120 files changed, 845 insertions, 590 deletions

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e5b447a0acda..c4178778e7fd 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -883,6 +883,14 @@ and is between 256 and 4096 characters. It is defined in the file
         lapic_timer_c2_ok       [X86-32,x86-64,APIC] trust the local apic timer in
                         C2 power state.
 
+        libata.dma=     [LIBATA] DMA control
+                        libata.dma=0      Disable all PATA and SATA DMA
+                        libata.dma=1      PATA and SATA Disk DMA only
+                        libata.dma=2      ATAPI (CDROM) DMA only
+                        libata.dma=4      Compact Flash DMA only 
+                        Combinations also work, so libata.dma=3 enables DMA
+                        for disks and CDROMs, but not CFs.
+
         libata.noacpi   [LIBATA] Disables use of ACPI in libata suspend/resume
                         when set.
                         Format: <int>
diff --git a/Documentation/nfsroot.txt b/Documentation/nfsroot.txt
index c86dd38e2281..31b329172343 100644
--- a/Documentation/nfsroot.txt
+++ b/Documentation/nfsroot.txt
@@ -145,6 +145,7 @@ ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>
                 this option.
 
                   off or none: don't use autoconfiguration
+                                (do static IP assignment instead)
                   on or any:   use any protocol available in the kernel
                                (default)
                   dhcp:        use DHCP
diff --git a/MAINTAINERS b/MAINTAINERS
index 79c711e6074b..b4f611c60cfc 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1919,7 +1919,7 @@ INFINIBAND SUBSYSTEM
 P:      Roland Dreier
 M:      rolandd@cisco.com
 P:      Sean Hefty
-M:      mshefty@ichips.intel.com
+M:      sean.hefty@intel.com
 P:      Hal Rosenstock
 M:      hal.rosenstock@gmail.com 
 L:      general@lists.openfabrics.org
@@ -1984,29 +1984,27 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 
 INTEL PRO/100 ETHERNET SUPPORT
-P:      John Ronciak
-M:      john.ronciak@intel.com
+P:      Auke Kok
+M:      auke-jan.h.kok@intel.com
 P:      Jesse Brandeburg
 M:      jesse.brandeburg@intel.com
 P:      Jeff Kirsher
 M:      jeffrey.t.kirsher@intel.com
-P:      Auke Kok
-M:      auke-jan.h.kok@intel.com
+P:      John Ronciak
+M:      john.ronciak@intel.com
 L:      e1000-devel@lists.sourceforge.net
 W:      http://sourceforge.net/projects/e1000/
 S:      Supported
 
 INTEL PRO/1000 GIGABIT ETHERNET SUPPORT
-P:      Jeb Cramer
-M:      cramerj@intel.com
-P:      John Ronciak
-M:      john.ronciak@intel.com
+P:      Auke Kok
+M:      auke-jan.h.kok@intel.com
 P:      Jesse Brandeburg
 M:      jesse.brandeburg@intel.com
 P:      Jeff Kirsher
 M:      jeffrey.t.kirsher@intel.com
-P:      Auke Kok
-M:      auke-jan.h.kok@intel.com
+P:      John Ronciak
+M:      john.ronciak@intel.com
 L:      e1000-devel@lists.sourceforge.net
 W:      http://sourceforge.net/projects/e1000/
 S:      Supported
diff --git a/arch/arm/mach-at91/board-ek.c b/arch/arm/mach-at91/board-ek.c
index d05b1b2be9fb..53a5ef9e72ee 100644
--- a/arch/arm/mach-at91/board-ek.c
+++ b/arch/arm/mach-at91/board-ek.c
@@ -109,6 +109,15 @@ static struct spi_board_info ek_spi_devices[] = {
 #endif
 };
 
+static struct i2c_board_info __initdata ek_i2c_devices[] = {
+        {
+                I2C_BOARD_INFO("ics1523", 0x26),
+        },
+        {
+                I2C_BOARD_INFO("dac3550", 0x4d),
+        }
+};
+
 #define EK_FLASH_BASE   AT91_CHIPSELECT_0
 #define EK_FLASH_SIZE   0x200000
 
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index dcd81f8d0833..9732d5d9466b 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -178,13 +178,19 @@ static void pxa25x_cpu_pm_save(unsigned long *sleep_save)
         SAVE(GAFR1_L); SAVE(GAFR1_U);
         SAVE(GAFR2_L); SAVE(GAFR2_U);
 
-        SAVE(ICMR);
+        SAVE(ICMR); ICMR = 0;
         SAVE(CKEN);
         SAVE(PSTR);
+
+        /* Clear GPIO transition detect bits */
+        GEDR0 = GEDR0; GEDR1 = GEDR1; GEDR2 = GEDR2;
 }
 
 static void pxa25x_cpu_pm_restore(unsigned long *sleep_save)
 {
+        /* ensure not to come back here if it wasn't intended */
+        PSPR = 0;
+
         /* restore registers */
         RESTORE_GPLEVEL(0); RESTORE_GPLEVEL(1); RESTORE_GPLEVEL(2);
         RESTORE(GPDR0); RESTORE(GPDR1); RESTORE(GPDR2);
@@ -195,7 +201,12 @@ static void pxa25x_cpu_pm_restore(unsigned long *sleep_save)
         RESTORE(GFER0); RESTORE(GFER1); RESTORE(GFER2);
         RESTORE(PGSR0); RESTORE(PGSR1); RESTORE(PGSR2);
 
+        PSSR = PSSR_RDH | PSSR_PH;
+
         RESTORE(CKEN);
+
+        ICLR = 0;
+        ICCR = 1;
         RESTORE(ICMR);
         RESTORE(PSTR);
 }
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c6fc405a6c8e..291d368ffd28 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -992,8 +992,6 @@ config BOOT_ELF64
 
 menu "CPU selection"
 
-source "kernel/time/Kconfig"
-
 choice
         prompt "CPU type"
         default CPU_R4X00
@@ -1768,6 +1766,8 @@ config NR_CPUS
           performance should round up your number of processors to the next
           power of two.
 
+source "kernel/time/Kconfig"
+
 #
 # Timer Interrupt Frequency Configuration
 #
diff --git a/arch/mips/au1000/common/pci.c b/arch/mips/au1000/common/pci.c
index 6fa70a36a250..ce771487567d 100644
--- a/arch/mips/au1000/common/pci.c
+++ b/arch/mips/au1000/common/pci.c
@@ -1,8 +1,8 @@
 /*
  * BRIEF MODULE DESCRIPTION
- *      Alchemy/AMD Au1x00 pci support.
+ *      Alchemy/AMD Au1x00 PCI support.
  *
- * Copyright 2001,2002,2003 MontaVista Software Inc.
+ * Copyright 2001-2003, 2007 MontaVista Software Inc.
  * Author: MontaVista Software, Inc.
  *              ppopov@mvista.com or source@mvista.com
  *
@@ -66,6 +66,8 @@ static unsigned long virt_io_addr;
 
 static int __init au1x_pci_setup(void)
 {
+        extern void au1x_pci_cfg_init(void);
+
 #if defined(CONFIG_SOC_AU1500) || defined(CONFIG_SOC_AU1550)
         virt_io_addr = (unsigned long)ioremap(Au1500_PCI_IO_START,
                         Au1500_PCI_IO_END - Au1500_PCI_IO_START + 1);
@@ -94,6 +96,8 @@ static int __init au1x_pci_setup(void)
         set_io_port_base(virt_io_addr);
 #endif
 
+        au1x_pci_cfg_init();
+
         register_pci_controller(&au1x_controller);
         return 0;
 }
diff --git a/arch/mips/kernel/head.S b/arch/mips/kernel/head.S
index 236768731063..50be56c9e9ef 100644
--- a/arch/mips/kernel/head.S
+++ b/arch/mips/kernel/head.S
@@ -136,7 +136,8 @@ EXPORT(_stext)
          * kernel load address.  This is needed because this platform does
          * not have a ELF loader yet.
          */
-        __INIT
+FEXPORT(__kernel_entry)
+        j       kernel_entry
 #endif
 
         __INIT_REFOK
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 7f6ddcb5d485..f8a535afce39 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -269,7 +269,7 @@ static void __init bootmem_init(void)
 
 static void __init bootmem_init(void)
 {
-        unsigned long init_begin, reserved_end;
+        unsigned long reserved_end;
         unsigned long mapstart = ~0UL;
         unsigned long bootmap_size;
         int i;
@@ -344,7 +344,6 @@ static void __init bootmem_init(void)
                                          min_low_pfn, max_low_pfn);
 
 
-        init_begin = PFN_UP(__pa_symbol(&__init_begin));
         for (i = 0; i < boot_mem_map.nr_map; i++) {
                 unsigned long start, end;
 
@@ -352,8 +351,8 @@ static void __init bootmem_init(void)
                 end = PFN_DOWN(boot_mem_map.map[i].addr
                                 + boot_mem_map.map[i].size);
 
-                if (start <= init_begin)
-                        start = init_begin;
+                if (start <= min_low_pfn)
+                        start = min_low_pfn;
                 if (start >= end)
                         continue;
 
diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
index 1ecfbb7eba6c..2995be1ab3ca 100644
--- a/arch/mips/kernel/time.c
+++ b/arch/mips/kernel/time.c
@@ -147,9 +147,9 @@ static __init int cpu_has_mfc0_count_bug(void)
                         return 1;
 
                 /*
-                 * I don't have erratas for newer R4400 so be paranoid.
+                 * we assume newer revisions are ok
                  */
-                return 1;
+                return 0;
         }
 
         return 0;
diff --git a/arch/mips/lasat/image/Makefile b/arch/mips/lasat/image/Makefile
index 5332449ec040..460626b6d62f 100644
--- a/arch/mips/lasat/image/Makefile
+++ b/arch/mips/lasat/image/Makefile
@@ -12,11 +12,11 @@ endif
 
 MKLASATIMG = mklasatimg
 MKLASATIMG_ARCH = mq2,mqpro,sp100,sp200
-KERNEL_IMAGE = $(TOPDIR)/vmlinux
+KERNEL_IMAGE = vmlinux
 KERNEL_START = $(shell $(NM) $(KERNEL_IMAGE) | grep " _text" | cut -f1 -d\ )
 KERNEL_ENTRY = $(shell $(NM) $(KERNEL_IMAGE) | grep kernel_entry | cut -f1 -d\ )
 
-LDSCRIPT= -L$(obj) -Tromscript.normal
+LDSCRIPT= -L$(srctree)/$(src) -Tromscript.normal
 
 HEAD_DEFINES := -D_kernel_start=0x$(KERNEL_START) \
                 -D_kernel_entry=0x$(KERNEL_ENTRY) \
@@ -24,7 +24,7 @@ HEAD_DEFINES := -D_kernel_start=0x$(KERNEL_START) \
                 -D TIMESTAMP=$(shell date +%s)
 
 $(obj)/head.o: $(obj)/head.S $(KERNEL_IMAGE)
-        $(CC) -fno-pic $(HEAD_DEFINES) -I$(TOPDIR)/include -c -o $@ $<
+        $(CC) -fno-pic $(HEAD_DEFINES) $(LINUXINCLUDE) -c -o $@ $<
 
 OBJECTS = head.o kImage.o
 
diff --git a/arch/mips/mips-boards/generic/memory.c b/arch/mips/mips-boards/generic/memory.c
index 2c5c27c8e86d..dc272c188233 100644
--- a/arch/mips/mips-boards/generic/memory.c
+++ b/arch/mips/mips-boards/generic/memory.c
@@ -169,7 +169,6 @@ void __init prom_meminit(void)
 
 void __init prom_free_prom_memory(void)
 {
-#if 0 /* for now ...  */
         unsigned long addr;
         int i;
 
@@ -181,5 +180,4 @@ void __init prom_free_prom_memory(void)
                 free_init_pages("prom memory",
                                 addr, addr + boot_mem_map.map[i].size);
         }
-#endif
 }
diff --git a/arch/mips/mips-boards/generic/reset.c b/arch/mips/mips-boards/generic/reset.c
index 7a1bb51f81ee..583d468d98a9 100644
--- a/arch/mips/mips-boards/generic/reset.c
+++ b/arch/mips/mips-boards/generic/reset.c
@@ -39,16 +39,18 @@ static void atlas_machine_power_off(void);
 
 static void mips_machine_restart(char *command)
 {
-        unsigned int __iomem *softres_reg = ioremap(SOFTRES_REG, sizeof(unsigned int));
+        unsigned int __iomem *softres_reg =
+                ioremap(SOFTRES_REG, sizeof(unsigned int));
 
-        writew(GORESET, softres_reg);
+        __raw_writel(GORESET, softres_reg);
 }
 
 static void mips_machine_halt(void)
 {
-        unsigned int __iomem *softres_reg = ioremap(SOFTRES_REG, sizeof(unsigned int));
+        unsigned int __iomem *softres_reg =
+                ioremap(SOFTRES_REG, sizeof(unsigned int));
 
-        writew(GORESET, softres_reg);
+        __raw_writel(GORESET, softres_reg);
 }
 
 #if defined(CONFIG_MIPS_ATLAS)
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index ae76795685cc..810535dd091b 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -45,7 +45,7 @@ static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
         /* ignore region specifiers */
         gfp &= ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM);
 
-#ifdef CONFIG_ZONE_DMA32
+#ifdef CONFIG_ZONE_DMA
         if (dev == NULL)
                 gfp |= __GFP_DMA;
         else if (dev->coherent_dma_mask < DMA_BIT_MASK(24))
diff --git a/arch/mips/pci/ops-au1000.c b/arch/mips/pci/ops-au1000.c
index 6b29904acf45..1314bd58f036 100644
--- a/arch/mips/pci/ops-au1000.c
+++ b/arch/mips/pci/ops-au1000.c
@@ -1,8 +1,8 @@
 /*
  * BRIEF MODULE DESCRIPTION
- *      Alchemy/AMD Au1x00 pci support.
+ *      Alchemy/AMD Au1x00 PCI support.
  *
- * Copyright 2001,2002,2003 MontaVista Software Inc.
+ * Copyright 2001-2003, 2007 MontaVista Software Inc.
  * Author: MontaVista Software, Inc.
  *              ppopov@mvista.com or source@mvista.com
  *
@@ -69,10 +69,27 @@ void mod_wired_entry(int entry, unsigned long entrylo0,
         write_c0_pagemask(old_pagemask);
 }
 
-struct vm_struct *pci_cfg_vm;
+static struct vm_struct *pci_cfg_vm;
 static int pci_cfg_wired_entry;
-static int first_cfg = 1;
-unsigned long last_entryLo0, last_entryLo1;
+static unsigned long last_entryLo0, last_entryLo1;
+
+/*
+ * We can't ioremap the entire pci config space because it's too large.
+ * Nor can we call ioremap dynamically because some device drivers use
+ * the PCI config routines from within interrupt handlers and that
+ * becomes a problem in get_vm_area().  We use one wired TLB to handle
+ * all config accesses for all busses.
+ */
+void __init au1x_pci_cfg_init(void)
+{
+        /* Reserve a wired entry for PCI config accesses */
+        pci_cfg_vm = get_vm_area(0x2000, VM_IOREMAP);
+        if (!pci_cfg_vm)
+                panic(KERN_ERR "PCI unable to get vm area\n");
+        pci_cfg_wired_entry = read_c0_wired();
+        add_wired_entry(0, 0, (unsigned long)pci_cfg_vm->addr, PM_4K);
+        last_entryLo0 = last_entryLo1 = 0xffffffff;
+}
 
 static int config_access(unsigned char access_type, struct pci_bus *bus,
                          unsigned int dev_fn, unsigned char where,
@@ -97,27 +114,6 @@ static int config_access(unsigned char access_type, struct pci_bus *bus,
                         Au1500_PCI_STATCMD);
         au_sync_udelay(1);
 
-        /*
-         * We can't ioremap the entire pci config space because it's
-         * too large. Nor can we call ioremap dynamically because some
-         * device drivers use the pci config routines from within
-         * interrupt handlers and that becomes a problem in get_vm_area().
-         * We use one wired tlb to handle all config accesses for all
-         * busses. To improve performance, if the current device
-         * is the same as the last device accessed, we don't touch the
-         * tlb.
-         */
-        if (first_cfg) {
-                /* reserve a wired entry for pci config accesses */
-                first_cfg = 0;
-                pci_cfg_vm = get_vm_area(0x2000, VM_IOREMAP);
-                if (!pci_cfg_vm)
-                        panic(KERN_ERR "PCI unable to get vm area\n");
-                pci_cfg_wired_entry = read_c0_wired();
-                add_wired_entry(0, 0, (unsigned long)pci_cfg_vm->addr, PM_4K);
-                last_entryLo0  = last_entryLo1 = 0xffffffff;
-        }
-
         /* Allow board vendors to implement their own off-chip idsel.
          * If it doesn't succeed, may as well bail out at this point.
          */
@@ -144,9 +140,12 @@ static int config_access(unsigned char access_type, struct pci_bus *bus,
         /* page boundary */
         cfg_base = cfg_base & PAGE_MASK;
 
+        /*
+         * To improve performance, if the current device is the same as
+         * the last device accessed, we don't touch the TLB.
+         */
         entryLo0 = (6 << 26)  | (cfg_base >> 6) | (2 << 3) | 7;
         entryLo1 = (6 << 26)  | (cfg_base >> 6) | (0x1000 >> 6) | (2 << 3) | 7;
-
         if ((entryLo0 != last_entryLo0) || (entryLo1 != last_entryLo1)) {
                 mod_wired_entry(pci_cfg_wired_entry, entryLo0, entryLo1,
                                 (unsigned long)pci_cfg_vm->addr, PM_4K);
diff --git a/arch/mips/pci/ops-mace.c b/arch/mips/pci/ops-mace.c
index fe5451449304..e95881897ec9 100644
--- a/arch/mips/pci/ops-mace.c
+++ b/arch/mips/pci/ops-mace.c
@@ -42,6 +42,10 @@ static int
 mace_pci_read_config(struct pci_bus *bus, unsigned int devfn,
                      int reg, int size, u32 *val)
 {
+        u32 control = mace->pci.control;
+
+        /* disable master aborts interrupts during config read */
+        mace->pci.control = control & ~MACEPCI_CONTROL_MAR_INT;
         mace->pci.config_addr = mkaddr(bus, devfn, reg);
         switch (size) {
         case 1:
@@ -54,6 +58,9 @@ mace_pci_read_config(struct pci_bus *bus, unsigned int devfn,
                 *val = mace->pci.config_data.l;
                 break;
         }
+        /* ack possible master abort */
+        mace->pci.error &= ~MACEPCI_ERROR_MASTER_ABORT;
+        mace->pci.control = control;
 
