99 files changed, 525 insertions, 293 deletions
diff --git a/arch/arm/include/asm/bitops.h b/arch/arm/include/asm/bitops.h
index 9a1db20e032a..63a481fbbed4 100644
--- a/arch/arm/include/asm/bitops.h
+++ b/arch/arm/include/asm/bitops.h
@@ -237,6 +237,7 @@ extern int _find_next_bit_be(const unsigned long *p, int size, int offset);
 #if __LINUX_ARM_ARCH__ < 5
 #include <asm-generic/bitops/ffz.h>
+#include <asm-generic/bitops/__fls.h>
 #include <asm-generic/bitops/__ffs.h>
 #include <asm-generic/bitops/fls.h>
 #include <asm-generic/bitops/ffs.h>
@@ -277,16 +278,19 @@ static inline int constant_fls(int x)
 * the clz instruction for much better code efficiency.
 */
-#define __fls(x) \
-        ( __builtin_constant_p(x) ? constant_fls(x) : \
-          ({ int __r; asm("clz\t%0, %1" : "=r"(__r) : "r"(x) : "cc"); 32-__r; }) )
-/* Implement fls() in C so that 64-bit args are suitably truncated */
 static inline int fls(int x)
 {
-        return __fls(x);
+        int ret;
+        if (__builtin_constant_p(x))
+               return constant_fls(x);
+        asm("clz\t%0, %1" : "=r" (ret) : "r" (x) : "cc");
+        ret = 32 - ret;
+        return ret;
 }
+#define __fls(x) (fls(x) - 1)
 #define ffs(x) ({ unsigned long __t = (x); fls(__t & -__t); })
 #define __ffs(x) (ffs(x) - 1)
 #define ffz(x) __ffs( ~(x) )
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index 517a4d6ffc74..6ff33790f47b 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -23,7 +23,7 @@
 #include <asm/types.h>
 #ifdef __KERNEL__
-#define STACK_TOP       ((current->personality == PER_LINUX_32BIT) ? \
+#define STACK_TOP       ((current->personality & ADDR_LIMIT_32BIT) ? \
                         TASK_SIZE : TASK_SIZE_26)
 #define STACK_TOP_MAX   TASK_SIZE
 #endif
diff --git a/arch/arm/mach-omap1/io.c b/arch/arm/mach-omap1/io.c
index b3bd8ca85118..4c3e582f3d3c 100644
--- a/arch/arm/mach-omap1/io.c
+++ b/arch/arm/mach-omap1/io.c
@@ -128,7 +128,7 @@ void __init omap1_map_common_io(void)
 * Common low-level hardware init for omap1. This should only get called from
 * board specific init.
 */
-void __init omap1_init_common_hw()
+void __init omap1_init_common_hw(void)
 {
        /* REVISIT: Refer to OMAP5910 Errata, Advisory SYS_1: "Timeout Abort
         * on a Posted Write in the TIPB Bridge".
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index 133e65d166b3..2d5884ce0435 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -70,6 +70,10 @@ static unsigned long ai_dword;
 static unsigned long ai_multi;
 static int ai_usermode;
+#define UM_WARN         (1 << 0)
+#define UM_FIXUP        (1 << 1)
+#define UM_SIGNAL       (1 << 2)
 #ifdef CONFIG_PROC_FS
 static const char *usermode_action[] = {
        "ignored",
@@ -754,7 +758,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
 user:
        ai_user += 1;
-        if (ai_usermode & 1)
+        if (ai_usermode & UM_WARN)
                printk("Alignment trap: %s (%d) PC=0x%08lx Instr=0x%0*lx "
                       "Address=0x%08lx FSR 0x%03x\n", current->comm,
                        task_pid_nr(current), instrptr,
@@ -762,10 +766,10 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
                        thumb_mode(regs) ? tinstr : instr,
                        addr, fsr);
-        if (ai_usermode & 2)
+        if (ai_usermode & UM_FIXUP)
                goto fixup;
-        if (ai_usermode & 4)
+        if (ai_usermode & UM_SIGNAL)
                force_sig(SIGBUS, current);
        else
                set_cr(cr_no_alignment);
@@ -796,6 +800,22 @@ static int __init alignment_init(void)
        res->write_proc = proc_alignment_write;
 #endif
+        /*
+         * ARMv6 and later CPUs can perform unaligned accesses for
+         * most single load and store instructions up to word size.
+         * LDM, STM, LDRD and STRD still need to be handled.
+         *
+         * Ignoring the alignment fault is not an option on these
+         * CPUs since we spin re-faulting the instruction without
+         * making any progress.
+         */
+        if (cpu_architecture() >= CPU_ARCH_ARMv6 && (cr_alignment & CR_U)) {
+                cr_alignment &= ~CR_A;
+                cr_no_alignment &= ~CR_A;
+                set_cr(cr_alignment);
+                ai_usermode = UM_FIXUP;
+        }
        hook_fault_code(1, do_alignment, SIGILL, "alignment exception");
        hook_fault_code(3, do_alignment, SIGILL, "alignment exception");
diff --git a/arch/arm/plat-omap/include/mach/omapfb.h b/arch/arm/plat-omap/include/mach/omapfb.h
index ec67fb428607..7b74d1255e0b 100644
--- a/arch/arm/plat-omap/include/mach/omapfb.h
+++ b/arch/arm/plat-omap/include/mach/omapfb.h
@@ -353,8 +353,8 @@ struct omapfb_device {
        u32                     pseudo_palette[17];
        struct lcd_panel        *panel;                 /* LCD panel */
-        struct lcd_ctrl         *ctrl;                  /* LCD controller */
+        const struct lcd_ctrl   *ctrl;                  /* LCD controller */
-        struct lcd_ctrl         *int_ctrl;              /* internal LCD ctrl */
+        const struct lcd_ctrl   *int_ctrl;              /* internal LCD ctrl */
        struct lcd_ctrl_extif   *ext_if;                /* LCD ctrl external
                                                           interface */
        struct device           *dev;
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index 9f9a921829c0..dcd9d16da2e9 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -255,7 +255,7 @@ void omap_sram_reprogram_clock(u32 dpllctl, u32 ckctl)
        if (!_omap_sram_reprogram_clock)
                omap_sram_error();
-        return _omap_sram_reprogram_clock(dpllctl, ckctl);
+        _omap_sram_reprogram_clock(dpllctl, ckctl);
 }
 int __init omap1_sram_init(void)
@@ -282,8 +282,8 @@ void omap2_sram_ddr_init(u32 *slow_dll_ctrl, u32 fast_dll_ctrl,
        if (!_omap2_sram_ddr_init)
                omap_sram_error();
-        return _omap2_sram_ddr_init(slow_dll_ctrl, fast_dll_ctrl,
+        _omap2_sram_ddr_init(slow_dll_ctrl, fast_dll_ctrl,
-                                    base_cs, force_unlock);
+                             base_cs, force_unlock);
 }
 static void (*_omap2_sram_reprogram_sdrc)(u32 perf_level, u32 dll_val,
@@ -294,7 +294,7 @@ void omap2_sram_reprogram_sdrc(u32 perf_level, u32 dll_val, u32 mem_type)
        if (!_omap2_sram_reprogram_sdrc)
                omap_sram_error();
-        return _omap2_sram_reprogram_sdrc(perf_level, dll_val, mem_type);
+        _omap2_sram_reprogram_sdrc(perf_level, dll_val, mem_type);
 }
 static u32 (*_omap2_set_prcm)(u32 dpll_ctrl_val, u32 sdrc_rfr_val, int bypass);
diff --git a/arch/arm/plat-orion/pcie.c b/arch/arm/plat-orion/pcie.c
index 883902fead89..d41d41d78ad9 100644
--- a/arch/arm/plat-orion/pcie.c
+++ b/arch/arm/plat-orion/pcie.c
@@ -35,7 +35,7 @@
 #define  PCIE_CONF_REG(r)               ((((r) & 0xf00) << 16) | ((r) & 0xfc))
 #define  PCIE_CONF_BUS(b)               (((b) & 0xff) << 16)
 #define  PCIE_CONF_DEV(d)               (((d) & 0x1f) << 11)
-#define  PCIE_CONF_FUNC(f)              (((f) & 0x3) << 8)
+#define  PCIE_CONF_FUNC(f)              (((f) & 0x7) << 8)
 #define PCIE_CONF_DATA_OFF      0x18fc
 #define PCIE_MASK_OFF           0x1910
 #define PCIE_CTRL_OFF           0x1a00
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index 972b2d2b8401..a1b3da6bad5c 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -1134,7 +1134,7 @@ static int vpe_release(struct inode *inode, struct file *filp)
        /* It's good to be able to run the SP and if it chokes have a look at
           the /dev/rt?. But if we reset the pointer to the shared struct we
-           loose what has happened. So perhaps if garbage is sent to the vpe
+           lose what has happened. So perhaps if garbage is sent to the vpe
           device, use it as a trigger for the reset. Hopefully a nice
           executable will be along shortly. */
        if (ret < 0)
diff --git a/arch/powerpc/kernel/cpu_setup_44x.S b/arch/powerpc/kernel/cpu_setup_44x.S
index 31c18b52affb..10b4ab1008af 100644
--- a/arch/powerpc/kernel/cpu_setup_44x.S
+++ b/arch/powerpc/kernel/cpu_setup_44x.S
@@ -40,6 +40,7 @@ _GLOBAL(__setup_cpu_460gt)
        mtlr    r4
        blr
+_GLOBAL(__setup_cpu_440x5)
 _GLOBAL(__setup_cpu_440gx)
 _GLOBAL(__setup_cpu_440spe)
        b       __fixup_440A_mcheck
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index b1eb834bc0fc..7e8719504f39 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -39,6 +39,7 @@ extern void __setup_cpu_440epx(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_440gx(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_440grx(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_440spe(unsigned long offset, struct cpu_spec* spec);
+extern void __setup_cpu_440x5(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_460ex(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_460gt(unsigned long offset, struct cpu_spec* spec);
 extern void __setup_cpu_603(unsigned long offset, struct cpu_spec* spec);
@@ -1500,6 +1501,8 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .cpu_user_features      = COMMON_USER_BOOKE,
                .icache_bsize           = 32,
                .dcache_bsize           = 32,
+                .cpu_setup              = __setup_cpu_440x5,
+                .machine_check          = machine_check_440A,
                .platform               = "ppc440",
        },
        { /* 460EX */
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 19d579d74d27..8f44ebb0dec8 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -16,6 +16,8 @@
 #include <linux/slab.h>
 #include <linux/syscalls.h>
 #include <linux/utsname.h>
+#include <linux/socket.h>
+#include <linux/un.h>
 #include <linux/workqueue.h>
 #include <linux/mutex.h>
 #include <asm/uaccess.h>
@@ -785,7 +787,7 @@ static int __init mconsole_init(void)
        /* long to avoid size mismatch warnings from gcc */
        long sock;
        int err;
-        char file[256];
+        char file[UNIX_PATH_MAX];
        if (umid_file_name("mconsole", file, sizeof(file)))
                return -1;
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
index 5662e226b0c9..a7b6dec6fc3f 100644
--- a/arch/x86/kernel/amd_iommu.c
+++ b/arch/x86/kernel/amd_iommu.c
@@ -344,7 +344,7 @@ static int iommu_map(struct protection_domain *dom,
        u64 __pte, *pte, *page;
        bus_addr  = PAGE_ALIGN(bus_addr);
-        phys_addr = PAGE_ALIGN(bus_addr);
+        phys_addr = PAGE_ALIGN(phys_addr);
        /* only support 512GB address spaces for now */
        if (bus_addr > IOMMU_MAP_SIZE_L3 || !(prot & IOMMU_PROT_MASK))
@@ -600,7 +600,7 @@ static void dma_ops_free_pagetable(struct dma_ops_domain *dma_dom)
                        continue;
                p2 = IOMMU_PTE_PAGE(p1[i]);
-                for (j = 0; j < 512; ++i) {
+                for (j = 0; j < 512; ++j) {
                        if (!IOMMU_PTE_PRESENT(p2[j]))
                                continue;
                        p3 = IOMMU_PTE_PAGE(p2[j]);
@@ -910,7 +910,7 @@ static void dma_ops_domain_unmap(struct amd_iommu *iommu,
        if (address >= dom->aperture_size)
                return;
-        WARN_ON(address & 0xfffULL || address > dom->aperture_size);
+        WARN_ON(address & ~PAGE_MASK || address >= dom->aperture_size);
        pte  = dom->pte_pages[IOMMU_PTE_L1_INDEX(address)];
        pte += IOMMU_PTE_L0_INDEX(address);
@@ -922,8 +922,8 @@ static void dma_ops_domain_unmap(struct amd_iommu *iommu,
 /*
 * This function contains common code for mapping of a physically
- * contiguous memory region into DMA address space. It is uses by all
+ * contiguous memory region into DMA address space. It is used by all
- * mapping functions provided by this IOMMU driver.
+ * mapping functions provided with this IOMMU driver.
