e949c..08a4335401a9 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -223,6 +223,7 @@ static const struct hc_driver ehci_au1xxx_hc_driver = {
        .bus_suspend = ehci_bus_suspend,
        .bus_resume = ehci_bus_resume,
        .relinquish_port = ehci_relinquish_port,
+        .port_handed_over = ehci_port_handed_over,
 };
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 6d9bed6c1f48..7370d6187c64 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -269,7 +269,7 @@ static int ehci_fsl_setup(struct usb_hcd *hcd)
        if (retval)
                return retval;
-        ehci->is_tdi_rh_tt = 1;
+        hcd->has_tt = 1;
        ehci->sbrn = 0x20;
@@ -295,10 +295,6 @@ static const struct hc_driver ehci_fsl_hc_driver = {
         */
        .reset = ehci_fsl_setup,
        .start = ehci_run,
-#ifdef  CONFIG_PM
-        .suspend = ehci_bus_suspend,
-        .resume = ehci_bus_resume,
-#endif
        .stop = ehci_stop,
        .shutdown = ehci_shutdown,
@@ -322,6 +318,7 @@ static const struct hc_driver ehci_fsl_hc_driver = {
        .bus_suspend = ehci_bus_suspend,
        .bus_resume = ehci_bus_resume,
        .relinquish_port = ehci_relinquish_port,
+        .port_handed_over = ehci_port_handed_over,
 };
 static int ehci_fsl_drv_probe(struct platform_device *pdev)
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 382587c4457c..740835bb8575 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -609,7 +609,7 @@ static int ehci_hub_control (
                        }
                        break;
                case USB_PORT_FEAT_C_SUSPEND:
-                        /* we auto-clear this feature */
+                        clear_bit(wIndex, &ehci->port_c_suspend);
                        break;
                case USB_PORT_FEAT_POWER:
                        if (HCS_PPC (ehci->hcs_params))
@@ -688,7 +688,7 @@ static int ehci_hub_control (
                        /* resume completed? */
                        else if (time_after_eq(jiffies,
                                        ehci->reset_done[wIndex])) {
-                                status |= 1 << USB_PORT_FEAT_C_SUSPEND;
+                                set_bit(wIndex, &ehci->port_c_suspend);
                                ehci->reset_done[wIndex] = 0;
                                /* stop resume signaling */
@@ -765,6 +765,8 @@ static int ehci_hub_control (
                        status |= 1 << USB_PORT_FEAT_RESET;
                if (temp & PORT_POWER)
                        status |= 1 << USB_PORT_FEAT_POWER;
+                if (test_bit(wIndex, &ehci->port_c_suspend))
+                        status |= 1 << USB_PORT_FEAT_C_SUSPEND;
 #ifndef VERBOSE_DEBUG
        if (status & ~0xffff)   /* only if wPortChange is interesting */
@@ -875,3 +877,13 @@ static void ehci_relinquish_port(struct usb_hcd *hcd, int portnum)
        set_owner(ehci, --portnum, PORT_OWNER);
 }
+static int ehci_port_handed_over(struct usb_hcd *hcd, int portnum)
+{
+        struct ehci_hcd         *ehci = hcd_to_ehci(hcd);
+        u32 __iomem             *reg;
+        if (ehci_is_TDI(ehci))
+                return 0;
+        reg = &ehci->regs->port_status[portnum - 1];
+        return ehci_readl(ehci, reg) & PORT_OWNER;
+}
diff --git a/drivers/usb/host/ehci-ixp4xx.c b/drivers/usb/host/ehci-ixp4xx.c
index 601c8795a854..9d042f220097 100644
--- a/drivers/usb/host/ehci-ixp4xx.c
+++ b/drivers/usb/host/ehci-ixp4xx.c
@@ -26,7 +26,7 @@ static int ixp4xx_ehci_init(struct usb_hcd *hcd)
                + HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
        ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
-        ehci->is_tdi_rh_tt = 1;
+        hcd->has_tt = 1;
        ehci_reset(ehci);
        retval = ehci_init(hcd);
@@ -58,6 +58,8 @@ static const struct hc_driver ixp4xx_ehci_hc_driver = {
        .bus_suspend            = ehci_bus_suspend,
        .bus_resume             = ehci_bus_resume,
 #endif
+        .relinquish_port        = ehci_relinquish_port,
+        .port_handed_over       = ehci_port_handed_over,
 };
 static int ixp4xx_ehci_probe(struct platform_device *pdev)
diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c
index 3adfda813a7b..ab625f0ba1d9 100644
--- a/drivers/usb/host/ehci-orion.c
+++ b/drivers/usb/host/ehci-orion.c
@@ -139,10 +139,6 @@ static const struct hc_driver ehci_orion_hc_driver = {
         */
        .reset = ehci_orion_setup,
        .start = ehci_run,
-#ifdef CONFIG_PM
-        .suspend = ehci_bus_suspend,
-        .resume = ehci_bus_resume,
-#endif
        .stop = ehci_stop,
        .shutdown = ehci_shutdown,
@@ -165,6 +161,8 @@ static const struct hc_driver ehci_orion_hc_driver = {
        .hub_control = ehci_hub_control,
        .bus_suspend = ehci_bus_suspend,
        .bus_resume = ehci_bus_resume,
+        .relinquish_port = ehci_relinquish_port,
+        .port_handed_over = ehci_port_handed_over,
 };
 static void __init
@@ -250,7 +248,7 @@ static int __init ehci_orion_drv_probe(struct platform_device *pdev)
        ehci->regs = hcd->regs + 0x100 +
                HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
        ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
-        ehci->is_tdi_rh_tt = 1;
+        hcd->has_tt = 1;
        ehci->sbrn = 0x20;
        /*
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 5bb7f6bb13f3..c46a58f9181d 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -129,7 +129,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
        switch (pdev->vendor) {
        case PCI_VENDOR_ID_TDI:
                if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
-                        ehci->is_tdi_rh_tt = 1;
                        hcd->has_tt = 1;
                        tdi_reset(ehci);
                }
@@ -379,7 +378,8 @@ static const struct hc_driver ehci_pci_hc_driver = {
        .hub_control =          ehci_hub_control,
        .bus_suspend =          ehci_bus_suspend,
        .bus_resume =           ehci_bus_resume,
-        .relinquish_port =      ehci_relinquish_port,
+        .relinquish_port =      ehci_relinquish_port,
+        .port_handed_over =     ehci_port_handed_over,
 };
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci-ppc-of.c b/drivers/usb/host/ehci-ppc-of.c
index ee305b1f99ff..b018deed2e8f 100644
--- a/drivers/usb/host/ehci-ppc-of.c
+++ b/drivers/usb/host/ehci-ppc-of.c
@@ -76,6 +76,8 @@ static const struct hc_driver ehci_ppc_of_hc_driver = {
        .bus_suspend            = ehci_bus_suspend,
        .bus_resume             = ehci_bus_resume,
 #endif
+        .relinquish_port        = ehci_relinquish_port,
+        .port_handed_over       = ehci_port_handed_over,
 };
diff --git a/drivers/usb/host/ehci-ppc-soc.c b/drivers/usb/host/ehci-ppc-soc.c
index 6c76036783a1..529590eb4037 100644
--- a/drivers/usb/host/ehci-ppc-soc.c
+++ b/drivers/usb/host/ehci-ppc-soc.c
@@ -163,6 +163,7 @@ static const struct hc_driver ehci_ppc_soc_hc_driver = {
        .bus_suspend = ehci_bus_suspend,
        .bus_resume = ehci_bus_resume,
        .relinquish_port = ehci_relinquish_port,
+        .port_handed_over = ehci_port_handed_over,
 };
 static int ehci_hcd_ppc_soc_drv_probe(struct platform_device *pdev)
diff --git a/drivers/usb/host/ehci-ps3.c b/drivers/usb/host/ehci-ps3.c
index 69782221bcf3..37e6abeb794c 100644
--- a/drivers/usb/host/ehci-ps3.c
+++ b/drivers/usb/host/ehci-ps3.c
@@ -73,6 +73,7 @@ static const struct hc_driver ps3_ehci_hc_driver = {
        .bus_resume             = ehci_bus_resume,
 #endif
        .relinquish_port        = ehci_relinquish_port,
+        .port_handed_over       = ehci_port_handed_over,
 };
 static int ps3_ehci_probe(struct ps3_system_bus_device *dev)
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index be575e46eac3..b7853c8bac0f 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1349,18 +1349,27 @@ iso_stream_schedule (
        /* when's the last uframe this urb could start? */
        max = now + mod;
-        /* typical case: reuse current schedule. stream is still active,
+        /* Typical case: reuse current schedule, stream is still active.
-         * and no gaps from host falling behind (irq delays etc)
+         * Hopefully there are no gaps from the host falling behind
+         * (irq delays etc), but if there are we'll take the next
+         * slot in the schedule, implicitly assuming URB_ISO_ASAP.
         */
        if (likely (!list_empty (&stream->td_list))) {
                start = stream->next_uframe;
                if (start < now)
                        start += mod;
-                if (likely ((start + sched->span) < max))
-                        goto ready;
+                /* Fell behind (by up to twice the slop amount)? */
-                /* else fell behind; someday, try to reschedule */
+                if (start >= max - 2 * 8 * SCHEDULE_SLOP)
-                status = -EL2NSYNC;
+                        start += stream->interval * DIV_ROUND_UP(
-                goto fail;
+                                        max - start, stream->interval) - mod;
+                /* Tried to schedule too far into the future? */
+                if (unlikely((start + sched->span) >= max)) {
+                        status = -EFBIG;
+                        goto fail;
+                }
+                goto ready;
        }
        /* need to schedule; when's the next (u)frame we could start?
@@ -1613,6 +1622,9 @@ itd_complete (
                } else if (likely ((t & EHCI_ISOC_ACTIVE) == 0)) {
                        desc->status = 0;
                        desc->actual_length = EHCI_ITD_LENGTH (t);
+                } else {
+                        /* URB was too late */
+                        desc->status = -EXDEV;
                }
        }
@@ -2095,7 +2107,7 @@ done:
 static void
 scan_periodic (struct ehci_hcd *ehci)
 {
-        unsigned        frame, clock, now_uframe, mod;
+        unsigned        now_uframe, frame, clock, clock_frame, mod;
        unsigned        modified;
        mod = ehci->periodic_size << 3;
@@ -2111,6 +2123,7 @@ scan_periodic (struct ehci_hcd *ehci)
        else
                clock = now_uframe + mod - 1;
        clock %= mod;
+        clock_frame = clock >> 3;
        for (;;) {
                union ehci_shadow       q, *q_p;
@@ -2157,22 +2170,26 @@ restart:
                        case Q_TYPE_ITD:
                                /* If this ITD is still active, leave it for
                                 * later processing ... check the next entry.
+                                 * No need to check for activity unless the
+                                 * frame is current.
                                 */
-                                rmb ();
+                                if (frame == clock_frame && live) {
-                                for (uf = 0; uf < 8 && live; uf++) {
+                                        rmb();
-                                        if (0 == (q.itd->hw_transaction [uf]
+                                        for (uf = 0; uf < 8; uf++) {
-                                                        & ITD_ACTIVE(ehci)))
+                                                if (q.itd->hw_transaction[uf] &
-                                                continue;
+                                                            ITD_ACTIVE(ehci))
-                                        incomplete = true;
+                                                        break;
-                                        q_p = &q.itd->itd_next;
+                                        }
-                                        hw_p = &q.itd->hw_next;
+                                        if (uf < 8) {
-                                        type = Q_NEXT_TYPE(ehci,
+                                                incomplete = true;
+                                                q_p = &q.itd->itd_next;
+                                                hw_p = &q.itd->hw_next;
+                                                type = Q_NEXT_TYPE(ehci,
                                                        q.itd->hw_next);
-                                        q = *q_p;
+                                                q = *q_p;
-                                        break;
+                                                break;
+                                        }
                                }
-                                if (uf < 8 && live)
-                                        break;
                                /* Take finished ITDs out of the schedule
                                 * and process them:  recycle, maybe report
@@ -2189,9 +2206,12 @@ restart:
                        case Q_TYPE_SITD:
                                /* If this SITD is still active, leave it for
                                 * later processing ... check the next entry.
+                                 * No need to check for activity unless the
+                                 * frame is current.
                                 */
-                                if ((q.sitd->hw_results & SITD_ACTIVE(ehci))
+                                if (frame == clock_frame && live &&
-                                                && live) {
+                                                (q.sitd->hw_results &
+                                                        SITD_ACTIVE(ehci))) {
                                        incomplete = true;
                                        q_p = &q.sitd->sitd_next;
                                        hw_p = &q.sitd->hw_next;
@@ -2260,6 +2280,7 @@ restart:
                        /* rescan the rest of this frame, then ... */
                        clock = now;
+                        clock_frame = clock >> 3;
                } else {
                        now_uframe++;
                        now_uframe %= mod;
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index bf92d209a1a9..35a03095757e 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -97,6 +97,8 @@ struct ehci_hcd {			/* one per controller */
                        dedicated to the companion controller */
        unsigned long           owned_ports;            /* which ports are
                        owned by the companion during a bus suspend */
+        unsigned long           port_c_suspend;         /* which ports have
+                        the change-suspend feature turned on */
        /* per-HC memory pools (could be per-bus, but ...) */
        struct dma_pool         *qh_pool;       /* qh per active urb */
@@ -112,7 +114,6 @@ struct ehci_hcd {			/* one per controller */
        u32                     command;
        /* SILICON QUIRKS */
-        unsigned                is_tdi_rh_tt:1; /* TDI roothub with TT */
        unsigned                no_selective_suspend:1;
        unsigned                has_fsl_port_bug:1; /* FreeScale */
        unsigned                big_endian_mmio:1;
@@ -678,7 +679,7 @@ struct ehci_fstn {
 * needed (mostly in root hub code).
 */
-#define ehci_is_TDI(e)                  ((e)->is_tdi_rh_tt)
+#define ehci_is_TDI(e)                  (ehci_to_hcd(e)->has_tt)
 /* Returns the speed of a device attached to a port on the root hub. */
 static inline unsigned int
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index c9cec8738261..65aa5ecf569a 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -2207,14 +2207,14 @@ struct usb_hcd *isp1760_register(u64 res_start, u64 res_len, int irq,
                goto err_put;
        }
-        ret = usb_add_hcd(hcd, irq, irqflags);
-        if (ret)
-                goto err_unmap;
        hcd->irq = irq;
        hcd->rsrc_start = res_start;
        hcd->rsrc_len = res_len;
+        ret = usb_add_hcd(hcd, irq, irqflags);
+        if (ret)
+                goto err_unmap;
        return hcd;
 err_unmap:
diff --git a/drivers/usb/host/isp1760-if.c b/drivers/usb/host/isp1760-if.c
index 440bf94f0d4c..c9db3fe98726 100644
--- a/drivers/usb/host/isp1760-if.c
+++ b/drivers/usb/host/isp1760-if.c
@@ -104,8 +104,8 @@ static u32 nxp_pci_io_base;
 static u32 iolength;
 static u32 pci_mem_phy0;
 static u32 length;
-static u8 *chip_addr;
+static u8 __iomem *chip_addr;
-static u8 *iobase;
+static u8 __iomem *iobase;
 static int __devinit isp1761_pci_probe(struct pci_dev *dev,
                const struct pci_device_id *id)
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index a53db1d4e07a..001789c9a11a 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -269,3 +269,15 @@ config USB_TEST
          See <http://www.linux-usb.org/usbtest/> for more information,
          including sample test device firmware and "how to use it".
+config USB_ISIGHTFW
+        tristate "iSight firmware loading support"
+        depends on USB
+        select FW_LOADER
+        help
+          This driver loads firmware for USB Apple iSight cameras, allowing
+          them to be driven by the USB video class driver available at
+          http://linux-uvc.berlios.de
+          The firmware for this driver must be extracted from the MacOS
+          driver beforehand. Tools for doing so are available at
+          http://bersace03.free.fr
diff --git a/drivers/usb/misc/Makefile b/drivers/usb/misc/Makefile
index b68e6b774f1a..aba091cb5ec0 100644
--- a/drivers/usb/misc/Makefile
+++ b/drivers/usb/misc/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_USB_EMI62)		+= emi62.o
 obj-$(CONFIG_USB_FTDI_ELAN)     += ftdi-elan.o
 obj-$(CONFIG_USB_IDMOUSE)       += idmouse.o
 obj-$(CONFIG_USB_IOWARRIOR)     += iowarrior.o
+obj-$(CONFIG_USB_ISIGHTFW)      += isight_firmware.o
 obj-$(CONFIG_USB_LCD)           += usblcd.o
 obj-$(CONFIG_USB_LD)            += ldusb.o
 obj-$(CONFIG_USB_LED)           += usbled.o
diff --git a/drivers/usb/misc/isight_firmware.c b/drivers/usb/misc/isight_firmware.c
new file mode 100644
index 000000000000..9f30aa1f8a5d
--- /dev/null
+++ b/drivers/usb/misc/isight_firmware.c
@@ -0,0 +1,140 @@
+/*
+ * Driver for loading USB isight firmware
+ *
+ * Copyright (C) 2008 Matthew Garrett <mjg@redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 2.
+ *
+ * The USB isight cameras in recent Apples are roughly compatible with the USB
+ * video class specification, and can be driven by uvcvideo. However, they
+ * need firmware to be loaded beforehand. After firmware loading, the device
+ * detaches from the USB bus and reattaches with a new device ID. It can then
+ * be claimed by the uvc driver.
+ *
+ * The firmware is non-free and must be extracted by the user. Tools to do this
+ * are available at http://bersace03.free.fr/ift/
+ *
+ * The isight firmware loading was reverse engineered by Johannes Berg
+ * <johannes@sipsolutions.de>, and this driver is based on code by Ronald
+ * Bultje <rbultje@ronald.bitfreak.net>
+ */
+#include <linux/usb.h>
+#include <linux/firmware.h>
+#include <linux/errno.h>
+#include <linux/module.h>
+static struct usb_device_id id_table[] = {
+        {USB_DEVICE(0x05ac, 0x8300)},
+        {},
+};
+MODULE_DEVICE_TABLE(usb, id_table);
+static int isight_firmware_load(struct usb_interface *intf,
+                                const struct usb_device_id *id)
+{
+        struct usb_device *dev = interface_to_usbdev(intf);
+        int llen, len, req, ret = 0;
+        const struct firmware *firmware;
+        unsigned char *buf = kmalloc(50, GFP_KERNEL);
+        unsigned char data[4];
+        u8 *ptr;
+        if (!buf)
+                return -ENOMEM;
+        if (request_firmware(&firmware, "isight.fw", &dev->dev) != 0) {
+                printk(KERN_ERR "Unable to load isight firmware\n");
+                return -ENODEV;
+        }
+        ptr = firmware->data;
+        if (usb_control_msg
+            (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1,
+             300) != 1) {
+                printk(KERN_ERR
+                       "Failed to initialise isight firmware loader\n");
+                ret = -ENODEV;
+                goto out;
+        }
+        while (ptr+4 <= firmware->data+firmware->size) {
+                memcpy(data, ptr, 4);
+                len = (data[0] << 8 | data[1]);
+                req = (data[2] << 8 | data[3]);
+                ptr += 4;
+                if (len == 0x8001)
+                        break;  /* success */
+                else if (len == 0)
+                        continue;
+                for (; len > 0; req += 50) {
+                        llen = min(len, 50);
+                        len -= llen;
+                        if (ptr+llen > firmware->data+firmware->size) {
+                                printk(KERN_ERR
+                                       "Malformed isight firmware");
+                                ret = -ENODEV;
+                                goto out;
+                        }
+                        memcpy(buf, ptr, llen);
+                        ptr += llen;
+                        if (usb_control_msg
+                            (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, req, 0,
+                             buf, llen, 300) != llen) {
+                                printk(KERN_ERR
+                                       "Failed to load isight firmware\n");
+                                kfree(buf);
+                                ret = -ENODEV;
+                                goto out;
+                        }
+                }
+        }
+        if (usb_control_msg
+            (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
+             300) != 1) {
+                printk(KERN_ERR "isight firmware loading completion failed\n");
+                ret = -ENODEV;
+        }
+out:
+        kfree(buf);
+        release_firmware(firmware);
+        return ret;
+}
+static void isight_firmware_disconnect(struct usb_interface *intf)
+{
+}
+static struct usb_driver isight_firmware_driver = {
+        .name = "isight_firmware",
+        .probe = isight_firmware_load,
+        .disconnect = isight_firmware_disconnect,
+        .id_table = id_table,
+};
+static int __init isight_firmware_init(void)
+{
+        return usb_register(&isight_firmware_driver);
+}
+static void __exit isight_firmware_exit(void)
+{
+        usb_deregister(&isight_firmware_driver);
+}
+module_init(isight_firmware_init);
+module_exit(isight_firmware_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 3cee6feac174..5234e7a3bd2c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -174,8 +174,270 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(FTDI_VID, FTDI_MTXORB_4_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
-        { USB_DEVICE(MTXORB_VK_VID, MTXORB_VK_PID),
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0100_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0101_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0102_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0103_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0104_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0105_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0106_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0107_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0108_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0109_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_010A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_010B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_010C_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_010D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_010E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_010F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0110_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0111_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0112_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0113_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0114_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0115_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0116_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0117_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0118_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0119_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_011A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_011B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_011C_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_011D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_011E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_011F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0120_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0121_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0122_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0123_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0124_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0125_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0126_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0127_PID),
                .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0128_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0129_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_012A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_012B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_012C_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_012D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_012E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_012F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0130_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0131_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0132_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0133_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0134_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0135_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0136_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0137_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0138_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0139_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_013A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_013B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_013C_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_013D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_013E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_013F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0140_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0141_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0142_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0143_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0144_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0145_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0146_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0147_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0148_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0149_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_014A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_014B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_014C_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_014D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_014E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_014F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0150_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0151_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0152_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0153_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0154_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0155_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0156_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0157_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0158_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_mtxorb_hack_quirk },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0159_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_015A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_015B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_015C_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_015D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_015E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_015F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0160_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0161_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0162_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0163_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0164_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0165_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0166_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0167_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0168_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0169_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_016A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_016B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_016C_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_016D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_016E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_016F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0170_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0171_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0172_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0173_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0174_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0175_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0176_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0177_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0178_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0179_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_017A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_017B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_017C_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_017D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_017E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_017F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0180_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0181_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0182_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0183_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0184_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0185_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0186_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0187_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0188_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0189_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_018A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_018B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_018C_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_018D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_018E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_018F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0190_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0191_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0192_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0193_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0194_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0195_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0196_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0197_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0198_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_0199_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_019A_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_019B_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_019C_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_019D_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_019E_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_019F_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A0_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A1_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A2_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A3_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A4_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A5_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A6_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A7_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A8_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01A9_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01AA_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01AB_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01AC_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01AD_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01AE_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01AF_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B0_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B1_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B2_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B3_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B4_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B5_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B6_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B7_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B8_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01B9_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01BA_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01BB_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01BC_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01BD_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01BE_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01BF_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C0_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C1_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C2_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C3_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C4_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C5_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C6_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C7_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C8_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01C9_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01CA_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01CB_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01CC_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01CD_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01CE_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01CF_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D0_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D1_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D2_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D3_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D4_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D5_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D6_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D7_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D8_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01D9_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01DA_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01DB_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01DC_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01DD_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01DE_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01DF_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E0_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E1_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E2_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E3_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E4_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E5_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E6_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E7_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E8_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01E9_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01EA_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01EB_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01EC_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01ED_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01EE_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01EF_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F0_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F1_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F2_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F3_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F4_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F5_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F6_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F7_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F8_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01F9_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01FA_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01FB_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01FC_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01FD_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01FE_PID) },
+        { USB_DEVICE(MTXORB_VID,MTXORB_FTDI_RANGE_01FF_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index a72f2c81d664..06e0ecabb3eb 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -114,11 +114,268 @@
 #define FTDI_OOCDLINK_PID       0xbaf8  /* Amontec JTAGkey */
 /*
- * The following are the values for the Matrix Orbital VK204-25-USB
+ * The following are the values for the Matrix Orbital FTDI Range
- * display, which use the FT232RL.
+ * Anything in this range will use an FT232RL.
- */
+ */
-#define MTXORB_VK_VID           0x1b3d
+#define MTXORB_VID                      0x1B3D
-#define MTXORB_VK_PID           0x0158
+#define MTXORB_FTDI_RANGE_0100_PID      0x0100
+#define MTXORB_FTDI_RANGE_0101_PID      0x0101
+#define MTXORB_FTDI_RANGE_0102_PID      0x0102
+#define MTXORB_FTDI_RANGE_0103_PID      0x0103
+#define MTXORB_FTDI_RANGE_0104_PID      0x0104
+#define MTXORB_FTDI_RANGE_0105_PID      0x0105
+#define MTXORB_FTDI_RANGE_0106_PID      0x0106
+#define MTXORB_FTDI_RANGE_0107_PID      0x0107
+#define MTXORB_FTDI_RANGE_0108_PID      0x0108
+#define MTXORB_FTDI_RANGE_0109_PID      0x0109
+#define MTXORB_FTDI_RANGE_010A_PID      0x010A
+#define MTXORB_FTDI_RANGE_010B_PID      0x010B
+#define MTXORB_FTDI_RANGE_010C_PID      0x010C
+#define MTXORB_FTDI_RANGE_010D_PID      0x010D
+#define MTXORB_FTDI_RANGE_010E_PID      0x010E
+#define MTXORB_FTDI_RANGE_010F_PID      0x010F
+#define MTXORB_FTDI_RANGE_0110_PID      0x0110
+#define MTXORB_FTDI_RANGE_0111_PID      0x0111
+#define MTXORB_FTDI_RANGE_0112_PID      0x0112
+#define MTXORB_FTDI_RANGE_0113_PID      0x0113
+#define MTXORB_FTDI_RANGE_0114_PID      0x0114
+#define MTXORB_FTDI_RANGE_0115_PID      0x0115
+#define MTXORB_FTDI_RANGE_0116_PID      0x0116
+#define MTXORB_FTDI_RANGE_0117_PID      0x0117
+#define MTXORB_FTDI_RANGE_0118_PID      0x0118
+#define MTXORB_FTDI_RANGE_0119_PID      0x0119
+#define MTXORB_FTDI_RANGE_011A_PID      0x011A
+#define MTXORB_FTDI_RANGE_011B_PID      0x011B
+#define MTXORB_FTDI_RANGE_011C_PID      0x011C
+#define MTXORB_FTDI_RANGE_011D_PID      0x011D
+#define MTXORB_FTDI_RANGE_011E_PID      0x011E
+#define MTXORB_FTDI_RANGE_011F_PID      0x011F
+#define MTXORB_FTDI_RANGE_0120_PID      0x0120
+#define MTXORB_FTDI_RANGE_0121_PID      0x0121
+#define MTXORB_FTDI_RANGE_0122_PID      0x0122
+#define MTXORB_FTDI_RANGE_0123_PID      0x0123
+#define MTXORB_FTDI_RANGE_0124_PID      0x0124
+#define MTXORB_FTDI_RANGE_0125_PID      0x0125
+#define MTXORB_FTDI_RANGE_0126_PID      0x0126
+#define MTXORB_FTDI_RANGE_0127_PID      0x0127
+#define MTXORB_FTDI_RANGE_0128_PID      0x0128
+#define MTXORB_FTDI_RANGE_0129_PID      0x0129
+#define MTXORB_FTDI_RANGE_012A_PID      0x012A
+#define MTXORB_FTDI_RANGE_012B_PID      0x012B
+#define MTXORB_FTDI_RANGE_012C_PID      0x012C
+#define MTXORB_FTDI_RANGE_012D_PID      0x012D
+#define MTXORB_FTDI_RANGE_012E_PID      0x012E
+#define MTXORB_FTDI_RANGE_012F_PID      0x012F
+#define MTXORB_FTDI_RANGE_0130_PID      0x0130
+#define MTXORB_FTDI_RANGE_0131_PID      0x0131
+#define MTXORB_FTDI_RANGE_0132_PID      0x0132
+#define MTXORB_FTDI_RANGE_0133_PID      0x0133
+#define MTXORB_FTDI_RANGE_0134_PID      0x0134
+#define MTXORB_FTDI_RANGE_0135_PID      0x0135
+#define MTXORB_FTDI_RANGE_0136_PID      0x0136
+#define MTXORB_FTDI_RANGE_0137_PID      0x0137
+#define MTXORB_FTDI_RANGE_0138_PID      0x0138
+#define MTXORB_FTDI_RANGE_0139_PID      0x0139
+#define MTXORB_FTDI_RANGE_013A_PID      0x013A
+#define MTXORB_FTDI_RANGE_013B_PID      0x013B
+#define MTXORB_FTDI_RANGE_013C_PID      0x013C
+#define MTXORB_FTDI_RANGE_013D_PID      0x013D
+#define MTXORB_FTDI_RANGE_013E_PID      0x013E
+#define MTXORB_FTDI_RANGE_013F_PID      0x013F
+#define MTXORB_FTDI_RANGE_0140_PID      0x0140
+#define MTXORB_FTDI_RANGE_0141_PID      0x0141
+#define MTXORB_FTDI_RANGE_0142_PID      0x0142
+#define MTXORB_FTDI_RANGE_0143_PID      0x0143
+#define MTXORB_FTDI_RANGE_0144_PID      0x0144
+#define MTXORB_FTDI_RANGE_0145_PID      0x0145
+#define MTXORB_FTDI_RANGE_0146_PID      0x0146
+#define MTXORB_FTDI_RANGE_0147_PID      0x0147
+#define MTXORB_FTDI_RANGE_0148_PID      0x0148
+#define MTXORB_FTDI_RANGE_0149_PID      0x0149
+#define MTXORB_FTDI_RANGE_014A_PID      0x014A
+#define MTXORB_FTDI_RANGE_014B_PID      0x014B
+#define MTXORB_FTDI_RANGE_014C_PID      0x014C
+#define MTXORB_FTDI_RANGE_014D_PID      0x014D
+#define MTXORB_FTDI_RANGE_014E_PID      0x014E
+#define MTXORB_FTDI_RANGE_014F_PID      0x014F
+#define MTXORB_FTDI_RANGE_0150_PID      0x0150
+#define MTXORB_FTDI_RANGE_0151_PID      0x0151
+#define MTXORB_FTDI_RANGE_0152_PID      0x0152
+#define MTXORB_FTDI_RANGE_0153_PID      0x0153
+#define MTXORB_FTDI_RANGE_0154_PID      0x0154
+#define MTXORB_FTDI_RANGE_0155_PID      0x0155
+#define MTXORB_FTDI_RANGE_0156_PID      0x0156
+#define MTXORB_FTDI_RANGE_0157_PID      0x0157
+#define MTXORB_FTDI_RANGE_0158_PID      0x0158
+#define MTXORB_FTDI_RANGE_0159_PID      0x0159
+#define MTXORB_FTDI_RANGE_015A_PID      0x015A
+#define MTXORB_FTDI_RANGE_015B_PID      0x015B
+#define MTXORB_FTDI_RANGE_015C_PID      0x015C
+#define MTXORB_FTDI_RANGE_015D_PID      0x015D
+#define MTXORB_FTDI_RANGE_015E_PID      0x015E
+#define MTXORB_FTDI_RANGE_015F_PID      0x015F
+#define MTXORB_FTDI_RANGE_0160_PID      0x0160
+#define MTXORB_FTDI_RANGE_0161_PID      0x0161
+#define MTXORB_FTDI_RANGE_0162_PID      0x0162
+#define MTXORB_FTDI_RANGE_0163_PID      0x0163
+#define MTXORB_FTDI_RANGE_0164_PID      0x0164
+#define MTXORB_FTDI_RANGE_0165_PID      0x0165
+#define MTXORB_FTDI_RANGE_0166_PID      0x0166
+#define MTXORB_FTDI_RANGE_0167_PID      0x0167
+#define MTXORB_FTDI_RANGE_0168_PID      0x0168
+#define MTXORB_FTDI_RANGE_0169_PID      0x0169
+#define MTXORB_FTDI_RANGE_016A_PID      0x016A
+#define MTXORB_FTDI_RANGE_016B_PID      0x016B
+#define MTXORB_FTDI_RANGE_016C_PID      0x016C
+#define MTXORB_FTDI_RANGE_016D_PID      0x016D
+#define MTXORB_FTDI_RANGE_016E_PID      0x016E
+#define MTXORB_FTDI_RANGE_016F_PID      0x016F
+#define MTXORB_FTDI_RANGE_0170_PID      0x0170
+#define MTXORB_FTDI_RANGE_0171_PID      0x0171
+#define MTXORB_FTDI_RANGE_0172_PID      0x0172
+#define MTXORB_FTDI_RANGE_0173_PID      0x0173
+#define MTXORB_FTDI_RANGE_0174_PID      0x0174
+#define MTXORB_FTDI_RANGE_0175_PID      0x0175
+#define MTXORB_FTDI_RANGE_0176_PID      0x0176
+#define MTXORB_FTDI_RANGE_0177_PID      0x0177
+#define MTXORB_FTDI_RANGE_0178_PID      0x0178
+#define MTXORB_FTDI_RANGE_0179_PID      0x0179
+#define MTXORB_FTDI_RANGE_017A_PID      0x017A
+#define MTXORB_FTDI_RANGE_017B_PID      0x017B
+#define MTXORB_FTDI_RANGE_017C_PID      0x017C
+#define MTXORB_FTDI_RANGE_017D_PID      0x017D
+#define MTXORB_FTDI_RANGE_017E_PID      0x017E
+#define MTXORB_FTDI_RANGE_017F_PID      0x017F
+#define MTXORB_FTDI_RANGE_0180_PID      0x0180
+#define MTXORB_FTDI_RANGE_0181_PID      0x0181
+#define MTXORB_FTDI_RANGE_0182_PID      0x0182
+#define MTXORB_FTDI_RANGE_0183_PID      0x0183
+#define MTXORB_FTDI_RANGE_0184_PID      0x0184
+#define MTXORB_FTDI_RANGE_0185_PID      0x0185
+#define MTXORB_FTDI_RANGE_0186_PID      0x0186
+#define MTXORB_FTDI_RANGE_0187_PID      0x0187
+#define MTXORB_FTDI_RANGE_0188_PID      0x0188
+#define MTXORB_FTDI_RANGE_0189_PID      0x0189
+#define MTXORB_FTDI_RANGE_018A_PID      0x018A
+#define MTXORB_FTDI_RANGE_018B_PID      0x018B
+#define MTXORB_FTDI_RANGE_018C_PID      0x018C
+#define MTXORB_FTDI_RANGE_018D_PID      0x018D
+#define MTXORB_FTDI_RANGE_018E_PID      0x018E
+#define MTXORB_FTDI_RANGE_018F_PID      0x018F
+#define MTXORB_FTDI_RANGE_0190_PID      0x0190
+#define MTXORB_FTDI_RANGE_0191_PID      0x0191
+#define MTXORB_FTDI_RANGE_0192_PID      0x0192
+#define MTXORB_FTDI_RANGE_0193_PID      0x0193
+#define MTXORB_FTDI_RANGE_0194_PID      0x0194
+#define MTXORB_FTDI_RANGE_0195_PID      0x0195
+#define MTXORB_FTDI_RANGE_0196_PID      0x0196
+#define MTXORB_FTDI_RANGE_0197_PID      0x0197
+#define MTXORB_FTDI_RANGE_0198_PID      0x0198
+#define MTXORB_FTDI_RANGE_0199_PID      0x0199
+#define MTXORB_FTDI_RANGE_019A_PID      0x019A
+#define MTXORB_FTDI_RANGE_019B_PID      0x019B
+#define MTXORB_FTDI_RANGE_019C_PID      0x019C
+#define MTXORB_FTDI_RANGE_019D_PID      0x019D
+#define MTXORB_FTDI_RANGE_019E_PID      0x019E
+#define MTXORB_FTDI_RANGE_019F_PID      0x019F
+#define MTXORB_FTDI_RANGE_01A0_PID      0x01A0
+#define MTXORB_FTDI_RANGE_01A1_PID      0x01A1
+#define MTXORB_FTDI_RANGE_01A2_PID      0x01A2
+#define MTXORB_FTDI_RANGE_01A3_PID      0x01A3
+#define MTXORB_FTDI_RANGE_01A4_PID      0x01A4
+#define MTXORB_FTDI_RANGE_01A5_PID      0x01A5
+#define MTXORB_FTDI_RANGE_01A6_PID      0x01A6
+#define MTXORB_FTDI_RANGE_01A7_PID      0x01A7
+#define MTXORB_FTDI_RANGE_01A8_PID      0x01A8
+#define MTXORB_FTDI_RANGE_01A9_PID      0x01A9
+#define MTXORB_FTDI_RANGE_01AA_PID      0x01AA
+#define MTXORB_FTDI_RANGE_01AB_PID      0x01AB
+#define MTXORB_FTDI_RANGE_01AC_PID      0x01AC
+#define MTXORB_FTDI_RANGE_01AD_PID      0x01AD
+#define MTXORB_FTDI_RANGE_01AE_PID      0x01AE
+#define MTXORB_FTDI_RANGE_01AF_PID      0x01AF
+#define MTXORB_FTDI_RANGE_01B0_PID      0x01B0
+#define MTXORB_FTDI_RANGE_01B1_PID      0x01B1
+#define MTXORB_FTDI_RANGE_01B2_PID      0x01B2
+#define MTXORB_FTDI_RANGE_01B3_PID      0x01B3
+#define MTXORB_FTDI_RANGE_01B4_PID      0x01B4
+#define MTXORB_FTDI_RANGE_01B5_PID      0x01B5
+#define MTXORB_FTDI_RANGE_01B6_PID      0x01B6
+#define MTXORB_FTDI_RANGE_01B7_PID      0x01B7
+#define MTXORB_FTDI_RANGE_01B8_PID      0x01B8
+#define MTXORB_FTDI_RANGE_01B9_PID      0x01B9
+#define MTXORB_FTDI_RANGE_01BA_PID      0x01BA
+#define MTXORB_FTDI_RANGE_01BB_PID      0x01BB
+#define MTXORB_FTDI_RANGE_01BC_PID      0x01BC
+#define MTXORB_FTDI_RANGE_01BD_PID      0x01BD
+#define MTXORB_FTDI_RANGE_01BE_PID      0x01BE
+#define MTXORB_FTDI_RANGE_01BF_PID      0x01BF
+#define MTXORB_FTDI_RANGE_01C0_PID      0x01C0
+#define MTXORB_FTDI_RANGE_01C1_PID      0x01C1
+#define MTXORB_FTDI_RANGE_01C2_PID      0x01C2
+#define MTXORB_FTDI_RANGE_01C3_PID      0x01C3
+#define MTXORB_FTDI_RANGE_01C4_PID      0x01C4
+#define MTXORB_FTDI_RANGE_01C5_PID      0x01C5
+#define MTXORB_FTDI_RANGE_01C6_PID      0x01C6
+#define MTXORB_FTDI_RANGE_01C7_PID      0x01C7
+#define MTXORB_FTDI_RANGE_01C8_PID      0x01C8
+#define MTXORB_FTDI_RANGE_01C9_PID      0x01C9
+#define MTXORB_FTDI_RANGE_01CA_PID      0x01CA
+#define MTXORB_FTDI_RANGE_01CB_PID      0x01CB
+#define MTXORB_FTDI_RANGE_01CC_PID      0x01CC
+#define MTXORB_FTDI_RANGE_01CD_PID      0x01CD
+#define MTXORB_FTDI_RANGE_01CE_PID      0x01CE
+#define MTXORB_FTDI_RANGE_01CF_PID      0x01CF
+#define MTXORB_FTDI_RANGE_01D0_PID      0x01D0
+#define MTXORB_FTDI_RANGE_01D1_PID      0x01D1
+#define MTXORB_FTDI_RANGE_01D2_PID      0x01D2
+#define MTXORB_FTDI_RANGE_01D3_PID      0x01D3
+#define MTXORB_FTDI_RANGE_01D4_PID      0x01D4
+#define MTXORB_FTDI_RANGE_01D5_PID      0x01D5
+#define MTXORB_FTDI_RANGE_01D6_PID      0x01D6
+#define MTXORB_FTDI_RANGE_01D7_PID      0x01D7
+#define MTXORB_FTDI_RANGE_01D8_PID      0x01D8
+#define MTXORB_FTDI_RANGE_01D9_PID      0x01D9
+#define MTXORB_FTDI_RANGE_01DA_PID      0x01DA
+#define MTXORB_FTDI_RANGE_01DB_PID      0x01DB
+#define MTXORB_FTDI_RANGE_01DC_PID      0x01DC
+#define MTXORB_FTDI_RANGE_01DD_PID      0x01DD
+#define MTXORB_FTDI_RANGE_01DE_PID      0x01DE
+#define MTXORB_FTDI_RANGE_01DF_PID      0x01DF
+#define MTXORB_FTDI_RANGE_01E0_PID      0x01E0
+#define MTXORB_FTDI_RANGE_01E1_PID      0x01E1
+#define MTXORB_FTDI_RANGE_01E2_PID      0x01E2
+#define MTXORB_FTDI_RANGE_01E3_PID      0x01E3
+#define MTXORB_FTDI_RANGE_01E4_PID      0x01E4
+#define MTXORB_FTDI_RANGE_01E5_PID      0x01E5
+#define MTXORB_FTDI_RANGE_01E6_PID      0x01E6
+#define MTXORB_FTDI_RANGE_01E7_PID      0x01E7
+#define MTXORB_FTDI_RANGE_01E8_PID      0x01E8
+#define MTXORB_FTDI_RANGE_01E9_PID      0x01E9
+#define MTXORB_FTDI_RANGE_01EA_PID      0x01EA
+#define MTXORB_FTDI_RANGE_01EB_PID      0x01EB
+#define MTXORB_FTDI_RANGE_01EC_PID      0x01EC
+#define MTXORB_FTDI_RANGE_01ED_PID      0x01ED
+#define MTXORB_FTDI_RANGE_01EE_PID      0x01EE
+#define MTXORB_FTDI_RANGE_01EF_PID      0x01EF
+#define MTXORB_FTDI_RANGE_01F0_PID      0x01F0
+#define MTXORB_FTDI_RANGE_01F1_PID      0x01F1
+#define MTXORB_FTDI_RANGE_01F2_PID      0x01F2
+#define MTXORB_FTDI_RANGE_01F3_PID      0x01F3
+#define MTXORB_FTDI_RANGE_01F4_PID      0x01F4
+#define MTXORB_FTDI_RANGE_01F5_PID      0x01F5
+#define MTXORB_FTDI_RANGE_01F6_PID      0x01F6
+#define MTXORB_FTDI_RANGE_01F7_PID      0x01F7
+#define MTXORB_FTDI_RANGE_01F8_PID      0x01F8
+#define MTXORB_FTDI_RANGE_01F9_PID      0x01F9
+#define MTXORB_FTDI_RANGE_01FA_PID      0x01FA
+#define MTXORB_FTDI_RANGE_01FB_PID      0x01FB
+#define MTXORB_FTDI_RANGE_01FC_PID      0x01FC
+#define MTXORB_FTDI_RANGE_01FD_PID      0x01FD
+#define MTXORB_FTDI_RANGE_01FE_PID      0x01FE
+#define MTXORB_FTDI_RANGE_01FF_PID      0x01FF
 /* Interbiometrics USB I/O Board */
 /* Developed for Interbiometrics by Rudolf Gugler */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 6cecd2c12b1d..43cfde83a93b 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -236,25 +236,25 @@ static struct usb_device_id option_ids[] = {
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_NETWORK_EX) },
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_KOI_MODEM) },
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_KOI_NETWORK) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220BIS, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1401) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1401, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1403) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1403, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1405) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1405, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1406) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1406, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1408) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1408, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1409) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1409, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1410) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1410, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1411) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1411, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1412) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1412, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1413) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1413, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1414) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1414, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1415) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1415, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1416) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1416, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1417) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1417, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1418) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1418, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1419) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1419, 0xff, 0xff, 0xff) },
        { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_9508) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, /* Novatel Merlin V640/XV620 */
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, /* Novatel Merlin V620/S620 */
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 234c5eea95a2..103195abd417 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -56,6 +56,7 @@ static struct usb_device_id id_table [] = {
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_RSAQ3) },
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_PHAROS) },
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ALDIGA) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 3bdefe020501..cff160abb130 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -14,6 +14,7 @@
 #define PL2303_PRODUCT_ID_PHAROS        0xaaa0
 #define PL2303_PRODUCT_ID_RSAQ3         0xaaa2
 #define PL2303_PRODUCT_ID_ALDIGA        0x0611
+#define PL2303_PRODUCT_ID_MMX           0x0612
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 1b09578cbb10..45fe3663fa7f 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -405,7 +405,7 @@ UNUSUAL_DEV(  0x04a5, 0x3010, 0x0100, 0x0100,
 UNUSUAL_DEV(  0x04b4, 0x6830, 0x0000, 0x9999,
                "Cypress",
                "Cypress AT2LP",
-                US_SC_CYP_ATACB, US_PR_BULK, NULL,
+                US_SC_CYP_ATACB, US_PR_DEVICE, NULL,
                0),
 #endif
@@ -1522,7 +1522,7 @@ UNUSUAL_DEV(  0x0fce, 0xe031, 0x0000, 0x0000,
                "Sony Ericsson",
                "M600i",
                US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_FIX_CAPACITY ),
+                US_FL_IGNORE_RESIDUE | US_FL_FIX_CAPACITY ),
 /* Reported by Kevin Cernekee <kpc-usbdev@gelato.uiuc.edu>
 * Tested on hardware version 1.10.
@@ -1716,10 +1716,12 @@ UNUSUAL_DEV(  0x22b8, 0x3010, 0x0001, 0x0001,
 /*
 * Patch by Pete Zaitcev <zaitcev@redhat.com>
 * Report by Mark Patton. Red Hat bz#208928.
+ * Added support for rev 0x0002 (Motorola ROKR W5)
+ * by Javier Smaldone <javier@smaldone.com.ar>
 */
-UNUSUAL_DEV(  0x22b8, 0x4810, 0x0001, 0x0001,
+UNUSUAL_DEV(  0x22b8, 0x4810, 0x0001, 0x0002,
                "Motorola",
-                "RAZR V3i",
+                "RAZR V3i/ROKR W5",
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_FIX_CAPACITY),
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index e4bcf5376a99..bd4ac0bafecb 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -3356,7 +3356,7 @@ static int __devinit atyfb_setup_generic(struct pci_dev *pdev, struct fb_info *i
        info->fix.mmio_start = raddr;
        par->ati_regbase = ioremap(info->fix.mmio_start, 0x1000);
-        if (par->ati_regbase == 0)
+        if (par->ati_regbase == NULL)
                return -ENOMEM;
        info->fix.mmio_start += par->aux_start ? 0x400 : 0xc00;
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 72cd0d2f14ec..400e9264e456 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -2277,8 +2277,8 @@ static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
        do {
                rinfo->fb_base = ioremap (rinfo->fb_base_phys,
                                          rinfo->mapped_vram);
-        } while (   rinfo->fb_base == 0 &&
+        } while (rinfo->fb_base == NULL &&
-                  ((rinfo->mapped_vram /=2) >= MIN_MAPPED_VRAM) );
+                 ((rinfo->mapped_vram /= 2) >= MIN_MAPPED_VRAM));
        if (rinfo->fb_base == NULL) {
                printk (KERN_ERR "radeonfb (%s): cannot map FB\n",
diff --git a/drivers/video/cirrusfb.c b/drivers/video/cirrusfb.c
index 35ac9d956b3d..c14b2435d23e 100644
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/cirrusfb.c
@@ -2432,9 +2432,9 @@ static int cirrusfb_pci_register(struct pci_dev *pdev,
        info->screen_size = board_size;
        cinfo->unmap = cirrusfb_pci_unmap;
-        printk(KERN_INFO " RAM (%lu kB) at 0xx%lx, ",
+        printk(KERN_INFO "RAM (%lu kB) at 0x%lx, Cirrus "
-                info->screen_size >> 10, board_addr);
+                        "Logic chipset on PCI bus\n",
-        printk(KERN_INFO "Cirrus Logic chipset on PCI bus\n");
+                        info->screen_size >> 10, board_addr);
        pci_set_drvdata(pdev, info);
        ret = cirrusfb_register(info);
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 5fa8b76673cb..97aff8db10bf 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2275,9 +2275,7 @@ static int fbcon_switch(struct vc_data *vc)
         * in fb_set_var()
         */
        info->var.activate = var.activate;
-        var.yoffset = info->var.yoffset;
+        var.vmode |= info->var.vmode & ~FB_VMODE_MASK;
-        var.xoffset = info->var.xoffset;
-        var.vmode = info->var.vmode;
        fb_set_var(info, &var);
        ops->var = info->var;
diff --git a/drivers/video/fsl-diu-fb.c b/drivers/video/fsl-diu-fb.c
index b50bb03cb5ab..0a2785361ca3 100644
--- a/drivers/video/fsl-diu-fb.c
+++ b/drivers/video/fsl-diu-fb.c
@@ -1320,7 +1320,7 @@ static void free_irq_local(int irq)
 * Power management hooks. Note that we won't be called from IRQ context,
 * unlike the blank functions above, so we may sleep.
 */
-static int fsl_diu_suspend(struct of_device *dev, pm_message_t state)
+static int fsl_diu_suspend(struct of_device *ofdev, pm_message_t state)
 {
        struct fsl_diu_data *machine_data;
@@ -1330,7 +1330,7 @@ static int fsl_diu_suspend(struct of_device *dev, pm_message_t state)
        return 0;
 }
-static int fsl_diu_resume(struct of_device *dev)
+static int fsl_diu_resume(struct of_device *ofdev)
 {
        struct fsl_diu_data *machine_data;
diff --git a/drivers/video/hgafb.c b/drivers/video/hgafb.c
index fb9e67228543..c18880d9db1f 100644
--- a/drivers/video/hgafb.c
+++ b/drivers/video/hgafb.c
@@ -279,7 +279,7 @@ static void hga_blank(int blank_mode)
 static int __init hga_card_detect(void)
 {
-        int count=0;
+        int count = 0;
        void __iomem *p, *q;
        unsigned short p_save, q_save;
@@ -303,20 +303,18 @@ static int __init hga_card_detect(void)
        writew(0x55aa, p); if (readw(p) == 0x55aa) count++;
        writew(p_save, p);
-        if (count != 2) {
+        if (count != 2)
-                return 0;
+                goto error;
-        }
        /* Ok, there is definitely a card registering at the correct
         * memory location, so now we do an I/O port test.
         */
        
-        if (!test_hga_b(0x66, 0x0f)) {      /* cursor low register */
+        if (!test_hga_b(0x66, 0x0f))        /* cursor low register */
-                return 0;
+                goto error;
-        }
-        if (!test_hga_b(0x99, 0x0f)) {     /* cursor low register */
+        if (!test_hga_b(0x99, 0x0f))     /* cursor low register */
-                return 0;
+                goto error;
-        }
        /* See if the card is a Hercules, by checking whether the vsync
         * bit of the status register is changing.  This test lasts for
@@ -331,7 +329,7 @@ static int __init hga_card_detect(void)
        }
        if (p_save == q_save) 
-                return 0;
+                goto error;
        switch (inb_p(HGA_STATUS_PORT) & 0x70) {
                case 0x10:
@@ -348,6 +346,12 @@ static int __init hga_card_detect(void)
                        break;
        }
        return 1;
+error:
+        if (release_io_ports)
+                release_region(0x3b0, 12);
+        if (release_io_port)
+                release_region(0x3bf, 1);
+        return 0;
 }
 /**
diff --git a/drivers/video/leo.c b/drivers/video/leo.c
index 8bc46e930340..13fea61d6ae4 100644
--- a/drivers/video/leo.c
+++ b/drivers/video/leo.c
@@ -17,8 +17,8 @@
 #include <linux/fb.h>
 #include <linux/mm.h>
 #include <linux/of_device.h>
+#include <linux/io.h>
-#include <asm/io.h>
 #include <asm/fbio.h>
 #include "sbuslib.h"
@@ -33,7 +33,6 @@ static int leo_blank(int, struct fb_info *);
 static int leo_mmap(struct fb_info *, struct vm_area_struct *);
 static int leo_ioctl(struct fb_info *, unsigned int, unsigned long);
-static int leo_pan_display(struct fb_var_screeninfo *, struct fb_info *);
 /*
 *  Frame buffer operations
@@ -43,7 +42,6 @@ static struct fb_ops leo_ops = {
        .owner                  = THIS_MODULE,
        .fb_setcolreg           = leo_setcolreg,
        .fb_blank               = leo_blank,
-        .fb_pan_display         = leo_pan_display,
        .fb_fillrect            = cfb_fillrect,
        .fb_copyarea            = cfb_copyarea,
        .fb_imageblit           = cfb_imageblit,
@@ -78,7 +76,7 @@ static struct fb_ops leo_ops = {
 #define LEO_CUR_TYPE_CMAP       0x00000050
 struct leo_cursor {
-        u8              xxx0[16];
+        u8      xxx0[16];
        u32     cur_type;
        u32     cur_misc;
        u32     cur_cursxy;
@@ -105,7 +103,7 @@ struct leo_lx_krn {
 struct leo_lc_ss0_krn {
        u32     misc;
-        u8              xxx0[0x800-4];
+        u8      xxx0[0x800-4];
        u32     rev;
 };
@@ -116,7 +114,7 @@ struct leo_lc_ss0_usr {
        u32     fontt;
        u32     extent;
        u32     src;
-        u32             dst;
+        u32     dst;
        u32     copy;
        u32     fill;
 };
@@ -129,8 +127,8 @@ struct leo_lc_ss1_usr {
        u8      unknown;
 };
-struct leo_ld {
+struct leo_ld_ss0 {
-        u8              xxx0[0xe00];
+        u8      xxx0[0xe00];
        u32     csr;
        u32     wid;
        u32     wmask;
@@ -144,13 +142,13 @@ struct leo_ld {
        u32     src;            /* Copy/Scroll (SS0 only) */
        u32     dst;            /* Copy/Scroll/Fill (SS0 only) */
        u32     extent;         /* Copy/Scroll/Fill size (SS0 only) */
-        u32             xxx1[3];
+        u32     xxx1[3];
        u32     setsem;         /* SS1 only */
        u32     clrsem;         /* SS1 only */
        u32     clrpick;        /* SS1 only */
        u32     clrdat;         /* SS1 only */
        u32     alpha;          /* SS1 only */
-        u8              xxx2[0x2c];
+        u8      xxx2[0x2c];
        u32     winbg;
        u32     planemask;
        u32     rop;
@@ -199,11 +197,12 @@ struct leo_par {
 static void leo_wait(struct leo_lx_krn __iomem *lx_krn)
 {
        int i;
-        
        for (i = 0;
-             (sbus_readl(&lx_krn->krn_csr) & LEO_KRN_CSR_PROGRESS) && i < 300000;
+             (sbus_readl(&lx_krn->krn_csr) & LEO_KRN_CSR_PROGRESS) &&
+             i < 300000;
             i++)
-                udelay (1); /* Busy wait at most 0.3 sec */
+                udelay(1); /* Busy wait at most 0.3 sec */
        return;
 }
@@ -221,7 +220,7 @@ static int leo_setcolreg(unsigned regno,
                         unsigned transp, struct fb_info *info)
 {
        struct leo_par *par = (struct leo_par *) info->par;
-        struct leo_lx_krn __iomem *lx_krn = par->lx_krn;
+        struct leo_lx_krn __iomem *lx_krn = par->lx_krn;
        unsigned long flags;
        u32 val;
        int i;
@@ -408,7 +407,7 @@ static void leo_wid_put(struct fb_info *info, struct fb_wid_list *wl)
        leo_wait(lx_krn);
        for (i = 0, wi = wl->wl_list; i < wl->wl_count; i++, wi++) {
-                switch(wi->wi_type) {
+                switch (wi->wi_type) {
                case FB_WID_DBL_8:
                        j = (wi->wi_index & 0xf) + 0x40;
                        break;
@@ -453,13 +452,12 @@ static void leo_init_wids(struct fb_info *info)
        wi.wi_index = 1;
        wi.wi_values [0] = 0x30;
        leo_wid_put(info, &wl);
 }
 static void leo_switch_from_graph(struct fb_info *info)
 {
        struct leo_par *par = (struct leo_par *) info->par;
-        struct leo_ld __iomem *ss = (struct leo_ld __iomem *) par->ld_ss0;
+        struct leo_ld_ss0 __iomem *ss = par->ld_ss0;
        unsigned long flags;
        u32 val;
@@ -485,19 +483,13 @@ static void leo_switch_from_graph(struct fb_info *info)
                val = sbus_readl(&par->lc_ss0_usr->csr);
        } while (val & 0x20000000);
-        spin_unlock_irqrestore(&par->lock, flags);
+        /* setup screen buffer for cfb_* functions */
-}
+        sbus_writel(1, &ss->wid);
+        sbus_writel(0x00ffffff, &ss->planemask);
-static int leo_pan_display(struct fb_var_screeninfo *var, struct fb_info *info)
+        sbus_writel(0x310b90, &ss->rop);
-{
+        sbus_writel(0, &par->lc_ss0_usr->addrspace);
-        /* We just use this to catch switches out of
-         * graphics mode.
-         */
-        leo_switch_from_graph(info);
-        if (var->xoffset || var->yoffset || var->vmode)
+        spin_unlock_irqrestore(&par->lock, flags);
-                return -EINVAL;
-        return 0;
 }
 static void leo_init_hw(struct fb_info *info)
@@ -542,7 +534,8 @@ static void leo_unmap_regs(struct of_device *op, struct fb_info *info,
                of_iounmap(&op->resource[0], info->screen_base, 0x800000);
 }
-static int __devinit leo_probe(struct of_device *op, const struct of_device_id *match)
+static int __devinit leo_probe(struct of_device *op,
+                               const struct of_device_id *match)
 {
        struct device_node *dp = op->node;
        struct fb_info *info;
@@ -594,8 +587,9 @@ static int __devinit leo_probe(struct of_device *op, const struct of_device_id *
            !info->screen_base)
                goto out_unmap_regs;
-        info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_YPAN;
+        info->flags = FBINFO_DEFAULT;
        info->fbops = &leo_ops;
+        info->pseudo_palette = par->clut_data;
        leo_init_wids(info);
        leo_init_hw(info);
@@ -649,7 +643,7 @@ static int __devexit leo_remove(struct of_device *op)
 static struct of_device_id leo_match[] = {
        {
-                .name = "leo",
+                .name = "SUNW,leo",
        },
        {},
 };
diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h
index f3107ad7e545..95883236c0cd 100644
--- a/drivers/video/matrox/matroxfb_base.h
+++ b/drivers/video/matrox/matroxfb_base.h
@@ -200,7 +200,7 @@ static inline int mga_ioremap(unsigned long phys, unsigned long size, int flags,
                virt->vaddr = ioremap_nocache(phys, size);
        else
                virt->vaddr = ioremap(phys, size);
-        return (virt->vaddr == 0); /* 0, !0... 0, error_code in future */
+        return (virt->vaddr == NULL); /* 0, !0... 0, error_code in future */
 }
 static inline void mga_iounmap(vaddr_t va) {
diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
index 473562191586..d3c3af53a290 100644
--- a/drivers/video/modedb.c
+++ b/drivers/video/modedb.c
@@ -28,6 +28,7 @@
 #endif
 const char *fb_mode_option;
+EXPORT_SYMBOL_GPL(fb_mode_option);
    /*
     *  Standard video mode definitions (taken from XFree86)
@@ -590,6 +591,7 @@ done:
                    "", (margins) ? " with margins" : "", (interlace) ?
                    " interlaced" : "");
+            memset(&cvt_mode, 0, sizeof(cvt_mode));
            cvt_mode.xres = xres;
            cvt_mode.yres = yres;
            cvt_mode.refresh = (refresh) ? refresh : 60;
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 3ee314beacc1..7dcda187d9ba 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -573,8 +573,8 @@ static int setup_frame_dma(struct pxafb_info *fbi, int dma, int pal,
                dma_desc->fdadr = fbi->dma_buff_phys + dma_desc_off;
                fbi->fdadr[dma] = fbi->dma_buff_phys + dma_desc_off;
        } else {
-                pal_desc = &fbi->dma_buff->pal_desc[dma];
+                pal_desc = &fbi->dma_buff->pal_desc[pal];
-                pal_desc_off = offsetof(struct pxafb_dma_buff, dma_desc[pal]);
+                pal_desc_off = offsetof(struct pxafb_dma_buff, pal_desc[pal]);
                pal_desc->fsadr = fbi->dma_buff_phys + pal * PALETTE_SIZE;
                pal_desc->fidr  = 0;
@@ -1276,6 +1276,8 @@ static int __init pxafb_map_video_memory(struct pxafb_info *fbi)
                fbi->dma_buff_phys = fbi->map_dma;
                fbi->palette_cpu = (u16 *) fbi->dma_buff->palette;
+                pr_debug("pxafb: palette_mem_size = 0x%08lx\n", fbi->palette_size*sizeof(u16));
 #ifdef CONFIG_FB_PXA_SMARTPANEL
                fbi->smart_cmds = (uint16_t *) fbi->dma_buff->cmd_buff;
                fbi->n_smart_cmds = 0;
@@ -1351,7 +1353,6 @@ static struct pxafb_info * __init pxafb_init_fbinfo(struct device *dev)
        struct pxafb_info *fbi;
        void *addr;
        struct pxafb_mach_info *inf = dev->platform_data;
-        struct pxafb_mode_info *mode = inf->modes;
        /* Alloc the pxafb_info and pseudo_palette in one step */
        fbi = kmalloc(sizeof(struct pxafb_info) + sizeof(u32) * 16, GFP_KERNEL);
diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c
index 13b38cbbe4cf..f0598961c6b0 100644
--- a/drivers/video/s3c2410fb.c
+++ b/drivers/video/s3c2410fb.c
@@ -1,75 +1,15 @@
-/*
+/* linux/drivers/video/s3c2410fb.c
- * linux/drivers/video/s3c2410fb.c
+ *      Copyright (c) 2004,2005 Arnaud Patard
- *      Copyright (c) Arnaud Patard, Ben Dooks
+ *      Copyright (c) 2004-2008 Ben Dooks
+ *
+ * S3C2410 LCD Framebuffer Driver
 *
 * This file is subject to the terms and conditions of the GNU General Public
 * License.  See the file COPYING in the main directory of this archive for
 * more details.
 *
- *          S3C2410 LCD Controller Frame Buffer Driver
+ * Driver based on skeletonfb.c, sa1100fb.c and others.
- *          based on skeletonfb.c, sa1100fb.c and others
+*/
- *
- * ChangeLog
- * 2005-04-07: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - u32 state -> pm_message_t state
- *      - S3C2410_{VA,SZ}_LCD -> S3C24XX
- *
- * 2005-03-15: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - Removed the ioctl
- *      - use readl/writel instead of __raw_writel/__raw_readl
- *
- * 2004-12-04: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - Added the possibility to set on or off the
- *      debugging messages
- *      - Replaced 0 and 1 by on or off when reading the
- *      /sys files
- *
- * 2005-03-23: Ben Dooks <ben-linux@fluff.org>
- *      - added non 16bpp modes
- *      - updated platform information for range of x/y/bpp
- *      - add code to ensure palette is written correctly
- *      - add pixel clock divisor control
- *
- * 2004-11-11: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - Removed the use of currcon as it no more exists
- *      - Added LCD power sysfs interface
- *
- * 2004-11-03: Ben Dooks <ben-linux@fluff.org>
- *      - minor cleanups
- *      - add suspend/resume support
- *      - s3c2410fb_setcolreg() not valid in >8bpp modes
- *      - removed last CONFIG_FB_S3C2410_FIXED
- *      - ensure lcd controller stopped before cleanup
- *      - added sysfs interface for backlight power
- *      - added mask for gpio configuration
- *      - ensured IRQs disabled during GPIO configuration
- *      - disable TPAL before enabling video
- *
- * 2004-09-20: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - Suppress command line options
- *
- * 2004-09-15: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - code cleanup
- *
- * 2004-09-07: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - Renamed from h1940fb.c to s3c2410fb.c
- *      - Add support for different devices
- *      - Backlight support
- *
- * 2004-09-05: Herbert Pötzl <herbert@13thfloor.at>
- *      - added clock (de-)allocation code
- *      - added fixem fbmem option
- *
- * 2004-07-27: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - code cleanup
- *      - added a forgotten return in h1940fb_init
- *
- * 2004-07-19: Herbert Pötzl <herbert@13thfloor.at>
- *      - code cleanup and extended debugging
- *
- * 2004-07-15: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - First version
- */
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -580,6 +520,27 @@ static int s3c2410fb_setcolreg(unsigned regno,
        return 0;
 }
+/* s3c2410fb_lcd_enable
+ *
+ * shutdown the lcd controller
+ */
+static void s3c2410fb_lcd_enable(struct s3c2410fb_info *fbi, int enable)
+{
+        unsigned long flags;
+        local_irq_save(flags);
+        if (enable)
+                fbi->regs.lcdcon1 |= S3C2410_LCDCON1_ENVID;
+        else
+                fbi->regs.lcdcon1 &= ~S3C2410_LCDCON1_ENVID;
+        writel(fbi->regs.lcdcon1, fbi->io + S3C2410_LCDCON1);
+        local_irq_restore(flags);
+}
 /*
 *      s3c2410fb_blank
 *      @blank_mode: the blank mode we want.
@@ -589,9 +550,6 @@ static int s3c2410fb_setcolreg(unsigned regno,
 *      blanking succeeded, != 0 if un-/blanking failed due to e.g. a
 *      video mode which doesn't support it. Implements VESA suspend
 *      and powerdown modes on hardware that supports disabling hsync/vsync:
- *      blank_mode == 2: suspend vsync
- *      blank_mode == 3: suspend hsync
- *      blank_mode == 4: powerdown
 *
 *      Returns negative errno on error, or zero on success.
 *
@@ -605,6 +563,12 @@ static int s3c2410fb_blank(int blank_mode, struct fb_info *info)
        tpal_reg += is_s3c2412(fbi) ? S3C2412_TPAL : S3C2410_TPAL;
+        if (blank_mode == FB_BLANK_POWERDOWN) {
+                s3c2410fb_lcd_enable(fbi, 0);
+        } else {
+                s3c2410fb_lcd_enable(fbi, 1);
+        }
        if (blank_mode == FB_BLANK_UNBLANK)
                writel(0x0, tpal_reg);
        else {
@@ -948,7 +912,10 @@ static int __init s3c24xxfb_probe(struct platform_device *pdev,
        }
        /* create device files */
-        device_create_file(&pdev->dev, &dev_attr_debug);
+        ret = device_create_file(&pdev->dev, &dev_attr_debug);
+        if (ret) {
+                printk(KERN_ERR "failed to add debug attribute\n");
+        }
        printk(KERN_INFO "fb%d: %s frame buffer device\n",
                fbinfo->node, fbinfo->fix.id);
@@ -983,21 +950,6 @@ static int __init s3c2412fb_probe(struct platform_device *pdev)
        return s3c24xxfb_probe(pdev, DRV_S3C2412);
 }
-/* s3c2410fb_stop_lcd
- *
- * shutdown the lcd controller
- */
-static void s3c2410fb_stop_lcd(struct s3c2410fb_info *fbi)
-{
-        unsigned long flags;
-        local_irq_save(flags);
-        fbi->regs.lcdcon1 &= ~S3C2410_LCDCON1_ENVID;
-        writel(fbi->regs.lcdcon1, fbi->io + S3C2410_LCDCON1);
-        local_irq_restore(flags);
-}
 /*
 *  Cleanup
@@ -1010,7 +962,7 @@ static int s3c2410fb_remove(struct platform_device *pdev)
        unregister_framebuffer(fbinfo);
-        s3c2410fb_stop_lcd(info);
+        s3c2410fb_lcd_enable(info, 0);
        msleep(1);
        s3c2410fb_unmap_video_memory(fbinfo);
@@ -1043,7 +995,7 @@ static int s3c2410fb_suspend(struct platform_device *dev, pm_message_t state)
        struct fb_info     *fbinfo = platform_get_drvdata(dev);
        struct s3c2410fb_info *info = fbinfo->par;
-        s3c2410fb_stop_lcd(info);
+        s3c2410fb_lcd_enable(info, 0);
        /* sleep before disabling the clock, we need to ensure
         * the LCD DMA engine is not going to get back on the bus
@@ -1118,3 +1070,5 @@ MODULE_AUTHOR("Arnaud Patard <arnaud.patard@rtp-net.org>, "
              "Ben Dooks <ben-linux@fluff.org>");
 MODULE_DESCRIPTION("Framebuffer driver for the s3c2410");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:s3c2410-lcd");
+MODULE_ALIAS("platform:s3c2412-lcd");
diff --git a/drivers/video/s3c2410fb.h b/drivers/video/s3c2410fb.h
index dbb73b95e2ef..9a6ba3e9d1b8 100644
--- a/drivers/video/s3c2410fb.h
+++ b/drivers/video/s3c2410fb.h
@@ -1,26 +1,14 @@
 /*
 * linux/drivers/video/s3c2410fb.h
- * Copyright (c) Arnaud Patard
+ *      Copyright (c) 2004 Arnaud Patard
+ *
+ *  S3C2410 LCD Framebuffer Driver
 *
 * This file is subject to the terms and conditions of the GNU General Public
 * License.  See the file COPYING in the main directory of this archive for
 * more details.