         DPRINTK("read%d: reg=%08x,val=%02x\n", size * 8, reg, *val);
 
diff --git a/arch/mips/pci/pci-ip32.c b/arch/mips/pci/pci-ip32.c
index 618ea7dbc474..532b561b4442 100644
--- a/arch/mips/pci/pci-ip32.c
+++ b/arch/mips/pci/pci-ip32.c
@@ -119,6 +119,7 @@ static struct pci_controller mace_pci_controller = {
         .iommu          = 0,
         .mem_offset     = MACE_PCI_MEM_OFFSET,
         .io_offset      = 0,
+        .io_map_base    = CKSEG1ADDR(MACEPCI_LOW_IO),
 };
 
 static int __init mace_init(void)
@@ -135,7 +136,8 @@ static int __init mace_init(void)
         BUG_ON(request_irq(MACE_PCI_BRIDGE_IRQ, macepci_error, 0,
                            "MACE PCI error", NULL));
 
-        iomem_resource = mace_pci_mem_resource;
+        /* extend memory resources */
+        iomem_resource.end = mace_pci_mem_resource.end;
         ioport_resource = mace_pci_io_resource;
 
         register_pci_controller(&mace_pci_controller);
diff --git a/arch/mips/philips/pnx8550/common/time.c b/arch/mips/philips/pnx8550/common/time.c
index e818fd0f1584..6d494e0de3d9 100644
--- a/arch/mips/philips/pnx8550/common/time.c
+++ b/arch/mips/philips/pnx8550/common/time.c
@@ -22,7 +22,6 @@
 #include <linux/kernel_stat.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
-#include <linux/module.h>
 
 #include <asm/bootinfo.h>
 #include <asm/cpu.h>
@@ -41,11 +40,60 @@ static cycle_t hpt_read(void)
         return read_c0_count2();
 }
 
+static struct clocksource pnx_clocksource = {
+        .name           = "pnx8xxx",
+        .rating         = 200,
+        .read           = hpt_read,
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
+};
+
 static void timer_ack(void)
 {
         write_c0_compare(cpj);
 }
 
+static irqreturn_t pnx8xxx_timer_interrupt(int irq, void *dev_id)
+{
+        struct clock_event_device *c = dev_id;
+
+        /* clear MATCH, signal the event */
+        c->event_handler(c);
+
+        return IRQ_HANDLED;
+}
+
+static struct irqaction pnx8xxx_timer_irq = {
+        .handler        = pnx8xxx_timer_interrupt,
+        .flags          = IRQF_DISABLED | IRQF_PERCPU,
+        .name           = "pnx8xxx_timer",
+};
+
+static irqreturn_t monotonic_interrupt(int irq, void *dev_id)
+{
+        /* Timer 2 clear interrupt */
+        write_c0_compare2(-1);
+        return IRQ_HANDLED;
+}
+
+static struct irqaction monotonic_irqaction = {
+        .handler = monotonic_interrupt,
+        .flags = IRQF_DISABLED,
+        .name = "Monotonic timer",
+};
+
+static int pnx8xxx_set_next_event(unsigned long delta,
+                                struct clock_event_device *evt)
+{
+        write_c0_compare(delta);
+        return 0;
+}
+
+static struct clock_event_device pnx8xxx_clockevent = {
+        .name           = "pnx8xxx_clockevent",
+        .features       = CLOCK_EVT_FEAT_ONESHOT,
+        .set_next_event = pnx8xxx_set_next_event,
+};
+
 /*
  * plat_time_init() - it does the following things:
  *
@@ -58,11 +106,34 @@ static void timer_ack(void)
 
 __init void plat_time_init(void)
 {
+        unsigned int             configPR;
         unsigned int             n;
         unsigned int             m;
         unsigned int             p;
         unsigned int             pow2p;
 
+        clockevents_register_device(&pnx8xxx_clockevent);
+        clocksource_register(&pnx_clocksource);
+
+        setup_irq(PNX8550_INT_TIMER1, &pnx8xxx_timer_irq);
+        setup_irq(PNX8550_INT_TIMER2, &monotonic_irqaction);
+
+        /* Timer 1 start */
+        configPR = read_c0_config7();
+        configPR &= ~0x00000008;
+        write_c0_config7(configPR);
+
+        /* Timer 2 start */
+        configPR = read_c0_config7();
+        configPR &= ~0x00000010;
+        write_c0_config7(configPR);
+
+        /* Timer 3 stop */
+        configPR = read_c0_config7();
+        configPR |= 0x00000020;
+        write_c0_config7(configPR);
+
+
         /* PLL0 sets MIPS clock (PLL1 <=> TM1, PLL6 <=> TM2, PLL5 <=> mem) */
         /* (but only if CLK_MIPS_CTL select value [bits 3:1] is 1:  FIXME) */
 
@@ -87,42 +158,6 @@ __init void plat_time_init(void)
         write_c0_count2(0);
         write_c0_compare2(0xffffffff);
 
-        clocksource_mips.read = hpt_read;
-        mips_timer_ack = timer_ack;
-}
-
-static irqreturn_t monotonic_interrupt(int irq, void *dev_id)
-{
-        /* Timer 2 clear interrupt */
-        write_c0_compare2(-1);
-        return IRQ_HANDLED;
 }
 
-static struct irqaction monotonic_irqaction = {
-        .handler = monotonic_interrupt,
-        .flags = IRQF_DISABLED,
-        .name = "Monotonic timer",
-};
 
-void __init plat_timer_setup(struct irqaction *irq)
-{
-        int configPR;
-
-        setup_irq(PNX8550_INT_TIMER1, irq);
-        setup_irq(PNX8550_INT_TIMER2, &monotonic_irqaction);
-
-        /* Timer 1 start */
-        configPR = read_c0_config7();
-        configPR &= ~0x00000008;
-        write_c0_config7(configPR);
-
-        /* Timer 2 start */
-        configPR = read_c0_config7();
-        configPR &= ~0x00000010;
-        write_c0_config7(configPR);
-
-        /* Timer 3 stop */
-        configPR = read_c0_config7();
-        configPR |= 0x00000020;
-        write_c0_config7(configPR);
-}
diff --git a/arch/mips/sgi-ip32/ip32-irq.c b/arch/mips/sgi-ip32/ip32-irq.c
index cab7cc22ab67..b0ea0e43ba48 100644
--- a/arch/mips/sgi-ip32/ip32-irq.c
+++ b/arch/mips/sgi-ip32/ip32-irq.c
@@ -426,7 +426,6 @@ static void ip32_irq0(void)
 
         crime_int = crime->istat & crime_mask;
         irq = MACE_VID_IN1_IRQ + __ffs(crime_int);
-        crime_int = 1 << irq;
 
         if (crime_int & CRIME_MACEISA_INT_MASK) {
                 unsigned long mace_int = mace->perif.ctrl.istat;
diff --git a/arch/mips/sgi-ip32/ip32-platform.c b/arch/mips/sgi-ip32/ip32-platform.c
index 77febd68fcd4..89a71f49b692 100644
--- a/arch/mips/sgi-ip32/ip32-platform.c
+++ b/arch/mips/sgi-ip32/ip32-platform.c
@@ -13,21 +13,22 @@
 #include <asm/ip32/mace.h>
 #include <asm/ip32/ip32_ints.h>
 
-/*
- * .iobase isn't a constant (in the sense of C) so we fill it in at runtime.
- */
-#define MACE_PORT(int)                                                  \
+#define MACEISA_SERIAL1_OFFS   offsetof(struct sgi_mace, isa.serial1)
+#define MACEISA_SERIAL2_OFFS   offsetof(struct sgi_mace, isa.serial2)
+
+#define MACE_PORT(offset,_irq)                                          \
 {                                                                       \
-        .irq            = int,                                          \
+        .mapbase        = MACE_BASE + offset,                           \
+        .irq            = _irq,                                         \
         .uartclk        = 1843200,                                      \
         .iotype         = UPIO_MEM,                                     \
-        .flags          = UPF_SKIP_TEST,                                \
+        .flags          = UPF_SKIP_TEST|UPF_IOREMAP,                    \
         .regshift       = 8,                                            \
 }
 
 static struct plat_serial8250_port uart8250_data[] = {
-        MACE_PORT(MACEISA_SERIAL1_IRQ),
-        MACE_PORT(MACEISA_SERIAL2_IRQ),
+        MACE_PORT(MACEISA_SERIAL1_OFFS, MACEISA_SERIAL1_IRQ),
+        MACE_PORT(MACEISA_SERIAL2_OFFS, MACEISA_SERIAL2_IRQ),
         { },
 };
 
@@ -41,9 +42,6 @@ static struct platform_device uart8250_device = {
 
 static int __init uart8250_init(void)
 {
-        uart8250_data[0].membase = (void __iomem *) &mace->isa.serial1;
-        uart8250_data[1].membase = (void __iomem *) &mace->isa.serial2;
-
         return platform_device_register(&uart8250_device);
 }
 
diff --git a/arch/x86/kernel/smpboot_64.c b/arch/x86/kernel/smpboot_64.c
index 500670c93d81..aaf4e1291217 100644
--- a/arch/x86/kernel/smpboot_64.c
+++ b/arch/x86/kernel/smpboot_64.c
@@ -526,7 +526,7 @@ struct create_idle {
         int cpu;
 };
 
-void do_fork_idle(struct work_struct *work)
+static void __cpuinit do_fork_idle(struct work_struct *work)
 {
         struct create_idle *c_idle =
                 container_of(work, struct create_idle, work);
diff --git a/block/blktrace.c b/block/blktrace.c
index 498a0a54a6aa..9b4da4ae3c7d 100644
--- a/block/blktrace.c
+++ b/block/blktrace.c
@@ -25,7 +25,6 @@
 #include <linux/time.h>
 #include <asm/uaccess.h>
 
-static DEFINE_PER_CPU(unsigned long long, blk_trace_cpu_offset) = { 0, };
 static unsigned int blktrace_seq __read_mostly = 1;
 
 /*
@@ -41,7 +40,7 @@ static void trace_note(struct blk_trace *bt, pid_t pid, int action,
                 const int cpu = smp_processor_id();
 
                 t->magic = BLK_IO_TRACE_MAGIC | BLK_IO_TRACE_VERSION;
-                t->time = cpu_clock(cpu) - per_cpu(blk_trace_cpu_offset, cpu);
+                t->time = ktime_to_ns(ktime_get());
                 t->device = bt->dev;
                 t->action = action;
                 t->pid = pid;
@@ -159,7 +158,7 @@ void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
 
                 t->magic = BLK_IO_TRACE_MAGIC | BLK_IO_TRACE_VERSION;
                 t->sequence = ++(*sequence);
-                t->time = cpu_clock(cpu) - per_cpu(blk_trace_cpu_offset, cpu);
+                t->time = ktime_to_ns(ktime_get());
                 t->sector = sector;
                 t->bytes = bytes;
                 t->action = what;
@@ -179,7 +178,7 @@ void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
 EXPORT_SYMBOL_GPL(__blk_add_trace);
 
 static struct dentry *blk_tree_root;
-static struct mutex blk_tree_mutex;
+static DEFINE_MUTEX(blk_tree_mutex);
 static unsigned int root_users;
 
 static inline void blk_remove_root(void)
@@ -505,77 +504,3 @@ void blk_trace_shutdown(struct request_queue *q)
                 blk_trace_remove(q);
         }
 }
-
-/*
- * Average offset over two calls to cpu_clock() with a gettimeofday()
- * in the middle
- */
-static void blk_check_time(unsigned long long *t, int this_cpu)
-{
-        unsigned long long a, b;
-        struct timeval tv;
-
-        a = cpu_clock(this_cpu);
-        do_gettimeofday(&tv);
-        b = cpu_clock(this_cpu);
-
-        *t = tv.tv_sec * 1000000000 + tv.tv_usec * 1000;
-        *t -= (a + b) / 2;
-}
-
-/*
- * calibrate our inter-CPU timings
- */
-static void blk_trace_check_cpu_time(void *data)
-{
-        unsigned long long *t;
-        int this_cpu = get_cpu();
-
-        t = &per_cpu(blk_trace_cpu_offset, this_cpu);
-
-        /*
-         * Just call it twice, hopefully the second call will be cache hot
-         * and a little more precise
-         */
-        blk_check_time(t, this_cpu);
-        blk_check_time(t, this_cpu);
-
-        put_cpu();
-}
-
-static void blk_trace_set_ht_offsets(void)
-{
-#if defined(CONFIG_SCHED_SMT)
-        int cpu, i;
-
-        /*
-         * now make sure HT siblings have the same time offset
-         */
-        preempt_disable();
-        for_each_online_cpu(cpu) {
-                unsigned long long *cpu_off, *sibling_off;
-
-                for_each_cpu_mask(i, per_cpu(cpu_sibling_map, cpu)) {
-                        if (i == cpu)
-                                continue;
-
-                        cpu_off = &per_cpu(blk_trace_cpu_offset, cpu);
-                        sibling_off = &per_cpu(blk_trace_cpu_offset, i);
-                        *sibling_off = *cpu_off;
-                }
-        }
-        preempt_enable();
-#endif
-}
-
-static __init int blk_trace_init(void)
-{
-        mutex_init(&blk_tree_mutex);
-        on_each_cpu(blk_trace_check_cpu_time, NULL, 1, 1);
-        blk_trace_set_ht_offsets();
-
-        return 0;
-}
-
-module_init(blk_trace_init);
-
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index f0124a8d3134..21a81cd148e4 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1733,11 +1733,15 @@ static void ata_eh_link_autopsy(struct ata_link *link)
                 ehc->i.action &= ~ATA_EH_PERDEV_MASK;
         }
 
-        /* consider speeding down */
+        /* propagate timeout to host link */
+        if ((all_err_mask & AC_ERR_TIMEOUT) && !ata_is_host_link(link))
+                ap->link.eh_context.i.err_mask |= AC_ERR_TIMEOUT;
+
+        /* record error and consider speeding down */
         dev = ehc->i.dev;
-        if (!dev && ata_link_max_devices(link) == 1 &&
-            ata_dev_enabled(link->device))
-                dev = link->device;
+        if (!dev && ((ata_link_max_devices(link) == 1 &&
+                      ata_dev_enabled(link->device))))
+            dev = link->device;
 
         if (dev)
                 ehc->i.action |= ata_eh_speed_down(dev, is_io, all_err_mask);
@@ -1759,8 +1763,14 @@ void ata_eh_autopsy(struct ata_port *ap)
 {
         struct ata_link *link;
 
-        __ata_port_for_each_link(link, ap)
+        ata_port_for_each_link(link, ap)
                 ata_eh_link_autopsy(link);
+
+        /* Autopsy of fanout ports can affect host link autopsy.
+         * Perform host link autopsy last.
+         */
+        if (ap->nr_pmp_links)
+                ata_eh_link_autopsy(&ap->link);
 }
 
 /**
@@ -2157,13 +2167,11 @@ int ata_eh_reset(struct ata_link *link, int classify,
                 if (ata_link_offline(link))
                         continue;
 
-                /* apply class override and convert UNKNOWN to NONE */
+                /* apply class override */
                 if (lflags & ATA_LFLAG_ASSUME_ATA)
                         classes[dev->devno] = ATA_DEV_ATA;
                 else if (lflags & ATA_LFLAG_ASSUME_SEMB)
                         classes[dev->devno] = ATA_DEV_SEMB_UNSUP; /* not yet */
-                else if (classes[dev->devno] == ATA_DEV_UNKNOWN)
-                        classes[dev->devno] = ATA_DEV_NONE;
         }
 
         /* record current link speed */
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index c0c4dbcde091..caef2bbd4a8a 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -495,14 +495,12 @@ static void sata_pmp_quirks(struct ata_port *ap)
                         /* SError.N need a kick in the ass to get working */
                         link->flags |= ATA_LFLAG_HRST_TO_RESUME;
 
-                        /* class code report is unreliable */
-                        if (link->pmp < 5)
-                                link->flags |= ATA_LFLAG_ASSUME_ATA;
-
-                        /* The config device, which can be either at
-                         * port 0 or 5, locks up on SRST.
+                        /* Class code report is unreliable and SRST
+                         * times out under certain configurations.
+                         * Config device can be at port 0 or 5 and
+                         * locks up on SRST.
                          */
-                        if (link->pmp == 0 || link->pmp == 5)
+                        if (link->pmp <= 5)
                                 link->flags |= ATA_LFLAG_NO_SRST |
                                                ATA_LFLAG_ASSUME_ATA;
 
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index a883bb03d4c7..264ae60e3fd8 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -872,7 +872,8 @@ int ata_scsi_slave_config(struct scsi_device *sdev)
 
         ata_scsi_sdev_config(sdev);
 
-        sdev->manage_start_stop = 1;
+        if (dev->class == ATA_DEV_ATA)
+                sdev->manage_start_stop = 1;
 
         if (dev)
                 ata_scsi_dev_config(sdev, dev);
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 48acc09dab96..b7ac80b4b1fb 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -806,7 +806,10 @@ int ata_pci_init_one(struct pci_dev *pdev,
         if (rc)
                 goto err_out;
 