 * Must be called with the domain lock held.
 */
 static dma_addr_t __map_single(struct device *dev,
@@ -983,7 +983,8 @@ static void __unmap_single(struct amd_iommu *iommu,
        dma_addr_t i, start;
        unsigned int pages;
-        if ((dma_addr == 0) || (dma_addr + size > dma_dom->aperture_size))
+        if ((dma_addr == bad_dma_address) ||
+            (dma_addr + size > dma_dom->aperture_size))
                return;
        pages = iommu_num_pages(dma_addr, size, PAGE_SIZE);
diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
index 0e9f1982b1dd..95777b0faa73 100644
--- a/arch/x86/kernel/paravirt-spinlocks.c
+++ b/arch/x86/kernel/paravirt-spinlocks.c
@@ -7,7 +7,8 @@
 #include <asm/paravirt.h>
-static void default_spin_lock_flags(struct raw_spinlock *lock, unsigned long flags)
+static inline void
+default_spin_lock_flags(raw_spinlock_t *lock, unsigned long flags)
 {
        __raw_spin_lock(lock);
 }
diff --git a/block/bsg.c b/block/bsg.c
index e8bd2475682a..e73e50daf3d0 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -202,6 +202,8 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
                rq->timeout = q->sg_timeout;
        if (!rq->timeout)
                rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
+        if (rq->timeout < BLK_MIN_SG_TIMEOUT)
+                rq->timeout = BLK_MIN_SG_TIMEOUT;
        return 0;
 }
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 5963cf91a3a0..d0bb92cbefb9 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -208,6 +208,8 @@ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
                rq->timeout = q->sg_timeout;
        if (!rq->timeout)
                rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
+        if (rq->timeout < BLK_MIN_SG_TIMEOUT)
+                rq->timeout = BLK_MIN_SG_TIMEOUT;
        return 0;
 }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 4fb3c12ac1d8..1423b0c0cd2e 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -173,19 +173,7 @@ static int acpi_battery_get_property(struct power_supply *psy,
                val->intval = battery->voltage_now * 1000;
                break;
        case POWER_SUPPLY_PROP_CURRENT_NOW:
-                val->intval = battery->current_now;
+                val->intval = battery->current_now * 1000;
-                if (battery->power_unit) {
-                        val->intval *= 1000;
-                } else {
-                        /*
-                         * If power units are mW, convert to mA by dividing by
-                         * current voltage.
-                         */
-                        if (battery->voltage_now)
-                                val->intval /= battery->voltage_now;
-                        else
-                                val->intval = -1;
-                }
                break;
        case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN:
        case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN:
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 78fbec8ceda0..421b7c71e72d 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -153,7 +153,7 @@ config SATA_PROMISE
          If unsure, say N.
 config SATA_SX4
-        tristate "Promise SATA SX4 support"
+        tristate "Promise SATA SX4 support (Experimental)"
        depends on PCI && EXPERIMENTAL
        help
          This option enables support for Promise Serial ATA SX4.
@@ -219,8 +219,8 @@ config PATA_ACPI
          otherwise unsupported hardware.
 config PATA_ALI
-        tristate "ALi PATA support (Experimental)"
+        tristate "ALi PATA support"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI
        help
          This option enables support for the ALi ATA interfaces
          found on the many ALi chipsets.
@@ -263,7 +263,7 @@ config PATA_ATIIXP
          If unsure, say N.
 config PATA_CMD640_PCI
-        tristate "CMD640 PCI PATA support (Very Experimental)"
+        tristate "CMD640 PCI PATA support (Experimental)"
        depends on PCI && EXPERIMENTAL
        help
          This option enables support for the CMD640 PCI IDE
@@ -291,8 +291,8 @@ config PATA_CS5520
          If unsure, say N.
 config PATA_CS5530
-        tristate "CS5530 PATA support (Experimental)"
+        tristate "CS5530 PATA support"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI
        help
          This option enables support for the Cyrix/NatSemi/AMD CS5530
          companion chip used with the MediaGX/Geode processor family.
@@ -309,8 +309,8 @@ config PATA_CS5535
          If unsure, say N.
 config PATA_CS5536
-        tristate "CS5536 PATA support (Experimental)"
+        tristate "CS5536 PATA support"
-        depends on PCI && X86 && !X86_64 && EXPERIMENTAL
+        depends on PCI && X86 && !X86_64
        help
          This option enables support for the AMD CS5536
          companion chip used with the Geode LX processor family.
@@ -363,7 +363,7 @@ config PATA_HPT37X
          If unsure, say N.
 config PATA_HPT3X2N
-        tristate "HPT 372N/302N PATA support (Very Experimental)"
+        tristate "HPT 372N/302N PATA support (Experimental)"
        depends on PCI && EXPERIMENTAL
        help
          This option enables support for the N variant HPT PATA
@@ -389,8 +389,8 @@ config PATA_HPT3X3_DMA
          problems with DMA on this chipset.
 config PATA_ISAPNP
-        tristate "ISA Plug and Play PATA support (Experimental)"
+        tristate "ISA Plug and Play PATA support"
-        depends on EXPERIMENTAL && ISAPNP
+        depends on ISAPNP
        help
          This option enables support for ISA plug & play ATA
          controllers such as those found on old soundcards.
@@ -498,8 +498,8 @@ config PATA_NINJA32
          If unsure, say N.
 config PATA_NS87410
-        tristate "Nat Semi NS87410 PATA support (Experimental)"
+        tristate "Nat Semi NS87410 PATA support"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI
        help
          This option enables support for the National Semiconductor
          NS87410 PCI-IDE controller.
@@ -507,8 +507,8 @@ config PATA_NS87410
          If unsure, say N.
 config PATA_NS87415
-        tristate "Nat Semi NS87415 PATA support (Experimental)"
+        tristate "Nat Semi NS87415 PATA support"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI
        help
          This option enables support for the National Semiconductor
          NS87415 PCI-IDE controller.
@@ -544,8 +544,8 @@ config PATA_PCMCIA
          If unsure, say N.
 config PATA_PDC_OLD
-        tristate "Older Promise PATA controller support (Experimental)"
+        tristate "Older Promise PATA controller support"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI
        help
          This option enables support for the Promise 20246, 20262, 20263,
          20265 and 20267 adapters.
@@ -559,7 +559,7 @@ config PATA_QDI
          Support for QDI 6500 and 6580 PATA controllers on VESA local bus.
 config PATA_RADISYS
-        tristate "RADISYS 82600 PATA support (Very Experimental)"
+        tristate "RADISYS 82600 PATA support (Experimental)"
        depends on PCI && EXPERIMENTAL
        help
          This option enables support for the RADISYS 82600
@@ -586,8 +586,8 @@ config PATA_RZ1000
          If unsure, say N.
 config PATA_SC1200
-        tristate "SC1200 PATA support (Very Experimental)"
+        tristate "SC1200 PATA support"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI
        help
          This option enables support for the NatSemi/AMD SC1200 SoC
          companion chip used with the Geode processor family.
@@ -620,8 +620,8 @@ config PATA_SIL680
          If unsure, say N.
 config PATA_SIS
-        tristate "SiS PATA support (Experimental)"
+        tristate "SiS PATA support"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI
        help
          This option enables support for SiS PATA controllers
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index d6d97d8f3fa4..c11936e13dd3 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -1072,7 +1072,14 @@ static int piix_broken_suspend(void)
         * matching is necessary because dmi_system_id.matches is
         * limited to four entries.
         */
-        if (!strcmp(dmi_get_system_info(DMI_SYS_VENDOR), "TOSHIBA") &&
+        if (dmi_get_system_info(DMI_SYS_VENDOR) &&
+            dmi_get_system_info(DMI_PRODUCT_NAME) &&
+            dmi_get_system_info(DMI_PRODUCT_VERSION) &&
+            dmi_get_system_info(DMI_PRODUCT_SERIAL) &&
+            dmi_get_system_info(DMI_BOARD_VENDOR) &&
+            dmi_get_system_info(DMI_BOARD_NAME) &&
+            dmi_get_system_info(DMI_BOARD_VERSION) &&
+            !strcmp(dmi_get_system_info(DMI_SYS_VENDOR), "TOSHIBA") &&
            !strcmp(dmi_get_system_info(DMI_PRODUCT_NAME), "000000") &&
            !strcmp(dmi_get_system_info(DMI_PRODUCT_VERSION), "000000") &&
            !strcmp(dmi_get_system_info(DMI_PRODUCT_SERIAL), "000000") &&
diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
index f2b83eabc7c7..a098ba8eaab6 100644
--- a/drivers/ata/pata_hpt366.c
+++ b/drivers/ata/pata_hpt366.c
@@ -382,10 +382,10 @@ static int hpt36x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
        /* PCI clocking determines the ATA timing values to use */
        /* info_hpt366 is safe against re-entry so we can scribble on it */
        switch((reg1 & 0x700) >> 8) {
-                case 5:
+                case 9:
                        hpriv = &hpt366_40;
                        break;
-                case 9:
+                case 5:
                        hpriv = &hpt366_25;
                        break;
                default:
diff --git a/drivers/ata/pata_ninja32.c b/drivers/ata/pata_ninja32.c
index 4e466eae8b46..4dd9a3b031e4 100644
--- a/drivers/ata/pata_ninja32.c
+++ b/drivers/ata/pata_ninja32.c
@@ -44,7 +44,7 @@
 #include <linux/libata.h>
 #define DRV_NAME "pata_ninja32"
-#define DRV_VERSION "0.1.1"
+#define DRV_VERSION "0.1.3"
 /**
@@ -130,7 +130,8 @@ static int ninja32_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                return rc;
        pci_set_master(dev);
-        /* Set up the register mappings */
+        /* Set up the register mappings. We use the I/O mapping as only the
+           older chips also have MMIO on BAR 1 */
        base = host->iomap[0];
        if (!base)
                return -ENOMEM;
@@ -167,8 +168,12 @@ static int ninja32_reinit_one(struct pci_dev *pdev)
 #endif
 static const struct pci_device_id ninja32[] = {
+        { 0x10FC, 0x0003, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+        { 0x1145, 0x8008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+        { 0x1145, 0xf008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
        { 0x1145, 0xf021, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
        { 0x1145, 0xf024, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+        { 0x1145, 0xf02C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
        { },
 };
diff --git a/drivers/ata/pata_sis.c b/drivers/ata/pata_sis.c
index d34236611752..e4be55e047f6 100644
--- a/drivers/ata/pata_sis.c
+++ b/drivers/ata/pata_sis.c
@@ -56,7 +56,6 @@ static const struct sis_laptop sis_laptop[] = {
        { 0x5513, 0x1043, 0x1107 },     /* ASUS A6K */
        { 0x5513, 0x1734, 0x105F },     /* FSC Amilo A1630 */
        { 0x5513, 0x1071, 0x8640 },     /* EasyNote K5305 */
-        { 0x5513, 0x1039, 0x5513 },     /* Targa Visionary 1000 */
        /* end marker */
        { 0, }
 };
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index edda7b6b077b..dc7a8c352da2 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -302,7 +302,7 @@ static struct kobj_type kobj_pkt_type_wqueue = {
 static void pkt_sysfs_dev_new(struct pktcdvd_device *pd)
 {
        if (class_pktcdvd) {
-                pd->dev = device_create(class_pktcdvd, NULL, pd->pkt_dev, NULL,
+                pd->dev = device_create(class_pktcdvd, NULL, MKDEV(0, 0), NULL,
                                        "%s", pd->name);
                if (IS_ERR(pd->dev))
                        pd->dev = NULL;
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index 3b23270eaa65..a8f15e6be594 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -418,7 +418,7 @@ static irqreturn_t cd2401_rxerr_interrupt(int irq, void *dev_id)
                                                             TTY_OVERRUN);
                                        /*
                                           If the flip buffer itself is
-                                           overflowing, we still loose
+                                           overflowing, we still lose
                                           the next incoming character.