 *
- *          S3C2410 LCD Controller Frame Buffer Driver
+*/
- *          based on skeletonfb.c, sa1100fb.h
- *
- * ChangeLog
- *
- * 2004-12-04: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - Moved dprintk to s3c2410fb.c
- *
- * 2004-09-07: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - Renamed from h1940fb.h to s3c2410fb.h
- *      - Changed h1940 to s3c2410
- *
- * 2004-07-15: Arnaud Patard <arnaud.patard@rtp-net.org>
- *      - First version
- */
 #ifndef __S3C2410FB_H
 #define __S3C2410FB_H
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index 73803624c131..b9343844cd1f 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -5787,7 +5787,7 @@ sisfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        } else {
                struct sis_video_info *countvideo = card_list;
                ivideo->cardnumber = 1;
-                while((countvideo = countvideo->next) != 0)
+                while((countvideo = countvideo->next) != NULL)
                        ivideo->cardnumber++;
        }
diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c
index 742b5c656d66..15d4a768b1f6 100644
--- a/drivers/video/sm501fb.c
+++ b/drivers/video/sm501fb.c
@@ -663,14 +663,14 @@ static void sm501fb_panel_power(struct sm501fb_info *fbi, int to)
                sm501fb_sync_regs(fbi);
                mdelay(10);
-                if (pd->flags & SM501FB_FLAG_PANEL_USE_VBIASEN) {
+                if (!(pd->flags & SM501FB_FLAG_PANEL_NO_VBIASEN)) {
                        control |= SM501_DC_PANEL_CONTROL_BIAS; /* VBIASEN */
                        writel(control, ctrl_reg);
                        sm501fb_sync_regs(fbi);
                        mdelay(10);
                }
-                if (pd->flags & SM501FB_FLAG_PANEL_USE_FPEN) {
+                if (!(pd->flags & SM501FB_FLAG_PANEL_NO_FPEN)) {
                        control |= SM501_DC_PANEL_CONTROL_FPEN;
                        writel(control, ctrl_reg);
                        sm501fb_sync_regs(fbi);
@@ -678,14 +678,14 @@ static void sm501fb_panel_power(struct sm501fb_info *fbi, int to)
                }
        } else if (!to && (control & SM501_DC_PANEL_CONTROL_VDD) != 0) {
                /* disable panel power */
-                if (pd->flags & SM501FB_FLAG_PANEL_USE_FPEN) {
+                if (!(pd->flags & SM501FB_FLAG_PANEL_NO_FPEN)) {
                        control &= ~SM501_DC_PANEL_CONTROL_FPEN;
                        writel(control, ctrl_reg);
                        sm501fb_sync_regs(fbi);
                        mdelay(10);
                }
-                if (pd->flags & SM501FB_FLAG_PANEL_USE_VBIASEN) {
+                if (!(pd->flags & SM501FB_FLAG_PANEL_NO_VBIASEN)) {
                        control &= ~SM501_DC_PANEL_CONTROL_BIAS;
                        writel(control, ctrl_reg);
                        sm501fb_sync_regs(fbi);
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 13866789b356..7084e7e146c0 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -2,6 +2,9 @@
 #include <linux/spinlock.h>
 #include <linux/virtio_config.h>
+/* Unique numbering for virtio devices. */
+static unsigned int dev_index;
 static ssize_t device_show(struct device *_d,
                           struct device_attribute *attr, char *buf)
 {
@@ -121,9 +124,9 @@ static int virtio_dev_probe(struct device *_d)
        if (err)
                add_status(dev, VIRTIO_CONFIG_S_FAILED);
        else {
-                add_status(dev, VIRTIO_CONFIG_S_DRIVER_OK);
                /* They should never have set feature bits beyond 32 */
                dev->config->set_features(dev, dev->features[0]);
+                add_status(dev, VIRTIO_CONFIG_S_DRIVER_OK);
        }
        return err;
 }
@@ -166,7 +169,10 @@ int register_virtio_device(struct virtio_device *dev)
        int err;
        dev->dev.bus = &virtio_bus;
-        sprintf(dev->dev.bus_id, "%u", dev->index);
+        /* Assign a unique device index and hence name. */
+        dev->index = dev_index++;
+        sprintf(dev->dev.bus_id, "virtio%u", dev->index);
        /* We always start by resetting the device, in case a previous
         * driver messed it up.  This also tests that code path a little. */
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index 27e9fc9117cd..eae7236310e4 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -78,9 +78,6 @@ static struct device virtio_pci_root = {
        .bus_id         = "virtio-pci",
 };
-/* Unique numbering for devices under the kvm root */
-static unsigned int dev_index;
 /* Convert a generic virtio device to our structure */
 static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
 {
@@ -325,10 +322,6 @@ static int __devinit virtio_pci_probe(struct pci_dev *pci_dev,
        if (vp_dev == NULL)
                return -ENOMEM;
-        snprintf(vp_dev->vdev.dev.bus_id, BUS_ID_SIZE, "virtio%d", dev_index);
-        vp_dev->vdev.index = dev_index;
-        dev_index++;
        vp_dev->vdev.dev.parent = &virtio_pci_root;
        vp_dev->vdev.config = &virtio_pci_config_ops;
        vp_dev->pci_dev = pci_dev;
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 937a49d6772c..72bf8bc09014 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -227,7 +227,6 @@ static bool vring_enable_cb(struct virtqueue *_vq)
        struct vring_virtqueue *vq = to_vvq(_vq);
        START_USE(vq);
-        BUG_ON(!(vq->vring.avail->flags & VRING_AVAIL_F_NO_INTERRUPT));
        /* We optimistically turn back on interrupts, then check if there was
         * more to do. */
@@ -254,13 +253,6 @@ irqreturn_t vring_interrupt(int irq, void *_vq)
        if (unlikely(vq->broken))
                return IRQ_HANDLED;
-        /* Other side may have missed us turning off the interrupt,
-         * but we should preserve disable semantic for virtio users. */
-        if (unlikely(vq->vring.avail->flags & VRING_AVAIL_F_NO_INTERRUPT)) {
-                pr_debug("virtqueue interrupt after disable for %p\n", vq);
-                return IRQ_HANDLED;
-        }
        pr_debug("virtqueue callback for %p (%p)\n", vq, vq->vq.callback);
        if (vq->vq.callback)
                vq->vq.callback(&vq->vq);
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 254d115cafab..ccb78f66c2b6 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -295,6 +295,19 @@ config ALIM7101_WDT
          Most people will say N.
+config GEODE_WDT
+        tristate "AMD Geode CS5535/CS5536 Watchdog"
+        depends on MGEODE_LX
+        help
+          This driver enables a watchdog capability built into the
+          CS5535/CS5536 companion chips for the AMD Geode GX and LX
+          processors.  This watchdog watches your kernel to make sure
+          it doesn't freeze, and if it does, it reboots your computer after
+          a certain amount of time.
+          You can compile this driver directly into the kernel, or use
+          it as a module.  The module will be called geodewdt.
 config SC520_WDT
        tristate "AMD Elan SC520 processor Watchdog"
        depends on X86
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index f3fb170fe5c6..25b352b664d9 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -59,6 +59,7 @@ obj-$(CONFIG_ACQUIRE_WDT) += acquirewdt.o
 obj-$(CONFIG_ADVANTECH_WDT) += advantechwdt.o
 obj-$(CONFIG_ALIM1535_WDT) += alim1535_wdt.o
 obj-$(CONFIG_ALIM7101_WDT) += alim7101_wdt.o
+obj-$(CONFIG_GEODE_WDT) += geodewdt.o
 obj-$(CONFIG_SC520_WDT) += sc520_wdt.o
 obj-$(CONFIG_EUROTECH_WDT) += eurotechwdt.o
 obj-$(CONFIG_IB700_WDT) += ib700wdt.o
diff --git a/drivers/watchdog/bfin_wdt.c b/drivers/watchdog/bfin_wdt.c
index 1237113dc14a..03b3e3d91e7c 100644
--- a/drivers/watchdog/bfin_wdt.c
+++ b/drivers/watchdog/bfin_wdt.c
@@ -29,7 +29,8 @@
 #define stamp(fmt, args...) pr_debug("%s:%i: " fmt "\n", __func__, __LINE__, ## args)
 #define stampit() stamp("here i am")
-#define pr_init(fmt, args...) ({ static const __initdata char __fmt[] = fmt; printk(__fmt, ## args); })
+#define pr_devinit(fmt, args...) ({ static const __devinitconst char __fmt[] = fmt; printk(__fmt, ## args); })
+#define pr_init(fmt, args...) ({ static const __initconst char __fmt[] = fmt; printk(__fmt, ## args); })
 #define WATCHDOG_NAME "bfin-wdt"
 #define PFX WATCHDOG_NAME ": "
@@ -377,20 +378,6 @@ static int bfin_wdt_resume(struct platform_device *pdev)
 # define bfin_wdt_resume NULL
 #endif
-static struct platform_device bfin_wdt_device = {
-        .name          = WATCHDOG_NAME,
-        .id            = -1,
-};
-static struct platform_driver bfin_wdt_driver = {
-        .driver    = {
-                .name  = WATCHDOG_NAME,
-                .owner = THIS_MODULE,
-        },
-        .suspend   = bfin_wdt_suspend,
-        .resume    = bfin_wdt_resume,
-};
 static const struct file_operations bfin_wdt_fops = {
        .owner    = THIS_MODULE,
        .llseek   = no_llseek,
@@ -418,11 +405,67 @@ static struct notifier_block bfin_wdt_notifier = {
 };
 /**
- *      bfin_wdt_init - Initialize module
+ *      bfin_wdt_probe - Initialize module
 *
- *      Registers the device and notifier handler. Actual device
+ *      Registers the misc device and notifier handler.  Actual device
 *      initialization is handled by bfin_wdt_open().
 */
+static int __devinit bfin_wdt_probe(struct platform_device *pdev)
+{
+        int ret;
+        ret = register_reboot_notifier(&bfin_wdt_notifier);
+        if (ret) {
+                pr_devinit(KERN_ERR PFX "cannot register reboot notifier (err=%d)\n", ret);
+                return ret;
+        }
+        ret = misc_register(&bfin_wdt_miscdev);
+        if (ret) {
+                pr_devinit(KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
+                       WATCHDOG_MINOR, ret);
+                unregister_reboot_notifier(&bfin_wdt_notifier);
+                return ret;
+        }
+        pr_devinit(KERN_INFO PFX "initialized: timeout=%d sec (nowayout=%d)\n",
+               timeout, nowayout);
+        return 0;
+}
+/**
+ *      bfin_wdt_remove - Initialize module
+ *
+ *      Unregisters the misc device and notifier handler.  Actual device
+ *      deinitialization is handled by bfin_wdt_close().
+ */
+static int __devexit bfin_wdt_remove(struct platform_device *pdev)
+{
+        misc_deregister(&bfin_wdt_miscdev);
+        unregister_reboot_notifier(&bfin_wdt_notifier);
+        return 0;
+}
+static struct platform_device *bfin_wdt_device;
+static struct platform_driver bfin_wdt_driver = {
+        .probe     = bfin_wdt_probe,
+        .remove    = __devexit_p(bfin_wdt_remove),
+        .suspend   = bfin_wdt_suspend,
+        .resume    = bfin_wdt_resume,
+        .driver    = {
+                .name  = WATCHDOG_NAME,
+                .owner = THIS_MODULE,
+        },
+};
+/**
+ *      bfin_wdt_init - Initialize module
+ *
+ *      Checks the module params and registers the platform device & driver.
+ *      Real work is in the platform probe function.
+ */
 static int __init bfin_wdt_init(void)
 {
        int ret;
@@ -436,44 +479,32 @@ static int __init bfin_wdt_init(void)
        /* Since this is an on-chip device and needs no board-specific
         * resources, we'll handle all the platform device stuff here.
         */
-        ret = platform_device_register(&bfin_wdt_device);
+        ret = platform_driver_register(&bfin_wdt_driver);
-        if (ret)
-                return ret;
-        ret = platform_driver_probe(&bfin_wdt_driver, NULL);
-        if (ret)
-                return ret;
-        ret = register_reboot_notifier(&bfin_wdt_notifier);
        if (ret) {
-                pr_init(KERN_ERR PFX "cannot register reboot notifier (err=%d)\n", ret);
+                pr_init(KERN_ERR PFX "unable to register driver\n");
                return ret;
        }
-        ret = misc_register(&bfin_wdt_miscdev);
+        bfin_wdt_device = platform_device_register_simple(WATCHDOG_NAME, -1, NULL, 0);
-        if (ret) {
+        if (IS_ERR(bfin_wdt_device)) {
-                pr_init(KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
+                pr_init(KERN_ERR PFX "unable to register device\n");
-                       WATCHDOG_MINOR, ret);
+                platform_driver_unregister(&bfin_wdt_driver);
-                unregister_reboot_notifier(&bfin_wdt_notifier);
+                return PTR_ERR(bfin_wdt_device);
-                return ret;
        }
-        pr_init(KERN_INFO PFX "initialized: timeout=%d sec (nowayout=%d)\n",
-               timeout, nowayout);
        return 0;
 }
 /**
 *      bfin_wdt_exit - Deinitialize module
 *
- *      Unregisters the device and notifier handler. Actual device
+ *      Back out the platform device & driver steps.  Real work is in the
- *      deinitialization is handled by bfin_wdt_close().
+ *      platform remove function.
 */
 static void __exit bfin_wdt_exit(void)
 {
-        misc_deregister(&bfin_wdt_miscdev);
+        platform_device_unregister(bfin_wdt_device);
-        unregister_reboot_notifier(&bfin_wdt_notifier);
+        platform_driver_unregister(&bfin_wdt_driver);
 }
 module_init(bfin_wdt_init);
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index d362f5bf658a..c1ba0db48501 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -1,12 +1,10 @@
 /*
- * drivers/char/watchdog/booke_wdt.c
- *
 * Watchdog timer for PowerPC Book-E systems
 *
 * Author: Matthew McClintock
 * Maintainer: Kumar Gala <galak@kernel.crashing.org>
 *
- * Copyright 2005 Freescale Semiconductor Inc.
+ * Copyright 2005, 2008 Freescale Semiconductor Inc.
 *
 * This program is free software; you can redistribute  it and/or modify it
 * under  the terms of  the GNU General  Public License as published by the
@@ -16,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/fs.h>
+#include <linux/smp.h>
 #include <linux/miscdevice.h>
 #include <linux/notifier.h>
 #include <linux/watchdog.h>
@@ -38,7 +37,7 @@
 #define WDT_PERIOD_DEFAULT 3    /* Refer to the PPC40x and PPC4xx manuals */
 #endif                          /* for timing information */
-u32 booke_wdt_enabled = 0;
+u32 booke_wdt_enabled;
 u32 booke_wdt_period = WDT_PERIOD_DEFAULT;
 #ifdef  CONFIG_FSL_BOOKE
@@ -47,33 +46,31 @@ u32 booke_wdt_period = WDT_PERIOD_DEFAULT;
 #define WDTP(x)         (TCR_WP(x))
 #endif
-/*
+static DEFINE_SPINLOCK(booke_wdt_lock);
- * booke_wdt_ping:
- */
+static void __booke_wdt_ping(void *data)
-static __inline__ void booke_wdt_ping(void)
 {
        mtspr(SPRN_TSR, TSR_ENW|TSR_WIS);
 }
-/*
+static void booke_wdt_ping(void)
- * booke_wdt_enable:
+{
- */
+        on_each_cpu(__booke_wdt_ping, NULL, 0, 0);
-static __inline__ void booke_wdt_enable(void)
+}
+static void __booke_wdt_enable(void *data)
 {
        u32 val;
        /* clear status before enabling watchdog */
-        booke_wdt_ping();
+        __booke_wdt_ping(NULL);
        val = mfspr(SPRN_TCR);
        val |= (TCR_WIE|TCR_WRC(WRC_CHIP)|WDTP(booke_wdt_period));
        mtspr(SPRN_TCR, val);
 }
-/*
+static ssize_t booke_wdt_write(struct file *file, const char __user *buf,
- * booke_wdt_write:
- */
-static ssize_t booke_wdt_write (struct file *file, const char __user *buf,
                                size_t count, loff_t *ppos)
 {
        booke_wdt_ping();
@@ -81,15 +78,11 @@ static ssize_t booke_wdt_write (struct file *file, const char __user *buf,
 }
 static struct watchdog_info ident = {
-  .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
+        .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
-  .firmware_version = 0,
+        .identity = "PowerPC Book-E Watchdog",
-  .identity = "PowerPC Book-E Watchdog",
 };
-/*
+static int booke_wdt_ioctl(struct inode *inode, struct file *file,
- * booke_wdt_ioctl:
- */
-static int booke_wdt_ioctl (struct inode *inode, struct file *file,
                            unsigned int cmd, unsigned long arg)
 {
        u32 tmp = 0;
@@ -97,7 +90,7 @@ static int booke_wdt_ioctl (struct inode *inode, struct file *file,
        switch (cmd) {
        case WDIOC_GETSUPPORT:
-                if (copy_to_user ((struct watchdog_info __user *) arg, &ident,
+                if (copy_to_user((struct watchdog_info __user *)arg, &ident,
                                sizeof(struct watchdog_info)))
                        return -EFAULT;
        case WDIOC_GETSTATUS:
@@ -132,33 +125,33 @@ static int booke_wdt_ioctl (struct inode *inode, struct file *file,
        return 0;
 }
-/*
- * booke_wdt_open:
+static int booke_wdt_open(struct inode *inode, struct file *file)
- */
-static int booke_wdt_open (struct inode *inode, struct file *file)
 {
+        spin_lock(&booke_wdt_lock);
        if (booke_wdt_enabled == 0) {
                booke_wdt_enabled = 1;
-                booke_wdt_enable();
+                on_each_cpu(__booke_wdt_enable, NULL, 0, 0);
-                printk (KERN_INFO "PowerPC Book-E Watchdog Timer Enabled (wdt_period=%d)\n",
+                printk(KERN_INFO "PowerPC Book-E Watchdog Timer Enabled "
-                                booke_wdt_period);
+                                "(wdt_period=%d)\n", booke_wdt_period);
        }
+        spin_unlock(&booke_wdt_lock);
        return nonseekable_open(inode, file);
 }
 static const struct file_operations booke_wdt_fops = {
-  .owner = THIS_MODULE,
+        .owner = THIS_MODULE,
-  .llseek = no_llseek,
+        .llseek = no_llseek,
-  .write = booke_wdt_write,
+        .write = booke_wdt_write,
-  .ioctl = booke_wdt_ioctl,
+        .ioctl = booke_wdt_ioctl,
-  .open = booke_wdt_open,
+        .open = booke_wdt_open,
 };
 static struct miscdevice booke_wdt_miscdev = {
-  .minor = WATCHDOG_MINOR,
+        .minor = WATCHDOG_MINOR,
-  .name = "watchdog",
+        .name = "watchdog",
-  .fops = &booke_wdt_fops,
+        .fops = &booke_wdt_fops,
 };
 static void __exit booke_wdt_exit(void)
@@ -166,28 +159,27 @@ static void __exit booke_wdt_exit(void)
        misc_deregister(&booke_wdt_miscdev);
 }
-/*
- * booke_wdt_init:
- */
 static int __init booke_wdt_init(void)
 {
        int ret = 0;
-        printk (KERN_INFO "PowerPC Book-E Watchdog Timer Loaded\n");
+        printk(KERN_INFO "PowerPC Book-E Watchdog Timer Loaded\n");
        ident.firmware_version = cur_cpu_spec->pvr_value;
        ret = misc_register(&booke_wdt_miscdev);
        if (ret) {
-                printk (KERN_CRIT "Cannot register miscdev on minor=%d (err=%d)\n",
+                printk(KERN_CRIT "Cannot register miscdev on minor=%d: %d\n",
                                WATCHDOG_MINOR, ret);
                return ret;
        }
+        spin_lock(&booke_wdt_lock);
        if (booke_wdt_enabled == 1) {
-                printk (KERN_INFO "PowerPC Book-E Watchdog Timer Enabled (wdt_period=%d)\n",
+                printk(KERN_INFO "PowerPC Book-E Watchdog Timer Enabled "
-                                booke_wdt_period);
+                                "(wdt_period=%d)\n", booke_wdt_period);
-                booke_wdt_enable();
+                on_each_cpu(__booke_wdt_enable, NULL, 0, 0);
        }
+        spin_unlock(&booke_wdt_lock);
        return ret;
 }
diff --git a/drivers/watchdog/geodewdt.c b/drivers/watchdog/geodewdt.c
new file mode 100644
index 000000000000..30d09cbbad94
--- /dev/null
+++ b/drivers/watchdog/geodewdt.c
@@ -0,0 +1,308 @@
+/* Watchdog timer for the Geode GX/LX with the CS5535/CS5536 companion chip
+ *
+ * Copyright (C) 2006-2007, Advanced Micro Devices, Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/types.h>
+#include <linux/miscdevice.h>
+#include <linux/watchdog.h>
+#include <linux/fs.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <asm/uaccess.h>
+#include <asm/geode.h>
+#define GEODEWDT_HZ 500
+#define GEODEWDT_SCALE 6
+#define GEODEWDT_MAX_SECONDS 131
+#define WDT_FLAGS_OPEN 1
+#define WDT_FLAGS_ORPHAN 2
+#define DRV_NAME "geodewdt"
+#define WATCHDOG_NAME "Geode GX/LX WDT"
+#define WATCHDOG_TIMEOUT 60
+static int timeout = WATCHDOG_TIMEOUT;
+module_param(timeout, int, 0);
+MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=131, default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ".");
+static int nowayout = WATCHDOG_NOWAYOUT;
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+static struct platform_device *geodewdt_platform_device;
+static unsigned long wdt_flags;
+static int wdt_timer;
+static int safe_close;
+static void geodewdt_ping(void)
+{
+        /* Stop the counter */
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, 0);
+        /* Reset the counter */
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_COUNTER, 0);
+        /* Enable the counter */
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, MFGPT_SETUP_CNTEN);
+}
+static void geodewdt_disable(void)
+{
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, 0);
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_COUNTER, 0);
+}
+static int geodewdt_set_heartbeat(int val)
+{
+        if (val < 1 || val > GEODEWDT_MAX_SECONDS)
+                return -EINVAL;
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, 0);
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_CMP2, val * GEODEWDT_HZ);
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_COUNTER, 0);
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, MFGPT_SETUP_CNTEN);
+        timeout = val;
+        return 0;
+}
+static int
+geodewdt_open(struct inode *inode, struct file *file)
+{
+        if (test_and_set_bit(WDT_FLAGS_OPEN, &wdt_flags))
+                return -EBUSY;
+        if (!test_and_clear_bit(WDT_FLAGS_ORPHAN, &wdt_flags))
+                __module_get(THIS_MODULE);
+        geodewdt_ping();
+        return nonseekable_open(inode, file);
+}
+static int
+geodewdt_release(struct inode *inode, struct file *file)
+{
+        if (safe_close) {
+                geodewdt_disable();
+                module_put(THIS_MODULE);
+        }
+        else {
+                printk(KERN_CRIT "Unexpected close - watchdog is not stopping.\n");
+                geodewdt_ping();
+                set_bit(WDT_FLAGS_ORPHAN, &wdt_flags);
+        }
+        clear_bit(WDT_FLAGS_OPEN, &wdt_flags);
+        safe_close = 0;
+        return 0;
+}
+static ssize_t
+geodewdt_write(struct file *file, const char __user *data, size_t len,
+               loff_t *ppos)
+{
+        if(len) {
+                if (!nowayout) {
+                        size_t i;
+                        safe_close = 0;
+                        for (i = 0; i != len; i++) {
+                                char c;
+                                if (get_user(c, data + i))
+                                        return -EFAULT;
+                                if (c == 'V')
+                                        safe_close = 1;
+                        }
+                }
+                geodewdt_ping();
+        }
+        return len;
+}
+static int
+geodewdt_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
+               unsigned long arg)
+{
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
+        int interval;
+        static struct watchdog_info ident = {
+                .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING
+                | WDIOF_MAGICCLOSE,
+                .firmware_version =     1,
+                .identity =             WATCHDOG_NAME,
+        };
+        switch(cmd) {
+        case WDIOC_GETSUPPORT:
+                return copy_to_user(argp, &ident,
+                                    sizeof(ident)) ? -EFAULT : 0;
+                break;
+        case WDIOC_GETSTATUS:
+        case WDIOC_GETBOOTSTATUS:
+                return put_user(0, p);
+        case WDIOC_KEEPALIVE:
+                geodewdt_ping();
+                return 0;
+        case WDIOC_SETTIMEOUT:
+                if (get_user(interval, p))
+                        return -EFAULT;
+                if (geodewdt_set_heartbeat(interval))
+                        return -EINVAL;
+/* Fall through */
+        case WDIOC_GETTIMEOUT:
+                return put_user(timeout, p);
+        case WDIOC_SETOPTIONS:
+        {
+                int options, ret = -EINVAL;
+                if (get_user(options, p))
+                        return -EFAULT;
+                if (options & WDIOS_DISABLECARD) {
+                        geodewdt_disable();
+                        ret = 0;
+                }
+                if (options & WDIOS_ENABLECARD) {
+                        geodewdt_ping();
+                        ret = 0;
+                }
+                return ret;
+        }
+        default:
+                return -ENOTTY;
+        }
+        return 0;
+}
+static const struct file_operations geodewdt_fops = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .write          = geodewdt_write,
+        .ioctl          = geodewdt_ioctl,
+        .open           = geodewdt_open,
+        .release        = geodewdt_release,
+};
+static struct miscdevice geodewdt_miscdev = {
+        .minor = WATCHDOG_MINOR,
+        .name = "watchdog",
+        .fops = &geodewdt_fops
+};
+static int __devinit
+geodewdt_probe(struct platform_device *dev)
+{
+        int ret, timer;
+        timer = geode_mfgpt_alloc_timer(MFGPT_TIMER_ANY, MFGPT_DOMAIN_WORKING);
+        if (timer == -1) {
+                printk(KERN_ERR "geodewdt:  No timers were available\n");
+                return -ENODEV;
+        }
+        wdt_timer = timer;
+        /* Set up the timer */
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP,
+                          GEODEWDT_SCALE | (3 << 8));
+        /* Set up comparator 2 to reset when the event fires */
+        geode_mfgpt_toggle_event(wdt_timer, MFGPT_CMP2, MFGPT_EVENT_RESET, 1);
+        /* Set up the initial timeout */
+        geode_mfgpt_write(wdt_timer, MFGPT_REG_CMP2,
+                timeout * GEODEWDT_HZ);
+        ret = misc_register(&geodewdt_miscdev);
+        return ret;
+}
+static int __devexit
+geodewdt_remove(struct platform_device *dev)
+{
+        misc_deregister(&geodewdt_miscdev);
+        return 0;
+}
+static void
+geodewdt_shutdown(struct platform_device *dev)
+{
+        geodewdt_disable();
+}
+static struct platform_driver geodewdt_driver = {
+        .probe          = geodewdt_probe,
+        .remove         = __devexit_p(geodewdt_remove),
+        .shutdown       = geodewdt_shutdown,
+        .driver         = {
+                .owner  = THIS_MODULE,
+                .name   = DRV_NAME,
+        },
+};
+static int __init
+geodewdt_init(void)
+{
+        int ret;
+        ret = platform_driver_register(&geodewdt_driver);
+        if (ret)
+                return ret;
+        geodewdt_platform_device = platform_device_register_simple(DRV_NAME, -1, NULL, 0);
+        if (IS_ERR(geodewdt_platform_device)) {
+                ret = PTR_ERR(geodewdt_platform_device);
+                goto err;
+        }
+        return 0;
+err:
+        platform_driver_unregister(&geodewdt_driver);
+        return ret;
+}
+static void __exit
+geodewdt_exit(void)
+{
+        platform_device_unregister(geodewdt_platform_device);
+        platform_driver_unregister(&geodewdt_driver);
+}
+module_init(geodewdt_init);
+module_exit(geodewdt_exit);
+MODULE_AUTHOR("Advanced Micro Devices, Inc");
+MODULE_DESCRIPTION("Geode GX/LX Watchdog Driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 6483d1066b95..6a63535fc04d 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -418,23 +418,20 @@ static int hpwdt_pretimeout(struct notifier_block *nb, unsigned long ulReason,
        static unsigned long rom_pl;
        static int die_nmi_called;
-        if (ulReason != DIE_NMI && ulReason != DIE_NMI_IPI)
+        if (ulReason == DIE_NMI || ulReason == DIE_NMI_IPI) {
-                return NOTIFY_OK;
+                spin_lock_irqsave(&rom_lock, rom_pl);
+                if (!die_nmi_called)
-        spin_lock_irqsave(&rom_lock, rom_pl);
+                        asminline_call(&cmn_regs, cru_rom_addr);
-        if (!die_nmi_called)
+                die_nmi_called = 1;
-                asminline_call(&cmn_regs, cru_rom_addr);
+                spin_unlock_irqrestore(&rom_lock, rom_pl);
-        die_nmi_called = 1;
+                if (cmn_regs.u1.ral != 0) {
-        spin_unlock_irqrestore(&rom_lock, rom_pl);
+                        panic("An NMI occurred, please see the Integrated "
-        if (cmn_regs.u1.ral == 0) {
+                              "Management Log for details.\n");
-                printk(KERN_WARNING "hpwdt: An NMI occurred, "
+                }
-                       "but unable to determine source.\n");
-        } else {
-                panic("An NMI occurred, please see the Integrated "
-                        "Management Log for details.\n");
        }
-        return NOTIFY_STOP;
+        die_nmi_called = 0;
+        return NOTIFY_DONE;
 }
 /*
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index a0e6809e369f..95ba985bd341 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -41,9 +41,10 @@
 *      82801HH  (ICH8DH)    : document number 313056-003, 313057-009,
 *      82801HO  (ICH8DO)    : document number 313056-003, 313057-009,
 *      82801HEM (ICH8M-E)   : document number 313056-003, 313057-009,
- *      82801IB  (ICH9)      : document number 316972-001, 316973-001,
+ *      82801IB  (ICH9)      : document number 316972-001, 316973-006,
- *      82801IR  (ICH9R)     : document number 316972-001, 316973-001,
+ *      82801IR  (ICH9R)     : document number 316972-001, 316973-006,
- *      82801IH  (ICH9DH)    : document number 316972-001, 316973-001,
+ *      82801IH  (ICH9DH)    : document number 316972-001, 316973-006,
+ *      82801IO  (ICH9DO)    : document number 316972-001, 316973-006,
 *      6300ESB  (6300ESB)   : document number 300641-003, 300884-010,
 *      631xESB  (631xESB)   : document number 313082-001, 313075-005,
 *      632xESB  (632xESB)   : document number 313082-001, 313075-005
@@ -55,8 +56,8 @@
 /* Module and version information */
 #define DRV_NAME        "iTCO_wdt"
-#define DRV_VERSION     "1.02"
+#define DRV_VERSION     "1.03"
-#define DRV_RELDATE     "26-Jul-2007"
+#define DRV_RELDATE     "30-Apr-2008"
 #define PFX             DRV_NAME ": "
 /* Includes */
@@ -104,6 +105,7 @@ enum iTCO_chipsets {
        TCO_ICH9,       /* ICH9 */
        TCO_ICH9R,      /* ICH9R */
        TCO_ICH9DH,     /* ICH9DH */
+        TCO_ICH9DO,     /* ICH9DO */
        TCO_631XESB,    /* 631xESB/632xESB */
 };
@@ -136,6 +138,7 @@ static struct {
        {"ICH9", 2},
        {"ICH9R", 2},
        {"ICH9DH", 2},
+        {"ICH9DO", 2},
        {"631xESB/632xESB", 2},
        {NULL,0}
 };
@@ -181,6 +184,7 @@ static struct pci_device_id iTCO_wdt_pci_tbl[] = {
        { ITCO_PCI_DEVICE(0x2918,                               TCO_ICH9   )},
        { ITCO_PCI_DEVICE(0x2916,                               TCO_ICH9R  )},
        { ITCO_PCI_DEVICE(PCI_DEVICE_ID_INTEL_ICH9_2,           TCO_ICH9DH )},
+        { ITCO_PCI_DEVICE(PCI_DEVICE_ID_INTEL_ICH9_4,           TCO_ICH9DO )},
        { ITCO_PCI_DEVICE(PCI_DEVICE_ID_INTEL_ESB2_0,           TCO_631XESB)},
        { ITCO_PCI_DEVICE(0x2671,                               TCO_631XESB)},
        { ITCO_PCI_DEVICE(0x2672,                               TCO_631XESB)},
diff --git a/drivers/watchdog/w83697hf_wdt.c b/drivers/watchdog/w83697hf_wdt.c
index c622a0e6c9ae..528b882420b6 100644
--- a/drivers/watchdog/w83697hf_wdt.c
+++ b/drivers/watchdog/w83697hf_wdt.c
@@ -44,6 +44,7 @@
 #define WATCHDOG_NAME "w83697hf/hg WDT"
 #define PFX WATCHDOG_NAME ": "
 #define WATCHDOG_TIMEOUT 60             /* 60 sec default timeout */
+#define WATCHDOG_EARLY_DISABLE 1        /* Disable until userland kicks in */
 static unsigned long wdt_is_open;
 static char expect_close;
@@ -56,12 +57,16 @@ MODULE_PARM_DESC(wdt_io, "w83697hf/hg WDT io port (default 0x2e, 0 = autodetect)
 static int timeout = WATCHDOG_TIMEOUT;  /* in seconds */
 module_param(timeout, int, 0);
-MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=255, default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ".");
+MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=255 (default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ")");
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+static int early_disable = WATCHDOG_EARLY_DISABLE;
+module_param(early_disable, int, 0);
+MODULE_PARM_DESC(early_disable, "Watchdog gets disabled at boot time (default=" __MODULE_STRING(WATCHDOG_EARLY_DISABLE) ")");
 /*
 *      Kernel methods.
 */
@@ -140,7 +145,7 @@ w83697hf_init(void)
        w83697hf_deselect_wdt();
 }
-static int
+static void
 wdt_ping(void)
 {
        spin_lock(&io_lock);
@@ -150,10 +155,9 @@ wdt_ping(void)
        w83697hf_deselect_wdt();
        spin_unlock(&io_lock);
-        return 0;
 }
-static int
+static void
 wdt_enable(void)
 {
        spin_lock(&io_lock);
@@ -164,10 +168,9 @@ wdt_enable(void)
        w83697hf_deselect_wdt();
        spin_unlock(&io_lock);
-        return 0;
 }
-static int
+static void
 wdt_disable(void)
 {
        spin_lock(&io_lock);
@@ -178,7 +181,22 @@ wdt_disable(void)
        w83697hf_deselect_wdt();
        spin_unlock(&io_lock);
-        return 0;
+}
+static unsigned char
+wdt_running(void)
+{
+        unsigned char t;
+        spin_lock(&io_lock);
+        w83697hf_select_wdt();
+        t = w83697hf_get_reg(0xF4);     /* Read timer */
+        w83697hf_deselect_wdt();
+        spin_unlock(&io_lock);
+        return t;
 }
 static int
@@ -397,7 +415,11 @@ wdt_init(void)
        }
        w83697hf_init();
-        wdt_disable();  /* Disable watchdog until first use */
+        if (early_disable) {
+                if (wdt_running())
+                        printk (KERN_WARNING PFX "Stopping previously enabled watchdog until userland kicks in\n");
+                wdt_disable();
+        }
        if (wdt_set_heartbeat(timeout)) {
                wdt_set_heartbeat(WATCHDOG_TIMEOUT);
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 55e8ee1900a5..3263084eef9e 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -42,7 +42,7 @@ config BINFMT_ELF_FDPIC
 config BINFMT_FLAT
        bool "Kernel support for flat binaries"
-        depends on !MMU
+        depends on !MMU && (!FRV || BROKEN)
        help
          Support uClinux FLAT format binaries.
diff --git a/fs/afs/callback.c b/fs/afs/callback.c
index a78d5b236bb1..587ef5123cd8 100644
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -8,7 +8,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Authors: David Woodhouse <dwmw2@cambridge.redhat.com>
+ * Authors: David Woodhouse <dwmw2@infradead.org>
 *          David Howells <dhowells@redhat.com>
 *
 */
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 08db82e1343a..bb47217f6a18 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -8,7 +8,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Authors: David Woodhouse <dwmw2@cambridge.redhat.com>
+ * Authors: David Woodhouse <dwmw2@infradead.org>
 *          David Howells <dhowells@redhat.com>
 *
 */
diff --git a/fs/afs/super.c b/fs/afs/super.c
index 4b572b801d8d..7e3faeef6818 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -10,7 +10,7 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
 * Authors: David Howells <dhowells@redhat.com>
- *          David Woodhouse <dwmw2@redhat.com>
+ *          David Woodhouse <dwmw2@infradead.org>
 *
 */
diff --git a/fs/aio.c b/fs/aio.c
index b5253e77eb2f..0fb3117ddd93 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -591,10 +591,6 @@ static void use_mm(struct mm_struct *mm)
        atomic_inc(&mm->mm_count);
        tsk->mm = mm;
        tsk->active_mm = mm;
-        /*
-         * Note that on UML this *requires* PF_BORROWED_MM to be set, otherwise
-         * it won't work. Update it accordingly if you change it here
-         */
        switch_mm(active_mm, mm, tsk);
        task_unlock(tsk);
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index ddd35d873391..d051a32e6270 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -390,7 +390,7 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
        }
        /* expand the stack mapping to use up the entire allocation granule */
-        fullsize = ksize((char *) current->mm->start_brk);
+        fullsize = kobjsize((char *) current->mm->start_brk);
        if (!IS_ERR_VALUE(do_mremap(current->mm->start_brk, stack_size,
                                    fullsize, 0, 0)))
                stack_size = fullsize;
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 3b40d45a3a16..2cb1acda3a82 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -548,7 +548,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                        PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
                /* Remap to use all availabe slack region space */
                if (realdatastart && (realdatastart < (unsigned long)-4096)) {
-                        reallen = ksize((void *)realdatastart);
+                        reallen = kobjsize((void *)realdatastart);
                        if (reallen > len) {
                                realdatastart = do_mremap(realdatastart, len,
                                        reallen, MREMAP_FIXED, realdatastart);
@@ -600,7 +600,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                        PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);
                /* Remap to use all availabe slack region space */
                if (textpos && (textpos < (unsigned long) -4096)) {
-                        reallen = ksize((void *)textpos);
+                        reallen = kobjsize((void *)textpos);
                        if (reallen > len) {
                                textpos = do_mremap(textpos, len, reallen,
                                        MREMAP_FIXED, textpos);
@@ -683,7 +683,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                 */
                current->mm->start_brk = datapos + data_len + bss_len;
                current->mm->brk = (current->mm->start_brk + 3) & ~3;
-                current->mm->context.end_brk = memp + ksize((void *) memp) - stack_len;
+                current->mm->context.end_brk = memp + kobjsize((void *) memp) - stack_len;
        }
        if (flags & FLAT_FLAG_KTRACE)
@@ -790,7 +790,7 @@ static int load_flat_file(struct linux_binprm * bprm,
        /* zero the BSS,  BRK and stack areas */
        memset((void*)(datapos + data_len), 0, bss_len + 
-                        (memp + ksize((void *) memp) - stack_len -      /* end brk */
+                        (memp + kobjsize((void *) memp) - stack_len -   /* end brk */
                        libinfo->lib_list[id].start_brk) +              /* start brk */
                        stack_len);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 7d822fae7765..470c10ceb0fb 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -12,6 +12,7 @@
 #include <linux/kmod.h>
 #include <linux/major.h>
 #include <linux/smp_lock.h>
+#include <linux/device_cgroup.h>
 #include <linux/highmem.h>
 #include <linux/blkdev.h>
 #include <linux/module.h>
@@ -928,9 +929,14 @@ static int do_open(struct block_device *bdev, struct file *file, int for_part)
 {
        struct module *owner = NULL;
        struct gendisk *disk;
-        int ret = -ENXIO;
+        int ret;
        int part;
+        ret = devcgroup_inode_permission(bdev->bd_inode, file->f_mode);
+        if (ret != 0)
+                return ret;
+        ret = -ENXIO;
        file->f_mapping = bdev->bd_inode->i_mapping;
        lock_kernel();
        disk = get_gendisk(bdev->bd_dev, &part);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 28e3d5c5fcac..1f3465201fdf 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -2,6 +2,11 @@ Version 1.53
 ------------
 DFS support added (Microsoft Distributed File System client support needed
 for referrals which enable a hierarchical name space among servers).
+Disable temporary caching of mode bits to servers which do not support
+storing of mode (e.g. Windows servers, when client mounts without cifsacl
+mount option) and add new "dynperm" mount option to enable temporary caching
+of mode (enable old behavior).  Fix hang on mount caused when server crashes
+tcp session during negotiate protocol.
 Version 1.52
 ------------
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index cb52cbbe45ff..f58e41d3ba48 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len)
                        }
                }
        }
+        /* don't trust len bigger than ctx buffer */
+        if (*len > ctx->end - ctx->pointer)
+                return 0;
        return 1;
 }
@@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx,
        if (!asn1_length_decode(ctx, &def, &len))
                return 0;
+        /* primitive shall be definite, indefinite shall be constructed */
+        if (*con == ASN1_PRI && !def)
+                return 0;
        if (def)
                *eoc = ctx->pointer + len;
        else
@@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx,
        unsigned long *optr;
        size = eoc - ctx->pointer + 1;
+        /* first subid actually encodes first two subids */
+        if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+                return 0;
        *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
        if (*oid == NULL)
                return 0;
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 5df93fd6303f..86b4d5f405ae 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -97,9 +97,6 @@ cifs_read_super(struct super_block *sb, void *data,
 {
        struct inode *inode;
        struct cifs_sb_info *cifs_sb;
-#ifdef CONFIG_CIFS_DFS_UPCALL
-        int len;
-#endif
        int rc = 0;
        /* BB should we make this contingent on mount parm? */
@@ -117,15 +114,17 @@ cifs_read_super(struct super_block *sb, void *data,
         * complex operation (mount), and in case of fail
         * just exit instead of doing mount and attempting
         * undo it if this copy fails?*/
-        len = strlen(data);
+        if (data) {
-        cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
+                int len = strlen(data);
-        if (cifs_sb->mountdata == NULL) {
+                cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
-                kfree(sb->s_fs_info);
+                if (cifs_sb->mountdata == NULL) {
-                sb->s_fs_info = NULL;
+                        kfree(sb->s_fs_info);
-                return -ENOMEM;
+                        sb->s_fs_info = NULL;
+                        return -ENOMEM;
+                }
+                strncpy(cifs_sb->mountdata, data, len + 1);
+                cifs_sb->mountdata[len] = '\0';
        }
-        strncpy(cifs_sb->mountdata, data, len + 1);
-        cifs_sb->mountdata[len] = '\0';
 #endif
        rc = cifs_mount(sb, cifs_sb, data, devname);
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 08914053242b..9cfcf326ead3 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -333,7 +333,6 @@ struct cifsFileInfo {
        bool messageMode:1;     /* for pipes: message vs byte mode */
        atomic_t wrtPending;   /* handle in use - defer close */
        struct semaphore fh_sem; /* prevents reopen race after dead ses*/
-        char *search_resume_name; /* BB removeme BB */
        struct cifs_search_info srch_inf;
 };
@@ -626,7 +625,7 @@ GLOBAL_EXTERN atomic_t tcpSesAllocCount;
 GLOBAL_EXTERN atomic_t tcpSesReconnectCount;
 GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
-/* Various Debug counters to remove someday (BB) */
+/* Various Debug counters */
 GLOBAL_EXTERN atomic_t bufAllocCount;    /* current number allocated  */
 #ifdef CONFIG_CIFS_STATS2
 GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 65d58b4e6a61..0f327c224da3 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -79,6 +79,19 @@
 #define TRANS2_GET_DFS_REFERRAL       0x10
 #define TRANS2_REPORT_DFS_INCOSISTENCY 0x11
+/* SMB Transact (Named Pipe) subcommand codes */
+#define TRANS_SET_NMPIPE_STATE      0x0001
+#define TRANS_RAW_READ_NMPIPE       0x0011
+#define TRANS_QUERY_NMPIPE_STATE    0x0021
+#define TRANS_QUERY_NMPIPE_INFO     0x0022
+#define TRANS_PEEK_NMPIPE           0x0023
+#define TRANS_TRANSACT_NMPIPE       0x0026
+#define TRANS_RAW_WRITE_NMPIPE      0x0031
+#define TRANS_READ_NMPIPE           0x0036
+#define TRANS_WRITE_NMPIPE          0x0037
+#define TRANS_WAIT_NMPIPE           0x0053
+#define TRANS_CALL_NMPIPE           0x0054
 /* NT Transact subcommand codes */
 #define NT_TRANSACT_CREATE            0x01
 #define NT_TRANSACT_IOCTL             0x02
@@ -328,12 +341,13 @@
 #define CREATE_COMPLETE_IF_OPLK 0x00000100      /* should be zero */
 #define CREATE_NO_EA_KNOWLEDGE  0x00000200
 #define CREATE_EIGHT_DOT_THREE  0x00000400      /* doc says this is obsolete
-                                                 open for recovery flag - should
+                                                 "open for recovery" flag - should
-                                                 be zero */
+                                                 be zero in any case */
+#define CREATE_OPEN_FOR_RECOVERY 0x00000400
 #define CREATE_RANDOM_ACCESS    0x00000800
 #define CREATE_DELETE_ON_CLOSE  0x00001000
 #define CREATE_OPEN_BY_ID       0x00002000
-#define CREATE_OPEN_BACKUP_INTN 0x00004000
+#define CREATE_OPEN_BACKUP_INTENT 0x00004000
 #define CREATE_NO_COMPRESSION   0x00008000
 #define CREATE_RESERVE_OPFILTER 0x00100000      /* should be zero */
 #define OPEN_REPARSE_POINT      0x00200000
@@ -722,7 +736,6 @@ typedef struct smb_com_tconx_rsp_ext {
 #define SMB_CSC_CACHE_AUTO_REINT   0x0004
 #define SMB_CSC_CACHE_VDO          0x0008
 #define SMB_CSC_NO_CACHING         0x000C
 #define SMB_UNIQUE_FILE_NAME    0x0010
 #define SMB_EXTENDED_SIGNATURES 0x0020
@@ -806,7 +819,7 @@ typedef struct smb_com_findclose_req {
 #define ICOUNT_MASK             0x00FF
 #define PIPE_READ_MODE          0x0100
 #define NAMED_PIPE_TYPE         0x0400
-#define PIPE_END_POINT          0x0800
+#define PIPE_END_POINT          0x4000
 #define BLOCKING_NAMED_PIPE     0x8000
 typedef struct smb_com_open_req {       /* also handles create */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 9b8b4cfdf993..4511b708f0f3 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1728,7 +1728,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
 {
        int rc = 0;
        LOCK_REQ *pSMB = NULL;
-        LOCK_RSP *pSMBr = NULL;
+/*      LOCK_RSP *pSMBr = NULL; */ /* No response data other than rc to parse */
        int bytes_returned;
        int timeout = 0;
        __u16 count;
@@ -1739,8 +1739,6 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
        if (rc)
                return rc;
-        pSMBr = (LOCK_RSP *)pSMB; /* BB removeme BB */
        if (lockType == LOCKING_ANDX_OPLOCK_RELEASE) {
                timeout = CIFS_ASYNC_OP; /* no response expected */
                pSMB->Timeout = 0;
@@ -1774,7 +1772,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
        if (waitFlag) {
                rc = SendReceiveBlockingLock(xid, tcon, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *) pSMBr, &bytes_returned);
+                        (struct smb_hdr *) pSMB, &bytes_returned);
                cifs_small_buf_release(pSMB);
        } else {
                rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *)pSMB,
@@ -3927,9 +3925,9 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
        }
        ref = (struct dfs_referral_level_3 *) &(pSMBr->referrals);
-        if (ref->VersionNumber != 3) {
+        if (ref->VersionNumber != cpu_to_le16(3)) {
                cERROR(1, ("Referrals of V%d version are not supported,"
-                        "should be V3", ref->VersionNumber));
+                        "should be V3", le16_to_cpu(ref->VersionNumber)));
                rc = -EINVAL;
                goto parse_DFS_referrals_exit;
        }
@@ -3977,7 +3975,7 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                if (rc)
                        goto parse_DFS_referrals_exit;
-                ref += ref->Size;
+                ref += le16_to_cpu(ref->Size);
        }
 parse_DFS_referrals_exit:
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 023434f72c15..e8fa46c7cff2 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -653,6 +653,7 @@ multi_t2_fnd:
        spin_lock(&GlobalMid_Lock);
        server->tcpStatus = CifsExiting;
        spin_unlock(&GlobalMid_Lock);
+        wake_up_all(&server->response_q);
        /* don't exit until kthread_stop is called */
        set_current_state(TASK_UNINTERRUPTIBLE);
@@ -2120,6 +2121,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
                }
+                if ((volume_info.cifs_acl) && (volume_info.dynperm))
+                        cERROR(1, ("mount option dynperm ignored if cifsacl "
+                                   "mount option supported"));
                tcon =
                    find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
                             volume_info.username);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index f0b5b5f3dd2e..fb69c1fa85c9 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -260,7 +260,9 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                                                 buf, inode->i_sb, xid,
                                                 &fileHandle);
                        if (newinode) {
-                                newinode->i_mode = mode;
+                                if (cifs_sb->mnt_cifs_flags &
+                                    CIFS_MOUNT_DYNPERM)
+                                        newinode->i_mode = mode;
                                if ((oplock & CIFS_CREATE_ACTION) &&
                                    (cifs_sb->mnt_cifs_flags &
                                     CIFS_MOUNT_SET_UID)) {
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 8636cec2642c..0aac824371a5 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -546,7 +546,6 @@ int cifs_close(struct inode *inode, struct file *file)
                        msleep(timeout);
                        timeout *= 8;
                }
-                kfree(pSMBFile->search_resume_name);
                kfree(file->private_data);
                file->private_data = NULL;
        } else
@@ -605,12 +604,6 @@ int cifs_closedir(struct inode *inode, struct file *file)
                        else
                                cifs_buf_release(ptmp);
                }
-                ptmp = pCFileStruct->search_resume_name;
-                if (ptmp) {
-                        cFYI(1, ("closedir free resume name"));
-                        pCFileStruct->search_resume_name = NULL;
-                        kfree(ptmp);
-                }
                kfree(file->private_data);
                file->private_data = NULL;
        }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 129dbfe4dca7..722be543ceec 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -418,6 +418,7 @@ int cifs_get_inode_info(struct inode **pinode,
        char *buf = NULL;
        bool adjustTZ = false;
        bool is_dfs_referral = false;
+        umode_t default_mode;
        pTcon = cifs_sb->tcon;
        cFYI(1, ("Getting info on %s", full_path));
@@ -530,47 +531,42 @@ int cifs_get_inode_info(struct inode **pinode,
                inode->i_mtime.tv_sec += pTcon->ses->server->timeAdj;
        }
-        /* set default mode. will override for dirs below */
+        /* get default inode mode */
-        if (atomic_read(&cifsInfo->inUse) == 0)
+        if (attr & ATTR_DIRECTORY)
-                /* new inode, can safely set these fields */
+                default_mode = cifs_sb->mnt_dir_mode;
-                inode->i_mode = cifs_sb->mnt_file_mode;
+        else
-        else /* since we set the inode type below we need to mask off
+                default_mode = cifs_sb->mnt_file_mode;
-             to avoid strange results if type changes and both
-             get orred in */
+        /* set permission bits */
-                inode->i_mode &= ~S_IFMT;
+        if (atomic_read(&cifsInfo->inUse) == 0 ||
-/*      if (attr & ATTR_REPARSE)  */
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
-        /* We no longer handle these as symlinks because we could not
+                inode->i_mode = default_mode;
-           follow them due to the absolute path with drive letter */
+        else {
-        if (attr & ATTR_DIRECTORY) {
+                /* just reenable write bits if !ATTR_READONLY */
-        /* override default perms since we do not do byte range locking
+                if ((inode->i_mode & S_IWUGO) == 0 &&
-           on dirs */
+                    (attr & ATTR_READONLY) == 0)
-                inode->i_mode = cifs_sb->mnt_dir_mode;
+                        inode->i_mode |= (S_IWUGO & default_mode);
-                inode->i_mode |= S_IFDIR;
+                        inode->i_mode &= ~S_IFMT;
-        } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
+        }
-                   (cifsInfo->cifsAttrs & ATTR_SYSTEM) &&
+        /* clear write bits if ATTR_READONLY is set */
-                   /* No need to le64 convert size of zero */
+        if (attr & ATTR_READONLY)
-                   (pfindData->EndOfFile == 0)) {
+                inode->i_mode &= ~S_IWUGO;
-                inode->i_mode = cifs_sb->mnt_file_mode;
-                inode->i_mode |= S_IFIFO;
+        /* set inode type */
-/* BB Finish for SFU style symlinks and devices */
+        if ((attr & ATTR_SYSTEM) &&
-        } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) {
-                   (cifsInfo->cifsAttrs & ATTR_SYSTEM)) {
+                /* no need to fix endianness on 0 */
-                if (decode_sfu_inode(inode, le64_to_cpu(pfindData->EndOfFile),
+                if (pfindData->EndOfFile == 0)
-                                     full_path, cifs_sb, xid))
+                        inode->i_mode |= S_IFIFO;
-                        cFYI(1, ("Unrecognized sfu inode type"));
+                else if (decode_sfu_inode(inode,
+                                le64_to_cpu(pfindData->EndOfFile),
-                cFYI(1, ("sfu mode 0%o", inode->i_mode));
+                                full_path, cifs_sb, xid))
+                        cFYI(1, ("unknown SFU file type\n"));
        } else {
-                inode->i_mode |= S_IFREG;
+                if (attr & ATTR_DIRECTORY)
-                /* treat dos attribute of read-only as read-only mode eg 555 */
+                        inode->i_mode |= S_IFDIR;
-                if (cifsInfo->cifsAttrs & ATTR_READONLY)
+                else
-                        inode->i_mode &= ~(S_IWUGO);
+                        inode->i_mode |= S_IFREG;
-                else if ((inode->i_mode & S_IWUGO) == 0)
-                        /* the ATTR_READONLY flag may have been */
-                        /* changed on server -- set any w bits  */
-                        /* allowed by mnt_file_mode             */
-                        inode->i_mode |= (S_IWUGO & cifs_sb->mnt_file_mode);
-        /* BB add code to validate if device or weird share or device type? */
        }
        spin_lock(&inode->i_lock);
@@ -1019,8 +1015,11 @@ mkdir_get_info:
                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                        }
                        if (direntry->d_inode) {
-                                direntry->d_inode->i_mode = mode;
+                                if (cifs_sb->mnt_cifs_flags &
-                                direntry->d_inode->i_mode |= S_IFDIR;
+                                     CIFS_MOUNT_DYNPERM)
+                                        direntry->d_inode->i_mode =
+                                                (mode | S_IFDIR);
                                if (cifs_sb->mnt_cifs_flags &
                                     CIFS_MOUNT_SET_UID) {
                                        direntry->d_inode->i_uid =
@@ -1547,13 +1546,26 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                } else
                        goto cifs_setattr_exit;
        }
-        if (attrs->ia_valid & ATTR_UID) {
-                cFYI(1, ("UID changed to %d", attrs->ia_uid));
+        /*
-                uid = attrs->ia_uid;
+         * Without unix extensions we can't send ownership changes to the
-        }
+         * server, so silently ignore them. This is consistent with how
-        if (attrs->ia_valid & ATTR_GID) {
+         * local DOS/Windows filesystems behave (VFAT, NTFS, etc). With
-                cFYI(1, ("GID changed to %d", attrs->ia_gid));
+         * CIFSACL support + proper Windows to Unix idmapping, we may be
-                gid = attrs->ia_gid;
+         * able to support this in the future.
+         */
+        if (!pTcon->unix_ext &&
+            !(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) {
+                attrs->ia_valid &= ~(ATTR_UID | ATTR_GID);
+        } else {
+                if (attrs->ia_valid & ATTR_UID) {
+                        cFYI(1, ("UID changed to %d", attrs->ia_uid));
+                        uid = attrs->ia_uid;
+                }
+                if (attrs->ia_valid & ATTR_GID) {
+                        cFYI(1, ("GID changed to %d", attrs->ia_gid));
+                        gid = attrs->ia_gid;
+                }
        }
        time_buf.Attributes = 0;
@@ -1563,7 +1575,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                attrs->ia_valid &= ~ATTR_MODE;
        if (attrs->ia_valid & ATTR_MODE) {
-                cFYI(1, ("Mode changed to 0x%x", attrs->ia_mode));
+                cFYI(1, ("Mode changed to 0%o", attrs->ia_mode));
                mode = attrs->ia_mode;
        }
@@ -1578,18 +1590,18 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
 #ifdef CONFIG_CIFS_EXPERIMENTAL
                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL)
                        rc = mode_to_acl(inode, full_path, mode);
-                else if ((mode & S_IWUGO) == 0) {
+                else
-#else
-                if ((mode & S_IWUGO) == 0) {
 #endif
-                        /* not writeable */
+                if (((mode & S_IWUGO) == 0) &&
-                        if ((cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
+                    (cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
-                                set_dosattr = true;
+                        set_dosattr = true;
-                                time_buf.Attributes =
+                        time_buf.Attributes = cpu_to_le32(cifsInode->cifsAttrs |
-                                        cpu_to_le32(cifsInode->cifsAttrs |
+                                                          ATTR_READONLY);
-                                                    ATTR_READONLY);
+                        /* fix up mode if we're not using dynperm */
-                        }
+                        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
-                } else if (cifsInode->cifsAttrs & ATTR_READONLY) {
+                                attrs->ia_mode = inode->i_mode & ~S_IWUGO;
+                } else if ((mode & S_IWUGO) &&
+                           (cifsInode->cifsAttrs & ATTR_READONLY)) {
                        /* If file is readonly on server, we would
                        not be able to write to it - so if any write
                        bit is enabled for user or group or other we
@@ -1600,6 +1612,20 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                        /* Windows ignores set to zero */
                        if (time_buf.Attributes == 0)
                                time_buf.Attributes |= cpu_to_le32(ATTR_NORMAL);
+                        /* reset local inode permissions to normal */
+                        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)) {
+                                attrs->ia_mode &= ~(S_IALLUGO);
+                                if (S_ISDIR(inode->i_mode))
+                                        attrs->ia_mode |=
+                                                cifs_sb->mnt_dir_mode;
+                                else
+                                        attrs->ia_mode |=
+                                                cifs_sb->mnt_file_mode;
+                        }
+                } else if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)) {
+                        /* ignore mode change - ATTR_READONLY hasn't changed */
+                        attrs->ia_valid &= ~ATTR_MODE;
                }
        }
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 1d69b8014e0b..4b17f8fe3157 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -519,8 +519,7 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
                        pnotify = (struct file_notify_information *)
                                ((char *)&pSMBr->hdr.Protocol + data_offset);
                        cFYI(1, ("dnotify on %s Action: 0x%x",
-                                 pnotify->FileName,
+                                 pnotify->FileName, pnotify->Action));
-                                pnotify->Action));  /* BB removeme BB */
                        /*   cifs_dump_mem("Rcvd notify Data: ",buf,
                                sizeof(struct smb_hdr)+60); */
                        return true;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 713c25110197..83f306954883 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -132,6 +132,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
        __u32 attr;
        __u64 allocation_size;
        __u64 end_of_file;
+        umode_t default_mode;
        /* save mtime and size */
        local_mtime = tmp_inode->i_mtime;
@@ -187,48 +188,54 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
        if (atomic_read(&cifsInfo->inUse) == 0) {
                tmp_inode->i_uid = cifs_sb->mnt_uid;
                tmp_inode->i_gid = cifs_sb->mnt_gid;
-                /* set default mode. will override for dirs below */
+        }
-                tmp_inode->i_mode = cifs_sb->mnt_file_mode;
-        } else {
+        if (attr & ATTR_DIRECTORY)
-                /* mask off the type bits since it gets set
+                default_mode = cifs_sb->mnt_dir_mode;
-                below and we do not want to get two type
+        else
-                bits set */
+                default_mode = cifs_sb->mnt_file_mode;
+        /* set initial permissions */
+        if ((atomic_read(&cifsInfo->inUse) == 0) ||
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
+                tmp_inode->i_mode = default_mode;
+        else {
+                /* just reenable write bits if !ATTR_READONLY */
+                if ((tmp_inode->i_mode & S_IWUGO) == 0 &&
+                    (attr & ATTR_READONLY) == 0)
+                        tmp_inode->i_mode |= (S_IWUGO & default_mode);
                tmp_inode->i_mode &= ~S_IFMT;
        }
-        if (attr & ATTR_DIRECTORY) {
+        /* clear write bits if ATTR_READONLY is set */
-                *pobject_type = DT_DIR;
+        if (attr & ATTR_READONLY)
-                /* override default perms since we do not lock dirs */
+                tmp_inode->i_mode &= ~S_IWUGO;
-                if (atomic_read(&cifsInfo->inUse) == 0)
-                        tmp_inode->i_mode = cifs_sb->mnt_dir_mode;
+        /* set inode type */
-                tmp_inode->i_mode |= S_IFDIR;
+        if ((attr & ATTR_SYSTEM) &&
-        } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) {
-                   (attr & ATTR_SYSTEM)) {
                if (end_of_file == 0)  {
-                        *pobject_type = DT_FIFO;
                        tmp_inode->i_mode |= S_IFIFO;
+                        *pobject_type = DT_FIFO;
                } else {
-                        /* rather than get the type here, we mark the
+                        /*
-                        inode as needing revalidate and get the real type
+                         * trying to get the type can be slow, so just call
-                        (blk vs chr vs. symlink) later ie in lookup */
+                         * this a regular file for now, and mark for reval
-                        *pobject_type = DT_REG;
+                         */
                        tmp_inode->i_mode |= S_IFREG;
+                        *pobject_type = DT_REG;
                        cifsInfo->time = 0;
                }
-/* we no longer mark these because we could not follow them */
-/*        } else if (attr & ATTR_REPARSE) {
-                *pobject_type = DT_LNK;
-                tmp_inode->i_mode |= S_IFLNK; */
        } else {
-                *pobject_type = DT_REG;
+                if (attr & ATTR_DIRECTORY) {
-                tmp_inode->i_mode |= S_IFREG;
+                        tmp_inode->i_mode |= S_IFDIR;
-                if (attr & ATTR_READONLY)
+                        *pobject_type = DT_DIR;
-                        tmp_inode->i_mode &= ~(S_IWUGO);
+                } else {
-                else if ((tmp_inode->i_mode & S_IWUGO) == 0)
+                        tmp_inode->i_mode |= S_IFREG;
-                        /* the ATTR_READONLY flag may have been changed on   */
+                        *pobject_type = DT_REG;
-                        /* server -- set any w bits allowed by mnt_file_mode */
+                }
-                        tmp_inode->i_mode |= (S_IWUGO & cifs_sb->mnt_file_mode);
+        }
-        } /* could add code here - to validate if device or weird share type? */
        /* can not fill in nlink here as in qpathinfo version and Unx search */
        if (atomic_read(&cifsInfo->inUse) == 0)
@@ -675,8 +682,6 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
                        cifsFile->invalidHandle = true;
                        CIFSFindClose(xid, pTcon, cifsFile->netfid);
                }
-                kfree(cifsFile->search_resume_name);
-                cifsFile->search_resume_name = NULL;
                if (cifsFile->srch_inf.ntwrk_buf_start) {
                        cFYI(1, ("freeing SMB ff cache buf on search rewind"));
                        if (cifsFile->srch_inf.smallBuf)
@@ -1043,9 +1048,7 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                } /* else {
                        cifsFile->invalidHandle = true;
                        CIFSFindClose(xid, pTcon, cifsFile->netfid);
-                }
+                } */
-                kfree(cifsFile->search_resume_name);
-                cifsFile->search_resume_name = NULL; */
                rc = find_cifs_entry(xid, pTcon, file,
                                &current_entry, &num_to_fill);
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index cd62d75b2cc0..e2832bc7869a 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1906,9 +1906,9 @@ int ecryptfs_get_tfm_and_mutex_for_cipher_name(struct crypto_blkcipher **tfm,
                        goto out;
                }
        }
-        mutex_unlock(&key_tfm_list_mutex);
        (*tfm) = key_tfm->key_tfm;
        (*tfm_mutex) = &key_tfm->key_tfm_mutex;
 out:
+        mutex_unlock(&key_tfm_list_mutex);
        return rc;
 }
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 951ee33a022d..c15c25745e05 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -660,8 +660,6 @@ int ecryptfs_get_tfm_and_mutex_for_cipher_name(struct crypto_blkcipher **tfm,
 int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
                                      struct ecryptfs_auth_tok **auth_tok,
                                      char *sig);
-int ecryptfs_write_zeros(struct file *file, pgoff_t index, int start,
-                         int num_zeros);
 int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
                         loff_t offset, size_t size);
 int ecryptfs_write_lower_page_segment(struct inode *ecryptfs_inode,
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index ebf55150be56..75c2ea9fee35 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -157,20 +157,6 @@ int ecryptfs_write(struct file *ecryptfs_file, char *data, loff_t offset,
                               ecryptfs_page_idx, rc);
                        goto out;
                }
-                if (start_offset_in_page) {
-                        /* Read in the page from the lower
-                         * into the eCryptfs inode page cache,
-                         * decrypting */
-                        rc = ecryptfs_decrypt_page(ecryptfs_page);
-                        if (rc) {
-                                printk(KERN_ERR "%s: Error decrypting "
-                                       "page; rc = [%d]\n",
-                                       __func__, rc);
-                                ClearPageUptodate(ecryptfs_page);
-                                page_cache_release(ecryptfs_page);
-                                goto out;
-                        }
-                }
                ecryptfs_page_virt = kmap_atomic(ecryptfs_page, KM_USER0);
                /*
@@ -349,14 +335,6 @@ int ecryptfs_read(char *data, loff_t offset, size_t size,
                               ecryptfs_page_idx, rc);
                        goto out;
                }
-                rc = ecryptfs_decrypt_page(ecryptfs_page);
-                if (rc) {
-                        printk(KERN_ERR "%s: Error decrypting "
-                               "page; rc = [%d]\n", __func__, rc);
-                        ClearPageUptodate(ecryptfs_page);
-                        page_cache_release(ecryptfs_page);
-                        goto out;
-                }
                ecryptfs_page_virt = kmap_atomic(ecryptfs_page, KM_USER0);
                memcpy((data + data_offset),
                       ((char *)ecryptfs_page_virt + start_offset_in_page),
diff --git a/fs/exec.c b/fs/exec.c
index 3c2ba7ce11d4..9448f1b50b4a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -860,6 +860,7 @@ static int de_thread(struct task_struct *tsk)
 no_thread_group:
        exit_itimers(sig);
+        flush_itimer_signals();
        if (leader)
                release_task(leader);
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 28cfd0b40527..77278e947e94 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -580,7 +580,8 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
        }
        blk = EXT3_SB(sb)->s_sbh->b_blocknr + 1 + EXT3_SB(sb)->s_gdb_count;
-        data = (__le32 *)dind->b_data + EXT3_SB(sb)->s_gdb_count;
+        data = (__le32 *)dind->b_data + (EXT3_SB(sb)->s_gdb_count %
+                                         EXT3_ADDR_PER_BLOCK(sb));
        end = (__le32 *)dind->b_data + EXT3_ADDR_PER_BLOCK(sb);
        /* Get each reserved primary GDT block and verify it holds backups */
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 30494c5da843..9cc80b9cc8d8 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -43,6 +43,46 @@ void ext4_get_group_no_and_offset(struct super_block *sb, ext4_fsblk_t blocknr,
 }
+static int ext4_block_in_group(struct super_block *sb, ext4_fsblk_t block,
+                        ext4_group_t block_group)
+{
+        ext4_group_t actual_group;
+        ext4_get_group_no_and_offset(sb, block, &actual_group, 0);
+        if (actual_group == block_group)
+                return 1;
+        return 0;
+}
+static int ext4_group_used_meta_blocks(struct super_block *sb,
+                                ext4_group_t block_group)
+{
+        ext4_fsblk_t tmp;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        /* block bitmap, inode bitmap, and inode table blocks */
+        int used_blocks = sbi->s_itb_per_group + 2;
+        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) {
+                struct ext4_group_desc *gdp;
+                struct buffer_head *bh;
+                gdp = ext4_get_group_desc(sb, block_group, &bh);
+                if (!ext4_block_in_group(sb, ext4_block_bitmap(sb, gdp),
+                                        block_group))
+                        used_blocks--;
+                if (!ext4_block_in_group(sb, ext4_inode_bitmap(sb, gdp),
+                                        block_group))
+                        used_blocks--;
+                tmp = ext4_inode_table(sb, gdp);
+                for (; tmp < ext4_inode_table(sb, gdp) +
+                                sbi->s_itb_per_group; tmp++) {
+                        if (!ext4_block_in_group(sb, tmp, block_group))
+                                used_blocks -= 1;
+                }
+        }
+        return used_blocks;
+}
 /* Initializes an uninitialized block bitmap if given, and returns the
 * number of blocks free in the group. */
 unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
@@ -105,20 +145,34 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
        free_blocks = group_blocks - bit_max;
        if (bh) {
-                ext4_fsblk_t start;
+                ext4_fsblk_t start, tmp;
+                int flex_bg = 0;
                for (bit = 0; bit < bit_max; bit++)
                        ext4_set_bit(bit, bh->b_data);
                start = ext4_group_first_block_no(sb, block_group);
-                /* Set bits for block and inode bitmaps, and inode table */
+                if (EXT4_HAS_INCOMPAT_FEATURE(sb,
-                ext4_set_bit(ext4_block_bitmap(sb, gdp) - start, bh->b_data);
+                                              EXT4_FEATURE_INCOMPAT_FLEX_BG))
-                ext4_set_bit(ext4_inode_bitmap(sb, gdp) - start, bh->b_data);
+                        flex_bg = 1;
-                for (bit = (ext4_inode_table(sb, gdp) - start),
-                     bit_max = bit + sbi->s_itb_per_group; bit < bit_max; bit++)
-                        ext4_set_bit(bit, bh->b_data);
+                /* Set bits for block and inode bitmaps, and inode table */
+                tmp = ext4_block_bitmap(sb, gdp);
+                if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
+                        ext4_set_bit(tmp - start, bh->b_data);
+                tmp = ext4_inode_bitmap(sb, gdp);
+                if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
+                        ext4_set_bit(tmp - start, bh->b_data);
+                tmp = ext4_inode_table(sb, gdp);
+                for (; tmp < ext4_inode_table(sb, gdp) +
+                                sbi->s_itb_per_group; tmp++) {
+                        if (!flex_bg ||
+                                ext4_block_in_group(sb, tmp, block_group))
+                                ext4_set_bit(tmp - start, bh->b_data);
+                }
                /*
                 * Also if the number of blocks within the group is
                 * less than the blocksize * 8 ( which is the size
@@ -126,8 +180,7 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
                 */
                mark_bitmap_end(group_blocks, sb->s_blocksize * 8, bh->b_data);
        }
+        return free_blocks - ext4_group_used_meta_blocks(sb, block_group);
-        return free_blocks - sbi->s_itb_per_group - 2;
 }
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 873ad9b3418c..c9900aade150 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2745,8 +2745,6 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
        sbi = EXT4_SB(sb);
        es = sbi->s_es;
-        ext4_debug("using block group %lu(%d)\n", ac->ac_b_ex.fe_group,
-                        gdp->bg_free_blocks_count);
        err = -EIO;
        bitmap_bh = read_block_bitmap(sb, ac->ac_b_ex.fe_group);
@@ -2762,6 +2760,9 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
        if (!gdp)
                goto out_err;
+        ext4_debug("using block group %lu(%d)\n", ac->ac_b_ex.fe_group,
+                        gdp->bg_free_blocks_count);
        err = ext4_journal_get_write_access(handle, gdp_bh);
        if (err)
                goto out_err;
@@ -3094,8 +3095,7 @@ static void ext4_mb_use_inode_pa(struct ext4_allocation_context *ac,
 static void ext4_mb_use_group_pa(struct ext4_allocation_context *ac,
                                struct ext4_prealloc_space *pa)
 {
-        unsigned len = ac->ac_o_ex.fe_len;
+        unsigned int len = ac->ac_o_ex.fe_len;
        ext4_get_group_no_and_offset(ac->ac_sb, pa->pa_pstart,
                                        &ac->ac_b_ex.fe_group,
                                        &ac->ac_b_ex.fe_start);
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 9f086a6a472b..9ecb92f68543 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -563,7 +563,8 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
        }
        blk = EXT4_SB(sb)->s_sbh->b_blocknr + 1 + EXT4_SB(sb)->s_gdb_count;
-        data = (__le32 *)dind->b_data + EXT4_SB(sb)->s_gdb_count;
+        data = (__le32 *)dind->b_data + (EXT4_SB(sb)->s_gdb_count %
+                                         EXT4_ADDR_PER_BLOCK(sb));
        end = (__le32 *)dind->b_data + EXT4_ADDR_PER_BLOCK(sb);
        /* Get each reserved primary GDT block and verify it holds backups */
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 09d9359c8055..cb96f127c366 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -671,6 +671,7 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
        unsigned long def_mount_opts;
        struct super_block *sb = vfs->mnt_sb;
        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        journal_t *journal = sbi->s_journal;
        struct ext4_super_block *es = sbi->s_es;
        def_mount_opts = le32_to_cpu(es->s_default_mount_opts);
@@ -729,8 +730,15 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
                seq_printf(seq, ",commit=%u",
                           (unsigned) (sbi->s_commit_interval / HZ));
        }
-        if (test_opt(sb, BARRIER))
+        /*
-                seq_puts(seq, ",barrier=1");
+         * We're changing the default of barrier mount option, so
+         * let's always display its mount state so it's clear what its
+         * status is.