-        if (!legacy_mode) {
+        if (!legacy_mode && pdev->irq) {
+                /* We may have no IRQ assigned in which case we can poll. This
+                   shouldn't happen on a sane system but robustness is cheap
+                   in this case */
                 rc = devm_request_irq(dev, pdev->irq, pi->port_ops->irq_handler,
                                       IRQF_SHARED, DRV_NAME, host);
                 if (rc)
@@ -814,7 +817,7 @@ int ata_pci_init_one(struct pci_dev *pdev,
 
                 ata_port_desc(host->ports[0], "irq %d", pdev->irq);
                 ata_port_desc(host->ports[1], "irq %d", pdev->irq);
-        } else {
+        } else if (legacy_mode) {
                 if (!ata_port_is_dummy(host->ports[0])) {
                         rc = devm_request_irq(dev, ATA_PRIMARY_IRQ(pdev),
                                               pi->port_ops->irq_handler,
diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
index fcd532afbf2e..120b5bfa7ce6 100644
--- a/drivers/ata/pata_ixp4xx_cf.c
+++ b/drivers/ata/pata_ixp4xx_cf.c
@@ -130,10 +130,11 @@ static struct ata_port_operations ixp4xx_port_ops = {
         .port_start             = ata_port_start,
 };
 
-static void ixp4xx_setup_port(struct ata_ioports *ioaddr,
+static void ixp4xx_setup_port(struct ata_port *ap,
                               struct ixp4xx_pata_data *data,
                               unsigned long raw_cs0, unsigned long raw_cs1)
 {
+        struct ata_ioports *ioaddr = &ap->ioaddr;
         unsigned long raw_cmd = raw_cs0;
         unsigned long raw_ctl = raw_cs1 + 0x06;
 
diff --git a/drivers/ata/pata_pdc202xx_old.c b/drivers/ata/pata_pdc202xx_old.c
index bc7c2d5d8d5e..8f2815601791 100644
--- a/drivers/ata/pata_pdc202xx_old.c
+++ b/drivers/ata/pata_pdc202xx_old.c
@@ -215,8 +215,8 @@ static void pdc2026x_bmdma_stop(struct ata_queued_cmd *qc)
         /* Flip back to 33Mhz for PIO */
         if (adev->dma_mode >= XFER_UDMA_2)
                 iowrite8(ioread8(clock) & ~sel66, clock);
-
         ata_bmdma_stop(qc);
+        pdc202xx_set_piomode(ap, adev);
 }
 
 /**
@@ -233,6 +233,17 @@ static void pdc2026x_dev_config(struct ata_device *adev)
         adev->max_sectors = 256;
 }
 
+static int pdc2026x_port_start(struct ata_port *ap)
+{
+        void __iomem *bmdma = ap->ioaddr.bmdma_addr;
+        if (bmdma) {
+                /* Enable burst mode */
+                u8 burst = ioread8(bmdma + 0x1f);
+                iowrite8(burst | 0x01, bmdma + 0x1f);
+        }
+        return ata_sff_port_start(ap);
+}
+
 static struct scsi_host_template pdc202xx_sht = {
         .module                 = THIS_MODULE,
         .name                   = DRV_NAME,
@@ -313,7 +324,7 @@ static struct ata_port_operations pdc2026x_port_ops = {
         .irq_clear      = ata_bmdma_irq_clear,
         .irq_on         = ata_irq_on,
 
-        .port_start     = ata_sff_port_start,
+        .port_start     = pdc2026x_port_start,
 };
 
 static int pdc202xx_init_one(struct pci_dev *dev, const struct pci_device_id *id)
diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
index 2f1de6ec044c..c68b241805fd 100644
--- a/drivers/ata/sata_qstor.c
+++ b/drivers/ata/sata_qstor.c
@@ -270,7 +270,7 @@ static int qs_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
 static void qs_error_handler(struct ata_port *ap)
 {
         qs_enter_reg_mode(ap);
-        ata_do_eh(ap, qs_prereset, ata_std_softreset, NULL,
+        ata_do_eh(ap, qs_prereset, NULL, sata_std_hardreset,
                   ata_std_postreset);
 }
 
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index 96fd5260446d..b4c674d83769 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -832,16 +832,31 @@ static int sil24_qc_defer(struct ata_queued_cmd *qc)
         struct ata_link *link = qc->dev->link;
         struct ata_port *ap = link->ap;
         u8 prot = qc->tf.protocol;
-        int is_atapi = (prot == ATA_PROT_ATAPI ||
-                        prot == ATA_PROT_ATAPI_NODATA ||
-                        prot == ATA_PROT_ATAPI_DMA);
-
-        /* ATAPI commands completing with CHECK_SENSE cause various
-         * weird problems if other commands are active.  PMP DMA CS
-         * errata doesn't cover all and HSM violation occurs even with
-         * only one other device active.  Always run an ATAPI command
-         * by itself.
-         */
+
+        /*
+         * There is a bug in the chip:
+         * Port LRAM Causes the PRB/SGT Data to be Corrupted
+         * If the host issues a read request for LRAM and SActive registers
+         * while active commands are available in the port, PRB/SGT data in
+         * the LRAM can become corrupted. This issue applies only when
+         * reading from, but not writing to, the LRAM.
+         *
+         * Therefore, reading LRAM when there is no particular error [and
+         * other commands may be outstanding] is prohibited.
+         *
+         * To avoid this bug there are two situations where a command must run
+         * exclusive of any other commands on the port:
+         *
+         * - ATAPI commands which check the sense data
+         * - Passthrough ATA commands which always have ATA_QCFLAG_RESULT_TF
+         *   set.
+         *
+         */
+        int is_excl = (prot == ATA_PROT_ATAPI ||
+                       prot == ATA_PROT_ATAPI_NODATA ||
+                       prot == ATA_PROT_ATAPI_DMA ||
+                       (qc->flags & ATA_QCFLAG_RESULT_TF));
+
         if (unlikely(ap->excl_link)) {
                 if (link == ap->excl_link) {
                         if (ap->nr_active_links)
@@ -849,7 +864,7 @@ static int sil24_qc_defer(struct ata_queued_cmd *qc)
                         qc->flags |= ATA_QCFLAG_CLEAR_EXCL;
                 } else
                         return ATA_DEFER_PORT;
-        } else if (unlikely(is_atapi)) {
+        } else if (unlikely(is_excl)) {
                 ap->excl_link = link;
                 if (ap->nr_active_links)
                         return ATA_DEFER_PORT;
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 14ced85b3f54..0c205b000e8b 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -625,14 +625,6 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
    if (mac[i] == NULL)
       nicstar_init_eprom(card->membase);
 
-   if (request_irq(pcidev->irq, &ns_irq_handler, IRQF_DISABLED | IRQF_SHARED, "nicstar", card) != 0)
-   {
-      printk("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
-      error = 9;
-      ns_init_card_error(card, error);
-      return error;
-   }
-
    /* Set the VPI/VCI MSb mask to zero so we can receive OAM cells */
    writel(0x00000000, card->membase + VPM);
       
@@ -858,8 +850,6 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
       card->iovpool.count++;
    }
 
-   card->intcnt = 0;
-
    /* Configure NICStAR */
    if (card->rct_size == 4096)
       ns_cfg_rctsize = NS_CFG_RCTSIZE_4096_ENTRIES;
@@ -868,6 +858,15 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
 
    card->efbie = 1;
 
+   card->intcnt = 0;
+   if (request_irq(pcidev->irq, &ns_irq_handler, IRQF_DISABLED | IRQF_SHARED, "nicstar", card) != 0)
+   {
+      printk("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
+      error = 9;
+      ns_init_card_error(card, error);
+      return error;
+   }
+
    /* Register device */
    card->atmdev = atm_dev_register("nicstar", &atm_ops, -1, NULL);
    if (card->atmdev == NULL)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 56e23042728a..b8af22e610df 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -610,7 +610,7 @@ static int loop_thread(void *data)
 static int loop_switch(struct loop_device *lo, struct file *file)
 {
         struct switch_request w;
-        struct bio *bio = bio_alloc(GFP_KERNEL, 1);
+        struct bio *bio = bio_alloc(GFP_KERNEL, 0);
         if (!bio)
                 return -ENOMEM;
         init_completion(&w.wait);
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index e02d59245a17..d4b6d64e858b 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -365,6 +365,25 @@ void tty_termios_copy_hw(struct ktermios *new, struct ktermios *old)
 EXPORT_SYMBOL(tty_termios_copy_hw);
 
 /**
+ *      tty_termios_hw_change   -       check for setting change
+ *      @a: termios
+ *      @b: termios to compare
+ *
+ *      Check if any of the bits that affect a dumb device have changed
+ *      between the two termios structures, or a speed change is needed.
+ */
+
+int tty_termios_hw_change(struct ktermios *a, struct ktermios *b)
+{
+        if (a->c_ispeed != b->c_ispeed || a->c_ospeed != b->c_ospeed)
+                return 1;
+        if ((a->c_cflag ^ b->c_cflag) & ~(HUPCL | CREAD | CLOCAL))
+                return 1;
+        return 0;
+}
+EXPORT_SYMBOL(tty_termios_hw_change);
+
+/**
  *      change_termios          -       update termios values
  *      @tty: tty to update
  *      @new_termios: desired new value
diff --git a/drivers/connector/cn_queue.c b/drivers/connector/cn_queue.c
index 296f51002b55..12ceed54ab18 100644
--- a/drivers/connector/cn_queue.c
+++ b/drivers/connector/cn_queue.c
@@ -99,8 +99,8 @@ int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id
         spin_unlock_bh(&dev->queue_lock);
 
         if (found) {
-                atomic_dec(&dev->refcnt);
                 cn_queue_free_callback(cbq);
+                atomic_dec(&dev->refcnt);
                 return -EINVAL;
         }
 
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index a337b693b6c9..5f7e71810489 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -429,8 +429,8 @@ static inline void padlock_xcrypt(const u8 *input, u8 *output, void *key,
 
 static void aes_crypt_copy(const u8 *in, u8 *out, u32 *key, struct cword *cword)
 {
-        u8 tmp[AES_BLOCK_SIZE * 2]
-                __attribute__ ((__aligned__(PADLOCK_ALIGNMENT)));
+        u8 buf[AES_BLOCK_SIZE * 2 + PADLOCK_ALIGNMENT - 1];
+        u8 *tmp = PTR_ALIGN(&buf[0], PADLOCK_ALIGNMENT);
 
         memcpy(tmp, in, AES_BLOCK_SIZE);
         padlock_xcrypt(tmp, out, key, cword);
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index b6e1eb77d148..bc132d8f79cb 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c
@@ -175,12 +175,11 @@ static struct device *dmi_dev;
 
 extern int dmi_available;
 
-static int __init dmi_id_init(void)
+/* In a separate function to keep gcc 3.2 happy - do NOT merge this in
+   dmi_id_init! */
+static void __init dmi_id_init_attr_table(void)
 {
-        int ret, i;
-
-        if (!dmi_available)
-                return -ENODEV;
+        int i;
 
         /* Not necessarily all DMI fields are available on all
          * systems, hence let's built an attribute table of just
@@ -205,6 +204,16 @@ static int __init dmi_id_init(void)
         ADD_DMI_ATTR(chassis_serial,    DMI_CHASSIS_SERIAL);
         ADD_DMI_ATTR(chassis_asset_tag, DMI_CHASSIS_ASSET_TAG);
         sys_dmi_attributes[i++] = &sys_dmi_modalias_attr.attr;
+}
+
+static int __init dmi_id_init(void)
+{
+        int ret;
+
+        if (!dmi_available)
+                return -ENODEV;
+
+        dmi_id_init_attr_table();
 
         ret = class_register(&dmi_class);
         if (ret)
diff --git a/drivers/ide/ide-acpi.c b/drivers/ide/ide-acpi.c
index 89df48fdc69d..899d56536e80 100644
--- a/drivers/ide/ide-acpi.c
+++ b/drivers/ide/ide-acpi.c
@@ -16,6 +16,7 @@
 #include <acpi/acpi.h>
 #include <linux/ide.h>
 #include <linux/pci.h>
+#include <linux/dmi.h>
 
 #include <acpi/acpi_bus.h>
 #include <acpi/acnames.h>
@@ -65,6 +66,39 @@ extern int ide_noacpi;
 extern int ide_noacpitfs;
 extern int ide_noacpionboot;
 
+static bool ide_noacpi_psx;
+static int no_acpi_psx(const struct dmi_system_id *id)
+{
+        ide_noacpi_psx = true;
+        printk(KERN_NOTICE"%s detected - disable ACPI _PSx.\n", id->ident);
+        return 0;
+}
+
+static const struct dmi_system_id ide_acpi_dmi_table[] = {
+        /* Bug 9673. */
+        /* We should check if this is because ACPI NVS isn't save/restored. */
+        {
+                .callback = no_acpi_psx,
+                .ident    = "HP nx9005",
+                .matches  = {
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies Ltd."),
+                        DMI_MATCH(DMI_BIOS_VERSION, "KAM1.60")
+                },
+        },
+
+        { }     /* terminate list */
+};
+
+static int ide_acpi_blacklist(void)
+{
+        static int done;
+        if (done)
+                return 0;
+        done = 1;
+        dmi_check_system(ide_acpi_dmi_table);
+        return 0;
+}
+
 /**
  * ide_get_dev_handle - finds acpi_handle and PCI device.function
  * @dev: device to locate
@@ -623,7 +657,7 @@ void ide_acpi_set_state(ide_hwif_t *hwif, int on)
 {
         int unit;
 
-        if (ide_noacpi)
+        if (ide_noacpi || ide_noacpi_psx)
                 return;
 
         DEBPRINT("ENTER:\n");
@@ -668,6 +702,8 @@ void ide_acpi_init(ide_hwif_t *hwif)
         struct ide_acpi_drive_link      *master;
         struct ide_acpi_drive_link      *slave;
 
+        ide_acpi_blacklist();
+
         hwif->acpidata = kzalloc(sizeof(struct ide_acpi_hwif_link), GFP_KERNEL);
         if (!hwif->acpidata)
                 return;
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index cef405ddaf0e..bb9693dabe41 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -612,12 +612,12 @@ u8 eighty_ninty_three (ide_drive_t *drive)
                 printk(KERN_DEBUG "%s: skipping word 93 validity check\n",
                                   drive->name);
 
+        if (ide_dev_is_sata(id) && !ivb)
+                return 1;
+
         if (hwif->cbl != ATA_CBL_PATA80 && !ivb)
                 goto no_80w;
 
-        if (ide_dev_is_sata(id))
-                return 1;
-
         /*
          * FIXME:
          * - force bit13 (80c cable present) check also for !ivb devices
diff --git a/drivers/ide/pci/trm290.c b/drivers/ide/pci/trm290.c
index 0895e753a35d..0151d7fdfb8a 100644
--- a/drivers/ide/pci/trm290.c
+++ b/drivers/ide/pci/trm290.c
@@ -1,7 +1,8 @@
 /*
- *  linux/drivers/ide/pci/trm290.c              Version 1.02    Mar. 18, 2000
+ *  linux/drivers/ide/pci/trm290.c              Version 1.05    Dec. 26, 2007
  *
  *  Copyright (c) 1997-1998  Mark Lord
+ *  Copyright (c) 2007       MontaVista Software, Inc. <source@mvista.com>
  *  May be copied or modified under the terms of the GNU General Public License
  *
  *  June 22, 2004 - get rid of check_region
@@ -177,7 +178,7 @@ static void trm290_selectproc (ide_drive_t *drive)
         trm290_prepare_drive(drive, drive->using_dma);
 }
 
-static void trm290_ide_dma_exec_cmd(ide_drive_t *drive, u8 command)
+static void trm290_dma_exec_cmd(ide_drive_t *drive, u8 command)
 {
         BUG_ON(HWGROUP(drive)->handler != NULL);        /* paranoia check */
         ide_set_handler(drive, &ide_dma_intr, WAIT_CMD, NULL);
@@ -185,7 +186,7 @@ static void trm290_ide_dma_exec_cmd(ide_drive_t *drive, u8 command)
         outb(command, IDE_COMMAND_REG);
 }
 
-static int trm290_ide_dma_setup(ide_drive_t *drive)
+static int trm290_dma_setup(ide_drive_t *drive)
 {
         ide_hwif_t *hwif = drive->hwif;
         struct request *rq = hwif->hwgroup->rq;
@@ -215,7 +216,7 @@ static int trm290_ide_dma_setup(ide_drive_t *drive)
         return 0;
 }
 
-static void trm290_ide_dma_start(ide_drive_t *drive)
+static void trm290_dma_start(ide_drive_t *drive)
 {
 }
 
@@ -240,6 +241,14 @@ static int trm290_ide_dma_test_irq (ide_drive_t *drive)
         return (status == 0x00ff);
 }
 
+static void trm290_dma_host_on(ide_drive_t *drive)
+{
+}
+
+static void trm290_dma_host_off(ide_drive_t *drive)
+{
+}
+
 static void __devinit init_hwif_trm290(ide_hwif_t *hwif)
 {
         unsigned int cfgbase = 0;
@@ -280,11 +289,13 @@ static void __devinit init_hwif_trm290(ide_hwif_t *hwif)
 
         ide_setup_dma(hwif, (hwif->config_data + 4) ^ (hwif->channel ? 0x0080 : 0x0000), 3);
 
-        hwif->dma_setup = &trm290_ide_dma_setup;
-        hwif->dma_exec_cmd = &trm290_ide_dma_exec_cmd;
-        hwif->dma_start = &trm290_ide_dma_start;
-        hwif->ide_dma_end = &trm290_ide_dma_end;
-        hwif->ide_dma_test_irq = &trm290_ide_dma_test_irq;
+        hwif->dma_host_off      = &trm290_dma_host_off;
+        hwif->dma_host_on       = &trm290_dma_host_on;
+        hwif->dma_setup         = &trm290_dma_setup;
+        hwif->dma_exec_cmd      = &trm290_dma_exec_cmd;
+        hwif->dma_start         = &trm290_dma_start;
+        hwif->ide_dma_end       = &trm290_ide_dma_end;
+        hwif->ide_dma_test_irq  = &trm290_ide_dma_test_irq;
 
         hwif->selectproc = &trm290_selectproc;
 #if 1
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 8bf44daf45ec..9d32c49cc651 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -430,7 +430,7 @@ static int mlx4_ib_poll_one(struct mlx4_ib_cq *cq,
                 wc->dlid_path_bits = (be32_to_cpu(cqe->g_mlpath_rqpn) >> 24) & 0x7f;
                 wc->wc_flags      |= be32_to_cpu(cqe->g_mlpath_rqpn) & 0x80000000 ?
                         IB_WC_GRH : 0;
-                wc->pkey_index     = be32_to_cpu(cqe->immed_rss_invalid) >> 16;
+                wc->pkey_index     = be32_to_cpu(cqe->immed_rss_invalid) & 0x7f;
         }
 
         return 0;
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 77e8b90dfbff..bdb6f8517401 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -2053,8 +2053,8 @@ static void srp_remove_one(struct ib_device *device)
 
                 list_for_each_entry_safe(target, tmp_target,
                                          &host->target_list, list) {
-                        scsi_remove_host(target->scsi_host);
                         srp_remove_host(target->scsi_host);
+                        scsi_remove_host(target->scsi_host);
                         srp_disconnect_target(target);
                         ib_destroy_cm_id(target->cm_id);
                         srp_free_target_ib(target);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index a5aad8cad843..e8c8157b02fc 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2865,7 +2865,8 @@ static void handle_stripe5(struct stripe_head *sh)
                 md_done_sync(conf->mddev, STRIPE_SECTORS, 1);
         }
 