                                         */
                                        if (tty_buffer_request_room(tty, 1) !=
diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
index 46610b090415..ab9c01e462ef 100644
--- a/drivers/firewire/fw-ohci.c
+++ b/drivers/firewire/fw-ohci.c
@@ -974,6 +974,7 @@ at_context_queue_packet(struct context *ctx, struct fw_packet *packet)
                        packet->ack = RCODE_SEND_ERROR;
                        return -1;
                }
+                packet->payload_bus = payload_bus;
                d[2].req_count    = cpu_to_le16(packet->payload_length);
                d[2].data_address = cpu_to_le32(payload_bus);
@@ -1025,7 +1026,6 @@ static int handle_at_packet(struct context *context,
        struct driver_data *driver_data;
        struct fw_packet *packet;
        struct fw_ohci *ohci = context->ohci;
-        dma_addr_t payload_bus;
        int evt;
        if (last->transfer_status == 0)
@@ -1038,9 +1038,8 @@ static int handle_at_packet(struct context *context,
                /* This packet was cancelled, just continue. */
                return 1;
-        payload_bus = le32_to_cpu(last->data_address);
+        if (packet->payload_bus)
-        if (payload_bus != 0)
+                dma_unmap_single(ohci->card.device, packet->payload_bus,
-                dma_unmap_single(ohci->card.device, payload_bus,
                                 packet->payload_length, DMA_TO_DEVICE);
        evt = le16_to_cpu(last->transfer_status) & 0x1f;
@@ -1697,6 +1696,10 @@ static int ohci_cancel_packet(struct fw_card *card, struct fw_packet *packet)
        if (packet->ack != 0)
                goto out;
+        if (packet->payload_bus)
+                dma_unmap_single(ohci->card.device, packet->payload_bus,
+                                 packet->payload_length, DMA_TO_DEVICE);
        log_ar_at_event('T', packet->speed, packet->header, 0x20);
        driver_data->packet = NULL;
        packet->ack = RCODE_CANCELLED;
diff --git a/drivers/firewire/fw-transaction.c b/drivers/firewire/fw-transaction.c
index 022ac4fabb67..2884f876397b 100644
--- a/drivers/firewire/fw-transaction.c
+++ b/drivers/firewire/fw-transaction.c
@@ -207,6 +207,7 @@ fw_fill_request(struct fw_packet *packet, int tcode, int tlabel,
        packet->speed = speed;
        packet->generation = generation;
        packet->ack = 0;
+        packet->payload_bus = 0;
 }
 /**
@@ -581,6 +582,8 @@ fw_fill_response(struct fw_packet *response, u32 *request_header,
                BUG();
                return;
        }
+        response->payload_bus = 0;
 }
 EXPORT_SYMBOL(fw_fill_response);
diff --git a/drivers/firewire/fw-transaction.h b/drivers/firewire/fw-transaction.h
index aed7dbb17cda..839466f0a795 100644
--- a/drivers/firewire/fw-transaction.h
+++ b/drivers/firewire/fw-transaction.h
@@ -27,6 +27,7 @@
 #include <linux/list.h>
 #include <linux/spinlock_types.h>
 #include <linux/timer.h>
+#include <linux/types.h>
 #include <linux/workqueue.h>
 #define TCODE_IS_READ_REQUEST(tcode)    (((tcode) & ~1) == 4)
@@ -153,6 +154,7 @@ struct fw_packet {
        size_t header_length;
        void *payload;
        size_t payload_length;
+        dma_addr_t payload_bus;
        u32 timestamp;
        /*
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index ba89b42f790a..553dd4bc3075 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -847,9 +847,10 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         * and the registers being closely associated.
         *
         * According to chipset errata, on the 965GM, MSI interrupts may
-         * be lost or delayed
+         * be lost or delayed, but we use them anyways to avoid
+         * stuck interrupts on some machines.
         */
-        if (!IS_I945G(dev) && !IS_I945GM(dev) && !IS_I965GM(dev))
+        if (!IS_I945G(dev) && !IS_I945GM(dev))
                pci_enable_msi(dev->pdev);
        intel_opregion_init(dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 3fde82be014f..ad672d854828 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1104,6 +1104,8 @@ i915_gem_evict_everything(struct drm_device *dev)
                if (ret != 0)
                        break;
        }
+        if (ret == -ENOMEM)
+                return 0;
        return ret;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 7a183789be97..3bbb871b25d5 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -299,7 +299,6 @@ typedef struct drm_radeon_private {
        atomic_t swi_emitted;
        int vblank_crtc;
        uint32_t irq_enable_reg;
-        int irq_enabled;
        uint32_t r500_disp_irq_reg;
        struct radeon_surface surfaces[RADEON_MAX_SURFACES];
diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
index 97c0599fdb1e..99be11418ac2 100644
--- a/drivers/gpu/drm/radeon/radeon_irq.c
+++ b/drivers/gpu/drm/radeon/radeon_irq.c
@@ -44,7 +44,8 @@ void radeon_irq_set_state(struct drm_device *dev, u32 mask, int state)
        else
                dev_priv->irq_enable_reg &= ~mask;
-        RADEON_WRITE(RADEON_GEN_INT_CNTL, dev_priv->irq_enable_reg);
+        if (!dev->irq_enabled)
+                RADEON_WRITE(RADEON_GEN_INT_CNTL, dev_priv->irq_enable_reg);
 }
 static void r500_vbl_irq_set_state(struct drm_device *dev, u32 mask, int state)
@@ -56,7 +57,8 @@ static void r500_vbl_irq_set_state(struct drm_device *dev, u32 mask, int state)
        else
                dev_priv->r500_disp_irq_reg &= ~mask;
-        RADEON_WRITE(R500_DxMODE_INT_MASK, dev_priv->r500_disp_irq_reg);
+        if (!dev->irq_enabled)
+                RADEON_WRITE(R500_DxMODE_INT_MASK, dev_priv->r500_disp_irq_reg);
 }
 int radeon_enable_vblank(struct drm_device *dev, int crtc)
@@ -355,8 +357,6 @@ void radeon_driver_irq_uninstall(struct drm_device * dev)
        if (!dev_priv)
                return;
-        dev_priv->irq_enabled = 0;
        if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RS690)
                RADEON_WRITE(R500_DxMODE_INT_MASK, 0);
        /* Disable *all* interrupts */
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 6d7401772a8f..e6857e01d1ba 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -669,10 +669,12 @@ config BLK_DEV_CELLEB
 endif
+# TODO: BLK_DEV_IDEDMA_PCI -> BLK_DEV_IDEDMA_SFF
 config BLK_DEV_IDE_PMAC
        tristate "PowerMac on-board IDE support"
        depends on PPC_PMAC && IDE=y
        select IDE_TIMINGS
+        select BLK_DEV_IDEDMA_PCI
        help
          This driver provides support for the on-board IDE controller on
          most of the recent Apple Power Macintoshes and PowerBooks.
@@ -689,16 +691,6 @@ config BLK_DEV_IDE_PMAC_ATA100FIRST
          CD-ROM on hda. This option changes this to more natural hda for
          hard disk and hdc for CD-ROM.
-config BLK_DEV_IDEDMA_PMAC
-        bool "PowerMac IDE DMA support"
-        depends on BLK_DEV_IDE_PMAC
-        select BLK_DEV_IDEDMA_PCI
-        help
-          This option allows the driver for the on-board IDE controller on
-          Power Macintoshes and PowerBooks to use DMA (direct memory access)
-          to transfer data to and from memory.  Saying Y is safe and improves
-          performance.
 config BLK_DEV_IDE_AU1XXX
       bool "IDE for AMD Alchemy Au1200"
       depends on SOC_AU1200
@@ -912,7 +904,7 @@ config BLK_DEV_UMC8672
 endif
 config BLK_DEV_IDEDMA
-        def_bool BLK_DEV_IDEDMA_SFF || BLK_DEV_IDEDMA_PMAC || \
+        def_bool BLK_DEV_IDEDMA_SFF || \
                 BLK_DEV_IDEDMA_ICS || BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA
 endif # IDE
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 7d275b2af3eb..cc35d6dbd410 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -208,8 +208,10 @@ static ide_startstop_t ide_start_power_step(ide_drive_t *drive, struct request *
                 */
                if (drive->hwif->dma_ops == NULL)
                        break;
-                if (drive->dev_flags & IDE_DFLAG_USING_DMA)
+                /*
-                        ide_set_dma(drive);
+                 * TODO: respect IDE_DFLAG_USING_DMA
+                 */
+                ide_set_dma(drive);
                break;
        }
diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
index 2e19d6298536..7c481bb56fab 100644
--- a/drivers/ide/pmac.c
+++ b/drivers/ide/pmac.c
@@ -66,7 +66,6 @@ typedef struct pmac_ide_hwif {
        struct macio_dev                *mdev;
        u32                             timings[4];
        volatile u32 __iomem *          *kauai_fcr;
-#ifdef CONFIG_BLK_DEV_IDEDMA_PMAC
        /* Those fields are duplicating what is in hwif. We currently
         * can't use the hwif ones because of some assumptions that are
         * beeing done by the generic code about the kind of dma controller
@@ -74,8 +73,6 @@ typedef struct pmac_ide_hwif {
         */
        volatile struct dbdma_regs __iomem *    dma_regs;
        struct dbdma_cmd*               dma_table_cpu;
-#endif
-        
 } pmac_ide_hwif_t;
 enum {
@@ -222,8 +219,6 @@ static const char* model_name[] = {
 #define KAUAI_FCR_UATA_RESET_N          0x00000002
 #define KAUAI_FCR_UATA_ENABLE           0x00000001
-#ifdef CONFIG_BLK_DEV_IDEDMA_PMAC
 /* Rounded Multiword DMA timings
 * 
 * I gave up finding a generic formula for all controller
@@ -413,8 +408,6 @@ static int pmac_ide_build_dmatable(ide_drive_t *drive, struct request *rq);
 static void pmac_ide_selectproc(ide_drive_t *drive);
 static void pmac_ide_kauai_selectproc(ide_drive_t *drive);
-#endif /* CONFIG_BLK_DEV_IDEDMA_PMAC */
 #define PMAC_IDE_REG(x) \
        ((void __iomem *)((drive)->hwif->io_ports.data_addr + (x)))
@@ -584,8 +577,6 @@ pmac_ide_set_pio_mode(ide_drive_t *drive, const u8 pio)
        pmac_ide_do_update_timings(drive);
 }
-#ifdef CONFIG_BLK_DEV_IDEDMA_PMAC
 /*
 * Calculate KeyLargo ATA/66 UDMA timings
 */
@@ -786,7 +777,6 @@ set_timings_mdma(ide_drive_t *drive, int intf_type, u32 *timings, u32 *timings2,
                drive->name, speed & 0xf,  *timings);
 #endif  
 }
-#endif /* #ifdef CONFIG_BLK_DEV_IDEDMA_PMAC */
 static void pmac_ide_set_dma_mode(ide_drive_t *drive, const u8 speed)
 {
@@ -804,7 +794,6 @@ static void pmac_ide_set_dma_mode(ide_drive_t *drive, const u8 speed)
        tl[0] = *timings;
        tl[1] = *timings2;
-#ifdef CONFIG_BLK_DEV_IDEDMA_PMAC
        if (speed >= XFER_UDMA_0) {
                if (pmif->kind == controller_kl_ata4)
                        ret = set_timings_udma_ata4(&tl[0], speed);
@@ -817,7 +806,7 @@ static void pmac_ide_set_dma_mode(ide_drive_t *drive, const u8 speed)
                        ret = -1;
        } else
                set_timings_mdma(drive, pmif->kind, &tl[0], &tl[1], speed);
-#endif /* CONFIG_BLK_DEV_IDEDMA_PMAC */
        if (ret)
                return;
@@ -1008,9 +997,7 @@ static const struct ide_port_info pmac_port_info = {
        .chipset                = ide_pmac,
        .tp_ops                 = &pmac_tp_ops,
        .port_ops               = &pmac_ide_port_ops,
-#ifdef CONFIG_BLK_DEV_IDEDMA_PMAC
        .dma_ops                = &pmac_dma_ops,
-#endif
        .host_flags             = IDE_HFLAG_SET_PIO_MODE_KEEP_DMA |
                                  IDE_HFLAG_POST_SET_MODE |
                                  IDE_HFLAG_MMIO |
@@ -1182,7 +1169,7 @@ pmac_ide_macio_attach(struct macio_dev *mdev, const struct of_device_id *match)
        pmif->regbase = regbase;
        pmif->irq = irq;
        pmif->kauai_fcr = NULL;
-#ifdef CONFIG_BLK_DEV_IDEDMA_PMAC
        if (macio_resource_count(mdev) >= 2) {
                if (macio_request_resource(mdev, 1, "ide-pmac (dma)"))
                        printk(KERN_WARNING "ide-pmac: can't request DMA "
@@ -1192,7 +1179,7 @@ pmac_ide_macio_attach(struct macio_dev *mdev, const struct of_device_id *match)
                        pmif->dma_regs = ioremap(macio_resource_start(mdev, 1), 0x1000);
        } else
                pmif->dma_regs = NULL;
-#endif /* CONFIG_BLK_DEV_IDEDMA_PMAC */
        dev_set_drvdata(&mdev->ofdev.dev, pmif);
        memset(&hw, 0, sizeof(hw));
@@ -1300,9 +1287,7 @@ pmac_ide_pci_attach(struct pci_dev *pdev, const struct pci_device_id *id)
        base = ioremap(rbase, rlen);
        pmif->regbase = (unsigned long) base + 0x2000;
-#ifdef CONFIG_BLK_DEV_IDEDMA_PMAC
        pmif->dma_regs = base + 0x1000;
-#endif /* CONFIG_BLK_DEV_IDEDMA_PMAC */
        pmif->kauai_fcr = base;
        pmif->irq = pdev->irq;
@@ -1434,8 +1419,6 @@ out:
        return error;
 }
-#ifdef CONFIG_BLK_DEV_IDEDMA_PMAC
 /*
 * pmac_ide_build_dmatable builds the DBDMA command list
 * for a transfer and sets the DBDMA channel to point to it.