+         */
+        seq_puts(seq, ",barrier=");
+        seq_puts(seq, test_opt(sb, BARRIER) ? "1" : "0");
+        if (test_opt(sb, JOURNAL_ASYNC_COMMIT))
+                seq_puts(seq, ",journal_async_commit");
        if (test_opt(sb, NOBH))
                seq_puts(seq, ",nobh");
        if (!test_opt(sb, EXTENTS))
@@ -1907,6 +1915,7 @@ static int ext4_fill_super (struct super_block *sb, void *data, int silent)
        sbi->s_resgid = le16_to_cpu(es->s_def_resgid);
        set_opt(sbi->s_mount_opt, RESERVATION);
+        set_opt(sbi->s_mount_opt, BARRIER);
        /*
         * turn on extents feature by default in ext4 filesystem
@@ -2189,6 +2198,29 @@ static int ext4_fill_super (struct super_block *sb, void *data, int silent)
            EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_HAS_JOURNAL)) {
                if (ext4_load_journal(sb, es, journal_devnum))
                        goto failed_mount3;
+                if (!(sb->s_flags & MS_RDONLY) &&
+                    EXT4_SB(sb)->s_journal->j_failed_commit) {
+                        printk(KERN_CRIT "EXT4-fs error (device %s): "
+                               "ext4_fill_super: Journal transaction "
+                               "%u is corrupt\n", sb->s_id, 
+                               EXT4_SB(sb)->s_journal->j_failed_commit);
+                        if (test_opt (sb, ERRORS_RO)) {
+                                printk (KERN_CRIT
+                                        "Mounting filesystem read-only\n");
+                                sb->s_flags |= MS_RDONLY;
+                                EXT4_SB(sb)->s_mount_state |= EXT4_ERROR_FS;
+                                es->s_state |= cpu_to_le16(EXT4_ERROR_FS);
+                        }
+                        if (test_opt(sb, ERRORS_PANIC)) {
+                                EXT4_SB(sb)->s_mount_state |= EXT4_ERROR_FS;
+                                es->s_state |= cpu_to_le16(EXT4_ERROR_FS);
+                                ext4_commit_super(sb, es, 1);
+                                printk(KERN_CRIT
+                                       "EXT4-fs (device %s): mount failed\n",
+                                      sb->s_id);
+                                goto failed_mount4;
+                        }
+                }
        } else if (journal_inum) {
                if (ext4_create_journal(sb, es, journal_inum))
                        goto failed_mount3;
diff --git a/fs/fat/file.c b/fs/fat/file.c
index 27cc1164ec36..771326b8047e 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -257,26 +257,34 @@ int fat_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
 }
 EXPORT_SYMBOL_GPL(fat_getattr);
-static int fat_check_mode(const struct msdos_sb_info *sbi, struct inode *inode,
+static int fat_sanitize_mode(const struct msdos_sb_info *sbi,
-                          mode_t mode)
+                             struct inode *inode, umode_t *mode_ptr)
 {
-        mode_t mask, req = mode & ~S_IFMT;
+        mode_t mask, perm;
-        if (S_ISREG(mode))
+        /*
+         * Note, the basic check is already done by a caller of
+         * (attr->ia_mode & ~MSDOS_VALID_MODE)
+         */
+        if (S_ISREG(inode->i_mode))
                mask = sbi->options.fs_fmask;
        else
                mask = sbi->options.fs_dmask;
+        perm = *mode_ptr & ~(S_IFMT | mask);
        /*
         * Of the r and x bits, all (subject to umask) must be present. Of the
         * w bits, either all (subject to umask) or none must be present.
         */
-        req &= ~mask;
+        if ((perm & (S_IRUGO | S_IXUGO)) != (inode->i_mode & (S_IRUGO|S_IXUGO)))
-        if ((req & (S_IRUGO | S_IXUGO)) != (inode->i_mode & (S_IRUGO|S_IXUGO)))
                return -EPERM;
-        if ((req & S_IWUGO) && ((req & S_IWUGO) != (S_IWUGO & ~mask)))
+        if ((perm & S_IWUGO) && ((perm & S_IWUGO) != (S_IWUGO & ~mask)))
                return -EPERM;
+        *mode_ptr &= S_IFMT | perm;
        return 0;
 }
@@ -299,7 +307,7 @@ int fat_setattr(struct dentry *dentry, struct iattr *attr)
 {
        struct msdos_sb_info *sbi = MSDOS_SB(dentry->d_sb);
        struct inode *inode = dentry->d_inode;
-        int mask, error = 0;
+        int error = 0;
        unsigned int ia_valid;
        lock_kernel();
@@ -332,12 +340,13 @@ int fat_setattr(struct dentry *dentry, struct iattr *attr)
                        error = 0;
                goto out;
        }
        if (((attr->ia_valid & ATTR_UID) &&
             (attr->ia_uid != sbi->options.fs_uid)) ||
            ((attr->ia_valid & ATTR_GID) &&
             (attr->ia_gid != sbi->options.fs_gid)) ||
            ((attr->ia_valid & ATTR_MODE) &&
-             fat_check_mode(sbi, inode, attr->ia_mode) < 0))
+             (attr->ia_mode & ~MSDOS_VALID_MODE)))
                error = -EPERM;
        if (error) {
@@ -346,15 +355,16 @@ int fat_setattr(struct dentry *dentry, struct iattr *attr)
                goto out;
        }
-        error = inode_setattr(inode, attr);
+        /*
-        if (error)
+         * We don't return -EPERM here. Yes, strange, but this is too
-                goto out;
+         * old behavior.
+         */
+        if (attr->ia_valid & ATTR_MODE) {
+                if (fat_sanitize_mode(sbi, inode, &attr->ia_mode) < 0)
+                        attr->ia_valid &= ~ATTR_MODE;
+        }
-        if (S_ISDIR(inode->i_mode))
+        error = inode_setattr(inode, attr);
-                mask = sbi->options.fs_dmask;
-        else
-                mask = sbi->options.fs_fmask;
-        inode->i_mode &= S_IFMT | (S_IRWXUGO & ~mask);
 out:
        unlock_kernel();
        return error;
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index fb77e0962132..43e99513334a 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -488,7 +488,12 @@ static struct fuse_conn *new_conn(struct super_block *sb)
                err = bdi_init(&fc->bdi);
                if (err)
                        goto error_kfree;
-                err = bdi_register_dev(&fc->bdi, fc->dev);
+                if (sb->s_bdev) {
+                        err = bdi_register(&fc->bdi, NULL, "%u:%u-fuseblk",
+                                           MAJOR(fc->dev), MINOR(fc->dev));
+                } else {
+                        err = bdi_register_dev(&fc->bdi, fc->dev);
+                }
                if (err)
                        goto error_bdi_destroy;
                /*
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 4d99685fdce4..a2ed72f7ceee 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -168,6 +168,7 @@ static int journal_submit_commit_record(journal_t *journal,
                spin_unlock(&journal->j_state_lock);
                /* And try again, without the barrier */
+                lock_buffer(bh);
                set_buffer_uptodate(bh);
                set_buffer_dirty(bh);
                ret = submit_bh(WRITE, bh);
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 5d0405a9e7ca..058f50f65b76 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -344,6 +344,7 @@ static int calc_chksums(journal_t *journal, struct buffer_head *bh,
                        *crc32_sum = crc32_be(*crc32_sum, (void *)obh->b_data,
                                     obh->b_size);
                }
+                put_bh(obh);
        }
        return 0;
 }
@@ -610,9 +611,8 @@ static int do_one_pass(journal_t *journal,
                                chksum_err = chksum_seen = 0;
                                if (info->end_transaction) {
-                                        printk(KERN_ERR "JBD: Transaction %u "
+                                        journal->j_failed_commit =
-                                                "found to be corrupt.\n",
+                                                info->end_transaction;
-                                                next_commit_ID - 1);
                                        brelse(bh);
                                        break;
                                }
@@ -643,10 +643,8 @@ static int do_one_pass(journal_t *journal,
                                        if (!JBD2_HAS_INCOMPAT_FEATURE(journal,
                                           JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)){
-                                                printk(KERN_ERR
+                                                journal->j_failed_commit =
-                                                       "JBD: Transaction %u "
+                                                        next_commit_ID;
-                                                       "found to be corrupt.\n",
-                                                       next_commit_ID);
                                                brelse(bh);
                                                break;
                                        }
diff --git a/fs/libfs.c b/fs/libfs.c
index b004dfadd891..892d41cb3382 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -528,6 +528,23 @@ ssize_t simple_read_from_buffer(void __user *to, size_t count, loff_t *ppos,
        return count;
 }
+ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
+                                const void *from, size_t available)
+{
+        loff_t pos = *ppos;
+        if (pos < 0)
+                return -EINVAL;
+        if (pos >= available)
+                return 0;
+        if (count > available - pos)
+                count = available - pos;
+        memcpy(to, from + pos, count);
+        *ppos = pos + count;
+        return count;
+}
 /*
 * Transaction based IO.
 * The file expects a single write which triggers the transaction, and then
@@ -800,6 +817,7 @@ EXPORT_SYMBOL(simple_statfs);
 EXPORT_SYMBOL(simple_sync_file);
 EXPORT_SYMBOL(simple_unlink);
 EXPORT_SYMBOL(simple_read_from_buffer);
+EXPORT_SYMBOL(memory_read_from_buffer);
 EXPORT_SYMBOL(simple_transaction_get);
 EXPORT_SYMBOL(simple_transaction_read);
 EXPORT_SYMBOL(simple_transaction_release);
diff --git a/fs/ntfs/upcase.c b/fs/ntfs/upcase.c
index 9101807dc81a..e2f72ca98037 100644
--- a/fs/ntfs/upcase.c
+++ b/fs/ntfs/upcase.c
@@ -77,11 +77,10 @@ ntfschar *generate_default_upcase(void)
                uc[i] = cpu_to_le16(i);
        for (r = 0; uc_run_table[r][0]; r++)
                for (i = uc_run_table[r][0]; i < uc_run_table[r][1]; i++)
-                        uc[i] = cpu_to_le16(le16_to_cpu(uc[i]) +
+                        le16_add_cpu(&uc[i], uc_run_table[r][2]);
-                                        uc_run_table[r][2]);
        for (r = 0; uc_dup_table[r][0]; r++)
                for (i = uc_dup_table[r][0]; i < uc_dup_table[r][1]; i += 2)
-                        uc[i + 1] = cpu_to_le16(le16_to_cpu(uc[i + 1]) - 1);
+                        le16_add_cpu(&uc[i + 1], -1);
        for (r = 0; uc_word_table[r][0]; r++)
                uc[uc_word_table[r][0]] = cpu_to_le16(uc_word_table[r][1]);
        return uc;
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 1e44ad14881a..a27d61581bd6 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -142,53 +142,43 @@ static void o2net_idle_timer(unsigned long data);
 static void o2net_sc_postpone_idle(struct o2net_sock_container *sc);
 static void o2net_sc_reset_idle_timer(struct o2net_sock_container *sc);
-static void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
-                           u32 msgkey, struct task_struct *task, u8 node)
-{
 #ifdef CONFIG_DEBUG_FS
+void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
+                    u32 msgkey, struct task_struct *task, u8 node)
+{
        INIT_LIST_HEAD(&nst->st_net_debug_item);
        nst->st_task = task;
        nst->st_msg_type = msgtype;
        nst->st_msg_key = msgkey;
        nst->st_node = node;
-#endif
 }
-static void o2net_set_nst_sock_time(struct o2net_send_tracking *nst)
+void o2net_set_nst_sock_time(struct o2net_send_tracking *nst)
 {
-#ifdef CONFIG_DEBUG_FS
        do_gettimeofday(&nst->st_sock_time);
-#endif
 }
-static void o2net_set_nst_send_time(struct o2net_send_tracking *nst)
+void o2net_set_nst_send_time(struct o2net_send_tracking *nst)
 {
-#ifdef CONFIG_DEBUG_FS
        do_gettimeofday(&nst->st_send_time);
-#endif
 }
-static void o2net_set_nst_status_time(struct o2net_send_tracking *nst)
+void o2net_set_nst_status_time(struct o2net_send_tracking *nst)
 {
-#ifdef CONFIG_DEBUG_FS
        do_gettimeofday(&nst->st_status_time);
-#endif
 }
-static void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
+void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
                                         struct o2net_sock_container *sc)
 {
-#ifdef CONFIG_DEBUG_FS
        nst->st_sc = sc;
-#endif
 }
-static void o2net_set_nst_msg_id(struct o2net_send_tracking *nst, u32 msg_id)
+void o2net_set_nst_msg_id(struct o2net_send_tracking *nst, u32 msg_id)
 {
-#ifdef CONFIG_DEBUG_FS
        nst->st_id = msg_id;
-#endif
 }
+#endif /* CONFIG_DEBUG_FS */
 static inline int o2net_reconnect_delay(void)
 {
diff --git a/fs/ocfs2/cluster/tcp.h b/fs/ocfs2/cluster/tcp.h
index a705d5d19036..fd6179eb26d4 100644
--- a/fs/ocfs2/cluster/tcp.h
+++ b/fs/ocfs2/cluster/tcp.h
@@ -128,23 +128,23 @@ void o2net_debug_del_nst(struct o2net_send_tracking *nst);
 void o2net_debug_add_sc(struct o2net_sock_container *sc);
 void o2net_debug_del_sc(struct o2net_sock_container *sc);
 #else
-static int o2net_debugfs_init(void)
+static inline int o2net_debugfs_init(void)
 {
        return 0;
 }
-static void o2net_debugfs_exit(void)
+static inline void o2net_debugfs_exit(void)
 {
 }
-static void o2net_debug_add_nst(struct o2net_send_tracking *nst)
+static inline void o2net_debug_add_nst(struct o2net_send_tracking *nst)
 {
 }
-static void o2net_debug_del_nst(struct o2net_send_tracking *nst)
+static inline void o2net_debug_del_nst(struct o2net_send_tracking *nst)
 {
 }
-static void o2net_debug_add_sc(struct o2net_sock_container *sc)
+static inline void o2net_debug_add_sc(struct o2net_sock_container *sc)
 {
 }
-static void o2net_debug_del_sc(struct o2net_sock_container *sc)
+static inline void o2net_debug_del_sc(struct o2net_sock_container *sc)
 {
 }
 #endif  /* CONFIG_DEBUG_FS */
diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
index 8d58cfe410b1..18307ff81b77 100644
--- a/fs/ocfs2/cluster/tcp_internal.h
+++ b/fs/ocfs2/cluster/tcp_internal.h
@@ -224,10 +224,42 @@ struct o2net_send_tracking {
        struct timeval                  st_send_time;
        struct timeval                  st_status_time;
 };
+void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
+                    u32 msgkey, struct task_struct *task, u8 node);
+void o2net_set_nst_sock_time(struct o2net_send_tracking *nst);
+void o2net_set_nst_send_time(struct o2net_send_tracking *nst);
+void o2net_set_nst_status_time(struct o2net_send_tracking *nst);
+void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
+                                  struct o2net_sock_container *sc);
+void o2net_set_nst_msg_id(struct o2net_send_tracking *nst, u32 msg_id);
 #else
 struct o2net_send_tracking {
        u32     dummy;
 };
+static inline void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
+                                  u32 msgkey, struct task_struct *task, u8 node)
+{
+}
+static inline void o2net_set_nst_sock_time(struct o2net_send_tracking *nst)
+{
+}
+static inline void o2net_set_nst_send_time(struct o2net_send_tracking *nst)
+{
+}
+static inline void o2net_set_nst_status_time(struct o2net_send_tracking *nst)
+{
+}
+static inline void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
+                                                struct o2net_sock_container *sc)
+{
+}
+static inline void o2net_set_nst_msg_id(struct o2net_send_tracking *nst,
+                                        u32 msg_id)
+{
+}
 #endif  /* CONFIG_DEBUG_FS */
 #endif /* O2CLUSTER_TCP_INTERNAL_H */
diff --git a/fs/ocfs2/dlm/dlmdebug.h b/fs/ocfs2/dlm/dlmdebug.h
index d34a62a3a625..8c686d22f9c7 100644
--- a/fs/ocfs2/dlm/dlmdebug.h
+++ b/fs/ocfs2/dlm/dlmdebug.h
@@ -60,25 +60,25 @@ void dlm_destroy_debugfs_root(void);
 #else
-static int dlm_debug_init(struct dlm_ctxt *dlm)
+static inline int dlm_debug_init(struct dlm_ctxt *dlm)
 {
        return 0;
 }
-static void dlm_debug_shutdown(struct dlm_ctxt *dlm)
+static inline void dlm_debug_shutdown(struct dlm_ctxt *dlm)
 {
 }
-static int dlm_create_debugfs_subroot(struct dlm_ctxt *dlm)
+static inline int dlm_create_debugfs_subroot(struct dlm_ctxt *dlm)
 {
        return 0;
 }
-static void dlm_destroy_debugfs_subroot(struct dlm_ctxt *dlm)
+static inline void dlm_destroy_debugfs_subroot(struct dlm_ctxt *dlm)
 {
 }
-static int dlm_create_debugfs_root(void)
+static inline int dlm_create_debugfs_root(void)
 {
        return 0;
 }
-static void dlm_destroy_debugfs_root(void)
+static inline void dlm_destroy_debugfs_root(void)
 {
 }
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index b503772cd0ec..6b97d11f6bf8 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -61,7 +61,7 @@
 * negotiated by the client.  The client negotiates based on the maximum
 * version advertised in /sys/fs/ocfs2/max_locking_protocol.  The major
 * number from the "SETV" message must match
- * user_stack.sp_proto->lp_max_version.pv_major, and the minor number
+ * ocfs2_user_plugin.sp_proto->lp_max_version.pv_major, and the minor number
 * must be less than or equal to ...->lp_max_version.pv_minor.
 *
 * Once this information has been set, mounts will be allowed.  From this
@@ -153,7 +153,7 @@ union ocfs2_control_message {
        struct ocfs2_control_message_down       u_down;
 };
-static struct ocfs2_stack_plugin user_stack;
+static struct ocfs2_stack_plugin ocfs2_user_plugin;
 static atomic_t ocfs2_control_opened;
 static int ocfs2_control_this_node = -1;
@@ -399,7 +399,7 @@ static int ocfs2_control_do_setversion_msg(struct file *file,
        char *ptr = NULL;
        struct ocfs2_control_private *p = file->private_data;
        struct ocfs2_protocol_version *max =
-                &user_stack.sp_proto->lp_max_version;
+                &ocfs2_user_plugin.sp_proto->lp_max_version;
        if (ocfs2_control_get_handshake_state(file) !=
            OCFS2_CONTROL_HANDSHAKE_PROTOCOL)
@@ -680,7 +680,7 @@ static void fsdlm_lock_ast_wrapper(void *astarg)
        struct dlm_lksb *lksb = fsdlm_astarg_to_lksb(astarg);
        int status = lksb->sb_status;
-        BUG_ON(user_stack.sp_proto == NULL);
+        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
        /*
         * For now we're punting on the issue of other non-standard errors
@@ -693,16 +693,16 @@ static void fsdlm_lock_ast_wrapper(void *astarg)
         */
        if (status == -DLM_EUNLOCK || status == -DLM_ECANCEL)
-                user_stack.sp_proto->lp_unlock_ast(astarg, 0);
+                ocfs2_user_plugin.sp_proto->lp_unlock_ast(astarg, 0);
        else
-                user_stack.sp_proto->lp_lock_ast(astarg);
+                ocfs2_user_plugin.sp_proto->lp_lock_ast(astarg);
 }
 static void fsdlm_blocking_ast_wrapper(void *astarg, int level)
 {
-        BUG_ON(user_stack.sp_proto == NULL);
+        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
-        user_stack.sp_proto->lp_blocking_ast(astarg, level);
+        ocfs2_user_plugin.sp_proto->lp_blocking_ast(astarg, level);
 }
 static int user_dlm_lock(struct ocfs2_cluster_connection *conn,
@@ -838,7 +838,7 @@ static int user_cluster_this_node(unsigned int *this_node)
        return 0;
 }
-static struct ocfs2_stack_operations user_stack_ops = {
+static struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
        .connect        = user_cluster_connect,
        .disconnect     = user_cluster_disconnect,
        .this_node      = user_cluster_this_node,
@@ -849,20 +849,20 @@ static struct ocfs2_stack_operations user_stack_ops = {
        .dump_lksb      = user_dlm_dump_lksb,
 };
-static struct ocfs2_stack_plugin user_stack = {
+static struct ocfs2_stack_plugin ocfs2_user_plugin = {
        .sp_name        = "user",
-        .sp_ops         = &user_stack_ops,
+        .sp_ops         = &ocfs2_user_plugin_ops,
        .sp_owner       = THIS_MODULE,
 };
-static int __init user_stack_init(void)
+static int __init ocfs2_user_plugin_init(void)
 {
        int rc;
        rc = ocfs2_control_init();
        if (!rc) {
-                rc = ocfs2_stack_glue_register(&user_stack);
+                rc = ocfs2_stack_glue_register(&ocfs2_user_plugin);
                if (rc)
                        ocfs2_control_exit();
        }
@@ -870,14 +870,14 @@ static int __init user_stack_init(void)
        return rc;
 }
-static void __exit user_stack_exit(void)
+static void __exit ocfs2_user_plugin_exit(void)
 {
-        ocfs2_stack_glue_unregister(&user_stack);
+        ocfs2_stack_glue_unregister(&ocfs2_user_plugin);
        ocfs2_control_exit();
 }
 MODULE_AUTHOR("Oracle");
 MODULE_DESCRIPTION("ocfs2 driver for userspace cluster stacks");
 MODULE_LICENSE("GPL");
-module_init(user_stack_init);
+module_init(ocfs2_user_plugin_init);
-module_exit(user_stack_exit);
+module_exit(ocfs2_user_plugin_exit);
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 9e3b8c33c24b..797d775e0354 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -288,7 +288,7 @@ static void render_cap_t(struct seq_file *m, const char *header,
        seq_printf(m, "%s", header);
        CAP_FOR_EACH_U32(__capi) {
                seq_printf(m, "%08x",
-                           a->cap[(_LINUX_CAPABILITY_U32S-1) - __capi]);
+                           a->cap[(_KERNEL_CAPABILITY_U32S-1) - __capi]);
        }
        seq_printf(m, "\n");
 }
diff --git a/fs/proc/base.c b/fs/proc/base.c
index c447e0743a3c..3b455371e7ff 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -127,6 +127,25 @@ struct pid_entry {
                NULL, &proc_single_file_operations,     \
                { .proc_show = &proc_##OTYPE } )
+/*
+ * Count the number of hardlinks for the pid_entry table, excluding the .
+ * and .. links.
+ */
+static unsigned int pid_entry_count_dirs(const struct pid_entry *entries,
+        unsigned int n)
+{
+        unsigned int i;
+        unsigned int count;
+        count = 0;
+        for (i = 0; i < n; ++i) {
+                if (S_ISDIR(entries[i].mode))
+                        ++count;
+        }
+        return count;
+}
 int maps_protect;
 EXPORT_SYMBOL(maps_protect);
@@ -2585,10 +2604,9 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
        inode->i_op = &proc_tgid_base_inode_operations;
        inode->i_fop = &proc_tgid_base_operations;
        inode->i_flags|=S_IMMUTABLE;
-        inode->i_nlink = 5;
-#ifdef CONFIG_SECURITY
+        inode->i_nlink = 2 + pid_entry_count_dirs(tgid_base_stuff,
-        inode->i_nlink += 1;
+                ARRAY_SIZE(tgid_base_stuff));
-#endif
        dentry->d_op = &pid_dentry_operations;
@@ -2816,10 +2834,9 @@ static struct dentry *proc_task_instantiate(struct inode *dir,
        inode->i_op = &proc_tid_base_inode_operations;
        inode->i_fop = &proc_tid_base_operations;
        inode->i_flags|=S_IMMUTABLE;
-        inode->i_nlink = 4;
-#ifdef CONFIG_SECURITY
+        inode->i_nlink = 2 + pid_entry_count_dirs(tid_base_stuff,
-        inode->i_nlink += 1;
+                ARRAY_SIZE(tid_base_stuff));
-#endif
        dentry->d_op = &pid_dentry_operations;
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 6f4e8dc97da1..b08d10017911 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -425,7 +425,8 @@ struct inode *proc_get_inode(struct super_block *sb, unsigned int ino,
                        }
                }
                unlock_new_inode(inode);
-        }
+        } else
+               module_put(de->owner);
        return inode;
 out_ino:
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index 74a323d2b850..7e277f2ad466 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -139,7 +139,7 @@ static int meminfo_read_proc(char *page, char **start, off_t off,
 #define K(x) ((x) << (PAGE_SHIFT - 10))
        si_meminfo(&i);
        si_swapinfo(&i);
-        committed = atomic_read(&vm_committed_space);
+        committed = atomic_long_read(&vm_committed_space);
        allowed = ((totalram_pages - hugetlb_total_pages())
                * sysctl_overcommit_ratio / 100) + total_swap_pages;
@@ -716,7 +716,7 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
        pfn = src / KPMSIZE;
        count = min_t(size_t, count, (max_pfn * KPMSIZE) - src);
        if (src & KPMMASK || count & KPMMASK)
-                return -EIO;
+                return -EINVAL;
        while (count > 0) {
                ppage = NULL;
@@ -726,7 +726,7 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
                if (!ppage)
                        pcount = 0;
                else
-                        pcount = atomic_read(&ppage->_count);
+                        pcount = page_mapcount(ppage);
                if (put_user(pcount, out++)) {
                        ret = -EFAULT;
@@ -782,7 +782,7 @@ static ssize_t kpageflags_read(struct file *file, char __user *buf,
        pfn = src / KPMSIZE;
        count = min_t(unsigned long, count, (max_pfn * KPMSIZE) - src);
        if (src & KPMMASK || count & KPMMASK)
-                return -EIO;
+                return -EINVAL;
        while (count > 0) {
                ppage = NULL;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 88717c0f941b..ab8ccc9d14ff 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -315,9 +315,9 @@ struct mem_size_stats {
 };
 static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
-                           void *private)
+                           struct mm_walk *walk)
 {
-        struct mem_size_stats *mss = private;
+        struct mem_size_stats *mss = walk->private;
        struct vm_area_struct *vma = mss->vma;
        pte_t *pte, ptent;
        spinlock_t *ptl;
@@ -365,19 +365,21 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
        return 0;
 }
-static struct mm_walk smaps_walk = { .pmd_entry = smaps_pte_range };
 static int show_smap(struct seq_file *m, void *v)
 {
        struct vm_area_struct *vma = v;
        struct mem_size_stats mss;
        int ret;
+        struct mm_walk smaps_walk = {
+                .pmd_entry = smaps_pte_range,
+                .mm = vma->vm_mm,
+                .private = &mss,
+        };
        memset(&mss, 0, sizeof mss);
        mss.vma = vma;
        if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-                walk_page_range(vma->vm_mm, vma->vm_start, vma->vm_end,
+                walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-                                &smaps_walk, &mss);
        ret = show_map(m, v);
        if (ret)
@@ -426,9 +428,9 @@ const struct file_operations proc_smaps_operations = {
 };
 static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
-                                unsigned long end, void *private)
+                                unsigned long end, struct mm_walk *walk)
 {
-        struct vm_area_struct *vma = private;
+        struct vm_area_struct *vma = walk->private;
        pte_t *pte, ptent;
        spinlock_t *ptl;
        struct page *page;
@@ -452,8 +454,6 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
        return 0;
 }
-static struct mm_walk clear_refs_walk = { .pmd_entry = clear_refs_pte_range };
 static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                                size_t count, loff_t *ppos)
 {
@@ -476,11 +476,17 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                return -ESRCH;
        mm = get_task_mm(task);
        if (mm) {
+                static struct mm_walk clear_refs_walk;
+                memset(&clear_refs_walk, 0, sizeof(clear_refs_walk));
+                clear_refs_walk.pmd_entry = clear_refs_pte_range;
+                clear_refs_walk.mm = mm;
                down_read(&mm->mmap_sem);
-                for (vma = mm->mmap; vma; vma = vma->vm_next)
+                for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                        clear_refs_walk.private = vma;
                        if (!is_vm_hugetlb_page(vma))
-                                walk_page_range(mm, vma->vm_start, vma->vm_end,
+                                walk_page_range(vma->vm_start, vma->vm_end,
-                                                &clear_refs_walk, vma);
+                                                &clear_refs_walk);
+                }
                flush_tlb_mm(mm);
                up_read(&mm->mmap_sem);
                mmput(mm);
@@ -496,7 +502,7 @@ const struct file_operations proc_clear_refs_operations = {
 };
 struct pagemapread {
-        char __user *out, *end;
+        u64 __user *out, *end;
 };
 #define PM_ENTRY_BYTES      sizeof(u64)
@@ -519,28 +525,18 @@ struct pagemapread {
 static int add_to_pagemap(unsigned long addr, u64 pfn,
                          struct pagemapread *pm)
 {
-        /*
-         * Make sure there's room in the buffer for an
-         * entire entry.  Otherwise, only copy part of
-         * the pfn.
-         */
-        if (pm->out + PM_ENTRY_BYTES >= pm->end) {
-                if (copy_to_user(pm->out, &pfn, pm->end - pm->out))
-                        return -EFAULT;
-                pm->out = pm->end;
-                return PM_END_OF_BUFFER;
-        }
        if (put_user(pfn, pm->out))
                return -EFAULT;
-        pm->out += PM_ENTRY_BYTES;
+        pm->out++;
+        if (pm->out >= pm->end)
+                return PM_END_OF_BUFFER;
        return 0;
 }
 static int pagemap_pte_hole(unsigned long start, unsigned long end,
-                                void *private)
+                                struct mm_walk *walk)
 {
-        struct pagemapread *pm = private;
+        struct pagemapread *pm = walk->private;
        unsigned long addr;
        int err = 0;
        for (addr = start; addr < end; addr += PAGE_SIZE) {
@@ -557,24 +553,45 @@ static u64 swap_pte_to_pagemap_entry(pte_t pte)
        return swp_type(e) | (swp_offset(e) << MAX_SWAPFILES_SHIFT);
 }
+static unsigned long pte_to_pagemap_entry(pte_t pte)
+{
+        unsigned long pme = 0;
+        if (is_swap_pte(pte))
+                pme = PM_PFRAME(swap_pte_to_pagemap_entry(pte))
+                        | PM_PSHIFT(PAGE_SHIFT) | PM_SWAP;
+        else if (pte_present(pte))
+                pme = PM_PFRAME(pte_pfn(pte))
+                        | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT;
+        return pme;
+}
 static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
-                             void *private)
+                             struct mm_walk *walk)
 {
-        struct pagemapread *pm = private;
+        struct vm_area_struct *vma;
+        struct pagemapread *pm = walk->private;
        pte_t *pte;
        int err = 0;
+        /* find the first VMA at or above 'addr' */
+        vma = find_vma(walk->mm, addr);
        for (; addr != end; addr += PAGE_SIZE) {
                u64 pfn = PM_NOT_PRESENT;
-                pte = pte_offset_map(pmd, addr);
-                if (is_swap_pte(*pte))
+                /* check to see if we've left 'vma' behind
-                        pfn = PM_PFRAME(swap_pte_to_pagemap_entry(*pte))
+                 * and need a new, higher one */
-                                | PM_PSHIFT(PAGE_SHIFT) | PM_SWAP;
+                if (vma && (addr >= vma->vm_end))
-                else if (pte_present(*pte))
+                        vma = find_vma(walk->mm, addr);
-                        pfn = PM_PFRAME(pte_pfn(*pte))
-                                | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT;
+                /* check that 'vma' actually covers this address,
-                /* unmap so we're not in atomic when we copy to userspace */
+                 * and that it isn't a huge page vma */
-                pte_unmap(pte);
+                if (vma && (vma->vm_start <= addr) &&
+                    !is_vm_hugetlb_page(vma)) {
+                        pte = pte_offset_map(pmd, addr);
+                        pfn = pte_to_pagemap_entry(*pte);
+                        /* unmap before userspace copy */
+                        pte_unmap(pte);
+                }
                err = add_to_pagemap(addr, pfn, pm);
                if (err)
                        return err;
@@ -634,7 +651,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
        ret = -EINVAL;
        /* file position must be aligned */
-        if (*ppos % PM_ENTRY_BYTES)
+        if ((*ppos % PM_ENTRY_BYTES) || (count % PM_ENTRY_BYTES))
                goto out_task;
        ret = 0;
@@ -664,8 +681,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                goto out_pages;
        }
-        pm.out = buf;
+        pm.out = (u64 *)buf;
-        pm.end = buf + count;
+        pm.end = (u64 *)(buf + count);
        if (!ptrace_may_attach(task)) {
                ret = -EIO;
@@ -685,14 +702,14 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                 * user buffer is tracked in "pm", and the walk
                 * will stop when we hit the end of the buffer.
                 */
-                ret = walk_page_range(mm, start_vaddr, end_vaddr,
+                ret = walk_page_range(start_vaddr, end_vaddr,
-                                        &pagemap_walk, &pm);
+                                        &pagemap_walk);
                if (ret == PM_END_OF_BUFFER)
                        ret = 0;
                /* don't need mmap_sem for these, but this looks cleaner */
-                *ppos += pm.out - buf;
+                *ppos += (char *)pm.out - buf;
                if (!ret)
-                        ret = pm.out - buf;
+                        ret = (char *)pm.out - buf;
        }
 out_pages:
diff --git a/fs/splice.c b/fs/splice.c
index 78150038b584..aa5f6f60b305 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -58,8 +58,8 @@ static int page_cache_pipe_buf_steal(struct pipe_inode_info *pipe,
                 */
                wait_on_page_writeback(page);
-                if (PagePrivate(page))
+                if (PagePrivate(page) && !try_to_release_page(page, GFP_KERNEL))
-                        try_to_release_page(page, GFP_KERNEL);
+                        goto out_unlock;
                /*
                 * If we succeeded in removing the mapping, set LRU flag
@@ -75,6 +75,7 @@ static int page_cache_pipe_buf_steal(struct pipe_inode_info *pipe,
         * Raced with truncate or failed to remove page from current
         * address space, unlock and return failure.
         */
+out_unlock:
        unlock_page(page);
        return 1;
 }
@@ -983,7 +984,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
        while (len) {
                size_t read_len;
-                loff_t pos = sd->pos;
+                loff_t pos = sd->pos, prev_pos = pos;
                ret = do_splice_to(in, &pos, pipe, len, flags);
                if (unlikely(ret <= 0))
@@ -998,15 +999,19 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
                 * could get stuck data in the internal pipe:
                 */
                ret = actor(pipe, sd);
-                if (unlikely(ret <= 0))
+                if (unlikely(ret <= 0)) {
+                        sd->pos = prev_pos;
                        goto out_release;
+                }
                bytes += ret;
                len -= ret;
                sd->pos = pos;
-                if (ret < read_len)
+                if (ret < read_len) {
+                        sd->pos = prev_pos + ret;
                        goto out_release;
+                }
        }
 done:
@@ -1072,7 +1077,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
        ret = splice_direct_to_actor(in, &sd, direct_splice_actor);
        if (ret > 0)
-                *ppos += ret;
+                *ppos = sd.pos;
        return ret;
 }
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 5105015a75ad..98e0e86093b4 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -387,6 +387,8 @@ _xfs_buf_lookup_pages(
                if (unlikely(page == NULL)) {
                        if (flags & XBF_READ_AHEAD) {
                                bp->b_page_count = i;
+                                for (i = 0; i < bp->b_page_count; i++)
+                                        unlock_page(bp->b_pages[i]);
                                return -ENOMEM;
                        }
@@ -416,17 +418,24 @@ _xfs_buf_lookup_pages(
                ASSERT(!PagePrivate(page));
                if (!PageUptodate(page)) {
                        page_count--;
-                        if (blocksize < PAGE_CACHE_SIZE && !PagePrivate(page)) {
+                        if (blocksize >= PAGE_CACHE_SIZE) {
+                                if (flags & XBF_READ)
+                                        bp->b_flags |= _XBF_PAGE_LOCKED;
+                        } else if (!PagePrivate(page)) {
                                if (test_page_region(page, offset, nbytes))
                                        page_count++;
                        }
                }
-                unlock_page(page);
                bp->b_pages[i] = page;
                offset = 0;
        }
+        if (!(bp->b_flags & _XBF_PAGE_LOCKED)) {
+                for (i = 0; i < bp->b_page_count; i++)
+                        unlock_page(bp->b_pages[i]);
+        }
        if (page_count == bp->b_page_count)
                bp->b_flags |= XBF_DONE;
@@ -746,6 +755,7 @@ xfs_buf_associate_memory(
        bp->b_count_desired = len;
        bp->b_buffer_length = buflen;
        bp->b_flags |= XBF_MAPPED;
+        bp->b_flags &= ~_XBF_PAGE_LOCKED;
        return 0;
 }
@@ -1093,8 +1103,10 @@ _xfs_buf_ioend(
        xfs_buf_t               *bp,
        int                     schedule)
 {
-        if (atomic_dec_and_test(&bp->b_io_remaining) == 1)
+        if (atomic_dec_and_test(&bp->b_io_remaining) == 1) {
+                bp->b_flags &= ~_XBF_PAGE_LOCKED;
                xfs_buf_ioend(bp, schedule);
+        }
 }
 STATIC void
@@ -1125,6 +1137,9 @@ xfs_buf_bio_end_io(
                if (--bvec >= bio->bi_io_vec)
                        prefetchw(&bvec->bv_page->flags);
+                if (bp->b_flags & _XBF_PAGE_LOCKED)
+                        unlock_page(page);
        } while (bvec >= bio->bi_io_vec);
        _xfs_buf_ioend(bp, 1);
@@ -1163,7 +1178,8 @@ _xfs_buf_ioapply(
         * filesystem block size is not smaller than the page size.
         */
        if ((bp->b_buffer_length < PAGE_CACHE_SIZE) &&
-            (bp->b_flags & XBF_READ) &&
+            ((bp->b_flags & (XBF_READ|_XBF_PAGE_LOCKED)) ==
+              (XBF_READ|_XBF_PAGE_LOCKED)) &&
            (blocksize >= PAGE_CACHE_SIZE)) {
                bio = bio_alloc(GFP_NOIO, 1);
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 841d7883528d..f948ec7ba9a4 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -66,6 +66,25 @@ typedef enum {
        _XBF_PAGES = (1 << 18),     /* backed by refcounted pages          */
        _XBF_RUN_QUEUES = (1 << 19),/* run block device task queue         */
        _XBF_DELWRI_Q = (1 << 21),   /* buffer on delwri queue             */
+        /*
+         * Special flag for supporting metadata blocks smaller than a FSB.
+         *
+         * In this case we can have multiple xfs_buf_t on a single page and
+         * need to lock out concurrent xfs_buf_t readers as they only
+         * serialise access to the buffer.
+         *
+         * If the FSB size >= PAGE_CACHE_SIZE case, we have no serialisation
+         * between reads of the page. Hence we can have one thread read the
+         * page and modify it, but then race with another thread that thinks
+         * the page is not up-to-date and hence reads it again.
+         *
+         * The result is that the first modifcation to the page is lost.
+         * This sort of AGF/AGI reading race can happen when unlinking inodes
+         * that require truncation and results in the AGI unlinked list
+         * modifications being lost.
+         */
+        _XBF_PAGE_LOCKED = (1 << 22),
 } xfs_buf_flags_t;
 typedef enum {
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 65e78c13d4ae..5f60363b9343 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -184,19 +184,24 @@ xfs_file_release(
        return -xfs_release(XFS_I(inode));
 }
+/*
+ * We ignore the datasync flag here because a datasync is effectively
+ * identical to an fsync. That is, datasync implies that we need to write
+ * only the metadata needed to be able to access the data that is written
+ * if we crash after the call completes. Hence if we are writing beyond
+ * EOF we have to log the inode size change as well, which makes it a
+ * full fsync. If we don't write beyond EOF, the inode core will be
+ * clean in memory and so we don't need to log the inode, just like
+ * fsync.
+ */
 STATIC int
 xfs_file_fsync(
        struct file     *filp,
        struct dentry   *dentry,
        int             datasync)
 {
-        int             flags = FSYNC_WAIT;
-        if (datasync)
-                flags |= FSYNC_DATA;
        xfs_iflags_clear(XFS_I(dentry->d_inode), XFS_ITRUNCATED);
-        return -xfs_fsync(XFS_I(dentry->d_inode), flags,
+        return -xfs_fsync(XFS_I(dentry->d_inode));
-                        (xfs_off_t)0, (xfs_off_t)-1);
 }
 /*
diff --git a/fs/xfs/linux-2.6/xfs_vnode.h b/fs/xfs/linux-2.6/xfs_vnode.h
index 9d73cb5c0fc7..25eb2a9e8d9b 100644
--- a/fs/xfs/linux-2.6/xfs_vnode.h
+++ b/fs/xfs/linux-2.6/xfs_vnode.h
@@ -230,14 +230,6 @@ static inline void vn_atime_to_time_t(bhv_vnode_t *vp, time_t *tt)
 #define ATTR_NOSIZETOK  0x400   /* Don't get the SIZE token */
 /*
- * Flags to vop_fsync/reclaim.
- */
-#define FSYNC_NOWAIT    0       /* asynchronous flush */
-#define FSYNC_WAIT      0x1     /* synchronous fsync or forced reclaim */
-#define FSYNC_INVAL     0x2     /* flush and invalidate cached data */
-#define FSYNC_DATA      0x4     /* synchronous fsync of data only */
-/*
 * Tracking vnode activity.
 */
 #if defined(XFS_INODE_TRACE)
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index cf0bb9c1d621..e569bf5d6cf0 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2974,6 +2974,7 @@ xfs_iflush_cluster(
        xfs_mount_t             *mp = ip->i_mount;
        xfs_perag_t             *pag = xfs_get_perag(mp, ip->i_ino);
        unsigned long           first_index, mask;
+        unsigned long           inodes_per_cluster;
        int                     ilist_size;
        xfs_inode_t             **ilist;
        xfs_inode_t             *iq;
@@ -2985,8 +2986,9 @@ xfs_iflush_cluster(
        ASSERT(pag->pagi_inodeok);
        ASSERT(pag->pag_ici_init);
-        ilist_size = XFS_INODE_CLUSTER_SIZE(mp) * sizeof(xfs_inode_t *);
+        inodes_per_cluster = XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_inodelog;
-        ilist = kmem_alloc(ilist_size, KM_MAYFAIL);
+        ilist_size = inodes_per_cluster * sizeof(xfs_inode_t *);
+        ilist = kmem_alloc(ilist_size, KM_MAYFAIL|KM_NOFS);
        if (!ilist)
                return 0;
@@ -2995,8 +2997,7 @@ xfs_iflush_cluster(
        read_lock(&pag->pag_ici_lock);
        /* really need a gang lookup range call here */
        nr_found = radix_tree_gang_lookup(&pag->pag_ici_root, (void**)ilist,
-                                        first_index,
+                                        first_index, inodes_per_cluster);
-                                        XFS_INODE_CLUSTER_SIZE(mp));
        if (nr_found == 0)
                goto out_free;
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 70702a60b4bb..e475e3717eb3 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -856,18 +856,14 @@ xfs_readlink(
 /*
 * xfs_fsync
 *
- * This is called to sync the inode and its data out to disk.
+ * This is called to sync the inode and its data out to disk.  We need to hold
- * We need to hold the I/O lock while flushing the data, and
+ * the I/O lock while flushing the data, and the inode lock while flushing the
- * the inode lock while flushing the inode.  The inode lock CANNOT
+ * inode.  The inode lock CANNOT be held while flushing the data, so acquire
- * be held while flushing the data, so acquire after we're done
+ * after we're done with that.
- * with that.
 */
 int
 xfs_fsync(
-        xfs_inode_t     *ip,
+        xfs_inode_t     *ip)
-        int             flag,
-        xfs_off_t       start,
-        xfs_off_t       stop)
 {
        xfs_trans_t     *tp;
        int             error;
@@ -875,103 +871,79 @@ xfs_fsync(
        xfs_itrace_entry(ip);
-        ASSERT(start >= 0 && stop >= -1);
        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
                return XFS_ERROR(EIO);
-        if (flag & FSYNC_DATA)
+        /* capture size updates in I/O completion before writing the inode. */
-                filemap_fdatawait(vn_to_inode(XFS_ITOV(ip))->i_mapping);
+        error = filemap_fdatawait(vn_to_inode(XFS_ITOV(ip))->i_mapping);
+        if (error)
+                return XFS_ERROR(error);
        /*
-         * We always need to make sure that the required inode state
+         * We always need to make sure that the required inode state is safe on
-         * is safe on disk.  The vnode might be clean but because
+         * disk.  The vnode might be clean but we still might need to force the
-         * of committed transactions that haven't hit the disk yet.
+         * log because of committed transactions that haven't hit the disk yet.
-         * Likewise, there could be unflushed non-transactional
+         * Likewise, there could be unflushed non-transactional changes to the
-         * changes to the inode core that have to go to disk.
+         * inode core that have to go to disk and this requires us to issue
+         * a synchronous transaction to capture these changes correctly.
         *
-         * The following code depends on one assumption:  that
+         * This code relies on the assumption that if the update_* fields
-         * any transaction that changes an inode logs the core
+         * of the inode are clear and the inode is unpinned then it is clean
-         * because it has to change some field in the inode core
+         * and no action is required.
-         * (typically nextents or nblocks).  That assumption
-         * implies that any transactions against an inode will
-         * catch any non-transactional updates.  If inode-altering
-         * transactions exist that violate this assumption, the
-         * code breaks.  Right now, it figures that if the involved
-         * update_* field is clear and the inode is unpinned, the
-         * inode is clean.  Either it's been flushed or it's been
-         * committed and the commit has hit the disk unpinning the inode.
-         * (Note that xfs_inode_item_format() called at commit clears
-         * the update_* fields.)
         */
        xfs_ilock(ip, XFS_ILOCK_SHARED);
-        /* If we are flushing data then we care about update_size
+        if (!(ip->i_update_size || ip->i_update_core)) {
-         * being set, otherwise we care about update_core
-         */
-        if ((flag & FSYNC_DATA) ?
-                        (ip->i_update_size == 0) :
-                        (ip->i_update_core == 0)) {
                /*
-                 * Timestamps/size haven't changed since last inode
+                 * Timestamps/size haven't changed since last inode flush or
-                 * flush or inode transaction commit.  That means
+                 * inode transaction commit.  That means either nothing got
-                 * either nothing got written or a transaction
+                 * written or a transaction committed which caught the updates.
-                 * committed which caught the updates.  If the
+                 * If the latter happened and the transaction hasn't hit the
-                 * latter happened and the transaction hasn't
+                 * disk yet, the inode will be still be pinned.  If it is,
-                 * hit the disk yet, the inode will be still
+                 * force the log.
-                 * be pinned.  If it is, force the log.
                 */
                xfs_iunlock(ip, XFS_ILOCK_SHARED);
                if (xfs_ipincount(ip)) {
-                        _xfs_log_force(ip->i_mount, (xfs_lsn_t)0,
+                        error = _xfs_log_force(ip->i_mount, (xfs_lsn_t)0,
-                                      XFS_LOG_FORCE |
+                                      XFS_LOG_FORCE | XFS_LOG_SYNC,
-                                      ((flag & FSYNC_WAIT)
-                                       ? XFS_LOG_SYNC : 0),
                                      &log_flushed);
                } else {
                        /*
-                         * If the inode is not pinned and nothing
+                         * If the inode is not pinned and nothing has changed
-                         * has changed we don't need to flush the
+                         * we don't need to flush the cache.
-                         * cache.
                         */
                        changed = 0;
                }
-                error = 0;
        } else  {
                /*
-                 * Kick off a transaction to log the inode
+                 * Kick off a transaction to log the inode core to get the
-                 * core to get the updates.  Make it
+                 * updates.  The sync transaction will also force the log.
-                 * sync if FSYNC_WAIT is passed in (which
-                 * is done by everybody but specfs).  The
-                 * sync transaction will also force the log.
                 */
                xfs_iunlock(ip, XFS_ILOCK_SHARED);
                tp = xfs_trans_alloc(ip->i_mount, XFS_TRANS_FSYNC_TS);
-                if ((error = xfs_trans_reserve(tp, 0,
+                error = xfs_trans_reserve(tp, 0,
-                                XFS_FSYNC_TS_LOG_RES(ip->i_mount),
+                                XFS_FSYNC_TS_LOG_RES(ip->i_mount), 0, 0, 0);
-                                0, 0, 0)))  {
+                if (error) {
                        xfs_trans_cancel(tp, 0);
                        return error;
                }
                xfs_ilock(ip, XFS_ILOCK_EXCL);
                /*
-                 * Note - it's possible that we might have pushed
+                 * Note - it's possible that we might have pushed ourselves out
-                 * ourselves out of the way during trans_reserve
+                 * of the way during trans_reserve which would flush the inode.
-                 * which would flush the inode.  But there's no
+                 * But there's no guarantee that the inode buffer has actually
-                 * guarantee that the inode buffer has actually
+                 * gone out yet (it's delwri).  Plus the buffer could be pinned
-                 * gone out yet (it's delwri).  Plus the buffer
+                 * anyway if it's part of an inode in another recent
-                 * could be pinned anyway if it's part of an
+                 * transaction.  So we play it safe and fire off the
-                 * inode in another recent transaction.  So we
+                 * transaction anyway.
-                 * play it safe and fire off the transaction anyway.
                 */
                xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
                xfs_trans_ihold(tp, ip);
                xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-                if (flag & FSYNC_WAIT)
+                xfs_trans_set_sync(tp);
-                        xfs_trans_set_sync(tp);
                error = _xfs_trans_commit(tp, 0, &log_flushed);
                xfs_iunlock(ip, XFS_ILOCK_EXCL);
diff --git a/fs/xfs/xfs_vnodeops.h b/fs/xfs/xfs_vnodeops.h
index 8abe8f186e20..57335ba4ce53 100644
--- a/fs/xfs/xfs_vnodeops.h
+++ b/fs/xfs/xfs_vnodeops.h
@@ -18,8 +18,7 @@ int xfs_open(struct xfs_inode *ip);
 int xfs_setattr(struct xfs_inode *ip, struct bhv_vattr *vap, int flags,
                struct cred *credp);
 int xfs_readlink(struct xfs_inode *ip, char *link);
-int xfs_fsync(struct xfs_inode *ip, int flag, xfs_off_t start,
+int xfs_fsync(struct xfs_inode *ip);
-                xfs_off_t stop);
 int xfs_release(struct xfs_inode *ip);
 int xfs_inactive(struct xfs_inode *ip);
 int xfs_lookup(struct xfs_inode *dp, struct xfs_name *name,
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 06480bcabfdc..06ebb6ef72aa 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -319,6 +319,7 @@ static inline int acpi_processor_ppc_has_changed(struct acpi_processor *pr)
 #endif                          /* CONFIG_CPU_FREQ */
 /* in processor_throttling.c */
+int acpi_processor_tstate_has_changed(struct acpi_processor *pr);
 int acpi_processor_get_throttling_info(struct acpi_processor *pr);
 extern int acpi_processor_set_throttling(struct acpi_processor *pr, int state);
 extern struct file_operations acpi_processor_throttling_fops;
diff --git a/include/asm-arm/arch-at91/io.h b/include/asm-arm/arch-at91/io.h
index 80073fd36b8e..f8beaa228467 100644
--- a/include/asm-arm/arch-at91/io.h
+++ b/include/asm-arm/arch-at91/io.h
@@ -21,8 +21,6 @@
 #ifndef __ASM_ARCH_IO_H
 #define __ASM_ARCH_IO_H
-#include <asm/io.h>
 #define IO_SPACE_LIMIT          0xFFFFFFFF
 #define __io(a)                 ((void __iomem *)(a))
diff --git a/include/asm-arm/arch-omap/board-palmte.h b/include/asm-arm/arch-omap/board-palmte.h
index cd22035a7160..6fac2c8935be 100644
--- a/include/asm-arm/arch-omap/board-palmte.h
+++ b/include/asm-arm/arch-omap/board-palmte.h
@@ -14,8 +14,6 @@
 #ifndef __OMAP_BOARD_PALMTE_H
 #define __OMAP_BOARD_PALMTE_H
-#include <asm/arch/gpio.h>
 #define PALMTE_USBDETECT_GPIO   0
 #define PALMTE_USB_OR_DC_GPIO   1
 #define PALMTE_TSC_GPIO         4
diff --git a/include/asm-arm/arch-omap/clock.h b/include/asm-arm/arch-omap/clock.h
index 57523bdb642b..12a5e4de9518 100644
--- a/include/asm-arm/arch-omap/clock.h
+++ b/include/asm-arm/arch-omap/clock.h
@@ -73,6 +73,8 @@ struct clk {
 #endif
 };
+struct cpufreq_frequency_table;
 struct clk_functions {
        int             (*clk_enable)(struct clk *clk);
        void            (*clk_disable)(struct clk *clk);
@@ -83,6 +85,9 @@ struct clk_functions {
        void            (*clk_allow_idle)(struct clk *clk);
        void            (*clk_deny_idle)(struct clk *clk);
        void            (*clk_disable_unused)(struct clk *clk);
+#ifdef CONFIG_CPU_FREQ
+        void            (*clk_init_cpufreq_table)(struct cpufreq_frequency_table **);
+#endif
 };
 extern unsigned int mpurate;
diff --git a/include/asm-arm/arch-omap/entry-macro.S b/include/asm-arm/arch-omap/entry-macro.S
index 74cd57221c8e..369093a45fcf 100644
--- a/include/asm-arm/arch-omap/entry-macro.S
+++ b/include/asm-arm/arch-omap/entry-macro.S
@@ -8,6 +8,7 @@
 * warranty of any kind, whether express or implied.
 */
 #include <asm/hardware.h>
+#include <asm/arch/io.h>
 #include <asm/arch/irqs.h>
 #if defined(CONFIG_ARCH_OMAP1)
diff --git a/include/asm-arm/arch-omap/gpio.h b/include/asm-arm/arch-omap/gpio.h
index 86621a04cd8f..5ee6a49864c3 100644
--- a/include/asm-arm/arch-omap/gpio.h
+++ b/include/asm-arm/arch-omap/gpio.h
@@ -26,7 +26,6 @@
 #ifndef __ASM_ARCH_OMAP_GPIO_H
 #define __ASM_ARCH_OMAP_GPIO_H
-#include <asm/hardware.h>
 #include <asm/arch/irqs.h>
 #include <asm/io.h>
diff --git a/include/asm-arm/arch-omap/hardware.h b/include/asm-arm/arch-omap/hardware.h
index da572092e255..91d85b3417b7 100644
--- a/include/asm-arm/arch-omap/hardware.h
+++ b/include/asm-arm/arch-omap/hardware.h
@@ -41,7 +41,6 @@
 #include <asm/types.h>
 #include <asm/arch/cpu.h>
 #endif
-#include <asm/arch/io.h>
 #include <asm/arch/serial.h>
 /*
diff --git a/include/asm-arm/arch-pxa/mfp-pxa27x.h b/include/asm-arm/arch-pxa/mfp-pxa27x.h
index eb6eaa174f8d..bc73ab84167c 100644
--- a/include/asm-arm/arch-pxa/mfp-pxa27x.h
+++ b/include/asm-arm/arch-pxa/mfp-pxa27x.h
@@ -112,6 +112,7 @@
 #define GPIO57_nIOIS16          MFP_CFG_IN(GPIO57, AF1)
 #define GPIO56_nPWAIT           MFP_CFG_IN(GPIO56, AF1)
 #define GPIO79_PSKTSEL          MFP_CFG_OUT(GPIO79, AF1, DRIVE_HIGH)
+#define GPIO104_PSKTSEL         MFP_CFG_OUT(GPIO104, AF1, DRIVE_HIGH)
 /* I2C */
 #define GPIO117_I2C_SCL         MFP_CFG_IN(GPIO117, AF1)
diff --git a/include/asm-arm/arch-pxa/pxa2xx-gpio.h b/include/asm-arm/arch-pxa/pxa2xx-gpio.h
index 763313c5e6be..b81cd63cb2eb 100644
--- a/include/asm-arm/arch-pxa/pxa2xx-gpio.h
+++ b/include/asm-arm/arch-pxa/pxa2xx-gpio.h
@@ -134,7 +134,11 @@
 #define GPIO93_CIF_DD_6         93      /* Camera data pin 6 */
 #define GPIO94_CIF_DD_5         94      /* Camera data pin 5 */
 #define GPIO95_CIF_DD_4         95      /* Camera data pin 4 */
+#define GPIO96_FFRXD            96      /* FFUART recieve */
+#define GPIO98_FFRTS            98      /* FFUART request to send */
 #define GPIO98_CIF_DD_0         98      /* Camera data pin 0 */
+#define GPIO99_FFTXD            99      /* FFUART transmit data */
+#define GPIO100_FFCTS           100     /* FFUART Clear to send */
 #define GPIO102_nPCE_1          102     /* PCMCIA (PXA27x) */
 #define GPIO103_CIF_DD_3        103     /* Camera data pin 3 */
 #define GPIO104_CIF_DD_2        104     /* Camera data pin 2 */
@@ -316,6 +320,8 @@
 #define GPIO85_nPCE_1_MD        (85 | GPIO_ALT_FN_1_OUT)
 #define GPIO85_CIF_LV_MD        (85 | GPIO_ALT_FN_3_IN)
 #define GPIO86_nPCE_1_MD        (86 | GPIO_ALT_FN_1_OUT)
+#define GPIO88_USBH1_PWR_MD     (88 | GPIO_ALT_FN_1_IN)
+#define GPIO89_USBH1_PEN_MD     (89 | GPIO_ALT_FN_2_OUT)
 #define GPIO90_CIF_DD_4_MD      (90 | GPIO_ALT_FN_3_IN)
 #define GPIO91_CIF_DD_5_MD      (91 | GPIO_ALT_FN_3_IN)
 #define GPIO92_MMCDAT0_MD       (92 | GPIO_ALT_FN_1_OUT)
@@ -324,8 +330,11 @@
 #define GPIO95_CIF_DD_4_MD      (95 | GPIO_ALT_FN_2_IN)
 #define GPIO95_KP_MKIN6_MD      (95 | GPIO_ALT_FN_3_IN)
 #define GPIO96_KP_DKIN3_MD      (96 | GPIO_ALT_FN_1_IN)
+#define GPIO96_FFRXD_MD         (96 | GPIO_ALT_FN_3_IN)
 #define GPIO97_KP_MKIN3_MD      (97 | GPIO_ALT_FN_3_IN)
 #define GPIO98_CIF_DD_0_MD      (98 | GPIO_ALT_FN_2_IN)
+#define GPIO98_FFRTS_MD         (98 | GPIO_ALT_FN_3_OUT)
+#define GPIO99_FFTXD_MD         (99 | GPIO_ALT_FN_3_OUT)
 #define GPIO100_KP_MKIN0_MD     (100 | GPIO_ALT_FN_1_IN)
 #define GPIO101_KP_MKIN1_MD     (101 | GPIO_ALT_FN_1_IN)
 #define GPIO102_nPCE_1_MD       (102 | GPIO_ALT_FN_1_OUT)
diff --git a/include/asm-arm/arch-pxa/regs-lcd.h b/include/asm-arm/arch-pxa/regs-lcd.h
index f762493f5141..3ba464c913a5 100644
--- a/include/asm-arm/arch-pxa/regs-lcd.h
+++ b/include/asm-arm/arch-pxa/regs-lcd.h
@@ -1,5 +1,8 @@
 #ifndef __ASM_ARCH_REGS_LCD_H
 #define __ASM_ARCH_REGS_LCD_H
+#include <asm/arch/bitfield.h>
 /*
 * LCD Controller Registers and Bits Definitions
 */
@@ -69,7 +72,7 @@
 #define LCCR0_QDM       (1 << 11)       /* LCD Quick Disable mask */
 #define LCCR0_PDD       (0xff << 12)    /* Palette DMA request delay */
 #define LCCR0_PDD_S     12
-#define LCCR0_BM        (1 << 20)       /* Branch mask */
+#define LCCR0_BM        (1 << 20)       /* Branch mask */
 #define LCCR0_OUM       (1 << 21)       /* Output FIFO underrun mask */
 #define LCCR0_LCDT      (1 << 22)       /* LCD panel type */
 #define LCCR0_RDSTM     (1 << 23)       /* Read status interrupt mask */
diff --git a/include/asm-arm/arch-sa1100/collie.h b/include/asm-arm/arch-sa1100/collie.h
index 14a344aa3cc7..762eba535813 100644
--- a/include/asm-arm/arch-sa1100/collie.h
+++ b/include/asm-arm/arch-sa1100/collie.h
@@ -34,9 +34,12 @@
 #define COLLIE_GPIO_ON_KEY              GPIO_GPIO (0)
 #define COLLIE_GPIO_AC_IN               GPIO_GPIO (1)
+#define COLLIE_GPIO_SDIO_INT            GPIO_GPIO (11)
 #define COLLIE_GPIO_CF_IRQ              GPIO_GPIO (14)
 #define COLLIE_GPIO_nREMOCON_INT        GPIO_GPIO (15)
 #define COLLIE_GPIO_UCB1x00_RESET       GPIO_GPIO (16)
+#define COLLIE_GPIO_nMIC_ON             GPIO_GPIO (17)
+#define COLLIE_GPIO_nREMOCON_ON         GPIO_GPIO (18)
 #define COLLIE_GPIO_CO                  GPIO_GPIO (20)
 #define COLLIE_GPIO_MCP_CLK             GPIO_GPIO (21)
 #define COLLIE_GPIO_CF_CD               GPIO_GPIO (22)
@@ -49,6 +52,7 @@
 #define COLLIE_IRQ_GPIO_ON_KEY          IRQ_GPIO0
 #define COLLIE_IRQ_GPIO_AC_IN           IRQ_GPIO1
+#define COLLIE_IRQ_GPIO_SDIO_IRQ        IRQ_GPIO11
 #define COLLIE_IRQ_GPIO_CF_IRQ          IRQ_GPIO14
 #define COLLIE_IRQ_GPIO_nREMOCON_INT    IRQ_GPIO15
 #define COLLIE_IRQ_GPIO_CO              IRQ_GPIO20
diff --git a/include/asm-arm/page.h b/include/asm-arm/page.h
index 5c22b0112106..8e05bdb5f12f 100644
--- a/include/asm-arm/page.h
+++ b/include/asm-arm/page.h
@@ -179,10 +179,10 @@ typedef unsigned long pgprot_t;
 #endif /* STRICT_MM_TYPECHECKS */
-typedef struct page *pgtable_t;
 #endif /* CONFIG_MMU */
+typedef struct page *pgtable_t;
 #include <asm/memory.h>
 #endif /* !__ASSEMBLY__ */
diff --git a/include/asm-arm/pgtable-nommu.h b/include/asm-arm/pgtable-nommu.h
index 2e5868bbe03b..386fcc10a973 100644
--- a/include/asm-arm/pgtable-nommu.h
+++ b/include/asm-arm/pgtable-nommu.h
@@ -16,7 +16,6 @@
 #include <linux/slab.h>
 #include <asm/processor.h>
 #include <asm/page.h>
-#include <asm/io.h>
 /*
 * Trivial page table functions.
diff --git a/include/asm-arm/spinlock.h b/include/asm-arm/spinlock.h
index 800ba5254daf..2b41ebbfa7ff 100644
--- a/include/asm-arm/spinlock.h
+++ b/include/asm-arm/spinlock.h
@@ -142,7 +142,7 @@ static inline void __raw_write_unlock(raw_rwlock_t *rw)
 }
 /* write_can_lock - would write_trylock() succeed? */
-#define __raw_write_can_lock(x)         ((x)->lock == 0x80000000)
+#define __raw_write_can_lock(x)         ((x)->lock == 0)
 /*
 * Read locks are a bit more hairy:
diff --git a/include/asm-arm/system.h b/include/asm-arm/system.h
index 6335de9a2bb3..514af792a598 100644
--- a/include/asm-arm/system.h
+++ b/include/asm-arm/system.h
@@ -48,20 +48,6 @@
 #define CPUID_TCM       2
 #define CPUID_TLBTYPE   3
-#ifdef CONFIG_CPU_CP15
-#define read_cpuid(reg)                                                 \
-        ({                                                              \
-                unsigned int __val;                                     \
-                asm("mrc        p15, 0, %0, c0, c0, " __stringify(reg)  \
-                    : "=r" (__val)                                      \
-                    :                                                   \
-                    : "cc");                                            \
-                __val;                                                  \
-        })
-#else
-#define read_cpuid(reg) (processor_id)
-#endif
 /*
 * This is used to ensure the compiler did actually allocate the register we
 * asked it for some inline assembly sequences.  Apparently we can't trust
@@ -78,6 +64,21 @@
 #include <linux/stringify.h>
 #include <linux/irqflags.h>
+#ifdef CONFIG_CPU_CP15
+#define read_cpuid(reg)                                                 \
+        ({                                                              \
+                unsigned int __val;                                     \
+                asm("mrc        p15, 0, %0, c0, c0, " __stringify(reg)  \
+                    : "=r" (__val)                                      \
+                    :                                                   \
+                    : "cc");                                            \
+                __val;                                                  \
+        })
+#else
+extern unsigned int processor_id;
+#define read_cpuid(reg) (processor_id)
+#endif
 /*
 * The CPU ID never changes at run time, so we might as well tell the
 * compiler that it's constant.  Use this function to read the CPU ID
diff --git a/include/asm-blackfin/bfin-global.h b/include/asm-blackfin/bfin-global.h
index a9248d883675..76033831eb35 100644
--- a/include/asm-blackfin/bfin-global.h
+++ b/include/asm-blackfin/bfin-global.h
@@ -105,13 +105,6 @@ extern int sram_free(const void*);
 extern void *sram_alloc_with_lsl(size_t, unsigned long);
 extern int sram_free_with_lsl(const void*);
-extern void led_on(int);
-extern void led_off(int);
-extern void led_toggle(int);
-extern void led_disp_num(int);
-extern void led_toggle_num(int);
-extern void init_leds(void);
 extern const char bfin_board_name[];
 extern unsigned long wall_jiffies;
diff --git a/include/asm-blackfin/mach-bf527/anomaly.h b/include/asm-blackfin/mach-bf527/anomaly.h
index 735fa02fafb2..4725268a5ada 100644
--- a/include/asm-blackfin/mach-bf527/anomaly.h
+++ b/include/asm-blackfin/mach-bf527/anomaly.h
@@ -15,12 +15,16 @@
 /* Multi-Issue Instruction with dsp32shiftimm in slot1 and P-reg Store in slot2 Not Supported */
 #define ANOMALY_05000074 (1)
+/* DMA_RUN Bit Is Not Valid after a Peripheral Receive Channel DMA Stops */
+#define ANOMALY_05000119 (1)
 /* Rx.H Cannot Be Used to Access 16-bit System MMR Registers */
 #define ANOMALY_05000122 (1)
 /* Spurious Hardware Error from an Access in the Shadow of a Conditional Branch */
 #define ANOMALY_05000245 (1)
 /* Sensitivity To Noise with Slow Input Edge Rates on External SPORT TX and RX Clocks */
 #define ANOMALY_05000265 (1)
+/* Errors when SSYNC, CSYNC, or Loads to LT, LB and LC Registers Are Interrupted */
+#define ANOMALY_05000312 (1)
 /* Incorrect Access of OTP_STATUS During otp_write() Function */
 #define ANOMALY_05000328 (1)
 /* Disallowed Configuration Prevents Subsequent Allowed Configuration on Host DMA Port */
@@ -92,7 +96,6 @@
 #define ANOMALY_05000266 (0)
 #define ANOMALY_05000273 (0)
 #define ANOMALY_05000311 (0)
-#define ANOMALY_05000312 (0)
 #define ANOMALY_05000323 (0)
 #define ANOMALY_05000363 (0)
diff --git a/include/asm-blackfin/mach-bf527/bfin_serial_5xx.h b/include/asm-blackfin/mach-bf527/bfin_serial_5xx.h
index 26e3c8076b4e..96bd09e31e36 100644
--- a/include/asm-blackfin/mach-bf527/bfin_serial_5xx.h
+++ b/include/asm-blackfin/mach-bf527/bfin_serial_5xx.h
@@ -53,6 +53,12 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
+#define UART_SET_RTS(x) gpio_set_value(x->rts_pin, 1)
+#define UART_CLEAR_RTS(x) gpio_set_value(x->rts_pin, 0)
+#define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
+#define UART_DISABLE_INTS(x) UART_PUT_IER(x, 0)
 #if defined(CONFIG_BFIN_UART0_CTSRTS) || defined(CONFIG_BFIN_UART1_CTSRTS)
 # define CONFIG_SERIAL_BFIN_CTSRTS
diff --git a/include/asm-blackfin/mach-bf533/anomaly.h b/include/asm-blackfin/mach-bf533/anomaly.h
index 5a6dcc5fa36c..8f7ea112fd3a 100644
--- a/include/asm-blackfin/mach-bf533/anomaly.h
+++ b/include/asm-blackfin/mach-bf533/anomaly.h
@@ -2,7 +2,7 @@
 * File: include/asm-blackfin/mach-bf533/anomaly.h
 * Bugs: Enter bugs at http://blackfin.uclinux.org/
 *
- * Copyright (C) 2004-2007 Analog Devices Inc.