-        if (s.expanding && s.locked == 0)
+        if (s.expanding && s.locked == 0 &&
+            !test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending))
                 handle_stripe_expansion(conf, sh, NULL);
 
         if (sh->ops.count)
@@ -3067,7 +3068,8 @@ static void handle_stripe6(struct stripe_head *sh, struct page *tmp_page)
                 md_done_sync(conf->mddev, STRIPE_SECTORS, 1);
         }
 
-        if (s.expanding && s.locked == 0)
+        if (s.expanding && s.locked == 0 &&
+            !test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending))
                 handle_stripe_expansion(conf, sh, &r6s);
 
         spin_unlock(&sh->lock);
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index c02d92deacd2..581a3c955739 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -3063,11 +3063,10 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
                 struct video_mbuf *mbuf = arg;
                 unsigned int i;
 
-                mutex_lock(&fh->cap.lock);
                 retval = videobuf_mmap_setup(&fh->cap,gbuffers,gbufsize,
                                              V4L2_MEMORY_MMAP);
                 if (retval < 0)
-                        goto fh_unlock_and_return;
+                        return retval;
 
                 gbuffers = retval;
                 memset(mbuf,0,sizeof(*mbuf));
@@ -3075,7 +3074,6 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
                 mbuf->size   = gbuffers * gbufsize;
                 for (i = 0; i < gbuffers; i++)
                         mbuf->offsets[i] = i * gbufsize;
-                mutex_unlock(&fh->cap.lock);
                 return 0;
         }
         case VIDIOCMCAPTURE:
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index 6d2dd8764f81..10d6faf8ccda 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -1076,6 +1076,10 @@ static int __devinit ivtv_probe(struct pci_dev *dev,
                 ivtv_process_eeprom(itv);
         }
 
+        /* The mspx4xx chips need a longer delay for some reason */
+        if (!(itv->hw_flags & IVTV_HW_MSP34XX))
+                itv->i2c_algo.udelay = 5;
+
         if (itv->std == 0) {
                 itv->std = V4L2_STD_NTSC_M;
         }
diff --git a/drivers/media/video/ivtv/ivtv-i2c.c b/drivers/media/video/ivtv/ivtv-i2c.c
index 44678fe27a04..36e54f78aa2a 100644
--- a/drivers/media/video/ivtv/ivtv-i2c.c
+++ b/drivers/media/video/ivtv/ivtv-i2c.c
@@ -541,7 +541,7 @@ static const struct i2c_algo_bit_data ivtv_i2c_algo_template = {
         .setscl         = ivtv_setscl_old,
         .getsda         = ivtv_getsda_old,
         .getscl         = ivtv_getscl_old,
-        .udelay         = 5,
+        .udelay         = 10,
         .timeout        = 200,
 };
 
@@ -718,9 +718,6 @@ int init_ivtv_i2c(struct ivtv *itv)
                        sizeof(struct i2c_adapter));
                 memcpy(&itv->i2c_algo, &ivtv_i2c_algo_template,
                        sizeof(struct i2c_algo_bit_data));
-                /* The mspx4xx chips need a longer delay for some reason */
-                if (itv->hw_flags & IVTV_HW_MSP34XX)
-                        itv->i2c_algo.udelay = 10;
                 itv->i2c_algo.data = itv;
                 itv->i2c_adap.algo_data = &itv->i2c_algo;
         }
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index a9eb1c516247..1707f98c322c 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -1504,9 +1504,12 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         int ret, wbufsize, word_gap, words;
         const struct kvec *vec;
         unsigned long vec_seek;
+        unsigned long initial_adr;
+        int initial_len = len;
 
         wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
         adr += chip->start;
+        initial_adr = adr;
         cmd_adr = adr & ~(wbufsize-1);
 
         /* Let's determine this according to the interleave only once */
@@ -1519,7 +1522,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
                 return ret;
         }
 
-        XIP_INVAL_CACHED_RANGE(map, adr, len);
+        XIP_INVAL_CACHED_RANGE(map, initial_adr, initial_len);
         ENABLE_VPP(map);
         xip_disable(map, chip, cmd_adr);
 
@@ -1610,7 +1613,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         chip->state = FL_WRITING;
 
         ret = INVAL_CACHE_AND_WAIT(map, chip, cmd_adr,
-                                   adr, len,
+                                   initial_adr, initial_len,
                                    chip->buffer_write_time);
         if (ret) {
                 map_write(map, CMD(0x70), cmd_adr);
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 2b06e4b4dabc..b87402bc8308 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1991,13 +1991,12 @@ static int e100_poll(struct napi_struct *napi, int budget)
         struct nic *nic = container_of(napi, struct nic, napi);
         struct net_device *netdev = nic->netdev;
         unsigned int work_done = 0;
-        int tx_cleaned;
 
         e100_rx_clean(nic, &work_done, budget);
-        tx_cleaned = e100_tx_clean(nic);
+        e100_tx_clean(nic);
 
-        /* If no Rx and Tx cleanup work was done, exit polling mode. */
-        if((!tx_cleaned && (work_done == 0)) || !netif_running(netdev)) {
+        /* If budget not fully consumed, exit the polling mode */
+        if (work_done < budget) {
                 netif_rx_complete(netdev, napi);
                 e100_enable_irq(nic);
         }
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 4f37506ad374..13d57b0a88fa 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3919,32 +3919,26 @@ e1000_clean(struct napi_struct *napi, int budget)
 {
         struct e1000_adapter *adapter = container_of(napi, struct e1000_adapter, napi);
         struct net_device *poll_dev = adapter->netdev;
-        int tx_cleaned = 0, work_done = 0;
+        int work_done = 0;
 
         /* Must NOT use netdev_priv macro here. */
         adapter = poll_dev->priv;
 
-        /* Keep link state information with original netdev */
-        if (!netif_carrier_ok(poll_dev))
-                goto quit_polling;
-
         /* e1000_clean is called per-cpu.  This lock protects
          * tx_ring[0] from being cleaned by multiple cpus
          * simultaneously.  A failure obtaining the lock means
          * tx_ring[0] is currently being cleaned anyway. */
         if (spin_trylock(&adapter->tx_queue_lock)) {
-                tx_cleaned = e1000_clean_tx_irq(adapter,
-                                                &adapter->tx_ring[0]);
+                e1000_clean_tx_irq(adapter,
+                                   &adapter->tx_ring[0]);
                 spin_unlock(&adapter->tx_queue_lock);
         }
 
         adapter->clean_rx(adapter, &adapter->rx_ring[0],
                           &work_done, budget);
 
-        /* If no Tx and not enough Rx work done, exit the polling mode */
-        if ((!tx_cleaned && (work_done == 0)) ||
-           !netif_running(poll_dev)) {
-quit_polling:
+        /* If budget not fully consumed, exit the polling mode */
+        if (work_done < budget) {
                 if (likely(adapter->itr_setting & 3))
                         e1000_set_itr(adapter);
                 netif_rx_complete(poll_dev, napi);
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 4fd2e23720b6..4a6fc7453776 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -1384,30 +1384,24 @@ static int e1000_clean(struct napi_struct *napi, int budget)
 {
         struct e1000_adapter *adapter = container_of(napi, struct e1000_adapter, napi);
         struct net_device *poll_dev = adapter->netdev;
-        int tx_cleaned = 0, work_done = 0;
+        int work_done = 0;
 
         /* Must NOT use netdev_priv macro here. */
         adapter = poll_dev->priv;
 
-        /* Keep link state information with original netdev */
-        if (!netif_carrier_ok(poll_dev))
-                goto quit_polling;
-
         /* e1000_clean is called per-cpu.  This lock protects
          * tx_ring from being cleaned by multiple cpus
          * simultaneously.  A failure obtaining the lock means
          * tx_ring is currently being cleaned anyway. */
         if (spin_trylock(&adapter->tx_queue_lock)) {
-                tx_cleaned = e1000_clean_tx_irq(adapter);
+                e1000_clean_tx_irq(adapter);
                 spin_unlock(&adapter->tx_queue_lock);
         }
 
         adapter->clean_rx(adapter, &work_done, budget);
 
-        /* If no Tx and not enough Rx work done, exit the polling mode */
-        if ((!tx_cleaned && (work_done < budget)) ||
-           !netif_running(poll_dev)) {
-quit_polling:
+        /* If budget not fully consumed, exit the polling mode */
+        if (work_done < budget) {
                 if (adapter->itr_setting & 3)
                         e1000_set_itr(adapter);
                 netif_rx_complete(poll_dev, napi);
diff --git a/drivers/net/epic100.c b/drivers/net/epic100.c
index ecdd3fc8d70c..0b365b8d947b 100644
--- a/drivers/net/epic100.c
+++ b/drivers/net/epic100.c
@@ -1273,7 +1273,7 @@ rx_action:
 
         epic_rx_err(dev, ep);
 
-        if (netif_running(dev) && (work_done < budget)) {
+        if (work_done < budget) {
                 unsigned long flags;
                 int more;
 
diff --git a/drivers/net/fec_8xx/fec_main.c b/drivers/net/fec_8xx/fec_main.c
index 8d2904fa5789..ab9637ab3a8d 100644
--- a/drivers/net/fec_8xx/fec_main.c
+++ b/drivers/net/fec_8xx/fec_main.c
@@ -476,11 +476,6 @@ static int fec_enet_rx_common(struct fec_enet_private *ep,
         __u16 pkt_len, sc;
         int curidx;
 
-        if (fpi->use_napi) {
-                if (!netif_running(dev))
-                        return 0;
-        }
-
         /*
          * First, grab all of the stats for the incoming packet.
          * These get messed up if we get called due to a busy condition.
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index a96583cceb5e..f84c752997a4 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5199,10 +5199,6 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 dev->dev_addr[3] = (np->orig_mac[0] >> 16) & 0xff;
                 dev->dev_addr[4] = (np->orig_mac[0] >>  8) & 0xff;
                 dev->dev_addr[5] = (np->orig_mac[0] >>  0) & 0xff;
-                /* set permanent address to be correct aswell */
-                np->orig_mac[0] = (dev->dev_addr[0] << 0) + (dev->dev_addr[1] << 8) +
-                        (dev->dev_addr[2] << 16) + (dev->dev_addr[3] << 24);
-                np->orig_mac[1] = (dev->dev_addr[4] << 0) + (dev->dev_addr[5] << 8);
                 writel(txreg|NVREG_TRANSMITPOLL_MAC_ADDR_REV, base + NvRegTransmitPoll);
         }
         memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
@@ -5414,6 +5410,8 @@ static void __devexit nv_remove(struct pci_dev *pci_dev)
          */
         writel(np->orig_mac[0], base + NvRegMacAddrA);
         writel(np->orig_mac[1], base + NvRegMacAddrB);
+        writel(readl(base + NvRegTransmitPoll) & ~NVREG_TRANSMITPOLL_MAC_ADDR_REV,
+               base + NvRegTransmitPoll);
 
         /* free all structures */
         free_rings(dev);
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index f2a4d399a6e5..3e1a57a42f11 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -96,9 +96,6 @@ static int fs_enet_rx_napi(struct napi_struct *napi, int budget)
         u16 pkt_len, sc;
         int curidx;
 
-        if (!netif_running(dev))
-                return 0;
-
         /*
          * First, grab all of the stats for the incoming packet.
          * These get messed up if we get called due to a busy condition.
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index bf9085fe035a..d2fb88d5cda2 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -1787,14 +1787,13 @@ ixgb_clean(struct napi_struct *napi, int budget)
 {
         struct ixgb_adapter *adapter = container_of(napi, struct ixgb_adapter, napi);
         struct net_device *netdev = adapter->netdev;
-        int tx_cleaned;
         int work_done = 0;
 
-        tx_cleaned = ixgb_clean_tx_irq(adapter);
+        ixgb_clean_tx_irq(adapter);
         ixgb_clean_rx_irq(adapter, &work_done, budget);
 
-        /* if no Tx and not enough Rx work done, exit the polling mode */
-        if((!tx_cleaned && (work_done == 0)) || !netif_running(netdev)) {
+        /* If budget not fully consumed, exit the polling mode */
+        if (work_done < budget) {
                 netif_rx_complete(netdev, napi);
                 ixgb_irq_enable(adapter);
         }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 00bc525c6560..a56491617661 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1468,21 +1468,15 @@ static int ixgbe_clean(struct napi_struct *napi, int budget)
         struct ixgbe_adapter *adapter = container_of(napi,
                                         struct ixgbe_adapter, napi);
         struct net_device *netdev = adapter->netdev;
-        int tx_cleaned = 0, work_done = 0;
-
-        /* Keep link state information with original netdev */
-        if (!netif_carrier_ok(adapter->netdev))
-                goto quit_polling;
+        int work_done = 0;
 
         /* In non-MSIX case, there is no multi-Tx/Rx queue */
-        tx_cleaned = ixgbe_clean_tx_irq(adapter, adapter->tx_ring);
+        ixgbe_clean_tx_irq(adapter, adapter->tx_ring);
         ixgbe_clean_rx_irq(adapter, &adapter->rx_ring[0], &work_done,
                            budget);
 
-        /* If no Tx and not enough Rx work done, exit the polling mode */
-        if ((!tx_cleaned && (work_done < budget)) ||
-            !netif_running(adapter->netdev)) {
-quit_polling:
+        /* If budget not fully consumed, exit the polling mode */
+        if (work_done < budget) {
                 netif_rx_complete(netdev, napi);
                 ixgbe_irq_enable(adapter);
         }
diff --git a/drivers/net/ixp2000/ixpdev.c b/drivers/net/ixp2000/ixpdev.c
index 6c0dd49149d0..484cb2ba717f 100644
--- a/drivers/net/ixp2000/ixpdev.c
+++ b/drivers/net/ixp2000/ixpdev.c
@@ -135,8 +135,6 @@ static int ixpdev_poll(struct napi_struct *napi, int budget)
         struct net_device *dev = ip->dev;
         int rx;
 
-        /* @@@ Have to stop polling when nds[0] is administratively
-         * downed while we are polling.  */
         rx = 0;
         do {
                 ixp2000_reg_write(IXP2000_IRQ_THD_RAW_STATUS_A_0, 0x00ff);
diff --git a/drivers/net/meth.c b/drivers/net/meth.c
index 0c89b028a80c..cdaa8fc21809 100644
--- a/drivers/net/meth.c
+++ b/drivers/net/meth.c
@@ -95,11 +95,14 @@ static inline void load_eaddr(struct net_device *dev)
 {
         int i;
         DECLARE_MAC_BUF(mac);
+        u64 macaddr;
 
-        for (i = 0; i < 6; i++)
-                dev->dev_addr[i] = o2meth_eaddr[i];
         DPRINTK("Loading MAC Address: %s\n", print_mac(mac, dev->dev_addr));
-        mace->eth.mac_addr = (*(unsigned long*)o2meth_eaddr) >> 16;
+        macaddr = 0;
+        for (i = 0; i < 6; i++)
+                macaddr |= dev->dev_addr[i] << ((5 - i) * 8);
+
+        mace->eth.mac_addr = macaddr;
 }
 
 /*
@@ -794,6 +797,7 @@ static int __init meth_probe(struct platform_device *pdev)
 #endif
         dev->irq             = MACE_ETHERNET_IRQ;
         dev->base_addr       = (unsigned long)&mace->eth;
+        memcpy(dev->dev_addr, o2meth_eaddr, 6);
 
         priv = netdev_priv(dev);
         spin_lock_init(&priv->meth_lock);
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 8def8657251f..c90958f6d3fe 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -1239,7 +1239,7 @@ static int myri10ge_poll(struct napi_struct *napi, int budget)
         /* process as many rx events as NAPI will allow */
         work_done = myri10ge_clean_rx_done(mgp, budget);
 
-        if (work_done < budget || !netif_running(netdev)) {
+        if (work_done < budget) {
                 netif_rx_complete(netdev, napi);
                 put_be32(htonl(3), mgp->irq_claim);
         }
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 87cde062fd63..c329a4f5840c 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -2266,7 +2266,7 @@ static int natsemi_poll(struct napi_struct *napi, int budget)
         /* Reenable interrupts providing nothing is trying to shut
          * the chip down. */
         spin_lock(&np->lock);
-        if (!np->hands_off && netif_running(dev))
+        if (!np->hands_off)
                 natsemi_irq_enable(dev);
         spin_unlock(&np->lock);
 
diff --git a/drivers/net/netx-eth.c b/drivers/net/netx-eth.c
index 5267e031daa0..78d34af13a1c 100644
--- a/drivers/net/netx-eth.c
+++ b/drivers/net/netx-eth.c
@@ -169,8 +169,8 @@ static void netx_eth_receive(struct net_device *ndev)
         ndev->last_rx = jiffies;
         skb->protocol = eth_type_trans(skb, ndev);
         netif_rx(skb);
-        dev->stats.rx_packets++;
-        dev->stats.rx_bytes += len;
+        ndev->stats.rx_packets++;
+        ndev->stats.rx_bytes += len;
 }
 
 static irqreturn_t
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index a80f0cd6b528..454226f7baa8 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1321,7 +1321,7 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
                                                      budget / MAX_RCV_CTX);
         }
 
