365 files changed, 3930 insertions, 2700 deletions

diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 50f99eab0e1f..2a39aeba1464 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -42,14 +42,8 @@ IRQ.txt
         - description of what an IRQ is.
 ManagementStyle
         - how to (attempt to) manage kernel hackers.
-MSI-HOWTO.txt
-        - the Message Signaled Interrupts (MSI) Driver Guide HOWTO and FAQ.
 RCU/
         - directory with info on RCU (read-copy update).
-README.DAC960
-        - info on Mylex DAC960/DAC1100 PCI RAID Controller Driver for Linux.
-README.cycladesZ
-        - info on Cyclades-Z firmware loading.
 SAK.txt
         - info on Secure Attention Keys.
 SM501.txt
@@ -86,20 +80,16 @@ blackfin/
         - directory with documentation for the Blackfin arch.
 block/
         - info on the Block I/O (BIO) layer.
+blockdev/
+        - info on block devices & drivers
 cachetlb.txt
         - describes the cache/TLB flushing interfaces Linux uses.
-cciss.txt
-        - info, major/minor #'s for Compaq's SMART Array Controllers.
 cdrom/
         - directory with information on the CD-ROM drivers that Linux has.
-computone.txt
-        - info on Computone Intelliport II/Plus Multiport Serial Driver.
 connector/
         - docs on the netlink based userspace<->kernel space communication mod.
 console/
         - documentation on Linux console drivers.
-cpqarray.txt
-        - info on using Compaq's SMART2 Intelligent Disk Array Controllers.
 cpu-freq/
         - info on CPU frequency and voltage scaling.
 cpu-hotplug.txt
@@ -126,8 +116,6 @@ device-mapper/
         - directory with info on Device Mapper.
 devices.txt
         - plain ASCII listing of all the nodes in /dev/ with major minor #'s.
-digiepca.txt
-        - info on Digi Intl. {PC,PCI,EISA}Xx and Xem series cards.
 dontdiff
         - file containing a list of files that should never be diff'ed.
 driver-model/
@@ -152,14 +140,10 @@ filesystems/
         - info on the vfs and the various filesystems that Linux supports.
 firmware_class/
         - request_firmware() hotplug interface info.
-floppy.txt
-        - notes and driver options for the floppy disk driver.
 frv/
         - Fujitsu FR-V Linux documentation.
 gpio.txt
         - overview of GPIO (General Purpose Input/Output) access conventions.
-hayes-esp.txt
-        - info on using the Hayes ESP serial driver.
 highuid.txt
         - notes on the change from 16 bit to 32 bit user/group IDs.
 timers/
@@ -186,8 +170,6 @@ io_ordering.txt
         - info on ordering I/O writes to memory-mapped addresses.
 ioctl/
         - directory with documents describing various IOCTL calls.
-ioctl-number.txt
-        - how to implement and register device/driver ioctl calls.
 iostats.txt
         - info on I/O statistics Linux kernel provides.
 irqflags-tracing.txt
@@ -250,14 +232,10 @@ mips/
         - directory with info about Linux on MIPS architecture.
 mono.txt
         - how to execute Mono-based .NET binaries with the help of BINFMT_MISC.
-moxa-smartio
-        - file with info on installing/using Moxa multiport serial driver.
 mutex-design.txt
         - info on the generic mutex subsystem.
 namespaces/
         - directory with various information about namespaces
-nbd.txt
-        - info on a TCP implementation of a network block device.
 netlabel/
         - directory with information on the NetLabel subsystem.
 networking/
@@ -270,8 +248,6 @@ numastat.txt
         - info on how to read Numa policy hit/miss statistics in sysfs.
 oops-tracing.txt
         - how to decode those nasty internal kernel error dump messages.
-paride.txt
-        - information about the parallel port IDE subsystem.
 parisc/
         - directory with info on using Linux on PA-RISC architecture.
 parport.txt
@@ -294,18 +270,12 @@ printk-formats.txt
         - how to get printk format specifiers right
 prio_tree.txt
         - info on radix-priority-search-tree use for indexing vmas.
-ramdisk.txt
-        - short guide on how to set up and use the RAM disk.
 rbtree.txt
         - info on what red-black trees are and what they are for.
-riscom8.txt
-        - notes on using the RISCom/8 multi-port serial driver.
 robust-futex-ABI.txt
         - documentation of the robust futex ABI.
 robust-futexes.txt
         - a description of what robust futexes are.
-rocket.txt
-        - info on the Comtrol RocketPort multiport serial driver.
 rt-mutex-design.txt
         - description of the RealTime mutex implementation design.
 rt-mutex.txt
@@ -334,8 +304,6 @@ sparc/
         - directory with info on using Linux on Sparc architecture.
 sparse.txt
         - info on how to obtain and use the sparse tool for typechecking.
-specialix.txt
-        - info on hardware/driver for specialix IO8+ multiport serial card.
 spi/
         - overview of Linux kernel Serial Peripheral Interface (SPI) support.
 spinlocks.txt
@@ -344,14 +312,10 @@ stable_api_nonsense.txt
         - info on why the kernel does not have a stable in-kernel api or abi.
 stable_kernel_rules.txt
         - rules and procedures for the -stable kernel releases.
-stallion.txt
-        - info on using the Stallion multiport serial driver.
 svga.txt
         - short guide on selecting video modes at boot via VGA BIOS.
 sysfs-rules.txt
         - How not to use sysfs.
-sx.txt
-        - info on the Specialix SX/SI multiport serial driver.
 sysctl/
         - directory with info on the /proc/sys/* files.
 sysrq.txt
@@ -360,8 +324,6 @@ telephony/
         - directory with info on telephony (e.g. voice over IP) support.
 time_interpolators.txt
         - info on time interpolators.
-tty.txt
-        - guide to the locking policies of the tty layer.
 uml/
         - directory with information about User Mode Linux.
 unicode.txt
diff --git a/Documentation/PCI/00-INDEX b/Documentation/PCI/00-INDEX
index 49f43946c6b6..812b17fe3ed0 100644
--- a/Documentation/PCI/00-INDEX
+++ b/Documentation/PCI/00-INDEX
@@ -1,5 +1,7 @@
 00-INDEX
         - this file
+MSI-HOWTO.txt
+        - the Message Signaled Interrupts (MSI) Driver Guide HOWTO and FAQ.
 PCI-DMA-mapping.txt
         - info for PCI drivers using DMA portably across all platforms
 PCIEBUS-HOWTO.txt
diff --git a/Documentation/MSI-HOWTO.txt b/Documentation/PCI/MSI-HOWTO.txt
index 256defd7e174..256defd7e174 100644
--- a/Documentation/MSI-HOWTO.txt
+++ b/Documentation/PCI/MSI-HOWTO.txt
diff --git a/Documentation/blockdev/00-INDEX b/Documentation/blockdev/00-INDEX
new file mode 100644
index 000000000000..86f054c47013
--- /dev/null
+++ b/Documentation/blockdev/00-INDEX
@@ -0,0 +1,16 @@
+00-INDEX
+        - this file
+README.DAC960
+        - info on Mylex DAC960/DAC1100 PCI RAID Controller Driver for Linux.
+cciss.txt
+        - info, major/minor #'s for Compaq's SMART Array Controllers.
+cpqarray.txt
+        - info on using Compaq's SMART2 Intelligent Disk Array Controllers.
+floppy.txt
+        - notes and driver options for the floppy disk driver.
+nbd.txt
+        - info on a TCP implementation of a network block device.
+paride.txt
+        - information about the parallel port IDE subsystem.
+ramdisk.txt
+        - short guide on how to set up and use the RAM disk.
diff --git a/Documentation/README.DAC960 b/Documentation/blockdev/README.DAC960
index 0e8f618ab534..0e8f618ab534 100644
--- a/Documentation/README.DAC960
+++ b/Documentation/blockdev/README.DAC960
diff --git a/Documentation/cciss.txt b/Documentation/blockdev/cciss.txt
index 89698e8df7d4..89698e8df7d4 100644
--- a/Documentation/cciss.txt
+++ b/Documentation/blockdev/cciss.txt
diff --git a/Documentation/cpqarray.txt b/Documentation/blockdev/cpqarray.txt
index c7154e20ef5e..c7154e20ef5e 100644
--- a/Documentation/cpqarray.txt
+++ b/Documentation/blockdev/cpqarray.txt
diff --git a/Documentation/floppy.txt b/Documentation/blockdev/floppy.txt
index 6ccab88705cb..6ccab88705cb 100644
--- a/Documentation/floppy.txt
+++ b/Documentation/blockdev/floppy.txt
diff --git a/Documentation/nbd.txt b/Documentation/blockdev/nbd.txt
index aeb93ffe6416..aeb93ffe6416 100644
--- a/Documentation/nbd.txt
+++ b/Documentation/blockdev/nbd.txt
diff --git a/Documentation/paride.txt b/Documentation/blockdev/paride.txt
index e4312676bdda..e4312676bdda 100644
--- a/Documentation/paride.txt
+++ b/Documentation/blockdev/paride.txt
diff --git a/Documentation/ramdisk.txt b/Documentation/blockdev/ramdisk.txt
index 6c820baa19a6..6c820baa19a6 100644
--- a/Documentation/ramdisk.txt
+++ b/Documentation/blockdev/ramdisk.txt
diff --git a/Documentation/ioctl/00-INDEX b/Documentation/ioctl/00-INDEX
new file mode 100644
index 000000000000..d2fe4d4729ef
--- /dev/null
+++ b/Documentation/ioctl/00-INDEX
@@ -0,0 +1,10 @@
+00-INDEX
+        - this file
+cdrom.txt
+        - summary of CDROM ioctl calls
+hdio.txt
+        - summary of HDIO_ ioctl calls
+ioctl-decoding.txt
+        - how to decode the bits of an IOCTL code
+ioctl-number.txt
+        - how to implement and register device/driver ioctl calls
diff --git a/Documentation/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
index b880ce5dbd33..b880ce5dbd33 100644
--- a/Documentation/ioctl-number.txt
+++ b/Documentation/ioctl/ioctl-number.txt
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index c600c4ffc657..e0f346d201ed 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -294,7 +294,9 @@ and is between 256 and 4096 characters. It is defined in the file
                         Possible values are:
                         isolate - enable device isolation (each device, as far
                                   as possible, will get its own protection
-                                  domain)
+                                  domain) [default]
+                        share - put every device behind one IOMMU into the
+                                same protection domain
                         fullflush - enable flushing of IO/TLB entries when
                                     they are unmapped. Otherwise they are
                                     flushed before they will be reused, which
@@ -629,7 +631,7 @@ and is between 256 and 4096 characters. It is defined in the file
 
         digiepca=       [HW,SERIAL]
                         See drivers/char/README.epca and
-                        Documentation/digiepca.txt.
+                        Documentation/serial/digiepca.txt.
 
         disable_mtrr_cleanup [X86]
         enable_mtrr_cleanup [X86]
@@ -740,7 +742,7 @@ and is between 256 and 4096 characters. It is defined in the file
                         See header of drivers/scsi/fdomain.c.
 
         floppy=         [HW]
-                        See Documentation/floppy.txt.
+                        See Documentation/blockdev/floppy.txt.
 
         force_pal_cache_flush
                         [IA-64] Avoid check_sal_cache_flush which may hang on
@@ -1101,7 +1103,7 @@ and is between 256 and 4096 characters. It is defined in the file
                         the same attribute, the last one is used.
 
         load_ramdisk=   [RAM] List of ramdisks to load from floppy
-                        See Documentation/ramdisk.txt.
+                        See Documentation/blockdev/ramdisk.txt.
 
         lockd.nlm_grace_period=P  [NFS] Assign grace period.
                         Format: <integer>
@@ -1193,8 +1195,8 @@ and is between 256 and 4096 characters. It is defined in the file
                         it is equivalent to "nosmp", which also disables
                         the IO APIC.
 
-        max_addr=[KMG]  [KNL,BOOT,ia64] All physical memory greater than or
-                        equal to this physical address is ignored.
+        max_addr=nn[KMG]        [KNL,BOOT,ia64] All physical memory greater than
+                        or equal to this physical address is ignored.
 
         max_luns=       [SCSI] Maximum number of LUNs to probe.
                         Should be between 1 and 2^32-1.
@@ -1294,6 +1296,9 @@ and is between 256 and 4096 characters. It is defined in the file
 
         mga=            [HW,DRM]
 
+        min_addr=nn[KMG]        [KNL,BOOT,ia64] All physical memory below this
+                        physical address is ignored.
+
         mminit_loglevel=
                         [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this
                         parameter allows control of the logging verbosity for
@@ -1596,7 +1601,7 @@ and is between 256 and 4096 characters. It is defined in the file
 
         pcd.            [PARIDE]
                         See header of drivers/block/paride/pcd.c.
-                        See also Documentation/paride.txt.
+                        See also Documentation/blockdev/paride.txt.
 
         pci=option[,option...]  [PCI] various PCI subsystem options:
                 off             [X86] don't probe for the PCI bus
@@ -1697,7 +1702,7 @@ and is between 256 and 4096 characters. It is defined in the file
         pcmv=           [HW,PCMCIA] BadgePAD 4
 
         pd.             [PARIDE]
-                        See Documentation/paride.txt.
+                        See Documentation/blockdev/paride.txt.
 
         pdcchassis=     [PARISC,HW] Disable/Enable PDC Chassis Status codes at
                         boot time.
@@ -1705,10 +1710,10 @@ and is between 256 and 4096 characters. It is defined in the file
                         See arch/parisc/kernel/pdc_chassis.c
 
         pf.             [PARIDE]
-                        See Documentation/paride.txt.
+                        See Documentation/blockdev/paride.txt.
 
         pg.             [PARIDE]
-                        See Documentation/paride.txt.
+                        See Documentation/blockdev/paride.txt.
 
         pirq=           [SMP,APIC] Manual mp-table setup
                         See Documentation/x86/i386/IO-APIC.txt.
@@ -1778,7 +1783,7 @@ and is between 256 and 4096 characters. It is defined in the file
 
         prompt_ramdisk= [RAM] List of RAM disks to prompt for floppy disk
                         before loading.
-                        See Documentation/ramdisk.txt.
+                        See Documentation/blockdev/ramdisk.txt.
 
         psmouse.proto=  [HW,MOUSE] Highest PS2 mouse protocol extension to
                         probe for; one of (bare|imps|exps|lifebook|any).
@@ -1798,7 +1803,7 @@ and is between 256 and 4096 characters. It is defined in the file
                         <io>,<mss_io>,<mss_irq>,<mss_dma>,<mpu_io>,<mpu_irq>
 
         pt.             [PARIDE]
-                        See Documentation/paride.txt.
+                        See Documentation/blockdev/paride.txt.
 
         pty.legacy_count=
                         [KNL] Number of legacy pty's. Overwrites compiled-in
@@ -1812,10 +1817,10 @@ and is between 256 and 4096 characters. It is defined in the file
                         See Documentation/md.txt.
 
         ramdisk_blocksize=      [RAM]
-                        See Documentation/ramdisk.txt.
+                        See Documentation/blockdev/ramdisk.txt.
 
         ramdisk_size=   [RAM] Sizes of RAM disks in kilobytes
-                        See Documentation/ramdisk.txt.
+                        See Documentation/blockdev/ramdisk.txt.
 
         rcupdate.blimit=        [KNL,BOOT]
                         Set maximum number of finished RCU callbacks to process
@@ -2147,7 +2152,7 @@ and is between 256 and 4096 characters. It is defined in the file
                         See Documentation/sonypi.txt
 
         specialix=      [HW,SERIAL] Specialix multi-serial port adapter
-                        See Documentation/specialix.txt.
+                        See Documentation/serial/specialix.txt.
 
         spia_io_base=   [HW,MTD]
         spia_fio_base=
diff --git a/Documentation/lockstat.txt b/Documentation/lockstat.txt
index 4ba4664ce5c3..9cb9138f7a79 100644
--- a/Documentation/lockstat.txt
+++ b/Documentation/lockstat.txt
@@ -71,35 +71,50 @@ Look at the current lock statistics:
 
 # less /proc/lock_stat
 
-01 lock_stat version 0.2
+01 lock_stat version 0.3
 02 -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 03                               class name    con-bounces    contentions   waittime-min   waittime-max waittime-total    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total
 04 -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 05
-06               &inode->i_data.tree_lock-W:            15          21657           0.18     1093295.30 11547131054.85             58          10415           0.16          87.51        6387.60
-07               &inode->i_data.tree_lock-R:             0              0           0.00           0.00           0.00          23302         231198           0.25           8.45       98023.38
-08               --------------------------
-09                 &inode->i_data.tree_lock              0          [<ffffffff8027c08f>] add_to_page_cache+0x5f/0x190
-10
-11 ...............................................................................................................................................................................................
-12
-13                              dcache_lock:          1037           1161           0.38          45.32         774.51           6611         243371           0.15         306.48       77387.24
-14                              -----------
-15                              dcache_lock            180          [<ffffffff802c0d7e>] sys_getcwd+0x11e/0x230
-16                              dcache_lock            165          [<ffffffff802c002a>] d_alloc+0x15a/0x210
-17                              dcache_lock             33          [<ffffffff8035818d>] _atomic_dec_and_lock+0x4d/0x70
-18                              dcache_lock              1          [<ffffffff802beef8>] shrink_dcache_parent+0x18/0x130
+06                          &mm->mmap_sem-W:           233            538 18446744073708       22924.27      607243.51           1342          45806           1.71        8595.89     1180582.34
+07                          &mm->mmap_sem-R:           205            587 18446744073708       28403.36      731975.00           1940         412426           0.58      187825.45     6307502.88
+08                          ---------------
+09                            &mm->mmap_sem            487          [<ffffffff8053491f>] do_page_fault+0x466/0x928
+10                            &mm->mmap_sem            179          [<ffffffff802a6200>] sys_mprotect+0xcd/0x21d
+11                            &mm->mmap_sem            279          [<ffffffff80210a57>] sys_mmap+0x75/0xce
+12                            &mm->mmap_sem             76          [<ffffffff802a490b>] sys_munmap+0x32/0x59
+13                          ---------------
+14                            &mm->mmap_sem            270          [<ffffffff80210a57>] sys_mmap+0x75/0xce
+15                            &mm->mmap_sem            431          [<ffffffff8053491f>] do_page_fault+0x466/0x928
+16                            &mm->mmap_sem            138          [<ffffffff802a490b>] sys_munmap+0x32/0x59
+17                            &mm->mmap_sem            145          [<ffffffff802a6200>] sys_mprotect+0xcd/0x21d
+18
+19 ...............................................................................................................................................................................................
+20
+21                              dcache_lock:           621            623           0.52         118.26        1053.02           6745          91930           0.29         316.29      118423.41
+22                              -----------
+23                              dcache_lock            179          [<ffffffff80378274>] _atomic_dec_and_lock+0x34/0x54
+24                              dcache_lock            113          [<ffffffff802cc17b>] d_alloc+0x19a/0x1eb
+25                              dcache_lock             99          [<ffffffff802ca0dc>] d_rehash+0x1b/0x44
+26                              dcache_lock            104          [<ffffffff802cbca0>] d_instantiate+0x36/0x8a
+27                              -----------
+28                              dcache_lock            192          [<ffffffff80378274>] _atomic_dec_and_lock+0x34/0x54
+29                              dcache_lock             98          [<ffffffff802ca0dc>] d_rehash+0x1b/0x44
+30                              dcache_lock             72          [<ffffffff802cc17b>] d_alloc+0x19a/0x1eb
+31                              dcache_lock            112          [<ffffffff802cbca0>] d_instantiate+0x36/0x8a
 
 This excerpt shows the first two lock class statistics. Line 01 shows the
 output version - each time the format changes this will be updated. Line 02-04
-show the header with column descriptions. Lines 05-10 and 13-18 show the actual
+show the header with column descriptions. Lines 05-18 and 20-31 show the actual
 statistics. These statistics come in two parts; the actual stats separated by a
-short separator (line 08, 14) from the contention points.
+short separator (line 08, 13) from the contention points.
 