+ * Copyright (C) 2004-2008 Analog Devices Inc.
 * Licensed under the GPL-2 or later.
 */
@@ -176,6 +176,21 @@
 #define ANOMALY_05000315 (1)
 /* Internal Voltage Regulator Values of 1.05V, 1.10V and 1.15V Not Allowed for LQFP Packages */
 #define ANOMALY_05000319 (ANOMALY_BF531 || ANOMALY_BF532)
+/* Serial Port (SPORT) Multichannel Transmit Failure when Channel 0 Is Disabled */
+#define ANOMALY_05000357 (1)
+/* UART Break Signal Issues */
+#define ANOMALY_05000363 (__SILICON_REVISION__ < 5)
+/* PPI Underflow Error Goes Undetected in ITU-R 656 Mode */
+#define ANOMALY_05000366 (1)
+/* Possible RETS Register Corruption when Subroutine Is under 5 Cycles in Duration */
+#define ANOMALY_05000371 (1)
+/* PPI Does Not Start Properly In Specific Mode */
+#define ANOMALY_05000400 (__SILICON_REVISION__ >= 5)
+/* SSYNC Stalls Processor when Executed from Non-Cacheable Memory */
+#define ANOMALY_05000402 (__SILICON_REVISION__ >= 5)
+/* Level-Sensitive External GPIO Wakeups May Cause Indefinite Stall */
+#define ANOMALY_05000403 (1)
 /* These anomalies have been "phased" out of analog.com anomaly sheets and are
 * here to show running on older silicon just isn't feasible.
@@ -249,20 +264,6 @@
 #define ANOMALY_05000192 (__SILICON_REVISION__ < 3)
 /* Internal Voltage Regulator may not start up */
 #define ANOMALY_05000206 (__SILICON_REVISION__ < 3)
-/* Serial Port (SPORT) Multichannel Transmit Failure when Channel 0 Is Disabled */
-#define ANOMALY_05000357 (1)
-/* UART Break Signal Issues */
-#define ANOMALY_05000363 (__SILICON_REVISION__ < 5)
-/* PPI Underflow Error Goes Undetected in ITU-R 656 Mode */
-#define ANOMALY_05000366 (1)
-/* Possible RETS Register Corruption when Subroutine Is under 5 Cycles in Duration */
-#define ANOMALY_05000371 (1)
-/* PPI Does Not Start Properly In Specific Mode */
-#define ANOMALY_05000400 (__SILICON_REVISION__ == 5)
-/* SSYNC Stalls Processor when Executed from Non-Cacheable Memory */
-#define ANOMALY_05000402 (__SILICON_REVISION__ == 5)
-/* Level-Sensitive External GPIO Wakeups May Cause Indefinite Stall */
-#define ANOMALY_05000403 (1)
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000266 (0)
diff --git a/include/asm-blackfin/mach-bf533/bfin_serial_5xx.h b/include/asm-blackfin/mach-bf533/bfin_serial_5xx.h
index d016603b6615..e924569ad1d8 100644
--- a/include/asm-blackfin/mach-bf533/bfin_serial_5xx.h
+++ b/include/asm-blackfin/mach-bf533/bfin_serial_5xx.h
@@ -53,6 +53,12 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
+#define UART_SET_RTS(x) gpio_set_value(x->rts_pin, 1)
+#define UART_CLEAR_RTS(x) gpio_set_value(x->rts_pin, 0)
+#define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
+#define UART_DISABLE_INTS(x) UART_PUT_IER(x, 0)
 #ifdef CONFIG_BFIN_UART0_CTSRTS
 # define CONFIG_SERIAL_BFIN_CTSRTS
 # ifndef CONFIG_UART0_CTS_PIN
diff --git a/include/asm-blackfin/mach-bf537/anomaly.h b/include/asm-blackfin/mach-bf537/anomaly.h
index a6b08facb242..8460ab9c324f 100644
--- a/include/asm-blackfin/mach-bf537/anomaly.h
+++ b/include/asm-blackfin/mach-bf537/anomaly.h
@@ -2,7 +2,7 @@
 * File: include/asm-blackfin/mach-bf537/anomaly.h
 * Bugs: Enter bugs at http://blackfin.uclinux.org/
 *
- * Copyright (C) 2004-2007 Analog Devices Inc.
+ * Copyright (C) 2004-2008 Analog Devices Inc.
 * Licensed under the GPL-2 or later.
 */
@@ -132,8 +132,8 @@
 #define ANOMALY_05000322 (1)
 /* Ethernet MAC MDIO Reads Do Not Meet IEEE Specification */
 #define ANOMALY_05000341 (__SILICON_REVISION__ >= 3)
-/* New Feature: UART Remains Enabled after UART Boot (Not Available on Older Silicon) */
+/* New Feature: UART Remains Enabled after UART Boot */
-#define ANOMALY_05000350 (__SILICON_REVISION__ < 3)
+#define ANOMALY_05000350 (__SILICON_REVISION__ >= 3)
 /* Regulator Programming Blocked when Hibernate Wakeup Source Remains Active */
 #define ANOMALY_05000355 (1)
 /* Serial Port (SPORT) Multichannel Transmit Failure when Channel 0 Is Disabled */
@@ -145,12 +145,10 @@
 /* Possible RETS Register Corruption when Subroutine Is under 5 Cycles in Duration */
 #define ANOMALY_05000371 (1)
 /* SSYNC Stalls Processor when Executed from Non-Cacheable Memory */
-#define ANOMALY_05000402 (__SILICON_REVISION__ >= 3)
+#define ANOMALY_05000402 (__SILICON_REVISION__ >= 5)
 /* Level-Sensitive External GPIO Wakeups May Cause Indefinite Stall */
 #define ANOMALY_05000403 (1)
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000125 (0)
 #define ANOMALY_05000158 (0)
diff --git a/include/asm-blackfin/mach-bf537/bfin_serial_5xx.h b/include/asm-blackfin/mach-bf537/bfin_serial_5xx.h
index f79d1a0e9129..41d7b6490bb1 100644
--- a/include/asm-blackfin/mach-bf537/bfin_serial_5xx.h
+++ b/include/asm-blackfin/mach-bf537/bfin_serial_5xx.h
@@ -53,6 +53,12 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
+#define UART_SET_RTS(x) gpio_set_value(x->rts_pin, 1)
+#define UART_CLEAR_RTS(x) gpio_set_value(x->rts_pin, 0)
+#define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
+#define UART_DISABLE_INTS(x) UART_PUT_IER(x, 0)
 #if defined(CONFIG_BFIN_UART0_CTSRTS) || defined(CONFIG_BFIN_UART1_CTSRTS)
 # define CONFIG_SERIAL_BFIN_CTSRTS
diff --git a/include/asm-blackfin/mach-bf548/anomaly.h b/include/asm-blackfin/mach-bf548/anomaly.h
index 49d3cebc5293..3ad59655881a 100644
--- a/include/asm-blackfin/mach-bf548/anomaly.h
+++ b/include/asm-blackfin/mach-bf548/anomaly.h
@@ -75,6 +75,8 @@
 #define ANOMALY_05000365 (1)
 /* Addressing Conflict between Boot ROM and Asynchronous Memory */
 #define ANOMALY_05000369 (1)
+/* Possible RETS Register Corruption when Subroutine Is under 5 Cycles in Duration */
+#define ANOMALY_05000371 (1)
 /* Mobile DDR Operation Not Functional */
 #define ANOMALY_05000377 (1)
 /* Security/Authentication Speedpath Causes Authentication To Fail To Initiate */
diff --git a/include/asm-blackfin/mach-bf548/bfin_serial_5xx.h b/include/asm-blackfin/mach-bf548/bfin_serial_5xx.h
index 5eb46a77d919..59b4ad4e5b4a 100644
--- a/include/asm-blackfin/mach-bf548/bfin_serial_5xx.h
+++ b/include/asm-blackfin/mach-bf548/bfin_serial_5xx.h
@@ -57,6 +57,12 @@
 #define UART_SET_DLAB(uart)     /* MMRs not muxed on BF54x */
 #define UART_CLEAR_DLAB(uart)   /* MMRs not muxed on BF54x */
+#define UART_GET_CTS(x) (UART_GET_MSR(x) & CTS)
+#define UART_SET_RTS(x) (UART_PUT_MCR(x, UART_GET_MCR(x) | MRTS))
+#define UART_CLEAR_RTS(x) (UART_PUT_MCR(x, UART_GET_MCR(x) & ~MRTS))
+#define UART_ENABLE_INTS(x, v) UART_SET_IER(x, v)
+#define UART_DISABLE_INTS(x) UART_CLEAR_IER(x, 0xF)
 #if defined(CONFIG_BFIN_UART0_CTSRTS) || defined(CONFIG_BFIN_UART1_CTSRTS)
 # define CONFIG_SERIAL_BFIN_CTSRTS
diff --git a/include/asm-blackfin/mach-bf561/anomaly.h b/include/asm-blackfin/mach-bf561/anomaly.h
index 82157caa96a2..5c5d7d7d695f 100644
--- a/include/asm-blackfin/mach-bf561/anomaly.h
+++ b/include/asm-blackfin/mach-bf561/anomaly.h
@@ -2,7 +2,7 @@
 * File: include/asm-blackfin/mach-bf561/anomaly.h
 * Bugs: Enter bugs at http://blackfin.uclinux.org/
 *
- * Copyright (C) 2004-2007 Analog Devices Inc.
+ * Copyright (C) 2004-2008 Analog Devices Inc.
 * Licensed under the GPL-2 or later.
 */
diff --git a/include/asm-blackfin/mach-bf561/bfin_serial_5xx.h b/include/asm-blackfin/mach-bf561/bfin_serial_5xx.h
index 7a9628769296..30d90b580f18 100644
--- a/include/asm-blackfin/mach-bf561/bfin_serial_5xx.h
+++ b/include/asm-blackfin/mach-bf561/bfin_serial_5xx.h
@@ -53,6 +53,12 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
+#define UART_SET_RTS(x) gpio_set_value(x->rts_pin, 1)
+#define UART_CLEAR_RTS(x) gpio_set_value(x->rts_pin, 0)
+#define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
+#define UART_DISABLE_INTS(x) UART_PUT_IER(x, 0)
 #ifdef CONFIG_BFIN_UART0_CTSRTS
 # define CONFIG_SERIAL_BFIN_CTSRTS
 # ifndef CONFIG_UART0_CTS_PIN
diff --git a/include/asm-frv/checksum.h b/include/asm-frv/checksum.h
index 9b1689850187..269da09ff637 100644
--- a/include/asm-frv/checksum.h
+++ b/include/asm-frv/checksum.h
@@ -75,7 +75,7 @@ __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
            : "=r" (sum), "=r" (iph), "=r" (ihl), "=r" (inc), "=&r"(tmp)
            : "0" (sum), "1" (iph), "2" (ihl), "3" (4),
            "m"(*(volatile struct { int _[100]; } *)iph)
-            : "icc0", "icc1"
+            : "icc0", "icc1", "memory"
            );
        return (__force __sum16)~sum;
diff --git a/include/asm-frv/mem-layout.h b/include/asm-frv/mem-layout.h
index 734a1d0583b6..2947764fc0e0 100644
--- a/include/asm-frv/mem-layout.h
+++ b/include/asm-frv/mem-layout.h
@@ -31,6 +31,13 @@
 #define PAGE_MASK                       (~(PAGE_SIZE-1))
+/*
+ * the slab must be aligned such that load- and store-double instructions don't
+ * fault if used
+ */
+#define ARCH_KMALLOC_MINALIGN           8
+#define ARCH_SLAB_MINALIGN              8
 /*****************************************************************************/
 /*
 * virtual memory layout from kernel's point of view
diff --git a/include/asm-generic/gpio.h b/include/asm-generic/gpio.h
index ecf675a59d21..6be061d09da9 100644
--- a/include/asm-generic/gpio.h
+++ b/include/asm-generic/gpio.h
@@ -1,8 +1,12 @@
 #ifndef _ASM_GENERIC_GPIO_H
 #define _ASM_GENERIC_GPIO_H
+#include <linux/types.h>
 #ifdef CONFIG_HAVE_GPIO_LIB
+#include <linux/compiler.h>
 /* Platforms may implement their GPIO interface with library code,
 * at a small performance cost for non-inlined operations and some
 * extra memory (for code and for per-GPIO table entries).
@@ -74,7 +78,7 @@ struct gpio_chip {
 extern const char *gpiochip_is_requested(struct gpio_chip *chip,
                        unsigned offset);
-extern int __init __must_check gpiochip_reserve(int start, int ngpio);
+extern int __must_check gpiochip_reserve(int start, int ngpio);
 /* add/remove chips */
 extern int gpiochip_add(struct gpio_chip *chip);
diff --git a/include/asm-h8300/cacheflush.h b/include/asm-h8300/cacheflush.h
index 71210d141b64..5ffdca217b95 100644
--- a/include/asm-h8300/cacheflush.h
+++ b/include/asm-h8300/cacheflush.h
@@ -3,7 +3,7 @@
 */
 #ifndef _ASM_H8300_CACHEFLUSH_H
-#define _AMS_H8300_CACHEFLUSH_H
+#define _ASM_H8300_CACHEFLUSH_H
 /*
 * Cache handling functions
diff --git a/include/asm-ia64/patch.h b/include/asm-ia64/patch.h
index a71543084fb4..295fe6ab4584 100644
--- a/include/asm-ia64/patch.h
+++ b/include/asm-ia64/patch.h
@@ -21,6 +21,7 @@ extern void ia64_patch_imm60 (u64 insn_addr, u64 val);		/* patch "brl" w/ip-rel
 extern void ia64_patch_mckinley_e9 (unsigned long start, unsigned long end);
 extern void ia64_patch_vtop (unsigned long start, unsigned long end);
 extern void ia64_patch_phys_stack_reg(unsigned long val);
+extern void ia64_patch_rse (unsigned long start, unsigned long end);
 extern void ia64_patch_gate (void);
 #endif /* _ASM_IA64_PATCH_H */
diff --git a/include/asm-ia64/ptrace.h b/include/asm-ia64/ptrace.h
index 4b2a8d40ebc5..15f8dcfe6eee 100644
--- a/include/asm-ia64/ptrace.h
+++ b/include/asm-ia64/ptrace.h
@@ -76,7 +76,7 @@
 # define KERNEL_STACK_SIZE_ORDER                0
 #endif
-#define IA64_RBS_OFFSET                 ((IA64_TASK_SIZE + IA64_THREAD_INFO_SIZE + 15) & ~15)
+#define IA64_RBS_OFFSET                 ((IA64_TASK_SIZE + IA64_THREAD_INFO_SIZE + 31) & ~31)
 #define IA64_STK_OFFSET                 ((1 << KERNEL_STACK_SIZE_ORDER)*PAGE_SIZE)
 #define KERNEL_STACK_SIZE               IA64_STK_OFFSET
diff --git a/include/asm-ia64/sections.h b/include/asm-ia64/sections.h
index dc42a359894f..7286e4a9fe84 100644
--- a/include/asm-ia64/sections.h
+++ b/include/asm-ia64/sections.h
@@ -10,6 +10,7 @@
 extern char __per_cpu_start[], __per_cpu_end[], __phys_per_cpu_start[];
 extern char __start___vtop_patchlist[], __end___vtop_patchlist[];
+extern char __start___rse_patchlist[], __end___rse_patchlist[];
 extern char __start___mckinley_e9_bundles[], __end___mckinley_e9_bundles[];
 extern char __start___phys_stack_reg_patchlist[], __end___phys_stack_reg_patchlist[];
 extern char __start_gate_section[];
diff --git a/include/asm-m32r/uaccess.h b/include/asm-m32r/uaccess.h
index bd8c83765a5c..1c7047bea200 100644
--- a/include/asm-m32r/uaccess.h
+++ b/include/asm-m32r/uaccess.h
@@ -14,6 +14,7 @@
 #include <linux/errno.h>
 #include <linux/thread_info.h>
 #include <asm/page.h>
+#include <asm/setup.h>
 #define VERIFY_READ 0
 #define VERIFY_WRITE 1
@@ -106,7 +107,6 @@ static inline void set_fs(mm_segment_t s)
 #else
 static inline int access_ok(int type, const void *addr, unsigned long size)
 {
-        extern unsigned long memory_start, memory_end;
        unsigned long val = (unsigned long)addr;
        return ((val >= memory_start) && ((val + size) < memory_end));
diff --git a/include/asm-m68k/bitops.h b/include/asm-m68k/bitops.h
index 83d1f286230b..3e8106442d5a 100644
--- a/include/asm-m68k/bitops.h
+++ b/include/asm-m68k/bitops.h
@@ -410,8 +410,49 @@ static inline int ext2_find_next_zero_bit(const void *vaddr, unsigned size,
        res = ext2_find_first_zero_bit (p, size - 32 * (p - addr));
        return (p - addr) * 32 + res;
 }
-#define ext2_find_next_bit(addr, size, off) \
-        generic_find_next_le_bit((unsigned long *)(addr), (size), (off))
+static inline int ext2_find_first_bit(const void *vaddr, unsigned size)
+{
+        const unsigned long *p = vaddr, *addr = vaddr;
+        int res;
+        if (!size)
+                return 0;
+        size = (size >> 5) + ((size & 31) > 0);
+        while (*p++ == 0UL) {
+                if (--size == 0)
+                        return (p - addr) << 5;
+        }
+        --p;
+        for (res = 0; res < 32; res++)
+                if (ext2_test_bit(res, p))
+                        break;
+        return (p - addr) * 32 + res;
+}
+static inline int ext2_find_next_bit(const void *vaddr, unsigned size,
+                                     unsigned offset)
+{
+        const unsigned long *addr = vaddr;
+        const unsigned long *p = addr + (offset >> 5);
+        int bit = offset & 31UL, res;
+        if (offset >= size)
+                return size;
+        if (bit) {
+                /* Look for one in first longword */
+                for (res = bit; res < 32; res++)
+                        if (ext2_test_bit(res, p))
+                                return (p - addr) * 32 + res;
+                p++;
+        }
+        /* No set bit yet, search remaining full bytes for a set bit */
+        res = ext2_find_first_bit(p, size - 32 * (p - addr));
+        return (p - addr) * 32 + res;
+}
 #endif /* __KERNEL__ */
diff --git a/include/asm-mips/gic.h b/include/asm-mips/gic.h
index 01b2f92dc33d..3a492f225f00 100644
--- a/include/asm-mips/gic.h
+++ b/include/asm-mips/gic.h
@@ -330,7 +330,7 @@
 #define GIC_SH_RMASK_OFS                0x0300
 #define GIC_CLR_INTR_MASK(intr, val) \
-        GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_RMASK_OFS + 4 + (((((intr) / 32) ^ 1) - 1) * 4)), ((val) << ((intr) % 32))
+        GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_RMASK_OFS + 4 + (((((intr) / 32) ^ 1) - 1) * 4)), ((val) << ((intr) % 32)))
 /* Register Map for Local Section */
 #define GIC_VPE_CTL_OFS                 0x0000
diff --git a/include/asm-mips/mach-au1x00/au1000.h b/include/asm-mips/mach-au1x00/au1000.h
index 363a14ee0ae5..1b5064dac007 100644
--- a/include/asm-mips/mach-au1x00/au1000.h
+++ b/include/asm-mips/mach-au1x00/au1000.h
@@ -1036,7 +1036,7 @@ enum soc_au1200_ints {
 #define USBD_INTSTAT            0xB020001C
 #  define USBDEV_INT_SOF        (1 << 12)
 #  define USBDEV_INT_HF_BIT     6
-#  define USBDEV_INT_HF_MASK    0x3f << USBDEV_INT_HF_BIT)
+#  define USBDEV_INT_HF_MASK    (0x3f << USBDEV_INT_HF_BIT)
 #  define USBDEV_INT_CMPLT_BIT  0
 #  define USBDEV_INT_CMPLT_MASK (0x3f << USBDEV_INT_CMPLT_BIT)
 #define USBD_CONFIG             0xB0200020
diff --git a/include/asm-mips/mach-au1x00/au1xxx_dbdma.h b/include/asm-mips/mach-au1x00/au1xxx_dbdma.h
index ad17d7ce516a..44a67bf05dc1 100644
--- a/include/asm-mips/mach-au1x00/au1xxx_dbdma.h
+++ b/include/asm-mips/mach-au1x00/au1xxx_dbdma.h
@@ -355,6 +355,7 @@ void au1xxx_dbdma_dump(u32 chanid);
 u32 au1xxx_dbdma_put_dscr(u32 chanid, au1x_ddma_desc_t *dscr);
 u32 au1xxx_ddma_add_device(dbdev_tab_t *dev);
+extern void au1xxx_ddma_del_device(u32 devid);
 void *au1xxx_ddma_get_nextptr_virt(au1x_ddma_desc_t *dp);
 /*
diff --git a/include/asm-mips/mipsregs.h b/include/asm-mips/mipsregs.h
index aa17f658f73c..a46f8e258e6b 100644
--- a/include/asm-mips/mipsregs.h
+++ b/include/asm-mips/mipsregs.h
@@ -765,6 +765,9 @@ do {									\
 #define read_c0_index()         __read_32bit_c0_register($0, 0)
 #define write_c0_index(val)     __write_32bit_c0_register($0, 0, val)
+#define read_c0_random()        __read_32bit_c0_register($1, 0)
+#define write_c0_random(val)    __write_32bit_c0_register($1, 0, val)
 #define read_c0_entrylo0()      __read_ulong_c0_register($2, 0)
 #define write_c0_entrylo0(val)  __write_ulong_c0_register($2, 0, val)
diff --git a/include/asm-mips/pgtable.h b/include/asm-mips/pgtable.h
index 2f597eea4448..6a0edf72ffbc 100644
--- a/include/asm-mips/pgtable.h
+++ b/include/asm-mips/pgtable.h
@@ -239,9 +239,10 @@ static inline pte_t pte_mkdirty(pte_t pte)
 static inline pte_t pte_mkyoung(pte_t pte)
 {
        pte.pte_low |= _PAGE_ACCESSED;
-        if (pte.pte_low & _PAGE_READ)
+        if (pte.pte_low & _PAGE_READ) {
                pte.pte_low  |= _PAGE_SILENT_READ;
                pte.pte_high |= _PAGE_SILENT_READ;
+        }
        return pte;
 }
 #else
diff --git a/include/asm-mips/rtlx.h b/include/asm-mips/rtlx.h
index 20b666022dcb..4ca3063ed2ce 100644
--- a/include/asm-mips/rtlx.h
+++ b/include/asm-mips/rtlx.h
@@ -3,7 +3,7 @@
 *
 */
-#ifndef __ASM_RTLX_H
+#ifndef __ASM_RTLX_H_
 #define __ASM_RTLX_H_
 #include <irq.h>
diff --git a/include/asm-mn10300/ipcbuf.h b/include/asm-mn10300/ipcbuf.h
index efbbef8d1c69..f6f63d448272 100644
--- a/include/asm-mn10300/ipcbuf.h
+++ b/include/asm-mn10300/ipcbuf.h
@@ -1,4 +1,4 @@
-#ifndef _ASM_IPCBUF_H_
+#ifndef _ASM_IPCBUF_H
 #define _ASM_IPCBUF_H
 /*
diff --git a/include/asm-parisc/checksum.h b/include/asm-parisc/checksum.h
index cc3ec1bd8919..e9639ccc3fce 100644
--- a/include/asm-parisc/checksum.h
+++ b/include/asm-parisc/checksum.h
@@ -65,7 +65,7 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
 "2:\n"
        : "=r" (sum), "=r" (iph), "=r" (ihl)
        : "1" (iph), "2" (ihl)
-        : "r19", "r20", "r21" );
+        : "r19", "r20", "r21", "memory");
        return (__force __sum16)sum;
 }
diff --git a/include/asm-powerpc/io.h b/include/asm-powerpc/io.h
index e0062d73db1c..89189488e286 100644
--- a/include/asm-powerpc/io.h
+++ b/include/asm-powerpc/io.h
@@ -100,7 +100,7 @@ static inline type name(const volatile type __iomem *addr)		\
 {                                                                       \
        type ret;                                                       \
        __asm__ __volatile__("sync;" insn ";twi 0,%0,0;isync"           \
-                : "=r" (ret) : "r" (addr), "m" (*addr));                \
+                : "=r" (ret) : "r" (addr), "m" (*addr) : "memory");     \
        return ret;                                                     \
 }
@@ -108,8 +108,8 @@ static inline type name(const volatile type __iomem *addr)		\
 static inline void name(volatile type __iomem *addr, type val)          \
 {                                                                       \
        __asm__ __volatile__("sync;" insn                               \
-                : "=m" (*addr) : "r" (val), "r" (addr));                \
+                : "=m" (*addr) : "r" (val), "r" (addr) : "memory");     \
-        IO_SET_SYNC_FLAG();                                     \
+        IO_SET_SYNC_FLAG();                                             \
 }
@@ -333,7 +333,8 @@ static inline unsigned int name(unsigned int port)	\
                "       .long   3b,5b\n"                \
                ".previous"                             \
                : "=&r" (x)                             \
-                : "r" (port + _IO_BASE));               \
+                : "r" (port + _IO_BASE)                 \
+                : "memory");                            \
        return x;                                       \
 }
@@ -350,7 +351,8 @@ static inline void name(unsigned int val, unsigned int port) \
                "       .long   0b,2b\n"                \
                "       .long   1b,2b\n"                \
                ".previous"                             \
-                : : "r" (val), "r" (port + _IO_BASE));  \
+                : : "r" (val), "r" (port + _IO_BASE)    \
+                : "memory");                            \
 }
 __do_in_asm(_rec_inb, "lbzx")
diff --git a/include/asm-powerpc/kvm_ppc.h b/include/asm-powerpc/kvm_ppc.h
index b35a7e3ef978..5a21115228af 100644
--- a/include/asm-powerpc/kvm_ppc.h
+++ b/include/asm-powerpc/kvm_ppc.h
@@ -57,6 +57,7 @@ extern int kvmppc_handle_store(struct kvm_run *run, struct kvm_vcpu *vcpu,
 extern int kvmppc_emulate_instruction(struct kvm_run *run,
                                      struct kvm_vcpu *vcpu);
+extern int kvmppc_emulate_mmio(struct kvm_run *run, struct kvm_vcpu *vcpu);
 extern void kvmppc_mmu_map(struct kvm_vcpu *vcpu, u64 gvaddr, gfn_t gfn,
                           u64 asid, u32 flags);
diff --git a/include/asm-powerpc/mpic.h b/include/asm-powerpc/mpic.h
index 943c5a3fac8a..a4d0f876b427 100644
--- a/include/asm-powerpc/mpic.h
+++ b/include/asm-powerpc/mpic.h
@@ -428,12 +428,11 @@ extern void mpic_init(struct mpic *mpic);
 */
-/* Change/Read the priority of an interrupt. Default is 8 for irqs and
+/* Change the priority of an interrupt. Default is 8 for irqs and
 * 10 for IPIs. You can call this on both IPIs and IRQ numbers, but the
 * IPI number is then the offset'ed (linux irq number mapped to the IPI)
 */
 extern void mpic_irq_set_priority(unsigned int irq, unsigned int pri);
-extern unsigned int mpic_irq_get_priority(unsigned int irq);
 /* Setup a non-boot CPU */
 extern void mpic_setup_this_cpu(void);
diff --git a/include/asm-s390/system.h b/include/asm-s390/system.h
index e0d4500d5f95..819e7d99ca0c 100644
--- a/include/asm-s390/system.h
+++ b/include/asm-s390/system.h
@@ -315,14 +315,14 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
        asm volatile(                                           \
                "       lctlg   %1,%2,0(%0)\n"                  \
                : : "a" (&array), "i" (low), "i" (high),        \
-                    "m" (*(addrtype *)(array)));                \
+                    "m" (*(addrtype *)(&array)));               \
        })
 #define __ctl_store(array, low, high) ({                        \
        typedef struct { char _[sizeof(array)]; } addrtype;     \
        asm volatile(                                           \
                "       stctg   %2,%3,0(%1)\n"                  \
-                : "=m" (*(addrtype *)(array))                   \
+                : "=m" (*(addrtype *)(&array))                  \
                : "a" (&array), "i" (low), "i" (high));         \
        })
@@ -333,14 +333,14 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
        asm volatile(                                           \
                "       lctl    %1,%2,0(%0)\n"                  \
                : : "a" (&array), "i" (low), "i" (high),        \
-                    "m" (*(addrtype *)(array)));                \
+                    "m" (*(addrtype *)(&array)));               \
 })
 #define __ctl_store(array, low, high) ({                        \
        typedef struct { char _[sizeof(array)]; } addrtype;     \
        asm volatile(                                           \
                "       stctl   %2,%3,0(%1)\n"                  \
-                : "=m" (*(addrtype *)(array))                   \
+                : "=m" (*(addrtype *)(&array))                  \
                : "a" (&array), "i" (low), "i" (high));         \
        })
diff --git a/include/asm-s390/types.h b/include/asm-s390/types.h
index 0e959e20e9a3..41c547656130 100644
--- a/include/asm-s390/types.h
+++ b/include/asm-s390/types.h
@@ -40,7 +40,13 @@ typedef __signed__ long saddr_t;
 #ifndef __ASSEMBLY__
+typedef u64 dma64_addr_t;
+#ifdef __s390x__
+/* DMA addresses come in 32-bit and 64-bit flavours. */
+typedef u64 dma_addr_t;
+#else
 typedef u32 dma_addr_t;
+#endif
 #ifndef __s390x__
 typedef union {
diff --git a/include/asm-sh/checksum_32.h b/include/asm-sh/checksum_32.h
index 4bc8357e8892..14b7ac2f0a07 100644
--- a/include/asm-sh/checksum_32.h
+++ b/include/asm-sh/checksum_32.h
@@ -109,7 +109,7 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
           will assume they contain their original values. */
        : "=r" (sum), "=r" (iph), "=r" (ihl), "=&r" (__dummy0), "=&z" (__dummy1)
        : "1" (iph), "2" (ihl)
-        : "t");
+        : "t", "memory");
        return  csum_fold(sum);
 }
diff --git a/include/asm-sparc64/io.h b/include/asm-sparc64/io.h
index c299b853b5ba..3158960f3eb5 100644
--- a/include/asm-sparc64/io.h
+++ b/include/asm-sparc64/io.h
@@ -24,7 +24,8 @@ static inline u8 _inb(unsigned long addr)
        __asm__ __volatile__("lduba\t[%1] %2, %0\t/* pci_inb */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
        return ret;
 }
@@ -35,7 +36,8 @@ static inline u16 _inw(unsigned long addr)
        __asm__ __volatile__("lduha\t[%1] %2, %0\t/* pci_inw */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
        return ret;
 }
@@ -46,7 +48,8 @@ static inline u32 _inl(unsigned long addr)
        __asm__ __volatile__("lduwa\t[%1] %2, %0\t/* pci_inl */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
        return ret;
 }
@@ -55,21 +58,24 @@ static inline void _outb(u8 b, unsigned long addr)
 {
        __asm__ __volatile__("stba\t%r0, [%1] %2\t/* pci_outb */"
                             : /* no outputs */
-                             : "Jr" (b), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "Jr" (b), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
 }
 static inline void _outw(u16 w, unsigned long addr)
 {
        __asm__ __volatile__("stha\t%r0, [%1] %2\t/* pci_outw */"
                             : /* no outputs */
-                             : "Jr" (w), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "Jr" (w), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
 }
 static inline void _outl(u32 l, unsigned long addr)
 {
        __asm__ __volatile__("stwa\t%r0, [%1] %2\t/* pci_outl */"
                             : /* no outputs */
-                             : "Jr" (l), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "Jr" (l), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
 }
 #define inb(__addr)             (_inb((unsigned long)(__addr)))
@@ -128,7 +134,8 @@ static inline u8 _readb(const volatile void __iomem *addr)
        __asm__ __volatile__("lduba\t[%1] %2, %0\t/* pci_readb */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
        return ret;
 }
@@ -137,7 +144,8 @@ static inline u16 _readw(const volatile void __iomem *addr)
        __asm__ __volatile__("lduha\t[%1] %2, %0\t/* pci_readw */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
        return ret;
 }
@@ -147,7 +155,8 @@ static inline u32 _readl(const volatile void __iomem *addr)
        __asm__ __volatile__("lduwa\t[%1] %2, %0\t/* pci_readl */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
        return ret;
 }
@@ -157,7 +166,8 @@ static inline u64 _readq(const volatile void __iomem *addr)
        __asm__ __volatile__("ldxa\t[%1] %2, %0\t/* pci_readq */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
        return ret;
 }
@@ -166,28 +176,32 @@ static inline void _writeb(u8 b, volatile void __iomem *addr)
 {
        __asm__ __volatile__("stba\t%r0, [%1] %2\t/* pci_writeb */"
                             : /* no outputs */
-                             : "Jr" (b), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "Jr" (b), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
 }
 static inline void _writew(u16 w, volatile void __iomem *addr)
 {
        __asm__ __volatile__("stha\t%r0, [%1] %2\t/* pci_writew */"
                             : /* no outputs */
-                             : "Jr" (w), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "Jr" (w), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
 }
 static inline void _writel(u32 l, volatile void __iomem *addr)
 {
        __asm__ __volatile__("stwa\t%r0, [%1] %2\t/* pci_writel */"
                             : /* no outputs */
-                             : "Jr" (l), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "Jr" (l), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
 }
 static inline void _writeq(u64 q, volatile void __iomem *addr)
 {
        __asm__ __volatile__("stxa\t%r0, [%1] %2\t/* pci_writeq */"
                             : /* no outputs */
-                             : "Jr" (q), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L));
+                             : "Jr" (q), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E_L)
+                             : "memory");
 }
 #define readb(__addr)           _readb(__addr)
@@ -299,7 +313,8 @@ static inline u8 _sbus_readb(const volatile void __iomem *addr)
        __asm__ __volatile__("lduba\t[%1] %2, %0\t/* sbus_readb */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E)
+                             : "memory");
        return ret;
 }
@@ -310,7 +325,8 @@ static inline u16 _sbus_readw(const volatile void __iomem *addr)
        __asm__ __volatile__("lduha\t[%1] %2, %0\t/* sbus_readw */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E)
+                             : "memory");
        return ret;
 }
@@ -321,7 +337,8 @@ static inline u32 _sbus_readl(const volatile void __iomem *addr)
        __asm__ __volatile__("lduwa\t[%1] %2, %0\t/* sbus_readl */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E)
+                             : "memory");
        return ret;
 }
@@ -332,7 +349,8 @@ static inline u64 _sbus_readq(const volatile void __iomem *addr)
        __asm__ __volatile__("ldxa\t[%1] %2, %0\t/* sbus_readq */"
                             : "=r" (ret)
-                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E));
+                             : "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E)
+                             : "memory");
        return ret;
 }
@@ -341,28 +359,32 @@ static inline void _sbus_writeb(u8 b, volatile void __iomem *addr)
 {
        __asm__ __volatile__("stba\t%r0, [%1] %2\t/* sbus_writeb */"
                             : /* no outputs */
-                             : "Jr" (b), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E));
+                             : "Jr" (b), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E)
+                             : "memory");
 }
 static inline void _sbus_writew(u16 w, volatile void __iomem *addr)
 {
        __asm__ __volatile__("stha\t%r0, [%1] %2\t/* sbus_writew */"
                             : /* no outputs */
-                             : "Jr" (w), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E));
+                             : "Jr" (w), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E)
+                             : "memory");
 }
 static inline void _sbus_writel(u32 l, volatile void __iomem *addr)
 {
        __asm__ __volatile__("stwa\t%r0, [%1] %2\t/* sbus_writel */"
                             : /* no outputs */
-                             : "Jr" (l), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E));
+                             : "Jr" (l), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E)
+                             : "memory");
 }
 static inline void _sbus_writeq(u64 l, volatile void __iomem *addr)
 {
        __asm__ __volatile__("stxa\t%r0, [%1] %2\t/* sbus_writeq */"
                             : /* no outputs */
-                             : "Jr" (l), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E));
+                             : "Jr" (l), "r" (addr), "i" (ASI_PHYS_BYPASS_EC_E)
+                             : "memory");
 }
 #define sbus_readb(__addr)              _sbus_readb(__addr)
diff --git a/include/asm-sparc64/ptrace.h b/include/asm-sparc64/ptrace.h
index d8a56cddf7f2..b163da79bb6d 100644
--- a/include/asm-sparc64/ptrace.h
+++ b/include/asm-sparc64/ptrace.h
@@ -126,6 +126,8 @@ struct sparc_trapf {
 #define TRACEREG32_SZ   sizeof(struct pt_regs32)
 #define STACKFRAME32_SZ sizeof(struct sparc_stackf32)
+#ifdef __KERNEL__
 struct global_reg_snapshot {
        unsigned long           tstate;
        unsigned long           tpc;
@@ -137,8 +139,6 @@ struct global_reg_snapshot {
        unsigned long           pad2;
 };
-#ifdef __KERNEL__
 #define __ARCH_WANT_COMPAT_SYS_PTRACE
 #define force_successful_syscall_return()           \
@@ -306,6 +306,8 @@ extern void __show_regs(struct pt_regs *);
 #define SF_XARG5  0x58
 #define SF_XXARG  0x5c
+#ifdef __KERNEL__
 /* global_reg_snapshot offsets */
 #define GR_SNAP_TSTATE  0x00
 #define GR_SNAP_TPC     0x08
@@ -316,6 +318,8 @@ extern void __show_regs(struct pt_regs *);
 #define GR_SNAP_PAD1    0x30
 #define GR_SNAP_PAD2    0x38
+#endif  /*  __KERNEL__  */
 /* Stuff for the ptrace system call */
 #define PTRACE_SPARC_DETACH       11
 #define PTRACE_GETREGS            12
diff --git a/include/asm-um/mmu_context.h b/include/asm-um/mmu_context.h
index 6686fc524ca1..54f42e8b0105 100644
--- a/include/asm-um/mmu_context.h
+++ b/include/asm-um/mmu_context.h
@@ -22,16 +22,10 @@ extern void force_flush_all(void);
 static inline void activate_mm(struct mm_struct *old, struct mm_struct *new)
 {
        /*
-         * This is called by fs/exec.c and fs/aio.c. In the first case, for an
+         * This is called by fs/exec.c and sys_unshare()
-         * exec, we don't need to do anything as we're called from userspace
+         * when the new ->mm is used for the first time.
-         * and thus going to use a new host PID. In the second, we're called
-         * from a kernel thread, and thus need to go doing the mmap's on the
-         * host. Since they're very expensive, we want to avoid that as far as
-         * possible.
         */
-        if (old != new && (current->flags & PF_BORROWED_MM))
+        __switch_mm(&new->context.id);
-                __switch_mm(&new->context.id);
        arch_dup_mmap(old, new);
 }
diff --git a/include/asm-v850/clinkage.h b/include/asm-v850/clinkage.h
index 2b622adccae5..c389691d6f86 100644
--- a/include/asm-v850/clinkage.h
+++ b/include/asm-v850/clinkage.h
@@ -11,7 +11,7 @@
 * Written by Miles Bader <miles@gnu.org>
 */
-#ifndef __CLINKAGE_H__
+#ifndef __V850_CLINKAGE_H__
 #define __V850_CLINKAGE_H__
 #include <asm/macrology.h>
diff --git a/include/asm-x86/i387.h b/include/asm-x86/i387.h
index 6b722d315936..37672f79dcc8 100644
--- a/include/asm-x86/i387.h
+++ b/include/asm-x86/i387.h
@@ -193,6 +193,8 @@ static inline int restore_i387(struct _fpstate __user *buf)
 #else  /* CONFIG_X86_32 */
+extern void finit(void);
 static inline void tolerant_fwait(void)
 {
        asm volatile("fnclex ; fwait");
diff --git a/include/asm-x86/tlbflush.h b/include/asm-x86/tlbflush.h
index 0c0674d94255..35c76ceb9f40 100644
--- a/include/asm-x86/tlbflush.h
+++ b/include/asm-x86/tlbflush.h
@@ -22,12 +22,23 @@ static inline void __native_flush_tlb(void)
 static inline void __native_flush_tlb_global(void)
 {
-        unsigned long cr4 = read_cr4();
+        unsigned long flags;
+        unsigned long cr4;
+        /*
+         * Read-modify-write to CR4 - protect it from preemption and
+         * from interrupts. (Use the raw variant because this code can
+         * be called from deep inside debugging code.)
+         */
+        raw_local_irq_save(flags);
+        cr4 = read_cr4();
        /* clear PGE */
        write_cr4(cr4 & ~X86_CR4_PGE);
        /* write old PGE again and flush TLBs */
        write_cr4(cr4);
+        raw_local_irq_restore(flags);
 }
 static inline void __native_flush_tlb_single(unsigned long addr)
diff --git a/include/linux/bitrev.h b/include/linux/bitrev.h
index 05e540d6963a..7ffe03f4693d 100644
--- a/include/linux/bitrev.h
+++ b/include/linux/bitrev.h
@@ -10,6 +10,7 @@ static inline u8 bitrev8(u8 byte)
        return byte_rev_table[byte];
 }
+extern u16 bitrev16(u16 in);
 extern u32 bitrev32(u32 in);
 #endif /* _LINUX_BITREV_H */
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index cfc3147e5cf9..e3ef903aae88 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -55,6 +55,7 @@ enum blktrace_act {
 enum blktrace_notify {
        __BLK_TN_PROCESS = 0,           /* establish pid/name mapping */
        __BLK_TN_TIMESTAMP,             /* include system clock */
+        __BLK_TN_MESSAGE,               /* Character string message */
 };
@@ -79,6 +80,7 @@ enum blktrace_notify {
 #define BLK_TN_PROCESS          (__BLK_TN_PROCESS | BLK_TC_ACT(BLK_TC_NOTIFY))
 #define BLK_TN_TIMESTAMP        (__BLK_TN_TIMESTAMP | BLK_TC_ACT(BLK_TC_NOTIFY))
+#define BLK_TN_MESSAGE          (__BLK_TN_MESSAGE | BLK_TC_ACT(BLK_TC_NOTIFY))
 #define BLK_IO_TRACE_MAGIC      0x65617400
 #define BLK_IO_TRACE_VERSION    0x07
@@ -119,6 +121,7 @@ struct blk_trace {
        int trace_state;
        struct rchan *rchan;
        unsigned long *sequence;
+        unsigned char *msg_data;
        u16 act_mask;
        u64 start_lba;
        u64 end_lba;
@@ -149,7 +152,28 @@ extern void blk_trace_shutdown(struct request_queue *);
 extern void __blk_add_trace(struct blk_trace *, sector_t, int, int, u32, int, int, void *);
 extern int do_blk_trace_setup(struct request_queue *q,
        char *name, dev_t dev, struct blk_user_trace_setup *buts);
+extern void __trace_note_message(struct blk_trace *, const char *fmt, ...);
+/**
+ * blk_add_trace_msg - Add a (simple) message to the blktrace stream
+ * @q:          queue the io is for
+ * @fmt:        format to print message in
+ * args...      Variable argument list for format
+ *
+ * Description:
+ *     Records a (simple) message onto the blktrace stream.
+ *
+ *     NOTE: BLK_TN_MAX_MSG characters are output at most.
+ *     NOTE: Can not use 'static inline' due to presence of var args...
+ *
+ **/
+#define blk_add_trace_msg(q, fmt, ...)                                  \
+        do {                                                            \
+                struct blk_trace *bt = (q)->blk_trace;                  \
+                if (unlikely(bt))                                       \
+                        __trace_note_message(bt, fmt, ##__VA_ARGS__);   \
+        } while (0)
+#define BLK_TN_MAX_MSG          128
 /**
 * blk_add_trace_rq - Add a trace for a request oriented action
@@ -299,6 +323,8 @@ extern int blk_trace_remove(struct request_queue *q);
 #define blk_trace_setup(q, name, dev, arg)      (-ENOTTY)
 #define blk_trace_startstop(q, start)           (-ENOTTY)
 #define blk_trace_remove(q)                     (-ENOTTY)
+#define blk_add_trace_msg(q, fmt, ...)          do { } while (0)
 #endif /* CONFIG_BLK_DEV_IO_TRACE */
 #endif /* __KERNEL__ */
 #endif
diff --git a/include/linux/capability.h b/include/linux/capability.h
index f4ea0dd9a618..fa830f8de032 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -31,11 +31,11 @@ struct task_struct;
 #define _LINUX_CAPABILITY_VERSION_1  0x19980330
 #define _LINUX_CAPABILITY_U32S_1     1
-#define _LINUX_CAPABILITY_VERSION_2  0x20071026
+#define _LINUX_CAPABILITY_VERSION_2  0x20071026  /* deprecated - use v3 */
 #define _LINUX_CAPABILITY_U32S_2     2
-#define _LINUX_CAPABILITY_VERSION    _LINUX_CAPABILITY_VERSION_2
+#define _LINUX_CAPABILITY_VERSION_3  0x20080522
-#define _LINUX_CAPABILITY_U32S       _LINUX_CAPABILITY_U32S_2
+#define _LINUX_CAPABILITY_U32S_3     2
 typedef struct __user_cap_header_struct {
        __u32 version;
@@ -77,10 +77,23 @@ struct vfs_cap_data {
        } data[VFS_CAP_U32];
 };
-#ifdef __KERNEL__
+#ifndef __KERNEL__
+/*
+ * Backwardly compatible definition for source code - trapped in a
+ * 32-bit world. If you find you need this, please consider using
+ * libcap to untrap yourself...
+ */
+#define _LINUX_CAPABILITY_VERSION  _LINUX_CAPABILITY_VERSION_1
+#define _LINUX_CAPABILITY_U32S     _LINUX_CAPABILITY_U32S_1
+#else
+#define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
+#define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3
 typedef struct kernel_cap_struct {
-        __u32 cap[_LINUX_CAPABILITY_U32S];
+        __u32 cap[_KERNEL_CAPABILITY_U32S];
 } kernel_cap_t;
 #define _USER_CAP_HEADER_SIZE  (sizeof(struct __user_cap_header_struct))
@@ -351,7 +364,7 @@ typedef struct kernel_cap_struct {
 */
 #define CAP_FOR_EACH_U32(__capi)  \
-        for (__capi = 0; __capi < _LINUX_CAPABILITY_U32S; ++__capi)
+        for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi)
 # define CAP_FS_MASK_B0     (CAP_TO_MASK(CAP_CHOWN)             \
                            | CAP_TO_MASK(CAP_DAC_OVERRIDE)     \
@@ -361,7 +374,7 @@ typedef struct kernel_cap_struct {
 # define CAP_FS_MASK_B1     (CAP_TO_MASK(CAP_MAC_OVERRIDE))
-#if _LINUX_CAPABILITY_U32S != 2
+#if _KERNEL_CAPABILITY_U32S != 2
 # error Fix up hand-coded capability macro initializers
 #else /* HAND-CODED capability initializers */
@@ -372,7 +385,7 @@ typedef struct kernel_cap_struct {
 # define CAP_NFSD_SET     ((kernel_cap_t){{ CAP_FS_MASK_B0|CAP_TO_MASK(CAP_SYS_RESOURCE), \
                                        CAP_FS_MASK_B1 } })
-#endif /* _LINUX_CAPABILITY_U32S != 2 */
+#endif /* _KERNEL_CAPABILITY_U32S != 2 */
 #define CAP_INIT_INH_SET    CAP_EMPTY_SET
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 51e6b1e520e6..dcf77fa826b5 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -82,6 +82,7 @@ struct cpuidle_state_kobj {
 };
 struct cpuidle_device {
+        unsigned int            registered:1;
        unsigned int            enabled:1;
        unsigned int            cpu;
diff --git a/include/linux/device.h b/include/linux/device.h
index 14616e80213c..6a2d04c011bc 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -385,6 +385,9 @@ static inline const char *dev_name(struct device *dev)
        return dev->bus_id;
 }
+extern int dev_set_name(struct device *dev, const char *name, ...)
+                        __attribute__((format(printf, 2, 3)));
 #ifdef CONFIG_NUMA
 static inline int dev_to_node(struct device *dev)
 {
diff --git a/include/linux/fs.h b/include/linux/fs.h
index f413085f748e..d490779f18d9 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2000,7 +2000,10 @@ extern int simple_fill_super(struct super_block *, int, struct tree_descr *);
 extern int simple_pin_fs(struct file_system_type *, struct vfsmount **mount, int *count);
 extern void simple_release_fs(struct vfsmount **mount, int *count);
-extern ssize_t simple_read_from_buffer(void __user *, size_t, loff_t *, const void *, size_t);
+extern ssize_t simple_read_from_buffer(void __user *to, size_t count,
+                        loff_t *ppos, const void *from, size_t available);
+extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
+                        const void *from, size_t available);
 #ifdef CONFIG_MIGRATION
 extern int buffer_migrate_page(struct address_space *,
diff --git a/include/linux/gpio.h b/include/linux/gpio.h
index 4987a84078ef..98be6c5762b9 100644
--- a/include/linux/gpio.h
+++ b/include/linux/gpio.h
@@ -8,6 +8,9 @@
 #else
+#include <linux/types.h>
+#include <linux/errno.h>
 /*
 * Some platforms don't support the GPIO programming interface.
 *
diff --git a/include/linux/ide.h b/include/linux/ide.h
index f8f195c20da2..9918772bf274 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -153,7 +153,7 @@ enum {		ide_unknown,	ide_generic,	ide_pci,
                ide_qd65xx,     ide_umc8672,    ide_ht6560b,
                ide_rz1000,     ide_trm290,
                ide_cmd646,     ide_cy82c693,   ide_4drives,
-                ide_pmac,       ide_etrax100,   ide_acorn,
+                ide_pmac,       ide_acorn,
                ide_au1xxx,     ide_palm3710
 };
diff --git a/include/linux/in_route.h b/include/linux/in_route.h
index 61f25c30a2a0..b261b8c915f0 100644
--- a/include/linux/in_route.h
+++ b/include/linux/in_route.h
@@ -10,19 +10,19 @@
 #define RTCF_NOPMTUDISC RTM_F_NOPMTUDISC
 #define RTCF_NOTIFY     0x00010000
-#define RTCF_DIRECTDST  0x00020000
+#define RTCF_DIRECTDST  0x00020000 /* unused */
 #define RTCF_REDIRECTED 0x00040000
-#define RTCF_TPROXY     0x00080000
+#define RTCF_TPROXY     0x00080000 /* unused */
-#define RTCF_FAST       0x00200000
+#define RTCF_FAST       0x00200000 /* unused */
-#define RTCF_MASQ       0x00400000
+#define RTCF_MASQ       0x00400000 /* unused */
-#define RTCF_SNAT       0x00800000
+#define RTCF_SNAT       0x00800000 /* unused */
 #define RTCF_DOREDIRECT 0x01000000
 #define RTCF_DIRECTSRC  0x04000000
 #define RTCF_DNAT       0x08000000
 #define RTCF_BROADCAST  0x10000000
 #define RTCF_MULTICAST  0x20000000
-#define RTCF_REJECT     0x40000000
+#define RTCF_REJECT     0x40000000 /* unused */
 #define RTCF_LOCAL      0x80000000
 #define RTCF_NAT        (RTCF_DNAT|RTCF_SNAT)
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 7009b0cdd06f..c6f51ad52d5b 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -117,7 +117,6 @@ struct in_ifaddr
        __be32                  ifa_address;
        __be32                  ifa_mask;
        __be32                  ifa_broadcast;
-        __be32                  ifa_anycast;
        unsigned char           ifa_scope;
        unsigned char           ifa_flags;
        unsigned char           ifa_prefixlen;
diff --git a/include/linux/input.h b/include/linux/input.h
index 28a094fcfe20..e075c4b762fb 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -637,7 +637,9 @@ struct input_absinfo {
 #define SW_LID                  0x00  /* set = lid shut */
 #define SW_TABLET_MODE          0x01  /* set = tablet mode */
 #define SW_HEADPHONE_INSERT     0x02  /* set = inserted */
-#define SW_RADIO                0x03  /* set = radio enabled */
+#define SW_RFKILL_ALL           0x03  /* rfkill master switch, type "any"
+                                         set = radio enabled */
+#define SW_RADIO                SW_RFKILL_ALL   /* deprecated */
 #define SW_MAX                  0x0f
 #define SW_CNT                  (SW_MAX+1)
diff --git a/include/linux/ioport.h b/include/linux/ioport.h
index d5d40a9f7929..c6801bffe76d 100644
--- a/include/linux/ioport.h
+++ b/include/linux/ioport.h
@@ -53,14 +53,14 @@ struct resource_list {
 #define IORESOURCE_AUTO         0x40000000
 #define IORESOURCE_BUSY         0x80000000      /* Driver has marked this resource busy */
-/* ISA PnP IRQ specific bits (IORESOURCE_BITS) */
+/* PnP IRQ specific bits (IORESOURCE_BITS) */
 #define IORESOURCE_IRQ_HIGHEDGE         (1<<0)
 #define IORESOURCE_IRQ_LOWEDGE          (1<<1)
 #define IORESOURCE_IRQ_HIGHLEVEL        (1<<2)
 #define IORESOURCE_IRQ_LOWLEVEL         (1<<3)
 #define IORESOURCE_IRQ_SHAREABLE        (1<<4)
-/* ISA PnP DMA specific bits (IORESOURCE_BITS) */
+/* PnP DMA specific bits (IORESOURCE_BITS) */
 #define IORESOURCE_DMA_TYPE_MASK        (3<<0)
 #define IORESOURCE_DMA_8BIT             (0<<0)
 #define IORESOURCE_DMA_8AND16BIT        (1<<0)
@@ -76,7 +76,7 @@ struct resource_list {
 #define IORESOURCE_DMA_TYPEB            (2<<6)
 #define IORESOURCE_DMA_TYPEF            (3<<6)
-/* ISA PnP memory I/O specific bits (IORESOURCE_BITS) */
+/* PnP memory I/O specific bits (IORESOURCE_BITS) */
 #define IORESOURCE_MEM_WRITEABLE        (1<<0)  /* dup: IORESOURCE_READONLY */
 #define IORESOURCE_MEM_CACHEABLE        (1<<1)  /* dup: IORESOURCE_CACHEABLE */
 #define IORESOURCE_MEM_RANGELENGTH      (1<<2)  /* dup: IORESOURCE_RANGELENGTH */
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 10b666b61add..cde056e08181 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -396,8 +396,10 @@ static inline struct request_sock *inet6_reqsk_alloc(struct request_sock_ops *op
 {
        struct request_sock *req = reqsk_alloc(ops);
-        if (req != NULL)
+        if (req != NULL) {
                inet_rsk(req)->inet6_rsk_offset = inet6_rsk_offset(req);
+                inet6_rsk(req)->pktopts = NULL;
+        }
        return req;
 }
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index 05e2b307161a..d147f0f90360 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -919,6 +919,9 @@ struct journal_s
        struct proc_dir_entry   *j_proc_entry;
        struct transaction_stats_s j_stats;
+        /* Failed journal commit ID */
+        unsigned int            j_failed_commit;
        /*
         * An opaque pointer to fs-private information.  ext3 puts its
         * superblock pointer here
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 398978972b7a..092b1b25291d 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -297,7 +297,7 @@ static inline gpa_t gfn_to_gpa(gfn_t gfn)
        return (gpa_t)gfn << PAGE_SHIFT;
 }
-static inline void kvm_migrate_apic_timer(struct kvm_vcpu *vcpu)
+static inline void kvm_migrate_timers(struct kvm_vcpu *vcpu)
 {
        set_bit(KVM_REQ_MIGRATE_TIMER, &vcpu->requests);
 }
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 4a92fbafce9d..e57e5d08312d 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -111,13 +111,10 @@ enum {
        /* various global constants */
        LIBATA_MAX_PRD          = ATA_MAX_PRD / 2,
        LIBATA_DUMB_MAX_PRD     = ATA_MAX_PRD / 4,      /* Worst case */
-        ATA_MAX_PORTS           = 8,
        ATA_DEF_QUEUE           = 1,
        /* tag ATA_MAX_QUEUE - 1 is reserved for internal commands */
        ATA_MAX_QUEUE           = 32,
        ATA_TAG_INTERNAL        = ATA_MAX_QUEUE - 1,
-        ATA_MAX_BUS             = 2,
-        ATA_DEF_BUSY_WAIT       = 10000,
        ATA_SHORT_PAUSE         = (HZ >> 6) + 1,
        ATAPI_MAX_DRAIN         = 16 << 10,
@@ -1435,7 +1432,8 @@ extern void ata_sff_qc_prep(struct ata_queued_cmd *qc);
 extern void ata_sff_dumb_qc_prep(struct ata_queued_cmd *qc);
 extern void ata_sff_dev_select(struct ata_port *ap, unsigned int device);
 extern u8 ata_sff_check_status(struct ata_port *ap);
-extern u8 ata_sff_altstatus(struct ata_port *ap);
+extern void ata_sff_pause(struct ata_port *ap);
+extern void ata_sff_dma_pause(struct ata_port *ap);
 extern int ata_sff_busy_sleep(struct ata_port *ap,
                              unsigned long timeout_pat, unsigned long timeout);
 extern int ata_sff_wait_ready(struct ata_link *link, unsigned long deadline);
@@ -1496,19 +1494,6 @@ extern int ata_pci_sff_init_one(struct pci_dev *pdev,
 #endif /* CONFIG_PCI */
 /**
- *      ata_sff_pause - Flush writes and pause 400 nanoseconds.
- *      @ap: Port to wait for.
- *
- *      LOCKING:
- *      Inherited from caller.
- */
-static inline void ata_sff_pause(struct ata_port *ap)
-{
-        ata_sff_altstatus(ap);
-        ndelay(400);
-}
-/**
 *      ata_sff_busy_wait - Wait for a port status register
 *      @ap: Port to wait for.
 *      @bits: bits that must be clear
diff --git a/include/linux/math64.h b/include/linux/math64.h
index c1a5f81501ff..c87f1528703a 100644
--- a/include/linux/math64.h
+++ b/include/linux/math64.h
@@ -81,4 +81,25 @@ static inline s64 div_s64(s64 dividend, s32 divisor)
 }
 #endif
+u32 iter_div_u64_rem(u64 dividend, u32 divisor, u64 *remainder);
+static __always_inline u32
+__iter_div_u64_rem(u64 dividend, u32 divisor, u64 *remainder)
+{
+        u32 ret = 0;
+        while (dividend >= divisor) {
+                /* The following asm() prevents the compiler from
+                   optimising this loop into a modulo operation.  */
+                asm("" : "+rm"(dividend));
+                dividend -= divisor;
+                ret++;
+        }
+        *remainder = dividend;
+        return ret;
+}
 #endif /* _LINUX_MATH64_H */
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 73e358612eaf..ea9f5ad9ec8e 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -77,14 +77,6 @@ extern int __add_pages(struct zone *zone, unsigned long start_pfn,
 extern int __remove_pages(struct zone *zone, unsigned long start_pfn,
        unsigned long nr_pages);
-/*
- * Walk through all memory which is registered as resource.
- * arg is (start_pfn, nr_pages, private_arg_pointer)
- */
-extern int walk_memory_resource(unsigned long start_pfn,
-                        unsigned long nr_pages, void *arg,
-                        int (*func)(unsigned long, unsigned long, void *));
 #ifdef CONFIG_NUMA
 extern int memory_add_physaddr_to_nid(u64 start);
 #else
@@ -199,6 +191,14 @@ static inline void register_page_bootmem_info_node(struct pglist_data *pgdat)
 #endif /* ! CONFIG_MEMORY_HOTPLUG */
+/*
+ * Walk through all memory which is registered as resource.