-        if (work_done >= budget && netxen_nic_rx_has_work(adapter) != 0)
+        if (work_done >= budget)
                 done = 0;
 
         if (netxen_process_cmd_ring((unsigned long)adapter) == 0)
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index abfc61c3a38c..9a0c6d3adfe9 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -33,8 +33,8 @@
 
 #define DRV_MODULE_NAME         "niu"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "0.5"
-#define DRV_MODULE_RELDATE      "October 5, 2007"
+#define DRV_MODULE_VERSION      "0.6"
+#define DRV_MODULE_RELDATE      "January 5, 2008"
 
 static char version[] __devinitdata =
         DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
@@ -2241,6 +2241,8 @@ static int niu_process_rx_pkt(struct niu *np, struct rx_ring_info *rp)
         skb->protocol = eth_type_trans(skb, np->dev);
         netif_receive_skb(skb);
 
+        np->dev->last_rx = jiffies;
+
         return num_rcr;
 }
 
@@ -2508,15 +2510,19 @@ static int niu_rx_error(struct niu *np, struct rx_ring_info *rp)
         u64 stat = nr64(RX_DMA_CTL_STAT(rp->rx_channel));
         int err = 0;
 
-        dev_err(np->device, PFX "%s: RX channel %u error, stat[%llx]\n",
-                np->dev->name, rp->rx_channel, (unsigned long long) stat);
-
-        niu_log_rxchan_errors(np, rp, stat);
 
         if (stat & (RX_DMA_CTL_STAT_CHAN_FATAL |
                     RX_DMA_CTL_STAT_PORT_FATAL))
                 err = -EINVAL;
 
+        if (err) {
+                dev_err(np->device, PFX "%s: RX channel %u error, stat[%llx]\n",
+                        np->dev->name, rp->rx_channel,
+                        (unsigned long long) stat);
+
+                niu_log_rxchan_errors(np, rp, stat);
+        }
+
         nw64(RX_DMA_CTL_STAT(rp->rx_channel),
              stat & RX_DMA_CTL_WRITE_CLEAR_ERRS);
 
@@ -2749,13 +2755,16 @@ static int niu_device_error(struct niu *np)
         return -ENODEV;
 }
 
-static int niu_slowpath_interrupt(struct niu *np, struct niu_ldg *lp)
+static int niu_slowpath_interrupt(struct niu *np, struct niu_ldg *lp,
+                              u64 v0, u64 v1, u64 v2)
 {
-        u64 v0 = lp->v0;
-        u64 v1 = lp->v1;
-        u64 v2 = lp->v2;
+
         int i, err = 0;
 
+        lp->v0 = v0;
+        lp->v1 = v1;
+        lp->v2 = v2;
+
         if (v1 & 0x00000000ffffffffULL) {
                 u32 rx_vec = (v1 & 0xffffffff);
 
@@ -2764,8 +2773,13 @@ static int niu_slowpath_interrupt(struct niu *np, struct niu_ldg *lp)
 
                         if (rx_vec & (1 << rp->rx_channel)) {
                                 int r = niu_rx_error(np, rp);
-                                if (r)
+                                if (r) {
                                         err = r;
+                                } else {
+                                        if (!v0)
+                                                nw64(RX_DMA_CTL_STAT(rp->rx_channel),
+                                                     RX_DMA_CTL_STAT_MEX);
+                                }
                         }
                 }
         }
@@ -2803,7 +2817,7 @@ static int niu_slowpath_interrupt(struct niu *np, struct niu_ldg *lp)
         if (err)
                 niu_enable_interrupts(np, 0);
 
-        return -EINVAL;
+        return err;
 }
 
 static void niu_rxchan_intr(struct niu *np, struct rx_ring_info *rp,
@@ -2905,7 +2919,7 @@ static irqreturn_t niu_interrupt(int irq, void *dev_id)
         }
 
         if (unlikely((v0 & ((u64)1 << LDN_MIF)) || v1 || v2)) {
-                int err = niu_slowpath_interrupt(np, lp);
+                int err = niu_slowpath_interrupt(np, lp, v0, v1, v2);
                 if (err)
                         goto out;
         }
@@ -5194,7 +5208,8 @@ static int niu_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
                 kfree_skb(skb);
                 skb = skb_new;
-        }
+        } else
+                skb_orphan(skb);
 
         align = ((unsigned long) skb->data & (16 - 1));
         headroom = align + sizeof(struct tx_pkt_hdr);
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index ff92aca0a7b3..90498ffe26f2 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -455,9 +455,14 @@ static void pcnet32_netif_start(struct net_device *dev)
 {
 #ifdef CONFIG_PCNET32_NAPI
         struct pcnet32_private *lp = netdev_priv(dev);
+        ulong ioaddr = dev->base_addr;
+        u16 val;
 #endif
         netif_wake_queue(dev);
 #ifdef CONFIG_PCNET32_NAPI
+        val = lp->a.read_csr(ioaddr, CSR3);
+        val &= 0x00ff;
+        lp->a.write_csr(ioaddr, CSR3, val);
         napi_enable(&lp->napi);
 #endif
 }
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index a5791114b7bd..cf0774de6c41 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -2320,14 +2320,9 @@ static int ql_poll(struct napi_struct *napi, int budget)
         unsigned long hw_flags;
         struct ql3xxx_port_registers __iomem *port_regs = qdev->mem_map_registers;
 
-        if (!netif_carrier_ok(ndev))
-                goto quit_polling;
-
         ql_tx_rx_clean(qdev, &tx_cleaned, &rx_cleaned, budget);
 
-        if (tx_cleaned + rx_cleaned != budget ||
-            !netif_running(ndev)) {
-quit_polling:
+        if (tx_cleaned + rx_cleaned != budget) {
                 spin_lock_irqsave(&qdev->hw_lock, hw_flags);
                 __netif_rx_complete(ndev, napi);
                 ql_update_small_bufq_prod_index(qdev);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 5863190894cc..af8030981f10 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2398,6 +2398,8 @@ static void rtl8169_wait_for_quiescence(struct net_device *dev)
         rtl8169_irq_mask_and_ack(ioaddr);
 
 #ifdef CONFIG_R8169_NAPI
+        tp->intr_mask = 0xffff;
+        RTL_W16(IntrMask, tp->intr_event);
         napi_enable(&tp->napi);
 #endif
 }
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 9d80f1cf73ac..fa57c49c0c51 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -2704,9 +2704,6 @@ static int s2io_poll(struct napi_struct *napi, int budget)
         struct XENA_dev_config __iomem *bar0 = nic->bar0;
         int i;
 
-        if (!is_s2io_card_up(nic))
-                return 0;
-
         mac_control = &nic->mac_control;
         config = &nic->config;
 
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index a74fc11a6482..52ec89b82f64 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1168,6 +1168,7 @@ static void sky2_vlan_rx_register(struct net_device *dev, struct vlan_group *grp
                              TX_VLAN_TAG_OFF);
         }
 
+        sky2_read32(hw, B0_Y2_SP_LISR);
         napi_enable(&hw->napi);
         netif_tx_unlock_bh(dev);
 }
@@ -2043,6 +2044,7 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
         err = sky2_rx_start(sky2);
         sky2_write32(hw, B0_IMSK, imask);
 
+        sky2_read32(hw, B0_Y2_SP_LISR);
         napi_enable(&hw->napi);
 
         if (err)
@@ -3861,6 +3863,7 @@ static int sky2_debug_show(struct seq_file *seq, void *v)
                    last = sky2_read16(hw, Y2_QADDR(rxqaddr[port], PREF_UNIT_PUT_IDX)),
                    sky2_read16(hw, Y2_QADDR(rxqaddr[port], PREF_UNIT_LAST_IDX)));
 
+        sky2_read32(hw, B0_Y2_SP_LISR);
         napi_enable(&hw->napi);
         return 0;
 }
diff --git a/drivers/net/tulip/interrupt.c b/drivers/net/tulip/interrupt.c
index 365331446387..6284afd14bbb 100644
--- a/drivers/net/tulip/interrupt.c
+++ b/drivers/net/tulip/interrupt.c
@@ -117,9 +117,6 @@ int tulip_poll(struct napi_struct *napi, int budget)
         int received = 0;
 #endif
 
-        if (!netif_running(dev))
-                goto done;
-
 #ifdef CONFIG_TULIP_NAPI_HW_MITIGATION
 
 /* that one buffer is needed for mit activation; or might be a
@@ -151,7 +148,8 @@ int tulip_poll(struct napi_struct *napi, int budget)
                        if (tulip_debug > 5)
                                printk(KERN_DEBUG "%s: In tulip_rx(), entry %d %8.8x.\n",
                                       dev->name, entry, status);
-                       if (work_done++ >= budget)
+
+                       if (++work_done >= budget)
                                goto not_done;
 
                        if ((status & 0x38008300) != 0x0300) {
@@ -260,8 +258,6 @@ int tulip_poll(struct napi_struct *napi, int budget)
                 * finally: amount of IO did not increase at all. */
        } while ((ioread32(tp->base_addr + CSR5) & RxIntr));
 
-done:
-
  #ifdef CONFIG_TULIP_NAPI_HW_MITIGATION
 
           /* We use this simplistic scheme for IM. It's proven by
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 58a53a641754..569ad8bfd383 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -70,7 +70,7 @@
 #define KAWETH_TX_TIMEOUT               (5 * HZ)
 #define KAWETH_SCRATCH_SIZE             32
 #define KAWETH_FIRMWARE_BUF_SIZE        4096
-#define KAWETH_CONTROL_TIMEOUT          (30 * HZ)
+#define KAWETH_CONTROL_TIMEOUT          (30000)
 
 #define KAWETH_STATUS_BROKEN            0x0000001
 #define KAWETH_STATUS_CLOSING           0x0000002
diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
index f55a5951733a..5ea7411e1337 100644
--- a/drivers/net/usb/mcs7830.c
+++ b/drivers/net/usb/mcs7830.c
@@ -94,7 +94,7 @@ static int mcs7830_get_reg(struct usbnet *dev, u16 index, u16 size, void *data)
 
         ret = usb_control_msg(xdev, usb_rcvctrlpipe(xdev, 0), MCS7830_RD_BREQ,
                               MCS7830_RD_BMREQ, 0x0000, index, data,
-                              size, msecs_to_jiffies(MCS7830_CTRL_TIMEOUT));
+                              size, MCS7830_CTRL_TIMEOUT);
         return ret;
 }
 
@@ -105,7 +105,7 @@ static int mcs7830_set_reg(struct usbnet *dev, u16 index, u16 size, void *data)
 
         ret = usb_control_msg(xdev, usb_sndctrlpipe(xdev, 0), MCS7830_WR_BREQ,
                               MCS7830_WR_BMREQ, 0x0000, index, data,
-                              size, msecs_to_jiffies(MCS7830_CTRL_TIMEOUT));
+                              size, MCS7830_CTRL_TIMEOUT);
         return ret;
 }
 
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index a28ad230d63e..7b6fc1ab2b90 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -273,6 +273,8 @@ enum {
 #define B43_PHYTYPE_A                   0x00
 #define B43_PHYTYPE_B                   0x01
 #define B43_PHYTYPE_G                   0x02
+#define B43_PHYTYPE_N                   0x04
+#define B43_PHYTYPE_LP                  0x05
 
 /* PHYRegisters */
 #define B43_PHY_ILT_A_CTRL              0x0072
diff --git a/drivers/net/wireless/b43/main.h b/drivers/net/wireless/b43/main.h
index 284d17da17d1..08e2e56e48f4 100644
--- a/drivers/net/wireless/b43/main.h
+++ b/drivers/net/wireless/b43/main.h
@@ -39,11 +39,11 @@
 #define PAD_BYTES(nr_bytes)             P4D_BYTES( __LINE__ , (nr_bytes))
 
 /* Lightweight function to convert a frequency (in Mhz) to a channel number. */
-static inline u8 b43_freq_to_channel_a(int freq)
+static inline u8 b43_freq_to_channel_5ghz(int freq)
 {
         return ((freq - 5000) / 5);
 }
-static inline u8 b43_freq_to_channel_bg(int freq)
+static inline u8 b43_freq_to_channel_2ghz(int freq)
 {
         u8 channel;
 
@@ -54,19 +54,13 @@ static inline u8 b43_freq_to_channel_bg(int freq)
 
         return channel;
 }
-static inline u8 b43_freq_to_channel(struct b43_wldev *dev, int freq)
-{
-        if (dev->phy.type == B43_PHYTYPE_A)
-                return b43_freq_to_channel_a(freq);
-        return b43_freq_to_channel_bg(freq);
-}
 
 /* Lightweight function to convert a channel number to a frequency (in Mhz). */
-static inline int b43_channel_to_freq_a(u8 channel)
+static inline int b43_channel_to_freq_5ghz(u8 channel)
 {
         return (5000 + (5 * channel));
 }
-static inline int b43_channel_to_freq_bg(u8 channel)
+static inline int b43_channel_to_freq_2ghz(u8 channel)
 {
         int freq;
 
@@ -77,12 +71,6 @@ static inline int b43_channel_to_freq_bg(u8 channel)
 
         return freq;
 }
-static inline int b43_channel_to_freq(struct b43_wldev *dev, u8 channel)
-{
-        if (dev->phy.type == B43_PHYTYPE_A)
-                return b43_channel_to_freq_a(channel);
-        return b43_channel_to_freq_bg(channel);
-}
 
 static inline int b43_is_cck_rate(int rate)
 {
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 0bd6f8a348a8..3307ba1856b1 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -531,21 +531,32 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         switch (chanstat & B43_RX_CHAN_PHYTYPE) {
         case B43_PHYTYPE_A:
                 status.phymode = MODE_IEEE80211A;
-                status.freq = chanid;
-                status.channel = b43_freq_to_channel_a(chanid);
-                break;
-        case B43_PHYTYPE_B:
-                status.phymode = MODE_IEEE80211B;
-                status.freq = chanid + 2400;
-                status.channel = b43_freq_to_channel_bg(chanid + 2400);
+                B43_WARN_ON(1);
+                /* FIXME: We don't really know which value the "chanid" contains.
+                 *        So the following assignment might be wrong. */
+                status.channel = chanid;
+                status.freq = b43_channel_to_freq_5ghz(status.channel);
                 break;
         case B43_PHYTYPE_G:
                 status.phymode = MODE_IEEE80211G;
+                /* chanid is the radio channel cookie value as used
+                 * to tune the radio. */
                 status.freq = chanid + 2400;
-                status.channel = b43_freq_to_channel_bg(chanid + 2400);
+                status.channel = b43_freq_to_channel_2ghz(status.freq);
+                break;
+        case B43_PHYTYPE_N:
+                status.phymode = 0xDEAD /*FIXME MODE_IEEE80211N*/;
+                /* chanid is the SHM channel cookie. Which is the plain
+                 * channel number in b43. */
+                status.channel = chanid;
+                if (chanstat & B43_RX_CHAN_5GHZ)
+                        status.freq = b43_freq_to_channel_5ghz(status.freq);
+                else
+                        status.freq = b43_freq_to_channel_2ghz(status.freq);
                 break;
         default:
                 B43_WARN_ON(1);
+                goto drop;
         }
 
         dev->stats.last_rx = jiffies;
diff --git a/drivers/net/wireless/b43/xmit.h b/drivers/net/wireless/b43/xmit.h
index 03bddd251618..6dc079382f7f 100644
--- a/drivers/net/wireless/b43/xmit.h
+++ b/drivers/net/wireless/b43/xmit.h
@@ -142,49 +142,56 @@ struct b43_rxhdr_fw4 {
 } __attribute__ ((__packed__));
 
 /* PHY RX Status 0 */
-#define B43_RX_PHYST0_GAINCTL   0x4000  /* Gain Control */
-#define B43_RX_PHYST0_PLCPHCF   0x0200
-#define B43_RX_PHYST0_PLCPFV    0x0100
-#define B43_RX_PHYST0_SHORTPRMBL        0x0080  /* Received with Short Preamble */
+#define B43_RX_PHYST0_GAINCTL           0x4000 /* Gain Control */
+#define B43_RX_PHYST0_PLCPHCF           0x0200
+#define B43_RX_PHYST0_PLCPFV            0x0100
+#define B43_RX_PHYST0_SHORTPRMBL        0x0080 /* Received with Short Preamble */
 #define B43_RX_PHYST0_LCRS              0x0040
-#define B43_RX_PHYST0_ANT               0x0020  /* Antenna */
-#define B43_RX_PHYST0_UNSRATE   0x0010
+#define B43_RX_PHYST0_ANT               0x0020 /* Antenna */
+#define B43_RX_PHYST0_UNSRATE           0x0010
 #define B43_RX_PHYST0_CLIP              0x000C
 #define B43_RX_PHYST0_CLIP_SHIFT        2
-#define B43_RX_PHYST0_FTYPE             0x0003  /* Frame type */
-#define  B43_RX_PHYST0_CCK              0x0000  /* Frame type: CCK */
-#define  B43_RX_PHYST0_OFDM             0x0001  /* Frame type: OFDM */
-#define  B43_RX_PHYST0_PRE_N    0x0002  /* Pre-standard N-PHY frame */
-#define  B43_RX_PHYST0_STD_N    0x0003  /* Standard N-PHY frame */
+#define B43_RX_PHYST0_FTYPE             0x0003 /* Frame type */
+#define  B43_RX_PHYST0_CCK              0x0000 /* Frame type: CCK */
+#define  B43_RX_PHYST0_OFDM             0x0001 /* Frame type: OFDM */
+#define  B43_RX_PHYST0_PRE_N            0x0002 /* Pre-standard N-PHY frame */
+#define  B43_RX_PHYST0_STD_N            0x0003 /* Standard N-PHY frame */
 
 /* PHY RX Status 2 */
-#define B43_RX_PHYST2_LNAG              0xC000  /* LNA Gain */
+#define B43_RX_PHYST2_LNAG              0xC000 /* LNA Gain */
 #define B43_RX_PHYST2_LNAG_SHIFT        14
-#define B43_RX_PHYST2_PNAG              0x3C00  /* PNA Gain */
+#define B43_RX_PHYST2_PNAG              0x3C00 /* PNA Gain */
 #define B43_RX_PHYST2_PNAG_SHIFT        10
-#define B43_RX_PHYST2_FOFF              0x03FF  /* F offset */
+#define B43_RX_PHYST2_FOFF              0x03FF /* F offset */
 