-The first lock (05-10) is a read/write lock, and shows two lines above the
+The first lock (05-18) is a read/write lock, and shows two lines above the
 short separator. The contention points don't match the column descriptors,
-they have two: contentions and [<IP>] symbol.
+they have two: contentions and [<IP>] symbol. The second set of contention
+points are the points we're contending with.
 
+The integer part of the time values is in us.
 
 View the top contending locks:
 
diff --git a/Documentation/networking/phy.txt b/Documentation/networking/phy.txt
index 8df6a7b0e66c..88bb71b46da4 100644
--- a/Documentation/networking/phy.txt
+++ b/Documentation/networking/phy.txt
@@ -96,7 +96,7 @@ Letting the PHY Abstraction Layer do Everything
    static void adjust_link(struct net_device *dev);
  
  Next, you need to know the device name of the PHY connected to this device. 
- The name will look something like, "phy0:0", where the first number is the
+ The name will look something like, "0:00", where the first number is the
  bus id, and the second is the PHY's address on that bus.  Typically,
  the bus is responsible for making its ID unique.
  
diff --git a/Documentation/serial/00-INDEX b/Documentation/serial/00-INDEX
new file mode 100644
index 000000000000..07dcdb0d2a36
--- /dev/null
+++ b/Documentation/serial/00-INDEX
@@ -0,0 +1,24 @@
+00-INDEX
+        - this file.
+README.cycladesZ
+        - info on Cyclades-Z firmware loading.
+computone.txt
+        - info on Computone Intelliport II/Plus Multiport Serial Driver.
+digiepca.txt
+        - info on Digi Intl. {PC,PCI,EISA}Xx and Xem series cards.
+hayes-esp.txt
+        - info on using the Hayes ESP serial driver.
+moxa-smartio
+        - file with info on installing/using Moxa multiport serial driver.
+riscom8.txt
+        - notes on using the RISCom/8 multi-port serial driver.
+rocket.txt
+        - info on the Comtrol RocketPort multiport serial driver.
+specialix.txt
+        - info on hardware/driver for specialix IO8+ multiport serial card.
+stallion.txt
+        - info on using the Stallion multiport serial driver.
+sx.txt
+        - info on the Specialix SX/SI multiport serial driver.
+tty.txt
+        - guide to the locking policies of the tty layer.
diff --git a/Documentation/README.cycladesZ b/Documentation/serial/README.cycladesZ
index 024a69443cc2..024a69443cc2 100644
--- a/Documentation/README.cycladesZ
+++ b/Documentation/serial/README.cycladesZ
diff --git a/Documentation/computone.txt b/Documentation/serial/computone.txt
index 5e2a0c76bfa0..c57ea4781e5d 100644
--- a/Documentation/computone.txt
+++ b/Documentation/serial/computone.txt
@@ -247,7 +247,7 @@ shar archive to make it easier to extract the script from the documentation.
 To create the ip2mkdev shell script change to a convenient directory (/tmp
 works just fine) and run the following command:
 
-        unshar Documentation/computone.txt
+        unshar Documentation/serial/computone.txt
                 (This file)
 
 You should now have a file ip2mkdev in your current working directory with
diff --git a/Documentation/digiepca.txt b/Documentation/serial/digiepca.txt
index f2560e22f2c9..f2560e22f2c9 100644
--- a/Documentation/digiepca.txt
+++ b/Documentation/serial/digiepca.txt
diff --git a/Documentation/hayes-esp.txt b/Documentation/serial/hayes-esp.txt
index 09b5d5856758..09b5d5856758 100644
--- a/Documentation/hayes-esp.txt
+++ b/Documentation/serial/hayes-esp.txt
diff --git a/Documentation/moxa-smartio b/Documentation/serial/moxa-smartio
index 5337e80a5b96..5337e80a5b96 100644
--- a/Documentation/moxa-smartio
+++ b/Documentation/serial/moxa-smartio
diff --git a/Documentation/riscom8.txt b/Documentation/serial/riscom8.txt
index 14f61fdad7ca..14f61fdad7ca 100644
--- a/Documentation/riscom8.txt
+++ b/Documentation/serial/riscom8.txt
diff --git a/Documentation/rocket.txt b/Documentation/serial/rocket.txt
index 1d8582990435..1d8582990435 100644
--- a/Documentation/rocket.txt
+++ b/Documentation/serial/rocket.txt
diff --git a/Documentation/specialix.txt b/Documentation/serial/specialix.txt
index 6eb6f3a3331c..6eb6f3a3331c 100644
--- a/Documentation/specialix.txt
+++ b/Documentation/serial/specialix.txt
diff --git a/Documentation/stallion.txt b/Documentation/serial/stallion.txt
index 5c4902d9a5be..5c4902d9a5be 100644
--- a/Documentation/stallion.txt
+++ b/Documentation/serial/stallion.txt
diff --git a/Documentation/sx.txt b/Documentation/serial/sx.txt
index cb4efa0fb5cc..cb4efa0fb5cc 100644
--- a/Documentation/sx.txt
+++ b/Documentation/serial/sx.txt
diff --git a/Documentation/tty.txt b/Documentation/serial/tty.txt
index 8e65c4498c52..8e65c4498c52 100644
--- a/Documentation/tty.txt
+++ b/Documentation/serial/tty.txt
diff --git a/MAINTAINERS b/MAINTAINERS
index 8e0777fae3ce..618c1ef4a397 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1809,7 +1809,7 @@ S:	Maintained
 
 FTRACE
 P:      Steven Rostedt
-M:      srostedt@redhat.com
+M:      rostedt@goodmis.org
 S:      Maintained
 
 FUJITSU FR-V (FRV) PORT
@@ -3928,8 +3928,6 @@ M:	bootc@bootc.net
 S:      Maintained
 
 SOFTWARE RAID (Multiple Disks) SUPPORT
-P:      Ingo Molnar
-M:      mingo@redhat.com
 P:      Neil Brown
 M:      neilb@suse.de
 L:      linux-raid@vger.kernel.org
diff --git a/Makefile b/Makefile
index 7f9ff9bf1544..7b1f2384094f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 28
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc6
 NAME = Killer Bat of Doom
 
 # *DOCUMENTATION*
diff --git a/arch/arm/include/asm/dma-mapping.h b/arch/arm/include/asm/dma-mapping.h
index 1cb8602dd9d5..4ed149cbb32a 100644
--- a/arch/arm/include/asm/dma-mapping.h
+++ b/arch/arm/include/asm/dma-mapping.h
@@ -256,8 +256,17 @@ int dmabounce_sync_for_cpu(struct device *, dma_addr_t, unsigned long,
 int dmabounce_sync_for_device(struct device *, dma_addr_t, unsigned long,
                 size_t, enum dma_data_direction);
 #else
-#define dmabounce_sync_for_cpu(dev,dma,off,sz,dir)      (1)
-#define dmabounce_sync_for_device(dev,dma,off,sz,dir)   (1)
+static inline int dmabounce_sync_for_cpu(struct device *d, dma_addr_t addr,
+        unsigned long offset, size_t size, enum dma_data_direction dir)
+{
+        return 1;
+}
+
+static inline int dmabounce_sync_for_device(struct device *d, dma_addr_t addr,
+        unsigned long offset, size_t size, enum dma_data_direction dir)
+{
+        return 1;
+}
 
 
 /**
diff --git a/arch/arm/include/asm/mach/map.h b/arch/arm/include/asm/mach/map.h
index cb1139ac1943..39d949b63e80 100644
--- a/arch/arm/include/asm/mach/map.h
+++ b/arch/arm/include/asm/mach/map.h
@@ -19,12 +19,13 @@ struct map_desc {
 };
 
 /* types 0-3 are defined in asm/io.h */
-#define MT_CACHECLEAN           4
-#define MT_MINICLEAN            5
-#define MT_LOW_VECTORS          6
-#define MT_HIGH_VECTORS         7
-#define MT_MEMORY               8
-#define MT_ROM                  9
+#define MT_UNCACHED             4
+#define MT_CACHECLEAN           5
+#define MT_MINICLEAN            6
+#define MT_LOW_VECTORS          7
+#define MT_HIGH_VECTORS         8
+#define MT_MEMORY               9
+#define MT_ROM                  10
 
 #ifdef CONFIG_MMU
 extern void iotable_init(struct map_desc *, int);
diff --git a/arch/arm/mach-clps711x/include/mach/hardware.h b/arch/arm/mach-clps711x/include/mach/hardware.h
index 4c3e101b96c9..b3ebe9e4871f 100644
--- a/arch/arm/mach-clps711x/include/mach/hardware.h
+++ b/arch/arm/mach-clps711x/include/mach/hardware.h
@@ -94,20 +94,6 @@
 #include <asm/hardware/ep7212.h>
 #include <asm/hardware/cs89712.h>
 
-/* dynamic ioremap() areas */
-#define FLASH_START      0x00000000
-#define FLASH_SIZE       0x800000
-#define FLASH_WIDTH      4
-
-#define SRAM_START       0x60000000
-#define SRAM_SIZE        0xc000
-#define SRAM_WIDTH       4
-
-#define BOOTROM_START    0x70000000
-#define BOOTROM_SIZE     0x80
-#define BOOTROM_WIDTH    4
-
-
 /* static cdb89712_map_io() areas */
 #define REGISTER_START   0x80000000
 #define REGISTER_SIZE    0x4000
@@ -198,14 +184,6 @@
 #define CEIVA_FLASH_SIZE        0x100000
 #define CEIVA_FLASH_WIDTH       2
 
-#define SRAM_START       0x60000000
-#define SRAM_SIZE        0xc000
-#define SRAM_WIDTH       4
-
-#define BOOTROM_START    0x70000000
-#define BOOTROM_SIZE     0x80
-#define BOOTROM_WIDTH    4
-
 /*
  * SED1355 LCD controller
  */
diff --git a/arch/arm/mach-clps7500/core.c b/arch/arm/mach-clps7500/core.c
index c3a33b8a5aac..7e247c04d41c 100644
--- a/arch/arm/mach-clps7500/core.c
+++ b/arch/arm/mach-clps7500/core.c
@@ -275,9 +275,9 @@ static struct map_desc cl7500_io_desc[] __initdata = {
                 .length         = ISA_SIZE,
                 .type           = MT_DEVICE
         }, {    /* Flash        */
-                .virtual        = FLASH_BASE,
-                .pfn            = __phys_to_pfn(FLASH_START),
-                .length         = FLASH_SIZE,
+                .virtual        = CLPS7500_FLASH_BASE,
+                .pfn            = __phys_to_pfn(CLPS7500_FLASH_START),
+                .length         = CLPS7500_FLASH_SIZE,
                 .type           = MT_DEVICE
         }, {    /* LED          */
                 .virtual        = LED_BASE,
diff --git a/arch/arm/mach-clps7500/include/mach/hardware.h b/arch/arm/mach-clps7500/include/mach/hardware.h
index d66578a3371c..a6ad1d44badf 100644
--- a/arch/arm/mach-clps7500/include/mach/hardware.h
+++ b/arch/arm/mach-clps7500/include/mach/hardware.h
@@ -39,9 +39,9 @@
 #define ISA_SIZE                0x00010000
 #define ISA_BASE                0xe1000000
 
-#define FLASH_START             0x01000000      /* XXX */
-#define FLASH_SIZE              0x01000000
-#define FLASH_BASE              0xe2000000
+#define CLPS7500_FLASH_START    0x01000000      /* XXX */
+#define CLPS7500_FLASH_SIZE     0x01000000
+#define CLPS7500_FLASH_BASE     0xe2000000
 
 #define LED_START               0x0302B000
 #define LED_SIZE                0x00001000
diff --git a/arch/arm/mach-h720x/include/mach/boards.h b/arch/arm/mach-h720x/include/mach/boards.h
index 079b279e1242..38b8e0d61fbf 100644
--- a/arch/arm/mach-h720x/include/mach/boards.h
+++ b/arch/arm/mach-h720x/include/mach/boards.h
@@ -19,9 +19,9 @@
 #ifdef CONFIG_ARCH_H7202
 
 /* FLASH */
-#define FLASH_VIRT              0xd0000000
-#define FLASH_PHYS              0x00000000
-#define FLASH_SIZE              0x02000000
+#define H720X_FLASH_VIRT        0xd0000000
+#define H720X_FLASH_PHYS        0x00000000
+#define H720X_FLASH_SIZE        0x02000000
 
 /* onboard LAN controller */
 # define ETH0_PHYS              0x08000000
diff --git a/arch/arm/mach-integrator/include/mach/platform.h b/arch/arm/mach-integrator/include/mach/platform.h
index 028b87839c0f..e00a2624f269 100644
--- a/arch/arm/mach-integrator/include/mach/platform.h
+++ b/arch/arm/mach-integrator/include/mach/platform.h
@@ -408,27 +408,10 @@
 #define uHAL_MEMORY_SIZE                INTEGRATOR_SSRAM_SIZE
 
 /*
- *  Application Flash
- *
- */
-#define FLASH_BASE                      INTEGRATOR_FLASH_BASE
-#define FLASH_SIZE                      INTEGRATOR_FLASH_SIZE
-#define FLASH_END                       (FLASH_BASE + FLASH_SIZE - 1)
-#define FLASH_BLOCK_SIZE                SZ_128K
-
-/*
- *  Boot Flash
- *
- */
-#define EPROM_BASE                      INTEGRATOR_BOOT_ROM_HI
-#define EPROM_SIZE                      INTEGRATOR_BOOT_ROM_SIZE
-#define EPROM_END                       (EPROM_BASE + EPROM_SIZE - 1)
-
-/*
  *  Clean base - dummy
  *
  */
-#define CLEAN_BASE                      EPROM_BASE
+#define CLEAN_BASE                      INTEGRATOR_BOOT_ROM_HI
 
 /*
  *  Timer definitions
diff --git a/arch/arm/mach-pxa/include/mach/pxafb.h b/arch/arm/mach-pxa/include/mach/pxafb.h
index 8e591118371e..cbda4d35c421 100644
--- a/arch/arm/mach-pxa/include/mach/pxafb.h
+++ b/arch/arm/mach-pxa/include/mach/pxafb.h
@@ -33,6 +33,7 @@
 #define LCD_CONN_TYPE(_x)       ((_x) & 0x0f)
 #define LCD_CONN_WIDTH(_x)      (((_x) >> 4) & 0x1f)
 
+#define LCD_TYPE_MASK           0xf
 #define LCD_TYPE_UNKNOWN        0
 #define LCD_TYPE_MONO_STN       1
 #define LCD_TYPE_MONO_DSTN      2
diff --git a/arch/arm/mach-pxa/reset.c b/arch/arm/mach-pxa/reset.c
index 1b2af575c40f..00b2dc2a1074 100644
--- a/arch/arm/mach-pxa/reset.c
+++ b/arch/arm/mach-pxa/reset.c
@@ -90,12 +90,13 @@ void arch_reset(char mode)
                 /* Jump into ROM at address 0 */
                 cpu_reset(0);
                 break;
-        case 'h':
-                do_hw_reset();
-                break;
         case 'g':
                 do_gpio_reset();
                 break;
+        case 'h':
+        default:
+                do_hw_reset();
+                break;
         }
 }
 
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index f0a5bbae0b45..3be76ee2bdbf 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -67,6 +67,7 @@
 static unsigned long spitz_pin_config[] __initdata = {
         /* Chip Selects */
         GPIO78_nCS_2,   /* SCOOP #2 */
+        GPIO79_nCS_3,   /* NAND */
         GPIO80_nCS_4,   /* SCOOP #1 */
 
         /* LCD - 16bpp Active TFT */
@@ -97,10 +98,10 @@ static unsigned long spitz_pin_config[] __initdata = {
         GPIO51_nPIOW,
         GPIO85_nPCE_1,
         GPIO54_nPCE_2,
-        GPIO79_PSKTSEL,
         GPIO55_nPREG,
         GPIO56_nPWAIT,
         GPIO57_nIOIS16,
+        GPIO104_PSKTSEL,
 
         /* MMC */
         GPIO32_MMC_CLK,
@@ -686,7 +687,6 @@ static void __init akita_init(void)
         spitz_pcmcia_config.num_devs = 1;
         platform_scoop_config = &spitz_pcmcia_config;
 
-        pxa_set_i2c_info(NULL);
         i2c_register_board_info(0, ARRAY_AND_SIZE(akita_i2c_board_info));
 
         common_init();
diff --git a/arch/arm/mach-realview/clock.c b/arch/arm/mach-realview/clock.c
index 3e706c57833a..3347c4236a60 100644
--- a/arch/arm/mach-realview/clock.c
+++ b/arch/arm/mach-realview/clock.c
@@ -104,7 +104,7 @@ static struct clk uart_clk = {
 
 static struct clk mmci_clk = {
         .name   = "MCLK",
-        .rate   = 33000000,
+        .rate   = 24000000,
 };
 
 int clk_register(struct clk *clk)
diff --git a/arch/arm/mach-realview/include/mach/platform.h b/arch/arm/mach-realview/include/mach/platform.h
index 4034b54950c2..793a3a332712 100644
--- a/arch/arm/mach-realview/include/mach/platform.h
+++ b/arch/arm/mach-realview/include/mach/platform.h
@@ -239,27 +239,10 @@
 #define REALVIEW_DECODE_OFFSET          0xC     /* Fitted logic modules */
 