+ * arg is (start_pfn, nr_pages, private_arg_pointer)
+ */
+extern int walk_memory_resource(unsigned long start_pfn,
+                        unsigned long nr_pages, void *arg,
+                        int (*func)(unsigned long, unsigned long, void *));
 extern int add_memory(int nid, u64 start, u64 size);
 extern int arch_add_memory(int nid, u64 start, u64 size);
 extern int remove_memory(u64 start, u64 size);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index c31a9cd2a30e..586a943cab01 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -760,16 +760,17 @@ unsigned long unmap_vmas(struct mmu_gather **tlb,
 * (see walk_page_range for more details)
 */
 struct mm_walk {
-        int (*pgd_entry)(pgd_t *, unsigned long, unsigned long, void *);
+        int (*pgd_entry)(pgd_t *, unsigned long, unsigned long, struct mm_walk *);
-        int (*pud_entry)(pud_t *, unsigned long, unsigned long, void *);
+        int (*pud_entry)(pud_t *, unsigned long, unsigned long, struct mm_walk *);
-        int (*pmd_entry)(pmd_t *, unsigned long, unsigned long, void *);
+        int (*pmd_entry)(pmd_t *, unsigned long, unsigned long, struct mm_walk *);
-        int (*pte_entry)(pte_t *, unsigned long, unsigned long, void *);
+        int (*pte_entry)(pte_t *, unsigned long, unsigned long, struct mm_walk *);
-        int (*pte_hole)(unsigned long, unsigned long, void *);
+        int (*pte_hole)(unsigned long, unsigned long, struct mm_walk *);
+        struct mm_struct *mm;
+        void *private;
 };
-int walk_page_range(const struct mm_struct *, unsigned long addr,
+int walk_page_range(unsigned long addr, unsigned long end,
-                    unsigned long end, const struct mm_walk *walk,
+                struct mm_walk *walk);
-                    void *private);
 void free_pgd_range(struct mmu_gather **tlb, unsigned long addr,
                unsigned long end, unsigned long floor, unsigned long ceiling);
 void free_pgtables(struct mmu_gather **tlb, struct vm_area_struct *start_vma,
diff --git a/include/linux/mman.h b/include/linux/mman.h
index 87920a0852a3..dab8892e6ff1 100644
--- a/include/linux/mman.h
+++ b/include/linux/mman.h
@@ -17,14 +17,14 @@
 extern int sysctl_overcommit_memory;
 extern int sysctl_overcommit_ratio;
-extern atomic_t vm_committed_space;
+extern atomic_long_t vm_committed_space;
 #ifdef CONFIG_SMP
 extern void vm_acct_memory(long pages);
 #else
 static inline void vm_acct_memory(long pages)
 {
-        atomic_add(pages, &vm_committed_space);
+        atomic_long_add(pages, &vm_committed_space);
 }
 #endif
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index c463cd8a15a4..443bc7cd8c62 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -703,7 +703,7 @@ extern struct pglist_data *next_online_pgdat(struct pglist_data *pgdat);
 extern struct zone *next_zone(struct zone *zone);
 /**
- * for_each_pgdat - helper macro to iterate over all nodes
+ * for_each_online_pgdat - helper macro to iterate over all online nodes
 * @pgdat - pointer to a pg_data_t variable
 */
 #define for_each_online_pgdat(pgdat)                    \
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index d73eceaa7afb..69b2342d5ebb 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -375,7 +375,8 @@ struct virtio_device_id {
 struct i2c_device_id {
        char name[I2C_NAME_SIZE];
-        kernel_ulong_t driver_data;     /* Data private to the driver */
+        kernel_ulong_t driver_data      /* Data private to the driver */
+                        __attribute__((aligned(sizeof(kernel_ulong_t))));
 };
diff --git a/include/linux/msdos_fs.h b/include/linux/msdos_fs.h
index b03b27457413..81cd36b735b0 100644
--- a/include/linux/msdos_fs.h
+++ b/include/linux/msdos_fs.h
@@ -57,12 +57,6 @@
 #define MSDOS_DOT       ".          "   /* ".", padded to MSDOS_NAME chars */
 #define MSDOS_DOTDOT    "..         "   /* "..", padded to MSDOS_NAME chars */
-/* media of boot sector */
-static inline int fat_valid_media(u8 media)
-{
-        return 0xf8 <= media || media == 0xf0;
-}
 #define FAT_FIRST_ENT(s, x)     ((MSDOS_SB(s)->fat_bits == 32 ? 0x0FFFFF00 : \
        MSDOS_SB(s)->fat_bits == 16 ? 0xFF00 : 0xF00) | (x))
@@ -334,6 +328,12 @@ static inline void fatwchar_to16(__u8 *dst, const wchar_t *src, size_t len)
 #endif
 }
+/* media of boot sector */
+static inline int fat_valid_media(u8 media)
+{
+        return 0xf8 <= media || media == 0xf0;
+}
 /* fat/cache.c */
 extern void fat_cache_inval_inode(struct inode *inode);
 extern int fat_get_cluster(struct inode *inode, int cluster,
diff --git a/include/linux/msg.h b/include/linux/msg.h
index 6f3b8e79a991..56abf1558fdd 100644
--- a/include/linux/msg.h
+++ b/include/linux/msg.h
@@ -64,11 +64,11 @@ struct msginfo {
 #define MSGMNB 16384   /* <= INT_MAX */   /* default max size of a message queue */
 /* unused */
-#define MSGPOOL (MSGMNI * MSGMNB) /* size in bytes of message pool */
+#define MSGPOOL (MSGMNI * MSGMNB / 1024) /* size in kbytes of message pool */
 #define MSGTQL  MSGMNB            /* number of system message headers */
 #define MSGMAP  MSGMNB            /* number of entries in message map */
 #define MSGSSZ  16                /* message segment size */
-#define __MSGSEG (MSGPOOL / MSGSSZ) /* max no. of segments */
+#define __MSGSEG ((MSGPOOL * 1024) / MSGSSZ) /* max no. of segments */
 #define MSGSEG (__MSGSEG <= 0xffff ? __MSGSEG : 0xffff)
 #ifdef __KERNEL__
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index c42bc7f533a5..53ea3dc8b0e8 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -1,7 +1,7 @@
 /*
 *  linux/include/linux/mtd/nand.h
 *
- *  Copyright (c) 2000 David Woodhouse <dwmw2@mvhi.com>
+ *  Copyright (c) 2000 David Woodhouse <dwmw2@infradead.org>
 *                     Steven J. Hill <sjhill@realitydiluted.com>
 *                     Thomas Gleixner <tglx@linutronix.de>
 *
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 2b0266484c84..f27fd2009334 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -514,12 +514,10 @@ struct net_device
 #define NETIF_F_NETNS_LOCAL     8192    /* Does not change network namespaces */
 #define NETIF_F_MULTI_QUEUE     16384   /* Has multiple TX/RX queues */
 #define NETIF_F_LRO             32768   /* large receive offload */
-#define NETIF_F_VLAN_TSO        65536   /* Supports TSO for VLANs */
-#define NETIF_F_VLAN_CSUM       131072  /* Supports TX checksumming for VLANs */
        /* Segmentation offload features */
-#define NETIF_F_GSO_SHIFT       20
+#define NETIF_F_GSO_SHIFT       16
-#define NETIF_F_GSO_MASK        0xfff00000
+#define NETIF_F_GSO_MASK        0xffff0000
 #define NETIF_F_TSO             (SKB_GSO_TCPV4 << NETIF_F_GSO_SHIFT)
 #define NETIF_F_UFO             (SKB_GSO_UDP << NETIF_F_GSO_SHIFT)
 #define NETIF_F_GSO_ROBUST      (SKB_GSO_DODGY << NETIF_F_GSO_SHIFT)
@@ -747,6 +745,9 @@ struct net_device
        /* rtnetlink link ops */
        const struct rtnl_link_ops *rtnl_link_ops;
+        /* VLAN feature mask */
+        unsigned long vlan_features;
        /* for setting kernel sock attribute on TCP connection setup */
 #define GSO_MAX_SIZE            65536
        unsigned int            gso_max_size;
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 590cff32415d..f31debfac926 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -306,5 +306,29 @@ static inline void __ClearPageTail(struct page *page)
 }
 #endif /* !PAGEFLAGS_EXTENDED */
+#define PAGE_FLAGS      (1 << PG_lru   | 1 << PG_private   | 1 << PG_locked | \
+                         1 << PG_buddy | 1 << PG_writeback | \
+                         1 << PG_slab  | 1 << PG_swapcache | 1 << PG_active)
+/*
+ * Flags checked in bad_page().  Pages on the free list should not have
+ * these flags set.  It they are, there is a problem.
+ */
+#define PAGE_FLAGS_CLEAR_WHEN_BAD (PAGE_FLAGS | 1 << PG_reclaim | 1 << PG_dirty)
+/*
+ * Flags checked when a page is freed.  Pages being freed should not have
+ * these flags set.  It they are, there is a problem.
+ */
+#define PAGE_FLAGS_CHECK_AT_FREE (PAGE_FLAGS | 1 << PG_reserved)
+/*
+ * Flags checked when a page is prepped for return by the page allocator.
+ * Pages being prepped should not have these flags set.  It they are, there
+ * is a problem.
+ */
+#define PAGE_FLAGS_CHECK_AT_PREP (PAGE_FLAGS | 1 << PG_reserved | 1 << PG_dirty)
 #endif /* !__GENERATING_BOUNDS_H */
 #endif  /* PAGE_FLAGS_H */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 509159bcd4e7..d18b1dd49fab 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -206,6 +206,7 @@ struct pci_dev {
        struct bin_attribute *rom_attr; /* attribute descriptor for sysfs ROM entry */
        int rom_attr_enabled;           /* has display of the rom attribute been enabled? */
        struct bin_attribute *res_attr[DEVICE_COUNT_RESOURCE]; /* sysfs file for resources */
+        struct bin_attribute *res_attr_wc[DEVICE_COUNT_RESOURCE]; /* sysfs file for WC mapping of resources */
 #ifdef CONFIG_PCI_MSI
        struct list_head msi_list;
 #endif
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index cf6dbd759395..eafc9d6d2b35 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -716,6 +716,7 @@
 #define PCI_DEVICE_ID_HP_CISSA          0x3220
 #define PCI_DEVICE_ID_HP_CISSC          0x3230
 #define PCI_DEVICE_ID_HP_CISSD          0x3238
+#define PCI_DEVICE_ID_HP_CISSE          0x323a
 #define PCI_DEVICE_ID_HP_ZX2_IOC        0x4031
 #define PCI_VENDOR_ID_PCTECH            0x1042
@@ -1761,6 +1762,7 @@
 #define PCI_VENDOR_ID_INTASHIELD        0x135a
 #define PCI_DEVICE_ID_INTASHIELD_IS200  0x0d80
+#define PCI_DEVICE_ID_INTASHIELD_IS400  0x0dc0
 #define PCI_VENDOR_ID_QUATECH           0x135C
 #define PCI_DEVICE_ID_QUATECH_QSC100    0x0010
@@ -2383,6 +2385,9 @@
 #define PCI_DEVICE_ID_INTEL_ICH10_4     0x3a30
 #define PCI_DEVICE_ID_INTEL_ICH10_5     0x3a60
 #define PCI_DEVICE_ID_INTEL_IOAT_SNB    0x402f
+#define PCI_DEVICE_ID_INTEL_5400_ERR    0x4030
+#define PCI_DEVICE_ID_INTEL_5400_FBD0   0x4035
+#define PCI_DEVICE_ID_INTEL_5400_FBD1   0x4036
 #define PCI_DEVICE_ID_INTEL_IOAT_SCNB   0x65ff
 #define PCI_DEVICE_ID_INTEL_TOLAPAI_0   0x5031
 #define PCI_DEVICE_ID_INTEL_TOLAPAI_1   0x5032
diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
index 9883bc942262..fff1d27ddb4c 100644
--- a/include/linux/proc_fs.h
+++ b/include/linux/proc_fs.h
@@ -9,6 +9,8 @@
 struct net;
 struct completion;
+struct mm_struct;
 /*
 * The proc filesystem constants/structures
 */
@@ -101,8 +103,6 @@ extern spinlock_t proc_subdir_lock;
 extern void proc_root_init(void);
 extern void proc_misc_init(void);
-struct mm_struct;
 void proc_flush_task(struct task_struct *task);
 struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct nameidata *);
 int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir);
diff --git a/include/linux/raid/bitmap.h b/include/linux/raid/bitmap.h
index 47fbcba11850..78bfdea24a8e 100644
--- a/include/linux/raid/bitmap.h
+++ b/include/linux/raid/bitmap.h
@@ -262,7 +262,6 @@ int  bitmap_create(mddev_t *mddev);
 void bitmap_flush(mddev_t *mddev);
 void bitmap_destroy(mddev_t *mddev);
-char *file_path(struct file *file, char *buf, int count);
 void bitmap_print_sb(struct bitmap *bitmap);
 void bitmap_update_sb(struct bitmap *bitmap);
diff --git a/include/linux/raid/md.h b/include/linux/raid/md.h
index 81a1a02d4566..b7386ae9d288 100644
--- a/include/linux/raid/md.h
+++ b/include/linux/raid/md.h
@@ -72,6 +72,8 @@
 */
 #define MD_PATCHLEVEL_VERSION           3
+extern int mdp_major;
 extern int register_md_personality (struct mdk_personality *p);
 extern int unregister_md_personality (struct mdk_personality *p);
 extern mdk_thread_t * md_register_thread (void (*run) (mddev_t *mddev),
diff --git a/include/linux/raid/md_k.h b/include/linux/raid/md_k.h
index 812ffa590cff..3dea9f545c8f 100644
--- a/include/linux/raid/md_k.h
+++ b/include/linux/raid/md_k.h
@@ -180,13 +180,15 @@ struct mddev_s
        int                             sync_speed_min;
        int                             sync_speed_max;
+        /* resync even though the same disks are shared among md-devices */
+        int                             parallel_resync;
        int                             ok_start_degraded;
        /* recovery/resync flags 
         * NEEDED:   we might need to start a resync/recover
         * RUNNING:  a thread is running, or about to be started
         * SYNC:     actually doing a resync, not a recovery
-         * ERR:      and IO error was detected - abort the resync/recovery
+         * INTR:     resync needs to be aborted for some reason
-         * INTR:     someone requested a (clean) early abort.
         * DONE:     thread is done and is waiting to be reaped
         * REQUEST:  user-space has requested a sync (used with SYNC)
         * CHECK:    user-space request for for check-only, no repair
@@ -196,7 +198,6 @@ struct mddev_s
         */
 #define MD_RECOVERY_RUNNING     0
 #define MD_RECOVERY_SYNC        1
-#define MD_RECOVERY_ERR         2
 #define MD_RECOVERY_INTR        3
 #define MD_RECOVERY_DONE        4
 #define MD_RECOVERY_NEEDED      5
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 44c81c744538..b358c704d102 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -246,6 +246,7 @@ enum rt_class_t
 {
        RT_TABLE_UNSPEC=0,
 /* User defined values */
+        RT_TABLE_COMPAT=252,
        RT_TABLE_DEFAULT=253,
        RT_TABLE_MAIN=254,
        RT_TABLE_LOCAL=255,
@@ -267,10 +268,10 @@ enum rtattr_type_t
        RTA_PREFSRC,
        RTA_METRICS,
        RTA_MULTIPATH,
-        RTA_PROTOINFO,
+        RTA_PROTOINFO, /* no longer used */
        RTA_FLOW,
        RTA_CACHEINFO,
-        RTA_SESSION,
+        RTA_SESSION, /* no longer used */
        RTA_MP_ALGO, /* no longer used */
        RTA_TABLE,
        __RTA_MAX
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 5395a6176f4b..c5d3f847ca8d 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -766,7 +766,6 @@ struct sched_domain {
        struct sched_domain *child;     /* bottom domain must be null terminated */
        struct sched_group *groups;     /* the balancing groups of the domain */
        cpumask_t span;                 /* span of all CPUs in this domain */
-        int first_cpu;                  /* cache of the first cpu in this domain */
        unsigned long min_interval;     /* Minimum balance interval ms */
        unsigned long max_interval;     /* Maximum balance interval ms */
        unsigned int busy_factor;       /* less balancing by factor if busy */
@@ -1848,7 +1847,9 @@ extern void exit_thread(void);
 extern void exit_files(struct task_struct *);
 extern void __cleanup_signal(struct signal_struct *);
 extern void __cleanup_sighand(struct sighand_struct *);
 extern void exit_itimers(struct signal_struct *);
+extern void flush_itimer_signals(void);
 extern NORET_TYPE void do_group_exit(int);
@@ -2025,6 +2026,19 @@ static inline int fatal_signal_pending(struct task_struct *p)
        return signal_pending(p) && __fatal_signal_pending(p);
 }
+static inline int signal_pending_state(long state, struct task_struct *p)
+{
+        if (!(state & (TASK_INTERRUPTIBLE | TASK_WAKEKILL)))
+                return 0;
+        if (!signal_pending(p))
+                return 0;
+        if (state & (__TASK_STOPPED | __TASK_TRACED))
+                return 0;
+        return (state & TASK_INTERRUPTIBLE) || __fatal_signal_pending(p);
+}
 static inline int need_resched(void)
 {
        return unlikely(test_thread_flag(TIF_NEED_RESCHED));
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index d32123ae08ad..d8f31de632c5 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -192,6 +192,7 @@ struct uart_ops {
        void            (*shutdown)(struct uart_port *);
        void            (*set_termios)(struct uart_port *, struct ktermios *new,
                                       struct ktermios *old);
+        void            (*set_ldisc)(struct uart_port *);
        void            (*pm)(struct uart_port *, unsigned int state,
                              unsigned int oldstate);
        int             (*set_wake)(struct uart_port *, unsigned int state);
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 805ed4b92f9a..c2ad35016599 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -276,6 +276,17 @@ static inline void *kzalloc(size_t size, gfp_t flags)
        return kmalloc(size, flags | __GFP_ZERO);
 }
+/**
+ * kzalloc_node - allocate zeroed memory from a particular memory node.
+ * @size: how many bytes of memory are required.
+ * @flags: the type of memory to allocate (see kmalloc).
+ * @node: memory node from which to allocate
+ */
+static inline void *kzalloc_node(size_t size, gfp_t flags, int node)
+{
+        return kmalloc_node(size, flags | __GFP_ZERO, node);
+}
 #ifdef CONFIG_SLABINFO
 extern const struct seq_operations slabinfo_op;
 ssize_t slabinfo_write(struct file *, const char __user *, size_t, loff_t *);
diff --git a/include/linux/sm501.h b/include/linux/sm501.h
index bca134544700..95c1c39ba445 100644
--- a/include/linux/sm501.h
+++ b/include/linux/sm501.h
@@ -71,8 +71,8 @@ extern unsigned long sm501_gpio_get(struct device *dev,
 #define SM501FB_FLAG_DISABLE_AT_EXIT    (1<<1)
 #define SM501FB_FLAG_USE_HWCURSOR       (1<<2)
 #define SM501FB_FLAG_USE_HWACCEL        (1<<3)
-#define SM501FB_FLAG_PANEL_USE_FPEN     (1<<4)
+#define SM501FB_FLAG_PANEL_NO_FPEN      (1<<4)
-#define SM501FB_FLAG_PANEL_USE_VBIASEN  (1<<5)
+#define SM501FB_FLAG_PANEL_NO_VBIASEN   (1<<5)
 struct sm501_platdata_fbsub {
        struct fb_videomode     *def_mode;
diff --git a/include/linux/spi/mmc_spi.h b/include/linux/spi/mmc_spi.h
index e9bbe3ebd721..d5ca78b93a3b 100644
--- a/include/linux/spi/mmc_spi.h
+++ b/include/linux/spi/mmc_spi.h
@@ -1,6 +1,8 @@
 #ifndef __LINUX_SPI_MMC_SPI_H
 #define __LINUX_SPI_MMC_SPI_H
+#include <linux/interrupt.h>
 struct device;
 struct mmc_host;
diff --git a/include/linux/ssb/ssb_driver_gige.h b/include/linux/ssb/ssb_driver_gige.h
index 01fbdf5fef22..942e38736901 100644
--- a/include/linux/ssb/ssb_driver_gige.h
+++ b/include/linux/ssb/ssb_driver_gige.h
@@ -100,7 +100,7 @@ extern char * nvram_get(const char *name);
 /* Get the device MAC address */
 static inline void ssb_gige_get_macaddr(struct pci_dev *pdev, u8 *macaddr)
 {
-#ifdef CONFIG_BCM947XX
+#ifdef CONFIG_BCM47XX
        char *res = nvram_get("et0macaddr");
        if (res)
                memcpy(macaddr, res, 6);
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 18e62e3d406f..b31b6b74aa28 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -239,11 +239,6 @@ static inline struct tcp_request_sock *tcp_rsk(const struct request_sock *req)
        return (struct tcp_request_sock *)req;
 }
-struct tcp_deferred_accept_info {
-        struct sock *listen_sk;
-        struct request_sock *request;
-};
 struct tcp_sock {
        /* inet_connection_sock has to be the first member of tcp_sock */
        struct inet_connection_sock     inet_conn;
@@ -379,8 +374,6 @@ struct tcp_sock {
        unsigned int            keepalive_intvl;  /* time interval between keep alive probes */
        int                     linger2;
-        struct tcp_deferred_accept_info defer_tcp_accept;
        unsigned long last_synq_overflow; 
        u32     tso_deferred;
diff --git a/include/linux/time.h b/include/linux/time.h
index d32ef0ad4c0a..e15206a7e82e 100644
--- a/include/linux/time.h
+++ b/include/linux/time.h
@@ -6,6 +6,7 @@
 #ifdef __KERNEL__
 # include <linux/cache.h>
 # include <linux/seqlock.h>
+# include <linux/math64.h>
 #endif
 #ifndef _STRUCT_TIMESPEC
@@ -169,18 +170,13 @@ extern struct timeval ns_to_timeval(const s64 nsec);
 * timespec_add_ns - Adds nanoseconds to a timespec
 * @a:          pointer to timespec to be incremented
 * @ns:         unsigned nanoseconds value to be added
+ *
+ * This must always be inlined because its used from the x86-64 vdso,
+ * which cannot call other kernel functions.
 */
-static inline void timespec_add_ns(struct timespec *a, u64 ns)
+static __always_inline void timespec_add_ns(struct timespec *a, u64 ns)
 {
-        ns += a->tv_nsec;
+        a->tv_sec += __iter_div_u64_rem(a->tv_nsec + ns, NSEC_PER_SEC, &ns);
-        while(unlikely(ns >= NSEC_PER_SEC)) {
-                /* The following asm() prevents the compiler from
-                 * optimising this loop into a modulo operation.  */
-                asm("" : "+r"(ns));
-                ns -= NSEC_PER_SEC;
-                a->tv_sec++;
-        }
        a->tv_nsec = ns;
 }
 #endif /* __KERNEL__ */
diff --git a/include/linux/topology.h b/include/linux/topology.h
index 4bb7074a2c3a..24f3d2282e11 100644
--- a/include/linux/topology.h
+++ b/include/linux/topology.h
@@ -166,7 +166,9 @@ void arch_update_cpu_topology(void);
        .busy_idx               = 3,                    \
        .idle_idx               = 3,                    \
        .flags                  = SD_LOAD_BALANCE       \
-                                | SD_SERIALIZE, \
+                                | SD_BALANCE_NEWIDLE    \
+                                | SD_WAKE_AFFINE        \
+                                | SD_SERIALIZE,         \
        .last_balance           = jiffies,              \
        .balance_interval       = 64,                   \
 }
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 7f7121f9c968..324a3b231d40 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -36,7 +36,7 @@
 #define N_6PACK         7
 #define N_MASC          8       /* Reserved for Mobitex module <kaz@cafe.net> */
 #define N_R3964         9       /* Reserved for Simatic R3964 module */
-#define N_PROFIBUS_FDL  10      /* Reserved for Profibus <Dave@mvhi.com> */
+#define N_PROFIBUS_FDL  10      /* Reserved for Profibus */
 #define N_IRDA          11      /* Linux IrDa - http://irda.sourceforge.net/ */
 #define N_SMSBLOCK      12      /* SMS block mode - for talking to GSM data */
                                /* cards about SMS messages */
diff --git a/include/linux/types.h b/include/linux/types.h
index 9dc2346627b4..d4a9ce6e2760 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -197,8 +197,6 @@ typedef u64 resource_size_t;
 typedef u32 resource_size_t;
 #endif
-#endif  /* __KERNEL__ */
 struct ustat {
        __kernel_daddr_t        f_tfree;
        __kernel_ino_t          f_tinode;
@@ -206,4 +204,6 @@ struct ustat {
        char                    f_fpack[6];
 };
+#endif  /* __KERNEL__ */
 #endif /* _LINUX_TYPES_H */
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index c1411189ba6c..4a535ea1e123 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -865,9 +865,9 @@ struct v4l2_querymenu
 #define V4L2_CID_HFLIP                  (V4L2_CID_BASE+20)
 #define V4L2_CID_VFLIP                  (V4L2_CID_BASE+21)
-/* Deprecated, use V4L2_CID_PAN_RESET and V4L2_CID_TILT_RESET */
+/* Deprecated; use V4L2_CID_PAN_RESET and V4L2_CID_TILT_RESET */
-#define V4L2_CID_HCENTER_DEPRECATED     (V4L2_CID_BASE+22)
+#define V4L2_CID_HCENTER                (V4L2_CID_BASE+22)
-#define V4L2_CID_VCENTER_DEPRECATED     (V4L2_CID_BASE+23)
+#define V4L2_CID_VCENTER                (V4L2_CID_BASE+23)
 #define V4L2_CID_POWER_LINE_FREQUENCY   (V4L2_CID_BASE+24)
 enum v4l2_power_line_frequency {
diff --git a/include/linux/virtio_blk.h b/include/linux/virtio_blk.h
index d4695a3356d0..5f79a5f9de79 100644
--- a/include/linux/virtio_blk.h
+++ b/include/linux/virtio_blk.h
@@ -10,18 +10,19 @@
 #define VIRTIO_BLK_F_SIZE_MAX   1       /* Indicates maximum segment size */
 #define VIRTIO_BLK_F_SEG_MAX    2       /* Indicates maximum # of segments */
 #define VIRTIO_BLK_F_GEOMETRY   4       /* Legacy geometry available  */
+#define VIRTIO_BLK_F_RO         5       /* Disk is read-only */
 struct virtio_blk_config
 {
        /* The capacity (in 512-byte sectors). */
-        __le64 capacity;
+        __u64 capacity;
        /* The maximum segment size (if VIRTIO_BLK_F_SIZE_MAX) */
-        __le32 size_max;
+        __u32 size_max;
        /* The maximum number of segments (if VIRTIO_BLK_F_SEG_MAX) */
-        __le32 seg_max;
+        __u32 seg_max;
        /* geometry the device (if VIRTIO_BLK_F_GEOMETRY) */
        struct virtio_blk_geometry {
-                __le16 cylinders;
+                __u16 cylinders;
                __u8 heads;
                __u8 sectors;
        } geometry;
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 50db245c81ad..f364bbf63c34 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -15,6 +15,10 @@
 /* We've given up on this device. */
 #define VIRTIO_CONFIG_S_FAILED          0x80
+/* Do we get callbacks when the ring is completely used, even if we've
+ * suppressed them? */
+#define VIRTIO_F_NOTIFY_ON_EMPTY        24
 #ifdef __KERNEL__
 #include <linux/virtio.h>
@@ -99,7 +103,7 @@ static inline bool virtio_has_feature(const struct virtio_device *vdev,
 * The return value is -ENOENT if the feature doesn't exist.  Otherwise
 * the config value is copied into whatever is pointed to by v. */
 #define virtio_config_val(vdev, fbit, offset, v) \
-        virtio_config_buf((vdev), (fbit), (offset), (v), sizeof(v))
+        virtio_config_buf((vdev), (fbit), (offset), (v), sizeof(*v))
 static inline int virtio_config_buf(struct virtio_device *vdev,
                                    unsigned int fbit,
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index 9405aa6cdf26..38c0571820fb 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -38,7 +38,7 @@ struct virtio_net_hdr
 #define VIRTIO_NET_HDR_GSO_ECN          0x80    // TCP has ECN set
        __u8 gso_type;
        __u16 hdr_len;          /* Ethernet + IP + tcp/udp hdrs */
-        __u16 gso_size;         /* Bytes to append to gso_hdr_len per frame */
+        __u16 gso_size;         /* Bytes to append to hdr_len per frame */
        __u16 csum_start;       /* Position to start checksumming from */
        __u16 csum_offset;      /* Offset after that to place checksum */
 };
diff --git a/include/linux/virtio_rng.h b/include/linux/virtio_rng.h
new file mode 100644
index 000000000000..331afb6c9f62
--- /dev/null
+++ b/include/linux/virtio_rng.h
@@ -0,0 +1,8 @@
+#ifndef _LINUX_VIRTIO_RNG_H
+#define _LINUX_VIRTIO_RNG_H
+#include <linux/virtio_config.h>
+/* The ID for virtio_rng */
+#define VIRTIO_ID_RNG   4
+#endif /* _LINUX_VIRTIO_RNG_H */
diff --git a/include/linux/wm97xx.h b/include/linux/wm97xx.h
index 4d13732e9cf0..6f69968eab24 100644
--- a/include/linux/wm97xx.h
+++ b/include/linux/wm97xx.h
@@ -100,6 +100,7 @@
 #define WM9713_ADCSEL_Y         0x0004  /* Y measurement */
 #define WM9713_ADCSEL_PRES      0x0008  /* Pressure measurement */
 #define WM9713_COO              0x0001  /* enable coordinate mode */
+#define WM9713_45W              0x1000  /* set for 5 wire panel */
 #define WM9713_PDEN             0x0800  /* measure only when pen down */
 #define WM9713_ADCSEL_MASK      0x00fe  /* ADC selection mask */
 #define WM9713_WAIT             0x0200  /* coordinate wait */
diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
index a807d2f86ee8..33f01ae08f76 100644
--- a/include/media/v4l2-dev.h
+++ b/include/media/v4l2-dev.h
@@ -40,7 +40,6 @@
 #define VFL_TYPE_VTX            3
 /*  Video standard functions  */
-extern unsigned int v4l2_video_std_fps(struct v4l2_standard *vs);
 extern char *v4l2_norm_to_name(v4l2_std_id id);
 extern int v4l2_video_std_construct(struct v4l2_standard *vs,
                                    int id, char *name);
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 0a2f0372df31..bbd3d583c6e6 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -94,6 +94,28 @@ extern void			addrconf_join_solict(struct net_device *dev,
 extern void                     addrconf_leave_solict(struct inet6_dev *idev,
                                        struct in6_addr *addr);
+static inline unsigned long addrconf_timeout_fixup(u32 timeout,
+                                                    unsigned unit)
+{
+        if (timeout == 0xffffffff)
+                return ~0UL;
+        /*
+         * Avoid arithmetic overflow.
+         * Assuming unit is constant and non-zero, this "if" statement
+         * will go away on 64bit archs.
+         */
+        if (0xfffffffe > LONG_MAX / unit && timeout > LONG_MAX / unit)
+                return LONG_MAX / unit;
+        return timeout;
+}
+static inline int addrconf_finite_timeout(unsigned long timeout)
+{
+        return ~timeout;
+}
 /*
 *      IPv6 Address Label subsystem (addrlabel.c)
 */
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index decdda546829..747c255d1df0 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -162,9 +162,9 @@ static inline int genlmsg_end(struct sk_buff *skb, void *hdr)
 * @skb: socket buffer the message is stored in
 * @hdr: generic netlink message header
 */
-static inline int genlmsg_cancel(struct sk_buff *skb, void *hdr)
+static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
 {
-        return nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
+        nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
 }
 /**
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index a42cd63d241a..9fabe5b38912 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -197,4 +197,14 @@ static inline int inet_iif(const struct sk_buff *skb)
        return skb->rtable->rt_iif;
 }
+static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops)
+{
+        struct request_sock *req = reqsk_alloc(ops);
+        if (req != NULL)
+                inet_rsk(req)->opt = NULL;
+        return req;
+}
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/netlink.h b/include/net/netlink.h
index a5506c42f03c..dfc3701dfcc3 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -556,14 +556,12 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
 * @skb: socket buffer the message is stored in
 * @mark: mark to trim to
 *
- * Trims the message to the provided mark. Returns -1.
+ * Trims the message to the provided mark.
 */
-static inline int nlmsg_trim(struct sk_buff *skb, const void *mark)
+static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
 {
        if (mark)
                skb_trim(skb, (unsigned char *) mark - skb->data);
-        return -1;
 }
 /**
@@ -572,11 +570,11 @@ static inline int nlmsg_trim(struct sk_buff *skb, const void *mark)
 * @nlh: netlink message header
 *
 * Removes the complete netlink message including all
- * attributes from the socket buffer again. Returns -1.
+ * attributes from the socket buffer again.
 */
-static inline int nlmsg_cancel(struct sk_buff *skb, struct nlmsghdr *nlh)
+static inline void nlmsg_cancel(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
-        return nlmsg_trim(skb, nlh);
+        nlmsg_trim(skb, nlh);
 }
 /**
@@ -772,12 +770,13 @@ static inline int __nla_parse_nested_compat(struct nlattr *tb[], int maxtype,
                                            const struct nla_policy *policy,
                                            int len)
 {
-        if (nla_len(nla) < len)
+        int nested_len = nla_len(nla) - NLA_ALIGN(len);
-                return -1;
-        if (nla_len(nla) >= NLA_ALIGN(len) + sizeof(struct nlattr))
+        if (nested_len < 0)
-                return nla_parse_nested(tb, maxtype,
+                return -EINVAL;
-                                        nla_data(nla) + NLA_ALIGN(len),
+        if (nested_len >= nla_attr_size(0))
-                                        policy);
+                return nla_parse(tb, maxtype, nla_data(nla) + NLA_ALIGN(len),
+                                 nested_len, policy);
        memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
        return 0;
 }
@@ -1079,11 +1078,11 @@ static inline int nla_nest_compat_end(struct sk_buff *skb, struct nlattr *start)
 * @start: container attribute
 *
 * Removes the container attribute and including all nested
- * attributes. Returns -1.
+ * attributes. Returns -EMSGSIZE
 */
-static inline int nla_nest_cancel(struct sk_buff *skb, struct nlattr *start)
+static inline void nla_nest_cancel(struct sk_buff *skb, struct nlattr *start)
 {
-        return nlmsg_trim(skb, start);
+        nlmsg_trim(skb, start);
 }
 /**
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index b220b5f624de..0c96e7bed5db 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -115,8 +115,8 @@ struct request_sock_queue {
        struct request_sock     *rskq_accept_head;
        struct request_sock     *rskq_accept_tail;
        rwlock_t                syn_wait_lock;
-        u16                     rskq_defer_accept;
+        u8                      rskq_defer_accept;
-        /* 2 bytes hole, try to pack */
+        /* 3 bytes hole, try to pack */
        struct listen_sock      *listen_opt;
 };
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 0ce0443c5b79..7f25195f9855 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -548,7 +548,8 @@ struct sctp_af {
        struct dst_entry *(*get_dst)    (struct sctp_association *asoc,
                                         union sctp_addr *daddr,
                                         union sctp_addr *saddr);
-        void            (*get_saddr)    (struct sctp_association *asoc,
+        void            (*get_saddr)    (struct sctp_sock *sk,
+                                         struct sctp_association *asoc,
                                         struct dst_entry *dst,
                                         union sctp_addr *daddr,
                                         union sctp_addr *saddr);
@@ -587,6 +588,7 @@ struct sctp_af {
        int             (*is_ce)        (const struct sk_buff *sk);
        void            (*seq_dump_addr)(struct seq_file *seq,
                                         union sctp_addr *addr);
+        void            (*ecn_capable)(struct sock *sk);
        __u16           net_header_len;
        int             sockaddr_len;
        sa_family_t     sa_family;
@@ -901,7 +903,10 @@ struct sctp_transport {
         *              calculation completes (i.e. the DATA chunk
         *              is SACK'd) clear this flag.
         */
-        int rto_pending;
+        __u8 rto_pending;
+        /* Flag to track the current fast recovery state */
+        __u8 fast_recovery;
        /*
         * These are the congestion stats.
@@ -920,6 +925,9 @@ struct sctp_transport {
        /* Data that has been sent, but not acknowledged. */
        __u32 flight_size;
+        /* TSN marking the fast recovery exit point */
+        __u32 fast_recovery_exit;
        /* Destination */
        struct dst_entry *dst;
        /* Source address. */
@@ -1044,7 +1052,7 @@ void sctp_transport_route(struct sctp_transport *, union sctp_addr *,
                          struct sctp_sock *);
 void sctp_transport_pmtu(struct sctp_transport *);
 void sctp_transport_free(struct sctp_transport *);
-void sctp_transport_reset_timers(struct sctp_transport *);
+void sctp_transport_reset_timers(struct sctp_transport *, int);
 void sctp_transport_hold(struct sctp_transport *);
 void sctp_transport_put(struct sctp_transport *);
 void sctp_transport_update_rto(struct sctp_transport *, __u32);
@@ -1134,6 +1142,9 @@ struct sctp_outq {
        /* How many unackd bytes do we have in-flight?  */
        __u32 outstanding_bytes;
+        /* Are we doing fast-rtx on this queue */
+        char fast_rtx;
        /* Corked? */
        char cork;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 633147cb6bbc..cf54034019d9 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -139,7 +139,6 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define MAX_TCP_KEEPINTVL       32767
 #define MAX_TCP_KEEPCNT         127
 #define MAX_TCP_SYNCNT          127
-#define MAX_TCP_ACCEPT_DEFERRED 65535
 #define TCP_SYNQ_INTERVAL       (HZ/5)  /* Period of SYNACK timer */
@@ -433,7 +432,6 @@ extern struct sk_buff *		tcp_make_synack(struct sock *sk,
 extern int                      tcp_disconnect(struct sock *sk, int flags);
-extern void                     tcp_unhash(struct sock *sk);
 /* From syncookies.c */
 extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index 27394e0447d8..112934a3288d 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -40,7 +40,8 @@ extern int			datagram_recv_ctl(struct sock *sk,
                                                  struct msghdr *msg,
                                                  struct sk_buff *skb);
-extern int                      datagram_send_ctl(struct msghdr *msg,
+extern int                      datagram_send_ctl(struct net *net,
+                                                  struct msghdr *msg,
                                                  struct flowi *fl,
                                                  struct ipv6_txoptions *opt,
                                                  int *hlimit, int *tclass);
diff --git a/include/net/udp.h b/include/net/udp.h
index 3e55a99b0ba3..ccce83707046 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -135,6 +135,7 @@ extern void	udp_err(struct sk_buff *, u32);
 extern int      udp_sendmsg(struct kiocb *iocb, struct sock *sk,
                            struct msghdr *msg, size_t len);
+extern void     udp_flush_pending_frames(struct sock *sk);
 extern int      udp_rcv(struct sk_buff *skb);
 extern int      udp_ioctl(struct sock *sk, int cmd, unsigned long arg);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 911a661b7278..31d30b1852e8 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -105,7 +105,6 @@ enum ib_device_cap_flags {
         */
        IB_DEVICE_UD_IP_CSUM            = (1<<18),
        IB_DEVICE_UD_TSO                = (1<<19),
-        IB_DEVICE_SEND_W_INV            = (1<<21),
 };
 enum ib_atomic_cap {
diff --git a/include/sound/ac97_codec.h b/include/sound/ac97_codec.h
index 049edc5e6461..9c309daf492b 100644
--- a/include/sound/ac97_codec.h
+++ b/include/sound/ac97_codec.h
@@ -505,6 +505,7 @@ struct snd_ac97 {
                        unsigned short pcmreg[3];       // PCM registers
                        unsigned short codec_cfg[3];    // CODEC_CFG bits
                        unsigned char swap_mic_linein;  // AD1986/AD1986A only
+                        unsigned char lo_as_master;     /* LO as master */
                } ad18xx;
                unsigned int dev_flags;         /* device specific */
        } spec;
diff --git a/init/Kconfig b/init/Kconfig
index 6135d07f31ec..6199d1120900 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -13,6 +13,7 @@ config DEFCONFIG_LIST
        default "/lib/modules/$UNAME_RELEASE/.config"
        default "/etc/kernel-config"
        default "/boot/config-$UNAME_RELEASE"
+        default "$ARCH_DEFCONFIG"
        default "arch/$ARCH/defconfig"
 menu "General setup"
diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
index 7473b0c59d4d..693d24694a6c 100644
--- a/init/do_mounts_md.c
+++ b/init/do_mounts_md.c
@@ -24,7 +24,6 @@ static struct {
 static int md_setup_ents __initdata;
-extern int mdp_major;
 /*
 * Parse the command-line parameters given our kernel, but do not
 * actually try to invoke the MD device now; that is handled by
diff --git a/ipc/msg.c b/ipc/msg.c
index 32494e8cc7a5..b4eee1c6101d 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -98,20 +98,15 @@ void recompute_msgmni(struct ipc_namespace *ns)
        if (allowed < MSGMNI) {
                ns->msg_ctlmni = MSGMNI;
-                goto out_callback;
+                return;
        }
        if (allowed > IPCMNI / nb_ns) {
                ns->msg_ctlmni = IPCMNI / nb_ns;
-                goto out_callback;
+                return;
        }
        ns->msg_ctlmni = allowed;
-out_callback:
-        printk(KERN_INFO "msgmni has been set to %d for ipc namespace %p\n",
-                ns->msg_ctlmni, ns);
 }
 void msg_init_ns(struct ipc_namespace *ns)
@@ -136,6 +131,10 @@ void msg_exit_ns(struct ipc_namespace *ns)
 void __init msg_init(void)
 {
        msg_init_ns(&init_ipc_ns);
+        printk(KERN_INFO "msgmni has been set to %d\n",
+                init_ipc_ns.msg_ctlmni);
        ipc_init_proc_interface("sysvipc/msg",
                                "       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
                                IPC_MSG_IDS, sysvipc_msg_proc_show);
diff --git a/ipc/shm.c b/ipc/shm.c
index 554429ade079..790240cd067f 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -894,8 +894,6 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
        if (!sfd)
                goto out_put_dentry;
-        err = -ENOMEM;
        file = alloc_file(path.mnt, path.dentry, f_mode, &shm_file_operations);
        if (!file)
                goto out_free;
@@ -1060,16 +1058,16 @@ asmlinkage long sys_shmdt(char __user *shmaddr)
 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
 {
        struct shmid_kernel *shp = it;
-        char *format;
-#define SMALL_STRING "%10d %10d  %4o %10u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
+#if BITS_PER_LONG <= 32
-#define BIG_STRING   "%10d %10d  %4o %21u %5u %5u  %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
+#define SIZE_SPEC "%10lu"
+#else
+#define SIZE_SPEC "%21lu"
+#endif
-        if (sizeof(size_t) <= sizeof(int))
+        return seq_printf(s,
-                format = SMALL_STRING;
+                          "%10d %10d  %4o " SIZE_SPEC " %5u %5u  "
-        else
+                          "%5lu %5u %5u %5u %5u %10lu %10lu %10lu\n",
-                format = BIG_STRING;
-        return seq_printf(s, format,
                          shp->shm_perm.key,
                          shp->shm_perm.id,
                          shp->shm_perm.mode,
diff --git a/kernel/capability.c b/kernel/capability.c
index 39e8193b41ea..cfbe44299488 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -53,6 +53,69 @@ static void warn_legacy_capability_use(void)
 }
 /*
+ * Version 2 capabilities worked fine, but the linux/capability.h file
+ * that accompanied their introduction encouraged their use without
+ * the necessary user-space source code changes. As such, we have
+ * created a version 3 with equivalent functionality to version 2, but
+ * with a header change to protect legacy source code from using
+ * version 2 when it wanted to use version 1. If your system has code
+ * that trips the following warning, it is using version 2 specific
+ * capabilities and may be doing so insecurely.
+ *
+ * The remedy is to either upgrade your version of libcap (to 2.10+,
+ * if the application is linked against it), or recompile your
+ * application with modern kernel headers and this warning will go
+ * away.
+ */
+static void warn_deprecated_v2(void)
+{
+        static int warned;
+        if (!warned) {
+                char name[sizeof(current->comm)];
+                printk(KERN_INFO "warning: `%s' uses deprecated v2"
+                       " capabilities in a way that may be insecure.\n",
+                       get_task_comm(name, current));
+                warned = 1;
+        }
+}
+/*
+ * Version check. Return the number of u32s in each capability flag
+ * array, or a negative value on error.
+ */
+static int cap_validate_magic(cap_user_header_t header, unsigned *tocopy)
+{
+        __u32 version;
+        if (get_user(version, &header->version))
+                return -EFAULT;
+        switch (version) {
+        case _LINUX_CAPABILITY_VERSION_1:
+                warn_legacy_capability_use();
+                *tocopy = _LINUX_CAPABILITY_U32S_1;
+                break;
+        case _LINUX_CAPABILITY_VERSION_2:
+                warn_deprecated_v2();
+                /*
+                 * fall through - v3 is otherwise equivalent to v2.
+                 */
+        case _LINUX_CAPABILITY_VERSION_3:
+                *tocopy = _LINUX_CAPABILITY_U32S_3;
+                break;
+        default:
+                if (put_user((u32)_KERNEL_CAPABILITY_VERSION, &header->version))
+                        return -EFAULT;
+                return -EINVAL;
+        }
+        return 0;
+}
+/*
 * For sys_getproccap() and sys_setproccap(), any of the three
 * capability set pointers may be NULL -- indicating that that set is
 * uninteresting and/or not to be changed.
@@ -71,27 +134,13 @@ asmlinkage long sys_capget(cap_user_header_t header, cap_user_data_t dataptr)
 {
        int ret = 0;
        pid_t pid;
-        __u32 version;
        struct task_struct *target;
        unsigned tocopy;
        kernel_cap_t pE, pI, pP;
-        if (get_user(version, &header->version))
+        ret = cap_validate_magic(header, &tocopy);
-                return -EFAULT;
+        if (ret != 0)
+                return ret;
-        switch (version) {
-        case _LINUX_CAPABILITY_VERSION_1:
-                warn_legacy_capability_use();
-                tocopy = _LINUX_CAPABILITY_U32S_1;
-                break;
-        case _LINUX_CAPABILITY_VERSION_2:
-                tocopy = _LINUX_CAPABILITY_U32S_2;
-                break;
-        default:
-                if (put_user(_LINUX_CAPABILITY_VERSION, &header->version))
-                        return -EFAULT;
-                return -EINVAL;
-        }
        if (get_user(pid, &header->pid))
                return -EFAULT;
@@ -118,7 +167,7 @@ out:
        spin_unlock(&task_capability_lock);
        if (!ret) {
-                struct __user_cap_data_struct kdata[_LINUX_CAPABILITY_U32S];
+                struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
                unsigned i;
                for (i = 0; i < tocopy; i++) {
@@ -128,7 +177,7 @@ out:
                }
                /*
-                 * Note, in the case, tocopy < _LINUX_CAPABILITY_U32S,
+                 * Note, in the case, tocopy < _KERNEL_CAPABILITY_U32S,
                 * we silently drop the upper capabilities here. This
                 * has the effect of making older libcap
                 * implementations implicitly drop upper capability
@@ -240,30 +289,16 @@ static inline int cap_set_all(kernel_cap_t *effective,
 */
 asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
 {
-        struct __user_cap_data_struct kdata[_LINUX_CAPABILITY_U32S];
+        struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
        unsigned i, tocopy;
        kernel_cap_t inheritable, permitted, effective;
-        __u32 version;
        struct task_struct *target;
        int ret;
        pid_t pid;
-        if (get_user(version, &header->version))
+        ret = cap_validate_magic(header, &tocopy);
-                return -EFAULT;
+        if (ret != 0)
+                return ret;
-        switch (version) {
-        case _LINUX_CAPABILITY_VERSION_1:
-                warn_legacy_capability_use();
-                tocopy = _LINUX_CAPABILITY_U32S_1;
-                break;
-        case _LINUX_CAPABILITY_VERSION_2:
-                tocopy = _LINUX_CAPABILITY_U32S_2;
-                break;
-        default:
-                if (put_user(_LINUX_CAPABILITY_VERSION, &header->version))
-                        return -EFAULT;
-                return -EINVAL;
-        }
        if (get_user(pid, &header->pid))
                return -EFAULT;
@@ -281,7 +316,7 @@ asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
                permitted.cap[i] = kdata[i].permitted;
                inheritable.cap[i] = kdata[i].inheritable;
        }
-        while (i < _LINUX_CAPABILITY_U32S) {
+        while (i < _KERNEL_CAPABILITY_U32S) {
                effective.cap[i] = 0;
                permitted.cap[i] = 0;
                inheritable.cap[i] = 0;
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index fbc6fc8949b4..15ac0e1e4f4d 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2903,7 +2903,7 @@ int cgroup_clone(struct task_struct *tsk, struct cgroup_subsys *subsys)
        cg = tsk->cgroups;
        parent = task_cgroup(tsk, subsys->subsys_id);
-        snprintf(nodename, MAX_CGROUP_TYPE_NAMELEN, "node_%d", tsk->pid);
+        snprintf(nodename, MAX_CGROUP_TYPE_NAMELEN, "%d", tsk->pid);
        /* Pin the hierarchy */
        atomic_inc(&parent->root->sb->s_active);
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 86ea9e34e326..039baa4cd90c 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -797,8 +797,10 @@ static int update_cpumask(struct cpuset *cs, char *buf)
                retval = cpulist_parse(buf, trialcs.cpus_allowed);
                if (retval < 0)
                        return retval;
+                if (!cpus_subset(trialcs.cpus_allowed, cpu_online_map))
+                        return -EINVAL;
        }
-        cpus_and(trialcs.cpus_allowed, trialcs.cpus_allowed, cpu_online_map);
        retval = validate_change(cs, &trialcs);
        if (retval < 0)
                return retval;
@@ -932,9 +934,11 @@ static int update_nodemask(struct cpuset *cs, char *buf)
                retval = nodelist_parse(buf, trialcs.mems_allowed);
                if (retval < 0)
                        goto done;
+                if (!nodes_subset(trialcs.mems_allowed,
+                                node_states[N_HIGH_MEMORY]))
+                        return -EINVAL;
        }
-        nodes_and(trialcs.mems_allowed, trialcs.mems_allowed,
-                                                node_states[N_HIGH_MEMORY]);
        oldmem = cs->mems_allowed;
        if (nodes_equal(oldmem, trialcs.mems_allowed)) {
                retval = 0;             /* Too easy - nothing to do */
diff --git a/kernel/exit.c b/kernel/exit.c
index 1510f78a0ffa..8f6185e69b69 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -126,6 +126,12 @@ static void __exit_signal(struct task_struct *tsk)
        __unhash_process(tsk);
+        /*
+         * Do this under ->siglock, we can race with another thread
+         * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
+         */
+        flush_sigqueue(&tsk->pending);
        tsk->signal = NULL;
        tsk->sighand = NULL;
        spin_unlock(&sighand->siglock);
@@ -133,7 +139,6 @@ static void __exit_signal(struct task_struct *tsk)
        __cleanup_sighand(sighand);
        clear_tsk_thread_flag(tsk,TIF_SIGPENDING);
-        flush_sigqueue(&tsk->pending);
        if (sig) {
                flush_sigqueue(&sig->shared_pending);
                taskstats_tgid_free(sig);
diff --git a/kernel/kgdb.c b/kernel/kgdb.c
index 14787de568b3..79e3c90113c2 100644
--- a/kernel/kgdb.c
+++ b/kernel/kgdb.c
@@ -52,6 +52,7 @@
 #include <asm/byteorder.h>
 #include <asm/atomic.h>
 #include <asm/system.h>
+#include <asm/unaligned.h>
 static int kgdb_break_asap;
@@ -227,8 +228,6 @@ void __weak kgdb_disable_hw_debug(struct pt_regs *regs)
 * GDB remote protocol parser:
 */
-static const char       hexchars[] = "0123456789abcdef";
 static int hex(char ch)
 {
        if ((ch >= 'a') && (ch <= 'f'))
@@ -316,8 +315,8 @@ static void put_packet(char *buffer)
                }
                kgdb_io_ops->write_char('#');
-                kgdb_io_ops->write_char(hexchars[checksum >> 4]);
+                kgdb_io_ops->write_char(hex_asc_hi(checksum));
-                kgdb_io_ops->write_char(hexchars[checksum & 0xf]);
+                kgdb_io_ops->write_char(hex_asc_lo(checksum));
                if (kgdb_io_ops->flush)
                        kgdb_io_ops->flush();
@@ -478,8 +477,8 @@ static void error_packet(char *pkt, int error)
 {
        error = -error;
        pkt[0] = 'E';
-        pkt[1] = hexchars[(error / 10)];
+        pkt[1] = hex_asc[(error / 10)];
-        pkt[2] = hexchars[(error % 10)];
+        pkt[2] = hex_asc[(error % 10)];
        pkt[3] = '\0';
 }
@@ -510,10 +509,7 @@ static void int_to_threadref(unsigned char *id, int value)
        scan = (unsigned char *)id;
        while (i--)
                *scan++ = 0;
-        *scan++ = (value >> 24) & 0xff;
+        put_unaligned_be32(value, scan);
-        *scan++ = (value >> 16) & 0xff;
-        *scan++ = (value >> 8) & 0xff;
-        *scan++ = (value & 0xff);
 }
 static struct task_struct *getthread(struct pt_regs *regs, int tid)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 1e0250cb9486..d4998f81e229 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -699,8 +699,9 @@ static int __register_kprobes(struct kprobe **kps, int num,
                return -EINVAL;
        for (i = 0; i < num; i++) {
                ret = __register_kprobe(kps[i], called_from);
-                if (ret < 0 && i > 0) {
+                if (ret < 0) {
-                        unregister_kprobes(kps, i);
+                        if (i > 0)
+                                unregister_kprobes(kps, i);
                        break;
                }
        }
@@ -776,8 +777,9 @@ static int __register_jprobes(struct jprobe **jps, int num,
                        jp->kp.break_handler = longjmp_break_handler;
                        ret = __register_kprobe(&jp->kp, called_from);
                }
-                if (ret < 0 && i > 0) {
+                if (ret < 0) {
-                        unregister_jprobes(jps, i);
+                        if (i > 0)
+                                unregister_jprobes(jps, i);
                        break;
                }
        }
@@ -920,8 +922,9 @@ static int __register_kretprobes(struct kretprobe **rps, int num,
                return -EINVAL;
        for (i = 0; i < num; i++) {
                ret = __register_kretprobe(rps[i], called_from);
-                if (ret < 0 && i > 0) {
+                if (ret < 0) {
-                        unregister_kretprobes(rps, i);
+                        if (i > 0)
+                                unregister_kretprobes(rps, i);
                        break;
                }
        }
diff --git a/kernel/module.c b/kernel/module.c
index f5e9491ef7ac..5f80478b746d 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1337,7 +1337,19 @@ out_unreg:
        kobject_put(&mod->mkobj.kobj);
        return err;
 }
-#endif
+static void mod_sysfs_fini(struct module *mod)
+{
+        kobject_put(&mod->mkobj.kobj);
+}
+#else /* CONFIG_SYSFS */
+static void mod_sysfs_fini(struct module *mod)
+{
+}
+#endif /* CONFIG_SYSFS */
 static void mod_kobject_remove(struct module *mod)
 {
@@ -1345,7 +1357,7 @@ static void mod_kobject_remove(struct module *mod)
        module_param_sysfs_remove(mod);
        kobject_put(mod->mkobj.drivers_dir);
        kobject_put(mod->holders_dir);
-        kobject_put(&mod->mkobj.kobj);
+        mod_sysfs_fini(mod);
 }
 /*
@@ -1780,7 +1792,7 @@ static struct module *load_module(void __user *umod,
        /* Sanity checks against insmoding binaries or wrong arch,
           weird elf version */
-        if (memcmp(hdr->e_ident, ELFMAG, 4) != 0
+        if (memcmp(hdr->e_ident, ELFMAG, SELFMAG) != 0
            || hdr->e_type != ET_REL
            || !elf_check_arch(hdr)
            || hdr->e_shentsize != sizeof(*sechdrs)) {
diff --git a/kernel/relay.c b/kernel/relay.c
index bc24dcdc570f..7de644cdec43 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1191,7 +1191,7 @@ static ssize_t relay_file_splice_read(struct file *in,
        ret = 0;
        spliced = 0;
-        while (len) {
+        while (len && !spliced) {
                ret = subbuf_splice_actor(in, ppos, pipe, len, flags, &nonpad_ret);
                if (ret < 0)
                        break;
diff --git a/kernel/sched.c b/kernel/sched.c
index 56ea3a203a5a..7c7b2d052c02 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -136,7 +136,7 @@ static inline void sg_inc_cpu_power(struct sched_group *sg, u32 val)
 static inline int rt_policy(int policy)
 {
-        if (unlikely(policy == SCHED_FIFO) || unlikely(policy == SCHED_RR))
+        if (unlikely(policy == SCHED_FIFO || policy == SCHED_RR))
                return 1;
        return 0;
 }
@@ -312,12 +312,15 @@ static DEFINE_SPINLOCK(task_group_lock);
 #endif
 /*
- * A weight of 0, 1 or ULONG_MAX can cause arithmetics problems.
+ * A weight of 0 or 1 can cause arithmetics problems.
+ * A weight of a cfs_rq is the sum of weights of which entities
+ * are queued on this cfs_rq, so a weight of a entity should not be
+ * too large, so as the shares value of a task group.
 * (The default weight is 1024 - so there's no practical
 *  limitation from this.)
 */
 #define MIN_SHARES      2
-#define MAX_SHARES      (ULONG_MAX - 1)
+#define MAX_SHARES      (1UL << 18)
 static int init_task_group_load = INIT_TASK_GROUP_LOAD;
 #endif
@@ -398,43 +401,6 @@ struct cfs_rq {
         */
        struct list_head leaf_cfs_rq_list;
        struct task_group *tg;  /* group that "owns" this runqueue */
-#ifdef CONFIG_SMP
-        unsigned long task_weight;
-        unsigned long shares;
-        /*
-         * We need space to build a sched_domain wide view of the full task
-         * group tree, in order to avoid depending on dynamic memory allocation
-         * during the load balancing we place this in the per cpu task group
-         * hierarchy. This limits the load balancing to one instance per cpu,
-         * but more should not be needed anyway.
-         */
-        struct aggregate_struct {
-                /*
-                 *   load = weight(cpus) * f(tg)
-                 *
-                 * Where f(tg) is the recursive weight fraction assigned to
-                 * this group.
-                 */
-                unsigned long load;
-                /*
-                 * part of the group weight distributed to this span.
-                 */
-                unsigned long shares;
-                /*
-                 * The sum of all runqueue weights within this span.
-                 */
-                unsigned long rq_weight;
-                /*
-                 * Weight contributed by tasks; this is the part we can
-                 * influence by moving tasks around.
-                 */
-                unsigned long task_weight;
-        } aggregate;
-#endif
 #endif
 };
@@ -1368,17 +1334,19 @@ static void __resched_task(struct task_struct *p, int tif_bit)
 */
 #define SRR(x, y) (((x) + (1UL << ((y) - 1))) >> (y))
-/*
- * delta *= weight / lw
- */
 static unsigned long
 calc_delta_mine(unsigned long delta_exec, unsigned long weight,
                struct load_weight *lw)
 {
        u64 tmp;
-        if (!lw->inv_weight)
+        if (!lw->inv_weight) {
-                lw->inv_weight = 1 + (WMULT_CONST-lw->weight/2)/(lw->weight+1);
+                if (BITS_PER_LONG > 32 && unlikely(lw->weight >= WMULT_CONST))
+                        lw->inv_weight = 1;
+                else
+                        lw->inv_weight = 1 + (WMULT_CONST-lw->weight/2)
+                                / (lw->weight+1);
+        }
        tmp = (u64)delta_exec * weight;
        /*
@@ -1393,6 +1361,12 @@ calc_delta_mine(unsigned long delta_exec, unsigned long weight,
        return (unsigned long)min(tmp, (u64)(unsigned long)LONG_MAX);
 }
+static inline unsigned long
+calc_delta_fair(unsigned long delta_exec, struct load_weight *lw)
+{
+        return calc_delta_mine(delta_exec, NICE_0_LOAD, lw);
+}
 static inline void update_load_add(struct load_weight *lw, unsigned long inc)
 {
        lw->weight += inc;
@@ -1505,326 +1479,6 @@ static unsigned long source_load(int cpu, int type);
 static unsigned long target_load(int cpu, int type);
 static unsigned long cpu_avg_load_per_task(int cpu);
 static int task_hot(struct task_struct *p, u64 now, struct sched_domain *sd);
-#ifdef CONFIG_FAIR_GROUP_SCHED
-/*
- * Group load balancing.
- *
- * We calculate a few balance domain wide aggregate numbers; load and weight.
- * Given the pictures below, and assuming each item has equal weight:
- *
- *         root          1 - thread
- *         / | \         A - group
- *        A  1  B
- *       /|\   / \
- *      C 2 D 3   4
- *      |   |
- *      5   6
- *
- * load:
- *    A and B get 1/3-rd of the total load. C and D get 1/3-rd of A's 1/3-rd,
- *    which equals 1/9-th of the total load.
- *
- * shares:
- *    The weight of this group on the selected cpus.
- *
- * rq_weight:
- *    Direct sum of all the cpu's their rq weight, e.g. A would get 3 while
- *    B would get 2.
- *
- * task_weight:
- *    Part of the rq_weight contributed by tasks; all groups except B would
- *    get 1, B gets 2.
- */
-static inline struct aggregate_struct *
-aggregate(struct task_group *tg, struct sched_domain *sd)
-{
-        return &tg->cfs_rq[sd->first_cpu]->aggregate;
-}
-typedef void (*aggregate_func)(struct task_group *, struct sched_domain *);
-/*
- * Iterate the full tree, calling @down when first entering a node and @up when
- * leaving it for the final time.
- */
-static
-void aggregate_walk_tree(aggregate_func down, aggregate_func up,
-                         struct sched_domain *sd)
-{
-        struct task_group *parent, *child;
-        rcu_read_lock();
-        parent = &root_task_group;
-down:
-        (*down)(parent, sd);
-        list_for_each_entry_rcu(child, &parent->children, siblings) {
-                parent = child;
-                goto down;
-up:
-                continue;
-        }
-        (*up)(parent, sd);
-        child = parent;
-        parent = parent->parent;
-        if (parent)
-                goto up;
-        rcu_read_unlock();
-}
-/*
- * Calculate the aggregate runqueue weight.
- */
-static
-void aggregate_group_weight(struct task_group *tg, struct sched_domain *sd)
-{
-        unsigned long rq_weight = 0;
-        unsigned long task_weight = 0;
-        int i;
-        for_each_cpu_mask(i, sd->span) {
-                rq_weight += tg->cfs_rq[i]->load.weight;
-                task_weight += tg->cfs_rq[i]->task_weight;
-        }
-        aggregate(tg, sd)->rq_weight = rq_weight;
-        aggregate(tg, sd)->task_weight = task_weight;
-}
-/*
- * Compute the weight of this group on the given cpus.
- */
-static
-void aggregate_group_shares(struct task_group *tg, struct sched_domain *sd)
-{
-        unsigned long shares = 0;
-        int i;
-        for_each_cpu_mask(i, sd->span)
-                shares += tg->cfs_rq[i]->shares;
-        if ((!shares && aggregate(tg, sd)->rq_weight) || shares > tg->shares)
-                shares = tg->shares;
-        aggregate(tg, sd)->shares = shares;
-}
-/*
- * Compute the load fraction assigned to this group, relies on the aggregate
- * weight and this group's parent's load, i.e. top-down.
- */
-static
-void aggregate_group_load(struct task_group *tg, struct sched_domain *sd)
-{
-        unsigned long load;
-        if (!tg->parent) {
-                int i;
-                load = 0;
-                for_each_cpu_mask(i, sd->span)
-                        load += cpu_rq(i)->load.weight;
-        } else {
-                load = aggregate(tg->parent, sd)->load;
-                /*
-                 * shares is our weight in the parent's rq so
-                 * shares/parent->rq_weight gives our fraction of the load
-                 */
-                load *= aggregate(tg, sd)->shares;
-                load /= aggregate(tg->parent, sd)->rq_weight + 1;
-        }
-        aggregate(tg, sd)->load = load;
-}
-static void __set_se_shares(struct sched_entity *se, unsigned long shares);
-/*
- * Calculate and set the cpu's group shares.
- */
-static void
-__update_group_shares_cpu(struct task_group *tg, struct sched_domain *sd,
-                          int tcpu)
-{
-        int boost = 0;
-        unsigned long shares;
-        unsigned long rq_weight;
-        if (!tg->se[tcpu])
-                return;
-        rq_weight = tg->cfs_rq[tcpu]->load.weight;
-        /*
-         * If there are currently no tasks on the cpu pretend there is one of
-         * average load so that when a new task gets to run here it will not
-         * get delayed by group starvation.
-         */
-        if (!rq_weight) {
-                boost = 1;
-                rq_weight = NICE_0_LOAD;
-        }
-        /*
-         *           \Sum shares * rq_weight
-         * shares =  -----------------------
-         *               \Sum rq_weight
-         *
-         */
-        shares = aggregate(tg, sd)->shares * rq_weight;
-        shares /= aggregate(tg, sd)->rq_weight + 1;
-        /*
-         * record the actual number of shares, not the boosted amount.
-         */
-        tg->cfs_rq[tcpu]->shares = boost ? 0 : shares;
-        if (shares < MIN_SHARES)
-                shares = MIN_SHARES;
-        else if (shares > MAX_SHARES)
-                shares = MAX_SHARES;
-        __set_se_shares(tg->se[tcpu], shares);
-}
-/*
- * Re-adjust the weights on the cpu the task came from and on the cpu the
- * task went to.
- */
-static void
-__move_group_shares(struct task_group *tg, struct sched_domain *sd,
-                    int scpu, int dcpu)
-{
-        unsigned long shares;
-        shares = tg->cfs_rq[scpu]->shares + tg->cfs_rq[dcpu]->shares;
-        __update_group_shares_cpu(tg, sd, scpu);
-        __update_group_shares_cpu(tg, sd, dcpu);
-        /*
-         * ensure we never loose shares due to rounding errors in the
-         * above redistribution.
-         */
-        shares -= tg->cfs_rq[scpu]->shares + tg->cfs_rq[dcpu]->shares;
-        if (shares)
-                tg->cfs_rq[dcpu]->shares += shares;
-}
-/*
- * Because changing a group's shares changes the weight of the super-group
- * we need to walk up the tree and change all shares until we hit the root.
- */
-static void
-move_group_shares(struct task_group *tg, struct sched_domain *sd,
-                  int scpu, int dcpu)
-{
-        while (tg) {
-                __move_group_shares(tg, sd, scpu, dcpu);
-                tg = tg->parent;
-        }
-}
-static
-void aggregate_group_set_shares(struct task_group *tg, struct sched_domain *sd)
-{
-        unsigned long shares = aggregate(tg, sd)->shares;
-        int i;
-        for_each_cpu_mask(i, sd->span) {
-                struct rq *rq = cpu_rq(i);
-                unsigned long flags;
-                spin_lock_irqsave(&rq->lock, flags);
-                __update_group_shares_cpu(tg, sd, i);
-                spin_unlock_irqrestore(&rq->lock, flags);
-        }
-        aggregate_group_shares(tg, sd);
-        /*
-         * ensure we never loose shares due to rounding errors in the
-         * above redistribution.
-         */
-        shares -= aggregate(tg, sd)->shares;
-        if (shares) {
-                tg->cfs_rq[sd->first_cpu]->shares += shares;
-                aggregate(tg, sd)->shares += shares;
-        }
-}
-/*
- * Calculate the accumulative weight and recursive load of each task group
- * while walking down the tree.
- */
-static
-void aggregate_get_down(struct task_group *tg, struct sched_domain *sd)
-{
-        aggregate_group_weight(tg, sd);
-        aggregate_group_shares(tg, sd);
-        aggregate_group_load(tg, sd);
-}
-/*
- * Rebalance the cpu shares while walking back up the tree.