@@ -1723,13 +1706,6 @@ static int __devinit pmac_ide_init_dma(ide_hwif_t *hwif,
        return 0;
 }
-#else
-static int __devinit pmac_ide_init_dma(ide_hwif_t *hwif,
-                                       const struct ide_port_info *d)
-{
-        return -EOPNOTSUPP;
-}
-#endif /* CONFIG_BLK_DEV_IDEDMA_PMAC */
 module_init(pmac_ide_probe);
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index 9e39f73282ee..d333ae22459c 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -1685,6 +1685,7 @@ static int nodemgr_host_thread(void *data)
                g = get_hpsb_generation(host);
                for (i = 0; i < 4 ; i++) {
                        msleep_interruptible(63);
+                        try_to_freeze();
                        if (kthread_should_stop())
                                goto exit;
@@ -1725,6 +1726,7 @@ static int nodemgr_host_thread(void *data)
                /* Sleep 3 seconds */
                for (i = 3000/200; i; i--) {
                        msleep_interruptible(200);
+                        try_to_freeze();
                        if (kthread_should_stop())
                                goto exit;
diff --git a/drivers/isdn/hardware/avm/b1isa.c b/drivers/isdn/hardware/avm/b1isa.c
index 1e288eeb5e2a..6461a32bc838 100644
--- a/drivers/isdn/hardware/avm/b1isa.c
+++ b/drivers/isdn/hardware/avm/b1isa.c
@@ -233,10 +233,8 @@ static void __exit b1isa_exit(void)
        int i;
        for (i = 0; i < MAX_CARDS; i++) {
-                if (!io[i])
+                if (isa_dev[i].resource[0].start)
-                        break;
+                        b1isa_remove(&isa_dev[i]);
-                b1isa_remove(&isa_dev[i]);
        }
        unregister_capi_driver(&capi_driver_b1isa);
 }
diff --git a/drivers/isdn/hysdn/hysdn_net.c b/drivers/isdn/hysdn/hysdn_net.c
index cfa8fa5e44ab..3f2a0a20c19b 100644
--- a/drivers/isdn/hysdn/hysdn_net.c
+++ b/drivers/isdn/hysdn/hysdn_net.c
@@ -83,12 +83,12 @@ net_open(struct net_device *dev)
        /* Fill in the MAC-level header (if not already set) */
        if (!card->mac_addr[0]) {
-                for (i = 0; i < ETH_ALEN - sizeof(unsigned long); i++)
+                for (i = 0; i < ETH_ALEN; i++)
                        dev->dev_addr[i] = 0xfc;
                if ((in_dev = dev->ip_ptr) != NULL) {
                        struct in_ifaddr *ifa = in_dev->ifa_list;
                        if (ifa != NULL)
-                                memcpy(dev->dev_addr + (ETH_ALEN - sizeof(unsigned long)), &ifa->ifa_local, sizeof(unsigned long));
+                                memcpy(dev->dev_addr + (ETH_ALEN - sizeof(ifa->ifa_local)), &ifa->ifa_local, sizeof(ifa->ifa_local));
                }
        } else
                memcpy(dev->dev_addr, card->mac_addr, ETH_ALEN);
diff --git a/drivers/message/i2o/i2o_block.c b/drivers/message/i2o/i2o_block.c
index 84bdc2ee69e6..a443e136dc41 100644
--- a/drivers/message/i2o/i2o_block.c
+++ b/drivers/message/i2o/i2o_block.c
@@ -354,7 +354,7 @@ static inline void i2o_block_sglist_free(struct i2o_block_request *ireq)
 *      @req: the request to prepare
 *
 *      Allocate the necessary i2o_block_request struct and connect it to
- *      the request. This is needed that we not loose the SG list later on.
+ *      the request. This is needed that we not lose the SG list later on.
 *
 *      Returns BLKPREP_OK on success or BLKPREP_DEFER on failure.
 */
diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
index be2b5926d26c..6e53a30bfd38 100644
--- a/drivers/message/i2o/iop.c
+++ b/drivers/message/i2o/iop.c
@@ -49,7 +49,6 @@ static int i2o_hrt_get(struct i2o_controller *c);
 /**
 *      i2o_msg_get_wait - obtain an I2O message from the IOP
 *      @c: I2O controller
- *      @msg: pointer to a I2O message pointer
 *      @wait: how long to wait until timeout
 *
 *      This function waits up to wait seconds for a message slot to be
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 76a76751da36..6659b2275c0c 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -37,9 +37,9 @@
 #define OPCODE_NORM_READ        0x03    /* Read data bytes (low frequency) */
 #define OPCODE_FAST_READ        0x0b    /* Read data bytes (high frequency) */
 #define OPCODE_PP               0x02    /* Page program (up to 256 bytes) */
-#define OPCODE_BE_4K            0x20    /* Erase 4KiB block */
+#define OPCODE_BE_4K            0x20    /* Erase 4KiB block */
 #define OPCODE_BE_32K           0x52    /* Erase 32KiB block */
-#define OPCODE_BE               0xc7    /* Erase whole flash block */
+#define OPCODE_CHIP_ERASE       0xc7    /* Erase whole flash chip */
 #define OPCODE_SE               0xd8    /* Sector erase (usually 64KiB) */
 #define OPCODE_RDID             0x9f    /* Read JEDEC ID */
@@ -167,7 +167,7 @@ static int wait_till_ready(struct m25p *flash)
 *
 * Returns 0 if successful, non-zero otherwise.
 */
-static int erase_block(struct m25p *flash)
+static int erase_chip(struct m25p *flash)
 {
        DEBUG(MTD_DEBUG_LEVEL3, "%s: %s %dKiB\n",
                        flash->spi->dev.bus_id, __func__,
@@ -181,7 +181,7 @@ static int erase_block(struct m25p *flash)
        write_enable(flash);
        /* Set up command buffer. */
-        flash->command[0] = OPCODE_BE;
+        flash->command[0] = OPCODE_CHIP_ERASE;
        spi_write(flash->spi, flash->command, 1);
@@ -250,15 +250,18 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
        mutex_lock(&flash->lock);
-        /* REVISIT in some cases we could speed up erasing large regions
+        /* whole-chip erase? */
-         * by using OPCODE_SE instead of OPCODE_BE_4K
+        if (len == flash->mtd.size && erase_chip(flash)) {
-         */
-        /* now erase those sectors */
-        if (len == flash->mtd.size && erase_block(flash)) {
                instr->state = MTD_ERASE_FAILED;
                mutex_unlock(&flash->lock);
                return -EIO;
+        /* REVISIT in some cases we could speed up erasing large regions
+         * by using OPCODE_SE instead of OPCODE_BE_4K.  We may have set up
+         * to use "small sector erase", but that's not always optimal.
+         */
+        /* "sector"-at-a-time erase */
        } else {
                while (len) {
                        if (erase_sector(flash, addr)) {
@@ -574,10 +577,11 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
        for (tmp = 0, info = m25p_data;
                        tmp < ARRAY_SIZE(m25p_data);
                        tmp++, info++) {
-                if (info->jedec_id == jedec)
+                if (info->jedec_id == jedec) {
-                        if (ext_jedec != 0 && info->ext_id != ext_jedec)
+                        if (info->ext_id != 0 && info->ext_id != ext_jedec)
                                continue;
                        return info;
+                }
        }
        dev_err(&spi->dev, "unrecognized JEDEC id %06x\n", jedec);
        return NULL;
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 42d844f8f6bf..dfbf3f270cea 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -19,7 +19,7 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/physmap.h>
 #include <linux/mtd/concat.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #define MAX_RESOURCES           4
@@ -27,7 +27,6 @@ struct physmap_flash_info {
        struct mtd_info         *mtd[MAX_RESOURCES];
        struct mtd_info         *cmtd;
        struct map_info         map[MAX_RESOURCES];
-        struct resource         *res;
 #ifdef CONFIG_MTD_PARTITIONS
        int                     nr_parts;
        struct mtd_partition    *parts;
@@ -70,16 +69,7 @@ static int physmap_flash_remove(struct platform_device *dev)
 #endif
                        map_destroy(info->mtd[i]);
                }
-                if (info->map[i].virt != NULL)
-                        iounmap(info->map[i].virt);
-        }
-        if (info->res != NULL) {
-                release_resource(info->res);
-                kfree(info->res);
        }
        return 0;
 }
@@ -101,7 +91,8 @@ static int physmap_flash_probe(struct platform_device *dev)
        if (physmap_data == NULL)
                return -ENODEV;
-        info = kzalloc(sizeof(struct physmap_flash_info), GFP_KERNEL);
+        info = devm_kzalloc(&dev->dev, sizeof(struct physmap_flash_info),
+                            GFP_KERNEL);
        if (info == NULL) {
                err = -ENOMEM;
                goto err_out;
@@ -114,10 +105,10 @@ static int physmap_flash_probe(struct platform_device *dev)
                       (unsigned long long)(dev->resource[i].end - dev->resource[i].start + 1),
                       (unsigned long long)dev->resource[i].start);
-                info->res = request_mem_region(dev->resource[i].start,
+                if (!devm_request_mem_region(&dev->dev,
-                                               dev->resource[i].end - dev->resource[i].start + 1,
+                        dev->resource[i].start,
-                                               dev->dev.bus_id);
+                        dev->resource[i].end - dev->resource[i].start + 1,
-                if (info->res == NULL) {
+                        dev->dev.bus_id)) {
                        dev_err(&dev->dev, "Could not reserve memory region\n");
                        err = -ENOMEM;
                        goto err_out;
@@ -129,7 +120,8 @@ static int physmap_flash_probe(struct platform_device *dev)
                info->map[i].bankwidth = physmap_data->width;
                info->map[i].set_vpp = physmap_data->set_vpp;
-                info->map[i].virt = ioremap(info->map[i].phys, info->map[i].size);
+                info->map[i].virt = devm_ioremap(&dev->dev, info->map[i].phys,
+                                                 info->map[i].size);
                if (info->map[i].virt == NULL) {
                        dev_err(&dev->dev, "Failed to ioremap flash region\n");
                        err = EIO;
diff --git a/drivers/mtd/nand/fsl_upm.c b/drivers/mtd/nand/fsl_upm.c
index 024e3fffd4bb..a83192f80eba 100644
--- a/drivers/mtd/nand/fsl_upm.c
+++ b/drivers/mtd/nand/fsl_upm.c
@@ -163,9 +163,11 @@ static int __devinit fun_chip_init(struct fsl_upm_nand *fun,
        ret = parse_mtd_partitions(&fun->mtd, part_types, &fun->parts, 0);
 #ifdef CONFIG_MTD_OF_PARTS
-        if (ret == 0)
+        if (ret == 0) {
-                ret = of_mtd_parse_partitions(fun->dev, &fun->mtd,
+                ret = of_mtd_parse_partitions(fun->dev, flash_np, &fun->parts);
-                                              flash_np, &fun->parts);
+                if (ret < 0)
+                        goto err;
+        }
 #endif
        if (ret > 0)
                ret = add_mtd_partitions(&fun->mtd, fun->parts, ret);
diff --git a/drivers/mtd/nand/pasemi_nand.c b/drivers/mtd/nand/pasemi_nand.c
index 75c899039023..9bd6c9ac8443 100644
--- a/drivers/mtd/nand/pasemi_nand.c
+++ b/drivers/mtd/nand/pasemi_nand.c
@@ -141,6 +141,7 @@ static int __devinit pasemi_nand_probe(struct of_device *ofdev,
        }
        lpcctl = pci_resource_start(pdev, 0);
+        pci_dev_put(pdev);
        if (!request_region(lpcctl, 4, driver_name)) {
                err = -EBUSY;
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index c0fa9c9edf08..15f0a26730ae 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -269,6 +269,7 @@ static struct pxa3xx_nand_timing stm2GbX16_timing = {
 static struct pxa3xx_nand_flash stm2GbX16 = {
        .timing = &stm2GbX16_timing,
+        .cmdset = &largepage_cmdset,
        .page_per_block = 64,
        .page_size = 2048,
        .flash_width = 16,
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
index e39b21d3e168..a7e4d985f5ef 100644
--- a/drivers/mtd/onenand/omap2.c
+++ b/drivers/mtd/onenand/omap2.c
@@ -32,19 +32,18 @@
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/io.h>
-#include <asm/io.h>
 #include <asm/mach/flash.h>
-#include <asm/arch/gpmc.h>
+#include <mach/gpmc.h>
-#include <asm/arch/onenand.h>
+#include <mach/onenand.h>
-#include <asm/arch/gpio.h>
+#include <mach/gpio.h>
-#include <asm/arch/pm.h>
+#include <mach/pm.h>
-#include <linux/dma-mapping.h>
+#include <mach/dma.h>
-#include <asm/dma-mapping.h>
-#include <asm/arch/dma.h>
-#include <asm/arch/board.h>
+#include <mach/board.h>
 #define DRIVER_NAME "omap2-onenand"
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d07e3f148951..a1a3d0e5d2b4 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -3144,6 +3144,28 @@ bnx2_has_work(struct bnx2_napi *bnapi)
        return 0;
 }
+static void
+bnx2_chk_missed_msi(struct bnx2 *bp)
+{
+        struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
+        u32 msi_ctrl;
+        if (bnx2_has_work(bnapi)) {
+                msi_ctrl = REG_RD(bp, BNX2_PCICFG_MSI_CONTROL);
+                if (!(msi_ctrl & BNX2_PCICFG_MSI_CONTROL_ENABLE))
+                        return;
+                if (bnapi->last_status_idx == bp->idle_chk_status_idx) {
+                        REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl &
+                               ~BNX2_PCICFG_MSI_CONTROL_ENABLE);
+                        REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl);
+                        bnx2_msi(bp->irq_tbl[0].vector, bnapi);
+                }
+        }
+        bp->idle_chk_status_idx = bnapi->last_status_idx;
+}
 static void bnx2_poll_link(struct bnx2 *bp, struct bnx2_napi *bnapi)
 {
        struct status_block *sblk = bnapi->status_blk.msi;
@@ -3218,14 +3240,15 @@ static int bnx2_poll(struct napi_struct *napi, int budget)
                work_done = bnx2_poll_work(bp, bnapi, work_done, budget);
-                if (unlikely(work_done >= budget))
-                        break;
                /* bnapi->last_status_idx is used below to tell the hw how
                 * much work has been processed, so we must read it before
                 * checking for more work.