 /* 
- *  Application Flash
- * 
- */
-#define FLASH_BASE                      REALVIEW_FLASH_BASE
-#define FLASH_SIZE                      REALVIEW_FLASH_SIZE
-#define FLASH_END                       (FLASH_BASE + FLASH_SIZE - 1)
-#define FLASH_BLOCK_SIZE                SZ_128K
-
-/* 
- *  Boot Flash
- * 
- */
-#define EPROM_BASE                      REALVIEW_BOOT_ROM_HI
-#define EPROM_SIZE                      REALVIEW_BOOT_ROM_SIZE
-#define EPROM_END                       (EPROM_BASE + EPROM_SIZE - 1)
-
-/* 
  *  Clean base - dummy
  * 
  */
-#define CLEAN_BASE                      EPROM_BASE
+#define CLEAN_BASE                      REALVIEW_BOOT_ROM_HI
 
 /*
  * System controller bit assignment
diff --git a/arch/arm/mach-versatile/clock.c b/arch/arm/mach-versatile/clock.c
index 9336508ec0b2..58937f1fb38c 100644
--- a/arch/arm/mach-versatile/clock.c
+++ b/arch/arm/mach-versatile/clock.c
@@ -105,7 +105,7 @@ static struct clk uart_clk = {
 
 static struct clk mmci_clk = {
         .name   = "MCLK",
-        .rate   = 33000000,
+        .rate   = 24000000,
 };
 
 int clk_register(struct clk *clk)
diff --git a/arch/arm/mach-versatile/include/mach/platform.h b/arch/arm/mach-versatile/include/mach/platform.h
index 27cbe6a3f220..f91ba930ca8a 100644
--- a/arch/arm/mach-versatile/include/mach/platform.h
+++ b/arch/arm/mach-versatile/include/mach/platform.h
@@ -436,28 +436,12 @@
 #define SIC_INTMASK_PCI1                (1 << SIC_INT_PCI1)
 #define SIC_INTMASK_PCI2                (1 << SIC_INT_PCI2)
 #define SIC_INTMASK_PCI3                (1 << SIC_INT_PCI3)
-/* 
- *  Application Flash
- * 
- */
-#define FLASH_BASE                      VERSATILE_FLASH_BASE
-#define FLASH_SIZE                      VERSATILE_FLASH_SIZE
-#define FLASH_END                       (FLASH_BASE + FLASH_SIZE - 1)
-#define FLASH_BLOCK_SIZE                SZ_128K
-
-/* 
- *  Boot Flash
- * 
- */
-#define EPROM_BASE                      VERSATILE_BOOT_ROM_HI
-#define EPROM_SIZE                      VERSATILE_BOOT_ROM_SIZE
-#define EPROM_END                       (EPROM_BASE + EPROM_SIZE - 1)
 
 /* 
  *  Clean base - dummy
  * 
  */
-#define CLEAN_BASE                      EPROM_BASE
+#define CLEAN_BASE                      VERSATILE_BOOT_ROM_HI
 
 /*
  * System controller bit assignment
diff --git a/arch/arm/mm/cache-feroceon-l2.c b/arch/arm/mm/cache-feroceon-l2.c
index 13cdae8b0d44..80cd207cbaea 100644
--- a/arch/arm/mm/cache-feroceon-l2.c
+++ b/arch/arm/mm/cache-feroceon-l2.c
@@ -150,7 +150,7 @@ static void feroceon_l2_inv_range(unsigned long start, unsigned long end)
         /*
          * Clean and invalidate partial last cache line.
          */
-        if (end & (CACHE_LINE_SIZE - 1)) {
+        if (start < end && end & (CACHE_LINE_SIZE - 1)) {
                 l2_clean_inv_pa(end & ~(CACHE_LINE_SIZE - 1));
                 end &= ~(CACHE_LINE_SIZE - 1);
         }
@@ -158,7 +158,7 @@ static void feroceon_l2_inv_range(unsigned long start, unsigned long end)
         /*
          * Invalidate all full cache lines between 'start' and 'end'.
          */
-        while (start != end) {
+        while (start < end) {
                 unsigned long range_end = calc_range_end(start, end);
                 l2_inv_pa_range(start, range_end - CACHE_LINE_SIZE);
                 start = range_end;
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index e63db11f16a8..7f36c825718d 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -208,6 +208,12 @@ static struct mem_type mem_types[] = {
                 .prot_sect      = PROT_SECT_DEVICE,
                 .domain         = DOMAIN_IO,
         },
+        [MT_UNCACHED] = {
+                .prot_pte       = PROT_PTE_DEVICE,
+                .prot_l1        = PMD_TYPE_TABLE,
+                .prot_sect      = PMD_TYPE_SECT | PMD_SECT_XN,
+                .domain         = DOMAIN_IO,
+        },
         [MT_CACHECLEAN] = {
                 .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
                 .domain    = DOMAIN_KERNEL,
diff --git a/arch/arm/plat-iop/setup.c b/arch/arm/plat-iop/setup.c
index 4689db638e95..9e573e78176a 100644
--- a/arch/arm/plat-iop/setup.c
+++ b/arch/arm/plat-iop/setup.c
@@ -16,14 +16,15 @@
 #include <asm/hardware/iop3xx.h>
 
 /*
- * Standard IO mapping for all IOP3xx based systems
+ * Standard IO mapping for all IOP3xx based systems.  Note that
+ * the IOP3xx OCCDR must be mapped uncached and unbuffered.
  */
 static struct map_desc iop3xx_std_desc[] __initdata = {
          {      /* mem mapped registers */
                 .virtual        = IOP3XX_PERIPHERAL_VIRT_BASE,
                 .pfn            = __phys_to_pfn(IOP3XX_PERIPHERAL_PHYS_BASE),
                 .length         = IOP3XX_PERIPHERAL_SIZE,
-                .type           = MT_DEVICE,
+                .type           = MT_UNCACHED,
          }, {   /* PCI IO space */
                 .virtual        = IOP3XX_PCI_LOWER_IO_VA,
                 .pfn            = __phys_to_pfn(IOP3XX_PCI_LOWER_IO_PA),
diff --git a/arch/blackfin/include/asm/bfin-global.h b/arch/blackfin/include/asm/bfin-global.h
index 56dcb0a2d244..77295666c34b 100644
--- a/arch/blackfin/include/asm/bfin-global.h
+++ b/arch/blackfin/include/asm/bfin-global.h
@@ -101,7 +101,7 @@ extern u16 _bfin_swrst; /* shadow for Software Reset Register (SWRST) */
 extern unsigned long _ramstart, _ramend, _rambase;
 extern unsigned long memory_start, memory_end, physical_mem_end;
 extern char _stext_l1[], _etext_l1[], _sdata_l1[], _edata_l1[], _sbss_l1[],
-        _ebss_l1[], _l1_lma_start[], _sdata_b_l1[], _ebss_b_l1[],
+        _ebss_l1[], _l1_lma_start[], _sdata_b_l1[], _sbss_b_l1[], _ebss_b_l1[],
         _stext_l2[], _etext_l2[], _sdata_l2[], _edata_l2[], _sbss_l2[],
         _ebss_l2[], _l2_lma_start[];
 
diff --git a/arch/blackfin/include/asm/dma-mapping.h b/arch/blackfin/include/asm/dma-mapping.h
index ede748d67efd..d7d9148e433c 100644
--- a/arch/blackfin/include/asm/dma-mapping.h
+++ b/arch/blackfin/include/asm/dma-mapping.h
@@ -15,7 +15,11 @@ void dma_free_coherent(struct device *dev, size_t size, void *vaddr,
 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
 
-#define dma_mapping_error
+static inline
+int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
+{
+        return 0;
+}
 
 /*
  * Map a single buffer of the indicated size for DMA in streaming mode.
diff --git a/arch/blackfin/kernel/bfin_gpio.c b/arch/blackfin/kernel/bfin_gpio.c
index 6e08f425bb44..5c0800adb4dd 100644
--- a/arch/blackfin/kernel/bfin_gpio.c
+++ b/arch/blackfin/kernel/bfin_gpio.c
@@ -218,7 +218,7 @@ inline int check_gpio(unsigned gpio)
         if (gpio == GPIO_PB15 || gpio == GPIO_PC14 || gpio == GPIO_PC15
             || gpio == GPIO_PH14 || gpio == GPIO_PH15
             || gpio == GPIO_PJ14 || gpio == GPIO_PJ15
-            || gpio > MAX_BLACKFIN_GPIOS)
+            || gpio >= MAX_BLACKFIN_GPIOS)
                 return -EINVAL;
         return 0;
 }
diff --git a/arch/blackfin/kernel/cplb-nompu/cplbinit.c b/arch/blackfin/kernel/cplb-nompu/cplbinit.c
index 512f8c92ead5..2debc900e246 100644
--- a/arch/blackfin/kernel/cplb-nompu/cplbinit.c
+++ b/arch/blackfin/kernel/cplb-nompu/cplbinit.c
@@ -188,10 +188,11 @@ static struct cplb_desc cplb_data[] = {
 
 static u16 __init lock_kernel_check(u32 start, u32 end)
 {
-        if ((end   <= (u32) _end && end   >= (u32)_stext) ||
-            (start <= (u32) _end && start >= (u32)_stext))
-                return IN_KERNEL;
-        return 0;
+        if (start >= (u32)_end || end <= (u32)_stext)
+                return 0;
+
+        /* This cplb block overlapped with kernel area. */
+        return IN_KERNEL;
 }
 
 static unsigned short __init
diff --git a/arch/blackfin/kernel/process.c b/arch/blackfin/kernel/process.c
index 77800dd83e57..0c3ea118b657 100644
--- a/arch/blackfin/kernel/process.c
+++ b/arch/blackfin/kernel/process.c
@@ -351,10 +351,15 @@ int _access_ok(unsigned long addr, unsigned long size)
                 return 1;
 #endif
 #if L1_DATA_B_LENGTH != 0
-        if (addr >= L1_DATA_B_START
+        if (addr >= L1_DATA_B_START + (_ebss_b_l1 - _sdata_b_l1)
             && addr + size <= L1_DATA_B_START + L1_DATA_B_LENGTH)
                 return 1;
 #endif
+#if L2_LENGTH != 0
+        if (addr >= L2_START + (_ebss_l2 - _stext_l2)
+            && addr + size <= L2_START + L2_LENGTH)
+                return 1;
+#endif
         return 0;
 }
 EXPORT_SYMBOL(_access_ok);
diff --git a/arch/blackfin/kernel/setup.c b/arch/blackfin/kernel/setup.c
index 7f35d1046cd8..71a9a8c53cea 100644
--- a/arch/blackfin/kernel/setup.c
+++ b/arch/blackfin/kernel/setup.c
@@ -119,23 +119,23 @@ void __init bfin_relocate_l1_mem(void)
         /* Copy _stext_l1 to _etext_l1 to L1 instruction SRAM */
         dma_memcpy(_stext_l1, _l1_lma_start, l1_code_length);
 
-        l1_data_a_length = _ebss_l1 - _sdata_l1;
+        l1_data_a_length = _sbss_l1 - _sdata_l1;
         if (l1_data_a_length > L1_DATA_A_LENGTH)
                 panic("L1 Data SRAM Bank A Overflow\n");
 
-        /* Copy _sdata_l1 to _ebss_l1 to L1 data bank A SRAM */
+        /* Copy _sdata_l1 to _sbss_l1 to L1 data bank A SRAM */
         dma_memcpy(_sdata_l1, _l1_lma_start + l1_code_length, l1_data_a_length);
 
-        l1_data_b_length = _ebss_b_l1 - _sdata_b_l1;
+        l1_data_b_length = _sbss_b_l1 - _sdata_b_l1;
         if (l1_data_b_length > L1_DATA_B_LENGTH)
                 panic("L1 Data SRAM Bank B Overflow\n");
 
-        /* Copy _sdata_b_l1 to _ebss_b_l1 to L1 data bank B SRAM */
+        /* Copy _sdata_b_l1 to _sbss_b_l1 to L1 data bank B SRAM */
         dma_memcpy(_sdata_b_l1, _l1_lma_start + l1_code_length +
                         l1_data_a_length, l1_data_b_length);
 
         if (L2_LENGTH != 0) {
-                l2_length = _ebss_l2 - _stext_l2;
+                l2_length = _sbss_l2 - _stext_l2;
                 if (l2_length > L2_LENGTH)
                         panic("L2 SRAM Overflow\n");
 
@@ -827,7 +827,7 @@ void __init setup_arch(char **cmdline_p)
                                 printk(KERN_ERR "Warning: Compiled for Rev %d, but running on Rev %d\n",
                                        bfin_compiled_revid(), bfin_revid());
                 }
-                if (bfin_revid() <= CONFIG_BF_REV_MIN || bfin_revid() > CONFIG_BF_REV_MAX)
+                if (bfin_revid() < CONFIG_BF_REV_MIN || bfin_revid() > CONFIG_BF_REV_MAX)
                         printk(KERN_ERR "Warning: Unsupported Chip Revision ADSP-%s Rev 0.%d detected\n",
                                CPU, bfin_revid());
         }
diff --git a/arch/blackfin/kernel/traps.c b/arch/blackfin/kernel/traps.c
index 1aa2c788e228..bef025b07443 100644
--- a/arch/blackfin/kernel/traps.c
+++ b/arch/blackfin/kernel/traps.c
@@ -59,7 +59,7 @@
 #endif
 
 
-#ifdef CONFIG_VERBOSE_DEBUG
+#ifdef CONFIG_DEBUG_VERBOSE
 #define verbose_printk(fmt, arg...) \
         printk(fmt, ##arg)
 #else
@@ -147,9 +147,12 @@ static void decode_address(char *buf, unsigned long address)
                                 char *name = p->comm;
                                 struct file *file = vma->vm_file;
 
-                                if (file)
-                                        name = d_path(&file->f_path, _tmpbuf,
+                                if (file) {
+                                        char *d_name = d_path(&file->f_path, _tmpbuf,
                                                       sizeof(_tmpbuf));
+                                        if (!IS_ERR(d_name))
+                                                name = d_name;
+                                }
 
                                 /* FLAT does not have its text aligned to the start of
                                  * the map while FDPIC ELF does ...
@@ -571,7 +574,7 @@ asmlinkage void trap_c(struct pt_regs *fp)
 #endif
                         panic("Kernel exception");
                 } else {
-#ifdef CONFIG_VERBOSE_DEBUG
+#ifdef CONFIG_DEBUG_VERBOSE
                         unsigned long *stack;
                         /* Dump the user space stack */
                         stack = (unsigned long *)rdusp();
diff --git a/arch/blackfin/mach-common/cache.S b/arch/blackfin/mach-common/cache.S
index db532181fbde..a028e9450419 100644
--- a/arch/blackfin/mach-common/cache.S
+++ b/arch/blackfin/mach-common/cache.S
@@ -25,9 +25,13 @@
  */
 .macro do_flush flushins:req optflushins optnopins label
 
+        R2 = -L1_CACHE_BYTES;
+
+        /* start = (start & -L1_CACHE_BYTES) */
+        R0 = R0 & R2;
+
         /* end = ((end - 1) & -L1_CACHE_BYTES) + L1_CACHE_BYTES; */
         R1 += -1;
-        R2 = -L1_CACHE_BYTES;
         R1 = R1 & R2;
         R1 += L1_CACHE_BYTES;
 
@@ -63,7 +67,7 @@ ENDPROC(_blackfin_icache_flush_range)
 
 /* Flush all cache lines assocoiated with this area of memory. */
 ENTRY(_blackfin_icache_dcache_flush_range)
-        do_flush IFLUSH, FLUSH
+        do_flush FLUSH, IFLUSH
 ENDPROC(_blackfin_icache_dcache_flush_range)
 
 /* Throw away all D-cached data in specified region without any obligation to
diff --git a/arch/blackfin/mach-common/cpufreq.c b/arch/blackfin/mach-common/cpufreq.c
index c22c47b60127..dda5443b37ed 100644
--- a/arch/blackfin/mach-common/cpufreq.c
+++ b/arch/blackfin/mach-common/cpufreq.c
@@ -72,13 +72,13 @@ unsigned int __bfin_cycles_mod;
 
 /**************************************************************************/
 
-static unsigned int bfin_getfreq(unsigned int cpu)
+static unsigned int bfin_getfreq_khz(unsigned int cpu)
 {
         /* The driver only support single cpu */
         if (cpu != 0)
                 return -1;
 
-        return get_cclk();
+        return get_cclk() / 1000;
 }
 
 
@@ -96,7 +96,7 @@ static int bfin_target(struct cpufreq_policy *policy,
 
         cclk_hz = bfin_freq_table[index].frequency;
 
-        freqs.old = bfin_getfreq(0);
+        freqs.old = bfin_getfreq_khz(0);
         freqs.new = cclk_hz;
         freqs.cpu = 0;
 
@@ -137,8 +137,8 @@ static int __init __bfin_cpu_init(struct cpufreq_policy *policy)
         if (policy->cpu != 0)
                 return -EINVAL;
 
-        cclk = get_cclk();
-        sclk = get_sclk();
+        cclk = get_cclk() / 1000;
+        sclk = get_sclk() / 1000;
 
 #if ANOMALY_05000273 || (!defined(CONFIG_BF54x) && defined(CONFIG_BFIN_DCACHE))
         min_cclk = sclk * 2;
@@ -152,7 +152,7 @@ static int __init __bfin_cpu_init(struct cpufreq_policy *policy)
                 dpm_state_table[index].csel = csel << 4; /* Shift now into PLL_DIV bitpos */
                 dpm_state_table[index].tscale =  (TIME_SCALE / (1 << csel)) - 1;
 
-                pr_debug("cpufreq: freq:%d csel:%d tscale:%d\n",
+                pr_debug("cpufreq: freq:%d csel:0x%x tscale:%d\n",
                                                  bfin_freq_table[index].frequency,
                                                  dpm_state_table[index].csel,
                                                  dpm_state_table[index].tscale);
@@ -173,7 +173,7 @@ static struct freq_attr *bfin_freq_attr[] = {
 static struct cpufreq_driver bfin_driver = {
         .verify = bfin_verify_speed,
         .target = bfin_target,
-        .get = bfin_getfreq,
+        .get = bfin_getfreq_khz,
         .init = __bfin_cpu_init,
         .name = "bfin cpufreq",
         .owner = THIS_MODULE,
diff --git a/arch/blackfin/mach-common/entry.S b/arch/blackfin/mach-common/entry.S
index c13fa8da28c7..bde6dc4e2614 100644
--- a/arch/blackfin/mach-common/entry.S
+++ b/arch/blackfin/mach-common/entry.S
@@ -277,7 +277,7 @@ ENTRY(_bfin_return_from_exception)
         p5.h = hi(ILAT);
         r6 = [p5];
         r7 = 0x20;              /* Did I just cause anther HW error? */
-        r7 = r7 & r1;
+        r6 = r7 & r6;
         CC = R7 == R6;
         if CC JUMP _double_fault;
 #endif
diff --git a/arch/blackfin/mm/sram-alloc.c b/arch/blackfin/mm/sram-alloc.c
index 0f1ca6930c16..cc6f336e7313 100644
--- a/arch/blackfin/mm/sram-alloc.c
+++ b/arch/blackfin/mm/sram-alloc.c
@@ -183,10 +183,10 @@ static void __init l2_sram_init(void)
                 return;
         }
 