 /* PHY RX Status 3 */
-#define B43_RX_PHYST3_DIGG              0x1800  /* DIG Gain */
+#define B43_RX_PHYST3_DIGG              0x1800 /* DIG Gain */
 #define B43_RX_PHYST3_DIGG_SHIFT        11
-#define B43_RX_PHYST3_TRSTATE   0x0400  /* TR state */
+#define B43_RX_PHYST3_TRSTATE           0x0400 /* TR state */
 
 /* MAC RX Status */
-#define B43_RX_MAC_BEACONSENT   0x00008000      /* Beacon send flag */
-#define B43_RX_MAC_KEYIDX               0x000007E0      /* Key index */
-#define B43_RX_MAC_KEYIDX_SHIFT 5
-#define B43_RX_MAC_DECERR               0x00000010      /* Decrypt error */
-#define B43_RX_MAC_DEC          0x00000008      /* Decryption attempted */
-#define B43_RX_MAC_PADDING              0x00000004      /* Pad bytes present */
-#define B43_RX_MAC_RESP         0x00000002      /* Response frame transmitted */
-#define B43_RX_MAC_FCSERR               0x00000001      /* FCS error */
+#define B43_RX_MAC_RXST_VALID           0x01000000 /* PHY RXST valid */
+#define B43_RX_MAC_TKIP_MICERR          0x00100000 /* TKIP MIC error */
+#define B43_RX_MAC_TKIP_MICATT          0x00080000 /* TKIP MIC attempted */
+#define B43_RX_MAC_AGGTYPE              0x00060000 /* Aggregation type */
+#define B43_RX_MAC_AGGTYPE_SHIFT        17
+#define B43_RX_MAC_AMSDU                0x00010000 /* A-MSDU mask */
+#define B43_RX_MAC_BEACONSENT           0x00008000 /* Beacon sent flag */
+#define B43_RX_MAC_KEYIDX               0x000007E0 /* Key index */
+#define B43_RX_MAC_KEYIDX_SHIFT         5
+#define B43_RX_MAC_DECERR               0x00000010 /* Decrypt error */
+#define B43_RX_MAC_DEC                  0x00000008 /* Decryption attempted */
+#define B43_RX_MAC_PADDING              0x00000004 /* Pad bytes present */
+#define B43_RX_MAC_RESP                 0x00000002 /* Response frame transmitted */
+#define B43_RX_MAC_FCSERR               0x00000001 /* FCS error */
 
 /* RX channel */
-#define B43_RX_CHAN_GAIN                0xFC00  /* Gain */
-#define B43_RX_CHAN_GAIN_SHIFT  10
-#define B43_RX_CHAN_ID          0x03FC  /* Channel ID */
-#define B43_RX_CHAN_ID_SHIFT    2
-#define B43_RX_CHAN_PHYTYPE             0x0003  /* PHY type */
+#define B43_RX_CHAN_40MHZ               0x1000 /* 40 Mhz channel width */
+#define B43_RX_CHAN_5GHZ                0x0800 /* 5 Ghz band */
+#define B43_RX_CHAN_ID                  0x07F8 /* Channel ID */
+#define B43_RX_CHAN_ID_SHIFT            3
+#define B43_RX_CHAN_PHYTYPE             0x0007 /* PHY type */
+
 
 u8 b43_plcp_get_ratecode_cck(const u8 bitrate);
 u8 b43_plcp_get_ratecode_ofdm(const u8 bitrate);
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 2a8fc431099f..bca37bf0f545 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -852,11 +852,6 @@ static int xennet_poll(struct napi_struct *napi, int budget)
 
         spin_lock(&np->rx_lock);
 
-        if (unlikely(!netif_carrier_ok(dev))) {
-                spin_unlock(&np->rx_lock);
-                return 0;
-        }
-
         skb_queue_head_init(&rxq);
         skb_queue_head_init(&errq);
         skb_queue_head_init(&tmpq);
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index 146d540f6281..288640756099 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -3041,7 +3041,6 @@ qla1280_32bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
         int cnt;
         int req_cnt;
         int seg_cnt;
-        dma_addr_t dma_handle;
         u8 dir;
 
         ENTER("qla1280_32bit_start_scsi");
@@ -3050,6 +3049,7 @@ qla1280_32bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
                 cmd->cmnd[0]);
 
         /* Calculate number of entries and segments required. */
+        req_cnt = 1;
         seg_cnt = scsi_dma_map(cmd);
         if (seg_cnt) {
                 /*
diff --git a/drivers/spi/spi_bitbang.c b/drivers/spi/spi_bitbang.c
index 81639c6be1c7..f7f8580edad8 100644
--- a/drivers/spi/spi_bitbang.c
+++ b/drivers/spi/spi_bitbang.c
@@ -184,6 +184,7 @@ int spi_bitbang_setup(struct spi_device *spi)
         struct spi_bitbang_cs   *cs = spi->controller_state;
         struct spi_bitbang      *bitbang;
         int                     retval;
+        unsigned long           flags;
 
         bitbang = spi_master_get_devdata(spi->master);
 
@@ -222,12 +223,12 @@ int spi_bitbang_setup(struct spi_device *spi)
          */
 
         /* deselect chip (low or high) */
-        spin_lock(&bitbang->lock);
+        spin_lock_irqsave(&bitbang->lock, flags);
         if (!bitbang->busy) {
                 bitbang->chipselect(spi, BITBANG_CS_INACTIVE);
                 ndelay(cs->nsecs);
         }
-        spin_unlock(&bitbang->lock);
+        spin_unlock_irqrestore(&bitbang->lock, flags);
 
         return 0;
 }
diff --git a/drivers/ssb/scan.c b/drivers/ssb/scan.c
index 96258c60919d..63ee5cfbefbb 100644
--- a/drivers/ssb/scan.c
+++ b/drivers/ssb/scan.c
@@ -388,6 +388,17 @@ int ssb_bus_scan(struct ssb_bus *bus,
                 case SSB_DEV_PCI:
                 case SSB_DEV_PCIE:
 #ifdef CONFIG_SSB_DRIVER_PCICORE
+                        if (bus->bustype == SSB_BUSTYPE_PCI) {
+                                /* Ignore PCI cores on PCI-E cards.
+                                 * Ignore PCI-E cores on PCI cards. */
+                                if (dev->id.coreid == SSB_DEV_PCI) {
+                                        if (bus->host_pci->is_pcie)
+                                                continue;
+                                } else {
+                                        if (!bus->host_pci->is_pcie)
+                                                continue;
+                                }
+                        }
                         if (bus->pcicore.dev) {
                                 ssb_printk(KERN_WARNING PFX
                                            "WARNING: Multiple PCI(E) cores found\n");
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index cf8add91de05..0da1df9c79bf 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -483,6 +483,13 @@ static void pl2303_set_termios(struct usb_serial_port *port,
         }
         spin_unlock_irqrestore(&priv->lock, flags);
 
+        /* The PL2303 is reported to lose bytes if you change
+           serial settings even to the same values as before. Thus
+           we actually need to filter in this specific case */
+
+        if (!tty_termios_hw_change(port->tty->termios, old_termios))
+                return;
+
         cflag = port->tty->termios->c_cflag;
 
         buf = kzalloc(7, GFP_KERNEL);
diff --git a/drivers/video/ps3fb.c b/drivers/video/ps3fb.c
index b3128903d673..044a423a72cb 100644
--- a/drivers/video/ps3fb.c
+++ b/drivers/video/ps3fb.c
@@ -443,8 +443,6 @@ static int ps3fb_sync(struct fb_info *info, u32 frame)
         u32 ddr_line_length, xdr_line_length;
         u64 ddr_base, xdr_base;
 
-        acquire_console_sem();
-
         if (frame > par->num_frames - 1) {
                 dev_dbg(info->device, "%s: invalid frame number (%u)\n",
                         __func__, frame);
@@ -464,7 +462,6 @@ static int ps3fb_sync(struct fb_info *info, u32 frame)
                          xdr_line_length);
 
 out:
-        release_console_sem();
         return error;
 }
 
@@ -479,7 +476,10 @@ static int ps3fb_release(struct fb_info *info, int user)
         if (atomic_dec_and_test(&ps3fb.f_count)) {
                 if (atomic_read(&ps3fb.ext_flip)) {
                         atomic_set(&ps3fb.ext_flip, 0);
-                        ps3fb_sync(info, 0);    /* single buffer */
+                        if (!try_acquire_console_sem()) {
+                                ps3fb_sync(info, 0);    /* single buffer */
+                                release_console_sem();
+                        }
                 }
         }
         return 0;
@@ -865,7 +865,9 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd,
                         break;
 
                 dev_dbg(info->device, "PS3FB_IOCTL_FSEL:%d\n", val);
+                acquire_console_sem();
                 retval = ps3fb_sync(info, val);
+                release_console_sem();
                 break;
 
         default:
@@ -885,7 +887,9 @@ static int ps3fbd(void *arg)
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (ps3fb.is_kicked) {
                         ps3fb.is_kicked = 0;
+                        acquire_console_sem();
                         ps3fb_sync(info, 0);    /* single buffer */
+                        release_console_sem();
                 }
                 schedule();
         }
@@ -1234,12 +1238,6 @@ static int ps3fb_shutdown(struct ps3_system_bus_device *dev)
         ps3fb_flip_ctl(0, &ps3fb);      /* flip off */
         ps3fb.dinfo->irq.mask = 0;
 
-        if (info) {
-                unregister_framebuffer(info);
-                fb_dealloc_cmap(&info->cmap);
-                framebuffer_release(info);
-        }
-
         ps3av_register_flip_ctl(NULL, NULL);
         if (ps3fb.task) {
                 struct task_struct *task = ps3fb.task;
@@ -1250,6 +1248,12 @@ static int ps3fb_shutdown(struct ps3_system_bus_device *dev)
                 free_irq(ps3fb.irq_no, &dev->core);
                 ps3_irq_plug_destroy(ps3fb.irq_no);
         }
+        if (info) {
+                unregister_framebuffer(info);
+                fb_dealloc_cmap(&info->cmap);
+                framebuffer_release(info);
+                info = dev->core.driver_data = NULL;
+        }
         iounmap((u8 __iomem *)ps3fb.dinfo);
 
         status = lv1_gpu_context_free(ps3fb.context_handle);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index ba8de7ca260b..f0b3171842f2 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1384,7 +1384,7 @@ static void fill_prstatus(struct elf_prstatus *prstatus,
         prstatus->pr_sigpend = p->pending.signal.sig[0];
         prstatus->pr_sighold = p->blocked.sig[0];
         prstatus->pr_pid = task_pid_vnr(p);
-        prstatus->pr_ppid = task_pid_vnr(p->parent);
+        prstatus->pr_ppid = task_pid_vnr(p->real_parent);
         prstatus->pr_pgrp = task_pgrp_vnr(p);
         prstatus->pr_sid = task_session_vnr(p);
         if (thread_group_leader(p)) {
@@ -1430,7 +1430,7 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
         psinfo->pr_psargs[len] = 0;
 
         psinfo->pr_pid = task_pid_vnr(p);
-        psinfo->pr_ppid = task_pid_vnr(p->parent);
+        psinfo->pr_ppid = task_pid_vnr(p->real_parent);
         psinfo->pr_pgrp = task_pgrp_vnr(p);
         psinfo->pr_sid = task_session_vnr(p);
 
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 0b1ab016fa2e..5a719180983c 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -120,22 +120,9 @@ ecryptfs_do_create(struct inode *directory_inode,
         rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode,
                                              ecryptfs_dentry, mode, nd);
         if (rc) {
-                struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode;
-                struct ecryptfs_inode_info *inode_info =
-                        ecryptfs_inode_to_private(ecryptfs_inode);
-
-                printk(KERN_WARNING "%s: Error creating underlying file; "
-                       "rc = [%d]; checking for existing\n", __FUNCTION__, rc);
-                if (inode_info) {
-                        mutex_lock(&inode_info->lower_file_mutex);
-                        if (!inode_info->lower_file) {
-                                mutex_unlock(&inode_info->lower_file_mutex);
-                                printk(KERN_ERR "%s: Failure to set underlying "
-                                       "file; rc = [%d]\n", __FUNCTION__, rc);
-                                goto out_lock;
-                        }
-                        mutex_unlock(&inode_info->lower_file_mutex);
-                }
+                printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
+                       "rc = [%d]\n", __FUNCTION__, rc);
+                goto out_lock;
         }
         rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
                                 directory_inode->i_sb, 0);
@@ -451,6 +438,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
         dentry->d_inode->i_nlink =
                 ecryptfs_inode_to_lower(dentry->d_inode)->i_nlink;
         dentry->d_inode->i_ctime = dir->i_ctime;
+        d_drop(dentry);
 out_unlock:
         unlock_parent(lower_dentry);
         return rc;
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index f8cdab2bee3d..4859c4eecd65 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -86,7 +86,6 @@ static void ecryptfs_destroy_inode(struct inode *inode)
                         fput(inode_info->lower_file);
                         inode_info->lower_file = NULL;
                         d_drop(lower_dentry);
-                        d_delete(lower_dentry);
                 }
         }
         mutex_unlock(&inode_info->lower_file_mutex);
diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
index 2c1b73fb82ae..5fb366992b73 100644
--- a/fs/fat/fatent.c
+++ b/fs/fat/fatent.c
@@ -590,21 +590,49 @@ error:
 
 EXPORT_SYMBOL_GPL(fat_free_clusters);
 
+/* 128kb is the whole sectors for FAT12 and FAT16 */
+#define FAT_READA_SIZE          (128 * 1024)
+
+static void fat_ent_reada(struct super_block *sb, struct fat_entry *fatent,
+                          unsigned long reada_blocks)
+{
+        struct fatent_operations *ops = MSDOS_SB(sb)->fatent_ops;
+        sector_t blocknr;
+        int i, offset;
+
+        ops->ent_blocknr(sb, fatent->entry, &offset, &blocknr);
+
+        for (i = 0; i < reada_blocks; i++)
+                sb_breadahead(sb, blocknr + i);
+}
+
 int fat_count_free_clusters(struct super_block *sb)
 {
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
         struct fatent_operations *ops = sbi->fatent_ops;
         struct fat_entry fatent;
+        unsigned long reada_blocks, reada_mask, cur_block;
         int err = 0, free;
 
         lock_fat(sbi);
         if (sbi->free_clusters != -1)
                 goto out;
 
+        reada_blocks = FAT_READA_SIZE >> sb->s_blocksize_bits;
+        reada_mask = reada_blocks - 1;
+        cur_block = 0;
+
         free = 0;
         fatent_init(&fatent);
         fatent_set_entry(&fatent, FAT_START_ENT);
         while (fatent.entry < sbi->max_cluster) {
+                /* readahead of fat blocks */
+                if ((cur_block & reada_mask) == 0) {
+                        unsigned long rest = sbi->fat_length - cur_block;
+                        fat_ent_reada(sb, &fatent, min(reada_blocks, rest));
+                }
+                cur_block++;
+
                 err = fat_ent_read_block(sb, &fatent);
                 if (err)
                         goto out;
diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c
index f13f1494d4fe..f8452a0eab56 100644
--- a/fs/hfs/bfind.c
+++ b/fs/hfs/bfind.c
@@ -52,6 +52,10 @@ int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd)
                 rec = (e + b) / 2;
                 len = hfs_brec_lenoff(bnode, rec, &off);
                 keylen = hfs_brec_keylen(bnode, rec);
+                if (keylen == HFS_BAD_KEYLEN) {
+                        res = -EINVAL;
+                        goto done;
+                }
                 hfs_bnode_read(bnode, fd->key, off, keylen);
                 cmpval = bnode->tree->keycmp(fd->key, fd->search_key);
                 if (!cmpval) {
@@ -67,6 +71,10 @@ int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd)
         if (rec != e && e >= 0) {
                 len = hfs_brec_lenoff(bnode, e, &off);
                 keylen = hfs_brec_keylen(bnode, e);
+                if (keylen == HFS_BAD_KEYLEN) {
+                        res = -EINVAL;
+                        goto done;
+                }
                 hfs_bnode_read(bnode, fd->key, off, keylen);
         }
 done:
@@ -198,6 +206,10 @@ int hfs_brec_goto(struct hfs_find_data *fd, int cnt)
 
         len = hfs_brec_lenoff(bnode, fd->record, &off);
         keylen = hfs_brec_keylen(bnode, fd->record);
+        if (keylen == HFS_BAD_KEYLEN) {
+                res = -EINVAL;
+                goto out;
+        }
         fd->keyoffset = off;
         fd->keylength = keylen;
         fd->entryoffset = off + keylen;
diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
index 5c87cf4801fc..8626ee375ea8 100644
--- a/fs/hfs/brec.c
+++ b/fs/hfs/brec.c
@@ -44,10 +44,21 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
                 recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
                 if (!recoff)
                         return 0;
-                if (node->tree->attributes & HFS_TREE_BIGKEYS)
+                if (node->tree->attributes & HFS_TREE_BIGKEYS) {
                         retval = hfs_bnode_read_u16(node, recoff) + 2;
-                else
+                        if (retval > node->tree->max_key_len + 2) {
+                                printk(KERN_ERR "hfs: keylen %d too large\n",
+                                        retval);
+                                retval = HFS_BAD_KEYLEN;
+                        }
+                } else {
                         retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
+                        if (retval > node->tree->max_key_len + 1) {
+                                printk(KERN_ERR "hfs: keylen %d too large\n",
+                                        retval);
+                                retval = HFS_BAD_KEYLEN;
+                        }
+                }
         }
         return retval;
 }
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 8a3a650abc87..31284c77bba8 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -81,6 +81,17 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
                 goto fail_page;
         if (!tree->node_count)
                 goto fail_page;
+        if ((id == HFS_EXT_CNID) && (tree->max_key_len != HFS_MAX_EXT_KEYLEN)) {
+                printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
+                        tree->max_key_len);
+                goto fail_page;
+        }
+        if ((id == HFS_CAT_CNID) && (tree->max_key_len != HFS_MAX_CAT_KEYLEN)) {
+                printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
+                        tree->max_key_len);
+                goto fail_page;
+        }
+
         tree->node_size_shift = ffs(size) - 1;
         tree->pages_per_bnode = (tree->node_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
@@ -89,9 +100,9 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         return tree;
 
  fail_page:
-        tree->inode->i_mapping->a_ops = &hfs_aops;
         page_cache_release(page);
  free_tree:
+        tree->inode->i_mapping->a_ops = &hfs_aops;
         iput(tree->inode);
         kfree(tree);
         return NULL;
diff --git a/fs/hfs/hfs.h b/fs/hfs/hfs.h
index 1445e3a56ed4..c6aae61adfe6 100644
--- a/fs/hfs/hfs.h
+++ b/fs/hfs/hfs.h
@@ -28,6 +28,8 @@
 #define HFS_MAX_NAMELEN         128
 #define HFS_MAX_VALENCE         32767U
 