- */
-static
-void aggregate_get_up(struct task_group *tg, struct sched_domain *sd)
-{
-        aggregate_group_set_shares(tg, sd);
-}
-static DEFINE_PER_CPU(spinlock_t, aggregate_lock);
-static void __init init_aggregate(void)
-{
-        int i;
-        for_each_possible_cpu(i)
-                spin_lock_init(&per_cpu(aggregate_lock, i));
-}
-static int get_aggregate(struct sched_domain *sd)
-{
-        if (!spin_trylock(&per_cpu(aggregate_lock, sd->first_cpu)))
-                return 0;
-        aggregate_walk_tree(aggregate_get_down, aggregate_get_up, sd);
-        return 1;
-}
-static void put_aggregate(struct sched_domain *sd)
-{
-        spin_unlock(&per_cpu(aggregate_lock, sd->first_cpu));
-}
-static void cfs_rq_set_shares(struct cfs_rq *cfs_rq, unsigned long shares)
-{
-        cfs_rq->shares = shares;
-}
-#else
-static inline void init_aggregate(void)
-{
-}
-static inline int get_aggregate(struct sched_domain *sd)
-{
-        return 0;
-}
-static inline void put_aggregate(struct sched_domain *sd)
-{
-}
-#endif
 #else /* CONFIG_SMP */
 #ifdef CONFIG_FAIR_GROUP_SCHED
@@ -1845,14 +1499,26 @@ static void cfs_rq_set_shares(struct cfs_rq *cfs_rq, unsigned long shares)
 #define sched_class_highest (&rt_sched_class)
-static void inc_nr_running(struct rq *rq)
+static inline void inc_load(struct rq *rq, const struct task_struct *p)
+{
+        update_load_add(&rq->load, p->se.load.weight);
+}
+static inline void dec_load(struct rq *rq, const struct task_struct *p)
+{
+        update_load_sub(&rq->load, p->se.load.weight);
+}
+static void inc_nr_running(struct task_struct *p, struct rq *rq)
 {
        rq->nr_running++;
+        inc_load(rq, p);
 }
-static void dec_nr_running(struct rq *rq)
+static void dec_nr_running(struct task_struct *p, struct rq *rq)
 {
        rq->nr_running--;
+        dec_load(rq, p);
 }
 static void set_load_weight(struct task_struct *p)
@@ -1944,7 +1610,7 @@ static void activate_task(struct rq *rq, struct task_struct *p, int wakeup)
                rq->nr_uninterruptible--;
        enqueue_task(rq, p, wakeup);
-        inc_nr_running(rq);
+        inc_nr_running(p, rq);
 }
 /*
@@ -1956,7 +1622,7 @@ static void deactivate_task(struct rq *rq, struct task_struct *p, int sleep)
                rq->nr_uninterruptible++;
        dequeue_task(rq, p, sleep);
-        dec_nr_running(rq);
+        dec_nr_running(p, rq);
 }
 /**
@@ -2609,7 +2275,7 @@ void wake_up_new_task(struct task_struct *p, unsigned long clone_flags)
                 * management (if any):
                 */
                p->sched_class->task_new(rq, p);
-                inc_nr_running(rq);
+                inc_nr_running(p, rq);
        }
        check_preempt_curr(rq, p);
 #ifdef CONFIG_SMP
@@ -3600,12 +3266,9 @@ static int load_balance(int this_cpu, struct rq *this_rq,
        unsigned long imbalance;
        struct rq *busiest;
        unsigned long flags;
-        int unlock_aggregate;
        cpus_setall(*cpus);
-        unlock_aggregate = get_aggregate(sd);
        /*
         * When power savings policy is enabled for the parent domain, idle
         * sibling can pick up load irrespective of busy siblings. In this case,
@@ -3721,9 +3384,8 @@ redo:
        if (!ld_moved && !sd_idle && sd->flags & SD_SHARE_CPUPOWER &&
            !test_sd_parent(sd, SD_POWERSAVINGS_BALANCE))
-                ld_moved = -1;
+                return -1;
+        return ld_moved;
-        goto out;
 out_balanced:
        schedstat_inc(sd, lb_balanced[idle]);
@@ -3738,13 +3400,8 @@ out_one_pinned:
        if (!sd_idle && sd->flags & SD_SHARE_CPUPOWER &&
            !test_sd_parent(sd, SD_POWERSAVINGS_BALANCE))
-                ld_moved = -1;
+                return -1;
-        else
+        return 0;
-                ld_moved = 0;
-out:
-        if (unlock_aggregate)
-                put_aggregate(sd);
-        return ld_moved;
 }
 /*
@@ -4430,7 +4087,7 @@ static inline void schedule_debug(struct task_struct *prev)
         * schedule() atomically, we ignore that path for now.
         * Otherwise, whine if we are scheduling when we should not be.
         */
-        if (unlikely(in_atomic_preempt_off()) && unlikely(!prev->exit_state))
+        if (unlikely(in_atomic_preempt_off() && !prev->exit_state))
                __schedule_bug(prev);
        profile_hit(SCHED_PROFILING, __builtin_return_address(0));
@@ -4510,12 +4167,10 @@ need_resched_nonpreemptible:
        clear_tsk_need_resched(prev);
        if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
-                if (unlikely((prev->state & TASK_INTERRUPTIBLE) &&
+                if (unlikely(signal_pending_state(prev->state, prev)))
-                                signal_pending(prev))) {
                        prev->state = TASK_RUNNING;
-                } else {
+                else
                        deactivate_task(rq, prev, 1);
-                }
                switch_count = &prev->nvcsw;
        }
@@ -4931,8 +4586,10 @@ void set_user_nice(struct task_struct *p, long nice)
                goto out_unlock;
        }
        on_rq = p->se.on_rq;
-        if (on_rq)
+        if (on_rq) {
                dequeue_task(rq, p, 0);
+                dec_load(rq, p);
+        }
        p->static_prio = NICE_TO_PRIO(nice);
        set_load_weight(p);
@@ -4942,6 +4599,7 @@ void set_user_nice(struct task_struct *p, long nice)
        if (on_rq) {
                enqueue_task(rq, p, 0);
+                inc_load(rq, p);
                /*
                 * If the task increased its priority or is running and
                 * lowered its priority, then reschedule its CPU:
@@ -7316,7 +6974,6 @@ static int __build_sched_domains(const cpumask_t *cpu_map,
                        SD_INIT(sd, ALLNODES);
                        set_domain_attribute(sd, attr);
                        sd->span = *cpu_map;
-                        sd->first_cpu = first_cpu(sd->span);
                        cpu_to_allnodes_group(i, cpu_map, &sd->groups, tmpmask);
                        p = sd;
                        sd_allnodes = 1;
@@ -7327,7 +6984,6 @@ static int __build_sched_domains(const cpumask_t *cpu_map,
                SD_INIT(sd, NODE);
                set_domain_attribute(sd, attr);
                sched_domain_node_span(cpu_to_node(i), &sd->span);
-                sd->first_cpu = first_cpu(sd->span);
                sd->parent = p;
                if (p)
                        p->child = sd;
@@ -7339,7 +6995,6 @@ static int __build_sched_domains(const cpumask_t *cpu_map,
                SD_INIT(sd, CPU);
                set_domain_attribute(sd, attr);
                sd->span = *nodemask;
-                sd->first_cpu = first_cpu(sd->span);
                sd->parent = p;
                if (p)
                        p->child = sd;
@@ -7351,7 +7006,6 @@ static int __build_sched_domains(const cpumask_t *cpu_map,
                SD_INIT(sd, MC);
                set_domain_attribute(sd, attr);
                sd->span = cpu_coregroup_map(i);
-                sd->first_cpu = first_cpu(sd->span);
                cpus_and(sd->span, sd->span, *cpu_map);
                sd->parent = p;
                p->child = sd;
@@ -7364,7 +7018,6 @@ static int __build_sched_domains(const cpumask_t *cpu_map,
                SD_INIT(sd, SIBLING);
                set_domain_attribute(sd, attr);
                sd->span = per_cpu(cpu_sibling_map, i);
-                sd->first_cpu = first_cpu(sd->span);
                cpus_and(sd->span, sd->span, *cpu_map);
                sd->parent = p;
                p->child = sd;
@@ -7568,8 +7221,8 @@ static int build_sched_domains(const cpumask_t *cpu_map)
 static cpumask_t *doms_cur;     /* current sched domains */
 static int ndoms_cur;           /* number of sched domains in 'doms_cur' */
-static struct sched_domain_attr *dattr_cur;     /* attribues of custom domains
+static struct sched_domain_attr *dattr_cur;
-                                                   in 'doms_cur' */
+                                /* attribues of custom domains in 'doms_cur' */
 /*
 * Special case: If a kmalloc of a doms_cur partition (array of
@@ -8034,7 +7687,6 @@ void __init sched_init(void)
        }
 #ifdef CONFIG_SMP
-        init_aggregate();
        init_defrootdomain();
 #endif
@@ -8599,11 +8251,14 @@ void sched_move_task(struct task_struct *tsk)
 #endif
 #ifdef CONFIG_FAIR_GROUP_SCHED
-static void __set_se_shares(struct sched_entity *se, unsigned long shares)
+static void set_se_shares(struct sched_entity *se, unsigned long shares)
 {
        struct cfs_rq *cfs_rq = se->cfs_rq;
+        struct rq *rq = cfs_rq->rq;
        int on_rq;
+        spin_lock_irq(&rq->lock);
        on_rq = se->on_rq;
        if (on_rq)
                dequeue_entity(cfs_rq, se, 0);
@@ -8613,17 +8268,8 @@ static void __set_se_shares(struct sched_entity *se, unsigned long shares)
        if (on_rq)
                enqueue_entity(cfs_rq, se, 0);
-}
-static void set_se_shares(struct sched_entity *se, unsigned long shares)
+        spin_unlock_irq(&rq->lock);
-{
-        struct cfs_rq *cfs_rq = se->cfs_rq;
-        struct rq *rq = cfs_rq->rq;
-        unsigned long flags;
-        spin_lock_irqsave(&rq->lock, flags);
-        __set_se_shares(se, shares);
-        spin_unlock_irqrestore(&rq->lock, flags);
 }
 static DEFINE_MUTEX(shares_mutex);
@@ -8662,13 +8308,8 @@ int sched_group_set_shares(struct task_group *tg, unsigned long shares)
         * w/o tripping rebalance_share or load_balance_fair.
         */
        tg->shares = shares;
-        for_each_possible_cpu(i) {
+        for_each_possible_cpu(i)
-                /*
-                 * force a rebalance
-                 */
-                cfs_rq_set_shares(tg->cfs_rq[i], 0);
                set_se_shares(tg->se[i], shares);
-        }
        /*
         * Enable load balance activity on this group, by inserting it back on
diff --git a/kernel/sched_clock.c b/kernel/sched_clock.c
index 9c597e37f7de..ce05271219ab 100644
--- a/kernel/sched_clock.c
+++ b/kernel/sched_clock.c
@@ -59,22 +59,26 @@ static inline struct sched_clock_data *cpu_sdc(int cpu)
        return &per_cpu(sched_clock_data, cpu);
 }
+static __read_mostly int sched_clock_running;
 void sched_clock_init(void)
 {
        u64 ktime_now = ktime_to_ns(ktime_get());
-        u64 now = 0;
+        unsigned long now_jiffies = jiffies;
        int cpu;
        for_each_possible_cpu(cpu) {
                struct sched_clock_data *scd = cpu_sdc(cpu);
                scd->lock = (raw_spinlock_t)__RAW_SPIN_LOCK_UNLOCKED;
-                scd->prev_jiffies = jiffies;
+                scd->prev_jiffies = now_jiffies;
-                scd->prev_raw = now;
+                scd->prev_raw = 0;
-                scd->tick_raw = now;
+                scd->tick_raw = 0;
                scd->tick_gtod = ktime_now;
                scd->clock = ktime_now;
        }
+        sched_clock_running = 1;
 }
 /*
@@ -136,6 +140,9 @@ u64 sched_clock_cpu(int cpu)
        struct sched_clock_data *scd = cpu_sdc(cpu);
        u64 now, clock;
+        if (unlikely(!sched_clock_running))
+                return 0ull;
        WARN_ON_ONCE(!irqs_disabled());
        now = sched_clock();
@@ -174,6 +181,9 @@ void sched_clock_tick(void)
        struct sched_clock_data *scd = this_scd();
        u64 now, now_gtod;
+        if (unlikely(!sched_clock_running))
+                return;
        WARN_ON_ONCE(!irqs_disabled());
        now = sched_clock();
diff --git a/kernel/sched_debug.c b/kernel/sched_debug.c
index 5f06118fbc31..8bb713040ac9 100644
--- a/kernel/sched_debug.c
+++ b/kernel/sched_debug.c
@@ -167,11 +167,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
 #endif
        SEQ_printf(m, "  .%-30s: %ld\n", "nr_spread_over",
                        cfs_rq->nr_spread_over);
-#ifdef CONFIG_FAIR_GROUP_SCHED
-#ifdef CONFIG_SMP
-        SEQ_printf(m, "  .%-30s: %lu\n", "shares", cfs_rq->shares);
-#endif
-#endif
 }
 static void print_cpu(struct seq_file *m, int cpu)
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index e24ecd39c4b8..08ae848b71d4 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -334,34 +334,6 @@ int sched_nr_latency_handler(struct ctl_table *table, int write,
 #endif
 /*
- * delta *= w / rw
- */
-static inline unsigned long
-calc_delta_weight(unsigned long delta, struct sched_entity *se)
-{
-        for_each_sched_entity(se) {
-                delta = calc_delta_mine(delta,
-                                se->load.weight, &cfs_rq_of(se)->load);
-        }
-        return delta;
-}
-/*
- * delta *= rw / w
- */
-static inline unsigned long
-calc_delta_fair(unsigned long delta, struct sched_entity *se)
-{
-        for_each_sched_entity(se) {
-                delta = calc_delta_mine(delta,
-                                cfs_rq_of(se)->load.weight, &se->load);
-        }
-        return delta;
-}
-/*
 * The idea is to set a period in which each task runs once.
 *
 * When there are too many tasks (sysctl_sched_nr_latency) we have to stretch
@@ -390,54 +362,47 @@ static u64 __sched_period(unsigned long nr_running)
 */
 static u64 sched_slice(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
-        return calc_delta_weight(__sched_period(cfs_rq->nr_running), se);
+        u64 slice = __sched_period(cfs_rq->nr_running);
+        for_each_sched_entity(se) {
+                cfs_rq = cfs_rq_of(se);
+                slice *= se->load.weight;
+                do_div(slice, cfs_rq->load.weight);
+        }
+        return slice;
 }
 /*
 * We calculate the vruntime slice of a to be inserted task
 *
- * vs = s*rw/w = p
+ * vs = s/w = p/rw
 */
 static u64 sched_vslice_add(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
        unsigned long nr_running = cfs_rq->nr_running;
+        unsigned long weight;
+        u64 vslice;
        if (!se->on_rq)
                nr_running++;
-        return __sched_period(nr_running);
+        vslice = __sched_period(nr_running);
-}
-/*
- * The goal of calc_delta_asym() is to be asymmetrically around NICE_0_LOAD, in
- * that it favours >=0 over <0.
- *
- *   -20         |
- *               |
- *     0 --------+-------
- *             .'
- *    19     .'
- *
- */
-static unsigned long
-calc_delta_asym(unsigned long delta, struct sched_entity *se)
-{
-        struct load_weight lw = {
-                .weight = NICE_0_LOAD,
-                .inv_weight = 1UL << (WMULT_SHIFT-NICE_0_SHIFT)
-        };
        for_each_sched_entity(se) {
-                struct load_weight *se_lw = &se->load;
+                cfs_rq = cfs_rq_of(se);
-                if (se->load.weight < NICE_0_LOAD)
+                weight = cfs_rq->load.weight;
-                        se_lw = &lw;
+                if (!se->on_rq)
+                        weight += se->load.weight;
-                delta = calc_delta_mine(delta,
+                vslice *= NICE_0_LOAD;
-                                cfs_rq_of(se)->load.weight, se_lw);
+                do_div(vslice, weight);
        }
-        return delta;
+        return vslice;
 }
 /*
@@ -454,7 +419,11 @@ __update_curr(struct cfs_rq *cfs_rq, struct sched_entity *curr,
        curr->sum_exec_runtime += delta_exec;
        schedstat_add(cfs_rq, exec_clock, delta_exec);
-        delta_exec_weighted = calc_delta_fair(delta_exec, curr);
+        delta_exec_weighted = delta_exec;
+        if (unlikely(curr->load.weight != NICE_0_LOAD)) {
+                delta_exec_weighted = calc_delta_fair(delta_exec_weighted,
+                                                        &curr->load);
+        }
        curr->vruntime += delta_exec_weighted;
 }
@@ -541,27 +510,10 @@ update_stats_curr_start(struct cfs_rq *cfs_rq, struct sched_entity *se)
 * Scheduling class queueing methods:
 */
-#if defined CONFIG_SMP && defined CONFIG_FAIR_GROUP_SCHED
-static void
-add_cfs_task_weight(struct cfs_rq *cfs_rq, unsigned long weight)
-{
-        cfs_rq->task_weight += weight;
-}
-#else
-static inline void
-add_cfs_task_weight(struct cfs_rq *cfs_rq, unsigned long weight)
-{
-}
-#endif
 static void
 account_entity_enqueue(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
        update_load_add(&cfs_rq->load, se->load.weight);
-        if (!parent_entity(se))
-                inc_cpu_load(rq_of(cfs_rq), se->load.weight);
-        if (entity_is_task(se))
-                add_cfs_task_weight(cfs_rq, se->load.weight);
        cfs_rq->nr_running++;
        se->on_rq = 1;
        list_add(&se->group_node, &cfs_rq->tasks);
@@ -571,10 +523,6 @@ static void
 account_entity_dequeue(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
        update_load_sub(&cfs_rq->load, se->load.weight);
-        if (!parent_entity(se))
-                dec_cpu_load(rq_of(cfs_rq), se->load.weight);
-        if (entity_is_task(se))
-                add_cfs_task_weight(cfs_rq, -se->load.weight);
        cfs_rq->nr_running--;
        se->on_rq = 0;
        list_del_init(&se->group_node);
@@ -661,17 +609,8 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
        if (!initial) {
                /* sleeps upto a single latency don't count. */
-                if (sched_feat(NEW_FAIR_SLEEPERS)) {
+                if (sched_feat(NEW_FAIR_SLEEPERS))
-                        unsigned long thresh = sysctl_sched_latency;
+                        vruntime -= sysctl_sched_latency;
-                        /*
-                         * convert the sleeper threshold into virtual time
-                         */
-                        if (sched_feat(NORMALIZED_SLEEPER))
-                                thresh = calc_delta_fair(thresh, se);
-                        vruntime -= thresh;
-                }
                /* ensure we never gain time by being placed backwards. */
                vruntime = max_vruntime(se->vruntime, vruntime);
@@ -1057,16 +996,27 @@ wake_affine(struct rq *rq, struct sched_domain *this_sd, struct rq *this_rq,
        struct task_struct *curr = this_rq->curr;
        unsigned long tl = this_load;
        unsigned long tl_per_task;
+        int balanced;
-        if (!(this_sd->flags & SD_WAKE_AFFINE))
+        if (!(this_sd->flags & SD_WAKE_AFFINE) || !sched_feat(AFFINE_WAKEUPS))
                return 0;
        /*
+         * If sync wakeup then subtract the (maximum possible)
+         * effect of the currently running task from the load
+         * of the current CPU:
+         */
+        if (sync)
+                tl -= current->se.load.weight;
+        balanced = 100*(tl + p->se.load.weight) <= imbalance*load;
+        /*
         * If the currently running task will sleep within
         * a reasonable amount of time then attract this newly
         * woken task:
         */
-        if (sync && curr->sched_class == &fair_sched_class) {
+        if (sync && balanced && curr->sched_class == &fair_sched_class) {
                if (curr->se.avg_overlap < sysctl_sched_migration_cost &&
                                p->se.avg_overlap < sysctl_sched_migration_cost)
                        return 1;
@@ -1075,16 +1025,8 @@ wake_affine(struct rq *rq, struct sched_domain *this_sd, struct rq *this_rq,
        schedstat_inc(p, se.nr_wakeups_affine_attempts);
        tl_per_task = cpu_avg_load_per_task(this_cpu);
-        /*
-         * If sync wakeup then subtract the (maximum possible)
-         * effect of the currently running task from the load
-         * of the current CPU:
-         */
-        if (sync)
-                tl -= current->se.load.weight;
        if ((tl <= load && tl + target_load(prev_cpu, idx) <= tl_per_task) ||
-                        100*(tl + p->se.load.weight) <= imbalance*load) {
+                        balanced) {
                /*
                 * This domain has SD_WAKE_AFFINE and
                 * p is cache cold in this domain, and
@@ -1169,10 +1111,11 @@ static unsigned long wakeup_gran(struct sched_entity *se)
        unsigned long gran = sysctl_sched_wakeup_granularity;
        /*
-         * More easily preempt - nice tasks, while not making it harder for
+         * More easily preempt - nice tasks, while not making
-         * + nice tasks.
+         * it harder for + nice tasks.
         */
-        gran = calc_delta_asym(sysctl_sched_wakeup_granularity, se);
+        if (unlikely(se->load.weight > NICE_0_LOAD))
+                gran = calc_delta_fair(gran, &se->load);
        return gran;
 }
@@ -1366,90 +1309,75 @@ static struct task_struct *load_balance_next_fair(void *arg)
        return __load_balance_iterator(cfs_rq, cfs_rq->balance_iterator);
 }
-static unsigned long
+#ifdef CONFIG_FAIR_GROUP_SCHED
-__load_balance_fair(struct rq *this_rq, int this_cpu, struct rq *busiest,
+static int cfs_rq_best_prio(struct cfs_rq *cfs_rq)
-                unsigned long max_load_move, struct sched_domain *sd,
-                enum cpu_idle_type idle, int *all_pinned, int *this_best_prio,
-                struct cfs_rq *cfs_rq)
 {
-        struct rq_iterator cfs_rq_iterator;
+        struct sched_entity *curr;
+        struct task_struct *p;
-        cfs_rq_iterator.start = load_balance_start_fair;
+        if (!cfs_rq->nr_running || !first_fair(cfs_rq))
-        cfs_rq_iterator.next = load_balance_next_fair;
+                return MAX_PRIO;
-        cfs_rq_iterator.arg = cfs_rq;
+        curr = cfs_rq->curr;
+        if (!curr)
+                curr = __pick_next_entity(cfs_rq);
+        p = task_of(curr);
-        return balance_tasks(this_rq, this_cpu, busiest,
+        return p->prio;
-                        max_load_move, sd, idle, all_pinned,
-                        this_best_prio, &cfs_rq_iterator);
 }
+#endif
-#ifdef CONFIG_FAIR_GROUP_SCHED
 static unsigned long
 load_balance_fair(struct rq *this_rq, int this_cpu, struct rq *busiest,
                  unsigned long max_load_move,
                  struct sched_domain *sd, enum cpu_idle_type idle,
                  int *all_pinned, int *this_best_prio)
 {
+        struct cfs_rq *busy_cfs_rq;
        long rem_load_move = max_load_move;
-        int busiest_cpu = cpu_of(busiest);
+        struct rq_iterator cfs_rq_iterator;
-        struct task_group *tg;
-        rcu_read_lock();
-        list_for_each_entry(tg, &task_groups, list) {
-                long imbalance;
-                unsigned long this_weight, busiest_weight;
-                long rem_load, max_load, moved_load;
-                /*
-                 * empty group
-                 */
-                if (!aggregate(tg, sd)->task_weight)
-                        continue;
-                rem_load = rem_load_move * aggregate(tg, sd)->rq_weight;
-                rem_load /= aggregate(tg, sd)->load + 1;
-                this_weight = tg->cfs_rq[this_cpu]->task_weight;
-                busiest_weight = tg->cfs_rq[busiest_cpu]->task_weight;
-                imbalance = (busiest_weight - this_weight) / 2;
+        cfs_rq_iterator.start = load_balance_start_fair;
+        cfs_rq_iterator.next = load_balance_next_fair;
-                if (imbalance < 0)
+        for_each_leaf_cfs_rq(busiest, busy_cfs_rq) {
-                        imbalance = busiest_weight;
+#ifdef CONFIG_FAIR_GROUP_SCHED
+                struct cfs_rq *this_cfs_rq;
+                long imbalance;
+                unsigned long maxload;
-                max_load = max(rem_load, imbalance);
+                this_cfs_rq = cpu_cfs_rq(busy_cfs_rq, this_cpu);
-                moved_load = __load_balance_fair(this_rq, this_cpu, busiest,
-                                max_load, sd, idle, all_pinned, this_best_prio,
-                                tg->cfs_rq[busiest_cpu]);
-                if (!moved_load)
+                imbalance = busy_cfs_rq->load.weight - this_cfs_rq->load.weight;
+                /* Don't pull if this_cfs_rq has more load than busy_cfs_rq */
+                if (imbalance <= 0)
                        continue;
-                move_group_shares(tg, sd, busiest_cpu, this_cpu);
+                /* Don't pull more than imbalance/2 */
+                imbalance /= 2;
+                maxload = min(rem_load_move, imbalance);
-                moved_load *= aggregate(tg, sd)->load;
+                *this_best_prio = cfs_rq_best_prio(this_cfs_rq);
-                moved_load /= aggregate(tg, sd)->rq_weight + 1;
+#else
+# define maxload rem_load_move
+#endif
+                /*
+                 * pass busy_cfs_rq argument into
+                 * load_balance_[start|next]_fair iterators
+                 */
+                cfs_rq_iterator.arg = busy_cfs_rq;
+                rem_load_move -= balance_tasks(this_rq, this_cpu, busiest,
+                                               maxload, sd, idle, all_pinned,
+                                               this_best_prio,
+                                               &cfs_rq_iterator);
-                rem_load_move -= moved_load;
+                if (rem_load_move <= 0)
-                if (rem_load_move < 0)
                        break;
        }
-        rcu_read_unlock();
        return max_load_move - rem_load_move;
 }
-#else
-static unsigned long
-load_balance_fair(struct rq *this_rq, int this_cpu, struct rq *busiest,
-                  unsigned long max_load_move,
-                  struct sched_domain *sd, enum cpu_idle_type idle,
-                  int *all_pinned, int *this_best_prio)
-{
-        return __load_balance_fair(this_rq, this_cpu, busiest,
-                        max_load_move, sd, idle, all_pinned,
-                        this_best_prio, &busiest->cfs);
-}
-#endif
 static int
 move_one_task_fair(struct rq *this_rq, int this_cpu, struct rq *busiest,
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index 060e87b0cb1c..3432d573205d 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -513,8 +513,6 @@ static void enqueue_task_rt(struct rq *rq, struct task_struct *p, int wakeup)
         */
        for_each_sched_rt_entity(rt_se)
                enqueue_rt_entity(rt_se);
-        inc_cpu_load(rq, p->se.load.weight);
 }
 static void dequeue_task_rt(struct rq *rq, struct task_struct *p, int sleep)
@@ -534,8 +532,6 @@ static void dequeue_task_rt(struct rq *rq, struct task_struct *p, int sleep)
                if (rt_rq && rt_rq->rt_nr_running)
                        enqueue_rt_entity(rt_se);
        }
-        dec_cpu_load(rq, p->se.load.weight);
 }
 /*
diff --git a/kernel/sched_stats.h b/kernel/sched_stats.h
index 5bae2e0c3ff2..a38878e0e49d 100644
--- a/kernel/sched_stats.h
+++ b/kernel/sched_stats.h
@@ -67,6 +67,7 @@ static int show_schedstat(struct seq_file *seq, void *v)
                preempt_enable();
 #endif
        }
+        kfree(mask_str);
        return 0;
 }
diff --git a/kernel/signal.c b/kernel/signal.c
index 72bb4f51f963..6c0958e52ea7 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -231,6 +231,40 @@ void flush_signals(struct task_struct *t)
        spin_unlock_irqrestore(&t->sighand->siglock, flags);
 }
+static void __flush_itimer_signals(struct sigpending *pending)
+{
+        sigset_t signal, retain;
+        struct sigqueue *q, *n;
+        signal = pending->signal;
+        sigemptyset(&retain);
+        list_for_each_entry_safe(q, n, &pending->list, list) {
+                int sig = q->info.si_signo;
+                if (likely(q->info.si_code != SI_TIMER)) {
+                        sigaddset(&retain, sig);
+                } else {
+                        sigdelset(&signal, sig);
+                        list_del_init(&q->list);
+                        __sigqueue_free(q);
+                }
+        }
+        sigorsets(&pending->signal, &signal, &retain);
+}
+void flush_itimer_signals(void)
+{
+        struct task_struct *tsk = current;
+        unsigned long flags;
+        spin_lock_irqsave(&tsk->sighand->siglock, flags);
+        __flush_itimer_signals(&tsk->pending);
+        __flush_itimer_signals(&tsk->signal->shared_pending);
+        spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
+}
 void ignore_signals(struct task_struct *t)
 {
        int i;
@@ -1240,17 +1274,22 @@ void sigqueue_free(struct sigqueue *q)
        BUG_ON(!(q->flags & SIGQUEUE_PREALLOC));
        /*
-         * If the signal is still pending remove it from the
+         * We must hold ->siglock while testing q->list
-         * pending queue. We must hold ->siglock while testing
+         * to serialize with collect_signal() or with
-         * q->list to serialize with collect_signal().
+         * __exit_signal()->flush_sigqueue().
         */
        spin_lock_irqsave(lock, flags);
+        q->flags &= ~SIGQUEUE_PREALLOC;
+        /*
+         * If it is queued it will be freed when dequeued,
+         * like the "regular" sigqueue.
+         */
        if (!list_empty(&q->list))
-                list_del_init(&q->list);
+                q = NULL;
        spin_unlock_irqrestore(lock, flags);
-        q->flags &= ~SIGQUEUE_PREALLOC;
+        if (q)
-        __sigqueue_free(q);
+                __sigqueue_free(q);
 }
 int send_sigqueue(struct sigqueue *q, struct task_struct *t, int group)
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 0101aeef7ed7..b7350bbfb076 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -62,8 +62,7 @@ static int stopmachine(void *cpu)
                 * help our sisters onto their CPUs. */
                if (!prepared && !irqs_disabled)
                        yield();
-                else
+                cpu_relax();
-                        cpu_relax();
        }
        /* Ack: we are exiting. */
@@ -106,8 +105,10 @@ static int stop_machine(void)
        }
        /* Wait for them all to come to life. */
-        while (atomic_read(&stopmachine_thread_ack) != stopmachine_num_threads)
+        while (atomic_read(&stopmachine_thread_ack) != stopmachine_num_threads) {
                yield();
+                cpu_relax();
+        }
        /* If some failed, kill them all. */
        if (ret < 0) {
diff --git a/kernel/sys.c b/kernel/sys.c
index 895d2d4c9493..14e97282eb6c 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1652,7 +1652,7 @@ asmlinkage long sys_umask(int mask)
 asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
                          unsigned long arg4, unsigned long arg5)
 {
-        long uninitialized_var(error);
+        long error = 0;
        if (security_task_prctl(option, arg2, arg3, arg4, arg5, &error))
                return error;
@@ -1701,9 +1701,7 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
                        error = PR_TIMING_STATISTICAL;
                        break;
                case PR_SET_TIMING:
-                        if (arg2 == PR_TIMING_STATISTICAL)
+                        if (arg2 != PR_TIMING_STATISTICAL)
-                                error = 0;
-                        else
                                error = -EINVAL;
                        break;
diff --git a/lib/bitrev.c b/lib/bitrev.c
index 989aff73f881..3956203456d4 100644
--- a/lib/bitrev.c
+++ b/lib/bitrev.c
@@ -42,10 +42,11 @@ const u8 byte_rev_table[256] = {
 };
 EXPORT_SYMBOL_GPL(byte_rev_table);
-static __always_inline u16 bitrev16(u16 x)
+u16 bitrev16(u16 x)
 {
        return (bitrev8(x & 0xff) << 8) | bitrev8(x >> 8);
 }
+EXPORT_SYMBOL(bitrev16);
 /**
 * bitrev32 - reverse the order of bits in a u32 value
diff --git a/lib/div64.c b/lib/div64.c
index bb5bd0c0f030..a111eb8de9cf 100644
--- a/lib/div64.c
+++ b/lib/div64.c
@@ -98,3 +98,13 @@ EXPORT_SYMBOL(div64_u64);
 #endif
 #endif /* BITS_PER_LONG == 32 */
+/*
+ * Iterative div/mod for use when dividend is not expected to be much
+ * bigger than divisor.
+ */
+u32 iter_div_u64_rem(u64 dividend, u32 divisor, u64 *remainder)
+{
+        return __iter_div_u64_rem(dividend, divisor, remainder);
+}
+EXPORT_SYMBOL(iter_div_u64_rem);
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index bd521716ab1a..169a2f8dabcc 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -88,6 +88,57 @@ static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
        return root->gfp_mask & __GFP_BITS_MASK;
 }
+static inline void tag_set(struct radix_tree_node *node, unsigned int tag,
+                int offset)
+{
+        __set_bit(offset, node->tags[tag]);
+}
+static inline void tag_clear(struct radix_tree_node *node, unsigned int tag,
+                int offset)
+{
+        __clear_bit(offset, node->tags[tag]);
+}
+static inline int tag_get(struct radix_tree_node *node, unsigned int tag,
+                int offset)
+{
+        return test_bit(offset, node->tags[tag]);
+}
+static inline void root_tag_set(struct radix_tree_root *root, unsigned int tag)
+{
+        root->gfp_mask |= (__force gfp_t)(1 << (tag + __GFP_BITS_SHIFT));
+}
+static inline void root_tag_clear(struct radix_tree_root *root, unsigned int tag)
+{
+        root->gfp_mask &= (__force gfp_t)~(1 << (tag + __GFP_BITS_SHIFT));
+}
+static inline void root_tag_clear_all(struct radix_tree_root *root)
+{
+        root->gfp_mask &= __GFP_BITS_MASK;
+}
+static inline int root_tag_get(struct radix_tree_root *root, unsigned int tag)
+{
+        return (__force unsigned)root->gfp_mask & (1 << (tag + __GFP_BITS_SHIFT));
+}
+/*
+ * Returns 1 if any slot in the node has this tag set.
+ * Otherwise returns 0.
+ */
+static inline int any_tag_set(struct radix_tree_node *node, unsigned int tag)
+{
+        int idx;
+        for (idx = 0; idx < RADIX_TREE_TAG_LONGS; idx++) {
+                if (node->tags[tag][idx])
+                        return 1;
+        }
+        return 0;
+}
 /*
 * This assumes that the caller has performed appropriate preallocation, and
 * that the caller has pinned this thread of control to the current CPU.
@@ -124,6 +175,17 @@ static void radix_tree_node_rcu_free(struct rcu_head *head)
 {
        struct radix_tree_node *node =
                        container_of(head, struct radix_tree_node, rcu_head);
+        /*
+         * must only free zeroed nodes into the slab. radix_tree_shrink
+         * can leave us with a non-NULL entry in the first slot, so clear
+         * that here to make sure.
+         */
+        tag_clear(node, 0, 0);
+        tag_clear(node, 1, 0);
+        node->slots[0] = NULL;
+        node->count = 0;
        kmem_cache_free(radix_tree_node_cachep, node);
 }
@@ -165,59 +227,6 @@ out:
 }
 EXPORT_SYMBOL(radix_tree_preload);
-static inline void tag_set(struct radix_tree_node *node, unsigned int tag,
-                int offset)
-{
-        __set_bit(offset, node->tags[tag]);
-}
-static inline void tag_clear(struct radix_tree_node *node, unsigned int tag,
-                int offset)
-{
-        __clear_bit(offset, node->tags[tag]);
-}
-static inline int tag_get(struct radix_tree_node *node, unsigned int tag,
-                int offset)
-{
-        return test_bit(offset, node->tags[tag]);
-}
-static inline void root_tag_set(struct radix_tree_root *root, unsigned int tag)
-{
-        root->gfp_mask |= (__force gfp_t)(1 << (tag + __GFP_BITS_SHIFT));
-}
-static inline void root_tag_clear(struct radix_tree_root *root, unsigned int tag)
-{
-        root->gfp_mask &= (__force gfp_t)~(1 << (tag + __GFP_BITS_SHIFT));
-}
-static inline void root_tag_clear_all(struct radix_tree_root *root)
-{
-        root->gfp_mask &= __GFP_BITS_MASK;
-}
-static inline int root_tag_get(struct radix_tree_root *root, unsigned int tag)
-{
-        return (__force unsigned)root->gfp_mask & (1 << (tag + __GFP_BITS_SHIFT));
-}
-/*
- * Returns 1 if any slot in the node has this tag set.
- * Otherwise returns 0.
- */
-static inline int any_tag_set(struct radix_tree_node *node, unsigned int tag)
-{
-        int idx;
-        for (idx = 0; idx < RADIX_TREE_TAG_LONGS; idx++) {
-                if (node->tags[tag][idx])
-                        return 1;
-        }
-        return 0;
-}
 /*
 *      Return the maximum key which can be store into a
 *      radix tree with height HEIGHT.
@@ -930,11 +939,6 @@ static inline void radix_tree_shrink(struct radix_tree_root *root)
                        newptr = radix_tree_ptr_to_indirect(newptr);
                root->rnode = newptr;
                root->height--;
-                /* must only free zeroed nodes into the slab */
-                tag_clear(to_free, 0, 0);
-                tag_clear(to_free, 1, 0);
-                to_free->slots[0] = NULL;
-                to_free->count = 0;
                radix_tree_node_free(to_free);
        }
 }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index bbf953eeb58b..ab171274ef21 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -785,7 +785,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                        continue;
                spin_lock(&dst->page_table_lock);
-                spin_lock(&src->page_table_lock);
+                spin_lock_nested(&src->page_table_lock, SINGLE_DEPTH_NESTING);
                if (!huge_pte_none(huge_ptep_get(src_pte))) {
                        if (cow)
                                huge_ptep_set_wrprotect(src, addr, src_pte);
diff --git a/mm/memory.c b/mm/memory.c
index fb5608a120ed..19e0ae9beecb 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2295,8 +2295,6 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
        vmf.flags = flags;
        vmf.page = NULL;
-        BUG_ON(vma->vm_flags & VM_PFNMAP);
        ret = vma->vm_ops->fault(vma, &vmf);
        if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE)))
                return ret;
diff --git a/mm/mmap.c b/mm/mmap.c
index fac66337da2a..3354fdd83d4b 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -80,7 +80,7 @@ EXPORT_SYMBOL(vm_get_page_prot);
 int sysctl_overcommit_memory = OVERCOMMIT_GUESS;  /* heuristic overcommit */
 int sysctl_overcommit_ratio = 50;       /* default is 50% */
 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
-atomic_t vm_committed_space = ATOMIC_INIT(0);
+atomic_long_t vm_committed_space = ATOMIC_LONG_INIT(0);
 /*
 * Check that a process has enough memory to allocate a new virtual
@@ -177,7 +177,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
         * cast `allowed' as a signed long because vm_committed_space
         * sometimes has a negative value
         */
-        if (atomic_read(&vm_committed_space) < (long)allowed)
+        if (atomic_long_read(&vm_committed_space) < (long)allowed)
                return 0;
 error:
        vm_unacct_memory(pages);
@@ -245,10 +245,16 @@ asmlinkage unsigned long sys_brk(unsigned long brk)
        unsigned long rlim, retval;
        unsigned long newbrk, oldbrk;
        struct mm_struct *mm = current->mm;
+        unsigned long min_brk;
        down_write(&mm->mmap_sem);
-        if (brk < mm->start_brk)
+#ifdef CONFIG_COMPAT_BRK
+        min_brk = mm->end_code;
+#else
+        min_brk = mm->start_brk;
+#endif
+        if (brk < min_brk)
                goto out;
        /*
diff --git a/mm/nommu.c b/mm/nommu.c
index ef8c62cec697..4462b6a3fcb9 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -39,7 +39,7 @@ struct page *mem_map;
 unsigned long max_mapnr;
 unsigned long num_physpages;
 unsigned long askedalloc, realalloc;
-atomic_t vm_committed_space = ATOMIC_INIT(0);
+atomic_long_t vm_committed_space = ATOMIC_LONG_INIT(0);
 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
 int sysctl_overcommit_ratio = 50; /* default is 50% */
 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
@@ -109,16 +109,23 @@ unsigned int kobjsize(const void *objp)
         * If the object we have should not have ksize performed on it,
         * return size of 0
         */
-        if (!objp || (unsigned long)objp >= memory_end || !((page = virt_to_page(objp))))
+        if (!objp || !virt_addr_valid(objp))
                return 0;
+        page = virt_to_head_page(objp);
+        /*
+         * If the allocator sets PageSlab, we know the pointer came from
+         * kmalloc().
+         */
        if (PageSlab(page))
                return ksize(objp);
-        BUG_ON(page->index < 0);
+        /*
-        BUG_ON(page->index >= MAX_ORDER);
+         * The ksize() function is only guaranteed to work for pointers
+         * returned by kmalloc(). So handle arbitrary pointers here.
-        return (PAGE_SIZE << page->index);
+         */
+        return PAGE_SIZE << compound_order(page);
 }
 /*
@@ -1410,7 +1417,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
         * cast `allowed' as a signed long because vm_committed_space
         * sometimes has a negative value
         */
-        if (atomic_read(&vm_committed_space) < (long)allowed)
+        if (atomic_long_read(&vm_committed_space) < (long)allowed)
                return 0;
 error:
        vm_unacct_memory(pages);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 63835579323a..2f552955a02f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -237,16 +237,7 @@ static void bad_page(struct page *page)
        printk(KERN_EMERG "Trying to fix it up, but a reboot is needed\n"
                KERN_EMERG "Backtrace:\n");
        dump_stack();
-        page->flags &= ~(1 << PG_lru    |
+        page->flags &= ~PAGE_FLAGS_CLEAR_WHEN_BAD;
-                        1 << PG_private |
-                        1 << PG_locked  |
-                        1 << PG_active  |
-                        1 << PG_dirty   |
-                        1 << PG_reclaim |
-                        1 << PG_slab    |
-                        1 << PG_swapcache |
-                        1 << PG_writeback |
-                        1 << PG_buddy );
        set_page_count(page, 0);
        reset_page_mapcount(page);
        page->mapping = NULL;
@@ -463,16 +454,7 @@ static inline int free_pages_check(struct page *page)
                (page->mapping != NULL)  |
                (page_get_page_cgroup(page) != NULL) |
                (page_count(page) != 0)  |
-                (page->flags & (
+                (page->flags & PAGE_FLAGS_CHECK_AT_FREE)))
-                        1 << PG_lru     |
-                        1 << PG_private |
-                        1 << PG_locked  |
-                        1 << PG_active  |
-                        1 << PG_slab    |
-                        1 << PG_swapcache |
-                        1 << PG_writeback |
-                        1 << PG_reserved |
-                        1 << PG_buddy ))))
                bad_page(page);
        if (PageDirty(page))
                __ClearPageDirty(page);
@@ -616,17 +598,7 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
                (page->mapping != NULL)  |
                (page_get_page_cgroup(page) != NULL) |
                (page_count(page) != 0)  |
-                (page->flags & (
+                (page->flags & PAGE_FLAGS_CHECK_AT_PREP)))
-                        1 << PG_lru     |
-                        1 << PG_private |
-                        1 << PG_locked  |
-                        1 << PG_active  |
-                        1 << PG_dirty   |
-                        1 << PG_slab    |
-                        1 << PG_swapcache |
-                        1 << PG_writeback |
-                        1 << PG_reserved |
-                        1 << PG_buddy ))))
                bad_page(page);
        /*
@@ -1396,6 +1368,9 @@ get_page_from_freelist(gfp_t gfp_mask, nodemask_t *nodemask, unsigned int order,
        (void)first_zones_zonelist(zonelist, high_zoneidx, nodemask,
                                                        &preferred_zone);
+        if (!preferred_zone)
+                return NULL;
        classzone_idx = zone_idx(preferred_zone);
 zonelist_scan:
@@ -2804,7 +2779,7 @@ int zone_wait_table_init(struct zone *zone, unsigned long zone_size_pages)
        alloc_size = zone->wait_table_hash_nr_entries
                                        * sizeof(wait_queue_head_t);
-        if (system_state == SYSTEM_BOOTING) {
+        if (!slab_is_available()) {
                zone->wait_table = (wait_queue_head_t *)
                        alloc_bootmem_node(pgdat, alloc_size);
        } else {
@@ -3378,7 +3353,8 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat,
                 * is used by this zone for memmap. This affects the watermark
                 * and per-cpu initialisations
                 */
-                memmap_pages = (size * sizeof(struct page)) >> PAGE_SHIFT;
+                memmap_pages =
+                        PAGE_ALIGN(size * sizeof(struct page)) >> PAGE_SHIFT;
                if (realsize >= memmap_pages) {
                        realsize -= memmap_pages;
                        printk(KERN_DEBUG
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 0afd2387e507..d5878bed7841 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -3,14 +3,14 @@
 #include <linux/sched.h>
 static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
-                          const struct mm_walk *walk, void *private)
+                          struct mm_walk *walk)
 {
        pte_t *pte;
        int err = 0;
        pte = pte_offset_map(pmd, addr);
        for (;;) {
-                err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, private);
+                err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, walk);
                if (err)
                       break;
                addr += PAGE_SIZE;
@@ -24,7 +24,7 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 }
 static int walk_pmd_range(pud_t *pud, unsigned long addr, unsigned long end,
-                          const struct mm_walk *walk, void *private)
+                          struct mm_walk *walk)
 {
        pmd_t *pmd;
        unsigned long next;
@@ -35,15 +35,15 @@ static int walk_pmd_range(pud_t *pud, unsigned long addr, unsigned long end,
                next = pmd_addr_end(addr, end);
                if (pmd_none_or_clear_bad(pmd)) {
                        if (walk->pte_hole)
-                                err = walk->pte_hole(addr, next, private);
+                                err = walk->pte_hole(addr, next, walk);
                        if (err)
                                break;
                        continue;
                }
                if (walk->pmd_entry)
-                        err = walk->pmd_entry(pmd, addr, next, private);
+                        err = walk->pmd_entry(pmd, addr, next, walk);
                if (!err && walk->pte_entry)
-                        err = walk_pte_range(pmd, addr, next, walk, private);
+                        err = walk_pte_range(pmd, addr, next, walk);
                if (err)
                        break;
        } while (pmd++, addr = next, addr != end);
@@ -52,7 +52,7 @@ static int walk_pmd_range(pud_t *pud, unsigned long addr, unsigned long end,
 }
 static int walk_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end,
-                          const struct mm_walk *walk, void *private)
+                          struct mm_walk *walk)
 {
        pud_t *pud;
        unsigned long next;
@@ -63,15 +63,15 @@ static int walk_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end,
                next = pud_addr_end(addr, end);
                if (pud_none_or_clear_bad(pud)) {
                        if (walk->pte_hole)
-                                err = walk->pte_hole(addr, next, private);
+                                err = walk->pte_hole(addr, next, walk);
                        if (err)
                                break;
                        continue;
                }
                if (walk->pud_entry)
-                        err = walk->pud_entry(pud, addr, next, private);
+                        err = walk->pud_entry(pud, addr, next, walk);
                if (!err && (walk->pmd_entry || walk->pte_entry))
-                        err = walk_pmd_range(pud, addr, next, walk, private);
+                        err = walk_pmd_range(pud, addr, next, walk);
                if (err)
                        break;
        } while (pud++, addr = next, addr != end);
@@ -85,15 +85,15 @@ static int walk_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end,
 * @addr: starting address
 * @end: ending address
 * @walk: set of callbacks to invoke for each level of the tree
- * @private: private data passed to the callback function
 *
 * Recursively walk the page table for the memory area in a VMA,
 * calling supplied callbacks. Callbacks are called in-order (first
 * PGD, first PUD, first PMD, first PTE, second PTE... second PMD,
 * etc.). If lower-level callbacks are omitted, walking depth is reduced.
 *
- * Each callback receives an entry pointer, the start and end of the
+ * Each callback receives an entry pointer and the start and end of the
- * associated range, and a caller-supplied private data pointer.
+ * associated range, and a copy of the original mm_walk for access to
+ * the ->private or ->mm fields.
 *
 * No locks are taken, but the bottom level iterator will map PTE
 * directories from highmem if necessary.
@@ -101,9 +101,8 @@ static int walk_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end,
 * If any callback returns a non-zero value, the walk is aborted and
 * the return value is propagated back to the caller. Otherwise 0 is returned.
 */
-int walk_page_range(const struct mm_struct *mm,
+int walk_page_range(unsigned long addr, unsigned long end,
-                    unsigned long addr, unsigned long end,
+                    struct mm_walk *walk)
-                    const struct mm_walk *walk, void *private)
 {
        pgd_t *pgd;
        unsigned long next;
@@ -112,21 +111,24 @@ int walk_page_range(const struct mm_struct *mm,
        if (addr >= end)
                return err;
-        pgd = pgd_offset(mm, addr);
+        if (!walk->mm)
+                return -EINVAL;
+        pgd = pgd_offset(walk->mm, addr);
        do {
                next = pgd_addr_end(addr, end);
                if (pgd_none_or_clear_bad(pgd)) {
                        if (walk->pte_hole)
-                                err = walk->pte_hole(addr, next, private);
+                                err = walk->pte_hole(addr, next, walk);
                        if (err)
                                break;
                        continue;
                }
                if (walk->pgd_entry)
-                        err = walk->pgd_entry(pgd, addr, next, private);
+                        err = walk->pgd_entry(pgd, addr, next, walk);
                if (!err &&
                    (walk->pud_entry || walk->pmd_entry || walk->pte_entry))
-                        err = walk_pud_range(pgd, addr, next, walk, private);
+                        err = walk_pud_range(pgd, addr, next, walk);
                if (err)
                        break;
        } while (pgd++, addr = next, addr != end);
diff --git a/mm/slob.c b/mm/slob.c
index 6038cbadf796..a3ad6671adf1 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -469,8 +469,9 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
                        return ZERO_SIZE_PTR;
                m = slob_alloc(size + align, gfp, align, node);
-                if (m)
+                if (!m)
-                        *m = size;
+                        return NULL;
+                *m = size;
                return (void *)m + align;
        } else {
                void *ret;
diff --git a/mm/slub.c b/mm/slub.c
index a505a828ef41..0987d1cd943c 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2726,9 +2726,10 @@ size_t ksize(const void *object)
        page = virt_to_head_page(object);
-        if (unlikely(!PageSlab(page)))
+        if (unlikely(!PageSlab(page))) {
+                WARN_ON(!PageCompound(page));
                return PAGE_SIZE << compound_order(page);
+        }
        s = page->slab;
 #ifdef CONFIG_SLUB_DEBUG
diff --git a/mm/swap.c b/mm/swap.c
index 91e194445a5e..45c9f25a8a3b 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -503,7 +503,7 @@ void vm_acct_memory(long pages)
        local = &__get_cpu_var(committed_space);
        *local += pages;
        if (*local > ACCT_THRESHOLD || *local < -ACCT_THRESHOLD) {
-                atomic_add(*local, &vm_committed_space);
+                atomic_long_add(*local, &vm_committed_space);
                *local = 0;
        }
        preempt_enable();
@@ -520,7 +520,7 @@ static int cpu_swap_callback(struct notifier_block *nfb,
        committed = &per_cpu(committed_space, (long)hcpu);
        if (action == CPU_DEAD || action == CPU_DEAD_FROZEN) {
-                atomic_add(*committed, &vm_committed_space);
+                atomic_long_add(*committed, &vm_committed_space);
                *committed = 0;
                drain_cpu_pagevecs((long)hcpu);
        }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 9a29901ad3b3..967d30ccd92b 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1307,7 +1307,7 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
                                        struct scan_control *sc)
 {
        int priority;
-        int ret = 0;
+        unsigned long ret = 0;
        unsigned long total_scanned = 0;
        unsigned long nr_reclaimed = 0;
        struct reclaim_state *reclaim_state = current->reclaim_state;
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 51961300b586..ab2225da0ee2 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -387,14 +387,8 @@ static void vlan_transfer_features(struct net_device *dev,
 {
        unsigned long old_features = vlandev->features;
-        if (dev->features & NETIF_F_VLAN_TSO) {
+        vlandev->features &= ~dev->vlan_features;
-                vlandev->features &= ~VLAN_TSO_FEATURES;
+        vlandev->features |= dev->features & dev->vlan_features;
-                vlandev->features |= dev->features & VLAN_TSO_FEATURES;
-        }
-        if (dev->features & NETIF_F_VLAN_CSUM) {
-                vlandev->features &= ~NETIF_F_ALL_CSUM;
-                vlandev->features |= dev->features & NETIF_F_ALL_CSUM;
-        }
        if (old_features != vlandev->features)
                netdev_features_change(vlandev);
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 79625696e86a..5229a72c7ea1 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -7,8 +7,6 @@
 #define VLAN_GRP_HASH_SIZE      (1 << VLAN_GRP_HASH_SHIFT)
 #define VLAN_GRP_HASH_MASK      (VLAN_GRP_HASH_SIZE - 1)
-#define VLAN_TSO_FEATURES       (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_SG)
 /*  Find a VLAN device by the MAC address of its Ethernet device, and
 *  it's VLAN ID.  The default configuration is to have VLAN's scope
 *  to be box-wide, so the MAC will be ignored.  The mac will only be
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index b1cfbaa88db2..5d055c242ed8 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -663,10 +663,7 @@ static int vlan_dev_init(struct net_device *dev)
                                          (1<<__LINK_STATE_DORMANT))) |
                      (1<<__LINK_STATE_PRESENT);
-        if (real_dev->features & NETIF_F_VLAN_TSO)
+        dev->features |= real_dev->features & real_dev->vlan_features;
-                dev->features |= real_dev->features & VLAN_TSO_FEATURES;
-        if (real_dev->features & NETIF_F_VLAN_CSUM)
-                dev->features |= real_dev->features & NETIF_F_ALL_CSUM;
        /* ipv6 shared card related stuff */
        dev->dev_id = real_dev->dev_id;
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index d8f215733175..034aa10a5198 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -64,20 +64,15 @@ void ax25_frames_acked(ax25_cb *ax25, unsigned short nr)
 void ax25_requeue_frames(ax25_cb *ax25)
 {
-        struct sk_buff *skb, *skb_prev = NULL;
+        struct sk_buff *skb;
        /*
         * Requeue all the un-ack-ed frames on the output queue to be picked
         * up by ax25_kick called from the timer. This arrangement handles the
         * possibility of an empty output queue.
         */
-        while ((skb = skb_dequeue(&ax25->ack_queue)) != NULL) {
+        while ((skb = skb_dequeue_tail(&ax25->ack_queue)) != NULL)
-                if (skb_prev == NULL)
+                skb_queue_head(&ax25->write_queue, skb);
-                        skb_queue_head(&ax25->write_queue, skb);
-                else
-                        skb_append(skb_prev, skb, &ax25->write_queue);
-                skb_prev = skb;
-        }
 }
 /*
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index eb62558e9b09..0c2c93735e93 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -423,8 +423,8 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
                rfcomm_dlc_lock(d);
                d->state = BT_CLOSED;
-                rfcomm_dlc_unlock(d);
                d->state_change(d, err);
+                rfcomm_dlc_unlock(d);
                skb_queue_purge(&d->tx_queue);
                rfcomm_dlc_unlink(d);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index c3f749abb2d0..c9191871c1e0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -566,11 +566,22 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
        if (dlc->state == BT_CLOSED) {
                if (!dev->tty) {
                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                                if (rfcomm_dev_get(dev->id) == NULL)
+                                /* Drop DLC lock here to avoid deadlock
+                                 * 1. rfcomm_dev_get will take rfcomm_dev_lock
+                                 *    but in rfcomm_dev_add there's lock order:
+                                 *    rfcomm_dev_lock -> dlc lock
+                                 * 2. rfcomm_dev_put will deadlock if it's
+                                 *    the last reference
+                                 */
+                                rfcomm_dlc_unlock(dlc);
+                                if (rfcomm_dev_get(dev->id) == NULL) {
+                                        rfcomm_dlc_lock(dlc);
                                        return;
+                                }
                                rfcomm_dev_del(dev);
                                rfcomm_dev_put(dev);
+                                rfcomm_dlc_lock(dlc);
                        }
                } else
                        tty_hangup(dev->tty);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5d9d7130bd6e..65f01f71b3f3 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1714,7 +1714,8 @@ static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
        return nla_nest_end(skb, nest);
 nla_put_failure:
-        return nla_nest_cancel(skb, nest);
+        nla_nest_cancel(skb, nest);
+        return -EMSGSIZE;
 }
 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
@@ -2057,9 +2058,9 @@ static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
                goto nla_put_failure;
        }
-        ci.ndm_used      = now - neigh->used;
+        ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
-        ci.ndm_confirmed = now - neigh->confirmed;
+        ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
-        ci.ndm_updated   = now - neigh->updated;
+        ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
        ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
        read_unlock_bh(&neigh->lock);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index cf857c4dc7b1..a9a77216310e 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -498,7 +498,8 @@ int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics)
        return nla_nest_end(skb, mx);
 nla_put_failure:
-        return nla_nest_cancel(skb, mx);
+        nla_nest_cancel(skb, mx);
+        return -EMSGSIZE;
 }
 int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst, u32 id,
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5c459f2b7985..1e556d312117 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1445,6 +1445,7 @@ done:
        if (spd.nr_pages) {
                int ret;
+                struct sock *sk = __skb->sk;
                /*
                 * Drop the socket lock, otherwise we have reverse
@@ -1455,9 +1456,9 @@ done:
                 * we call into ->sendpage() with the i_mutex lock held
                 * and networking will grab the socket lock.
                 */
-                release_sock(__skb->sk);
+                release_sock(sk);
                ret = splice_to_pipe(pipe, &spd);
-                lock_sock(__skb->sk);
+                lock_sock(sk);
                return ret;
        }
diff --git a/net/core/user_dma.c b/net/core/user_dma.c
index 0ad1cd57bc39..c77aff9c6eb3 100644
--- a/net/core/user_dma.c
+++ b/net/core/user_dma.c
@@ -75,7 +75,7 @@ int dma_skb_copy_datagram_iovec(struct dma_chan *chan,
                end = start + skb_shinfo(skb)->frags[i].size;
                copy = end - offset;
-                if ((copy = end - offset) > 0) {
+                if (copy > 0) {
                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
                        struct page *page = frag->page;
diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
index 6de4bd195d28..1e8be246ad15 100644
--- a/net/dccp/ackvec.c
+++ b/net/dccp/ackvec.c
@@ -290,12 +290,12 @@ int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
                while (1) {
                        const u8 len = dccp_ackvec_len(av, index);
-                        const u8 state = dccp_ackvec_state(av, index);
+                        const u8 av_state = dccp_ackvec_state(av, index);
                        /*
                         * valid packets not yet in av_buf have a reserved
                         * entry, with a len equal to 0.
                         */
-                        if (state == DCCP_ACKVEC_STATE_NOT_RECEIVED &&
+                        if (av_state == DCCP_ACKVEC_STATE_NOT_RECEIVED &&
                            len == 0 && delta == 0) { /* Found our
                                                         reserved seat! */
                                dccp_pr_debug("Found %llu reserved seat!\n",
@@ -325,31 +325,6 @@ out_duplicate:
        return -EILSEQ;
 }
-#ifdef CONFIG_IP_DCCP_DEBUG
-void dccp_ackvector_print(const u64 ackno, const unsigned char *vector, int len)
-{
-        dccp_pr_debug_cat("ACK vector len=%d, ackno=%llu |", len,
-                         (unsigned long long)ackno);
-        while (len--) {
-                const u8 state = (*vector & DCCP_ACKVEC_STATE_MASK) >> 6;
-                const u8 rl = *vector & DCCP_ACKVEC_LEN_MASK;
-                dccp_pr_debug_cat("%d,%d|", state, rl);
-                ++vector;
-        }
-        dccp_pr_debug_cat("\n");
-}
-void dccp_ackvec_print(const struct dccp_ackvec *av)
-{
-        dccp_ackvector_print(av->av_buf_ackno,
-                             av->av_buf + av->av_buf_head,
-                             av->av_vec_len);
-}
-#endif
 static void dccp_ackvec_throw_record(struct dccp_ackvec *av,
                                     struct dccp_ackvec_record *avr)
 {
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index cd61dea2eea1..a1929f33d703 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -159,8 +159,8 @@ static void ccid3_hc_tx_update_x(struct sock *sk, ktime_t *stamp)
        } else if (ktime_us_delta(now, hctx->ccid3hctx_t_ld)
                                - (s64)hctx->ccid3hctx_rtt >= 0) {
-                hctx->ccid3hctx_x =
+                hctx->ccid3hctx_x = min(2 * hctx->ccid3hctx_x, min_rate);
-                        max(min(2 * hctx->ccid3hctx_x, min_rate),
+                hctx->ccid3hctx_x = max(hctx->ccid3hctx_x,
                            scaled_div(((__u64)hctx->ccid3hctx_s) << 6,
                                       hctx->ccid3hctx_rtt));
                hctx->ccid3hctx_t_ld = now;
@@ -193,22 +193,17 @@ static inline void ccid3_hc_tx_update_s(struct ccid3_hc_tx_sock *hctx, int len)
 /*
 *      Update Window Counter using the algorithm from [RFC 4342, 8.1].
- *      The algorithm is not applicable if RTT < 4 microseconds.
+ *      As elsewhere, RTT > 0 is assumed by using dccp_sample_rtt().
 */
 static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hctx,
                                                ktime_t now)
 {
-        u32 quarter_rtts;
+        u32 delta = ktime_us_delta(now, hctx->ccid3hctx_t_last_win_count),
+            quarter_rtts = (4 * delta) / hctx->ccid3hctx_rtt;
-        if (unlikely(hctx->ccid3hctx_rtt < 4))  /* avoid divide-by-zero */
-                return;
-        quarter_rtts = ktime_us_delta(now, hctx->ccid3hctx_t_last_win_count);
-        quarter_rtts /= hctx->ccid3hctx_rtt / 4;
        if (quarter_rtts > 0) {
                hctx->ccid3hctx_t_last_win_count = now;
-                hctx->ccid3hctx_last_win_count  += min_t(u32, quarter_rtts, 5);
+                hctx->ccid3hctx_last_win_count  += min(quarter_rtts, 5U);
                hctx->ccid3hctx_last_win_count  &= 0xF;         /* mod 16 */
        }
 }
@@ -334,8 +329,14 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
                        hctx->ccid3hctx_x    = rfc3390_initial_rate(sk);
                        hctx->ccid3hctx_t_ld = now;
                } else {
-                        /* Sender does not have RTT sample: X_pps = 1 pkt/sec */
+                        /*
-                        hctx->ccid3hctx_x = hctx->ccid3hctx_s;
+                         * Sender does not have RTT sample:
+                         * - set fallback RTT (RFC 4340, 3.4) since a RTT value
+                         *   is needed in several parts (e.g.  window counter);
+                         * - set sending rate X_pps = 1pps as per RFC 3448, 4.2.
+                         */
+                        hctx->ccid3hctx_rtt = DCCP_FALLBACK_RTT;
+                        hctx->ccid3hctx_x   = hctx->ccid3hctx_s;
                        hctx->ccid3hctx_x <<= 6;
                }
                ccid3_update_send_interval(hctx);
diff --git a/net/dccp/ccids/lib/tfrc.c b/net/dccp/ccids/lib/tfrc.c
index d1dfbb8de64c..97ecec0a8e76 100644
--- a/net/dccp/ccids/lib/tfrc.c
+++ b/net/dccp/ccids/lib/tfrc.c
@@ -14,14 +14,6 @@ module_param(tfrc_debug, bool, 0444);
 MODULE_PARM_DESC(tfrc_debug, "Enable debug messages");
 #endif
-extern int  tfrc_tx_packet_history_init(void);
-extern void tfrc_tx_packet_history_exit(void);
-extern int  tfrc_rx_packet_history_init(void);
-extern void tfrc_rx_packet_history_exit(void);
-extern int  tfrc_li_init(void);
-extern void tfrc_li_exit(void);
 static int __init tfrc_module_init(void)
 {
        int rc = tfrc_li_init();
diff --git a/net/dccp/ccids/lib/tfrc.h b/net/dccp/ccids/lib/tfrc.h
index 1fb1187bbf1c..ed9857527acf 100644
--- a/net/dccp/ccids/lib/tfrc.h
+++ b/net/dccp/ccids/lib/tfrc.h
@@ -15,7 +15,7 @@
 *  (at your option) any later version.
 */
 #include <linux/types.h>
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include "../../dccp.h"
 /* internal includes that this module exports: */
 #include "loss_interval.h"
@@ -29,21 +29,19 @@ extern int tfrc_debug;
 #endif
 /* integer-arithmetic divisions of type (a * 1000000)/b */
-static inline u64 scaled_div(u64 a, u32 b)
+static inline u64 scaled_div(u64 a, u64 b)
 {
        BUG_ON(b==0);
-        a *= 1000000;
+        return div64_u64(a * 1000000, b);
-        do_div(a, b);
-        return a;
 }
-static inline u32 scaled_div32(u64 a, u32 b)
+static inline u32 scaled_div32(u64 a, u64 b)
 {
        u64 result = scaled_div(a, b);
        if (result > UINT_MAX) {
-                DCCP_CRIT("Overflow: a(%llu)/b(%u) > ~0U",
+                DCCP_CRIT("Overflow: %llu/%llu > UINT_MAX",
-                          (unsigned long long)a, b);
+                          (unsigned long long)a, (unsigned long long)b);
                return UINT_MAX;
        }
        return result;
@@ -58,7 +56,14 @@ static inline u32 tfrc_ewma(const u32 avg, const u32 newval, const u8 weight)
        return avg ? (weight * avg + (10 - weight) * newval) / 10 : newval;
 }
-extern u32 tfrc_calc_x(u16 s, u32 R, u32 p);
+extern u32  tfrc_calc_x(u16 s, u32 R, u32 p);
-extern u32 tfrc_calc_x_reverse_lookup(u32 fvalue);
+extern u32  tfrc_calc_x_reverse_lookup(u32 fvalue);
+extern int  tfrc_tx_packet_history_init(void);
+extern void tfrc_tx_packet_history_exit(void);
+extern int  tfrc_rx_packet_history_init(void);
+extern void tfrc_rx_packet_history_exit(void);
+extern int  tfrc_li_init(void);
+extern void tfrc_li_exit(void);
 #endif /* _TFRC_H_ */
diff --git a/net/dccp/ccids/lib/tfrc_equation.c b/net/dccp/ccids/lib/tfrc_equation.c
index e4e64b76c10c..2f20a29cffe4 100644
--- a/net/dccp/ccids/lib/tfrc_equation.c
+++ b/net/dccp/ccids/lib/tfrc_equation.c
@@ -661,7 +661,7 @@ u32 tfrc_calc_x(u16 s, u32 R, u32 p)
 EXPORT_SYMBOL_GPL(tfrc_calc_x);
-/*
+/**
 *  tfrc_calc_x_reverse_lookup  -  try to find p given f(p)
 *
 *  @fvalue: function value to match, scaled by 1000000
@@ -676,11 +676,11 @@ u32 tfrc_calc_x_reverse_lookup(u32 fvalue)
        /* Error cases. */
        if (fvalue < tfrc_calc_x_lookup[0][1]) {
-                DCCP_WARN("fvalue %d smaller than resolution\n", fvalue);
+                DCCP_WARN("fvalue %u smaller than resolution\n", fvalue);
-                return tfrc_calc_x_lookup[0][1];
+                return TFRC_SMALLEST_P;
        }
        if (fvalue > tfrc_calc_x_lookup[TFRC_CALC_X_ARRSIZE - 1][0]) {
-                DCCP_WARN("fvalue %d exceeds bounds!\n", fvalue);
+                DCCP_WARN("fvalue %u exceeds bounds!\n", fvalue);
                return 1000000;
        }
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index b348dd70c685..37d27bcb361f 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -589,7 +589,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                goto drop;
-        req = reqsk_alloc(&dccp_request_sock_ops);
+        req = inet_reqsk_alloc(&dccp_request_sock_ops);
        if (req == NULL)
                goto drop;
@@ -605,7 +605,6 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
        ireq = inet_rsk(req);
        ireq->loc_addr = ip_hdr(skb)->daddr;
        ireq->rmt_addr = ip_hdr(skb)->saddr;
-        ireq->opt       = NULL;
        /*
         * Step 3: Process LISTEN state
@@ -739,8 +738,8 @@ int dccp_invalid_packet(struct sk_buff *skb)
         * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
         * has short sequence numbers), drop packet and return
         */
-        if (dh->dccph_type >= DCCP_PKT_DATA    &&
+        if ((dh->dccph_type < DCCP_PKT_DATA    ||
-            dh->dccph_type <= DCCP_PKT_DATAACK && dh->dccph_x == 0)  {
+            dh->dccph_type > DCCP_PKT_DATAACK) && dh->dccph_x == 0)  {
                DCCP_WARN("P.type (%s) not Data || [Data]Ack, while P.X == 0\n",
                          dccp_packet_name(dh->dccph_type));
                return 1;
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9b1129bb7ece..f7fe2a572d7b 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -421,7 +421,6 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        ireq6 = inet6_rsk(req);
        ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr);
        ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr);
-        ireq6->pktopts  = NULL;
        if (ipv6_opt_accepted(sk, skb) ||
            np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 33ad48321b08..66dca5bba858 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -165,12 +165,12 @@ out_free:
                /* See dccp_v4_conn_request */
                newdmsk->dccpms_sequence_window = req->rcv_wnd;
-                newdp->dccps_gar = newdp->dccps_isr = dreq->dreq_isr;
+                newdp->dccps_gar = newdp->dccps_iss = dreq->dreq_iss;
-                dccp_update_gsr(newsk, dreq->dreq_isr);
-                newdp->dccps_iss = dreq->dreq_iss;
                dccp_update_gss(newsk, dreq->dreq_iss);
+                newdp->dccps_isr = dreq->dreq_isr;
+                dccp_update_gsr(newsk, dreq->dreq_isr);
                /*
                 * SWL and AWL are initially adjusted so that they are not less than
                 * the initial Sequence Numbers received and sent, respectively:
diff --git a/net/dccp/options.c b/net/dccp/options.c
index d2a84a2fecee..43bc24e761d0 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -107,9 +107,11 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                 *
                 * CCID-specific options are ignored during connection setup, as
                 * negotiation may still be in progress (see RFC 4340, 10.3).