-        free_l2_sram_head.next->paddr = (void *)L2_START +
-                (_etext_l2 - _stext_l2) + (_edata_l2 - _sdata_l2);
-        free_l2_sram_head.next->size = L2_LENGTH -
-                (_etext_l2 - _stext_l2) + (_edata_l2 - _sdata_l2);
+        free_l2_sram_head.next->paddr =
+                (void *)L2_START + (_ebss_l2 - _stext_l2);
+        free_l2_sram_head.next->size =
+                L2_LENGTH - (_ebss_l2 - _stext_l2);
         free_l2_sram_head.next->pid = 0;
         free_l2_sram_head.next->next = NULL;
 
diff --git a/arch/ia64/include/asm/intrinsics.h b/arch/ia64/include/asm/intrinsics.h
index 47d686dba1eb..a3e44a5ed497 100644
--- a/arch/ia64/include/asm/intrinsics.h
+++ b/arch/ia64/include/asm/intrinsics.h
@@ -226,7 +226,7 @@ extern long ia64_cmpxchg_called_with_bad_pointer (void);
 /************************************************/
 #define ia64_ssm                        IA64_INTRINSIC_MACRO(ssm)
 #define ia64_rsm                        IA64_INTRINSIC_MACRO(rsm)
-#define ia64_getreg                     IA64_INTRINSIC_API(getreg)
+#define ia64_getreg                     IA64_INTRINSIC_MACRO(getreg)
 #define ia64_setreg                     IA64_INTRINSIC_API(setreg)
 #define ia64_set_rr                     IA64_INTRINSIC_API(set_rr)
 #define ia64_get_rr                     IA64_INTRINSIC_API(get_rr)
diff --git a/arch/ia64/include/asm/paravirt_privop.h b/arch/ia64/include/asm/paravirt_privop.h
index d577aac11835..0b597424fcfc 100644
--- a/arch/ia64/include/asm/paravirt_privop.h
+++ b/arch/ia64/include/asm/paravirt_privop.h
@@ -78,6 +78,19 @@ extern unsigned long ia64_native_getreg_func(int regnum);
                         ia64_native_rsm(mask);  \
         } while (0)
 
+/* returned ip value should be the one in the caller,
+ * not in __paravirt_getreg() */
+#define paravirt_getreg(reg)                                    \
+        ({                                                      \
+                unsigned long res;                              \
+                BUILD_BUG_ON(!__builtin_constant_p(reg));       \
+                if ((reg) == _IA64_REG_IP)                      \
+                        res = ia64_native_getreg(_IA64_REG_IP); \
+                else                                            \
+                        res = pv_cpu_ops.getreg(reg);           \
+                res;                                            \
+        })
+
 /******************************************************************************
  * replacement of hand written assembly codes.
  */
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 7ef0c594f5ed..d435f4a7a96c 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -499,6 +499,7 @@ GLOBAL_ENTRY(prefetch_stack)
 END(prefetch_stack)
 
 GLOBAL_ENTRY(kernel_execve)
+        rum psr.ac
         mov r15=__NR_execve                     // put syscall number in place
         break __BREAK_SYSCALL
         br.ret.sptk.many rp
diff --git a/arch/ia64/kernel/head.S b/arch/ia64/kernel/head.S
index 66e491d8baac..59301c472800 100644
--- a/arch/ia64/kernel/head.S
+++ b/arch/ia64/kernel/head.S
@@ -260,7 +260,7 @@ start_ap:
          * Switch into virtual mode:
          */
         movl r16=(IA64_PSR_IT|IA64_PSR_IC|IA64_PSR_DT|IA64_PSR_RT|IA64_PSR_DFH|IA64_PSR_BN \
-                  |IA64_PSR_DI)
+                  |IA64_PSR_DI|IA64_PSR_AC)
         ;;
         mov cr.ipsr=r16
         movl r17=1f
diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
index 7dd96c127177..bab1de2d2f6a 100644
--- a/arch/ia64/kernel/mca.c
+++ b/arch/ia64/kernel/mca.c
@@ -1139,7 +1139,7 @@ ia64_mca_modify_original_stack(struct pt_regs *regs,
         return previous_current;
 
 no_mod:
-        printk(KERN_INFO "cpu %d, %s %s, original stack not modified\n",
+        mprintk(KERN_INFO "cpu %d, %s %s, original stack not modified\n",
                         smp_processor_id(), type, msg);
         return previous_current;
 }
diff --git a/arch/ia64/kernel/paravirt.c b/arch/ia64/kernel/paravirt.c
index de35d8e8b7d2..9f14c16f6369 100644
--- a/arch/ia64/kernel/paravirt.c
+++ b/arch/ia64/kernel/paravirt.c
@@ -130,7 +130,7 @@ ia64_native_getreg_func(int regnum)
         unsigned long res = -1;
         switch (regnum) {
         CASE_GET_REG(GP);
-        CASE_GET_REG(IP);
+        /*CASE_GET_REG(IP);*/ /* returned ip value shouldn't be constant */
         CASE_GET_REG(PSR);
         CASE_GET_REG(TP);
         CASE_GET_REG(SP);
diff --git a/arch/ia64/kernel/pci-dma.c b/arch/ia64/kernel/pci-dma.c
index dbdb778efa05..2a92f637431d 100644
--- a/arch/ia64/kernel/pci-dma.c
+++ b/arch/ia64/kernel/pci-dma.c
@@ -19,7 +19,6 @@
 #include <linux/kernel.h>
 
 #include <asm/page.h>
-#include <asm/iommu.h>
 
 dma_addr_t bad_dma_address __read_mostly;
 EXPORT_SYMBOL(bad_dma_address);
diff --git a/arch/ia64/xen/hypercall.S b/arch/ia64/xen/hypercall.S
index d4ff0b9e79f1..45e02bb64a92 100644
--- a/arch/ia64/xen/hypercall.S
+++ b/arch/ia64/xen/hypercall.S
@@ -58,7 +58,7 @@ __HCALL2(xen_set_rr, HYPERPRIVOP_SET_RR)
 __HCALL2(xen_set_kr, HYPERPRIVOP_SET_KR)
 
 #ifdef CONFIG_IA32_SUPPORT
-__HCALL1(xen_get_eflag, HYPERPRIVOP_GET_EFLAG)
+__HCALL0(xen_get_eflag, HYPERPRIVOP_GET_EFLAG)
 __HCALL1(xen_set_eflag, HYPERPRIVOP_SET_EFLAG)  // refer SDM vol1 3.1.8
 #endif /* CONFIG_IA32_SUPPORT */
 
diff --git a/arch/m68k/kernel/ints.c b/arch/m68k/kernel/ints.c
index 7e8a0d394e61..761ee0440c99 100644
--- a/arch/m68k/kernel/ints.c
+++ b/arch/m68k/kernel/ints.c
@@ -133,7 +133,7 @@ void __init m68k_setup_user_interrupt(unsigned int vec, unsigned int cnt,
 {
         int i;
 
-        BUG_ON(IRQ_USER + cnt >= NR_IRQS);
+        BUG_ON(IRQ_USER + cnt > NR_IRQS);
         m68k_first_user_vec = vec;
         for (i = 0; i < cnt; i++)
                 irq_controller[IRQ_USER + i] = &user_irq_controller;
diff --git a/arch/mips/include/asm/mach-rc32434/gpio.h b/arch/mips/include/asm/mach-rc32434/gpio.h
index c8e554eafce3..b5cf6457305a 100644
--- a/arch/mips/include/asm/mach-rc32434/gpio.h
+++ b/arch/mips/include/asm/mach-rc32434/gpio.h
@@ -84,5 +84,7 @@ extern void set_434_reg(unsigned reg_offs, unsigned bit, unsigned len, unsigned
 extern unsigned get_434_reg(unsigned reg_offs);
 extern void set_latch_u5(unsigned char or_mask, unsigned char nand_mask);
 extern unsigned char get_latch_u5(void);
+extern void rb532_gpio_set_ilevel(int bit, unsigned gpio);
+extern void rb532_gpio_set_istat(int bit, unsigned gpio);
 
 #endif /* _RC32434_GPIO_H_ */
diff --git a/arch/mips/include/asm/mach-rc32434/rb.h b/arch/mips/include/asm/mach-rc32434/rb.h
index 79e8ef67d0d3..f25a84916703 100644
--- a/arch/mips/include/asm/mach-rc32434/rb.h
+++ b/arch/mips/include/asm/mach-rc32434/rb.h
@@ -40,12 +40,14 @@
 #define BTCS            0x010040
 #define BTCOMPARE       0x010044
 #define GPIOBASE        0x050000
-#define GPIOCFG         0x050004
-#define GPIOD           0x050008
-#define GPIOILEVEL      0x05000C
-#define GPIOISTAT       0x050010
-#define GPIONMIEN       0x050014
-#define IMASK6          0x038038
+/* Offsets relative to GPIOBASE */
+#define GPIOFUNC        0x00
+#define GPIOCFG         0x04
+#define GPIOD           0x08
+#define GPIOILEVEL      0x0C
+#define GPIOISTAT       0x10
+#define GPIONMIEN       0x14
+#define IMASK6          0x38
 #define LO_WPX          (1 << 0)
 #define LO_ALE          (1 << 1)
 #define LO_CLE          (1 << 2)
diff --git a/arch/mips/include/asm/time.h b/arch/mips/include/asm/time.h
index d3bd5c5aa2ec..9601ea950542 100644
--- a/arch/mips/include/asm/time.h
+++ b/arch/mips/include/asm/time.h
@@ -63,7 +63,7 @@ static inline int mips_clockevent_init(void)
 /*
  * Initialize the count register as a clocksource
  */
-#ifdef CONFIG_CEVT_R4K
+#ifdef CONFIG_CSRC_R4K
 extern int init_mips_clocksource(void);
 #else
 static inline int init_mips_clocksource(void)
diff --git a/arch/mips/kernel/csrc-r4k.c b/arch/mips/kernel/csrc-r4k.c
index 86e026f067bc..74fb74583b4e 100644
--- a/arch/mips/kernel/csrc-r4k.c
+++ b/arch/mips/kernel/csrc-r4k.c
@@ -27,7 +27,7 @@ int __init init_mips_clocksource(void)
         if (!cpu_has_counter || !mips_hpt_frequency)
                 return -ENXIO;
 
-        /* Calclate a somewhat reasonable rating value */
+        /* Calculate a somewhat reasonable rating value */
         clocksource_mips.rating = 200 + mips_hpt_frequency / 10000000;
 
         clocksource_set_clock(&clocksource_mips, mips_hpt_frequency);
diff --git a/arch/mips/mm/sc-ip22.c b/arch/mips/mm/sc-ip22.c
index 1f602a110e10..13adb5782110 100644
--- a/arch/mips/mm/sc-ip22.c
+++ b/arch/mips/mm/sc-ip22.c
@@ -161,7 +161,7 @@ static inline int __init indy_sc_probe(void)
 
 /* XXX Check with wje if the Indy caches can differenciate between
    writeback + invalidate and just invalidate.  */
-struct bcache_ops indy_sc_ops = {
+static struct bcache_ops indy_sc_ops = {
         .bc_enable = indy_sc_enable,
         .bc_disable = indy_sc_disable,
         .bc_wback_inv = indy_sc_wback_invalidate,
diff --git a/arch/mips/mti-malta/malta-amon.c b/arch/mips/mti-malta/malta-amon.c
index 96236bf33838..df9e526312a2 100644
--- a/arch/mips/mti-malta/malta-amon.c
+++ b/arch/mips/mti-malta/malta-amon.c
@@ -22,9 +22,9 @@
 #include <linux/init.h>
 #include <linux/smp.h>
 
-#include <asm-mips/addrspace.h>
-#include <asm-mips/mips-boards/launch.h>
-#include <asm-mips/mipsmtregs.h>
+#include <asm/addrspace.h>
+#include <asm/mips-boards/launch.h>
+#include <asm/mipsmtregs.h>
 
 int amon_cpu_avail(int cpu)
 {
diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c
index 2f22d714d5b0..c1c29181bd46 100644
--- a/arch/mips/rb532/devices.c
+++ b/arch/mips/rb532/devices.c
@@ -118,7 +118,7 @@ static struct platform_device cf_slot0 = {
 /* Resources and device for NAND */
 static int rb532_dev_ready(struct mtd_info *mtd)
 {
-        return readl(IDT434_REG_BASE + GPIOD) & GPIO_RDY;
+        return gpio_get_value(GPIO_RDY);
 }
 
 static void rb532_cmd_ctrl(struct mtd_info *mtd, int cmd, unsigned int ctrl)
diff --git a/arch/mips/rb532/gpio.c b/arch/mips/rb532/gpio.c
index 70c4a6726377..0e84c8ab6a39 100644
--- a/arch/mips/rb532/gpio.c
+++ b/arch/mips/rb532/gpio.c
@@ -39,10 +39,6 @@
 struct rb532_gpio_chip {
         struct gpio_chip chip;
         void __iomem     *regbase;
-        void            (*set_int_level)(struct gpio_chip *chip, unsigned offset, int value);
-        int             (*get_int_level)(struct gpio_chip *chip, unsigned offset);
-        void            (*set_int_status)(struct gpio_chip *chip, unsigned offset, int value);
-        int             (*get_int_status)(struct gpio_chip *chip, unsigned offset);
 };
 
 struct mpmc_device dev3;
@@ -111,15 +107,47 @@ unsigned char get_latch_u5(void)
 }
 EXPORT_SYMBOL(get_latch_u5);
 
+/* rb532_set_bit - sanely set a bit
+ *
+ * bitval: new value for the bit
+ * offset: bit index in the 4 byte address range
+ * ioaddr: 4 byte aligned address being altered
+ */
+static inline void rb532_set_bit(unsigned bitval,
+                unsigned offset, void __iomem *ioaddr)
+{
+        unsigned long flags;
+        u32 val;
+
+        bitval = !!bitval;              /* map parameter to {0,1} */
+
+        local_irq_save(flags);
+
+        val = readl(ioaddr);
+        val &= ~( ~bitval << offset );   /* unset bit if bitval == 0 */
+        val |=  (  bitval << offset );   /* set bit if bitval == 1 */
+        writel(val, ioaddr);
+
+        local_irq_restore(flags);
+}
+
+/* rb532_get_bit - read a bit
+ *
+ * returns the boolean state of the bit, which may be > 1
+ */
+static inline int rb532_get_bit(unsigned offset, void __iomem *ioaddr)
+{
+        return (readl(ioaddr) & (1 << offset));
+}
+
 /*
  * Return GPIO level */
 static int rb532_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
-        u32                     mask = 1 << offset;
         struct rb532_gpio_chip  *gpch;
 
         gpch = container_of(chip, struct rb532_gpio_chip, chip);
-        return readl(gpch->regbase + GPIOD) & mask;
+        return rb532_get_bit(offset, gpch->regbase + GPIOD);
 }
 
 /*
@@ -128,23 +156,10 @@ static int rb532_gpio_get(struct gpio_chip *chip, unsigned offset)
 static void rb532_gpio_set(struct gpio_chip *chip,
                                 unsigned offset, int value)
 {
-        unsigned long           flags;
-        u32                     mask = 1 << offset;
-        u32                     tmp;
         struct rb532_gpio_chip  *gpch;
-        void __iomem            *gpvr;
 
         gpch = container_of(chip, struct rb532_gpio_chip, chip);
-        gpvr = gpch->regbase + GPIOD;
-
-        local_irq_save(flags);
-        tmp = readl(gpvr);
-        if (value)
-                tmp |= mask;
-        else
-                tmp &= ~mask;
-        writel(tmp, gpvr);
-        local_irq_restore(flags);
+        rb532_set_bit(value, offset, gpch->regbase + GPIOD);
 }
 
 /*
@@ -152,21 +167,14 @@ static void rb532_gpio_set(struct gpio_chip *chip,
  */
 static int rb532_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 {
-        unsigned long           flags;
-        u32                     mask = 1 << offset;
-        u32                     value;
         struct rb532_gpio_chip  *gpch;
-        void __iomem            *gpdr;
 
         gpch = container_of(chip, struct rb532_gpio_chip, chip);
-        gpdr = gpch->regbase + GPIOCFG;
 
-        local_irq_save(flags);
-        value = readl(gpdr);
-        value &= ~mask;
-        writel(value, gpdr);
-        local_irq_restore(flags);
+        if (rb532_get_bit(offset, gpch->regbase + GPIOFUNC))
+                return 1;       /* alternate function, GPIOCFG is ignored */
 
+        rb532_set_bit(0, offset, gpch->regbase + GPIOCFG);
         return 0;
 }
 
@@ -176,117 +184,60 @@ static int rb532_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 static int rb532_gpio_direction_output(struct gpio_chip *chip,
                                         unsigned offset, int value)
 {
-        unsigned long           flags;
-        u32                     mask = 1 << offset;
-        u32                     tmp;
         struct rb532_gpio_chip  *gpch;
-        void __iomem            *gpdr;
 
         gpch = container_of(chip, struct rb532_gpio_chip, chip);
-        writel(mask, gpch->regbase + GPIOD);
-        gpdr = gpch->regbase + GPIOCFG;
 
-        local_irq_save(flags);
-        tmp = readl(gpdr);
-        tmp |= mask;
-        writel(tmp, gpdr);
-        local_irq_restore(flags);
+        if (rb532_get_bit(offset, gpch->regbase + GPIOFUNC))
+                return 1;       /* alternate function, GPIOCFG is ignored */
 
+        /* set the initial output value */
+        rb532_set_bit(value, offset, gpch->regbase + GPIOD);
+
+        rb532_set_bit(1, offset, gpch->regbase + GPIOCFG);
         return 0;
 }
 