                 */
                bnapi->last_status_idx = sblk->status_idx;
+                if (unlikely(work_done >= budget))
+                        break;
                rmb();
                if (likely(!bnx2_has_work(bnapi))) {
                        netif_rx_complete(bp->dev, napi);
@@ -4570,6 +4593,8 @@ bnx2_init_chip(struct bnx2 *bp)
        for (i = 0; i < BNX2_MAX_MSIX_VEC; i++)
                bp->bnx2_napi[i].last_status_idx = 0;
+        bp->idle_chk_status_idx = 0xffff;
        bp->rx_mode = BNX2_EMAC_RX_MODE_SORT_MODE;
        /* Set up how to generate a link change interrupt. */
@@ -5718,6 +5743,10 @@ bnx2_timer(unsigned long data)
        if (atomic_read(&bp->intr_sem) != 0)
                goto bnx2_restart_timer;
+        if ((bp->flags & (BNX2_FLAG_USING_MSI | BNX2_FLAG_ONE_SHOT_MSI)) ==
+             BNX2_FLAG_USING_MSI)
+                bnx2_chk_missed_msi(bp);
        bnx2_send_heart_beat(bp);
        bp->stats_blk->stat_FwRxDrop =
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 617d95340160..0b032c3c7b61 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -378,6 +378,9 @@ struct l2_fhdr {
 *  pci_config_l definition
 *  offset: 0000
 */
+#define BNX2_PCICFG_MSI_CONTROL                         0x00000058
+#define BNX2_PCICFG_MSI_CONTROL_ENABLE                   (1L<<16)
 #define BNX2_PCICFG_MISC_CONFIG                         0x00000068
 #define BNX2_PCICFG_MISC_CONFIG_TARGET_BYTE_SWAP         (1L<<2)
 #define BNX2_PCICFG_MISC_CONFIG_TARGET_MB_WORD_SWAP      (1L<<3)
@@ -6863,6 +6866,9 @@ struct bnx2 {
        u8                      num_tx_rings;
        u8                      num_rx_rings;
+        u32                     idle_chk_status_idx;
 };
 #define REG_RD(bp, offset)                                      \
diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c
index e1b441effbbe..c414554ac321 100644
--- a/drivers/net/enc28j60.c
+++ b/drivers/net/enc28j60.c
@@ -568,6 +568,17 @@ static u16 erxrdpt_workaround(u16 next_packet_ptr, u16 start, u16 end)
        return erxrdpt;
 }
+/*
+ * Calculate wrap around when reading beyond the end of the RX buffer
+ */
+static u16 rx_packet_start(u16 ptr)
+{
+        if (ptr + RSV_SIZE > RXEND_INIT)
+                return (ptr + RSV_SIZE) - (RXEND_INIT - RXSTART_INIT + 1);
+        else
+                return ptr + RSV_SIZE;
+}
 static void nolock_rxfifo_init(struct enc28j60_net *priv, u16 start, u16 end)
 {
        u16 erxrdpt;
@@ -938,8 +949,9 @@ static void enc28j60_hw_rx(struct net_device *ndev)
                        skb->dev = ndev;
                        skb_reserve(skb, NET_IP_ALIGN);
                        /* copy the packet from the receive buffer */
-                        enc28j60_mem_read(priv, priv->next_pk_ptr + sizeof(rsv),
+                        enc28j60_mem_read(priv,
-                                        len, skb_put(skb, len));
+                                rx_packet_start(priv->next_pk_ptr),
+                                len, skb_put(skb, len));
                        if (netif_msg_pktdata(priv))
                                dump_packet(__func__, skb->len, skb->data);
                        skb->protocol = eth_type_trans(skb, ndev);
diff --git a/drivers/net/netx-eth.c b/drivers/net/netx-eth.c
index b9bed82e1d21..b289a0a2b945 100644
--- a/drivers/net/netx-eth.c
+++ b/drivers/net/netx-eth.c
@@ -401,6 +401,8 @@ static int netx_eth_drv_probe(struct platform_device *pdev)
        priv->xmac_base = priv->xc->xmac_base;
        priv->sram_base = priv->xc->sram_base;
+        spin_lock_init(&priv->lock);
        ret = pfifo_request(PFIFO_MASK(priv->id));
        if (ret) {
                printk("unable to request PFIFO\n");
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index dcce3542d5a7..7a9f901d4ff6 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -3897,6 +3897,7 @@ static int ipw_disassociate(void *data)
        if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
                return 0;
        ipw_send_disassociate(data, 0);
+        netif_carrier_off(priv->net_dev);
        return 1;
 }
@@ -10190,6 +10191,9 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
        u16 remaining_bytes;
        int fc;
+        if (!(priv->status & STATUS_ASSOCIATED))
+                goto drop;
        hdr_len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
        switch (priv->ieee->iw_mode) {
        case IW_MODE_ADHOC:
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 4c312c55f90c..01a845851338 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -290,6 +290,9 @@ void iwl_clear_stations_table(struct iwl_priv *priv)
        priv->num_stations = 0;
        memset(priv->stations, 0, sizeof(priv->stations));
+        /* clean ucode key table bit map */
+        priv->ucode_key_table = 0;
        spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 EXPORT_SYMBOL(iwl_clear_stations_table);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 61797f3f8d5c..26f7084d3011 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -475,7 +475,7 @@ static int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
                if (!test_and_set_bit(i, &priv->ucode_key_table))
                        return i;
-        return -1;
+        return WEP_INVALID_OFFSET;
 }
 int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
@@ -620,6 +620,9 @@ static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
        /* else, we are overriding an existing key => no need to allocated room
         * in uCode. */
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
        priv->stations[sta_id].sta.key.key_flags = key_flags;
        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
@@ -637,6 +640,7 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
 {
        unsigned long flags;
        __le16 key_flags = 0;
+        int ret;
        key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
@@ -664,14 +668,18 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
        /* else, we are overriding an existing key => no need to allocated room
         * in uCode. */
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
        priv->stations[sta_id].sta.key.key_flags = key_flags;
        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        ret = iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
        spin_unlock_irqrestore(&priv->sta_lock, flags);
-        IWL_DEBUG_INFO("hwcrypto: modify ucode station key info\n");
+        return ret;
-        return iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 }
 static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
@@ -696,6 +704,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
        /* else, we are overriding an existing key => no need to allocated room
         * in uCode. */
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
        /* This copy is acutally not needed: we get the key with each TX */
        memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
@@ -734,6 +745,13 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                return 0;
        }
+        if (priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+                IWL_WARNING("Removing wrong key %d 0x%x\n",
+                            keyconf->keyidx, key_flags);
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
        if (!test_and_clear_bit(priv->stations[sta_id].sta.key.key_offset,
                &priv->ucode_key_table))
                IWL_ERROR("index %d not used in uCode key table.\n",
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index fe1867b25ff7..cac732f4047f 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -615,7 +615,7 @@ static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr,
                struct ieee80211_hdr *tx_hdr;
                tx_hdr = (struct ieee80211_hdr *)skb->data;
-                if (likely(!compare_ether_addr(tx_hdr->addr2, rx_hdr->addr1)))
+                if (likely(!memcmp(tx_hdr->addr2, rx_hdr->addr1, ETH_ALEN)))
                {
                        __skb_unlink(skb, q);
                        tx_status(hw, skb, IEEE80211_TX_STAT_ACK, stats->signal, 1);
diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
index 341d7a5b45a2..4e91419e8911 100644
--- a/drivers/rtc/rtc-ds1672.c
+++ b/drivers/rtc/rtc-ds1672.c
@@ -209,12 +209,18 @@ static int ds1672_probe(struct i2c_client *client,
        return err;
 }
+static struct i2c_device_id ds1672_id[] = {
+        { "ds1672", 0 },
+        { }
+};
 static struct i2c_driver ds1672_driver = {
        .driver = {
                   .name = "rtc-ds1672",
                   },
        .probe = &ds1672_probe,
        .remove = &ds1672_remove,
+        .id_table = ds1672_id,
 };
 static int __init ds1672_init(void)
diff --git a/drivers/rtc/rtc-max6900.c b/drivers/rtc/rtc-max6900.c
index 80782798763f..a4f6665ab3c5 100644
--- a/drivers/rtc/rtc-max6900.c
+++ b/drivers/rtc/rtc-max6900.c
@@ -247,12 +247,18 @@ max6900_probe(struct i2c_client *client, const struct i2c_device_id *id)
        return 0;
 }
+static struct i2c_device_id max6900_id[] = {
+        { "max6900", 0 },
+        { }
+};
 static struct i2c_driver max6900_driver = {
        .driver = {
                   .name = "rtc-max6900",
                   },
        .probe = max6900_probe,
        .remove = max6900_remove,
+        .id_table = max6900_id,
 };
 static int __init max6900_init(void)
diff --git a/drivers/rtc/rtc-twl4030.c b/drivers/rtc/rtc-twl4030.c
index abe87a4d2665..01d8da9afdc8 100644
--- a/drivers/rtc/rtc-twl4030.c
+++ b/drivers/rtc/rtc-twl4030.c
@@ -337,7 +337,7 @@ static int twl4030_rtc_ioctl(struct device *dev, unsigned int cmd,
 }
 #else
-#define omap_rtc_ioctl  NULL
+#define twl4030_rtc_ioctl       NULL
 #endif
 static irqreturn_t twl4030_rtc_interrupt(int irq, void *rtc)
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 6117d3db0b66..28c00c3d58f5 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -591,8 +591,8 @@ mpc52xx_uart_set_termios(struct uart_port *port, struct ktermios *new,
        /* Update the per-port timeout */
        uart_update_timeout(port, new->c_cflag, baud);
-        /* Do our best to flush TX & RX, so we don't loose anything */
+        /* Do our best to flush TX & RX, so we don't lose anything */
-        /* But we don't wait indefinitly ! */
+        /* But we don't wait indefinitely ! */
        j = 5000000;    /* Maximum wait */
        /* FIXME Can't receive chars since set_termios might be called at early
         * boot for the console, all stuff is not yet ready to receive at that
diff --git a/drivers/serial/s3c2440.c b/drivers/serial/s3c2440.c
index 317d239ab740..29cbb0afef8e 100644
--- a/drivers/serial/s3c2440.c
+++ b/drivers/serial/s3c2440.c
@@ -177,5 +177,5 @@ module_exit(s3c2440_serial_exit);
 MODULE_DESCRIPTION("Samsung S3C2440,S3C2442 SoC Serial port driver");
 MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
-MODULE_LICENSE("GPLi v2");
+MODULE_LICENSE("GPL v2");
 MODULE_ALIAS("platform:s3c2440-uart");
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 51d7bdea2869..aad1359a3eb1 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1498,7 +1498,7 @@ static int ftdi_open(struct tty_struct *tty,
                        priv->interface, buf, 0, WDR_TIMEOUT);
        /* Termios defaults are set by usb_serial_init. We don't change
-           port->tty->termios - this would loose speed settings, etc.
+           port->tty->termios - this would lose speed settings, etc.