+                 * The same applies to Ack Vectors, as these depend on the CCID.
                 *
                 */
-                if (dreq != NULL && opt >= 128)
+                if (dreq != NULL && (opt >= 128 ||
+                    opt == DCCPO_ACK_VECTOR_0 || opt == DCCPO_ACK_VECTOR_1))
                        goto ignore_option;
                switch (opt) {
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 1f8a9b64c083..fe20068c5d8e 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -508,6 +508,7 @@ void dccp_send_ack(struct sock *sk)
 EXPORT_SYMBOL_GPL(dccp_send_ack);
+#if 0
 /* FIXME: Is this still necessary (11.3) - currently nowhere used by DCCP. */
 void dccp_send_delayed_ack(struct sock *sk)
 {
@@ -538,6 +539,7 @@ void dccp_send_delayed_ack(struct sock *sk)
        icsk->icsk_ack.timeout = timeout;
        sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
 }
+#endif
 void dccp_send_sync(struct sock *sk, const u64 ackno,
                    const enum dccp_pkt_type pkt_type)
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 0bcdc9250279..81368a7f5379 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -42,7 +42,7 @@ static int bufsize = 64 * 1024;
 static const char procname[] = "dccpprobe";
-struct {
+static struct {
        struct kfifo      *fifo;
        spinlock_t        lock;
        wait_queue_head_t wait;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 6848e4760f34..79a7ef6209ff 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -90,7 +90,6 @@ static const struct nla_policy ifa_ipv4_policy[IFA_MAX+1] = {
        [IFA_LOCAL]             = { .type = NLA_U32 },
        [IFA_ADDRESS]           = { .type = NLA_U32 },
        [IFA_BROADCAST]         = { .type = NLA_U32 },
-        [IFA_ANYCAST]           = { .type = NLA_U32 },
        [IFA_LABEL]             = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
 };
@@ -536,9 +535,6 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh)
        if (tb[IFA_BROADCAST])
                ifa->ifa_broadcast = nla_get_be32(tb[IFA_BROADCAST]);
-        if (tb[IFA_ANYCAST])
-                ifa->ifa_anycast = nla_get_be32(tb[IFA_ANYCAST]);
        if (tb[IFA_LABEL])
                nla_strlcpy(ifa->ifa_label, tb[IFA_LABEL], IFNAMSIZ);
        else
@@ -745,7 +741,6 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                                break;
                        inet_del_ifa(in_dev, ifap, 0);
                        ifa->ifa_broadcast = 0;
-                        ifa->ifa_anycast = 0;
                        ifa->ifa_scope = 0;
                }
@@ -1113,7 +1108,6 @@ static inline size_t inet_nlmsg_size(void)
               + nla_total_size(4) /* IFA_ADDRESS */
               + nla_total_size(4) /* IFA_LOCAL */
               + nla_total_size(4) /* IFA_BROADCAST */
-               + nla_total_size(4) /* IFA_ANYCAST */
               + nla_total_size(IFNAMSIZ); /* IFA_LABEL */
 }
@@ -1143,9 +1137,6 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
        if (ifa->ifa_broadcast)
                NLA_PUT_BE32(skb, IFA_BROADCAST, ifa->ifa_broadcast);
-        if (ifa->ifa_anycast)
-                NLA_PUT_BE32(skb, IFA_ANYCAST, ifa->ifa_anycast);
        if (ifa->ifa_label[0])
                NLA_PUT_STRING(skb, IFA_LABEL, ifa->ifa_label);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 0f1557a4ac7a..0b2ac6a3d903 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -506,7 +506,6 @@ const struct nla_policy rtm_ipv4_policy[RTA_MAX+1] = {
        [RTA_PREFSRC]           = { .type = NLA_U32 },
        [RTA_METRICS]           = { .type = NLA_NESTED },
        [RTA_MULTIPATH]         = { .len = sizeof(struct rtnexthop) },
-        [RTA_PROTOINFO]         = { .type = NLA_U32 },
        [RTA_FLOW]              = { .type = NLA_U32 },
 };
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 3b83c34019fc..0d4d72827e4b 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -960,7 +960,10 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
        rtm->rtm_dst_len = dst_len;
        rtm->rtm_src_len = 0;
        rtm->rtm_tos = tos;
-        rtm->rtm_table = tb_id;
+        if (tb_id < 256)
+                rtm->rtm_table = tb_id;
+        else
+                rtm->rtm_table = RT_TABLE_COMPAT;
        NLA_PUT_U32(skb, RTA_TABLE, tb_id);
        rtm->rtm_type = type;
        rtm->rtm_flags = fi->fib_flags;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 828ea211ff21..045e799d3e1d 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -419,7 +419,8 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
        struct inet_connection_sock *icsk = inet_csk(parent);
        struct request_sock_queue *queue = &icsk->icsk_accept_queue;
        struct listen_sock *lopt = queue->listen_opt;
-        int thresh = icsk->icsk_syn_retries ? : sysctl_tcp_synack_retries;
+        int max_retries = icsk->icsk_syn_retries ? : sysctl_tcp_synack_retries;
+        int thresh = max_retries;
        unsigned long now = jiffies;
        struct request_sock **reqp, *req;
        int i, budget;
@@ -455,6 +456,9 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                }
        }
+        if (queue->rskq_defer_accept)
+                max_retries = queue->rskq_defer_accept;
        budget = 2 * (lopt->nr_table_entries / (timeout / interval));
        i = lopt->clock_hand;
@@ -462,8 +466,9 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                reqp=&lopt->syn_table[i];
                while ((req = *reqp) != NULL) {
                        if (time_after_eq(now, req->expires)) {
-                                if (req->retrans < thresh &&
+                                if ((req->retrans < (inet_rsk(req)->acked ? max_retries : thresh)) &&
-                                    !req->rsk_ops->rtx_syn_ack(parent, req)) {
+                                    (inet_rsk(req)->acked ||
+                                     !req->rsk_ops->rtx_syn_ack(parent, req))) {
                                        unsigned long timeo;
                                        if (req->retrans++ == 0)
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 5daefad3d193..7750c97fde7b 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -232,6 +232,11 @@ static unsigned char asn1_length_decode(struct asn1_ctx *ctx,
                        }
                }
        }
+        /* don't trust len bigger than ctx buffer */
+        if (*len > ctx->end - ctx->pointer)
+                return 0;
        return 1;
 }
@@ -250,6 +255,10 @@ static unsigned char asn1_header_decode(struct asn1_ctx *ctx,
        if (!asn1_length_decode(ctx, &def, &len))
                return 0;
+        /* primitive shall be definite, indefinite shall be constructed */
+        if (*con == ASN1_PRI && !def)
+                return 0;
        if (def)
                *eoc = ctx->pointer + len;
        else
@@ -434,6 +443,11 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
        unsigned long *optr;
        size = eoc - ctx->pointer + 1;
+        /* first subid actually encodes first two subids */
+        if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+                return 0;
        *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
        if (*oid == NULL) {
                if (net_ratelimit())
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index fead049daf43..e7e091d365ff 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -608,6 +608,14 @@ static void raw_close(struct sock *sk, long timeout)
        sk_common_release(sk);
 }
+static int raw_destroy(struct sock *sk)
+{
+        lock_sock(sk);
+        ip_flush_pending_frames(sk);
+        release_sock(sk);
+        return 0;
+}
 /* This gets rid of all the nasties in af_inet. -DaveM */
 static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
@@ -820,6 +828,7 @@ struct proto raw_prot = {
        .name              = "RAW",
        .owner             = THIS_MODULE,
        .close             = raw_close,
+        .destroy           = raw_destroy,
        .connect           = ip4_datagram_connect,
        .disconnect        = udp_disconnect,
        .ioctl             = raw_ioctl,
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index df41026b60db..96be336064fb 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1792,7 +1792,7 @@ static int __mkroute_input(struct sk_buff *skb,
        if (err)
                flags |= RTCF_DIRECTSRC;
-        if (out_dev == in_dev && err && !(flags & RTCF_MASQ) &&
+        if (out_dev == in_dev && err &&
            (IN_DEV_SHARED_MEDIA(out_dev) ||
             inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
                flags |= RTCF_DOREDIRECT;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 73ba98921d64..d182a2a26291 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -285,7 +285,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                cookie_check_timestamp(&tcp_opt);
        ret = NULL;
-        req = reqsk_alloc(&tcp_request_sock_ops); /* for safety */
+        req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
        if (!req)
                goto out;
@@ -301,7 +301,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
        ireq->rmt_port          = th->source;
        ireq->loc_addr          = ip_hdr(skb)->daddr;
        ireq->rmt_addr          = ip_hdr(skb)->saddr;
-        ireq->opt               = NULL;
        ireq->snd_wscale        = tcp_opt.snd_wscale;
        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
        ireq->sack_ok           = tcp_opt.sack_ok;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f88653138621..fc54a48fde1e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1227,7 +1227,14 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                                copied += used;
                                offset += used;
                        }
-                        if (offset != skb->len)
+                        /*
+                         * If recv_actor drops the lock (e.g. TCP splice
+                         * receive) the skb pointer might be invalid when
+                         * getting here: tcp_collapse might have deleted it
+                         * while aggregating skbs from the socket queue.
+                         */
+                        skb = tcp_recv_skb(sk, seq-1, &offset);
+                        if (!skb || (offset+1 != skb->len))
                                break;
                }
                if (tcp_hdr(skb)->fin) {
@@ -2105,12 +2112,15 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                break;
        case TCP_DEFER_ACCEPT:
-                if (val < 0) {
+                icsk->icsk_accept_queue.rskq_defer_accept = 0;
-                        err = -EINVAL;
+                if (val > 0) {
-                } else {
+                        /* Translate value in seconds to number of
-                        if (val > MAX_TCP_ACCEPT_DEFERRED)
+                         * retransmits */
-                                val = MAX_TCP_ACCEPT_DEFERRED;
+                        while (icsk->icsk_accept_queue.rskq_defer_accept < 32 &&
-                        icsk->icsk_accept_queue.rskq_defer_accept = val;
+                               val > ((TCP_TIMEOUT_INIT / HZ) <<
+                                       icsk->icsk_accept_queue.rskq_defer_accept))
+                                icsk->icsk_accept_queue.rskq_defer_accept++;
+                        icsk->icsk_accept_queue.rskq_defer_accept++;
                }
                break;
@@ -2292,7 +2302,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                        val = (val ? : sysctl_tcp_fin_timeout) / HZ;
                break;
        case TCP_DEFER_ACCEPT:
-                val = icsk->icsk_accept_queue.rskq_defer_accept;
+                val = !icsk->icsk_accept_queue.rskq_defer_accept ? 0 :
+                        ((TCP_TIMEOUT_INIT / HZ) << (icsk->icsk_accept_queue.rskq_defer_accept - 1));
                break;
        case TCP_WINDOW_CLAMP:
                val = tp->window_clamp;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index b54d9d37b636..cad73b7dfef0 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1392,9 +1392,9 @@ static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
        if (before(next_dup->start_seq, skip_to_seq)) {
                skb = tcp_sacktag_skip(skb, sk, next_dup->start_seq, fack_count);
-                tcp_sacktag_walk(skb, sk, NULL,
+                skb = tcp_sacktag_walk(skb, sk, NULL,
-                                 next_dup->start_seq, next_dup->end_seq,
+                                     next_dup->start_seq, next_dup->end_seq,
-                                 1, fack_count, reord, flag);
+                                     1, fack_count, reord, flag);
        }
        return skb;
@@ -2483,6 +2483,20 @@ static inline void tcp_complete_cwr(struct sock *sk)
        tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
 }
+static void tcp_try_keep_open(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int state = TCP_CA_Open;
+        if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
+                state = TCP_CA_Disorder;
+        if (inet_csk(sk)->icsk_ca_state != state) {
+                tcp_set_ca_state(sk, state);
+                tp->high_seq = tp->snd_nxt;
+        }
+}
 static void tcp_try_to_open(struct sock *sk, int flag)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -2496,15 +2510,7 @@ static void tcp_try_to_open(struct sock *sk, int flag)
                tcp_enter_cwr(sk, 1);
        if (inet_csk(sk)->icsk_ca_state != TCP_CA_CWR) {
-                int state = TCP_CA_Open;
+                tcp_try_keep_open(sk);
-                if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
-                        state = TCP_CA_Disorder;
-                if (inet_csk(sk)->icsk_ca_state != state) {
-                        tcp_set_ca_state(sk, state);
-                        tp->high_seq = tp->snd_nxt;
-                }
                tcp_moderate_cwnd(tp);
        } else {
                tcp_cwnd_down(sk, flag);
@@ -3310,8 +3316,11 @@ no_queue:
        return 1;
 old_ack:
-        if (TCP_SKB_CB(skb)->sacked)
+        if (TCP_SKB_CB(skb)->sacked) {
                tcp_sacktag_write_queue(sk, skb, prior_snd_una);
+                if (icsk->icsk_ca_state == TCP_CA_Open)
+                        tcp_try_keep_open(sk);
+        }
 uninteresting_ack:
        SOCK_DEBUG(sk, "Ack %u out of %u:%u\n", ack, tp->snd_una, tp->snd_nxt);
@@ -4532,49 +4541,6 @@ static void tcp_urg(struct sock *sk, struct sk_buff *skb, struct tcphdr *th)
        }
 }
-static int tcp_defer_accept_check(struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        if (tp->defer_tcp_accept.request) {
-                int queued_data =  tp->rcv_nxt - tp->copied_seq;
-                int hasfin =  !skb_queue_empty(&sk->sk_receive_queue) ?
-                        tcp_hdr((struct sk_buff *)
-                                sk->sk_receive_queue.prev)->fin : 0;
-                if (queued_data && hasfin)
-                        queued_data--;
-                if (queued_data &&
-                    tp->defer_tcp_accept.listen_sk->sk_state == TCP_LISTEN) {
-                        if (sock_flag(sk, SOCK_KEEPOPEN)) {
-                                inet_csk_reset_keepalive_timer(sk,
-                                                               keepalive_time_when(tp));
-                        } else {
-                                inet_csk_delete_keepalive_timer(sk);
-                        }
-                        inet_csk_reqsk_queue_add(
-                                tp->defer_tcp_accept.listen_sk,
-                                tp->defer_tcp_accept.request,
-                                sk);
-                        tp->defer_tcp_accept.listen_sk->sk_data_ready(
-                                tp->defer_tcp_accept.listen_sk, 0);
-                        sock_put(tp->defer_tcp_accept.listen_sk);
-                        sock_put(sk);
-                        tp->defer_tcp_accept.listen_sk = NULL;
-                        tp->defer_tcp_accept.request = NULL;
-                } else if (hasfin ||
-                           tp->defer_tcp_accept.listen_sk->sk_state != TCP_LISTEN) {
-                        tcp_reset(sk);
-                        return -1;
-                }
-        }
-        return 0;
-}
 static int tcp_copy_to_iovec(struct sock *sk, struct sk_buff *skb, int hlen)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -4935,8 +4901,6 @@ step5:
        tcp_data_snd_check(sk);
        tcp_ack_snd_check(sk);
-        tcp_defer_accept_check(sk);
        return 0;
 csum_error:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index cd601a866c2f..97a230026e13 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1285,7 +1285,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                goto drop;
-        req = reqsk_alloc(&tcp_request_sock_ops);
+        req = inet_reqsk_alloc(&tcp_request_sock_ops);
        if (!req)
                goto drop;
@@ -1918,14 +1918,6 @@ int tcp_v4_destroy_sock(struct sock *sk)
                sk->sk_sndmsg_page = NULL;
        }
-        if (tp->defer_tcp_accept.request) {
-                reqsk_free(tp->defer_tcp_accept.request);
-                sock_put(tp->defer_tcp_accept.listen_sk);
-                sock_put(sk);
-                tp->defer_tcp_accept.listen_sk = NULL;
-                tp->defer_tcp_accept.request = NULL;
-        }
        atomic_dec(&tcp_sockets_allocated);
        return 0;
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 019c8c16e5cc..8245247a6ceb 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -571,8 +571,10 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
           does sequence test, SYN is truncated, and thus we consider
           it a bare ACK.
-           Both ends (listening sockets) accept the new incoming
+           If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
-           connection and try to talk to each other. 8-)
+           bare ACK.  Otherwise, we create an established connection.  Both
+           ends (listening sockets) accept the new incoming connection and try
+           to talk to each other. 8-)
           Note: This case is both harmless, and rare.  Possibility is about the
           same as us discovering intelligent life on another plant tomorrow.
@@ -640,6 +642,13 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                if (!(flg & TCP_FLAG_ACK))
                        return NULL;
+                /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
+                if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
+                    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
+                        inet_rsk(req)->acked = 1;
+                        return NULL;
+                }
                /* OK, ACK is valid, create big socket and
                 * feed this segment to it. It will repeat all
                 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
@@ -678,24 +687,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                inet_csk_reqsk_queue_unlink(sk, req, prev);
                inet_csk_reqsk_queue_removed(sk, req);
-                if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
+                inet_csk_reqsk_queue_add(sk, req, child);
-                    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
-                        /* the accept queue handling is done is est recv slow
-                         * path so lets make sure to start there
-                         */
-                        tcp_sk(child)->pred_flags = 0;
-                        sock_hold(sk);
-                        sock_hold(child);
-                        tcp_sk(child)->defer_tcp_accept.listen_sk = sk;
-                        tcp_sk(child)->defer_tcp_accept.request = req;
-                        inet_csk_reset_keepalive_timer(child,
-                                                       inet_csk(sk)->icsk_accept_queue.rskq_defer_accept * HZ);
-                } else {
-                        inet_csk_reqsk_queue_add(sk, req, child);
-                }
                return child;
        listen_overflow:
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e399bde7813a..ad993ecb4810 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2131,6 +2131,8 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
        TCP_SKB_CB(skb)->when = tcp_time_stamp;
        if (tcp_transmit_skb(sk, skb, 0, priority))
                NET_INC_STATS(LINUX_MIB_TCPABORTFAILED);
+        TCP_INC_STATS(TCP_MIB_OUTRSTS);
 }
 /* WARNING: This routine must only be called when we have already sent
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 4de68cf5f2aa..63ed9d6830e7 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -489,11 +489,6 @@ static void tcp_keepalive_timer (unsigned long data)
                goto death;
        }
-        if (tp->defer_tcp_accept.request && sk->sk_state == TCP_ESTABLISHED) {
-                tcp_send_active_reset(sk, GFP_ATOMIC);
-                goto death;
-        }
        if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE)
                goto out;
diff --git a/net/ipv4/tunnel4.c b/net/ipv4/tunnel4.c
index d3b709a6f264..cb1f0e83830b 100644
--- a/net/ipv4/tunnel4.c
+++ b/net/ipv4/tunnel4.c
@@ -97,7 +97,7 @@ static int tunnel64_rcv(struct sk_buff *skb)
 {
        struct xfrm_tunnel *handler;
-        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                goto drop;
        for (handler = tunnel64_handlers; handler; handler = handler->next)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index db1cb7c96d63..56fcda3694ba 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -420,7 +420,7 @@ void udp_err(struct sk_buff *skb, u32 info)
 /*
 * Throw away all pending data and cancel the corking. Socket is locked.
 */
-static void udp_flush_pending_frames(struct sock *sk)
+void udp_flush_pending_frames(struct sock *sk)
 {
        struct udp_sock *up = udp_sk(sk);
@@ -430,6 +430,7 @@ static void udp_flush_pending_frames(struct sock *sk)
                ip_flush_pending_frames(sk);
        }
 }
+EXPORT_SYMBOL(udp_flush_pending_frames);
 /**
 *      udp4_hwcsum_outgoing  -  handle outgoing HW checksumming
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3a835578fd1c..147588f4c7c0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -731,8 +731,13 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                                                onlink = -1;
                                        spin_lock(&ifa->lock);
-                                        lifetime = min_t(unsigned long,
-                                                         ifa->valid_lft, 0x7fffffffUL/HZ);
+                                        lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
+                                        /*
+                                         * Note: Because this address is
+                                         * not permanent, lifetime <
+                                         * LONG_MAX / HZ here.
+                                         */
                                        if (time_before(expires,
                                                        ifa->tstamp + lifetime * HZ))
                                                expires = ifa->tstamp + lifetime * HZ;
@@ -1722,7 +1727,6 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
        __u32 valid_lft;
        __u32 prefered_lft;
        int addr_type;
-        unsigned long rt_expires;
        struct inet6_dev *in6_dev;
        pinfo = (struct prefix_info *) opt;
@@ -1764,28 +1768,23 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
         *      2) Configure prefixes with the auto flag set
         */
-        if (valid_lft == INFINITY_LIFE_TIME)
+        if (pinfo->onlink) {
-                rt_expires = ~0UL;
+                struct rt6_info *rt;
-        else if (valid_lft >= 0x7FFFFFFF/HZ) {
+                unsigned long rt_expires;
                /* Avoid arithmetic overflow. Really, we could
                 * save rt_expires in seconds, likely valid_lft,
                 * but it would require division in fib gc, that it
                 * not good.
                 */
-                rt_expires = 0x7FFFFFFF - (0x7FFFFFFF % HZ);
+                if (HZ > USER_HZ)
-        } else
+                        rt_expires = addrconf_timeout_fixup(valid_lft, HZ);
-                rt_expires = valid_lft * HZ;
+                else
+                        rt_expires = addrconf_timeout_fixup(valid_lft, USER_HZ);
-        /*
+                if (addrconf_finite_timeout(rt_expires))
-         * We convert this (in jiffies) to clock_t later.
+                        rt_expires *= HZ;
-         * Avoid arithmetic overflow there as well.
-         * Overflow can happen only if HZ < USER_HZ.
-         */
-        if (HZ < USER_HZ && ~rt_expires && rt_expires > 0x7FFFFFFF / USER_HZ)
-                rt_expires = 0x7FFFFFFF / USER_HZ;
-        if (pinfo->onlink) {
-                struct rt6_info *rt;
                rt = rt6_lookup(dev_net(dev), &pinfo->prefix, NULL,
                                dev->ifindex, 1);
@@ -1794,7 +1793,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                        if (valid_lft == 0) {
                                ip6_del_rt(rt);
                                rt = NULL;
-                        } else if (~rt_expires) {
+                        } else if (addrconf_finite_timeout(rt_expires)) {
                                /* not infinity */
                                rt->rt6i_expires = jiffies + rt_expires;
                                rt->rt6i_flags |= RTF_EXPIRES;
@@ -1803,9 +1802,9 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                                rt->rt6i_expires = 0;
                        }
                } else if (valid_lft) {
-                        int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
                        clock_t expires = 0;
-                        if (~rt_expires) {
+                        int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
+                        if (addrconf_finite_timeout(rt_expires)) {
                                /* not infinity */
                                flags |= RTF_EXPIRES;
                                expires = jiffies_to_clock_t(rt_expires);
@@ -2027,7 +2026,7 @@ err_exit:
 *      Manual configuration of address on an interface
 */
 static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
-                          int plen, __u8 ifa_flags, __u32 prefered_lft,
+                          unsigned int plen, __u8 ifa_flags, __u32 prefered_lft,
                          __u32 valid_lft)
 {
        struct inet6_ifaddr *ifp;
@@ -2036,9 +2035,13 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
        int scope;
        u32 flags;
        clock_t expires;
+        unsigned long timeout;
        ASSERT_RTNL();
+        if (plen > 128)
+                return -EINVAL;
        /* check the lifetime */
        if (!valid_lft || prefered_lft > valid_lft)
                return -EINVAL;
@@ -2052,22 +2055,23 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
        scope = ipv6_addr_scope(pfx);
-        if (valid_lft == INFINITY_LIFE_TIME) {
+        timeout = addrconf_timeout_fixup(valid_lft, HZ);
-                ifa_flags |= IFA_F_PERMANENT;
+        if (addrconf_finite_timeout(timeout)) {
-                flags = 0;
+                expires = jiffies_to_clock_t(timeout * HZ);
-                expires = 0;
+                valid_lft = timeout;
-        } else {
-                if (valid_lft >= 0x7FFFFFFF/HZ)
-                        valid_lft = 0x7FFFFFFF/HZ;
                flags = RTF_EXPIRES;
-                expires = jiffies_to_clock_t(valid_lft * HZ);
+        } else {
+                expires = 0;
+                flags = 0;
+                ifa_flags |= IFA_F_PERMANENT;
        }
-        if (prefered_lft == 0)
+        timeout = addrconf_timeout_fixup(prefered_lft, HZ);
-                ifa_flags |= IFA_F_DEPRECATED;
+        if (addrconf_finite_timeout(timeout)) {
-        else if ((prefered_lft >= 0x7FFFFFFF/HZ) &&
+                if (timeout == 0)
-                 (prefered_lft != INFINITY_LIFE_TIME))
+                        ifa_flags |= IFA_F_DEPRECATED;
-                prefered_lft = 0x7FFFFFFF/HZ;
+                prefered_lft = timeout;
+        }
        ifp = ipv6_add_addr(idev, pfx, plen, scope, ifa_flags);
@@ -2095,12 +2099,15 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
 }
 static int inet6_addr_del(struct net *net, int ifindex, struct in6_addr *pfx,
-                          int plen)
+                          unsigned int plen)
 {
        struct inet6_ifaddr *ifp;
        struct inet6_dev *idev;
        struct net_device *dev;
+        if (plen > 128)
+                return -EINVAL;
        dev = __dev_get_by_index(net, ifindex);
        if (!dev)
                return -ENODEV;
@@ -3169,26 +3176,28 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
 {
        u32 flags;
        clock_t expires;
+        unsigned long timeout;
        if (!valid_lft || (prefered_lft > valid_lft))
                return -EINVAL;
-        if (valid_lft == INFINITY_LIFE_TIME) {
+        timeout = addrconf_timeout_fixup(valid_lft, HZ);
-                ifa_flags |= IFA_F_PERMANENT;
+        if (addrconf_finite_timeout(timeout)) {
-                flags = 0;
+                expires = jiffies_to_clock_t(timeout * HZ);
-                expires = 0;
+                valid_lft = timeout;
-        } else {
-                if (valid_lft >= 0x7FFFFFFF/HZ)
-                        valid_lft = 0x7FFFFFFF/HZ;
                flags = RTF_EXPIRES;
-                expires = jiffies_to_clock_t(valid_lft * HZ);
+        } else {
+                expires = 0;
+                flags = 0;
+                ifa_flags |= IFA_F_PERMANENT;
        }
-        if (prefered_lft == 0)
+        timeout = addrconf_timeout_fixup(prefered_lft, HZ);
-                ifa_flags |= IFA_F_DEPRECATED;
+        if (addrconf_finite_timeout(timeout)) {
-        else if ((prefered_lft >= 0x7FFFFFFF/HZ) &&
+                if (timeout == 0)
-                 (prefered_lft != INFINITY_LIFE_TIME))
+                        ifa_flags |= IFA_F_DEPRECATED;
-                prefered_lft = 0x7FFFFFFF/HZ;
+                prefered_lft = timeout;
+        }
        spin_lock_bh(&ifp->lock);
        ifp->flags = (ifp->flags & ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD | IFA_F_HOMEADDRESS)) | ifa_flags;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3c6aafb02183..e84b3fd17fb4 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -191,7 +191,7 @@ lookup_protocol:
        np->mcast_hops  = -1;
        np->mc_loop     = 1;
        np->pmtudisc    = IPV6_PMTUDISC_WANT;
-        np->ipv6only    = init_net.ipv6.sysctl.bindv6only;
+        np->ipv6only    = net->ipv6.sysctl.bindv6only;
        /* Init the ipv4 part of the socket since we can have sockets
         * using v6 API for ipv4.
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 94fa6ae77cfe..0f0f94a40335 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -496,7 +496,8 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
        return 0;
 }
-int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
+int datagram_send_ctl(struct net *net,
+                      struct msghdr *msg, struct flowi *fl,
                      struct ipv6_txoptions *opt,
                      int *hlimit, int *tclass)
 {
@@ -509,7 +510,6 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
        for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
                int addr_type;
-                struct net_device *dev = NULL;
                if (!CMSG_OK(msg, cmsg)) {
                        err = -EINVAL;
@@ -522,6 +522,9 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                switch (cmsg->cmsg_type) {
                case IPV6_PKTINFO:
                case IPV6_2292PKTINFO:
+                    {
+                        struct net_device *dev = NULL;
                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct in6_pktinfo))) {
                                err = -EINVAL;
                                goto exit_f;
@@ -535,32 +538,32 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                                fl->oif = src_info->ipi6_ifindex;
                        }
-                        addr_type = ipv6_addr_type(&src_info->ipi6_addr);
+                        addr_type = __ipv6_addr_type(&src_info->ipi6_addr);
-                        if (addr_type == IPV6_ADDR_ANY)
+                        if (fl->oif) {
-                                break;
+                                dev = dev_get_by_index(net, fl->oif);
+                                if (!dev)
+                                        return -ENODEV;
+                        } else if (addr_type & IPV6_ADDR_LINKLOCAL)
+                                return -EINVAL;
-                        if (addr_type & IPV6_ADDR_LINKLOCAL) {
+                        if (addr_type != IPV6_ADDR_ANY) {
-                                if (!src_info->ipi6_ifindex)
+                                int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL;
-                                        return -EINVAL;
+                                if (!ipv6_chk_addr(net, &src_info->ipi6_addr,
-                                else {
+                                                   strict ? dev : NULL, 0))
-                                        dev = dev_get_by_index(&init_net, src_info->ipi6_ifindex);
+                                        err = -EINVAL;
-                                        if (!dev)
+                                else
-                                                return -ENODEV;
+                                        ipv6_addr_copy(&fl->fl6_src, &src_info->ipi6_addr);
-                                }
-                        }
-                        if (!ipv6_chk_addr(&init_net, &src_info->ipi6_addr,
-                                           dev, 0)) {
-                                if (dev)
-                                        dev_put(dev);
-                                err = -EINVAL;
-                                goto exit_f;
                        }
                        if (dev)
                                dev_put(dev);
-                        ipv6_addr_copy(&fl->fl6_src, &src_info->ipi6_addr);
+                        if (err)
+                                goto exit_f;
                        break;
+                    }
                case IPV6_FLOWINFO:
                        if (cmsg->cmsg_len < CMSG_LEN(4)) {
@@ -702,6 +705,11 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                        }
                        *hlimit = *(int *)CMSG_DATA(cmsg);
+                        if (*hlimit < -1 || *hlimit > 0xff) {
+                                err = -EINVAL;
+                                goto exit_f;
+                        }
                        break;
                case IPV6_TCLASS:
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index eb7a940310f4..37a4e777e347 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -354,7 +354,7 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                msg.msg_control = (void*)(fl->opt+1);
                flowi.oif = 0;
-                err = datagram_send_ctl(&msg, &flowi, fl->opt, &junk, &junk);
+                err = datagram_send_ctl(net, &msg, &flowi, fl->opt, &junk, &junk);
                if (err)
                        goto done;
                err = -EINVAL;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 2de3c464fe75..14796181e8b5 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -197,7 +197,7 @@ static int ip6mr_vif_seq_show(struct seq_file *seq, void *v)
                const char *name = vif->dev ? vif->dev->name : "none";
                seq_printf(seq,
-                           "%2Zd %-10s %8ld %7ld  %8ld %7ld %05X\n",
+                           "%2td %-10s %8ld %7ld  %8ld %7ld %05X\n",
                           vif - vif6_table,
                           name, vif->bytes_in, vif->pkt_in,
                           vif->bytes_out, vif->pkt_out,
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 56d55fecf8ec..c042ce19bd14 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -67,7 +67,7 @@ int ip6_ra_control(struct sock *sk, int sel, void (*destructor)(struct sock *))
        /* RA packet may be delivered ONLY to IPPROTO_RAW socket */
        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num != IPPROTO_RAW)
-                return -EINVAL;
+                return -ENOPROTOOPT;
        new_ra = (sel>=0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
@@ -161,9 +161,17 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                        struct ipv6_txoptions *opt;
                        struct sk_buff *pktopt;
-                        if (sk->sk_protocol != IPPROTO_UDP &&
+                        if (sk->sk_type == SOCK_RAW)
-                            sk->sk_protocol != IPPROTO_UDPLITE &&
+                                break;
-                            sk->sk_protocol != IPPROTO_TCP)
+                        if (sk->sk_protocol == IPPROTO_UDP ||
+                            sk->sk_protocol == IPPROTO_UDPLITE) {
+                                struct udp_sock *up = udp_sk(sk);
+                                if (up->pending == AF_INET6) {
+                                        retv = -EBUSY;
+                                        break;
+                                }
+                        } else if (sk->sk_protocol != IPPROTO_TCP)
                                break;
                        if (sk->sk_state != TCP_ESTABLISHED) {
@@ -416,7 +424,7 @@ sticky_done:
                msg.msg_controllen = optlen;
                msg.msg_control = (void*)(opt+1);
-                retv = datagram_send_ctl(&msg, &fl, opt, &junk, &junk);
+                retv = datagram_send_ctl(net, &msg, &fl, opt, &junk, &junk);
                if (retv)
                        goto done;
 update:
@@ -438,7 +446,7 @@ done:
        case IPV6_MULTICAST_HOPS:
                if (sk->sk_type == SOCK_STREAM)
-                        goto e_inval;
+                        break;
                if (optlen < sizeof(int))
                        goto e_inval;
                if (val > 255 || val < -1)
@@ -450,13 +458,15 @@ done:
        case IPV6_MULTICAST_LOOP:
                if (optlen < sizeof(int))
                        goto e_inval;
+                if (val != valbool)
+                        goto e_inval;
                np->mc_loop = valbool;
                retv = 0;
                break;
        case IPV6_MULTICAST_IF:
                if (sk->sk_type == SOCK_STREAM)
-                        goto e_inval;
+                        break;
                if (optlen < sizeof(int))
                        goto e_inval;
@@ -832,7 +842,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
        len = min_t(unsigned int, len, ipv6_optlen(hdr));
        if (copy_to_user(optval, hdr, len))
                return -EFAULT;
-        return ipv6_optlen(hdr);
+        return len;
 }
 static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
@@ -852,7 +862,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                if (sk->sk_protocol != IPPROTO_UDP &&
                    sk->sk_protocol != IPPROTO_UDPLITE &&
                    sk->sk_protocol != IPPROTO_TCP)
-                        return -EINVAL;
+                        return -ENOPROTOOPT;
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -ENOTCONN;
                val = sk->sk_family;
@@ -866,6 +876,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                        return -EINVAL;
                if (copy_from_user(&gsf, optval, GROUP_FILTER_SIZE(0)))
                        return -EFAULT;
+                if (gsf.gf_group.ss_family != AF_INET6)
+                        return -EADDRNOTAVAIL;
                lock_sock(sk);
                err = ip6_mc_msfget(sk, &gsf,
                        (struct group_filter __user *)optval, optlen);
@@ -975,6 +987,9 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                len = ipv6_getsockopt_sticky(sk, np->opt,
                                             optname, optval, len);
                release_sock(sk);
+                /* check if ipv6_getsockopt_sticky() returns err code */
+                if (len < 0)
+                        return len;
                return put_user(len, optlen);
        }
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 2dccad48058c..e65e26e210ee 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -209,7 +209,9 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
        arg.dst = dst;
        hash = ip6qhashfn(id, src, dst);
+        local_bh_disable();
        q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
+        local_bh_enable();
        if (q == NULL)
                goto oom;
@@ -638,10 +640,10 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
                goto ret_orig;
        }
-        spin_lock(&fq->q.lock);
+        spin_lock_bh(&fq->q.lock);
        if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
-                spin_unlock(&fq->q.lock);
+                spin_unlock_bh(&fq->q.lock);
                pr_debug("Can't insert skb to queue\n");
                fq_put(fq);
                goto ret_orig;
@@ -653,7 +655,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
                if (ret_skb == NULL)
                        pr_debug("Can't reassemble fragmented packets\n");
        }
-        spin_unlock(&fq->q.lock);
+        spin_unlock_bh(&fq->q.lock);
        fq_put(fq);
        return ret_skb;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 232e0dc45bf5..3aee12310d94 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -813,7 +813,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(struct ipv6_txoptions);
-                err = datagram_send_ctl(msg, &fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit, &tclass);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
@@ -1164,6 +1164,15 @@ static void rawv6_close(struct sock *sk, long timeout)
        sk_common_release(sk);
 }
+static int raw6_destroy(struct sock *sk)
+{
+        lock_sock(sk);
+        ip6_flush_pending_frames(sk);
+        release_sock(sk);
+        return inet6_destroy_sock(sk);
+}
 static int rawv6_init_sk(struct sock *sk)
 {
        struct raw6_sock *rp = raw6_sk(sk);
@@ -1187,11 +1196,11 @@ struct proto rawv6_prot = {
        .name              = "RAWv6",
        .owner             = THIS_MODULE,
        .close             = rawv6_close,
+        .destroy           = raw6_destroy,
        .connect           = ip6_datagram_connect,
        .disconnect        = udp_disconnect,
        .ioctl             = rawv6_ioctl,
        .init              = rawv6_init_sk,
-        .destroy           = inet6_destroy_sock,
        .setsockopt        = rawv6_setsockopt,
        .getsockopt        = rawv6_getsockopt,
        .sendmsg           = rawv6_sendmsg,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 48534c6c0735..d1f3e19b06c7 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -446,7 +446,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
        struct route_info *rinfo = (struct route_info *) opt;
        struct in6_addr prefix_buf, *prefix;
        unsigned int pref;
-        u32 lifetime;
+        unsigned long lifetime;
        struct rt6_info *rt;
        if (len < sizeof(struct route_info)) {
@@ -472,13 +472,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
        if (pref == ICMPV6_ROUTER_PREF_INVALID)
                pref = ICMPV6_ROUTER_PREF_MEDIUM;
-        lifetime = ntohl(rinfo->lifetime);
+        lifetime = addrconf_timeout_fixup(ntohl(rinfo->lifetime), HZ);
-        if (lifetime == 0xffffffff) {
-                /* infinity */
-        } else if (lifetime > 0x7fffffff/HZ - 1) {
-                /* Avoid arithmetic overflow */
-                lifetime = 0x7fffffff/HZ - 1;
-        }
        if (rinfo->length == 3)
                prefix = (struct in6_addr *)rinfo->prefix;
@@ -506,7 +500,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
                                 (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
        if (rt) {
-                if (lifetime == 0xffffffff) {
+                if (!addrconf_finite_timeout(lifetime)) {
                        rt->rt6i_flags &= ~RTF_EXPIRES;
                } else {
                        rt->rt6i_expires = jiffies + HZ * lifetime;
@@ -2202,8 +2196,12 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
        NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric);
-        expires = (rt->rt6i_flags & RTF_EXPIRES) ?
+        if (!(rt->rt6i_flags & RTF_EXPIRES))
-                        rt->rt6i_expires - jiffies : 0;
+                expires = 0;
+        else if (rt->rt6i_expires - jiffies < INT_MAX)
+                expires = rt->rt6i_expires - jiffies;
+        else
+                expires = INT_MAX;
        if (rtnl_put_cacheinfo(skb, &rt->u.dst, 0, 0, 0,
                               expires, rt->u.dst.error) < 0)
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 938ce4ecde55..3ecc1157994e 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -198,7 +198,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        ireq = inet_rsk(req);
        ireq6 = inet6_rsk(req);
        treq = tcp_rsk(req);
-        ireq6->pktopts = NULL;
        if (security_inet_conn_request(sk, skb, req)) {
                reqsk_free(req);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 715965f0fac0..cb46749d4c32 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1299,7 +1299,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        treq = inet6_rsk(req);
        ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
        ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
-        treq->pktopts = NULL;
        if (!want_cookie)
                TCP_ECN_create_request(req, tcp_hdr(skb));
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 6323921b40be..669f280989c3 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -109,7 +109,7 @@ static int tunnel46_rcv(struct sk_buff *skb)
 {
        struct xfrm6_tunnel *handler;
-        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
+        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                goto drop;
        for (handler = tunnel46_handlers; handler; handler = handler->next)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1fd784f3e2ec..dd309626ae9a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -534,7 +534,9 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
 {
        struct udp_sock *up = udp_sk(sk);
-        if (up->pending) {
+        if (up->pending == AF_INET)
+                udp_flush_pending_frames(sk);
+        else if (up->pending) {
                up->len = 0;
                up->pending = 0;
                ip6_flush_pending_frames(sk);
@@ -731,7 +733,7 @@ do_udp_sendmsg:
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(*opt);
-                err = datagram_send_ctl(msg, &fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit, &tclass);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
@@ -848,12 +850,14 @@ do_append_data:
                } else {
                        dst_release(dst);
                }
+                dst = NULL;
        }
        if (err > 0)
                err = np->recverr ? net_xmit_errno(err) : 0;
        release_sock(sk);
 out:
+        dst_release(dst);
        fl6_sock_release(flowlabel);
        if (!err)
                return len;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index ae54b20d0470..3eb5bcc75f99 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1093,11 +1093,6 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
        init_waitqueue_head(&self->query_wait);
-        /* Initialise networking socket struct */
-        sock_init_data(sock, sk);       /* Note : set sk->sk_refcnt to 1 */
-        sk->sk_family = PF_IRDA;
-        sk->sk_protocol = protocol;
        switch (sock->type) {
        case SOCK_STREAM:
                sock->ops = &irda_stream_ops;
@@ -1124,13 +1119,20 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
                        self->max_sdu_size_rx = TTP_SAR_UNBOUND;
                        break;
                default:
+                        sk_free(sk);
                        return -ESOCKTNOSUPPORT;
                }
                break;
        default:
+                sk_free(sk);
                return -ESOCKTNOSUPPORT;
        }
+        /* Initialise networking socket struct */
+        sock_init_data(sock, sk);       /* Note : set sk->sk_refcnt to 1 */
+        sk->sk_family = PF_IRDA;
+        sk->sk_protocol = protocol;
        /* Register as a client with IrLMP */
        self->ckey = irlmp_register_client(0, NULL, NULL, NULL);
        self->mask.word = 0xffff;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9bba7ac5fee0..7470e367272b 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3030,6 +3030,9 @@ static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c)
 static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c)
 {
+        if (atomic_read(&pfkey_socks_nr) == 0)
+                return 0;
        switch (c->event) {
        case XFRM_MSG_EXPIRE:
                return key_notify_sa_expire(x, c);
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index e2ddde755019..008de1fc42ca 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -286,12 +286,14 @@ void llc_build_and_send_xid_pkt(struct llc_sap *sap, struct sk_buff *skb,
 *
 *      Sends received pdus to the sap state machine.
 */
-static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb)
+static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
+                        struct sock *sk)
 {
        struct llc_sap_state_ev *ev = llc_sap_ev(skb);
        ev->type   = LLC_SAP_EV_TYPE_PDU;
        ev->reason = 0;
+        skb->sk = sk;
        llc_sap_state_process(sap, skb);
 }
@@ -360,8 +362,7 @@ static void llc_sap_mcast(struct llc_sap *sap,
                        break;
                sock_hold(sk);
-                skb_set_owner_r(skb1, sk);
+                llc_sap_rcv(sap, skb1, sk);
-                llc_sap_rcv(sap, skb1);
                sock_put(sk);
        }
        read_unlock_bh(&sap->sk_list.lock);
@@ -381,8 +382,7 @@ void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb)
        } else {
                struct sock *sk = llc_lookup_dgram(sap, &laddr);
                if (sk) {
-                        skb_set_owner_r(skb, sk);
+                        llc_sap_rcv(sap, skb, sk);
-                        llc_sap_rcv(sap, skb);
                        sock_put(sk);
                } else
                        kfree_skb(skb);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 699d97b8de5e..a9fce4afdf21 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -672,7 +672,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (params->vlan) {
                sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
-                if (sdata->vif.type != IEEE80211_IF_TYPE_VLAN ||
+                if (sdata->vif.type != IEEE80211_IF_TYPE_VLAN &&
                    sdata->vif.type != IEEE80211_IF_TYPE_AP)
                        return -EINVAL;
        } else
@@ -760,7 +760,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
        if (params->vlan && params->vlan != sta->sdata->dev) {
                vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
-                if (vlansdata->vif.type != IEEE80211_IF_TYPE_VLAN ||
+                if (vlansdata->vif.type != IEEE80211_IF_TYPE_VLAN &&
                    vlansdata->vif.type != IEEE80211_IF_TYPE_AP) {
                        rcu_read_unlock();
                        return -EINVAL;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c7314bf4bec2..006486b26726 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -899,7 +899,7 @@ extern const struct iw_handler_def ieee80211_iw_handler_def;
 /* ieee80211_ioctl.c */
-int ieee80211_set_freq(struct ieee80211_local *local, int freq);
+int ieee80211_set_freq(struct net_device *dev, int freq);
 /* ieee80211_sta.c */
 void ieee80211_sta_timer(unsigned long data);
 void ieee80211_sta_work(struct work_struct *work);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 915afadb0602..98c0b5e56ecc 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -511,6 +511,7 @@ static int ieee80211_stop(struct net_device *dev)
        case IEEE80211_IF_TYPE_STA:
        case IEEE80211_IF_TYPE_IBSS:
                sdata->u.sta.state = IEEE80211_DISABLED;
+                memset(sdata->u.sta.bssid, 0, ETH_ALEN);
                del_timer_sync(&sdata->u.sta.timer);
                /*
                 * When we get here, the interface is marked down.
@@ -1313,7 +1314,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
        /*
         * Clear the TX filter mask for this STA when sending the next
         * packet. If the STA went to power save mode, this will happen
-         * happen when it wakes up for the next time.
+         * when it wakes up for the next time.
         */
        sta->flags |= WLAN_STA_CLEAR_PS_FILT;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7cfd12e0d1e2..4d2b582dd055 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -44,7 +44,7 @@
 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
-#define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
+#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
 #define IEEE80211_PROBE_DELAY (HZ / 33)
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
@@ -1325,7 +1325,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
        /* prepare reordering buffer */
        tid_agg_rx->reorder_buf =
-                kmalloc(buf_size * sizeof(struct sk_buf *), GFP_ATOMIC);
+                kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
        if (!tid_agg_rx->reorder_buf) {
                if (net_ratelimit())
                        printk(KERN_ERR "can not allocate reordering buffer "
@@ -1334,7 +1334,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
                goto end;
        }
        memset(tid_agg_rx->reorder_buf, 0,
-                buf_size * sizeof(struct sk_buf *));
+                buf_size * sizeof(struct sk_buff *));
        if (local->ops->ampdu_action)
                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
@@ -1614,7 +1614,7 @@ void sta_addba_resp_timer_expired(unsigned long data)
         * only one argument, and both sta_info and TID are needed, so init
         * flow in sta_info_create gives the TID as data, while the timer_to_id
         * array gives the sta through container_of */
-        u16 tid = *(int *)data;
+        u16 tid = *(u8 *)data;
        struct sta_info *temp_sta = container_of((void *)data,
                struct sta_info, timer_to_tid[tid]);
@@ -1662,7 +1662,7 @@ timer_expired_exit:
 void sta_rx_agg_session_timer_expired(unsigned long data)
 {
        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and verious sta_info are needed here, so init
+         * only one argument, and various sta_info are needed here, so init
         * flow in sta_info_create gives the TID as data, while the timer_to_id
         * array gives the sta through container_of */
        u8 *ptid = (u8 *)data;
@@ -2336,6 +2336,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
        u8 *pos;
        struct ieee80211_sub_if_data *sdata;
        struct ieee80211_supported_band *sband;
+        union iwreq_data wrqu;
        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
@@ -2358,13 +2359,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
        sdata->drop_unencrypted = bss->capability &
                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-        res = ieee80211_set_freq(local, bss->freq);
+        res = ieee80211_set_freq(dev, bss->freq);
-        if (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS) {
+        if (res)
-                printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
+                return res;
-                       "%d MHz\n", dev->name, local->oper_channel->center_freq);
-                return -1;
-        }
        /* Set beacon template */
        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
@@ -2479,7 +2477,9 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
        ifsta->state = IEEE80211_IBSS_JOINED;
        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
-        ieee80211_rx_bss_put(dev, bss);
+        memset(&wrqu, 0, sizeof(wrqu));
+        memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
        return res;
 }
@@ -3488,7 +3488,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
        spin_unlock_bh(&local->sta_bss_lock);
        if (selected) {
-                ieee80211_set_freq(local, selected->freq);
+                ieee80211_set_freq(dev, selected->freq);
                if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
                        ieee80211_sta_set_ssid(dev, selected->ssid,
                                               selected->ssid_len);
@@ -3523,6 +3523,7 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
        struct ieee80211_supported_band *sband;
        u8 bssid[ETH_ALEN], *pos;
        int i;
+        int ret;
        DECLARE_MAC_BUF(mac);
 #if 0
@@ -3567,7 +3568,9 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
                *pos++ = (u8) (rate / 5);
        }
-        return ieee80211_sta_join_ibss(dev, ifsta, bss);
+        ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
+        ieee80211_rx_bss_put(dev, bss);
+        return ret;
 }
@@ -3615,10 +3618,13 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
            (bss = ieee80211_rx_bss_get(dev, bssid,
                                        local->hw.conf.channel->center_freq,
                                        ifsta->ssid, ifsta->ssid_len))) {
+                int ret;
                printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
                       " based on configured SSID\n",
                       dev->name, print_mac(mac, bssid));
-                return ieee80211_sta_join_ibss(dev, ifsta, bss);
+                ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
+                ieee80211_rx_bss_put(dev, bss);
+                return ret;
        }
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
        printk(KERN_DEBUG "   did not try to join ibss\n");
@@ -4095,18 +4101,17 @@ ieee80211_sta_scan_result(struct net_device *dev,
        memset(&iwe, 0, sizeof(iwe));
        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = bss->freq;
+        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
-        iwe.u.freq.e = 6;
+        iwe.u.freq.e = 0;
        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                          IW_EV_FREQ_LEN);
        memset(&iwe, 0, sizeof(iwe));
        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
+        iwe.u.freq.m = bss->freq;
-        iwe.u.freq.e = 0;
+        iwe.u.freq.e = 6;
        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                          IW_EV_FREQ_LEN);
        memset(&iwe, 0, sizeof(iwe));
        iwe.cmd = IWEVQUAL;
        iwe.u.qual.qual = bss->signal;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1958bfb361c6..0941e5d6a522 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1091,7 +1091,7 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
        u16 fc, hdrlen, ethertype;
        u8 *payload;
        u8 dst[ETH_ALEN];
-        u8 src[ETH_ALEN];
+        u8 src[ETH_ALEN] __aligned(2);
        struct sk_buff *skb = rx->skb;
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        DECLARE_MAC_BUF(mac);
@@ -1234,7 +1234,7 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 */
 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx)
 {
-        static const u8 pae_group_addr[ETH_ALEN]
+        static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
                = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
        struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 131e9e6c8a32..4e97b266f907 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -34,11 +34,11 @@ void *mac80211_wiphy_privid = &mac80211_wiphy_privid;
 /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
 /* Ethernet-II snap header (RFC1042 for most EtherTypes) */
-const unsigned char rfc1042_header[] =
+const unsigned char rfc1042_header[] __aligned(2) =
        { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 /* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
-const unsigned char bridge_tunnel_header[] =
+const unsigned char bridge_tunnel_header[] __aligned(2) =
        { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 457ebf9e85ae..a8bb8e31b1ec 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -290,14 +290,22 @@ static int ieee80211_ioctl_giwmode(struct net_device *dev,
        return 0;
 }
-int ieee80211_set_freq(struct ieee80211_local *local, int freqMHz)
+int ieee80211_set_freq(struct net_device *dev, int freqMHz)
 {
        int ret = -EINVAL;
        struct ieee80211_channel *chan;
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        chan = ieee80211_get_channel(local->hw.wiphy, freqMHz);
        if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
+                if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
+                    chan->flags & IEEE80211_CHAN_NO_IBSS) {
+                        printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
+                                "%d MHz\n", dev->name, chan->center_freq);
+                        return ret;
+                }
                local->oper_channel = chan;
                if (local->sta_sw_scanning || local->sta_hw_scanning)
@@ -315,7 +323,6 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                   struct iw_request_info *info,
                                   struct iw_freq *freq, char *extra)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
@@ -329,14 +336,14 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                        IEEE80211_STA_AUTO_CHANNEL_SEL;
                        return 0;
                } else
-                        return ieee80211_set_freq(local,
+                        return ieee80211_set_freq(dev,
                                ieee80211_channel_to_frequency(freq->m));
        } else {
                int i, div = 1000000;
                for (i = 0; i < freq->e; i++)
                        div /= 10;
                if (div > 0)
-                        return ieee80211_set_freq(local, freq->m / div);
+                        return ieee80211_set_freq(dev, freq->m / div);
                else
                        return -EINVAL;
        }
@@ -489,9 +496,14 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                ap_addr->sa_family = ARPHRD_ETHER;
+                if (sdata->u.sta.state == IEEE80211_ASSOCIATED) {
-                memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
+                        ap_addr->sa_family = ARPHRD_ETHER;
-                return 0;
+                        memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
+                        return 0;
+                } else {
+                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
+                        return 0;
+                }
        } else if (sdata->vif.type == IEEE80211_IF_TYPE_WDS) {
                ap_addr->sa_family = ARPHRD_ETHER;
                memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index c4b1799da5d7..662c1ccfee26 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -196,8 +196,6 @@ destroy_conntrack(struct nf_conntrack *nfct)
        if (l4proto && l4proto->destroy)
                l4proto->destroy(ct);
-        nf_ct_ext_destroy(ct);
        rcu_read_unlock();
        spin_lock_bh(&nf_conntrack_lock);
@@ -520,6 +518,7 @@ static void nf_conntrack_free_rcu(struct rcu_head *head)
 void nf_conntrack_free(struct nf_conn *ct)
 {
+        nf_ct_ext_destroy(ct);
        call_rcu(&ct->rcu, nf_conntrack_free_rcu);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_free);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index e31beeb33b2b..e8f0dead267f 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -587,10 +587,10 @@ int __init nf_conntrack_expect_init(void)
        return 0;
 err3:
+        kmem_cache_destroy(nf_ct_expect_cachep);
+err2:
        nf_ct_free_hashtable(nf_ct_expect_hash, nf_ct_expect_vmalloc,
                             nf_ct_expect_hsize);
-err2:
-        kmem_cache_destroy(nf_ct_expect_cachep);
 err1:
        return err;
 }
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index bc11d7092032..9fda6ee95a31 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -92,10 +92,6 @@ void nf_log_packet(int pf,
                vsnprintf(prefix, sizeof(prefix), fmt, args);
                va_end(args);
                logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix);
-        } else if (net_ratelimit()) {
-                printk(KERN_WARNING "nf_log_packet: can\'t log since "
-                       "no backend logging module loaded in! Please either "
-                       "load one, or disable logging explicitly\n");
        }
        rcu_read_unlock();
 }
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 2e89a00df92c..70907f6baac3 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -73,7 +73,8 @@ connlimit_iphash6(const union nf_inet_addr *addr,
 static inline bool already_closed(const struct nf_conn *conn)
 {
        if (nf_ct_protonum(conn) == IPPROTO_TCP)
-                return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
+                return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT ||
+                       conn->proto.tcp.state == TCP_CONNTRACK_CLOSE;
        else
                return 0;
 }
diff --git a/net/netlink/attr.c b/net/netlink/attr.c
index feb326f4a752..47bbf45ae5d7 100644
--- a/net/netlink/attr.c
+++ b/net/netlink/attr.c
@@ -400,13 +400,13 @@ void __nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
 * @attrlen: length of attribute payload
 * @data: head of attribute payload
 *
- * Returns -1 if the tailroom of the skb is insufficient to store
+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
 * the attribute header and payload.
 */
 int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
 {
        if (unlikely(skb_tailroom(skb) < nla_total_size(attrlen)))
-                return -1;
+                return -EMSGSIZE;
        __nla_put(skb, attrtype, attrlen, data);
        return 0;
@@ -418,13 +418,13 @@ int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
 * @attrlen: length of attribute payload
 * @data: head of attribute payload
 *
- * Returns -1 if the tailroom of the skb is insufficient to store
+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
 * the attribute payload.
 */
 int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
 {
        if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
-                return -1;
+                return -EMSGSIZE;
        __nla_put_nohdr(skb, attrlen, data);
        return 0;
@@ -436,13 +436,13 @@ int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
 * @attrlen: length of attribute payload
 * @data: head of attribute payload
 *
- * Returns -1 if the tailroom of the skb is insufficient to store
+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
 * the attribute payload.
 */
 int nla_append(struct sk_buff *skb, int attrlen, const void *data)
 {
        if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
-                return -1;
+                return -EMSGSIZE;
        memcpy(skb_put(skb, attrlen), data, attrlen);
        return 0;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index d16929c9b4bc..f5aa23c3e886 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -554,7 +554,8 @@ static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
        return genlmsg_end(skb, hdr);
 nla_put_failure:
-        return genlmsg_cancel(skb, hdr);
+        genlmsg_cancel(skb, hdr);
+        return -EMSGSIZE;
 }
 static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 pid,
@@ -590,7 +591,8 @@ static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 pid,
        return genlmsg_end(skb, hdr);
 nla_put_failure:
-        return genlmsg_cancel(skb, hdr);
+        genlmsg_cancel(skb, hdr);
+        return -EMSGSIZE;
 }
 static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 0df911fd67b1..64465bacbe79 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -444,7 +444,8 @@ static int dsmark_dump_class(struct Qdisc *sch, unsigned long cl,
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
@@ -466,7 +467,8 @@ static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static const struct Qdisc_class_ops dsmark_class_ops = {
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 3a9d226ff1e4..c89fba56db56 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -582,7 +582,8 @@ append_opt:
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static void gred_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 87293d0db1d7..fdfaa3fcc16d 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1360,7 +1360,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
 nla_put_failure:
        nla_nest_cancel(skb, nest);
-        return -1;
+        return -EMSGSIZE;
 }
 static int
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 3dcd493f4f4a..5c569853b9c0 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -281,7 +281,8 @@ static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static int red_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index b4cd2b71953f..532634861db1 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1203,6 +1203,9 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
        struct list_head *head = &asoc->peer.transport_addr_list;
        struct list_head *pos;
+        if (asoc->peer.transport_count == 1)
+                return;
        /* Find the next transport in a round-robin fashion. */
        t = asoc->peer.retran_path;
        pos = &t->transports;
@@ -1217,6 +1220,15 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
                t = list_entry(pos, struct sctp_transport, transports);
+                /* We have exhausted the list, but didn't find any
+                 * other active transports.  If so, use the next
+                 * transport.
+                 */
+                if (t == asoc->peer.retran_path) {
+                        t = next;
+                        break;
+                }
                /* Try to find an active transport. */
                if ((t->state == SCTP_ACTIVE) ||
@@ -1229,15 +1241,6 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
                        if (!next)
                                next = t;
                }
-                /* We have exhausted the list, but didn't find any
-                 * other active transports.  If so, use the next
-                 * transport.
-                 */
-                if (t == asoc->peer.retran_path) {
-                        t = next;
-                        break;
-                }
        }
        asoc->peer.retran_path = t;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index e45e44c60635..a2f4d4d51593 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -299,7 +299,8 @@ static inline int sctp_v6_addr_match_len(union sctp_addr *s1,
 /* Fills in the source address(saddr) based on the destination address(daddr)
 * and asoc's bind address list.
 */
-static void sctp_v6_get_saddr(struct sctp_association *asoc,
+static void sctp_v6_get_saddr(struct sctp_sock *sk,
+                              struct sctp_association *asoc,
                              struct dst_entry *dst,
                              union sctp_addr *daddr,
                              union sctp_addr *saddr)
@@ -318,7 +319,7 @@ static void sctp_v6_get_saddr(struct sctp_association *asoc,
        if (!asoc) {
                ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL,
                                   &daddr->v6.sin6_addr,
-                                   inet6_sk(asoc->base.sk)->srcprefs,
+                                   inet6_sk(&sk->inet.sk)->srcprefs,
                                   &saddr->v6.sin6_addr);
                SCTP_DEBUG_PRINTK("saddr from ipv6_get_saddr: " NIP6_FMT "\n",
                                  NIP6(saddr->v6.sin6_addr));
@@ -726,6 +727,11 @@ static void sctp_v6_seq_dump_addr(struct seq_file *seq, union sctp_addr *addr)
        seq_printf(seq, NIP6_FMT " ", NIP6(addr->v6.sin6_addr));
 }
+static void sctp_v6_ecn_capable(struct sock *sk)
+{
+        inet6_sk(sk)->tclass |= INET_ECN_ECT_0;
+}
 /* Initialize a PF_INET6 socket msg_name. */
 static void sctp_inet6_msgname(char *msgname, int *addr_len)
 {
@@ -996,6 +1002,7 @@ static struct sctp_af sctp_af_inet6 = {
        .skb_iif           = sctp_v6_skb_iif,
        .is_ce             = sctp_v6_is_ce,
        .seq_dump_addr     = sctp_v6_seq_dump_addr,
+        .ecn_capable       = sctp_v6_ecn_capable,
        .net_header_len    = sizeof(struct ipv6hdr),
        .sockaddr_len      = sizeof(struct sockaddr_in6),
 #ifdef CONFIG_COMPAT
diff --git a/net/sctp/output.c b/net/sctp/output.c
index cf4f9fb6819d..6d45bae93b46 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -548,7 +548,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         * Note: The works for IPv6 layer checks this bit too later
         * in transmission.  See IP6_ECN_flow_xmit().
         */
-        INET_ECN_xmit(nskb->sk);
+        (*tp->af_specific->ecn_capable)(nskb->sk);
        /* Set up the IP options.  */
        /* BUG: not implemented
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 59edfd25a19c..ace6770e9048 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -208,6 +208,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
        INIT_LIST_HEAD(&q->sacked);
        INIT_LIST_HEAD(&q->abandoned);
+        q->fast_rtx = 0;
        q->outstanding_bytes = 0;
        q->empty = 1;
        q->cork  = 0;
@@ -500,6 +501,7 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
        case SCTP_RTXR_FAST_RTX:
                SCTP_INC_STATS(SCTP_MIB_FAST_RETRANSMITS);
                sctp_transport_lower_cwnd(transport, SCTP_LOWER_CWND_FAST_RTX);
+                q->fast_rtx = 1;
                break;
        case SCTP_RTXR_PMTUD:
                SCTP_INC_STATS(SCTP_MIB_PMTUD_RETRANSMITS);
@@ -518,9 +520,15 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
         * the sender SHOULD try to advance the "Advanced.Peer.Ack.Point" by
         * following the procedures outlined in C1 - C5.
         */
-        sctp_generate_fwdtsn(q, q->asoc->ctsn_ack_point);
+        if (reason == SCTP_RTXR_T3_RTX)
+                sctp_generate_fwdtsn(q, q->asoc->ctsn_ack_point);
-        error = sctp_outq_flush(q, /* rtx_timeout */ 1);
+        /* Flush the queues only on timeout, since fast_rtx is only
+         * triggered during sack processing and the queue
+         * will be flushed at the end.
+         */
+        if (reason != SCTP_RTXR_FAST_RTX)
+                error = sctp_outq_flush(q, /* rtx_timeout */ 1);
        if (error)
                q->asoc->base.sk->sk_err = -error;
@@ -538,17 +546,23 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                               int rtx_timeout, int *start_timer)
 {
        struct list_head *lqueue;
-        struct list_head *lchunk;
        struct sctp_transport *transport = pkt->transport;
        sctp_xmit_t status;
        struct sctp_chunk *chunk, *chunk1;
        struct sctp_association *asoc;
+        int fast_rtx;
        int error = 0;
+        int timer = 0;
+        int done = 0;
        asoc = q->asoc;
        lqueue = &q->retransmit;
+        fast_rtx = q->fast_rtx;
-        /* RFC 2960 6.3.3 Handle T3-rtx Expiration
+        /* This loop handles time-out retransmissions, fast retransmissions,
+         * and retransmissions due to opening of whindow.
+         *
+         * RFC 2960 6.3.3 Handle T3-rtx Expiration
         *
         * E3) Determine how many of the earliest (i.e., lowest TSN)
         * outstanding DATA chunks for the address for which the
@@ -563,12 +577,12 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
         * [Just to be painfully clear, if we are retransmitting
         * because a timeout just happened, we should send only ONE
         * packet of retransmitted data.]
+         *
+         * For fast retransmissions we also send only ONE packet.  However,
+         * if we are just flushing the queue due to open window, we'll
+         * try to send as much as possible.
         */
-        lchunk = sctp_list_dequeue(lqueue);
+        list_for_each_entry_safe(chunk, chunk1, lqueue, transmitted_list) {
-        while (lchunk) {
-                chunk = list_entry(lchunk, struct sctp_chunk,
-                                   transmitted_list);
                /* Make sure that Gap Acked TSNs are not retransmitted.  A
                 * simple approach is just to move such TSNs out of the
@@ -576,58 +590,60 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                 * next chunk.
                 */
                if (chunk->tsn_gap_acked) {
-                        list_add_tail(lchunk, &transport->transmitted);
+                        list_del(&chunk->transmitted_list);
-                        lchunk = sctp_list_dequeue(lqueue);
+                        list_add_tail(&chunk->transmitted_list,
+                                        &transport->transmitted);
                        continue;
                }
+                /* If we are doing fast retransmit, ignore non-fast_rtransmit
+                 * chunks
+                 */
+                if (fast_rtx && !chunk->fast_retransmit)
+                        continue;
                /* Attempt to append this chunk to the packet. */
                status = sctp_packet_append_chunk(pkt, chunk);
                switch (status) {
                case SCTP_XMIT_PMTU_FULL:
                        /* Send this packet.  */
-                        if ((error = sctp_packet_transmit(pkt)) == 0)
+                        error = sctp_packet_transmit(pkt);
-                                *start_timer = 1;
                        /* If we are retransmitting, we should only
                         * send a single packet.
                         */
-                        if (rtx_timeout) {
+                        if (rtx_timeout || fast_rtx)
-                                list_add(lchunk, lqueue);
+                                done = 1;
-                                lchunk = NULL;
-                        }
-                        /* Bundle lchunk in the next round.  */
+                        /* Bundle next chunk in the next round.  */
                        break;
                case SCTP_XMIT_RWND_FULL:
                        /* Send this packet. */
-                        if ((error = sctp_packet_transmit(pkt)) == 0)
+                        error = sctp_packet_transmit(pkt);
-                                *start_timer = 1;
                        /* Stop sending DATA as there is no more room
                         * at the receiver.
                         */
-                        list_add(lchunk, lqueue);
+                        done = 1;
-                        lchunk = NULL;
                        break;
                case SCTP_XMIT_NAGLE_DELAY:
                        /* Send this packet. */
-                        if ((error = sctp_packet_transmit(pkt)) == 0)
+                        error = sctp_packet_transmit(pkt);
-                                *start_timer = 1;
                        /* Stop sending DATA because of nagle delay. */
-                        list_add(lchunk, lqueue);
+                        done = 1;
-                        lchunk = NULL;
                        break;
                default:
                        /* The append was successful, so add this chunk to
                         * the transmitted list.
                         */
-                        list_add_tail(lchunk, &transport->transmitted);
+                        list_del(&chunk->transmitted_list);
+                        list_add_tail(&chunk->transmitted_list,
+                                        &transport->transmitted);
                        /* Mark the chunk as ineligible for fast retransmit
                         * after it is retransmitted.
@@ -635,27 +651,44 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                        if (chunk->fast_retransmit > 0)
                                chunk->fast_retransmit = -1;
-                        *start_timer = 1;
+                        /* Force start T3-rtx timer when fast retransmitting
-                        q->empty = 0;
+                         * the earliest outstanding TSN
+                         */
+                        if (!timer && fast_rtx &&
+                            ntohl(chunk->subh.data_hdr->tsn) ==
+                                             asoc->ctsn_ack_point + 1)
+                                timer = 2;
-                        /* Retrieve a new chunk to bundle. */
+                        q->empty = 0;
-                        lchunk = sctp_list_dequeue(lqueue);
                        break;
                }
-                /* If we are here due to a retransmit timeout or a fast
+                /* Set the timer if there were no errors */
-                 * retransmit and if there are any chunks left in the retransmit
+                if (!error && !timer)
-                 * queue that could not fit in the PMTU sized packet, they need
+                        timer = 1;
-                 * to be marked as ineligible for a subsequent fast retransmit.