-/*
- * Set the GPIO interrupt level
- */
-static void rb532_gpio_set_int_level(struct gpio_chip *chip,
-                                        unsigned offset, int value)
-{
-        unsigned long           flags;
-        u32                     mask = 1 << offset;
-        u32                     tmp;
-        struct rb532_gpio_chip  *gpch;
-        void __iomem            *gpil;
-
-        gpch = container_of(chip, struct rb532_gpio_chip, chip);
-        gpil = gpch->regbase + GPIOILEVEL;
-
-        local_irq_save(flags);
-        tmp = readl(gpil);
-        if (value)
-                tmp |= mask;
-        else
-                tmp &= ~mask;
-        writel(tmp, gpil);
-        local_irq_restore(flags);
-}
+static struct rb532_gpio_chip rb532_gpio_chip[] = {
+        [0] = {
+                .chip = {
+                        .label                  = "gpio0",
+                        .direction_input        = rb532_gpio_direction_input,
+                        .direction_output       = rb532_gpio_direction_output,
+                        .get                    = rb532_gpio_get,
+                        .set                    = rb532_gpio_set,
+                        .base                   = 0,
+                        .ngpio                  = 32,
+                },
+        },
+};
 
 /*
- * Get the GPIO interrupt level
+ * Set GPIO interrupt level
  */
-static int rb532_gpio_get_int_level(struct gpio_chip *chip, unsigned offset)
+void rb532_gpio_set_ilevel(int bit, unsigned gpio)
 {
-        u32                     mask = 1 << offset;
-        struct rb532_gpio_chip  *gpch;
-
-        gpch = container_of(chip, struct rb532_gpio_chip, chip);
-        return readl(gpch->regbase + GPIOILEVEL) & mask;
+        rb532_set_bit(bit, gpio, rb532_gpio_chip->regbase + GPIOILEVEL);
 }
+EXPORT_SYMBOL(rb532_gpio_set_ilevel);
 
 /*
- * Set the GPIO interrupt status
+ * Set GPIO interrupt status
  */
-static void rb532_gpio_set_int_status(struct gpio_chip *chip,
-                                unsigned offset, int value)
+void rb532_gpio_set_istat(int bit, unsigned gpio)
 {
-        unsigned long           flags;
-        u32                     mask = 1 << offset;
-        u32                     tmp;
-        struct rb532_gpio_chip  *gpch;
-        void __iomem            *gpis;
-
-        gpch = container_of(chip, struct rb532_gpio_chip, chip);
-        gpis = gpch->regbase + GPIOISTAT;
-
-        local_irq_save(flags);
-        tmp = readl(gpis);
-        if (value)
-                tmp |= mask;
-        else
-                tmp &= ~mask;
-        writel(tmp, gpis);
-        local_irq_restore(flags);
+        rb532_set_bit(bit, gpio, rb532_gpio_chip->regbase + GPIOISTAT);
 }
+EXPORT_SYMBOL(rb532_gpio_set_istat);
 
 /*
- * Get the GPIO interrupt status
+ * Configure GPIO alternate function
  */
-static int rb532_gpio_get_int_status(struct gpio_chip *chip, unsigned offset)
+static void rb532_gpio_set_func(int bit, unsigned gpio)
 {
-        u32                     mask = 1 << offset;
-        struct rb532_gpio_chip  *gpch;
-
-        gpch = container_of(chip, struct rb532_gpio_chip, chip);
-        return readl(gpch->regbase + GPIOISTAT) & mask;
+       rb532_set_bit(bit, gpio, rb532_gpio_chip->regbase + GPIOFUNC);
 }
 
-static struct rb532_gpio_chip rb532_gpio_chip[] = {
-        [0] = {
-                .chip = {
-                        .label                  = "gpio0",
-                        .direction_input        = rb532_gpio_direction_input,
-                        .direction_output       = rb532_gpio_direction_output,
-                        .get                    = rb532_gpio_get,
-                        .set                    = rb532_gpio_set,
-                        .base                   = 0,
-                        .ngpio                  = 32,
-                },
-                .get_int_level          = rb532_gpio_get_int_level,
-                .set_int_level          = rb532_gpio_set_int_level,
-                .get_int_status         = rb532_gpio_get_int_status,
-                .set_int_status         = rb532_gpio_set_int_status,
-        },
-};
-
 int __init rb532_gpio_init(void)
 {
         struct resource *r;
@@ -310,9 +261,11 @@ int __init rb532_gpio_init(void)
                 return -ENXIO;
         }
 
-        /* Set the interrupt status and level for the CF pin */
-        rb532_gpio_set_int_level(&rb532_gpio_chip->chip, CF_GPIO_NUM, 1);
-        rb532_gpio_set_int_status(&rb532_gpio_chip->chip, CF_GPIO_NUM, 0);
+        /* configure CF_GPIO_NUM as CFRDY IRQ source */
+        rb532_gpio_set_func(0, CF_GPIO_NUM);
+        rb532_gpio_direction_input(&rb532_gpio_chip->chip, CF_GPIO_NUM);
+        rb532_gpio_set_ilevel(1, CF_GPIO_NUM);
+        rb532_gpio_set_istat(0, CF_GPIO_NUM);
 
         return 0;
 }
diff --git a/arch/parisc/include/asm/smp.h b/arch/parisc/include/asm/smp.h
index 398cdbaf4e54..409e698f4361 100644
--- a/arch/parisc/include/asm/smp.h
+++ b/arch/parisc/include/asm/smp.h
@@ -44,8 +44,6 @@ extern void arch_send_call_function_ipi(cpumask_t mask);
  
 #define PROC_CHANGE_PENALTY     15              /* Schedule penalty */
 
-extern unsigned long cpu_present_mask;
-
 #define raw_smp_processor_id()  (current_thread_info()->cpu)
 
 #else /* CONFIG_SMP */
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 90904f9dfc50..927db3668b6f 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -183,10 +183,10 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
  * being 64 bit in both cases.
  */
 
-static long translate_usr_offset(long offset)
+static compat_ulong_t translate_usr_offset(compat_ulong_t offset)
 {
         if (offset < 0)
-                return -1;
+                return sizeof(struct pt_regs);
         else if (offset <= 32*4)        /* gr[0..31] */
                 return offset * 2 + 4;
         else if (offset <= 32*4+32*8)   /* gr[0..31] + fr[0..31] */
@@ -194,7 +194,7 @@ static long translate_usr_offset(long offset)
         else if (offset < sizeof(struct pt_regs)/2 + 32*4)
                 return offset * 2 + 4 - 32*8;
         else
-                return -1;
+                return sizeof(struct pt_regs);
 }
 
 long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
@@ -209,7 +209,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
                 if (addr & (sizeof(compat_uint_t)-1))
                         break;
                 addr = translate_usr_offset(addr);
-                if (addr < 0)
+                if (addr >= sizeof(struct pt_regs))
                         break;
 
                 tmp = *(compat_uint_t *) ((char *) task_regs(child) + addr);
@@ -236,7 +236,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
                         if (addr & (sizeof(compat_uint_t)-1))
                                 break;
                         addr = translate_usr_offset(addr);
-                        if (addr < 0)
+                        if (addr >= sizeof(struct pt_regs))
                                 break;
                         if (addr >= PT_FR0 && addr <= PT_FR31 + 4) {
                                 /* Special case, fp regs are 64 bits anyway */
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index ed500ef799b7..08844fc24a2e 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -61,22 +61,25 @@ STACK_SIZE  = 1 << STACK_SHIFT
 
 #ifdef CONFIG_TRACE_IRQFLAGS
         .macro  TRACE_IRQS_ON
-        l       %r1,BASED(.Ltrace_irq_on)
+        basr    %r2,%r0
+        l       %r1,BASED(.Ltrace_irq_on_caller)
         basr    %r14,%r1
         .endm
 
         .macro  TRACE_IRQS_OFF
-        l       %r1,BASED(.Ltrace_irq_off)
+        basr    %r2,%r0
+        l       %r1,BASED(.Ltrace_irq_off_caller)
         basr    %r14,%r1
         .endm
 
         .macro  TRACE_IRQS_CHECK
+        basr    %r2,%r0
         tm      SP_PSW(%r15),0x03       # irqs enabled?
         jz      0f
-        l       %r1,BASED(.Ltrace_irq_on)
+        l       %r1,BASED(.Ltrace_irq_on_caller)
         basr    %r14,%r1
         j       1f
-0:      l       %r1,BASED(.Ltrace_irq_off)
+0:      l       %r1,BASED(.Ltrace_irq_off_caller)
         basr    %r14,%r1
 1:
         .endm
@@ -1113,9 +1116,12 @@ cleanup_io_leave_insn:
 .Lschedtail:    .long   schedule_tail
 .Lsysc_table:   .long   sys_call_table
 #ifdef CONFIG_TRACE_IRQFLAGS
-.Ltrace_irq_on: .long   trace_hardirqs_on
-.Ltrace_irq_off:
-                .long   trace_hardirqs_off
+.Ltrace_irq_on_caller:
+                .long   trace_hardirqs_on_caller
+.Ltrace_irq_off_caller:
+                .long   trace_hardirqs_off_caller
+#endif
+#ifdef CONFIG_LOCKDEP
 .Llockdep_sys_exit:
                 .long   lockdep_sys_exit
 #endif
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index d7ce150453f2..41aca06682aa 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -61,19 +61,22 @@ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_NOTIFY_RESUME | _TIF_NEED_RESCHED | \
 
 #ifdef CONFIG_TRACE_IRQFLAGS
         .macro  TRACE_IRQS_ON
-         brasl  %r14,trace_hardirqs_on
+         basr   %r2,%r0
+         brasl  %r14,trace_hardirqs_on_caller
         .endm
 
         .macro  TRACE_IRQS_OFF
-         brasl  %r14,trace_hardirqs_off
+         basr   %r2,%r0
+         brasl  %r14,trace_hardirqs_off_caller
         .endm
 
         .macro TRACE_IRQS_CHECK
+        basr    %r2,%r0
         tm      SP_PSW(%r15),0x03       # irqs enabled?
         jz      0f
-        brasl   %r14,trace_hardirqs_on
+        brasl   %r14,trace_hardirqs_on_caller
         j       1f
-0:      brasl   %r14,trace_hardirqs_off
+0:      brasl   %r14,trace_hardirqs_off_caller
 1:
         .endm
 #else
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 3e2c05cb6a87..04f8c67a6101 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -136,9 +136,12 @@ static void default_idle(void)
                 return;
         }
         trace_hardirqs_on();
+        /* Don't trace preempt off for idle. */
+        stop_critical_timings();
         /* Wait for external, I/O or machine check interrupt. */
         __load_psw_mask(psw_kernel_bits | PSW_MASK_WAIT |
                         PSW_MASK_IO | PSW_MASK_EXT);
+        start_critical_timings();
 }
 
 void cpu_idle(void)
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 62122bad1e33..400b040df7fa 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -604,13 +604,13 @@ setup_memory(void)
                 if (memory_chunk[i].type != CHUNK_READ_WRITE)
                         continue;
                 start_chunk = PFN_DOWN(memory_chunk[i].addr);
-                end_chunk = start_chunk + PFN_DOWN(memory_chunk[i].size) - 1;
+                end_chunk = start_chunk + PFN_DOWN(memory_chunk[i].size);
                 end_chunk = min(end_chunk, end_pfn);
                 if (start_chunk >= end_chunk)
                         continue;
                 add_active_range(0, start_chunk, end_chunk);
                 pfn = max(start_chunk, start_pfn);
-                for (; pfn <= end_chunk; pfn++)
+                for (; pfn < end_chunk; pfn++)
                         page_set_storage_key(PFN_PHYS(pfn), PAGE_DEFAULT_KEY);
         }
 
diff --git a/arch/s390/kernel/sys_s390.c b/arch/s390/kernel/sys_s390.c
index 5fdb799062b7..4fe952e557ac 100644
--- a/arch/s390/kernel/sys_s390.c
+++ b/arch/s390/kernel/sys_s390.c
@@ -198,7 +198,7 @@ asmlinkage long s390x_newuname(struct new_utsname __user *name)
 {
         int ret = sys_newuname(name);
 
-        if (current->personality == PER_LINUX32 && !ret) {
+        if (personality(current->personality) == PER_LINUX32 && !ret) {
                 ret = copy_to_user(name->machine, "s390\0\0\0\0", 8);
                 if (ret) ret = -EFAULT;
         }
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index 632b13e10053..a947899dcba1 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -65,18 +65,21 @@ static int machine_has_topology_irq;
 static struct timer_list topology_timer;
 static void set_topology_timer(void);
 static DECLARE_WORK(topology_work, topology_work_fn);
+/* topology_lock protects the core linked list */
+static DEFINE_SPINLOCK(topology_lock);
 
 cpumask_t cpu_core_map[NR_CPUS];
 
 cpumask_t cpu_coregroup_map(unsigned int cpu)
 {
         struct core_info *core = &core_info;
+        unsigned long flags;
         cpumask_t mask;
 
         cpus_clear(mask);
         if (!machine_has_topology)
                 return cpu_present_map;
-        mutex_lock(&smp_cpu_state_mutex);
+        spin_lock_irqsave(&topology_lock, flags);
         while (core) {
                 if (cpu_isset(cpu, core->mask)) {
                         mask = core->mask;
@@ -84,7 +87,7 @@ cpumask_t cpu_coregroup_map(unsigned int cpu)
                 }
                 core = core->next;
         }
-        mutex_unlock(&smp_cpu_state_mutex);
+        spin_unlock_irqrestore(&topology_lock, flags);
         if (cpus_empty(mask))
                 mask = cpumask_of_cpu(cpu);
         return mask;
@@ -133,7 +136,7 @@ static void tl_to_cores(struct tl_info *info)
         union tl_entry *tle, *end;
         struct core_info *core = &core_info;
 
-        mutex_lock(&smp_cpu_state_mutex);
+        spin_lock_irq(&topology_lock);
         clear_cores();
         tle = info->tle;
         end = (union tl_entry *)((unsigned long)info + info->length);
@@ -157,7 +160,7 @@ static void tl_to_cores(struct tl_info *info)
                 }
                 tle = next_tle(tle);
         }
-        mutex_unlock(&smp_cpu_state_mutex);
+        spin_unlock_irq(&topology_lock);
 }
 
 static void topology_update_polarization_simple(void)
diff --git a/arch/sh/include/asm/io.h b/arch/sh/include/asm/io.h
index 436c28539577..65eaae34e753 100644
--- a/arch/sh/include/asm/io.h
+++ b/arch/sh/include/asm/io.h
@@ -293,6 +293,10 @@ __ioremap_mode(unsigned long offset, unsigned long size, unsigned long flags)
  */
 #define xlate_dev_kmem_ptr(p)   p
 
+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
+int valid_phys_addr_range(unsigned long addr, size_t size);
+int valid_mmap_phys_addr_range(unsigned long pfn, size_t size);
+
 #endif /* __KERNEL__ */
 
 #endif /* __ASM_SH_IO_H */
diff --git a/arch/sh/include/asm/pgtable.h b/arch/sh/include/asm/pgtable.h
index 52220d70a096..b517ae08b9c0 100644
--- a/arch/sh/include/asm/pgtable.h
+++ b/arch/sh/include/asm/pgtable.h
@@ -148,6 +148,12 @@ extern void paging_init(void);
 extern void page_table_range_init(unsigned long start, unsigned long end,
                                   pgd_t *pgd);
 
+#if !defined(CONFIG_CACHE_OFF) && defined(CONFIG_CPU_SH4) && defined(CONFIG_MMU)
+extern void kmap_coherent_init(void);
+#else
+#define kmap_coherent_init()    do { } while (0)
+#endif
+
 #include <asm-generic/pgtable.h>
 
 #endif /* __ASM_SH_PGTABLE_H */
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7723.c b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
index a7412cede534..6d9e6972cfc9 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
@@ -119,17 +119,17 @@ static struct plat_sci_port sci_platform_data[] = {
         },{
                 .mapbase        = 0xa4e30000,
                 .flags          = UPF_BOOT_AUTOCONF,
-                .type           = PORT_SCI,
+                .type           = PORT_SCIFA,
                 .irqs           = { 56, 56, 56, 56 },
         },{
                 .mapbase        = 0xa4e40000,
                 .flags          = UPF_BOOT_AUTOCONF,
-                .type           = PORT_SCI,
+                .type           = PORT_SCIFA,
                 .irqs           = { 88, 88, 88, 88 },
         },{
                 .mapbase        = 0xa4e50000,
                 .flags          = UPF_BOOT_AUTOCONF,
-                .type           = PORT_SCI,
+                .type           = PORT_SCIFA,
                 .irqs           = { 109, 109, 109, 109 },
         }, {
                 .flags = 0,
diff --git a/arch/sh/kernel/early_printk.c b/arch/sh/kernel/early_printk.c
index 6b7d166694e2..a952dcf9999d 100644
--- a/arch/sh/kernel/early_printk.c
+++ b/arch/sh/kernel/early_printk.c
@@ -75,6 +75,7 @@ static struct console bios_console = {
 #endif
 
 static struct uart_port scif_port = {
+        .type           = PORT_SCIF,
         .mapbase        = CONFIG_EARLY_SCIF_CONSOLE_PORT,
         .membase        = (char __iomem *)CONFIG_EARLY_SCIF_CONSOLE_PORT,
 };
@@ -84,9 +85,9 @@ static void scif_sercon_putc(int c)
         while (((sci_in(&scif_port, SCFDR) & EPK_FIFO_BITS) >= EPK_FIFO_SIZE))
                 ;
 
-        sci_out(&scif_port, SCxTDR, c);
         sci_in(&scif_port, SCxSR);
         sci_out(&scif_port, SCxSR, 0xf3 & ~(0x20 | 0x40));
+        sci_out(&scif_port, SCxTDR, c);
 
         while ((sci_in(&scif_port, SCxSR) & 0x40) == 0)
                 ;
diff --git a/arch/sh/kernel/timers/timer-tmu.c b/arch/sh/kernel/timers/timer-tmu.c
index aaaf90d06b85..3c61ddd4d43e 100644
--- a/arch/sh/kernel/timers/timer-tmu.c
+++ b/arch/sh/kernel/timers/timer-tmu.c
@@ -120,7 +120,7 @@ static void tmu_set_mode(enum clock_event_mode mode,
 {
         switch (mode) {
         case CLOCK_EVT_MODE_PERIODIC:
-                ctrl_outl(ctrl_inl(TMU0_TCNT), TMU0_TCOR);
+                ctrl_outl(tmu_latest_interval[TMU0], TMU0_TCOR);
                 break;
         case CLOCK_EVT_MODE_ONESHOT:
                 ctrl_outl(0, TMU0_TCOR);
diff --git a/arch/sh/lib/copy_page.S b/arch/sh/lib/copy_page.S
index 5d12e657be34..43de7e8e4e17 100644
--- a/arch/sh/lib/copy_page.S
+++ b/arch/sh/lib/copy_page.S
@@ -80,6 +80,11 @@ ENTRY(copy_page)
         .section __ex_table, "a";       \
         .long 9999b, 6000f      ;       \
         .previous
+#define EX_NO_POP(...)                  \
+        9999: __VA_ARGS__ ;             \
+        .section __ex_table, "a";       \
+        .long 9999b, 6005f      ;       \
+        .previous
 ENTRY(__copy_user)
         ! Check if small number of bytes
         mov     #11,r0
@@ -139,9 +144,9 @@ EX(	mov.b	r1,@r4		)
         bt      1f
 