           This is same behaviour as serial.c/rs_open() - Kuba */
        /* ftdi_set_termios  will send usb control messages */
diff --git a/drivers/video/aty/radeon_accel.c b/drivers/video/aty/radeon_accel.c
index a547e5d4c8bf..8da5e5ab8547 100644
--- a/drivers/video/aty/radeon_accel.c
+++ b/drivers/video/aty/radeon_accel.c
@@ -256,7 +256,8 @@ void radeonfb_imageblit(struct fb_info *info, const struct fb_image *image)
                return;
        /* We only do 1 bpp color expansion for now */
-        if (info->flags & FBINFO_HWACCEL_DISABLED || image->depth != 1)
+        if (!accel_cexp ||
+            (info->flags & FBINFO_HWACCEL_DISABLED) || image->depth != 1)
                goto fallback;
        /* Fallback if running out of the screen. We may do clipping
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index b3ffe8205d2b..d5b27f9d374d 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -282,6 +282,8 @@ static int backlight = 1;
 static int backlight = 0;
 #endif
+int accel_cexp = 0;
 /*
 * prototypes
 */
@@ -2520,6 +2522,8 @@ static int __init radeonfb_setup (char *options)
                } else if (!strncmp(this_opt, "ignore_devlist", 14)) {
                        ignore_devlist = 1;
 #endif
+                } else if (!strncmp(this_opt, "accel_cexp", 12)) {
+                        accel_cexp = 1;
                } else
                        mode_option = this_opt;
        }
@@ -2567,6 +2571,8 @@ module_param(monitor_layout, charp, 0);
 MODULE_PARM_DESC(monitor_layout, "Specify monitor mapping (like XFree86)");
 module_param(force_measure_pll, bool, 0);
 MODULE_PARM_DESC(force_measure_pll, "Force measurement of PLL (debug)");
+module_param(accel_cexp, bool, 0);
+MODULE_PARM_DESC(accel_cexp, "Use acceleration engine for color expansion");
 #ifdef CONFIG_MTRR
 module_param(nomtrr, bool, 0);
 MODULE_PARM_DESC(nomtrr, "bool: disable use of MTRR registers");
diff --git a/drivers/video/aty/radeonfb.h b/drivers/video/aty/radeonfb.h
index ea0b5b47acaf..974ca6d86540 100644
--- a/drivers/video/aty/radeonfb.h
+++ b/drivers/video/aty/radeonfb.h
@@ -638,4 +638,6 @@ static inline void radeonfb_bl_init(struct radeonfb_info *rinfo) {}
 static inline void radeonfb_bl_exit(struct radeonfb_info *rinfo) {}
 #endif
+extern int accel_cexp;
 #endif /* __RADEONFB_H__ */
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 67ff370d80af..0b2adefe9e3d 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -3531,12 +3531,18 @@ static void fbcon_exit(void)
        softback_buf = 0UL;
        for (i = 0; i < FB_MAX; i++) {
+                int pending;
                mapped = 0;
                info = registered_fb[i];
                if (info == NULL)
                        continue;
+                pending = cancel_work_sync(&info->queue);
+                DPRINTK("fbcon: %s pending work\n", (pending ? "canceled" :
+                        "no"));
                for (j = first_fb_vc; j <= last_fb_vc; j++) {
                        if (con2fb_map[j] == i)
                                mapped = 1;
diff --git a/drivers/video/mb862xx/mb862xxfb.c b/drivers/video/mb862xx/mb862xxfb.c
index 38718d95fbb9..fb64234a3825 100644
--- a/drivers/video/mb862xx/mb862xxfb.c
+++ b/drivers/video/mb862xx/mb862xxfb.c
@@ -927,9 +927,9 @@ static int __devinit mb862xx_pci_probe(struct pci_dev *pdev,
        }
        dev_dbg(dev, "fb phys 0x%llx 0x%lx\n",
-                (u64)par->fb_base_phys, (ulong)par->mapped_vram);
+                (unsigned long long)par->fb_base_phys, (ulong)par->mapped_vram);
        dev_dbg(dev, "mmio phys 0x%llx 0x%lx\n",
-                (u64)par->mmio_base_phys, (ulong)par->mmio_len);
+                (unsigned long long)par->mmio_base_phys, (ulong)par->mmio_len);
        if (mb862xx_pci_gdc_init(par))
                goto io_unmap;
diff --git a/drivers/video/omap/omapfb_main.c b/drivers/video/omap/omapfb_main.c
index 5a5e407dc45f..1a49519dafa4 100644
--- a/drivers/video/omap/omapfb_main.c
+++ b/drivers/video/omap/omapfb_main.c
@@ -392,7 +392,7 @@ static void set_fb_fix(struct fb_info *fbi)
        int bpp;
        rg = &plane->fbdev->mem_desc.region[plane->idx];
-        fbi->screen_base        = (char __iomem *)rg->vaddr;
+        fbi->screen_base        = rg->vaddr;
        fix->smem_start         = rg->paddr;
        fix->smem_len           = rg->size;
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 80246bad1b7f..890e01828817 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -367,6 +367,8 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid,
         * Try to get any dentry for the given file handle from the filesystem.
         */
        result = nop->fh_to_dentry(mnt->mnt_sb, fid, fh_len, fileid_type);
+        if (!result)
+                result = ERR_PTR(-ESTALE);
        if (IS_ERR(result))
                return result;
@@ -420,6 +422,8 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid,
                target_dir = nop->fh_to_parent(mnt->mnt_sb, fid,
                                fh_len, fileid_type);
+                if (!target_dir)
+                        goto err_result;
                err = PTR_ERR(target_dir);
                if (IS_ERR(target_dir))
                        goto err_result;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index d2003cdc36aa..db35cfdb3c8b 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -609,8 +609,8 @@ int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks)
        if (free_blocks - (nblocks + root_blocks + dirty_blocks) <
                                                EXT4_FREEBLOCKS_WATERMARK) {
-                free_blocks  = percpu_counter_sum(fbc);
+                free_blocks  = percpu_counter_sum_positive(fbc);
-                dirty_blocks = percpu_counter_sum(dbc);
+                dirty_blocks = percpu_counter_sum_positive(dbc);
                if (dirty_blocks < 0) {
                        printk(KERN_CRIT "Dirty block accounting "
                                        "went wrong %lld\n",
diff --git a/fs/fcntl.c b/fs/fcntl.c
index ac4f7db9f134..549daf8005fb 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -19,6 +19,7 @@
 #include <linux/signal.h>
 #include <linux/rcupdate.h>
 #include <linux/pid_namespace.h>
+#include <linux/smp_lock.h>
 #include <asm/poll.h>
 #include <asm/siginfo.h>
@@ -175,6 +176,11 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
        if (error)
                return error;
+        /*
+         * We still need a lock here for now to keep multiple FASYNC calls
+         * from racing with each other.
+         */
+        lock_kernel();
        if ((arg ^ filp->f_flags) & FASYNC) {
                if (filp->f_op && filp->f_op->fasync) {
                        error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
@@ -185,6 +191,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
        filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
 out:
+        unlock_kernel();
        return error;
 }
diff --git a/fs/inotify.c b/fs/inotify.c
index 7bbed1b89825..dae3f28f30d4 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -428,11 +428,13 @@ void inotify_unmount_inodes(struct list_head *list)
                watches = &inode->inotify_watches;
                list_for_each_entry_safe(watch, next_w, watches, i_list) {
                        struct inotify_handle *ih= watch->ih;
+                        get_inotify_watch(watch);
                        mutex_lock(&ih->mutex);
                        ih->in_ops->handle_event(watch, watch->wd, IN_UNMOUNT, 0,
                                                 NULL, NULL);
                        inotify_remove_watch_locked(ih, watch);
                        mutex_unlock(&ih->mutex);
+                        put_inotify_watch(watch);
                }
                mutex_unlock(&inode->inotify_mutex);
                iput(inode);            
diff --git a/fs/ioctl.c b/fs/ioctl.c
index d152856c371b..43e8b2c0664b 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -400,11 +400,9 @@ static int ioctl_fioasync(unsigned int fd, struct file *filp,
        /* Did FASYNC state change ? */
        if ((flag ^ filp->f_flags) & FASYNC) {
-                if (filp->f_op && filp->f_op->fasync) {
+                if (filp->f_op && filp->f_op->fasync)
-                        lock_kernel();
                        error = filp->f_op->fasync(fd, filp, on);
-                        unlock_kernel();
+                else
-                } else
                        error = -ENOTTY;
        }
        if (error)
@@ -440,11 +438,17 @@ int do_vfs_ioctl(struct file *filp, unsigned int fd, unsigned int cmd,
                break;
        case FIONBIO:
+                /* BKL needed to avoid races tweaking f_flags */
+                lock_kernel();
                error = ioctl_fionbio(filp, argp);
+                unlock_kernel();
                break;
        case FIOASYNC:
+                /* BKL needed to avoid races tweaking f_flags */
+                lock_kernel();
                error = ioctl_fioasync(fd, filp, argp);
+                unlock_kernel();
                break;
        case FIOQSIZE:
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 486cf3fe7139..d4677603c889 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -371,7 +371,7 @@ static int lstats_show_proc(struct seq_file *m, void *v)
                                task->latency_record[i].time,
                                task->latency_record[i].max);
                        for (q = 0; q < LT_BACKTRACEDEPTH; q++) {
-                                char sym[KSYM_NAME_LEN];
+                                char sym[KSYM_SYMBOL_LEN];
                                char *c;
                                if (!task->latency_record[i].backtrace[q])
                                        break;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index b770c095e45c..3a8bdd7f5756 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -557,9 +557,9 @@ static u64 swap_pte_to_pagemap_entry(pte_t pte)
        return swp_type(e) | (swp_offset(e) << MAX_SWAPFILES_SHIFT);
 }
-static unsigned long pte_to_pagemap_entry(pte_t pte)
+static u64 pte_to_pagemap_entry(pte_t pte)
 {
-        unsigned long pme = 0;
+        u64 pme = 0;
        if (is_swap_pte(pte))
                pme = PM_PFRAME(swap_pte_to_pagemap_entry(pte))
                        | PM_PSHIFT(PAGE_SHIFT) | PM_SWAP;
diff --git a/include/asm-generic/atomic.h b/include/asm-generic/atomic.h
index 4ec0a296bdec..7abdaa91ccd3 100644
--- a/include/asm-generic/atomic.h
+++ b/include/asm-generic/atomic.h
@@ -251,7 +251,7 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
 #define atomic_long_cmpxchg(l, old, new) \
        (atomic_cmpxchg((atomic_t *)(l), (old), (new)))
 #define atomic_long_xchg(v, new) \
-        (atomic_xchg((atomic_t *)(l), (new)))
+        (atomic_xchg((atomic_t *)(v), (new)))
 #endif  /*  BITS_PER_LONG == 64  */
diff --git a/include/asm-generic/audit_write.h b/include/asm-generic/audit_write.h
index f10d367fb2a5..c5f1c2c920e2 100644
--- a/include/asm-generic/audit_write.h
+++ b/include/asm-generic/audit_write.h
@@ -1,6 +1,8 @@
 #include <asm-generic/audit_dir_write.h>
 __NR_acct,
+#ifdef __NR_swapon
 __NR_swapon,
+#endif
 __NR_quotactl,
 __NR_truncate,
 #ifdef __NR_truncate64
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 6272a395d43c..8f0672d13eb1 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -391,6 +391,7 @@ extern int audit_classify_arch(int arch);
 #ifdef CONFIG_AUDITSYSCALL
 /* These are defined in auditsc.c */
                                /* Public API */
+extern void audit_finish_fork(struct task_struct *child);
 extern int  audit_alloc(struct task_struct *task);
 extern void audit_free(struct task_struct *task);
 extern void audit_syscall_entry(int arch,
@@ -434,7 +435,7 @@ static inline void audit_ptrace(struct task_struct *t)
                                /* Private API (for audit.c only) */
 extern unsigned int audit_serial(void);
-extern void auditsc_get_stamp(struct audit_context *ctx,
+extern int auditsc_get_stamp(struct audit_context *ctx,
                              struct timespec *t, unsigned int *serial);
 extern int  audit_set_loginuid(struct task_struct *task, uid_t loginuid);
 #define audit_get_loginuid(t) ((t)->loginuid)
@@ -504,6 +505,7 @@ static inline int audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
 extern int audit_n_rules;
 extern int audit_signals;
 #else
+#define audit_finish_fork(t)
 #define audit_alloc(t) ({ 0; })
 #define audit_free(t) do { ; } while (0)
 #define audit_syscall_entry(ta,a,b,c,d,e) do { ; } while (0)
@@ -516,7 +518,7 @@ extern int audit_signals;
 #define audit_inode(n,d) do { ; } while (0)
 #define audit_inode_child(d,i,p) do { ; } while (0)
 #define audit_core_dumps(i) do { ; } while (0)
-#define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
+#define auditsc_get_stamp(c,t,s) (0)
 #define audit_get_loginuid(t) (-1)
 #define audit_get_sessionid(t) (-1)
 #define audit_log_task_context(b) do { ; } while (0)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 6dcd30d806cd..031a315c0509 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -662,6 +662,7 @@ extern unsigned long blk_max_low_pfn, blk_max_pfn;
 * default timeout for SG_IO if none specified
 */
 #define BLK_DEFAULT_SG_TIMEOUT  (60 * HZ)
+#define BLK_MIN_SG_TIMEOUT      (7 * HZ)
 #ifdef CONFIG_BOUNCE
 extern int init_emergency_isa_pool(void);
diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index e9ca210ffa5b..f50785ad4781 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -19,7 +19,7 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
-#define CAN_VERSION "20071116"
+#define CAN_VERSION "20081130"
 /* increment this number each time you change some user-space interface */
 #define CAN_ABI_VERSION "8"
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 703eb53cfa2b..9c5bc6be2b09 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -6,6 +6,7 @@
 #include <linux/ktime.h>
 #include <linux/init.h>
 #include <linux/types.h>
+#include <linux/module.h>
 #include <linux/kallsyms.h>
 #ifdef CONFIG_FUNCTION_TRACER
@@ -231,7 +232,7 @@ ftrace_init_module(unsigned long *start, unsigned long *end) { }
 struct boot_trace {
        pid_t                   caller;
-        char                    func[KSYM_NAME_LEN];
+        char                    func[KSYM_SYMBOL_LEN];
        int                     result;
        unsigned long long      duration;               /* usecs */
        ktime_t                 calltime;
diff --git a/kernel/audit.c b/kernel/audit.c
index 4414e93d8750..ce6d8ea3131e 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -61,8 +61,11 @@
 #include "audit.h"
-/* No auditing will take place until audit_initialized != 0.