-                 */
+                if (done)
-                if (rtx_timeout && !lchunk) {
+                        break;
-                        list_for_each_entry(chunk1, lqueue, transmitted_list) {
+        }
-                                if (chunk1->fast_retransmit > 0)
-                                        chunk1->fast_retransmit = -1;
+        /* If we are here due to a retransmit timeout or a fast
-                        }
+         * retransmit and if there are any chunks left in the retransmit
+         * queue that could not fit in the PMTU sized packet, they need
+         * to be marked as ineligible for a subsequent fast retransmit.
+         */
+        if (rtx_timeout || fast_rtx) {
+                list_for_each_entry(chunk1, lqueue, transmitted_list) {
+                        if (chunk1->fast_retransmit > 0)
+                                chunk1->fast_retransmit = -1;
                }
        }
+        *start_timer = timer;
+        /* Clear fast retransmit hint */
+        if (fast_rtx)
+                q->fast_rtx = 0;
        return error;
 }
@@ -862,7 +895,8 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                                                    rtx_timeout, &start_timer);
                        if (start_timer)
-                                sctp_transport_reset_timers(transport);
+                                sctp_transport_reset_timers(transport,
+                                                            start_timer-1);
                        /* This can happen on COOKIE-ECHO resend.  Only
                         * one chunk can get bundled with a COOKIE-ECHO.
@@ -977,7 +1011,7 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                        list_add_tail(&chunk->transmitted_list,
                                      &transport->transmitted);
-                        sctp_transport_reset_timers(transport);
+                        sctp_transport_reset_timers(transport, start_timer-1);
                        q->empty = 0;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 0ec234b762c2..b435a193c5df 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -470,11 +470,11 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
                /* Walk through the bind address list and look for a bind
                 * address that matches the source address of the returned dst.
                 */
+                sctp_v4_dst_saddr(&dst_saddr, dst, htons(bp->port));
                rcu_read_lock();
                list_for_each_entry_rcu(laddr, &bp->address_list, list) {
                        if (!laddr->valid || (laddr->state != SCTP_ADDR_SRC))
                                continue;
-                        sctp_v4_dst_saddr(&dst_saddr, dst, htons(bp->port));
                        if (sctp_v4_cmp_addr(&dst_saddr, &laddr->a))
                                goto out_unlock;
                }
@@ -519,7 +519,8 @@ out:
 /* For v4, the source address is cached in the route entry(dst). So no need
 * to cache it separately and hence this is an empty routine.
 */
-static void sctp_v4_get_saddr(struct sctp_association *asoc,
+static void sctp_v4_get_saddr(struct sctp_sock *sk,
+                              struct sctp_association *asoc,
                              struct dst_entry *dst,
                              union sctp_addr *daddr,
                              union sctp_addr *saddr)
@@ -616,6 +617,11 @@ static void sctp_v4_seq_dump_addr(struct seq_file *seq, union sctp_addr *addr)
        seq_printf(seq, "%d.%d.%d.%d ", NIPQUAD(addr->v4.sin_addr));
 }
+static void sctp_v4_ecn_capable(struct sock *sk)
+{
+        INET_ECN_xmit(sk);
+}
 /* Event handler for inet address addition/deletion events.
 * The sctp_local_addr_list needs to be protocted by a spin lock since
 * multiple notifiers (say IPv4 and IPv6) may be running at the same
@@ -934,6 +940,7 @@ static struct sctp_af sctp_af_inet = {
        .skb_iif           = sctp_v4_skb_iif,
        .is_ce             = sctp_v4_is_ce,
        .seq_dump_addr     = sctp_v4_seq_dump_addr,
+        .ecn_capable       = sctp_v4_ecn_capable,
        .net_header_len    = sizeof(struct iphdr),
        .sockaddr_len      = sizeof(struct sockaddr_in),
 #ifdef CONFIG_COMPAT
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index f4938f6c5abe..3f34f61221ec 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -79,6 +79,7 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
        peer->rttvar = 0;
        peer->srtt = 0;
        peer->rto_pending = 0;
+        peer->fast_recovery = 0;
        peer->last_time_heard = jiffies;
        peer->last_time_used = jiffies;
@@ -190,7 +191,7 @@ static void sctp_transport_destroy(struct sctp_transport *transport)
 /* Start T3_rtx timer if it is not already running and update the heartbeat
 * timer.  This routine is called every time a DATA chunk is sent.
 */
-void sctp_transport_reset_timers(struct sctp_transport *transport)
+void sctp_transport_reset_timers(struct sctp_transport *transport, int force)
 {
        /* RFC 2960 6.3.2 Retransmission Timer Rules
         *
@@ -200,7 +201,7 @@ void sctp_transport_reset_timers(struct sctp_transport *transport)
         * address.
         */
-        if (!timer_pending(&transport->T3_rtx_timer))
+        if (force || !timer_pending(&transport->T3_rtx_timer))
                if (!mod_timer(&transport->T3_rtx_timer,
                               jiffies + transport->rto))
                        sctp_transport_hold(transport);
@@ -291,7 +292,7 @@ void sctp_transport_route(struct sctp_transport *transport,
        if (saddr)
                memcpy(&transport->saddr, saddr, sizeof(union sctp_addr));
        else
-                af->get_saddr(asoc, dst, daddr, &transport->saddr);
+                af->get_saddr(opt, asoc, dst, daddr, &transport->saddr);
        transport->dst = dst;
        if ((transport->param_flags & SPP_PMTUD_DISABLE) && transport->pathmtu) {
@@ -403,11 +404,16 @@ void sctp_transport_raise_cwnd(struct sctp_transport *transport,
        cwnd = transport->cwnd;
        flight_size = transport->flight_size;
+        /* See if we need to exit Fast Recovery first */
+        if (transport->fast_recovery &&
+            TSN_lte(transport->fast_recovery_exit, sack_ctsn))
+                transport->fast_recovery = 0;
        /* The appropriate cwnd increase algorithm is performed if, and only
-         * if the cumulative TSN has advanced and the congestion window is
+         * if the cumulative TSN whould advanced and the congestion window is
         * being fully utilized.
         */
-        if ((transport->asoc->ctsn_ack_point >= sack_ctsn) ||
+        if (TSN_lte(sack_ctsn, transport->asoc->ctsn_ack_point) ||
            (flight_size < cwnd))
                return;
@@ -416,17 +422,23 @@ void sctp_transport_raise_cwnd(struct sctp_transport *transport,
        pmtu = transport->asoc->pathmtu;
        if (cwnd <= ssthresh) {
-                /* RFC 2960 7.2.1, sctpimpguide-05 2.14.2 When cwnd is less
+                /* RFC 4960 7.2.1
-                 * than or equal to ssthresh an SCTP endpoint MUST use the
+                 * o  When cwnd is less than or equal to ssthresh, an SCTP
-                 * slow start algorithm to increase cwnd only if the current
+                 *    endpoint MUST use the slow-start algorithm to increase
-                 * congestion window is being fully utilized and an incoming
+                 *    cwnd only if the current congestion window is being fully
-                 * SACK advances the Cumulative TSN Ack Point. Only when these
+                 *    utilized, an incoming SACK advances the Cumulative TSN
-                 * two conditions are met can the cwnd be increased otherwise
+                 *    Ack Point, and the data sender is not in Fast Recovery.
-                 * the cwnd MUST not be increased. If these conditions are met
+                 *    Only when these three conditions are met can the cwnd be
-                 * then cwnd MUST be increased by at most the lesser of
+                 *    increased; otherwise, the cwnd MUST not be increased.
-                 * 1) the total size of the previously outstanding DATA
+                 *    If these conditions are met, then cwnd MUST be increased
-                 * chunk(s) acknowledged, and 2) the destination's path MTU.
+                 *    by, at most, the lesser of 1) the total size of the
+                 *    previously outstanding DATA chunk(s) acknowledged, and
+                 *    2) the destination's path MTU.  This upper bound protects
+                 *    against the ACK-Splitting attack outlined in [SAVAGE99].
                 */
+                if (transport->fast_recovery)
+                        return;
                if (bytes_acked > pmtu)
                        cwnd += pmtu;
                else
@@ -502,6 +514,13 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                 *      cwnd = ssthresh
                 *      partial_bytes_acked = 0
                 */
+                if (transport->fast_recovery)
+                        return;
+                /* Mark Fast recovery */
+                transport->fast_recovery = 1;
+                transport->fast_recovery_exit = transport->asoc->next_tsn - 1;
                transport->ssthresh = max(transport->cwnd/2,
                                          4*transport->asoc->pathmtu);
                transport->cwnd = transport->ssthresh;
@@ -586,6 +605,7 @@ void sctp_transport_reset(struct sctp_transport *t)
        t->flight_size = 0;
        t->error_count = 0;
        t->rto_pending = 0;
+        t->fast_recovery = 0;
        /* Initialize the state information for SFR-CACC */
        t->cacc.changeover_active = 0;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2bdd4dddc0e1..fb75f265b39c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -187,7 +187,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
@@ -273,7 +274,8 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
@@ -928,7 +930,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_station(struct sk_buff *skb,
@@ -1267,7 +1270,8 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_mpath(struct sk_buff *skb,
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index ac765dd9c7f5..23a2cc04b8cd 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -200,8 +200,8 @@ static struct xfrm_algo_desc aalg_list[] = {
        }
 },
 {
-        .name = "hmac(ripemd160)",
+        .name = "hmac(rmd160)",
-        .compat = "ripemd160",
+        .compat = "rmd160",
        .uinfo = {
                .auth = {
diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
index a098a0454dc8..17092d6c7db3 100644
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -43,7 +43,13 @@ _modpost: __modpost
 include include/config/auto.conf
 include scripts/Kbuild.include
+# When building external modules load the Kbuild file to retreive EXTRA_SYMBOLS info
 ifneq ($(KBUILD_EXTMOD),)
+# set src + obj - they may be used when building the .mod.c file
+obj := $(KBUILD_EXTMOD)
+src := $(obj)
 # Include the module's Makefile to find KBUILD_EXTRA_SYMBOLS
 include $(if $(wildcard $(KBUILD_EXTMOD)/Kbuild), \
             $(KBUILD_EXTMOD)/Kbuild, $(KBUILD_EXTMOD)/Makefile)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index b6bbbcdc557e..6971bf078d13 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -9,7 +9,7 @@ use strict;
 my $P = $0;
 $P =~ s@.*/@@g;
-my $V = '0.18';
+my $V = '0.19';
 use Getopt::Long qw(:config no_auto_abbrev);
@@ -115,6 +115,7 @@ our $Attribute	= qr{
                        __kprobes|
                        __(?:mem|cpu|dev|)(?:initdata|init)
                  }x;
+our $Modifier;
 our $Inline     = qr{inline|__always_inline|noinline};
 our $Member     = qr{->$Ident|\.$Ident|\[[^]]*\]};
 our $Lval       = qr{$Ident(?:$Member)*};
@@ -144,17 +145,17 @@ our $UTF8	= qr {
 our @typeList = (
        qr{void},
-        qr{char},
+        qr{(?:unsigned\s+)?char},
-        qr{short},
+        qr{(?:unsigned\s+)?short},
-        qr{int},
+        qr{(?:unsigned\s+)?int},
-        qr{long},
+        qr{(?:unsigned\s+)?long},
+        qr{(?:unsigned\s+)?long\s+int},
+        qr{(?:unsigned\s+)?long\s+long},
+        qr{(?:unsigned\s+)?long\s+long\s+int},
        qr{unsigned},
        qr{float},
        qr{double},
        qr{bool},
-        qr{long\s+int},
-        qr{long\s+long},
-        qr{long\s+long\s+int},
        qr{(?:__)?(?:u|s|be|le)(?:8|16|32|64)},
        qr{struct\s+$Ident},
        qr{union\s+$Ident},
@@ -163,26 +164,29 @@ our @typeList = (
        qr{${Ident}_handler},
        qr{${Ident}_handler_fn},
 );
+our @modifierList = (
+        qr{fastcall},
+);
 sub build_types {
+        my $mods = "(?:  \n" . join("|\n  ", @modifierList) . "\n)";
        my $all = "(?:  \n" . join("|\n  ", @typeList) . "\n)";
        $NonptrType     = qr{
-                        \b
                        (?:const\s+)?
-                        (?:unsigned\s+)?
+                        (?:$mods\s+)?
                        (?:
-                                $all|
+                                (?:typeof|__typeof__)\s*\(\s*\**\s*$Ident\s*\)|
-                                (?:typeof|__typeof__)\s*\(\s*\**\s*$Ident\s*\)
+                                (?:${all}\b)
                        )
                        (?:\s+$Sparse|\s+const)*
-                        \b
                  }x;
        $Type   = qr{
-                        \b$NonptrType\b
+                        $NonptrType
                        (?:\s*\*+\s*const|\s*\*+|(?:\s*\[\s*\])+)?
-                        (?:\s+$Inline|\s+$Sparse|\s+$Attribute)*
+                        (?:\s+$Inline|\s+$Sparse|\s+$Attribute|\s+$mods)*
                  }x;
        $Declare        = qr{(?:$Storage\s+)?$Type};
+        $Modifier       = qr{(?:$Attribute|$Sparse|$mods)};
 }
 build_types();
@@ -329,7 +333,7 @@ sub sanitise_line {
                        $off++;
                        next;
                }
-                if (substr($line, $off, 2) eq $sanitise_quote) {
+                if (substr($line, $off, 2) eq '*/') {
                        $sanitise_quote = '';
                        substr($res, $off, 2, "$;$;");
                        $off++;
@@ -366,14 +370,14 @@ sub sanitise_line {
        }
        # The pathname on a #include may be surrounded by '<' and '>'.
-        if ($res =~ /^.#\s*include\s+\<(.*)\>/) {
+        if ($res =~ /^.\s*\#\s*include\s+\<(.*)\>/) {
                my $clean = 'X' x length($1);
                $res =~ s@\<.*\>@<$clean>@;
        # The whole of a #error is a string.
-        } elsif ($res =~ /^.#\s*(?:error|warning)\s+(.*)\b/) {
+        } elsif ($res =~ /^.\s*\#\s*(?:error|warning)\s+(.*)\b/) {
                my $clean = 'X' x length($1);
-                $res =~ s@(#\s*(?:error|warning)\s+).*@$1$clean@;
+                $res =~ s@(\#\s*(?:error|warning)\s+).*@$1$clean@;
        }
        return $res;
@@ -715,7 +719,7 @@ sub annotate_values {
                        print "DECLARE($1)\n" if ($dbg_values > 1);
                        $type = 'T';
-                } elsif ($cur =~ /^(#\s*define\s*$Ident)(\(?)/o) {
+                } elsif ($cur =~ /^(\#\s*define\s*$Ident)(\(?)/o) {
                        print "DEFINE($1,$2)\n" if ($dbg_values > 1);
                        $av_preprocessor = 1;
                        push(@av_paren_type, $type);
@@ -724,12 +728,12 @@ sub annotate_values {
                        }
                        $type = 'E';
-                } elsif ($cur =~ /^(#\s*undef\s*$Ident)/o) {
+                } elsif ($cur =~ /^(\#\s*(?:undef\s*$Ident|include\b))/o) {
                        print "UNDEF($1)\n" if ($dbg_values > 1);
                        $av_preprocessor = 1;
                        push(@av_paren_type, $type);
-                } elsif ($cur =~ /^(#\s*(?:ifdef|ifndef|if))/o) {
+                } elsif ($cur =~ /^(\#\s*(?:ifdef|ifndef|if))/o) {
                        print "PRE_START($1)\n" if ($dbg_values > 1);
                        $av_preprocessor = 1;
@@ -737,7 +741,7 @@ sub annotate_values {
                        push(@av_paren_type, $type);
                        $type = 'E';
-                } elsif ($cur =~ /^(#\s*(?:else|elif))/o) {
+                } elsif ($cur =~ /^(\#\s*(?:else|elif))/o) {
                        print "PRE_RESTART($1)\n" if ($dbg_values > 1);
                        $av_preprocessor = 1;
@@ -745,7 +749,7 @@ sub annotate_values {
                        $type = 'E';
-                } elsif ($cur =~ /^(#\s*(?:endif))/o) {
+                } elsif ($cur =~ /^(\#\s*(?:endif))/o) {
                        print "PRE_END($1)\n" if ($dbg_values > 1);
                        $av_preprocessor = 1;
@@ -837,14 +841,26 @@ sub annotate_values {
 sub possible {
        my ($possible, $line) = @_;
-        #print "CHECK<$possible>\n";
+        print "CHECK<$possible> ($line)\n" if ($dbg_possible > 1);
        if ($possible !~ /^(?:$Storage|$Type|DEFINE_\S+)$/ &&
            $possible ne 'goto' && $possible ne 'return' &&
-            $possible ne 'struct' && $possible ne 'enum' &&
            $possible ne 'case' && $possible ne 'else' &&
-            $possible ne 'typedef') {
+            $possible ne 'asm' &&
-                warn "POSSIBLE: $possible ($line)\n" if ($dbg_possible);
+            $possible !~ /^(typedef|struct|enum)\b/) {
-                push(@typeList, $possible);
+                # Check for modifiers.
+                $possible =~ s/\s*$Storage\s*//g;
+                $possible =~ s/\s*$Sparse\s*//g;
+                if ($possible =~ /^\s*$/) {
+                } elsif ($possible =~ /\s/) {
+                        $possible =~ s/\s*$Type\s*//g;
+                        warn "MODIFIER: $possible ($line)\n" if ($dbg_possible);
+                        push(@modifierList, $possible);
+                } else {
+                        warn "POSSIBLE: $possible ($line)\n" if ($dbg_possible);
+                        push(@typeList, $possible);
+                }
                build_types();
        }
 }
@@ -949,6 +965,7 @@ sub process {
                        } else {
                                $realcnt=1+1;
                        }
+                        $in_comment = 0;
                        # Guestimate if this is a continuing comment.  Run
                        # the context looking for a comment "edge".  If this
@@ -1117,7 +1134,9 @@ sub process {
                        ERROR("trailing whitespace\n" . $herevet);
                }
 #80 column limit
-                if ($line =~ /^\+/ && !($prevrawline=~/\/\*\*/) && $length > 80) {
+                if ($line =~ /^\+/ && $prevrawline !~ /\/\*\*/ &&
+                    $rawline !~ /^.\s*\*\s*\@$Ident\s/ && $length > 80)
+                {
                        WARN("line over 80 characters\n" . $herecurr);
                }
@@ -1159,18 +1178,20 @@ sub process {
                        # Ignore functions being called
                        } elsif ($s =~ /^.\s*$Ident\s*\(/s) {
+                        # declarations always start with types
+                        } elsif ($prev_values eq 'E' && $s =~ /^.\s*(?:$Storage\s+)?(?:$Inline\s+)?(?:const\s+)?((?:\s*$Ident)+)\b(?:\s+$Sparse)?\s*\**\s*(?:$Ident|\(\*[^\)]*\))\s*(?:;|=|,|\()/s) {
+                                my $type = $1;
+                                $type =~ s/\s+/ /g;
+                                possible($type, "A:" . $s);
                        # definitions in global scope can only start with types
                        } elsif ($s =~ /^.(?:$Storage\s+)?(?:$Inline\s+)?(?:const\s+)?($Ident)\b/s) {
-                                possible($1, $s);
+                                possible($1, "B:" . $s);
-                        # declarations always start with types
-                        } elsif ($prev_values eq 'E' && $s =~ /^.\s*(?:$Storage\s+)?(?:const\s+)?($Ident)\b(:?\s+$Sparse)?\s*\**\s*$Ident\s*(?:;|=|,)/s) {
-                                possible($1, $s);
                        }
                        # any (foo ... *) is a pointer cast, and foo is a type
                        while ($s =~ /\(($Ident)(?:\s+$Sparse)*\s*\*+\s*\)/sg) {
-                                possible($1, $s);
+                                possible($1, "C:" . $s);
                        }
                        # Check for any sort of function declaration.
@@ -1184,9 +1205,9 @@ sub process {
                                $ctx =~ s/\)[^\)]*$//;
                                for my $arg (split(/\s*,\s*/, $ctx)) {
-                                        if ($arg =~ /^(?:const\s+)?($Ident)(?:\s+$Sparse)*\s*\**\s*(:?\b$Ident)?$/ || $arg =~ /^($Ident)$/) {
+                                        if ($arg =~ /^(?:const\s+)?($Ident)(?:\s+$Sparse)*\s*\**\s*(:?\b$Ident)?$/s || $arg =~ /^($Ident)$/s) {
-                                                possible($1, $s);
+                                                possible($1, "D:" . $s);
                                        }
                                }
                        }
@@ -1221,7 +1242,7 @@ sub process {
 # if/while/etc brace do not go on next line, unless defining a do while loop,
 # or if that brace on the next line is for something else
-                if ($line =~ /(.*)\b((?:if|while|for|switch)\s*\(|do\b|else\b)/ && $line !~ /^.#/) {
+                if ($line =~ /(.*)\b((?:if|while|for|switch)\s*\(|do\b|else\b)/ && $line !~ /^.\s*\#/) {
                        my $pre_ctx = "$1$2";
                        my ($level, @ctx) = ctx_statement_level($linenr, $realcnt, 0);
@@ -1239,7 +1260,7 @@ sub process {
                        if ($ctx !~ /{\s*/ && defined($lines[$ctx_ln -1]) && $lines[$ctx_ln - 1] =~ /^\+\s*{/) {
                                ERROR("that open brace { should be on the previous line\n" .
-                                        "$here\n$ctx\n$lines[$ctx_ln - 1]");
+                                        "$here\n$ctx\n$lines[$ctx_ln - 1]\n");
                        }
                        if ($level == 0 && $pre_ctx !~ /}\s*while\s*\($/ &&
                            $ctx =~ /\)\s*\;\s*$/ &&
@@ -1248,7 +1269,7 @@ sub process {
                                my ($nlength, $nindent) = line_stats($lines[$ctx_ln - 1]);
                                if ($nindent > $indent) {
                                        WARN("trailing semicolon indicates no statements, indent implies otherwise\n" .
-                                                "$here\n$ctx\n$lines[$ctx_ln - 1]");
+                                                "$here\n$ctx\n$lines[$ctx_ln - 1]\n");
                                }
                        }
                }
@@ -1284,7 +1305,7 @@ sub process {
 #
 # check for malformed paths in #include statements (uses RAW line)
-                if ($rawline =~ m{^.#\s*include\s+[<"](.*)[">]}) {
+                if ($rawline =~ m{^.\s*\#\s*include\s+[<"](.*)[">]}) {
                        my $path = $1;
                        if ($path =~ m{//}) {
                                ERROR("malformed #include filename\n" .
@@ -1316,7 +1337,7 @@ sub process {
                }
 # check for external initialisers.
-                if ($line =~ /^.$Type\s*$Ident\s*=\s*(0|NULL|false)\s*;/) {
+                if ($line =~ /^.$Type\s*$Ident\s*(?:\s+$Modifier)*\s*=\s*(0|NULL|false)\s*;/) {
                        ERROR("do not initialise externals to 0 or NULL\n" .
                                $herecurr);
                }
@@ -1330,6 +1351,7 @@ sub process {
 # make sense.
                if ($line =~ /\btypedef\s/ &&
                    $line !~ /\btypedef\s+$Type\s+\(\s*\*?$Ident\s*\)\s*\(/ &&
+                    $line !~ /\btypedef\s+$Type\s+$Ident\s*\(/ &&
                    $line !~ /\b__bitwise(?:__|)\b/) {
                        WARN("do not add new typedefs\n" . $herecurr);
                }
@@ -1388,8 +1410,8 @@ sub process {
 # function brace can't be on same line, except for #defines of do while,
 # or if closed on same line
-                if (($line=~/$Type\s*[A-Za-z\d_]+\(.*\).*\s{/) and
+                if (($line=~/$Type\s*$Ident\(.*\).*\s{/) and
-                    !($line=~/\#define.*do\s{/) and !($line=~/}/)) {
+                    !($line=~/\#\s*define.*do\s{/) and !($line=~/}/)) {
                        ERROR("open brace '{' following function declarations go on the next line\n" . $herecurr);
                }
@@ -1416,10 +1438,10 @@ sub process {
                        # cpp #define statements have non-optional spaces, ie
                        # if there is a space between the name and the open
                        # parenthesis it is simply not a parameter group.
-                        } elsif ($ctx_before =~ /^.\#\s*define\s*$/) {
+                        } elsif ($ctx_before =~ /^.\s*\#\s*define\s*$/) {
                        # cpp #elif statement condition may start with a (
-                        } elsif ($ctx =~ /^.\#\s*elif\s*$/) {
+                        } elsif ($ctx =~ /^.\s*\#\s*elif\s*$/) {
                        # If this whole things ends with a type its most
                        # likely a typedef for a function.
@@ -1625,13 +1647,14 @@ sub process {
                        ERROR("space prohibited before that close square bracket ']'\n" . $herecurr);
                }
-# check spacing on paretheses
+# check spacing on parentheses
                if ($line =~ /\(\s/ && $line !~ /\(\s*(?:\\)?$/ &&
                    $line !~ /for\s*\(\s+;/) {
                        ERROR("space prohibited after that open parenthesis '('\n" . $herecurr);
                }
                if ($line =~ /(\s+)\)/ && $line !~ /^.\s*\)/ &&
-                    $line !~ /for\s*\(.*;\s+\)/) {
+                    $line !~ /for\s*\(.*;\s+\)/ &&
+                    $line !~ /:\s+\)/) {
                        ERROR("space prohibited before that close parenthesis ')'\n" . $herecurr);
                }
@@ -1641,6 +1664,23 @@ sub process {
                        WARN("labels should not be indented\n" . $herecurr);
                }
+# Return is not a function.
+                if (defined($stat) && $stat =~ /^.\s*return(\s*)(\(.*);/s) {
+                        my $spacing = $1;
+                        my $value = $2;
+                        # Flatten any parentheses and braces
+                        while ($value =~ s/\([^\(\)]*\)/1/) {
+                        }
+                        if ($value =~ /^(?:$Ident|-?$Constant)$/) {
+                                ERROR("return is not a function, parentheses are not required\n" . $herecurr);
+                        } elsif ($spacing !~ /\s+/) {
+                                ERROR("space required before the open parenthesis '('\n" . $herecurr);
+                        }
+                }
 # Need a space before open parenthesis after if, while etc
                if ($line=~/\b(if|while|for|switch)\(/) {
                        ERROR("space required before the open parenthesis '('\n" . $herecurr);
@@ -1660,7 +1700,7 @@ sub process {
                        $s =~ s/\n.*//g;
                        $s =~ s/$;//g;  # Remove any comments
                        if (length($c) && $s !~ /^\s*({|;|)\s*\\*\s*$/ &&
-                            $c !~ /^.\#\s*if/)
+                            $c !~ /^.\s*\#\s*if/)
                        {
                                ERROR("trailing statements should be on next line\n" . $herecurr);
                        }
@@ -1719,14 +1759,16 @@ sub process {
 #               }
 #no spaces allowed after \ in define
-                if ($line=~/\#define.*\\\s$/) {
+                if ($line=~/\#\s*define.*\\\s$/) {
                        WARN("Whitepspace after \\ makes next lines useless\n" . $herecurr);
                }
 #warn if <asm/foo.h> is #included and <linux/foo.h> is available (uses RAW line)
-                if ($tree && $rawline =~ m{^.\#\s*include\s*\<asm\/(.*)\.h\>}) {
+                if ($tree && $rawline =~ m{^.\s*\#\s*include\s*\<asm\/(.*)\.h\>}) {
-                        my $checkfile = "$root/include/linux/$1.h";
+                        my $checkfile = "include/linux/$1.h";
-                        if (-f $checkfile && $1 ne 'irq') {
+                        if (-f "$root/$checkfile" && $realfile ne $checkfile &&
+                            $1 ne 'irq')
+                        {
                                WARN("Use #include <linux/$1.h> instead of <asm/$1.h>\n" .
                                        $herecurr);
                        }
@@ -1735,45 +1777,87 @@ sub process {
 # multi-statement macros should be enclosed in a do while loop, grab the
 # first statement and ensure its the whole macro if its not enclosed
 # in a known good container
-                if ($prevline =~ /\#define.*\\/ &&
+                if ($line =~ /^.\s*\#\s*define\s*$Ident(\()?/) {
-                   $prevline !~/(?:do\s+{|\(\{|\{)/ &&
-                   $line !~ /(?:do\s+{|\(\{|\{)/ &&
-                   $line !~ /^.\s*$Declare\s/) {
-                        # Grab the first statement, if that is the entire macro
-                        # its ok.  This may start either on the #define line
-                        # or the one below.
                        my $ln = $linenr;
                        my $cnt = $realcnt;
-                        my $off = 0;
+                        my ($off, $dstat, $dcond, $rest);
+                        my $ctx = '';
-                        # If the macro starts on the define line start
+                        my $args = defined($1);
-                        # grabbing the statement after the identifier
-                        $prevline =~ m{^(.#\s*define\s*$Ident(?:\([^\)]*\))?\s*)(.*)\\\s*$};
+                        # Find the end of the macro and limit our statement
-                        ##print "1<$1> 2<$2>\n";
+                        # search to that.
-                        if (defined $2 && $2 ne '') {
+                        while ($cnt > 0 && defined $lines[$ln - 1] &&
-                                $off = length($1);
+                                $lines[$ln - 1] =~ /^(?:-|..*\\$)/)
-                                $ln--;
+                        {
-                                $cnt++;
+                                $ctx .= $rawlines[$ln - 1] . "\n";
-                                while ($lines[$ln - 1] =~ /^-/) {
+                                $ln++;
-                                        $ln--;
+                                $cnt--;
-                                        $cnt++;
+                        }
-                                }
+                        $ctx .= $rawlines[$ln - 1];
+                        ($dstat, $dcond, $ln, $cnt, $off) =
+                                ctx_statement_block($linenr, $ln - $linenr + 1, 0);
+                        #print "dstat<$dstat> dcond<$dcond> cnt<$cnt> off<$off>\n";
+                        #print "LINE<$lines[$ln]> len<" . length($lines[$ln]) . "\n";
+                        # Extract the remainder of the define (if any) and
+                        # rip off surrounding spaces, and trailing \'s.
+                        $rest = '';
+                        if (defined $lines[$ln - 1] &&
+                            $off > length($lines[$ln - 1]))
+                        {
+                                $ln++;
+                                $cnt--;
+                                $off = 0;
+                        }
+                        while ($cnt > 0) {
+                                $rest .= substr($lines[$ln - 1], $off) . "\n";
+                                $ln++;
+                                $cnt--;
+                                $off = 0;
+                        }
+                        $rest =~ s/\\\n.//g;
+                        $rest =~ s/^\s*//s;
+                        $rest =~ s/\s*$//s;
+                        # Clean up the original statement.
+                        if ($args) {
+                                substr($dstat, 0, length($dcond), '');
+                        } else {
+                                $dstat =~ s/^.\s*\#\s*define\s+$Ident\s*//;
                        }
-                        my @ctx = ctx_statement($ln, $cnt, $off);
+                        $dstat =~ s/\\\n.//g;
-                        my $ctx_ln = $ln + $#ctx + 1;
+                        $dstat =~ s/^\s*//s;
-                        my $ctx = join("\n", @ctx);
+                        $dstat =~ s/\s*$//s;
-                        # Pull in any empty extension lines.
+                        # Flatten any parentheses and braces
-                        while ($ctx =~ /\\$/ &&
+                        while ($dstat =~ s/\([^\(\)]*\)/1/) {
-                               $lines[$ctx_ln - 1] =~ /^.\s*(?:\\)?$/) {
+                        }
-                                $ctx .= $lines[$ctx_ln - 1];
+                        while ($dstat =~ s/\{[^\{\}]*\}/1/) {
-                                $ctx_ln++;
                        }
-                        if ($ctx =~ /\\$/) {
+                        my $exceptions = qr{
-                                if ($ctx =~ /;/) {
+                                $Declare|
+                                module_param_named|
+                                MODULE_PARAM_DESC|
+                                DECLARE_PER_CPU|
+                                DEFINE_PER_CPU|
+                                __typeof__\(
+                        }x;
+                        if ($rest ne '') {
+                                if ($rest !~ /while\s*\(/ &&
+                                    $dstat !~ /$exceptions/)
+                                {
                                        ERROR("Macros with multiple statements should be enclosed in a do - while loop\n" . "$here\n$ctx\n");
-                                } else {
+                                }
+                        } elsif ($ctx !~ /;/) {
+                                if ($dstat ne '' &&
+                                    $dstat !~ /^(?:$Ident|-?$Constant)$/ &&
+                                    $dstat !~ /$exceptions/ &&
+                                    $dstat =~ /$Operators/)
+                                {
                                        ERROR("Macros with complex values should be enclosed in parenthesis\n" . "$here\n$ctx\n");
                                }
                        }
@@ -1884,7 +1968,7 @@ sub process {
 # don't include deprecated include files (uses RAW line)
                for my $inc (@dep_includes) {
-                        if ($rawline =~ m@\#\s*include\s*\<$inc>@) {
+                        if ($rawline =~ m@^.\s*\#\s*include\s*\<$inc>@) {
                                ERROR("Don't use <$inc>: see Documentation/feature-removal-schedule.txt\n" . $herecurr);
                        }
                }
@@ -1908,7 +1992,7 @@ sub process {
                }
 # warn about #if 0
-                if ($line =~ /^.#\s*if\s+0\b/) {
+                if ($line =~ /^.\s*\#\s*if\s+0\b/) {
                        CHK("if this code is redundant consider removing it\n" .
                                $herecurr);
                }
@@ -1920,23 +2004,16 @@ sub process {
                                WARN("kfree(NULL) is safe this check is probabally not required\n" . $hereprev);
                        }
                }
-# check for needless usb_free_urb() checks
-                if ($prevline =~ /\bif\s*\(([^\)]*)\)/) {
-                        my $expr = $1;
-                        if ($line =~ /\busb_free_urb\(\Q$expr\E\);/) {
-                                WARN("usb_free_urb(NULL) is safe this check is probabally not required\n" . $hereprev);
-                        }
-                }
 # warn about #ifdefs in C files
-#               if ($line =~ /^.#\s*if(|n)def/ && ($realfile =~ /\.c$/)) {
+#               if ($line =~ /^.\s*\#\s*if(|n)def/ && ($realfile =~ /\.c$/)) {
 #                       print "#ifdef in C files should be avoided\n";
 #                       print "$herecurr";
 #                       $clean = 0;
 #               }
 # warn about spacing in #ifdefs
-                if ($line =~ /^.#\s*(ifdef|ifndef|elif)\s\s+/) {
+                if ($line =~ /^.\s*\#\s*(ifdef|ifndef|elif)\s\s+/) {
                        ERROR("exactly one space required after that #$1\n" . $herecurr);
                }
@@ -1955,7 +2032,7 @@ sub process {
                        }
                }
 # check of hardware specific defines
-                if ($line =~ m@^.#\s*if.*\b(__i386__|__powerpc64__|__sun__|__s390x__)\b@ && $realfile !~ m@include/asm-@) {
+                if ($line =~ m@^.\s*\#\s*if.*\b(__i386__|__powerpc64__|__sun__|__s390x__)\b@ && $realfile !~ m@include/asm-@) {
                        CHK("architecture specific defines should be avoided\n" .  $herecurr);
                }
@@ -1973,15 +2050,18 @@ sub process {
 # check for new externs in .c files.
                if ($realfile =~ /\.c$/ && defined $stat &&
-                    $stat =~ /^.\s*(?:extern\s+)?$Type\s+$Ident(\s*)\(/s)
+                    $stat =~ /^.\s*(?:extern\s+)?$Type\s+($Ident)(\s*)\(/s)
                {
-                        my $paren_space = $1;
+                        my $function_name = $1;
+                        my $paren_space = $2;
                        my $s = $stat;
                        if (defined $cond) {
                                substr($s, 0, length($cond), '');
                        }
-                        if ($s =~ /^\s*;/) {
+                        if ($s =~ /^\s*;/ &&
+                            $function_name ne 'uninitialized_var')
+                        {
                                WARN("externs should be avoided in .c files\n" .  $herecurr);
                        }
@@ -2030,8 +2110,8 @@ sub process {
 # use of NR_CPUS is usually wrong
 # ignore definitions of NR_CPUS and usage to define arrays as likely right
                if ($line =~ /\bNR_CPUS\b/ &&
-                    $line !~ /^.#\s*if\b.*\bNR_CPUS\b/ &&
+                    $line !~ /^.\s*\s*#\s*if\b.*\bNR_CPUS\b/ &&
-                    $line !~ /^.#\s*define\b.*\bNR_CPUS\b/ &&
+                    $line !~ /^.\s*\s*#\s*define\b.*\bNR_CPUS\b/ &&
                    $line !~ /^.\s*$Declare\s.*\[[^\]]*NR_CPUS[^\]]*\]/ &&
                    $line !~ /\[[^\]]*\.\.\.[^\]]*NR_CPUS[^\]]*\]/ &&
                    $line !~ /\[[^\]]*NR_CPUS[^\]]*\.\.\.[^\]]*\]/)
diff --git a/scripts/decodecode b/scripts/decodecode
index 235d3938529d..235d3938529d 100644..100755
--- a/scripts/decodecode
+++ b/scripts/decodecode
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 508c5895c680..a07f91aac920 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -467,6 +467,25 @@ static void parse_elf_finish(struct elf_info *info)
        release_file(info->hdr, info->size);
 }
+static int ignore_undef_symbol(struct elf_info *info, const char *symname)
+{
+        /* ignore __this_module, it will be resolved shortly */
+        if (strcmp(symname, MODULE_SYMBOL_PREFIX "__this_module") == 0)
+                return 1;
+        /* ignore global offset table */
+        if (strcmp(symname, "_GLOBAL_OFFSET_TABLE_") == 0)
+                return 1;
+        if (info->hdr->e_machine == EM_PPC)
+                /* Special register function linked on all modules during final link of .ko */
+                if (strncmp(symname, "_restgpr_", sizeof("_restgpr_") - 1) == 0 ||
+                    strncmp(symname, "_savegpr_", sizeof("_savegpr_") - 1) == 0 ||
+                    strncmp(symname, "_rest32gpr_", sizeof("_rest32gpr_") - 1) == 0 ||
+                    strncmp(symname, "_save32gpr_", sizeof("_save32gpr_") - 1) == 0)
+                        return 1;
+        /* Do not ignore this symbol */
+        return 0;
+}
 #define CRC_PFX     MODULE_SYMBOL_PREFIX "__crc_"
 #define KSYMTAB_PFX MODULE_SYMBOL_PREFIX "__ksymtab_"
@@ -493,11 +512,7 @@ static void handle_modversions(struct module *mod, struct elf_info *info,
                if (ELF_ST_BIND(sym->st_info) != STB_GLOBAL &&
                    ELF_ST_BIND(sym->st_info) != STB_WEAK)
                        break;
-                /* ignore global offset table */
+                if (ignore_undef_symbol(info, symname))
-                if (strcmp(symname, "_GLOBAL_OFFSET_TABLE_") == 0)
-                        break;
-                /* ignore __this_module, it will be resolved shortly */
-                if (strcmp(symname, MODULE_SYMBOL_PREFIX "__this_module") == 0)
                        break;
 /* cope with newer glibc (2.3.4 or higher) STT_ definition in elf.h */
 #if defined(STT_REGISTER) || defined(STT_SPARC_REGISTER)
diff --git a/scripts/ver_linux b/scripts/ver_linux
index ab69ecefedbd..7ac0e309be09 100755
--- a/scripts/ver_linux
+++ b/scripts/ver_linux
@@ -12,12 +12,9 @@ echo ' '
 uname -a
 echo ' '
-gcc --version 2>&1| head -n 1 | grep -v gcc | awk \
+gcc -dumpversion 2>&1| awk \
 'NR==1{print "Gnu C                 ", $1}'
-gcc --version 2>&1| grep gcc | awk \
-'NR==1{print "Gnu C                 ", $3}'
 make --version 2>&1 | awk -F, '{print $1}' | awk \
      '/GNU Make/{print "Gnu make              ",$NF}'
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 4ea583689eec..baf348834b66 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -49,10 +49,14 @@ struct dev_cgroup {
        spinlock_t lock;
 };
+static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s)
+{
+        return container_of(s, struct dev_cgroup, css);
+}
 static inline struct dev_cgroup *cgroup_to_devcgroup(struct cgroup *cgroup)
 {
-        return container_of(cgroup_subsys_state(cgroup, devices_subsys_id),
+        return css_to_devcgroup(cgroup_subsys_state(cgroup, devices_subsys_id));
-                            struct dev_cgroup, css);
 }
 struct cgroup_subsys devices_subsys;
@@ -102,7 +106,7 @@ free_and_exit:
 static int dev_whitelist_add(struct dev_cgroup *dev_cgroup,
                        struct dev_whitelist_item *wh)
 {
-        struct dev_whitelist_item *whcopy;
+        struct dev_whitelist_item *whcopy, *walk;
        whcopy = kmalloc(sizeof(*whcopy), GFP_KERNEL);
        if (!whcopy)
@@ -110,7 +114,21 @@ static int dev_whitelist_add(struct dev_cgroup *dev_cgroup,
        memcpy(whcopy, wh, sizeof(*whcopy));
        spin_lock(&dev_cgroup->lock);
-        list_add_tail(&whcopy->list, &dev_cgroup->whitelist);
+        list_for_each_entry(walk, &dev_cgroup->whitelist, list) {
+                if (walk->type != wh->type)
+                        continue;
+                if (walk->major != wh->major)
+                        continue;
+                if (walk->minor != wh->minor)
+                        continue;
+                walk->access |= wh->access;
+                kfree(whcopy);
+                whcopy = NULL;
+        }
+        if (whcopy != NULL)
+                list_add_tail(&whcopy->list, &dev_cgroup->whitelist);
        spin_unlock(&dev_cgroup->lock);
        return 0;
 }
@@ -502,7 +520,6 @@ struct cgroup_subsys devices_subsys = {
 int devcgroup_inode_permission(struct inode *inode, int mask)
 {
-        struct cgroup *cgroup;
        struct dev_cgroup *dev_cgroup;
        struct dev_whitelist_item *wh;
@@ -511,8 +528,8 @@ int devcgroup_inode_permission(struct inode *inode, int mask)
                return 0;
        if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
                return 0;
-        cgroup = task_cgroup(current, devices_subsys.subsys_id);
+        dev_cgroup = css_to_devcgroup(task_subsys_state(current,
-        dev_cgroup = cgroup_to_devcgroup(cgroup);
+                                devices_subsys_id));
        if (!dev_cgroup)
                return 0;
@@ -543,12 +560,11 @@ acc_check:
 int devcgroup_inode_mknod(int mode, dev_t dev)
 {
-        struct cgroup *cgroup;
        struct dev_cgroup *dev_cgroup;
        struct dev_whitelist_item *wh;
-        cgroup = task_cgroup(current, devices_subsys.subsys_id);
+        dev_cgroup = css_to_devcgroup(task_subsys_state(current,
-        dev_cgroup = cgroup_to_devcgroup(cgroup);
+                                devices_subsys_id));
        if (!dev_cgroup)
                return 0;
diff --git a/security/dummy.c b/security/dummy.c
index f50c6c3c32c9..b8916883b77f 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -27,6 +27,8 @@
 #include <linux/hugetlb.h>
 #include <linux/ptrace.h>
 #include <linux/file.h>
+#include <linux/prctl.h>
+#include <linux/securebits.h>
 static int dummy_ptrace (struct task_struct *parent, struct task_struct *child)
 {
@@ -607,7 +609,27 @@ static int dummy_task_kill (struct task_struct *p, struct siginfo *info,
 static int dummy_task_prctl (int option, unsigned long arg2, unsigned long arg3,
                             unsigned long arg4, unsigned long arg5, long *rc_p)
 {
-        return 0;
+        switch (option) {
+        case PR_CAPBSET_READ:
+                *rc_p = (cap_valid(arg2) ? 1 : -EINVAL);
+                break;
+        case PR_GET_KEEPCAPS:
+                *rc_p = issecure(SECURE_KEEP_CAPS);
+                break;
+        case PR_SET_KEEPCAPS:
+                if (arg2 > 1)
+                        *rc_p = -EINVAL;
+                else if (arg2)
+                        current->securebits |= issecure_mask(SECURE_KEEP_CAPS);
+                else
+                        current->securebits &=
+                                ~issecure_mask(SECURE_KEEP_CAPS);
+                break;
+        default:
+                return 0;
+        }
+        return 1;
 }
 static void dummy_task_reparent_to_init (struct task_struct *p)
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 8c05587f5018..b39f5c2e2c4b 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -78,7 +78,6 @@ extern unsigned key_quota_maxbytes;
 extern struct rb_root key_serial_tree;
 extern spinlock_t key_serial_lock;
-extern struct semaphore key_alloc_sem;
 extern struct mutex key_construction_mutex;
 extern wait_queue_head_t request_key_conswq;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index b5c8f9237008..4a09293efa00 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1881,6 +1881,18 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
        final = sbsp->smk_default;
        /*
+         * If this is the root inode the superblock
+         * may be in the process of initialization.
+         * If that is the case use the root value out
+         * of the superblock.
+         */
+        if (opt_dentry->d_parent == opt_dentry) {
+                isp->smk_inode = sbsp->smk_root;
+                isp->smk_flags |= SMK_INODE_INSTANT;
+                goto unlockandout;
+        }
+        /*
         * This is pretty hackish.
         * Casey says that we shouldn't have to do
         * file system specific code, but it does help
diff --git a/sound/drivers/pcsp/pcsp.h b/sound/drivers/pcsp/pcsp.h
index f07cc1ee1fe7..1d661f795e8c 100644
--- a/sound/drivers/pcsp/pcsp.h
+++ b/sound/drivers/pcsp/pcsp.h
@@ -24,7 +24,8 @@ static DEFINE_SPINLOCK(i8253_lock);
 /* default timer freq for PC-Speaker: 18643 Hz */
 #define DIV_18KHZ 64
 #define MAX_DIV DIV_18KHZ
-#define CUR_DIV() (MAX_DIV >> chip->treble)
+#define CALC_DIV(d) (MAX_DIV >> (d))
+#define CUR_DIV() CALC_DIV(chip->treble)
 #define PCSP_MAX_TREBLE 1
 /* unfortunately, with hrtimers 37KHz does not work very well :( */
@@ -36,7 +37,8 @@ static DEFINE_SPINLOCK(i8253_lock);
 #define PCSP_DEFAULT_SDIV (DIV_18KHZ >> 1)
 #define PCSP_DEFAULT_SRATE (PIT_TICK_RATE / PCSP_DEFAULT_SDIV)
 #define PCSP_INDEX_INC() (1 << (PCSP_MAX_TREBLE - chip->treble))
-#define PCSP_RATE() (PIT_TICK_RATE / CUR_DIV())
+#define PCSP_CALC_RATE(i) (PIT_TICK_RATE / CALC_DIV(i))
+#define PCSP_RATE() PCSP_CALC_RATE(chip->treble)
 #define PCSP_MIN_RATE__1 MAX_DIV/PIT_TICK_RATE
 #define PCSP_MAX_RATE__1 MIN_DIV/PIT_TICK_RATE
 #define PCSP_MAX_PERIOD_NS (1000000000ULL * PCSP_MIN_RATE__1)
diff --git a/sound/drivers/pcsp/pcsp_mixer.c b/sound/drivers/pcsp/pcsp_mixer.c
index 64a695fef74e..caeb0f57fcca 100644
--- a/sound/drivers/pcsp/pcsp_mixer.c
+++ b/sound/drivers/pcsp/pcsp_mixer.c
@@ -50,7 +50,8 @@ static int pcsp_treble_info(struct snd_kcontrol *kcontrol,
        uinfo->value.enumerated.items = chip->max_treble + 1;
        if (uinfo->value.enumerated.item > chip->max_treble)
                uinfo->value.enumerated.item = chip->max_treble;
-        sprintf(uinfo->value.enumerated.name, "%d", PCSP_RATE());
+        sprintf(uinfo->value.enumerated.name, "%d",
+                        PCSP_CALC_RATE(uinfo->value.enumerated.item));
        return 0;
 }
diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
index 2da89810ca10..1292dcee072d 100644
--- a/sound/pci/ac97/ac97_patch.c
+++ b/sound/pci/ac97/ac97_patch.c
@@ -1971,6 +1971,9 @@ static int snd_ac97_ad1888_lohpsel_get(struct snd_kcontrol *kcontrol, struct snd
        val = ac97->regs[AC97_AD_MISC];
        ucontrol->value.integer.value[0] = !(val & AC97_AD198X_LOSEL);
+        if (ac97->spec.ad18xx.lo_as_master)
+                ucontrol->value.integer.value[0] =
+                        !ucontrol->value.integer.value[0];
        return 0;
 }
@@ -1979,8 +1982,10 @@ static int snd_ac97_ad1888_lohpsel_put(struct snd_kcontrol *kcontrol, struct snd
        struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
        unsigned short val;
-        val = !ucontrol->value.integer.value[0]
+        val = !ucontrol->value.integer.value[0];
-                ? (AC97_AD198X_LOSEL | AC97_AD198X_HPSEL) : 0;
+        if (ac97->spec.ad18xx.lo_as_master)
+                val = !val;
+        val = val ? (AC97_AD198X_LOSEL | AC97_AD198X_HPSEL) : 0;
        return snd_ac97_update_bits(ac97, AC97_AD_MISC,
                                    AC97_AD198X_LOSEL | AC97_AD198X_HPSEL, val);
 }
@@ -2031,7 +2036,7 @@ static void ad1888_update_jacks(struct snd_ac97 *ac97)
 {
        unsigned short val = 0;
        /* clear LODIS if shared jack is to be used for Surround out */
-        if (is_shared_linein(ac97))
+        if (!ac97->spec.ad18xx.lo_as_master && is_shared_linein(ac97))
                val |= (1 << 12);
        /* clear CLDIS if shared jack is to be used for C/LFE out */
        if (is_shared_micin(ac97))
@@ -2067,9 +2072,13 @@ static const struct snd_kcontrol_new snd_ac97_ad1888_controls[] = {
 static int patch_ad1888_specific(struct snd_ac97 *ac97)
 {
-        /* rename 0x04 as "Master" and 0x02 as "Master Surround" */
+        if (!ac97->spec.ad18xx.lo_as_master) {
-        snd_ac97_rename_vol_ctl(ac97, "Master Playback", "Master Surround Playback");
+                /* rename 0x04 as "Master" and 0x02 as "Master Surround" */
-        snd_ac97_rename_vol_ctl(ac97, "Headphone Playback", "Master Playback");
+                snd_ac97_rename_vol_ctl(ac97, "Master Playback",
+                                        "Master Surround Playback");
+                snd_ac97_rename_vol_ctl(ac97, "Headphone Playback",
+                                        "Master Playback");
+        }
        return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
 }
@@ -2088,16 +2097,27 @@ static int patch_ad1888(struct snd_ac97 * ac97)
        
        patch_ad1881(ac97);
        ac97->build_ops = &patch_ad1888_build_ops;
-        /* Switch FRONT/SURROUND LINE-OUT/HP-OUT default connection */
-        /* it seems that most vendors connect line-out connector to headphone out of AC'97 */
+        /*
+         * LO can be used as a real line-out on some devices,
+         * and we need to revert the front/surround mixer switches
+         */
+        if (ac97->subsystem_vendor == 0x1043 &&
+            ac97->subsystem_device == 0x1193) /* ASUS A9T laptop */
+                ac97->spec.ad18xx.lo_as_master = 1;
+        misc = snd_ac97_read(ac97, AC97_AD_MISC);
        /* AD-compatible mode */
        /* Stereo mutes enabled */
-        misc = snd_ac97_read(ac97, AC97_AD_MISC);
+        misc |= AC97_AD198X_MSPLT | AC97_AD198X_AC97NC;
-        snd_ac97_write_cache(ac97, AC97_AD_MISC, misc |
+        if (!ac97->spec.ad18xx.lo_as_master)
-                             AC97_AD198X_LOSEL |
+                /* Switch FRONT/SURROUND LINE-OUT/HP-OUT default connection */
-                             AC97_AD198X_HPSEL |
+                /* it seems that most vendors connect line-out connector to
-                             AC97_AD198X_MSPLT |
+                 * headphone out of AC'97
-                             AC97_AD198X_AC97NC);
+                 */
+                misc |= AC97_AD198X_LOSEL | AC97_AD198X_HPSEL;
+        snd_ac97_write_cache(ac97, AC97_AD_MISC, misc);
        ac97->flags |= AC97_STEREO_MUTES;
        return 0;
 }
diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
index abde5b901884..548c9cc81af5 100644
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -1818,13 +1818,6 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
        }
        emu->port = pci_resource_start(pci, 0);
-        if (request_irq(pci->irq, snd_emu10k1_interrupt, IRQF_SHARED,
-                        "EMU10K1", emu)) {
-                err = -EBUSY;
-                goto error;
-        }
-        emu->irq = pci->irq;
        emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
        if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
                                32 * 1024, &emu->ptb_pages) < 0) {
@@ -1887,6 +1880,14 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
        emu->fx8010.etram_pages.area = NULL;
        emu->fx8010.etram_pages.bytes = 0;
+        /* irq handler must be registered after I/O ports are activated */
+        if (request_irq(pci->irq, snd_emu10k1_interrupt, IRQF_SHARED,
+                        "EMU10K1", emu)) {
+                err = -EBUSY;
+                goto error;
+        }
+        emu->irq = pci->irq;
        /*
         *  Init to 0x02109204 :
         *  Clock accuracy    = 0     (1000ppm)
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index e0a605adde42..a99e86d74278 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -2858,6 +2858,7 @@ static const char *ad1988_models[AD1988_MODEL_LAST] = {
 static struct snd_pci_quirk ad1988_cfg_tbl[] = {
        SND_PCI_QUIRK(0x1043, 0x81ec, "Asus P5B-DLX", AD1988_6STACK_DIG),
        SND_PCI_QUIRK(0x1043, 0x81f6, "Asus M2N-SLI", AD1988_6STACK_DIG),
+        SND_PCI_QUIRK(0x1043, 0x8277, "Asus P5K-E/WIFI-AP", AD1988_6STACK_DIG),
        {}
 };
@@ -3643,33 +3644,17 @@ static struct snd_kcontrol_new ad1884a_laptop_mixers[] = {
        { } /* end */
 };
-static struct hda_input_mux ad1884a_mobile_capture_source = {
-        .num_items = 2,
-        .items = {
-                { "Mic", 0x1 }, /* port-C */
-                { "Mix", 0x3 },
-        },
-};
 static struct snd_kcontrol_new ad1884a_mobile_mixers[] = {
        HDA_CODEC_VOLUME("Master Playback Volume", 0x21, 0x0, HDA_OUTPUT),
        HDA_CODEC_MUTE("Master Playback Switch", 0x21, 0x0, HDA_OUTPUT),
        HDA_CODEC_VOLUME("PCM Playback Volume", 0x20, 0x5, HDA_INPUT),
        HDA_CODEC_MUTE("PCM Playback Switch", 0x20, 0x5, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mic Playback Volume", 0x20, 0x01, HDA_INPUT),
-        HDA_CODEC_MUTE("Mic Playback Switch", 0x20, 0x01, HDA_INPUT),
        HDA_CODEC_VOLUME("Beep Playback Volume", 0x20, 0x03, HDA_INPUT),
        HDA_CODEC_MUTE("Beep Playback Switch", 0x20, 0x03, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mic Boost", 0x15, 0x0, HDA_INPUT),
+        HDA_CODEC_VOLUME("Mic Capture Volume", 0x14, 0x0, HDA_INPUT),
+        HDA_CODEC_VOLUME("Internal Mic Capture Volume", 0x15, 0x0, HDA_INPUT),
        HDA_CODEC_VOLUME("Capture Volume", 0x0c, 0x0, HDA_OUTPUT),
        HDA_CODEC_MUTE("Capture Switch", 0x0c, 0x0, HDA_OUTPUT),
-        {
-                .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-                .name = "Capture Source",
-                .info = ad198x_mux_enum_info,
-                .get = ad198x_mux_enum_get,
-                .put = ad198x_mux_enum_put,
-        },
        { } /* end */
 };
@@ -3686,14 +3671,31 @@ static void ad1884a_hp_automute(struct hda_codec *codec)
                            present ? 0x00 : 0x02);
 }
+/* switch to external mic if plugged */
+static void ad1884a_hp_automic(struct hda_codec *codec)
+{
+        unsigned int present;
+        present = snd_hda_codec_read(codec, 0x14, 0,
+                                     AC_VERB_GET_PIN_SENSE, 0) & 0x80000000;
+        snd_hda_codec_write(codec, 0x0c, 0, AC_VERB_SET_CONNECT_SEL,
+                            present ? 0 : 1);
+}
 #define AD1884A_HP_EVENT                0x37
+#define AD1884A_MIC_EVENT               0x36
 /* unsolicited event for HP jack sensing */
 static void ad1884a_hp_unsol_event(struct hda_codec *codec, unsigned int res)
 {
-        if ((res >> 26) != AD1884A_HP_EVENT)
+        switch (res >> 26) {
-                return;
+        case AD1884A_HP_EVENT:
-        ad1884a_hp_automute(codec);
+                ad1884a_hp_automute(codec);
+                break;
+        case AD1884A_MIC_EVENT:
+                ad1884a_hp_automic(codec);
+                break;
+        }
 }
 /* initialize jack-sensing, too */
@@ -3701,6 +3703,7 @@ static int ad1884a_hp_init(struct hda_codec *codec)
 {
        ad198x_init(codec);
        ad1884a_hp_automute(codec);
+        ad1884a_hp_automic(codec);
        return 0;
 }
@@ -3714,10 +3717,15 @@ static struct hda_verb ad1884a_laptop_verbs[] = {
        /* Port-F pin */
        {0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
        {0x16, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE},
+        /* Port-C pin - internal mic-in */
+        {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
+        {0x14, AC_VERB_SET_AMP_GAIN_MUTE, 0x7002}, /* raise mic as default */
+        {0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0x7002}, /* raise mic as default */
        /* analog mix */
        {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(4)},
        /* unsolicited event for pin-sense */
        {0x11, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | AD1884A_HP_EVENT},
+        {0x14, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | AD1884A_MIC_EVENT},
        { } /* end */
 };
@@ -3877,7 +3885,6 @@ static int patch_ad1884a(struct hda_codec *codec)
                spec->mixers[0] = ad1884a_mobile_mixers;
                spec->init_verbs[spec->num_init_verbs++] = ad1884a_laptop_verbs;
                spec->multiout.dig_out_nid = 0;
-                spec->input_mux = &ad1884a_mobile_capture_source;
                codec->patch_ops.unsol_event = ad1884a_hp_unsol_event;
                codec->patch_ops.init = ad1884a_hp_init;
                break;
diff --git a/sound/pci/hda/patch_cmedia.c b/sound/pci/hda/patch_cmedia.c
index c73ce074a6ea..6ef57fbfb6eb 100644
--- a/sound/pci/hda/patch_cmedia.c
+++ b/sound/pci/hda/patch_cmedia.c
@@ -611,6 +611,7 @@ static const char *cmi9880_models[CMI_MODELS] = {
 static struct snd_pci_quirk cmi9880_cfg_tbl[] = {
        SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", CMI_FULL_DIG),
+        SND_PCI_QUIRK(0x1854, 0x002b, "LG LS75", CMI_MINIMAL),
        SND_PCI_QUIRK(0x1854, 0x0032, "LG", CMI_FULL_DIG),
        {} /* terminator */
 };
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 864b2f598c38..b0a2a262ece2 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -853,6 +853,7 @@ do_sku:
                case 0x10ec0269:
                case 0x10ec0862:
                case 0x10ec0662:        
+                case 0x10ec0889:
                        snd_hda_codec_write(codec, 0x14, 0,
                                            AC_VERB_SET_EAPD_BTLENABLE, 2);
                        snd_hda_codec_write(codec, 0x15, 0,
@@ -877,6 +878,7 @@ do_sku:
                case 0x10ec0883:
                case 0x10ec0885:
                case 0x10ec0888:
+                case 0x10ec0889:
                        snd_hda_codec_write(codec, 0x20, 0,
                                            AC_VERB_SET_COEF_INDEX, 7);
                        tmp = snd_hda_codec_read(codec, 0x20, 0,
@@ -940,7 +942,6 @@ do_sku:
                            AC_VERB_SET_UNSOLICITED_ENABLE,
                            AC_USRSP_EN | ALC880_HP_EVENT);
        spec->unsol_event = alc_sku_unsol_event;
-        spec->init_hook = alc_sku_automute;     
 }
 /*
@@ -7743,6 +7744,7 @@ static struct snd_pci_quirk alc883_cfg_tbl[] = {
        SND_PCI_QUIRK(0x103c, 0x2a60, "HP Lucknow", ALC888_3ST_HP),
        SND_PCI_QUIRK(0x103c, 0x2a61, "HP Nettle", ALC883_6ST_DIG),
        SND_PCI_QUIRK(0x1043, 0x8249, "Asus M2A-VM HDMI", ALC883_3ST_6ch_DIG),
+        SND_PCI_QUIRK(0x105b, 0x0ce8, "Foxconn P35AX-S", ALC883_6ST_DIG),
        SND_PCI_QUIRK(0x105b, 0x6668, "Foxconn", ALC883_6ST_DIG),
        SND_PCI_QUIRK(0x1071, 0x8253, "Mitac 8252d", ALC883_MITAC),
        SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC883_LAPTOP_EAPD),
@@ -8640,6 +8642,7 @@ static struct hda_verb alc262_sony_unsol_verbs[] = {
        {0x15, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
        {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
+        {}
 };
 /* mute/unmute internal speaker according to the hp jack and mute state */
@@ -10510,6 +10513,7 @@ static struct snd_pci_quirk alc268_cfg_tbl[] = {
        SND_PCI_QUIRK(0x1043, 0x1205, "ASUS W7J", ALC268_3ST),
        SND_PCI_QUIRK(0x1179, 0xff10, "TOSHIBA A205", ALC268_TOSHIBA),
        SND_PCI_QUIRK(0x1179, 0xff50, "TOSHIBA A305", ALC268_TOSHIBA),
+        SND_PCI_QUIRK(0x14c0, 0x0025, "COMPAL IFL90/JFL-92", ALC268_TOSHIBA),
        SND_PCI_QUIRK(0x152d, 0x0763, "Diverse (CPR2000)", ALC268_ACER),
        SND_PCI_QUIRK(0x152d, 0x0771, "Quanta IL1", ALC267_QUANTA_IL1),
        SND_PCI_QUIRK(0x1170, 0x0040, "ZEPTO", ALC268_ZEPTO),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 393f7fd2b1be..a4f44a00bae8 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -840,7 +840,7 @@ static struct snd_kcontrol_new stac92hd71bxx_mixer[] = {
 static struct snd_kcontrol_new stac925x_mixer[] = {
        STAC_INPUT_SOURCE(1),
        HDA_CODEC_VOLUME("Capture Volume", 0x09, 0, HDA_OUTPUT),
-        HDA_CODEC_MUTE("Capture Switch", 0x09, 0, HDA_OUTPUT),
+        HDA_CODEC_MUTE("Capture Switch", 0x14, 0, HDA_OUTPUT),
        HDA_CODEC_VOLUME("Capture Mux Volume", 0x0f, 0, HDA_OUTPUT),
        { } /* end */
 };
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 52b1d81a26f7..e7e43524f8c7 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -447,6 +447,23 @@ static struct hda_pcm_stream vt1708_pcm_analog_playback = {
        },
 };
+static struct hda_pcm_stream vt1708_pcm_analog_s16_playback = {
+        .substreams = 1,
+        .channels_min = 2,
+        .channels_max = 8,
+        .nid = 0x10, /* NID to query formats and rates */
+        /* We got noisy outputs on the right channel on VT1708 when
+         * 24bit samples are used.  Until any workaround is found,
+         * disable the 24bit format, so far.
+         */
+        .formats = SNDRV_PCM_FMTBIT_S16_LE,
+        .ops = {
+                .open = via_playback_pcm_open,
+                .prepare = via_playback_pcm_prepare,
+                .cleanup = via_playback_pcm_cleanup
+        },
+};
 static struct hda_pcm_stream vt1708_pcm_analog_capture = {
        .substreams = 2,
        .channels_min = 2,
@@ -899,6 +916,9 @@ static int patch_vt1708(struct hda_codec *codec)
        
        spec->stream_name_analog = "VT1708 Analog";
        spec->stream_analog_playback = &vt1708_pcm_analog_playback;
+        /* disable 32bit format on VT1708 */
+        if (codec->vendor_id == 0x11061708)
+                spec->stream_analog_playback = &vt1708_pcm_analog_s16_playback;
        spec->stream_analog_capture = &vt1708_pcm_analog_capture;
        spec->stream_name_digital = "VT1708 Digital";
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index 4232fd75dd20..98778cb69c6e 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -45,7 +45,7 @@
 #else
 #define ioapic_debug(fmt, arg...)
 #endif
-static void ioapic_deliver(struct kvm_ioapic *vioapic, int irq);
+static int ioapic_deliver(struct kvm_ioapic *vioapic, int irq);
 static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
                                          unsigned long addr,
@@ -89,8 +89,8 @@ static void ioapic_service(struct kvm_ioapic *ioapic, unsigned int idx)
        pent = &ioapic->redirtbl[idx];
        if (!pent->fields.mask) {
-                ioapic_deliver(ioapic, idx);
+                int injected = ioapic_deliver(ioapic, idx);
-                if (pent->fields.trig_mode == IOAPIC_LEVEL_TRIG)
+                if (injected && pent->fields.trig_mode == IOAPIC_LEVEL_TRIG)
                        pent->fields.remote_irr = 1;
        }
        if (!pent->fields.trig_mode)
@@ -133,7 +133,7 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
        }
 }
-static void ioapic_inj_irq(struct kvm_ioapic *ioapic,
+static int ioapic_inj_irq(struct kvm_ioapic *ioapic,
                           struct kvm_vcpu *vcpu,
                           u8 vector, u8 trig_mode, u8 delivery_mode)
 {
@@ -143,7 +143,7 @@ static void ioapic_inj_irq(struct kvm_ioapic *ioapic,
        ASSERT((delivery_mode == IOAPIC_FIXED) ||
               (delivery_mode == IOAPIC_LOWEST_PRIORITY));
-        kvm_apic_set_irq(vcpu, vector, trig_mode);
+        return kvm_apic_set_irq(vcpu, vector, trig_mode);
 }
 static u32 ioapic_get_delivery_bitmask(struct kvm_ioapic *ioapic, u8 dest,
@@ -186,7 +186,7 @@ static u32 ioapic_get_delivery_bitmask(struct kvm_ioapic *ioapic, u8 dest,
        return mask;
 }
-static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
+static int ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
 {
        u8 dest = ioapic->redirtbl[irq].fields.dest_id;
        u8 dest_mode = ioapic->redirtbl[irq].fields.dest_mode;
@@ -195,7 +195,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
        u8 trig_mode = ioapic->redirtbl[irq].fields.trig_mode;
        u32 deliver_bitmask;
        struct kvm_vcpu *vcpu;
-        int vcpu_id;
+        int vcpu_id, r = 0;
        ioapic_debug("dest=%x dest_mode=%x delivery_mode=%x "
                     "vector=%x trig_mode=%x\n",
@@ -204,7 +204,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
        deliver_bitmask = ioapic_get_delivery_bitmask(ioapic, dest, dest_mode);
        if (!deliver_bitmask) {
                ioapic_debug("no target on destination\n");
-                return;
+                return 0;
        }
        switch (delivery_mode) {
@@ -216,7 +216,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
                        vcpu = ioapic->kvm->vcpus[0];
 #endif
                if (vcpu != NULL)
-                        ioapic_inj_irq(ioapic, vcpu, vector,
+                        r = ioapic_inj_irq(ioapic, vcpu, vector,
                                       trig_mode, delivery_mode);
                else
                        ioapic_debug("null lowest prio vcpu: "
@@ -234,7 +234,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
                        deliver_bitmask &= ~(1 << vcpu_id);
                        vcpu = ioapic->kvm->vcpus[vcpu_id];
                        if (vcpu) {
-                                ioapic_inj_irq(ioapic, vcpu, vector,
+                                r = ioapic_inj_irq(ioapic, vcpu, vector,
                                               trig_mode, delivery_mode);
                        }
                }
@@ -246,6 +246,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
                       delivery_mode);
                break;
        }
+        return r;
 }
 void kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)