 2:
-EX(     mov.b   @r5+,r0         )
+EX_NO_POP(      mov.b   @r5+,r0         )
         dt      r6
-EX(     mov.b   r0,@r4          )
+EX_NO_POP(      mov.b   r0,@r4          )
         bf/s    2b
          add    #1,r4
 
@@ -150,7 +155,7 @@ EX(	mov.b	r0,@r4		)
 
 # Exception handler:
 .section .fixup, "ax"
-6000:
+6005:
         mov.l   8000f,r1
         mov     r3,r0
         jmp     @r1
diff --git a/arch/sh/mm/Makefile_32 b/arch/sh/mm/Makefile_32
index 70e0906023cc..f066e76da204 100644
--- a/arch/sh/mm/Makefile_32
+++ b/arch/sh/mm/Makefile_32
@@ -2,7 +2,7 @@
 # Makefile for the Linux SuperH-specific parts of the memory manager.
 #
 
-obj-y                   := init.o extable_32.o consistent.o
+obj-y                   := init.o extable_32.o consistent.o mmap.o
 
 ifndef CONFIG_CACHE_OFF
 cache-$(CONFIG_CPU_SH2)         := cache-sh2.o
diff --git a/arch/sh/mm/Makefile_64 b/arch/sh/mm/Makefile_64
index 0d92a8a3ac9a..9481d0f54efd 100644
--- a/arch/sh/mm/Makefile_64
+++ b/arch/sh/mm/Makefile_64
@@ -2,7 +2,7 @@
 # Makefile for the Linux SuperH-specific parts of the memory manager.
 #
 
-obj-y                   := init.o consistent.o
+obj-y                   := init.o consistent.o mmap.o
 
 mmu-y                   := tlb-nommu.o pg-nommu.o extable_32.o
 mmu-$(CONFIG_MMU)       := fault_64.o ioremap_64.o tlbflush_64.o tlb-sh5.o \
diff --git a/arch/sh/mm/init.c b/arch/sh/mm/init.c
index 4abf00031dae..6cbef8caeb56 100644
--- a/arch/sh/mm/init.c
+++ b/arch/sh/mm/init.c
@@ -137,6 +137,7 @@ void __init page_table_range_init(unsigned long start, unsigned long end,
 void __init paging_init(void)
 {
         unsigned long max_zone_pfns[MAX_NR_ZONES];
+        unsigned long vaddr;
         int nid;
 
         /* We don't need to map the kernel through the TLB, as
@@ -148,10 +149,15 @@ void __init paging_init(void)
          * check for a null value. */
         set_TTB(swapper_pg_dir);
 
-        /* Populate the relevant portions of swapper_pg_dir so that
+        /*
+         * Populate the relevant portions of swapper_pg_dir so that
          * we can use the fixmap entries without calling kmalloc.
-         * pte's will be filled in by __set_fixmap(). */
-        page_table_range_init(FIXADDR_START, FIXADDR_TOP, swapper_pg_dir);
+         * pte's will be filled in by __set_fixmap().
+         */
+        vaddr = __fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK;
+        page_table_range_init(vaddr, 0, swapper_pg_dir);
+
+        kmap_coherent_init();
 
         memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
 
diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
new file mode 100644
index 000000000000..8837d511710a
--- /dev/null
+++ b/arch/sh/mm/mmap.c
@@ -0,0 +1,31 @@
+/*
+ * arch/sh/mm/mmap.c
+ *
+ * Copyright (C) 2008  Paul Mundt
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/io.h>
+#include <linux/mm.h>
+#include <asm/page.h>
+
+/*
+ * You really shouldn't be using read() or write() on /dev/mem.  This
+ * might go away in the future.
+ */
+int valid_phys_addr_range(unsigned long addr, size_t count)
+{
+        if (addr < __MEMORY_START)
+                return 0;
+        if (addr + count > __pa(high_memory))
+                return 0;
+
+        return 1;
+}
+
+int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
+{
+        return 1;
+}
diff --git a/arch/sh/mm/pg-sh4.c b/arch/sh/mm/pg-sh4.c
index 38870e0fc182..2fe14da1f839 100644
--- a/arch/sh/mm/pg-sh4.c
+++ b/arch/sh/mm/pg-sh4.c
@@ -7,6 +7,7 @@
  * Released under the terms of the GNU GPL v2.0.
  */
 #include <linux/mm.h>
+#include <linux/init.h>
 #include <linux/mutex.h>
 #include <linux/fs.h>
 #include <linux/highmem.h>
@@ -16,6 +17,20 @@
 
 #define CACHE_ALIAS (current_cpu_data.dcache.alias_mask)
 
+#define kmap_get_fixmap_pte(vaddr)                                     \
+        pte_offset_kernel(pmd_offset(pud_offset(pgd_offset_k(vaddr), (vaddr)), (vaddr)), (vaddr))
+
+static pte_t *kmap_coherent_pte;
+
+void __init kmap_coherent_init(void)
+{
+        unsigned long vaddr;
+
+        /* cache the first coherent kmap pte */
+        vaddr = __fix_to_virt(FIX_CMAP_BEGIN);
+        kmap_coherent_pte = kmap_get_fixmap_pte(vaddr);
+}
+
 static inline void *kmap_coherent(struct page *page, unsigned long addr)
 {
         enum fixed_addresses idx;
@@ -34,6 +49,8 @@ static inline void *kmap_coherent(struct page *page, unsigned long addr)
 
         update_mmu_cache(NULL, vaddr, pte);
 
+        set_pte(kmap_coherent_pte - (FIX_CMAP_END - idx), pte);
+
         return (void *)vaddr;
 }
 
diff --git a/arch/sparc/include/asm/termbits.h b/arch/sparc/include/asm/termbits.h
index d6ca3e2754f5..d72dfed1f9d7 100644
--- a/arch/sparc/include/asm/termbits.h
+++ b/arch/sparc/include/asm/termbits.h
@@ -29,10 +29,11 @@ struct termios {
         tcflag_t c_cflag;               /* control mode flags */
         tcflag_t c_lflag;               /* local mode flags */
         cc_t c_line;                    /* line discipline */
+#ifndef __KERNEL__
         cc_t c_cc[NCCS];                /* control characters */
-#ifdef __KERNEL__
+#else
+        cc_t c_cc[NCCS+2];      /* kernel needs 2 more to hold vmin/vtime */
 #define SIZEOF_USER_TERMIOS sizeof (struct termios) - (2*sizeof (cc_t))
-        cc_t _x_cc[2];                  /* We need them to hold vmin/vtime */
 #endif
 };
 
@@ -42,8 +43,7 @@ struct termios2 {
         tcflag_t c_cflag;               /* control mode flags */
         tcflag_t c_lflag;               /* local mode flags */
         cc_t c_line;                    /* line discipline */
-        cc_t c_cc[NCCS];                /* control characters */
-        cc_t _x_cc[2];                  /* padding to match ktermios */
+        cc_t c_cc[NCCS+2];              /* control characters */
         speed_t c_ispeed;               /* input speed */
         speed_t c_ospeed;               /* output speed */
 };
@@ -54,8 +54,7 @@ struct ktermios {
         tcflag_t c_cflag;               /* control mode flags */
         tcflag_t c_lflag;               /* local mode flags */
         cc_t c_line;                    /* line discipline */
-        cc_t c_cc[NCCS];                /* control characters */
-        cc_t _x_cc[2];                  /* We need them to hold vmin/vtime */
+        cc_t c_cc[NCCS+2];              /* control characters */
         speed_t c_ispeed;               /* input speed */
         speed_t c_ospeed;               /* output speed */
 };
diff --git a/arch/sparc/include/asm/unistd_32.h b/arch/sparc/include/asm/unistd_32.h
index 648643a9f139..0d13d2a4c76f 100644
--- a/arch/sparc/include/asm/unistd_32.h
+++ b/arch/sparc/include/asm/unistd_32.h
@@ -338,8 +338,9 @@
 #define __NR_dup3               320
 #define __NR_pipe2              321
 #define __NR_inotify_init1      322
+#define __NR_accept4            323
 
-#define NR_SYSCALLS             323
+#define NR_SYSCALLS             324
 
 /* Sparc 32-bit only has the "setresuid32", "getresuid32" variants,
  * it never had the plain ones and there is no value to adding those
diff --git a/arch/sparc/include/asm/unistd_64.h b/arch/sparc/include/asm/unistd_64.h
index c5cc0e052321..fa5d3c0343c7 100644
--- a/arch/sparc/include/asm/unistd_64.h
+++ b/arch/sparc/include/asm/unistd_64.h
@@ -340,8 +340,9 @@
 #define __NR_dup3               320
 #define __NR_pipe2              321
 #define __NR_inotify_init1      322
+#define __NR_accept4            323
 
-#define NR_SYSCALLS             323
+#define NR_SYSCALLS             324
 
 #ifdef __KERNEL__
 #define __ARCH_WANT_IPC_PARSE_VERSION
diff --git a/arch/sparc/kernel/of_device.c b/arch/sparc/kernel/of_device.c
index 0837bd52e28f..0a83bd737654 100644
--- a/arch/sparc/kernel/of_device.c
+++ b/arch/sparc/kernel/of_device.c
@@ -563,9 +563,9 @@ build_resources:
         op->dev.parent = parent;
         op->dev.bus = &of_platform_bus_type;
         if (!parent)
-                strcpy(op->dev.bus_id, "root");
+                dev_set_name(&op->dev, "root");
         else
-                sprintf(op->dev.bus_id, "%08x", dp->node);
+                dev_set_name(&op->dev, "%08x", dp->node);
 
         if (of_device_register(op)) {
                 printk("%s: Could not register of device.\n",
diff --git a/arch/sparc/kernel/systbls.S b/arch/sparc/kernel/systbls.S
index e1b9233b90ab..7d0807586442 100644
--- a/arch/sparc/kernel/systbls.S
+++ b/arch/sparc/kernel/systbls.S
@@ -81,4 +81,4 @@ sys_call_table:
 /*305*/ .long sys_set_mempolicy, sys_kexec_load, sys_move_pages, sys_getcpu, sys_epoll_pwait
 /*310*/ .long sys_utimensat, sys_signalfd, sys_timerfd_create, sys_eventfd, sys_fallocate
 /*315*/ .long sys_timerfd_settime, sys_timerfd_gettime, sys_signalfd4, sys_eventfd2, sys_epoll_create1
-/*320*/ .long sys_dup3, sys_pipe2, sys_inotify_init1
+/*320*/ .long sys_dup3, sys_pipe2, sys_inotify_init1, sys_accept4
diff --git a/arch/sparc64/kernel/sys32.S b/arch/sparc64/kernel/sys32.S
index ade18ba0c686..f061c4dda9ef 100644
--- a/arch/sparc64/kernel/sys32.S
+++ b/arch/sparc64/kernel/sys32.S
@@ -150,7 +150,7 @@ sys32_mmap2:
 sys32_socketcall:       /* %o0=call, %o1=args */
         cmp             %o0, 1
         bl,pn           %xcc, do_einval
-         cmp            %o0, 17
+         cmp            %o0, 18
         bg,pn           %xcc, do_einval
          sub            %o0, 1, %o0
         sllx            %o0, 5, %o0
@@ -319,6 +319,15 @@ do_sys_recvmsg: /* compat_sys_recvmsg(int, struct compat_msghdr *, unsigned int)
         nop
         nop
         nop
+do_sys_accept4: /* sys_accept4(int, struct sockaddr *, int *, int) */
+63:     ldswa           [%o1 + 0x0] %asi, %o0
+        sethi           %hi(sys_accept4), %g1
+64:     lduwa           [%o1 + 0x8] %asi, %o2
+65:     ldswa           [%o1 + 0xc] %asi, %o3
+        jmpl            %g1 + %lo(sys_accept4), %g0
+66:      lduwa          [%o1 + 0x4] %asi, %o1
+        nop
+        nop
 
         .section        __ex_table,"a"
         .align          4
@@ -353,4 +362,6 @@ do_sys_recvmsg: /* compat_sys_recvmsg(int, struct compat_msghdr *, unsigned int)
         .word           57b, __retl_efault, 58b, __retl_efault
         .word           59b, __retl_efault, 60b, __retl_efault
         .word           61b, __retl_efault, 62b, __retl_efault
+        .word           63b, __retl_efault, 64b, __retl_efault
+        .word           65b, __retl_efault, 66b, __retl_efault
         .previous
diff --git a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
index b2fa4c163638..9fc78cf354bd 100644
--- a/arch/sparc64/kernel/systbls.S
+++ b/arch/sparc64/kernel/systbls.S
@@ -82,7 +82,7 @@ sys_call_table32:
         .word compat_sys_set_mempolicy, compat_sys_kexec_load, compat_sys_move_pages, sys_getcpu, compat_sys_epoll_pwait
 /*310*/ .word compat_sys_utimensat, compat_sys_signalfd, sys_timerfd_create, sys_eventfd, compat_sys_fallocate
         .word compat_sys_timerfd_settime, compat_sys_timerfd_gettime, compat_sys_signalfd4, sys_eventfd2, sys_epoll_create1
-/*320*/ .word sys_dup3, sys_pipe2, sys_inotify_init1
+/*320*/ .word sys_dup3, sys_pipe2, sys_inotify_init1, sys_accept4
 
 #endif /* CONFIG_COMPAT */
 
@@ -156,4 +156,4 @@ sys_call_table:
         .word sys_set_mempolicy, sys_kexec_load, sys_move_pages, sys_getcpu, sys_epoll_pwait
 /*310*/ .word sys_utimensat, sys_signalfd, sys_timerfd_create, sys_eventfd, sys_fallocate
         .word sys_timerfd_settime, sys_timerfd_gettime, sys_signalfd4, sys_eventfd2, sys_epoll_create1
-/*320*/ .word sys_dup3, sys_pipe2, sys_inotify_init1
+/*320*/ .word sys_dup3, sys_pipe2, sys_inotify_init1, sys_accept4
diff --git a/arch/um/include/asm/system.h b/arch/um/include/asm/system.h
index 753346e2cdfd..ae5f94d6317d 100644
--- a/arch/um/include/asm/system.h
+++ b/arch/um/include/asm/system.h
@@ -11,21 +11,21 @@ extern int get_signals(void);
 extern void block_signals(void);
 extern void unblock_signals(void);
 
-#define local_save_flags(flags) do { typecheck(unsigned long, flags); \
+#define raw_local_save_flags(flags) do { typecheck(unsigned long, flags); \
                                      (flags) = get_signals(); } while(0)
-#define local_irq_restore(flags) do { typecheck(unsigned long, flags); \
+#define raw_local_irq_restore(flags) do { typecheck(unsigned long, flags); \
                                       set_signals(flags); } while(0)
 
-#define local_irq_save(flags) do { local_save_flags(flags); \
-                                   local_irq_disable(); } while(0)
+#define raw_local_irq_save(flags) do { raw_local_save_flags(flags); \
+                                   raw_local_irq_disable(); } while(0)
 
-#define local_irq_enable() unblock_signals()
-#define local_irq_disable() block_signals()
+#define raw_local_irq_enable() unblock_signals()
+#define raw_local_irq_disable() block_signals()
 
 #define irqs_disabled()                 \
 ({                                      \
         unsigned long flags;            \
-        local_save_flags(flags);        \
+        raw_local_save_flags(flags);        \
         (flags == 0);                   \
 })
 
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 93224b569187..ac22bb7719f7 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -167,9 +167,12 @@ config GENERIC_PENDING_IRQ
 config X86_SMP
         bool
         depends on SMP && ((X86_32 && !X86_VOYAGER) || X86_64)
-        select USE_GENERIC_SMP_HELPERS
         default y
 
+config USE_GENERIC_SMP_HELPERS
+        def_bool y
+        depends on SMP
+
 config X86_32_SMP
         def_bool y
         depends on X86_32 && SMP
@@ -957,7 +960,7 @@ config ARCH_PHYS_ADDR_T_64BIT
 config NUMA
         bool "Numa Memory Allocation and Scheduler Support (EXPERIMENTAL)"
         depends on SMP
-        depends on X86_64 || (X86_32 && HIGHMEM64G && (X86_NUMAQ || X86_BIGSMP || X86_SUMMIT && ACPI) && BROKEN)
+        depends on X86_64 || (X86_32 && HIGHMEM64G && (X86_NUMAQ || X86_BIGSMP || X86_SUMMIT && ACPI) && EXPERIMENTAL)
         default n if X86_PC
         default y if (X86_NUMAQ || X86_SUMMIT || X86_BIGSMP)
         help
diff --git a/include/asm-x86/iomap.h b/arch/x86/include/asm/iomap.h
index c1f06289b14b..c1f06289b14b 100644
--- a/include/asm-x86/iomap.h
+++ b/arch/x86/include/asm/iomap.h
diff --git a/arch/x86/include/asm/iommu.h b/arch/x86/include/asm/iommu.h
index e4a552d44465..0b500c5b6446 100644
--- a/arch/x86/include/asm/iommu.h
+++ b/arch/x86/include/asm/iommu.h
@@ -6,7 +6,6 @@ extern void no_iommu_init(void);
 extern struct dma_mapping_ops nommu_dma_ops;
 extern int force_iommu, no_iommu;
 extern int iommu_detected;
-extern int dmar_disabled;
 
 extern unsigned long iommu_nr_pages(unsigned long addr, unsigned long len);
 
diff --git a/arch/x86/include/asm/mmzone_32.h b/arch/x86/include/asm/mmzone_32.h
index 485bdf059ffb..07f1af494ca5 100644
--- a/arch/x86/include/asm/mmzone_32.h
+++ b/arch/x86/include/asm/mmzone_32.h
@@ -34,10 +34,14 @@ static inline void get_memcfg_numa(void)
 
 extern int early_pfn_to_nid(unsigned long pfn);
 
+extern void resume_map_numa_kva(pgd_t *pgd);
+
 #else /* !CONFIG_NUMA */
 
 #define get_memcfg_numa get_memcfg_numa_flat
 
+static inline void resume_map_numa_kva(pgd_t *pgd) {}
+
 #endif /* CONFIG_NUMA */
 