+/* No auditing will take place until audit_initialized == AUDIT_INITIALIZED.
 * (Initialization happens after skb_init is called.) */
+#define AUDIT_DISABLED          -1
+#define AUDIT_UNINITIALIZED     0
+#define AUDIT_INITIALIZED       1
 static int      audit_initialized;
 #define AUDIT_OFF       0
@@ -965,6 +968,9 @@ static int __init audit_init(void)
 {
        int i;
+        if (audit_initialized == AUDIT_DISABLED)
+                return 0;
        printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
               audit_default ? "enabled" : "disabled");
        audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0,
@@ -976,7 +982,7 @@ static int __init audit_init(void)
        skb_queue_head_init(&audit_skb_queue);
        skb_queue_head_init(&audit_skb_hold_queue);
-        audit_initialized = 1;
+        audit_initialized = AUDIT_INITIALIZED;
        audit_enabled = audit_default;
        audit_ever_enabled |= !!audit_default;
@@ -999,13 +1005,21 @@ __initcall(audit_init);
 static int __init audit_enable(char *str)
 {
        audit_default = !!simple_strtol(str, NULL, 0);
-        printk(KERN_INFO "audit: %s%s\n",
+        if (!audit_default)
-               audit_default ? "enabled" : "disabled",
+                audit_initialized = AUDIT_DISABLED;
-               audit_initialized ? "" : " (after initialization)");
-        if (audit_initialized) {
+        printk(KERN_INFO "audit: %s", audit_default ? "enabled" : "disabled");
+        if (audit_initialized == AUDIT_INITIALIZED) {
                audit_enabled = audit_default;
                audit_ever_enabled |= !!audit_default;
+        } else if (audit_initialized == AUDIT_UNINITIALIZED) {
+                printk(" (after initialization)");
+        } else {
+                printk(" (until reboot)");
        }
+        printk("\n");
        return 1;
 }
@@ -1107,9 +1121,7 @@ unsigned int audit_serial(void)
 static inline void audit_get_stamp(struct audit_context *ctx,
                                   struct timespec *t, unsigned int *serial)
 {
-        if (ctx)
+        if (!ctx || !auditsc_get_stamp(ctx, t, serial)) {
-                auditsc_get_stamp(ctx, t, serial);
-        else {
                *t = CURRENT_TIME;
                *serial = audit_serial();
        }
@@ -1146,7 +1158,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
        int reserve;
        unsigned long timeout_start = jiffies;
-        if (!audit_initialized)
+        if (audit_initialized != AUDIT_INITIALIZED)
                return NULL;
        if (unlikely(audit_filter_type(type)))
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index cf5bc2f5f9c3..2a3f0afc4d2a 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1459,7 +1459,6 @@ void audit_free(struct task_struct *tsk)
 /**
 * audit_syscall_entry - fill in an audit record at syscall entry
- * @tsk: task being audited
 * @arch: architecture type
 * @major: major syscall type (function)
 * @a1: additional syscall register 1
@@ -1548,9 +1547,25 @@ void audit_syscall_entry(int arch, int major,
        context->ppid       = 0;
 }
+void audit_finish_fork(struct task_struct *child)
+{
+        struct audit_context *ctx = current->audit_context;
+        struct audit_context *p = child->audit_context;
+        if (!p || !ctx || !ctx->auditable)
+                return;
+        p->arch = ctx->arch;
+        p->major = ctx->major;
+        memcpy(p->argv, ctx->argv, sizeof(ctx->argv));
+        p->ctime = ctx->ctime;
+        p->dummy = ctx->dummy;
+        p->auditable = ctx->auditable;
+        p->in_syscall = ctx->in_syscall;
+        p->filterkey = kstrdup(ctx->filterkey, GFP_KERNEL);
+        p->ppid = current->pid;
+}
 /**
 * audit_syscall_exit - deallocate audit context after a system call
- * @tsk: task being audited
 * @valid: success/failure flag
 * @return_code: syscall return value
 *
@@ -1942,15 +1957,18 @@ EXPORT_SYMBOL_GPL(__audit_inode_child);
 *
 * Also sets the context as auditable.
 */
-void auditsc_get_stamp(struct audit_context *ctx,
+int auditsc_get_stamp(struct audit_context *ctx,
                       struct timespec *t, unsigned int *serial)
 {
+        if (!ctx->in_syscall)
+                return 0;
        if (!ctx->serial)
                ctx->serial = audit_serial();
        t->tv_sec  = ctx->ctime.tv_sec;
        t->tv_nsec = ctx->ctime.tv_nsec;
        *serial    = ctx->serial;
        ctx->auditable = 1;
+        return 1;
 }
 /* global counter which is incremented every time something logs in */
diff --git a/kernel/fork.c b/kernel/fork.c
index 2a372a0e206f..8d6a7dd9282b 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1398,6 +1398,7 @@ long do_fork(unsigned long clone_flags,
                        init_completion(&vfork);
                }
+                audit_finish_fork(p);
                tracehook_report_clone(trace, regs, clone_flags, nr, p);
                /*
diff --git a/kernel/latencytop.c b/kernel/latencytop.c
index 5e7b45c56923..449db466bdbc 100644
--- a/kernel/latencytop.c
+++ b/kernel/latencytop.c
@@ -191,7 +191,7 @@ static int lstats_show(struct seq_file *m, void *v)
                                latency_record[i].time,
                                latency_record[i].max);
                        for (q = 0; q < LT_BACKTRACEDEPTH; q++) {
-                                char sym[KSYM_NAME_LEN];
+                                char sym[KSYM_SYMBOL_LEN];
                                char *c;
                                if (!latency_record[i].backtrace[q])
                                        break;
diff --git a/kernel/relay.c b/kernel/relay.c
index 32b0befdcb6a..09ac2008f77b 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1317,12 +1317,9 @@ static ssize_t relay_file_splice_read(struct file *in,
                if (ret < 0)
                        break;
                else if (!ret) {
-                        if (spliced)
+                        if (flags & SPLICE_F_NONBLOCK)
-                                break;
-                        if (flags & SPLICE_F_NONBLOCK) {
                                ret = -EAGAIN;
-                                break;
+                        break;
-                        }
                }
                *ppos += ret;
diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c
index a8663890a88c..b255b939bc1b 100644
--- a/lib/percpu_counter.c
+++ b/lib/percpu_counter.c
@@ -62,10 +62,7 @@ s64 __percpu_counter_sum(struct percpu_counter *fbc)
        for_each_online_cpu(cpu) {
                s32 *pcount = per_cpu_ptr(fbc->counters, cpu);
                ret += *pcount;
-                *pcount = 0;
        }
-        fbc->count = ret;
        spin_unlock(&fbc->lock);
        return ret;
 }
@@ -104,13 +101,13 @@ void percpu_counter_destroy(struct percpu_counter *fbc)
        if (!fbc->counters)
                return;
-        free_percpu(fbc->counters);
-        fbc->counters = NULL;
 #ifdef CONFIG_HOTPLUG_CPU
        mutex_lock(&percpu_counters_lock);
        list_del(&fbc->list);
        mutex_unlock(&percpu_counters_lock);
 #endif
+        free_percpu(fbc->counters);
+        fbc->counters = NULL;
 }
 EXPORT_SYMBOL(percpu_counter_destroy);
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 2a56124dbc28..801c08b046e6 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -176,7 +176,7 @@ int bdi_register(struct backing_dev_info *bdi, struct device *parent,
        int ret = 0;
        struct device *dev;
-        if (WARN_ON(bdi->dev))
+        if (bdi->dev)   /* The driver needs to use separate queues per device */
                goto exit;
        va_start(args, fmt);
diff --git a/mm/migrate.c b/mm/migrate.c
index 1e0d6b237f44..d8f07667fc80 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -987,25 +987,18 @@ out:
 /*
 * Determine the nodes of an array of pages and store it in an array of status.
 */
-static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
+static void do_pages_stat_array(struct mm_struct *mm, unsigned long nr_pages,
-                         const void __user * __user *pages,
+                                const void __user **pages, int *status)
-                         int __user *status)
 {
        unsigned long i;
-        int err;
        down_read(&mm->mmap_sem);
        for (i = 0; i < nr_pages; i++) {
-                const void __user *p;
+                unsigned long addr = (unsigned long)(*pages);
-                unsigned long addr;
                struct vm_area_struct *vma;
                struct page *page;
+                int err;
-                err = -EFAULT;
-                if (get_user(p, pages+i))
-                        goto out;
-                addr = (unsigned long) p;
                vma = find_vma(mm, addr);
                if (!vma)
@@ -1024,12 +1017,52 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
                err = page_to_nid(page);
 set_status:
-                put_user(err, status+i);
+                *status = err;
+                pages++;
+                status++;
+        }
+        up_read(&mm->mmap_sem);
+}
+/*
+ * Determine the nodes of a user array of pages and store it in
+ * a user array of status.
+ */
+static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
+                         const void __user * __user *pages,
+                         int __user *status)
+{
+#define DO_PAGES_STAT_CHUNK_NR 16
+        const void __user *chunk_pages[DO_PAGES_STAT_CHUNK_NR];
+        int chunk_status[DO_PAGES_STAT_CHUNK_NR];
+        unsigned long i, chunk_nr = DO_PAGES_STAT_CHUNK_NR;
+        int err;
+        for (i = 0; i < nr_pages; i += chunk_nr) {
+                if (chunk_nr + i > nr_pages)
+                        chunk_nr = nr_pages - i;
+                err = copy_from_user(chunk_pages, &pages[i],
+                                     chunk_nr * sizeof(*chunk_pages));
+                if (err) {
+                        err = -EFAULT;
+                        goto out;
+                }
+                do_pages_stat_array(mm, chunk_nr, chunk_pages, chunk_status);
+                err = copy_to_user(&status[i], chunk_status,
+                                   chunk_nr * sizeof(*chunk_status));
+                if (err) {
+                        err = -EFAULT;
+                        goto out;
+                }
        }
        err = 0;
 out:
-        up_read(&mm->mmap_sem);
        return err;
 }
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index 0b3cbf090a67..ab27ff750519 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -49,6 +49,9 @@ static int __init alloc_node_page_cgroup(int nid)
        start_pfn = NODE_DATA(nid)->node_start_pfn;
        nr_pages = NODE_DATA(nid)->node_spanned_pages;
+        if (!nr_pages)
+                return 0;
        table_size = sizeof(struct page_cgroup) * nr_pages;
        base = __alloc_bootmem_node_nopanic(NODE_DATA(nid),
diff --git a/mm/slub.c b/mm/slub.c
index 749588a50a5a..a2cd47d89e0a 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3597,7 +3597,7 @@ static int list_locations(struct kmem_cache *s, char *buf,
        for (i = 0; i < t.count; i++) {
                struct location *l = &t.loc[i];
-                if (len > PAGE_SIZE - 100)
+                if (len > PAGE_SIZE - KSYM_SYMBOL_LEN - 100)
                        break;
                len += sprintf(buf + len, "%7ld ", l->count);
diff --git a/mm/swap.c b/mm/swap.c
index 2881987603eb..b135ec90cdeb 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -299,7 +299,6 @@ void lru_add_drain(void)
        put_cpu();
 }
-#if defined(CONFIG_NUMA) || defined(CONFIG_UNEVICTABLE_LRU)
 static void lru_add_drain_per_cpu(struct work_struct *dummy)
 {
        lru_add_drain();
@@ -313,18 +312,6 @@ int lru_add_drain_all(void)
        return schedule_on_each_cpu(lru_add_drain_per_cpu);
 }
-#else
-/*
- * Returns 0 for success
- */
-int lru_add_drain_all(void)
-{
-        lru_add_drain();
-        return 0;
-}
-#endif
 /*
 * Batched page_cache_release().  Decrement the reference count on all the
 * passed pages.  If it fell to zero then remove the page from the LRU and
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index f3f6e0758562..1ddb77ba3995 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1717,7 +1717,7 @@ static int s_show(struct seq_file *m, void *p)
                v->addr, v->addr + v->size, v->size);
        if (v->caller) {
-                char buff[2 * KSYM_NAME_LEN];
+                char buff[KSYM_SYMBOL_LEN];
                seq_putc(m, ' ');
                sprint_symbol(buff, (unsigned long)v->caller);
diff --git a/net/atm/svc.c b/net/atm/svc.c
index de1e4f2f3a43..8fb54dc870b3 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -293,7 +293,10 @@ static int svc_listen(struct socket *sock,int backlog)
                error = -EINVAL;
                goto out;
        }
-        vcc_insert_socket(sk);
+        if (test_bit(ATM_VF_LISTEN, &vcc->flags)) {
+                error = -EADDRINUSE;
+                goto out;
+        }
        set_bit(ATM_VF_WAITING, &vcc->flags);
        prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
        sigd_enq(vcc,as_listen,NULL,NULL,&vcc->local);
@@ -307,6 +310,7 @@ static int svc_listen(struct socket *sock,int backlog)
                goto out;
        }
        set_bit(ATM_VF_LISTEN,&vcc->flags);
+        vcc_insert_socket(sk);
        sk->sk_max_ack_backlog = backlog > 0 ? backlog : ATM_BACKLOG_DEFAULT;
        error = -sk->sk_err;
 out:
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7d4d2b3c137e..3dadb338addd 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -319,23 +319,52 @@ static struct dev_rcv_lists *find_dev_rcv_lists(struct net_device *dev)
        return n ? d : NULL;
 }
+/**
+ * find_rcv_list - determine optimal filterlist inside device filter struct
+ * @can_id: pointer to CAN identifier of a given can_filter
+ * @mask: pointer to CAN mask of a given can_filter
+ * @d: pointer to the device filter struct
+ *
+ * Description:
+ *  Returns the optimal filterlist to reduce the filter handling in the
+ *  receive path. This function is called by service functions that need
+ *  to register or unregister a can_filter in the filter lists.