+#define HFS_BAD_KEYLEN          0xFF
+
 /* Meanings of the drAtrb field of the MDB,
  * Reference: _Inside Macintosh: Files_ p. 2-61
  */
@@ -167,6 +169,9 @@ typedef union hfs_btree_key {
         struct hfs_ext_key ext;
 } hfs_btree_key;
 
+#define HFS_MAX_CAT_KEYLEN      (sizeof(struct hfs_cat_key) - sizeof(u8))
+#define HFS_MAX_EXT_KEYLEN      (sizeof(struct hfs_ext_key) - sizeof(u8))
+
 typedef union hfs_btree_key btree_key;
 
 struct hfs_extent {
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index b35069a2aa9e..bd1b9d663fb9 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -115,6 +115,7 @@ struct nfs4_lock_state {
 #define NFS_LOCK_INITIALIZED 1
         int                     ls_flags;
         struct nfs_seqid_counter        ls_seqid;
+        struct rpc_sequence     ls_sequence;
         struct nfs_unique_id    ls_id;
         nfs4_stateid            ls_stateid;
         atomic_t                ls_count;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 23a9a36556bf..5a39c6f78acf 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -509,7 +509,10 @@ static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, f
         lsp = kzalloc(sizeof(*lsp), GFP_KERNEL);
         if (lsp == NULL)
                 return NULL;
-        lsp->ls_seqid.sequence = &state->owner->so_sequence;
+        rpc_init_wait_queue(&lsp->ls_sequence.wait, "lock_seqid_waitqueue");
+        spin_lock_init(&lsp->ls_sequence.lock);
+        INIT_LIST_HEAD(&lsp->ls_sequence.list);
+        lsp->ls_seqid.sequence = &lsp->ls_sequence;
         atomic_set(&lsp->ls_count, 1);
         lsp->ls_owner = fl_owner;
         spin_lock(&clp->cl_lock);
diff --git a/include/linux/key.h b/include/linux/key.h
index fcdbd5ed227b..a70b8a8f2005 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -290,7 +290,7 @@ extern void key_init(void);
 #define key_get(k)                      ({ NULL; })
 #define key_put(k)                      do { } while(0)
 #define key_ref_put(k)                  do { } while(0)
-#define make_key_ref(k)                 ({ NULL; })
+#define make_key_ref(k, p)                      ({ NULL; })
 #define key_ref_to_ptr(k)               ({ NULL; })
 #define is_key_possessed(k)             0
 #define alloc_uid_keyring(u,c)          0
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 1e6af4f174b6..b0813c3286b1 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -319,21 +319,29 @@ struct napi_struct {
 enum
 {
         NAPI_STATE_SCHED,       /* Poll is scheduled */
+        NAPI_STATE_DISABLE,     /* Disable pending */
 };
 
 extern void FASTCALL(__napi_schedule(struct napi_struct *n));
 
+static inline int napi_disable_pending(struct napi_struct *n)
+{
+        return test_bit(NAPI_STATE_DISABLE, &n->state);
+}
+
 /**
  *      napi_schedule_prep - check if napi can be scheduled
  *      @n: napi context
  *
  * Test if NAPI routine is already running, and if not mark
  * it as running.  This is used as a condition variable
- * insure only one NAPI poll instance runs
+ * insure only one NAPI poll instance runs.  We also make
+ * sure there is no pending NAPI disable.
  */
 static inline int napi_schedule_prep(struct napi_struct *n)
 {
-        return !test_and_set_bit(NAPI_STATE_SCHED, &n->state);
+        return !napi_disable_pending(n) &&
+                !test_and_set_bit(NAPI_STATE_SCHED, &n->state);
 }
 
 /**
@@ -389,8 +397,10 @@ static inline void napi_complete(struct napi_struct *n)
  */
 static inline void napi_disable(struct napi_struct *n)
 {
+        set_bit(NAPI_STATE_DISABLE, &n->state);
         while (test_and_set_bit(NAPI_STATE_SCHED, &n->state))
                 msleep(1);
+        clear_bit(NAPI_STATE_DISABLE, &n->state);
 }
 
 /**
@@ -1268,7 +1278,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits)
 static inline int netif_rx_schedule_prep(struct net_device *dev,
                                          struct napi_struct *napi)
 {
-        return netif_running(dev) && napi_schedule_prep(napi);
+        return napi_schedule_prep(napi);
 }
 
 /* Add interface to tail of rx poll list. This assumes that _prep has
@@ -1277,7 +1287,6 @@ static inline int netif_rx_schedule_prep(struct net_device *dev,
 static inline void __netif_rx_schedule(struct net_device *dev,
                                        struct napi_struct *napi)
 {
-        dev_hold(dev);
         __napi_schedule(napi);
 }
 
@@ -1308,7 +1317,6 @@ static inline void __netif_rx_complete(struct net_device *dev,
                                        struct napi_struct *napi)
 {
         __napi_complete(napi);
-        dev_put(dev);
 }
 
 /* Remove interface from poll list: it must be in the poll list
diff --git a/include/linux/scatterlist.h b/include/linux/scatterlist.h
index 416e000dfe81..e3ff21dbac53 100644
--- a/include/linux/scatterlist.h
+++ b/include/linux/scatterlist.h
@@ -191,8 +191,8 @@ static inline void sg_chain(struct scatterlist *prv, unsigned int prv_nents,
         /*
          * offset and length are unused for chain entry.  Clear them.
          */
-        prv->offset = 0;
-        prv->length = 0;
+        prv[prv_nents - 1].offset = 0;
+        prv[prv_nents - 1].length = 0;
 
         /*
          * Set lowest bit to indicate a link pointer, and make sure to clear
diff --git a/include/linux/tty.h b/include/linux/tty.h
index c555f5442bd7..defd2ab72449 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -319,6 +319,7 @@ extern speed_t tty_termios_input_baud_rate(struct ktermios *termios);
 extern void tty_termios_encode_baud_rate(struct ktermios *termios, speed_t ibaud, speed_t obaud);
 extern void tty_encode_baud_rate(struct tty_struct *tty, speed_t ibaud, speed_t obaud);
 extern void tty_termios_copy_hw(struct ktermios *new, struct ktermios *old);
+extern int tty_termios_hw_change(struct ktermios *a, struct ktermios *b);
 
 extern struct tty_ldisc *tty_ldisc_ref(struct tty_struct *);
 extern void tty_ldisc_deref(struct tty_ldisc *);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index c9265518a378..4c3b35153c37 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -325,7 +325,6 @@ static inline struct sk_buff *skb_act_clone(struct sk_buff *skb, gfp_t gfp_mask)
                 n->tc_verd = SET_TC_VERD(n->tc_verd, 0);
                 n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
                 n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
-                n->iif = skb->iif;
         }
         return n;
 }
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 00848b641f59..954090b1e354 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -450,7 +450,7 @@ enum sctp_sn_type {
         SCTP_SHUTDOWN_EVENT,
         SCTP_PARTIAL_DELIVERY_EVENT,
         SCTP_ADAPTATION_INDICATION,
-        SCTP_AUTHENTICATION_EVENT,
+        SCTP_AUTHENTICATION_INDICATION,
 };
 
 /* Notification error codes used to fill up the error fields in some
diff --git a/include/net/sock.h b/include/net/sock.h
index 67e35c7e230c..6e1542da33a1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -944,7 +944,7 @@ static inline int sk_filter(struct sock *sk, struct sk_buff *skb)
                 return err;
         
         rcu_read_lock_bh();
-        filter = sk->sk_filter;
+        filter = rcu_dereference(sk->sk_filter);
         if (filter) {
                 unsigned int pkt_len = sk_run_filter(skb, filter->insns,
                                 filter->len);
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 58dfa82889aa..1dd20cf17982 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1188,10 +1188,15 @@ static inline int xfrm_aevent_is_on(void)
         return ret;
 }
 
+static inline int xfrm_alg_len(struct xfrm_algo *alg)
+{
+        return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
+}
+
 #ifdef CONFIG_XFRM_MIGRATE
 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
 {
-        return (struct xfrm_algo *)kmemdup(orig, sizeof(*orig) + orig->alg_key_len, GFP_KERNEL);
+        return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
 }
 
 static inline void xfrm_states_put(struct xfrm_state **states, int n)
diff --git a/kernel/acct.c b/kernel/acct.c
index cf19547cc9e4..521dfa53cb99 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -482,7 +482,7 @@ static void do_acct_process(struct file *file)
 #endif
 #if ACCT_VERSION==3
         ac.ac_pid = current->tgid;
-        ac.ac_ppid = current->parent->tgid;
+        ac.ac_ppid = current->real_parent->tgid;
 #endif
 
         spin_lock_irq(&current->sighand->siglock);
diff --git a/kernel/futex.c b/kernel/futex.c
index 172a1aeeafdb..db9824de8bf0 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1097,15 +1097,15 @@ static void unqueue_me_pi(struct futex_q *q)
 }
 
 /*
- * Fixup the pi_state owner with current.
+ * Fixup the pi_state owner with the new owner.
  *
  * Must be called with hash bucket lock held and mm->sem held for non
  * private futexes.
  */
 static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
-                                struct task_struct *curr)
+                                struct task_struct *newowner)
 {
-        u32 newtid = task_pid_vnr(curr) | FUTEX_WAITERS;
+        u32 newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
         struct futex_pi_state *pi_state = q->pi_state;
         u32 uval, curval, newval;
         int ret;
@@ -1119,12 +1119,12 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
         } else
                 newtid |= FUTEX_OWNER_DIED;
 
-        pi_state->owner = curr;
+        pi_state->owner = newowner;
 
-        spin_lock_irq(&curr->pi_lock);
+        spin_lock_irq(&newowner->pi_lock);
         WARN_ON(!list_empty(&pi_state->list));
-        list_add(&pi_state->list, &curr->pi_state_list);
-        spin_unlock_irq(&curr->pi_lock);
+        list_add(&pi_state->list, &newowner->pi_state_list);
+        spin_unlock_irq(&newowner->pi_lock);
 
         /*
          * We own it, so we have to replace the pending owner
@@ -1508,9 +1508,40 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
                  * when we were on the way back before we locked the
                  * hash bucket.
                  */
-                if (q.pi_state->owner == curr &&
-                    rt_mutex_trylock(&q.pi_state->pi_mutex)) {
-                        ret = 0;
+                if (q.pi_state->owner == curr) {
+                        /*
+                         * Try to get the rt_mutex now. This might
+                         * fail as some other task acquired the
+                         * rt_mutex after we removed ourself from the
+                         * rt_mutex waiters list.
+                         */
+                        if (rt_mutex_trylock(&q.pi_state->pi_mutex))
+                                ret = 0;
+                        else {
+                                /*
+                                 * pi_state is incorrect, some other
+                                 * task did a lock steal and we
+                                 * returned due to timeout or signal
+                                 * without taking the rt_mutex. Too
+                                 * late. We can access the
+                                 * rt_mutex_owner without locking, as
+                                 * the other task is now blocked on
+                                 * the hash bucket lock. Fix the state
+                                 * up.
+                                 */
+                                struct task_struct *owner;
+                                int res;
+
+                                owner = rt_mutex_owner(&q.pi_state->pi_mutex);
+                                res = fixup_pi_state_owner(uaddr, &q, owner);
+
+                                WARN_ON(rt_mutex_owner(&q.pi_state->pi_mutex) !=
+                                        owner);
+
+                                /* propagate -EFAULT, if the fixup failed */
+                                if (res)
+                                        ret = res;
+                        }
                 } else {
                         /*
                          * Paranoia check. If we did not take the lock
diff --git a/kernel/kexec.c b/kernel/kexec.c
index aa74a1ef2da8..9a26eec9eb04 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1404,6 +1404,7 @@ static int __init crash_save_vmcoreinfo_init(void)
         VMCOREINFO_OFFSET(list_head, next);
         VMCOREINFO_OFFSET(list_head, prev);
         VMCOREINFO_LENGTH(zone.free_area, MAX_ORDER);
+        VMCOREINFO_LENGTH(free_area.free_list, MIGRATE_TYPES);
         VMCOREINFO_NUMBER(NR_FREE_PAGES);
 
         arch_crash_save_vmcoreinfo();
diff --git a/kernel/sched.c b/kernel/sched.c
index 3df84ea6aba9..37cf07aa4164 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4918,7 +4918,7 @@ static void show_task(struct task_struct *p)
         }
 #endif
         printk(KERN_CONT "%5lu %5d %6d\n", free,
-                task_pid_nr(p), task_pid_nr(p->parent));
+                task_pid_nr(p), task_pid_nr(p->real_parent));
 
         if (state != TASK_RUNNING)
                 show_stack(p, NULL);
diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
index e233fff61b4b..f874ae818ad3 100644
--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -25,14 +25,15 @@ static struct page *__xip_sparse_page;
 static struct page *xip_sparse_page(void)
 {
         if (!__xip_sparse_page) {
-                unsigned long zeroes = get_zeroed_page(GFP_HIGHUSER);
-                if (zeroes) {
+                struct page *page = alloc_page(GFP_HIGHUSER | __GFP_ZERO);
+
+                if (page) {
                         static DEFINE_SPINLOCK(xip_alloc_lock);
                         spin_lock(&xip_alloc_lock);
                         if (!__xip_sparse_page)
-                                __xip_sparse_page = virt_to_page(zeroes);
+                                __xip_sparse_page = page;
                         else
-                                free_page(zeroes);
+                                __free_page(page);
                         spin_unlock(&xip_alloc_lock);
                 }
         }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d73bfad1c32f..e1028fae3ebb 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3438,7 +3438,7 @@ static void __init_refok alloc_node_mem_map(struct pglist_data *pgdat)
                 mem_map = NODE_DATA(0)->node_mem_map;
 #ifdef CONFIG_ARCH_POPULATES_NODE_MAP
                 if (page_to_pfn(mem_map) != pgdat->node_start_pfn)
-                        mem_map -= pgdat->node_start_pfn;
+                        mem_map -= (pgdat->node_start_pfn - ARCH_PFN_OFFSET);
 #endif /* CONFIG_ARCH_POPULATES_NODE_MAP */
         }
 #endif
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 2086396de177..9c7f712fc7e9 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -542,6 +542,13 @@ static int mpc_send_packet(struct sk_buff *skb, struct net_device *dev)
         if (eth->h_proto != htons(ETH_P_IP))
                 goto non_ip; /* Multi-Protocol Over ATM :-) */
 
+        /* Weed out funny packets (e.g., AF_PACKET or raw). */
+        if (skb->len < ETH_HLEN + sizeof(struct iphdr))
+                goto non_ip;
+        skb_set_network_header(skb, ETH_HLEN);
+        if (skb->len < ETH_HLEN + ip_hdr(skb)->ihl * 4 || ip_hdr(skb)->ihl < 5)
+                goto non_ip;
+
         while (i < mpc->number_of_mps_macs) {
                 if (!compare_ether_addr(eth->h_dest, (mpc->mps_macs + i*ETH_ALEN)))
                         if ( send_via_shortcut(skb, mpc) == 0 )           /* try shortcut */
diff --git a/net/core/dev.c b/net/core/dev.c
index be9d3015beaa..0879f52115eb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2207,8 +2207,12 @@ static void net_rx_action(struct softirq_action *h)
                  * still "owns" the NAPI instance and therefore can
                  * move the instance around on the list at-will.
                  */
-                if (unlikely(work == weight))
-                        list_move_tail(&n->poll_list, list);
+                if (unlikely(work == weight)) {
+                        if (unlikely(napi_disable_pending(n)))
+                                __napi_complete(n);
+                        else
+                                list_move_tail(&n->poll_list, list);
+                }
 
                 netpoll_poll_unlock(have);
         }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5b4ce9b4dd20..b6283779e93d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -416,16 +416,17 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
         C(len);
         C(data_len);
         C(mac_len);
-        n->cloned = 1;
         n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
+        n->cloned = 1;
         n->nohdr = 0;
         n->destructor = NULL;
-        C(truesize);
-        atomic_set(&n->users, 1);
-        C(head);
-        C(data);
+        C(iif);
         C(tail);
         C(end);
+        C(head);
+        C(data);
+        C(truesize);
+        atomic_set(&n->users, 1);
 
         atomic_inc(&(skb_shinfo(skb)->dataref));
         skb->cloned = 1;
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 9a96c277393d..4a4d49fca1f2 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -310,7 +310,7 @@ static void lro_flush(struct net_lro_mgr *lro_mgr,
         skb_shinfo(lro_desc->parent)->gso_size = lro_desc->mss;
 
         if (lro_desc->vgrp) {
-                if (test_bit(LRO_F_NAPI, &lro_mgr->features))
+                if (lro_mgr->features & LRO_F_NAPI)
                         vlan_hwaccel_receive_skb(lro_desc->parent,
                                                  lro_desc->vgrp,
                                                  lro_desc->vlan_tag);
@@ -320,7 +320,7 @@ static void lro_flush(struct net_lro_mgr *lro_mgr,
                                         lro_desc->vlan_tag);
 