 #ifdef CONFIG_DISCONTIGMEM
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 35c54921b2e4..99192bb55a53 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -157,6 +157,7 @@ extern int __get_user_bad(void);
         int __ret_gu;                                                   \
         unsigned long __val_gu;                                         \
         __chk_user_ptr(ptr);                                            \
+        might_fault();                                                  \
         switch (sizeof(*(ptr))) {                                       \
         case 1:                                                         \
                 __get_user_x(1, __ret_gu, __val_gu, ptr);               \
@@ -241,6 +242,7 @@ extern void __put_user_8(void);
         int __ret_pu;                                           \
         __typeof__(*(ptr)) __pu_val;                            \
         __chk_user_ptr(ptr);                                    \
+        might_fault();                                          \
         __pu_val = x;                                           \
         switch (sizeof(*(ptr))) {                               \
         case 1:                                                 \
diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
index d095a3aeea1b..5e06259e90e5 100644
--- a/arch/x86/include/asm/uaccess_32.h
+++ b/arch/x86/include/asm/uaccess_32.h
@@ -82,8 +82,8 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
 static __always_inline unsigned long __must_check
 __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-       might_sleep();
-       return __copy_to_user_inatomic(to, from, n);
+        might_fault();
+        return __copy_to_user_inatomic(to, from, n);
 }
 
 static __always_inline unsigned long
@@ -137,7 +137,7 @@ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
 static __always_inline unsigned long
 __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        might_sleep();
+        might_fault();
         if (__builtin_constant_p(n)) {
                 unsigned long ret;
 
@@ -159,7 +159,7 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
 static __always_inline unsigned long __copy_from_user_nocache(void *to,
                                 const void __user *from, unsigned long n)
 {
-        might_sleep();
+        might_fault();
         if (__builtin_constant_p(n)) {
                 unsigned long ret;
 
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 664f15280f14..84210c479fca 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -29,6 +29,8 @@ static __always_inline __must_check
 int __copy_from_user(void *dst, const void __user *src, unsigned size)
 {
         int ret = 0;
+
+        might_fault();
         if (!__builtin_constant_p(size))
                 return copy_user_generic(dst, (__force void *)src, size);
         switch (size) {
@@ -46,7 +48,7 @@ int __copy_from_user(void *dst, const void __user *src, unsigned size)
                 return ret;
         case 10:
                 __get_user_asm(*(u64 *)dst, (u64 __user *)src,
-                               ret, "q", "", "=r", 16);
+                               ret, "q", "", "=r", 10);
                 if (unlikely(ret))
                         return ret;
                 __get_user_asm(*(u16 *)(8 + (char *)dst),
@@ -71,6 +73,8 @@ static __always_inline __must_check
 int __copy_to_user(void __user *dst, const void *src, unsigned size)
 {
         int ret = 0;
+
+        might_fault();
         if (!__builtin_constant_p(size))
                 return copy_user_generic((__force void *)dst, src, size);
         switch (size) {
@@ -113,6 +117,8 @@ static __always_inline __must_check
 int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
 {
         int ret = 0;
+
+        might_fault();
         if (!__builtin_constant_p(size))
                 return copy_user_generic((__force void *)dst,
                                          (__force void *)src, size);
diff --git a/arch/x86/include/asm/unistd_64.h b/arch/x86/include/asm/unistd_64.h
index 834b2c1d89fb..d2e415e6666f 100644
--- a/arch/x86/include/asm/unistd_64.h
+++ b/arch/x86/include/asm/unistd_64.h
@@ -639,8 +639,8 @@ __SYSCALL(__NR_fallocate, sys_fallocate)
 __SYSCALL(__NR_timerfd_settime, sys_timerfd_settime)
 #define __NR_timerfd_gettime                    287
 __SYSCALL(__NR_timerfd_gettime, sys_timerfd_gettime)
-#define __NR_paccept                            288
-__SYSCALL(__NR_paccept, sys_paccept)
+#define __NR_accept4                            288
+__SYSCALL(__NR_accept4, sys_accept4)
 #define __NR_signalfd4                          289
 __SYSCALL(__NR_signalfd4, sys_signalfd4)
 #define __NR_eventfd2                           290
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
index 331b318304eb..e4899e0e8787 100644
--- a/arch/x86/kernel/amd_iommu.c
+++ b/arch/x86/kernel/amd_iommu.c
@@ -537,7 +537,7 @@ static void dma_ops_free_addresses(struct dma_ops_domain *dom,
         address >>= PAGE_SHIFT;
         iommu_area_free(dom->bitmap, address, pages);
 
-        if (address + pages >= dom->next_bit)
+        if (address >= dom->next_bit)
                 dom->need_flush = true;
 }
 
diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
index 0cdcda35a05f..30ae2701b3df 100644
--- a/arch/x86/kernel/amd_iommu_init.c
+++ b/arch/x86/kernel/amd_iommu_init.c
@@ -121,7 +121,7 @@ u16 amd_iommu_last_bdf;			/* largest PCI device id we have
 LIST_HEAD(amd_iommu_unity_map);         /* a list of required unity mappings
                                            we find in ACPI */
 unsigned amd_iommu_aperture_order = 26; /* size of aperture in power of 2 */
-int amd_iommu_isolate;                  /* if 1, device isolation is enabled */
+int amd_iommu_isolate = 1;              /* if 1, device isolation is enabled */
 bool amd_iommu_unmap_flush;             /* if true, flush on every unmap */
 
 LIST_HEAD(amd_iommu_list);              /* list of all AMD IOMMUs in the
@@ -1213,7 +1213,9 @@ static int __init parse_amd_iommu_options(char *str)
         for (; *str; ++str) {
                 if (strncmp(str, "isolate", 7) == 0)
                         amd_iommu_isolate = 1;
-                if (strncmp(str, "fullflush", 11) == 0)
+                if (strncmp(str, "share", 5) == 0)
+                        amd_iommu_isolate = 0;
+                if (strncmp(str, "fullflush", 9) == 0)
                         amd_iommu_unmap_flush = true;
         }
 
diff --git a/arch/x86/kernel/ds.c b/arch/x86/kernel/ds.c
index 2b69994fd3a8..d1a121443bde 100644
--- a/arch/x86/kernel/ds.c
+++ b/arch/x86/kernel/ds.c
@@ -236,17 +236,33 @@ static inline struct ds_context *ds_alloc_context(struct task_struct *task)
         struct ds_context *context = *p_context;
 
         if (!context) {
+                spin_unlock(&ds_lock);
+
                 context = kzalloc(sizeof(*context), GFP_KERNEL);
 
-                if (!context)
+                if (!context) {
+                        spin_lock(&ds_lock);
                         return NULL;
+                }
 
                 context->ds = kzalloc(ds_cfg.sizeof_ds, GFP_KERNEL);
                 if (!context->ds) {
                         kfree(context);
+                        spin_lock(&ds_lock);
                         return NULL;
                 }
 
+                spin_lock(&ds_lock);
+                /*
+                 * Check for race - another CPU could have allocated
+                 * it meanwhile:
+                 */
+                if (*p_context) {
+                        kfree(context->ds);
+                        kfree(context);
+                        return *p_context;
+                }
+
                 *p_context = context;
 
                 context->this = p_context;
@@ -384,14 +400,15 @@ static int ds_request(struct task_struct *task, void *base, size_t size,
 
         spin_lock(&ds_lock);
 
-        if (!check_tracer(task))
-                return -EPERM;
-
         error = -ENOMEM;
         context = ds_alloc_context(task);
         if (!context)
                 goto out_unlock;
 
+        error = -EPERM;
+        if (!check_tracer(task))
+                goto out_unlock;
+
         error = -EALREADY;
         if (context->owner[qual] == current)
                 goto out_unlock;
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index 3ce029ffaa55..1b894b72c0f5 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -188,20 +188,6 @@ static void __init ati_bugs_contd(int num, int slot, int func)
 }
 #endif
 
-#ifdef CONFIG_DMAR
-static void __init intel_g33_dmar(int num, int slot, int func)
-{
-        struct acpi_table_header *dmar_tbl;
-        acpi_status status;
-
-        status = acpi_get_table(ACPI_SIG_DMAR, 0, &dmar_tbl);
-        if (ACPI_SUCCESS(status)) {
-                printk(KERN_INFO "BIOS BUG: DMAR advertised on Intel G31/G33 chipset -- ignoring\n");
-                dmar_disabled = 1;
-        }
-}
-#endif
-
 #define QFLAG_APPLY_ONCE        0x1
 #define QFLAG_APPLIED           0x2
 #define QFLAG_DONE              (QFLAG_APPLY_ONCE|QFLAG_APPLIED)
@@ -225,10 +211,6 @@ static struct chipset early_qrk[] __initdata = {
           PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs },
         { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_SBX00_SMBUS,
           PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs_contd },
-#ifdef CONFIG_DMAR
-        { PCI_VENDOR_ID_INTEL, 0x29c0,
-          PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, intel_g33_dmar },
-#endif
         {}
 };
 
diff --git a/arch/x86/kernel/es7000_32.c b/arch/x86/kernel/es7000_32.c
index f454c78fcef6..0aa2c443d600 100644
--- a/arch/x86/kernel/es7000_32.c
+++ b/arch/x86/kernel/es7000_32.c
@@ -250,31 +250,24 @@ int __init find_unisys_acpi_oem_table(unsigned long *oem_addr)
 {
         struct acpi_table_header *header = NULL;
         int i = 0;
-        acpi_size tbl_size;
 
-        while (ACPI_SUCCESS(acpi_get_table_with_size("OEM1", i++, &header, &tbl_size))) {
+        while (ACPI_SUCCESS(acpi_get_table("OEM1", i++, &header))) {
                 if (!memcmp((char *) &header->oem_id, "UNISYS", 6)) {
                         struct oem_table *t = (struct oem_table *)header;
 
                         oem_addrX = t->OEMTableAddr;
                         oem_size = t->OEMTableSize;
-                        early_acpi_os_unmap_memory(header, tbl_size);
 
                         *oem_addr = (unsigned long)__acpi_map_table(oem_addrX,
                                                                     oem_size);
                         return 0;
                 }
-                early_acpi_os_unmap_memory(header, tbl_size);
         }
         return -1;
 }
 
 void __init unmap_unisys_acpi_oem_table(unsigned long oem_addr)
 {
-        if (!oem_addr)
-                return;
-
-        __acpi_unmap_table((char *)oem_addr, oem_size);
 }
 #endif
 
diff --git a/arch/x86/kernel/io_apic.c b/arch/x86/kernel/io_apic.c
index 7a3f2028e2eb..c9513e1ff28d 100644
--- a/arch/x86/kernel/io_apic.c
+++ b/arch/x86/kernel/io_apic.c
@@ -1140,6 +1140,20 @@ static void __clear_irq_vector(int irq)
 
         cfg->vector = 0;
         cpus_clear(cfg->domain);
+
+        if (likely(!cfg->move_in_progress))
+                return;
+        cpus_and(mask, cfg->old_domain, cpu_online_map);
+        for_each_cpu_mask_nr(cpu, mask) {
+                for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
+                                                                vector++) {
+                        if (per_cpu(vector_irq, cpu)[vector] != irq)
+                                continue;
+                        per_cpu(vector_irq, cpu)[vector] = -1;
+                        break;
+                }
+        }
+        cfg->move_in_progress = 0;
 }
 
 void __setup_vector_irq(int cpu)
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 724adfc63cb9..cc5a2545dd41 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -169,6 +169,15 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_BOARD_NAME, "0KW626"),
                 },
         },
+        {   /* Handle problems with rebooting on Dell Optiplex 330 with 0KP561 */
+                .callback = set_bios_reboot,
+                .ident = "Dell OptiPlex 330",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 330"),
+                        DMI_MATCH(DMI_BOARD_NAME, "0KP561"),
+                },
+        },
         {       /* Handle problems with rebooting on Dell 2400's */
                 .callback = set_bios_reboot,
                 .ident = "Dell PowerEdge 2400",
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 0fa6790c1dd3..9d5674f7b6cc 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -764,7 +764,7 @@ static struct dmi_system_id __initdata bad_bios_dmi_table[] = {
                 .callback = dmi_low_memory_corruption,
                 .ident = "Phoenix BIOS",
                 .matches = {
-                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies"),
                 },
         },
 #endif
diff --git a/arch/x86/kernel/tsc_sync.c b/arch/x86/kernel/tsc_sync.c
index 9ffb01c31c40..1c0dfbca87c1 100644
--- a/arch/x86/kernel/tsc_sync.c
+++ b/arch/x86/kernel/tsc_sync.c
@@ -46,7 +46,9 @@ static __cpuinit void check_tsc_warp(void)
         cycles_t start, now, prev, end;
         int i;
 
+        rdtsc_barrier();
         start = get_cycles();
+        rdtsc_barrier();
         /*
          * The measurement runs for 20 msecs:
          */
@@ -61,7 +63,9 @@ static __cpuinit void check_tsc_warp(void)
                  */
                 __raw_spin_lock(&sync_lock);
                 prev = last_tsc;
+                rdtsc_barrier();
                 now = get_cycles();
+                rdtsc_barrier();
                 last_tsc = now;
                 __raw_spin_unlock(&sync_lock);
 
diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
index 9e68075544f6..4a20b2f9a381 100644
--- a/arch/x86/lib/usercopy_32.c
+++ b/arch/x86/lib/usercopy_32.c
@@ -39,7 +39,7 @@ static inline int __movsl_is_ok(unsigned long a1, unsigned long a2, unsigned lon
 #define __do_strncpy_from_user(dst, src, count, res)                       \
 do {                                                                       \
         int __d0, __d1, __d2;                                              \
-        might_sleep();                                                     \
+        might_fault();                                                     \
         __asm__ __volatile__(                                              \
                 "       testl %1,%1\n"                                     \
                 "       jz 2f\n"                                           \
@@ -126,7 +126,7 @@ EXPORT_SYMBOL(strncpy_from_user);
 #define __do_clear_user(addr,size)                                      \
 do {                                                                    \
         int __d0;                                                       \
-        might_sleep();                                                  \
+        might_fault();                                                  \
         __asm__ __volatile__(                                           \
                 "0:     rep; stosl\n"                                   \
                 "       movl %2,%0\n"                                   \
@@ -155,7 +155,7 @@ do {									\
 unsigned long
 clear_user(void __user *to, unsigned long n)
 {
-        might_sleep();
+        might_fault();
         if (access_ok(VERIFY_WRITE, to, n))
                 __do_clear_user(to, n);
         return n;
@@ -197,7 +197,7 @@ long strnlen_user(const char __user *s, long n)
         unsigned long mask = -__addr_ok(s);
         unsigned long res, tmp;
 
-        might_sleep();
+        might_fault();
 
         __asm__ __volatile__(
                 "       testl %0, %0\n"
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
index f4df6e7c718b..64d6c84e6353 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -15,7 +15,7 @@
 #define __do_strncpy_from_user(dst,src,count,res)                          \
 do {                                                                       \
         long __d0, __d1, __d2;                                             \
-        might_sleep();                                                     \
+        might_fault();                                                     \
         __asm__ __volatile__(                                              \
                 "       testq %1,%1\n"                                     \
                 "       jz 2f\n"                                           \
@@ -64,7 +64,7 @@ EXPORT_SYMBOL(strncpy_from_user);
 unsigned long __clear_user(void __user *addr, unsigned long size)
 {
         long __d0;
-        might_sleep();
+        might_fault();
         /* no memory constraint because it doesn't change any memory gcc knows
            about */
         asm volatile(
diff --git a/arch/x86/mach-voyager/voyager_smp.c b/arch/x86/mach-voyager/voyager_smp.c
index 0e331652681e..52145007bd7e 100644
--- a/arch/x86/mach-voyager/voyager_smp.c
+++ b/arch/x86/mach-voyager/voyager_smp.c
@@ -7,6 +7,7 @@
  * This file provides all the same external entries as smp.c but uses
  * the voyager hal to provide the functionality
  */
+#include <linux/cpu.h>
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/kernel_stat.h>
@@ -1790,6 +1791,17 @@ void __init smp_setup_processor_id(void)
         x86_write_percpu(cpu_number, hard_smp_processor_id());
 }
 
+static void voyager_send_call_func(cpumask_t callmask)
+{
+        __u32 mask = cpus_addr(callmask)[0] & ~(1 << smp_processor_id());
+        send_CPI(mask, VIC_CALL_FUNCTION_CPI);
+}
+
+static void voyager_send_call_func_single(int cpu)
+{
+        send_CPI(1 << cpu, VIC_CALL_FUNCTION_SINGLE_CPI);
+}
+
 struct smp_ops smp_ops = {
         .smp_prepare_boot_cpu = voyager_smp_prepare_boot_cpu,
         .smp_prepare_cpus = voyager_smp_prepare_cpus,
@@ -1799,6 +1811,6 @@ struct smp_ops smp_ops = {
         .smp_send_stop = voyager_smp_send_stop,
         .smp_send_reschedule = voyager_smp_send_reschedule,
 
-        .send_call_func_ipi = native_send_call_func_ipi,
-        .send_call_func_single_ipi = native_send_call_func_single_ipi,
+        .send_call_func_ipi = voyager_send_call_func,
+        .send_call_func_single_ipi = voyager_send_call_func_single,
 };
diff --git a/arch/x86/mm/numa_32.c b/arch/x86/mm/numa_32.c
index 847c164725f4..8518c678d83f 100644
--- a/arch/x86/mm/numa_32.c
+++ b/arch/x86/mm/numa_32.c
@@ -222,6 +222,41 @@ static void __init remap_numa_kva(void)
         }
 }
 
+#ifdef CONFIG_HIBERNATION
+/**
+ * resume_map_numa_kva - add KVA mapping to the temporary page tables created
+ *                       during resume from hibernation
+ * @pgd_base - temporary resume page directory
+ */
+void resume_map_numa_kva(pgd_t *pgd_base)
+{
+        int node;
+
+        for_each_online_node(node) {
+                unsigned long start_va, start_pfn, size, pfn;
+
+                start_va = (unsigned long)node_remap_start_vaddr[node];
+                start_pfn = node_remap_start_pfn[node];
+                size = node_remap_size[node];
+
+                printk(KERN_DEBUG "%s: node %d\n", __FUNCTION__, node);
+
+                for (pfn = 0; pfn < size; pfn += PTRS_PER_PTE) {
+                        unsigned long vaddr = start_va + (pfn << PAGE_SHIFT);
+                        pgd_t *pgd = pgd_base + pgd_index(vaddr);
+                        pud_t *pud = pud_offset(pgd, vaddr);
+                        pmd_t *pmd = pmd_offset(pud, vaddr);
+
+                        set_pmd(pmd, pfn_pmd(start_pfn + pfn,
+                                                PAGE_KERNEL_LARGE_EXEC));
+
+                        printk(KERN_DEBUG "%s: %08lx -> pfn %08lx\n",
+                                __FUNCTION__, vaddr, start_pfn + pfn);
+                }
+        }
+}
+#endif
+
 static unsigned long calculate_numa_remap_pages(void)
 {
         int nid;
diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c
index f2b6e3f11bfc..81197c62d5b3 100644
--- a/arch/x86/power/hibernate_32.c
+++ b/arch/x86/power/hibernate_32.c
@@ -12,6 +12,7 @@
 #include <asm/system.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
+#include <asm/mmzone.h>
 