+ *
+ *  A filter matches in general, when
+ *
+ *          <received_can_id> & mask == can_id & mask
+ *
+ *  so every bit set in the mask (even CAN_EFF_FLAG, CAN_RTR_FLAG) describe
+ *  relevant bits for the filter.
+ *
+ *  The filter can be inverted (CAN_INV_FILTER bit set in can_id) or it can
+ *  filter for error frames (CAN_ERR_FLAG bit set in mask). For error frames
+ *  there is a special filterlist and a special rx path filter handling.
+ *
+ * Return:
+ *  Pointer to optimal filterlist for the given can_id/mask pair.
+ *  Constistency checked mask.
+ *  Reduced can_id to have a preprocessed filter compare value.
+ */
 static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
                                        struct dev_rcv_lists *d)
 {
        canid_t inv = *can_id & CAN_INV_FILTER; /* save flag before masking */
-        /* filter error frames */
+        /* filter for error frames in extra filterlist */
        if (*mask & CAN_ERR_FLAG) {
-                /* clear CAN_ERR_FLAG in list entry */
+                /* clear CAN_ERR_FLAG in filter entry */
                *mask &= CAN_ERR_MASK;
                return &d->rx[RX_ERR];
        }
-        /* ensure valid values in can_mask */
+        /* with cleared CAN_ERR_FLAG we have a simple mask/value filterpair */
-        if (*mask & CAN_EFF_FLAG)
-                *mask &= (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG);
+#define CAN_EFF_RTR_FLAGS (CAN_EFF_FLAG | CAN_RTR_FLAG)
-        else
-                *mask &= (CAN_SFF_MASK | CAN_RTR_FLAG);
+        /* ensure valid values in can_mask for 'SFF only' frame filtering */
+        if ((*mask & CAN_EFF_FLAG) && !(*can_id & CAN_EFF_FLAG))
+                *mask &= (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS);
        /* reduce condition testing at receive time */
        *can_id &= *mask;
@@ -348,15 +377,19 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
        if (!(*mask))
                return &d->rx[RX_ALL];
-        /* use extra filterset for the subscription of exactly *ONE* can_id */
+        /* extra filterlists for the subscription of a single non-RTR can_id */
-        if (*can_id & CAN_EFF_FLAG) {
+        if (((*mask & CAN_EFF_RTR_FLAGS) == CAN_EFF_RTR_FLAGS)
-                if (*mask == (CAN_EFF_MASK | CAN_EFF_FLAG)) {
+            && !(*can_id & CAN_RTR_FLAG)) {
-                        /* RFC: a use-case for hash-tables in the future? */
-                        return &d->rx[RX_EFF];
+                if (*can_id & CAN_EFF_FLAG) {
+                        if (*mask == (CAN_EFF_MASK | CAN_EFF_RTR_FLAGS)) {
+                                /* RFC: a future use-case for hash-tables? */
+                                return &d->rx[RX_EFF];
+                        }
+                } else {
+                        if (*mask == (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS))
+                                return &d->rx_sff[*can_id];
                }
-        } else {
-                if (*mask == CAN_SFF_MASK)
-                        return &d->rx_sff[*can_id];
        }
        /* default: filter via can_id/can_mask */
@@ -589,7 +622,10 @@ static int can_rcv_filter(struct dev_rcv_lists *d, struct sk_buff *skb)
                }
        }
-        /* check CAN_ID specific entries */
+        /* check filterlists for single non-RTR can_ids */
+        if (can_id & CAN_RTR_FLAG)
+                return matches;
        if (can_id & CAN_EFF_FLAG) {
                hlist_for_each_entry_rcu(r, n, &d->rx[RX_EFF], list) {
                        if (r->can_id == can_id) {
diff --git a/net/can/bcm.c b/net/can/bcm.c
index d0dd382001e2..da0d426c0ce4 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -64,10 +64,11 @@
 #define BCM_CAN_DLC_MASK 0x0F /* clean private flags in can_dlc by masking */
 /* get best masking value for can_rx_register() for a given single can_id */
-#define REGMASK(id) ((id & CAN_RTR_FLAG) | ((id & CAN_EFF_FLAG) ? \
+#define REGMASK(id) ((id & CAN_EFF_FLAG) ? \
-                        (CAN_EFF_MASK | CAN_EFF_FLAG) : CAN_SFF_MASK))
+                     (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \
+                     (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG))
-#define CAN_BCM_VERSION "20080415"
+#define CAN_BCM_VERSION CAN_VERSION
 static __initdata const char banner[] = KERN_INFO
        "can: broadcast manager protocol (rev " CAN_BCM_VERSION ")\n";
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 85b07eba1879..fe3b4bdfd251 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -722,8 +722,7 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
                                 unsigned int mss_now)
 {
-        if (skb->len <= mss_now || !sk_can_gso(sk) ||
+        if (skb->len <= mss_now || !sk_can_gso(sk)) {
-            tcp_urg_mode(tcp_sk(sk))) {
                /* Avoid the costly divide in the normal
                 * non-TSO case.
                 */
@@ -1029,10 +1028,6 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
 /* Compute the current effective MSS, taking SACKs and IP options,
 * and even PMTU discovery events into account.
- *
- * LARGESEND note: !tcp_urg_mode is overkill, only frames up to snd_up
- * cannot be large. However, taking into account rare use of URG, this
- * is not a big flaw.
 */
 unsigned int tcp_current_mss(struct sock *sk, int large_allowed)
 {
@@ -1047,7 +1042,7 @@ unsigned int tcp_current_mss(struct sock *sk, int large_allowed)
        mss_now = tp->mss_cache;
-        if (large_allowed && sk_can_gso(sk) && !tcp_urg_mode(tp))
+        if (large_allowed && sk_can_gso(sk))
                doing_tso = 1;
        if (dst) {
@@ -1164,9 +1159,7 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
 {
        int tso_segs = tcp_skb_pcount(skb);
-        if (!tso_segs ||
+        if (!tso_segs || (tso_segs > 1 && tcp_skb_mss(skb) != mss_now)) {
-            (tso_segs > 1 && (tcp_skb_mss(skb) != mss_now ||
-                              tcp_urg_mode(tcp_sk(sk))))) {
                tcp_set_skb_tso_segs(sk, skb, mss_now);
                tso_segs = tcp_skb_pcount(skb);
        }
@@ -1519,6 +1512,10 @@ static int tcp_mtu_probe(struct sock *sk)
 * send_head.  This happens as incoming acks open up the remote
 * window for us.
 *
+ * LARGESEND note: !tcp_urg_mode is overkill, only frames between
+ * snd_up-64k-mss .. snd_up cannot be large. However, taking into
+ * account rare use of URG, this is not a big flaw.
+ *
 * Returns 1, if no segments are in flight and we have queued segments, but
 * cannot send anything now because of SWS or another problem.
 */
@@ -1570,7 +1567,7 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
                }
                limit = mss_now;
-                if (tso_segs > 1)
+                if (tso_segs > 1 && !tcp_urg_mode(tp))
                        limit = tcp_mss_split_point(sk, skb, mss_now,
                                                    cwnd_quota);
@@ -1619,6 +1616,7 @@ void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
 */
 void tcp_push_one(struct sock *sk, unsigned int mss_now)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *skb = tcp_send_head(sk);
        unsigned int tso_segs, cwnd_quota;
@@ -1633,7 +1631,7 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
                BUG_ON(!tso_segs);
                limit = mss_now;
-                if (tso_segs > 1)
+                if (tso_segs > 1 && !tcp_urg_mode(tp))
                        limit = tcp_mss_split_point(sk, skb, mss_now,
                                                    cwnd_quota);
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index 14504dada116..7cd22262de3a 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -326,6 +326,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                tp->snd_cwnd = 2;
                        else if (tp->snd_cwnd > tp->snd_cwnd_clamp)
                                tp->snd_cwnd = tp->snd_cwnd_clamp;
+                        tp->snd_ssthresh = tcp_current_ssthresh(sk);
                }
                /* Wipe the slate clean for the next RTT. */
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7fef8ea1f5ec..d254446b85b5 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -99,7 +99,7 @@ struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr)
        sta = rcu_dereference(local->sta_hash[STA_HASH(addr)]);
        while (sta) {
-                if (compare_ether_addr(sta->sta.addr, addr) == 0)
+                if (memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                        break;
                sta = rcu_dereference(sta->hnext);
        }
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 02a8fed21082..1acc089be7e9 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -141,7 +141,7 @@ socket_mt(const struct sk_buff *skb, const struct xt_match_param *par)
        sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
                                   saddr, daddr, sport, dport, par->in, false);
        if (sk != NULL) {
-                bool wildcard = (inet_sk(sk)->rcv_saddr == 0);
+                bool wildcard = (sk->sk_state != TCP_TIME_WAIT && inet_sk(sk)->rcv_saddr == 0);
                nf_tproxy_put_sock(sk);
                if (wildcard)
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index e8a5c32b0f10..90c8506a0aac 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -574,9 +574,10 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
        list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
                                           &iface->addr4_list);
        spin_unlock(&netlbl_unlhsh_lock);
-        if (list_entry == NULL)
+        if (list_entry != NULL)
+                entry = netlbl_unlhsh_addr4_entry(list_entry);
+        else
                ret_val = -ENOENT;
-        entry = netlbl_unlhsh_addr4_entry(list_entry);
        audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
                                              audit_info);
@@ -634,9 +635,10 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
        spin_lock(&netlbl_unlhsh_lock);
        list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
        spin_unlock(&netlbl_unlhsh_lock);
-        if (list_entry == NULL)
+        if (list_entry != NULL)
+                entry = netlbl_unlhsh_addr6_entry(list_entry);
+        else
                ret_val = -ENOENT;
-        entry = netlbl_unlhsh_addr6_entry(list_entry);
        audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
                                              audit_info);
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index b1770d66bc8d..242fe8f8c322 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -123,6 +123,7 @@ nla_put_failure:
 static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct net *net = sock_net(skb->sk);
        struct phonet_device *pnd;
        int dev_idx = 0, dev_start_idx = cb->args[0];
        int addr_idx = 0, addr_start_idx = cb->args[1];
@@ -131,6 +132,8 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
        list_for_each_entry(pnd, &pndevs.list, list) {
                u8 addr;
+                if (!net_eq(dev_net(pnd->netdev), net))
+                        continue;
                if (dev_idx > dev_start_idx)
                        addr_start_idx = 0;
                if (dev_idx++ < dev_start_idx)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 058f04f54b90..fb216c9adf86 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -817,6 +817,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
                                continue;
                        hlist_del(&pol->bydst);
                        hlist_del(&pol->byidx);
+                        list_del(&pol->walk.all);
                        write_unlock_bh(&xfrm_policy_lock);
                        xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,