         } else {
-                if (test_bit(LRO_F_NAPI, &lro_mgr->features))
+                if (lro_mgr->features & LRO_F_NAPI)
                         netif_receive_skb(lro_desc->parent);
                 else
                         netif_rx(lro_desc->parent);
@@ -352,7 +352,7 @@ static int __lro_proc_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
                 goto out;
 
         if ((skb->protocol == htons(ETH_P_8021Q))
-            && !test_bit(LRO_F_EXTRACT_VLAN_ID, &lro_mgr->features))
+            && !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
                 vlan_hdr_len = VLAN_HLEN;
 
         if (!lro_desc->active) { /* start new lro session */
@@ -474,7 +474,7 @@ static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
                         goto out;
 
                 if ((skb->protocol == htons(ETH_P_8021Q))
-                    && !test_bit(LRO_F_EXTRACT_VLAN_ID, &lro_mgr->features))
+                    && !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
                         vlan_hdr_len = VLAN_HLEN;
 
                 iph = (void *)(skb->data + vlan_hdr_len);
@@ -516,7 +516,7 @@ void lro_receive_skb(struct net_lro_mgr *lro_mgr,
                      void *priv)
 {
         if (__lro_proc_skb(lro_mgr, skb, NULL, 0, priv)) {
-                if (test_bit(LRO_F_NAPI, &lro_mgr->features))
+                if (lro_mgr->features & LRO_F_NAPI)
                         netif_receive_skb(skb);
                 else
                         netif_rx(skb);
@@ -531,7 +531,7 @@ void lro_vlan_hwaccel_receive_skb(struct net_lro_mgr *lro_mgr,
                                   void *priv)
 {
         if (__lro_proc_skb(lro_mgr, skb, vgrp, vlan_tag, priv)) {
-                if (test_bit(LRO_F_NAPI, &lro_mgr->features))
+                if (lro_mgr->features & LRO_F_NAPI)
                         vlan_hwaccel_receive_skb(skb, vgrp, vlan_tag);
                 else
                         vlan_hwaccel_rx(skb, vgrp, vlan_tag);
@@ -550,7 +550,7 @@ void lro_receive_frags(struct net_lro_mgr *lro_mgr,
         if (!skb)
                 return;
 
-        if (test_bit(LRO_F_NAPI, &lro_mgr->features))
+        if (lro_mgr->features & LRO_F_NAPI)
                 netif_receive_skb(skb);
         else
                 netif_rx(skb);
@@ -570,7 +570,7 @@ void lro_vlan_hwaccel_receive_frags(struct net_lro_mgr *lro_mgr,
         if (!skb)
                 return;
 
-        if (test_bit(LRO_F_NAPI, &lro_mgr->features))
+        if (lro_mgr->features & LRO_F_NAPI)
                 vlan_hwaccel_receive_skb(skb, vgrp, vlan_tag);
         else
                 vlan_hwaccel_rx(skb, vgrp, vlan_tag);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 56a675734ea5..b8f7763b2261 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1404,8 +1404,7 @@ static int __init ic_proto_name(char *name)
                 return 1;
         }
         if (!strcmp(name, "off") || !strcmp(name, "none")) {
-                ic_enable = 0;
-                return 1;
+                return 0;
         }
 #ifdef CONFIG_IP_PNP_DHCP
         else if (!strcmp(name, "dhcp")) {
@@ -1442,10 +1441,22 @@ static int __init ip_auto_config_setup(char *addrs)
         ic_set_manually = 1;
         ic_enable = 1;
 
+        /*
+         * If any dhcp, bootp etc options are set, leave autoconfig on
+         * and skip the below static IP processing.
+         */
         if (ic_proto_name(addrs))
                 return 1;
 
-        /* Parse the whole string */
+        /* If no static IP is given, turn off autoconfig and bail.  */
+        if (*addrs == 0 ||
+            strcmp(addrs, "off") == 0 ||
+            strcmp(addrs, "none") == 0) {
+                ic_enable = 0;
+                return 1;
+        }
+
+        /* Parse string for static IP assignment.  */
         ip = addrs;
         while (ip && *ip) {
                 if ((cp = strchr(ip, ':')))
@@ -1483,7 +1494,10 @@ static int __init ip_auto_config_setup(char *addrs)
                                 strlcpy(user_dev_name, ip, sizeof(user_dev_name));
                                 break;
                         case 6:
-                                ic_proto_name(ip);
+                                if (ic_proto_name(ip) == 0 &&
+                                    ic_myaddr == NONE) {
+                                        ic_enable = 0;
+                                }
                                 break;
                         }
                 }
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 66b42f547bf9..e7050f8eabeb 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -271,6 +271,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
         int hh_len;
         struct iphdr *iph;
         struct sk_buff *skb;
+        unsigned int iphlen;
         int err;
 
         if (length > rt->u.dst.dev->mtu) {
@@ -304,7 +305,8 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
                 goto error_fault;
 
         /* We don't modify invalid header */
-        if (length >= sizeof(*iph) && iph->ihl * 4U <= length) {
+        iphlen = iph->ihl * 4;
+        if (iphlen >= sizeof(*iph) && iphlen <= length) {
                 if (!iph->saddr)
                         iph->saddr = rt->rt_src;
                 iph->check   = 0;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d2bc6148a737..d3377069ce05 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2626,11 +2626,10 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
         int idx, s_idx;
 
         s_h = cb->args[0];
+        if (s_h < 0)
+                s_h = 0;
         s_idx = idx = cb->args[1];
-        for (h = 0; h <= rt_hash_mask; h++) {
-                if (h < s_h) continue;
-                if (h > s_h)
-                        s_idx = 0;
+        for (h = s_h; h <= rt_hash_mask; h++) {
                 rcu_read_lock_bh();
                 for (rt = rcu_dereference(rt_hash_table[h].chain), idx = 0; rt;
                      rt = rcu_dereference(rt->u.dst.rt_next), idx++) {
@@ -2647,6 +2646,7 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
                         dst_release(xchg(&skb->dst, NULL));
                 }
                 rcu_read_unlock_bh();
+                s_idx = 0;
         }
 
 done:
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 2ed689ac449e..5d4245ab4183 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -123,11 +123,11 @@ ipv4_connected:
                                 goto out;
                         }
                         sk->sk_bound_dev_if = usin->sin6_scope_id;
-                        if (!sk->sk_bound_dev_if &&
-                            (addr_type & IPV6_ADDR_MULTICAST))
-                                fl.oif = np->mcast_oif;
                 }
 
+                if (!sk->sk_bound_dev_if && (addr_type & IPV6_ADDR_MULTICAST))
+                        sk->sk_bound_dev_if = np->mcast_oif;
+
                 /* Connect to link-local address requires an interface */
                 if (!sk->sk_bound_dev_if) {
                         err = -EINVAL;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 48ce59a6e026..d5e4dd75200b 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1118,8 +1118,6 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
                         self->max_sdu_size_rx = TTP_SAR_UNBOUND;
                         break;
                 default:
-                        IRDA_ERROR("%s: protocol not supported!\n",
-                                   __FUNCTION__);
                         return -ESOCKTNOSUPPORT;
                 }
                 break;
diff --git a/net/mac80211/ieee80211_ioctl.c b/net/mac80211/ieee80211_ioctl.c
index 7027eed4d4ae..308bbe4a1333 100644
--- a/net/mac80211/ieee80211_ioctl.c
+++ b/net/mac80211/ieee80211_ioctl.c
@@ -591,7 +591,7 @@ static int ieee80211_ioctl_siwrate(struct net_device *dev,
         sdata->bss->force_unicast_rateidx = -1;
         if (rate->value < 0)
                 return 0;
-        for (i=0; i< mode->num_rates; i++) {
+        for (i=0; i < mode->num_rates; i++) {
                 struct ieee80211_rate *rates = &mode->rates[i];
                 int this_rate = rates->rate;
 
@@ -599,10 +599,10 @@ static int ieee80211_ioctl_siwrate(struct net_device *dev,
                         sdata->bss->max_ratectrl_rateidx = i;
                         if (rate->fixed)
                                 sdata->bss->force_unicast_rateidx = i;
-                        break;
+                        return 0;
                 }
         }
-        return 0;
+        return -EINVAL;
 }
 
 static int ieee80211_ioctl_giwrate(struct net_device *dev,
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index ed7c9e30ebc9..3cc629d3c9ff 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -210,6 +210,9 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         chunksize = sizeof(init) + addrs_len + SCTP_SAT_LEN(num_types);
         chunksize += sizeof(ecap_param);
 
+        if (sctp_prsctp_enable)
+                chunksize += sizeof(prsctp_param);
+
         /* ADDIP: Section 4.2.7:
          *  An implementation supporting this extension [ADDIP] MUST list
          *  the ASCONF,the ASCONF-ACK, and the AUTH  chunks in its INIT and
@@ -369,6 +372,9 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
         if (asoc->peer.ecn_capable)
                 chunksize += sizeof(ecap_param);
 
+        if (sctp_prsctp_enable)
+                chunksize += sizeof(prsctp_param);
+
         if (sctp_addip_enable) {
                 extensions[num_ext] = SCTP_CID_ASCONF;
                 extensions[num_ext+1] = SCTP_CID_ASCONF_ACK;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 5fb84778846d..d247ed4ee423 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1309,26 +1309,6 @@ static void sctp_tietags_populate(struct sctp_association *new_asoc,
         new_asoc->c.initial_tsn         = asoc->c.initial_tsn;
 }
 
-static void sctp_auth_params_populate(struct sctp_association *new_asoc,
-                                    const struct sctp_association *asoc)
-{
-        /* Only perform this if AUTH extension is enabled */
-        if (!sctp_auth_enable)
-                return;
-
-        /* We need to provide the same parameter information as
-         * was in the original INIT.  This means that we need to copy
-         * the HMACS, CHUNKS, and RANDOM parameter from the original
-         * assocaition.
-         */
-        memcpy(new_asoc->c.auth_random, asoc->c.auth_random,
-                sizeof(asoc->c.auth_random));
-        memcpy(new_asoc->c.auth_hmacs, asoc->c.auth_hmacs,
-                sizeof(asoc->c.auth_hmacs));
-        memcpy(new_asoc->c.auth_chunks, asoc->c.auth_chunks,
-                sizeof(asoc->c.auth_chunks));
-}
-
 /*
  * Compare vtag/tietag values to determine unexpected COOKIE-ECHO
  * handling action.
@@ -1486,8 +1466,6 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
 
         sctp_tietags_populate(new_asoc, asoc);
 
-        sctp_auth_params_populate(new_asoc, asoc);
-
         /* B) "Z" shall respond immediately with an INIT ACK chunk.  */
 
         /* If there are errors need to be reported for unknown parameters,
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 2c17c7efad46..307314356e16 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -830,7 +830,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_authkey(
         ak = (struct sctp_authkey_event *)
                 skb_put(skb, sizeof(struct sctp_authkey_event));
 
-        ak->auth_type = SCTP_AUTHENTICATION_EVENT;
+        ak->auth_type = SCTP_AUTHENTICATION_INDICATION;
         ak->auth_flags = 0;
         ak->auth_length = sizeof(struct sctp_authkey_event);
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index e75dbdcb08a4..c4f6419b1769 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -31,11 +31,6 @@
 #include <linux/in6.h>
 #endif
 
-static inline int alg_len(struct xfrm_algo *alg)
-{
-        return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
-}
-
 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
 {
         struct nlattr *rt = attrs[type];
@@ -45,7 +40,7 @@ static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
                 return 0;
 
         algp = nla_data(rt);
-        if (nla_len(rt) < alg_len(algp))
+        if (nla_len(rt) < xfrm_alg_len(algp))
                 return -EINVAL;
 
         switch (type) {
@@ -204,7 +199,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
                 return -ENOSYS;
         *props = algo->desc.sadb_alg_id;
 
-        p = kmemdup(ualg, alg_len(ualg), GFP_KERNEL);
+        p = kmemdup(ualg, xfrm_alg_len(ualg), GFP_KERNEL);
         if (!p)
                 return -ENOMEM;
 
@@ -516,9 +511,9 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
                 NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);
 
         if (x->aalg)
-                NLA_PUT(skb, XFRMA_ALG_AUTH, alg_len(x->aalg), x->aalg);
+                NLA_PUT(skb, XFRMA_ALG_AUTH, xfrm_alg_len(x->aalg), x->aalg);
         if (x->ealg)
-                NLA_PUT(skb, XFRMA_ALG_CRYPT, alg_len(x->ealg), x->ealg);
+                NLA_PUT(skb, XFRMA_ALG_CRYPT, xfrm_alg_len(x->ealg), x->ealg);
         if (x->calg)
                 NLA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
 
@@ -1978,9 +1973,9 @@ static inline size_t xfrm_sa_len(struct xfrm_state *x)
 {
         size_t l = 0;
         if (x->aalg)
-                l += nla_total_size(alg_len(x->aalg));
+                l += nla_total_size(xfrm_alg_len(x->aalg));
         if (x->ealg)
-                l += nla_total_size(alg_len(x->ealg));
+                l += nla_total_size(xfrm_alg_len(x->ealg));
         if (x->calg)
                 l += nla_total_size(sizeof(*x->calg));
         if (x->encap)
diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index 3ace4a5680ba..c5a5ab9cae8c 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -925,6 +925,68 @@ static void mixer_slot_clear(struct snd_mixer_oss_slot *rslot)
         rslot->number = idx;
 }
 
+/* In a separate function to keep gcc 3.2 happy - do NOT merge this in
+   snd_mixer_oss_build_input! */
+static int snd_mixer_oss_build_test_all(struct snd_mixer_oss *mixer,
+                                        struct snd_mixer_oss_assign_table *ptr,
+                                        struct slot *slot)
+{
+        char str[64];
+        int err;
+
+        err = snd_mixer_oss_build_test(mixer, slot, ptr->name, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_GLOBAL);
+        if (err)
+                return err;
+        sprintf(str, "%s Switch", ptr->name);
+        err = snd_mixer_oss_build_test(mixer, slot, str, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_GSWITCH);
+        if (err)
+                return err;
+        sprintf(str, "%s Route", ptr->name);
+        err = snd_mixer_oss_build_test(mixer, slot, str, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_GROUTE);
+        if (err)
+                return err;
+        sprintf(str, "%s Volume", ptr->name);
+        err = snd_mixer_oss_build_test(mixer, slot, str, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_GVOLUME);
+        if (err)
+                return err;
+        sprintf(str, "%s Playback Switch", ptr->name);
+        err = snd_mixer_oss_build_test(mixer, slot, str, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_PSWITCH);
+        if (err)
+                return err;
+        sprintf(str, "%s Playback Route", ptr->name);
+        err = snd_mixer_oss_build_test(mixer, slot, str, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_PROUTE);
+        if (err)
+                return err;
+        sprintf(str, "%s Playback Volume", ptr->name);
+        err = snd_mixer_oss_build_test(mixer, slot, str, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_PVOLUME);
+        if (err)
+                return err;
+        sprintf(str, "%s Capture Switch", ptr->name);
+        err = snd_mixer_oss_build_test(mixer, slot, str, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_CSWITCH);
+        if (err)
+                return err;
+        sprintf(str, "%s Capture Route", ptr->name);
+        err = snd_mixer_oss_build_test(mixer, slot, str, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_CROUTE);
+        if (err)
+                return err;
+        sprintf(str, "%s Capture Volume", ptr->name);
+        err = snd_mixer_oss_build_test(mixer, slot, str, ptr->index,
+                                       SNDRV_MIXER_OSS_ITEM_CVOLUME);
+        if (err)
+                return err;
+
+        return 0;
+}
+
 /*
  * build an OSS mixer element.
  * ptr_allocated means the entry is dynamically allocated (change via proc file).
@@ -944,44 +1006,7 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer, struct snd_mix
 
         memset(&slot, 0, sizeof(slot));
         memset(slot.numid, 0xff, sizeof(slot.numid)); /* ID_UNKNOWN */
-        if (snd_mixer_oss_build_test(mixer, &slot, ptr->name, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_GLOBAL))
-                return 0;
-        sprintf(str, "%s Switch", ptr->name);
-        if (snd_mixer_oss_build_test(mixer, &slot, str, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_GSWITCH))
-                return 0;
-        sprintf(str, "%s Route", ptr->name);
-        if (snd_mixer_oss_build_test(mixer, &slot, str, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_GROUTE))
-                return 0;
-        sprintf(str, "%s Volume", ptr->name);
-        if (snd_mixer_oss_build_test(mixer, &slot, str, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_GVOLUME))
-                return 0;
-        sprintf(str, "%s Playback Switch", ptr->name);
-        if (snd_mixer_oss_build_test(mixer, &slot, str, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_PSWITCH))
-                return 0;
-        sprintf(str, "%s Playback Route", ptr->name);
-        if (snd_mixer_oss_build_test(mixer, &slot, str, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_PROUTE))
-                return 0;
-        sprintf(str, "%s Playback Volume", ptr->name);
-        if (snd_mixer_oss_build_test(mixer, &slot, str, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_PVOLUME))
-                return 0;
-        sprintf(str, "%s Capture Switch", ptr->name);
-        if (snd_mixer_oss_build_test(mixer, &slot, str, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_CSWITCH))
-                return 0;
-        sprintf(str, "%s Capture Route", ptr->name);
-        if (snd_mixer_oss_build_test(mixer, &slot, str, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_CROUTE))
-                return 0;
-        sprintf(str, "%s Capture Volume", ptr->name);
-        if (snd_mixer_oss_build_test(mixer, &slot, str, ptr->index,
-                                     SNDRV_MIXER_OSS_ITEM_CVOLUME))
+        if (snd_mixer_oss_build_test_all(mixer, ptr, &slot))
                 return 0;
         down_read(&mixer->card->controls_rwsem);
         if (ptr->index == 0 && (kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0)) != NULL) {
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 62b9fb386903..3fa0f9704909 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -555,8 +555,7 @@ static unsigned int azx_rirb_get_response(struct hda_codec *codec)
                 }
                 if (!chip->rirb.cmds)
                         return chip->rirb.res; /* the last value */
-                udelay(10);
-                cond_resched();
+                schedule_timeout_uninterruptible(1);
         } while (time_after_eq(timeout, jiffies));
 
         if (chip->msi) {