 /* Defined in hibernate_asm_32.S */
 extern int restore_image(void);
@@ -127,6 +128,9 @@ static int resume_physical_mapping_init(pgd_t *pgd_base)
                         }
                 }
         }
+
+        resume_map_numa_kva(pgd_base);
+
         return 0;
 }
 
diff --git a/block/blk-map.c b/block/blk-map.c
index 4849fa36161e..0f4b4b881811 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -217,6 +217,12 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
                 return PTR_ERR(bio);
 
         if (bio->bi_size != len) {
+                /*
+                 * Grab an extra reference to this bio, as bio_unmap_user()
+                 * expects to be able to drop it twice as it happens on the
+                 * normal IO completion path
+                 */
+                bio_get(bio);
                 bio_endio(bio, 0);
                 bio_unmap_user(bio);
                 return -EINVAL;
diff --git a/block/genhd.c b/block/genhd.c
index 4e5e7493f676..27549e470da5 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -768,6 +768,8 @@ static int __init genhd_device_init(void)
         bdev_map = kobj_map_init(base_probe, &block_class_lock);
         blk_dev_init();
 
+        register_blkdev(BLOCK_EXT_MAJOR, "blkext");
+
 #ifndef CONFIG_SYSFS_DEPRECATED
         /* create top-level block dir */
         block_depr = kobject_create_and_add("block", NULL);
diff --git a/block/ioctl.c b/block/ioctl.c
index c832d639b6e2..d03985b04d67 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -18,7 +18,6 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user
         struct disk_part_iter piter;
         long long start, length;
         int partno;
-        int err;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -61,10 +60,10 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user
                         disk_part_iter_exit(&piter);
 
                         /* all seems OK */
-                        err = add_partition(disk, partno, start, length,
-                                            ADDPART_FLAG_NONE);
+                        part = add_partition(disk, partno, start, length,
+                                             ADDPART_FLAG_NONE);
                         mutex_unlock(&bdev->bd_mutex);
-                        return err;
+                        return IS_ERR(part) ? PTR_ERR(part) : 0;
                 case BLKPG_DEL_PARTITION:
                         part = disk_get_part(disk, partno);
                         if (!part)
diff --git a/drivers/acpi/sleep/proc.c b/drivers/acpi/sleep/proc.c
index 64e591ba86f2..4dbc2271acf5 100644
--- a/drivers/acpi/sleep/proc.c
+++ b/drivers/acpi/sleep/proc.c
@@ -366,7 +366,7 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
                            dev->wakeup.state.enabled ? "enabled" : "disabled");
                 if (ldev)
                         seq_printf(seq, "%s:%s",
-                                   dev_name(ldev) ? ldev->bus->name : "no-bus",
+                                   ldev->bus ? ldev->bus->name : "no-bus",
                                    dev_name(ldev));
                 seq_printf(seq, "\n");
                 put_device(ldev);
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 4b4739486327..9033d164c4ec 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1227,10 +1227,19 @@ fsm_start:
                         /* ATA PIO protocol */
                         if (unlikely((status & ATA_DRQ) == 0)) {
                                 /* handle BSY=0, DRQ=0 as error */
-                                if (likely(status & (ATA_ERR | ATA_DF)))
+                                if (likely(status & (ATA_ERR | ATA_DF))) {
                                         /* device stops HSM for abort/error */
                                         qc->err_mask |= AC_ERR_DEV;
-                                else {
+
+                                        /* If diagnostic failed and this is
+                                         * IDENTIFY, it's likely a phantom
+                                         * device.  Mark hint.
+                                         */
+                                        if (qc->dev->horkage &
+                                            ATA_HORKAGE_DIAGNOSTIC)
+                                                qc->err_mask |=
+                                                        AC_ERR_NODEV_HINT;
+                                } else {
                                         /* HSM violation. Let EH handle this.
                                          * Phantom devices also trigger this
                                          * condition.  Mark hint.
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 61ad8d639ba3..0344a8a8321d 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -21,7 +21,8 @@ config BLK_DEV_FD
         ---help---
           If you want to use the floppy disk drive(s) of your PC under Linux,
           say Y. Information about this driver, especially important for IBM
-          Thinkpad users, is contained in <file:Documentation/floppy.txt>.
+          Thinkpad users, is contained in
+          <file:Documentation/blockdev/floppy.txt>.
           That file also contains the location of the Floppy driver FAQ as
           well as location of the fdutils package used to configure additional
           parameters of the driver at run time.
@@ -76,7 +77,7 @@ config PARIDE
           your computer's parallel port. Most of them are actually IDE devices
           using a parallel port IDE adapter. This option enables the PARIDE
           subsystem which contains drivers for many of these external drives.
-          Read <file:Documentation/paride.txt> for more information.
+          Read <file:Documentation/blockdev/paride.txt> for more information.
 
           If you have said Y to the "Parallel-port support" configuration
           option, you may share a single port between your printer and other
@@ -114,9 +115,9 @@ config BLK_CPQ_DA
         help
           This is the driver for Compaq Smart Array controllers.  Everyone
           using these boards should say Y here.  See the file
-          <file:Documentation/cpqarray.txt> for the current list of boards
-          supported by this driver, and for further information on the use of
-          this driver.
+          <file:Documentation/blockdev/cpqarray.txt> for the current list of
+          boards supported by this driver, and for further information on the
+          use of this driver.
 
 config BLK_CPQ_CISS_DA
         tristate "Compaq Smart Array 5xxx support"
@@ -124,7 +125,7 @@ config BLK_CPQ_CISS_DA
         help
           This is the driver for Compaq Smart Array 5xxx controllers.
           Everyone using these boards should say Y here.
-          See <file:Documentation/cciss.txt> for the current list of
+          See <file:Documentation/blockdev/cciss.txt> for the current list of
           boards supported by this driver, and for further information
           on the use of this driver.
 
@@ -135,7 +136,7 @@ config CISS_SCSI_TAPE
         help
           When enabled (Y), this option allows SCSI tape drives and SCSI medium
           changers (tape robots) to be accessed via a Compaq 5xxx array 
-          controller.  (See <file:Documentation/cciss.txt> for more details.)
+          controller.  (See <file:Documentation/blockdev/cciss.txt> for more details.)
 
           "SCSI support" and "SCSI tape support" must also be enabled for this 
           option to work.
@@ -149,8 +150,8 @@ config BLK_DEV_DAC960
         help
           This driver adds support for the Mylex DAC960, AcceleRAID, and
           eXtremeRAID PCI RAID controllers.  See the file
-          <file:Documentation/README.DAC960> for further information about
-          this driver.
+          <file:Documentation/blockdev/README.DAC960> for further information
+          about this driver.
 
           To compile this driver as a module, choose M here: the
           module will be called DAC960.
@@ -278,9 +279,9 @@ config BLK_DEV_NBD
           userland (making server and client physically the same computer,
           communicating using the loopback network device).
 
-          Read <file:Documentation/nbd.txt> for more information, especially
-          about where to find the server code, which runs in user space and
-          does not need special kernel support.
+          Read <file:Documentation/blockdev/nbd.txt> for more information,
+          especially about where to find the server code, which runs in user
+          space and does not need special kernel support.
 
           Note that this has nothing to do with the network file systems NFS
           or Coda; you can say N here even if you intend to use NFS or Coda.
@@ -321,8 +322,8 @@ config BLK_DEV_RAM
           store a copy of a minimal root file system off of a floppy into RAM
           during the initial install of Linux.
 
-          Note that the kernel command line option "ramdisk=XX" is now
-          obsolete. For details, read <file:Documentation/ramdisk.txt>.
+          Note that the kernel command line option "ramdisk=XX" is now obsolete.
+          For details, read <file:Documentation/blockdev/ramdisk.txt>.
 
           To compile this driver as a module, choose M here: the
           module will be called rd.
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 12de1fdaa6c6..9364dc554257 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -2847,7 +2847,7 @@ static void do_cciss_request(struct request_queue *q)
                 h->maxSG = seg;
 
 #ifdef CCISS_DEBUG
-        printk(KERN_DEBUG "cciss: Submitting %d sectors in %d segments\n",
+        printk(KERN_DEBUG "cciss: Submitting %lu sectors in %d segments\n",
                creq->nr_sectors, seg);
 #endif                          /* CCISS_DEBUG */
 
@@ -3197,7 +3197,7 @@ static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
 
         c->paddr = pci_resource_start(pdev, 0); /* addressing mode bits already removed */
 #ifdef CCISS_DEBUG
-        printk("address 0 = %x\n", c->paddr);
+        printk("address 0 = %lx\n", c->paddr);
 #endif                          /* CCISS_DEBUG */
         c->vaddr = remap_pci_mem(c->paddr, 0x250);
 
@@ -3224,7 +3224,8 @@ static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
 #endif                          /* CCISS_DEBUG */
         cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
 #ifdef CCISS_DEBUG
-        printk("cfg base address index = %x\n", cfg_base_addr_index);
+        printk("cfg base address index = %llx\n",
+                (unsigned long long)cfg_base_addr_index);
 #endif                          /* CCISS_DEBUG */
         if (cfg_base_addr_index == -1) {
                 printk(KERN_WARNING "cciss: Cannot find cfg_base_addr_index\n");
@@ -3234,7 +3235,7 @@ static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
 
         cfg_offset = readl(c->vaddr + SA5_CTMEM_OFFSET);
 #ifdef CCISS_DEBUG
-        printk("cfg offset = %x\n", cfg_offset);
+        printk("cfg offset = %llx\n", (unsigned long long)cfg_offset);
 #endif                          /* CCISS_DEBUG */
         c->cfgtable = remap_pci_mem(pci_resource_start(pdev,
                                                        cfg_base_addr_index) +
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 14db747a636e..cf29cc4e6ab7 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4124,7 +4124,7 @@ static int __init floppy_setup(char *str)
                 printk("\n");
         } else
                 DPRINT("botched floppy option\n");
-        DPRINT("Read Documentation/floppy.txt\n");
+        DPRINT("Read Documentation/blockdev/floppy.txt\n");
         return 0;
 }
 
diff --git a/drivers/block/ub.c b/drivers/block/ub.c
index fccac18d3111..048d71d244d7 100644
--- a/drivers/block/ub.c
+++ b/drivers/block/ub.c
@@ -1546,8 +1546,6 @@ static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd)
 
 /*
  * Reset management
- * XXX Move usb_reset_device to khubd. Hogging kevent is not a good thing.
- * XXX Make usb_sync_reset asynchronous.
  */
 
 static void ub_reset_enter(struct ub_dev *sc, int try)
@@ -1633,6 +1631,22 @@ static void ub_reset_task(struct work_struct *work)
 }
 
 /*
+ * XXX Reset brackets are too much hassle to implement, so just stub them
+ * in order to prevent forced unbinding (which deadlocks solid when our
+ * ->disconnect method waits for the reset to complete and this kills keventd).
+ *
+ * XXX Tell Alan to move usb_unlock_device inside of usb_reset_device,
+ * or else the post_reset is invoked, and restats I/O on a locked device.
+ */
+static int ub_pre_reset(struct usb_interface *iface) {
+        return 0;
+}
+
+static int ub_post_reset(struct usb_interface *iface) {
+        return 0;
+}
+
+/*
  * This is called from a process context.
  */
 static void ub_revalidate(struct ub_dev *sc, struct ub_lun *lun)
@@ -2446,6 +2460,8 @@ static struct usb_driver ub_driver = {
         .probe =        ub_probe,
         .disconnect =   ub_disconnect,
         .id_table =     ub_usb_ids,
+        .pre_reset =    ub_pre_reset,
+        .post_reset =   ub_post_reset,
 };
 
 static int __init ub_init(void)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index b220c686089d..2d19f0cc47f2 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -338,12 +338,18 @@ wait:
 static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size)
 {
         struct request_queue *rq;
+        elevator_t *old_e;
 
         rq = blk_init_queue(do_blkif_request, &blkif_io_lock);
         if (rq == NULL)
                 return -1;
 
-        elevator_init(rq, "noop");
+        old_e = rq->elevator;
+        if (IS_ERR_VALUE(elevator_init(rq, "noop")))
+                printk(KERN_WARNING
+                        "blkfront: Switch elevator failed, use default\n");
+        else
+                elevator_exit(old_e);
 
         /* Hard sector size and max sectors impersonate the equiv. hardware. */
         blk_queue_hardsect_size(rq, sector_size);
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 43b35d0369d6..43d6ba83a191 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -124,7 +124,7 @@ config COMPUTONE
           which give you many serial ports. You would need something like this
           to connect more than two modems to your Linux box, for instance in
           order to become a dial-in server. If you have a card like that, say
-          Y here and read <file:Documentation/computone.txt>.
+          Y here and read <file:Documentation/serial/computone.txt>.
 
           To compile this driver as module, choose M here: the
           module will be called ip2.
@@ -136,7 +136,7 @@ config ROCKETPORT
           This driver supports Comtrol RocketPort and RocketModem PCI boards.   
           These boards provide 2, 4, 8, 16, or 32 high-speed serial ports or
           modems.  For information about the RocketPort/RocketModem  boards
-          and this driver read <file:Documentation/rocket.txt>.
+          and this driver read <file:Documentation/serial/rocket.txt>.
 
           To compile this driver as a module, choose M here: the
           module will be called rocket.
@@ -154,7 +154,7 @@ config CYCLADES
           your Linux box, for instance in order to become a dial-in server.
 
           For information about the Cyclades-Z card, read
-          <file:Documentation/README.cycladesZ>.
+          <file:Documentation/serial/README.cycladesZ>.
 
           To compile this driver as a module, choose M here: the
           module will be called cyclades.
@@ -183,7 +183,7 @@ config DIGIEPCA
           box, for instance in order to become a dial-in server. This driver
           supports the original PC (ISA) boards as well as PCI, and EISA. If
           you have a card like this, say Y here and read the file
-          <file:Documentation/digiepca.txt>.
+          <file:Documentation/serial/digiepca.txt>.
 
           To compile this driver as a module, choose M here: the
           module will be called epca.
@@ -289,7 +289,7 @@ config RISCOM8
           which gives you many serial ports. You would need something like
           this to connect more than two modems to your Linux box, for instance
           in order to become a dial-in server. If you have a card like that,
-          say Y here and read the file <file:Documentation/riscom8.txt>.
+          say Y here and read the file <file:Documentation/serial/riscom8.txt>.
 
           Also it's possible to say M here and compile this driver as kernel
           loadable module; the module will be called riscom8.
@@ -304,8 +304,8 @@ config SPECIALIX
           your Linux box, for instance in order to become a dial-in server.
 
           If you have a card like that, say Y here and read the file
-          <file:Documentation/specialix.txt>. Also it's possible to say M here
-          and compile this driver as kernel loadable module which will be
+          <file:Documentation/serial/specialix.txt>. Also it's possible to say
+          M here and compile this driver as kernel loadable module which will be
           called specialix.
 
 config SX
@@ -313,7 +313,7 @@ config SX
         depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA)
         help
           This is a driver for the SX and SI multiport serial cards.
-          Please read the file <file:Documentation/sx.txt> for details.
+          Please read the file <file:Documentation/serial/sx.txt> for details.
 
           This driver can only be built as a module ( = code which can be
           inserted in and removed from the running kernel whenever you want).
@@ -344,8 +344,8 @@ config STALDRV
           like this to connect more than two modems to your Linux box, for
           instance in order to become a dial-in server.  If you say Y here,
           you will be asked for your specific card model in the next
-          questions.  Make sure to read <file:Documentation/stallion.txt> in
-          this case.  If you have never heard about all this, it's safe to
+          questions.  Make sure to read <file:Documentation/serial/stallion.txt>
+          in this case.  If you have never heard about all this, it's safe to
           say N.
 
 config STALLION
@@ -354,7 +354,7 @@ config STALLION
         help
           If you have an EasyIO or EasyConnection 8/32 multiport Stallion
           card, then this is for you; say Y.  Make sure to read
-          <file:Documentation/stallion.txt>.
+          <file:Documentation/serial/stallion.txt>.
 
           To compile this driver as a module, choose M here: the
           module will be called stallion.
@@ -365,7 +365,7 @@ config ISTALLION
         help
           If you have an EasyConnection 8/64, ONboard, Brumby or Stallion
           serial multiport card, say Y here. Make sure to read
-          <file:Documentation/stallion.txt>.
+          <file:Documentation/serial/stallion.txt>.
 
           To compile this driver as a module, choose M here: the
           module will be called istallion.
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index 242fd46fda22..a16b94f12eb2 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -72,7 +72,7 @@
 /*
  * There is a bunch of documentation about the card, jumpers, config
  * settings, restrictions, cables, device names and numbers in
- * Documentation/specialix.txt
+ * Documentation/serial/specialix.txt
  */
 
 #include <linux/module.h>
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index faa1cc66e9cf..82020abc329e 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1134,7 +1134,7 @@ static void gpiolib_dbg_show(struct seq_file *s, struct gpio_chip *chip)
                         continue;
 
                 is_out = test_bit(FLAG_IS_OUT, &gdesc->flags);
-                seq_printf(s, " gpio-%-3d (%-12s) %s %s",
+                seq_printf(s, " gpio-%-3d (%-20.20s) %s %s",
                         gpio, gdesc->label,
                         is_out ? "out" : "in ",
                         chip->get
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index c6ab4ba60c52..9b97795e45ad 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -55,10 +55,11 @@ struct apple_key_translation {
 
 static struct apple_key_translation apple_fn_keys[] = {
         { KEY_BACKSPACE, KEY_DELETE },
+        { KEY_ENTER,    KEY_INSERT },
         { KEY_F1,       KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY },
         { KEY_F2,       KEY_BRIGHTNESSUP,   APPLE_FLAG_FKEY },
-        { KEY_F3,       KEY_FN_F5,          APPLE_FLAG_FKEY }, /* Exposé */
-        { KEY_F4,       KEY_FN_F4,          APPLE_FLAG_FKEY }, /* Dashboard */
+        { KEY_F3,       KEY_SCALE,          APPLE_FLAG_FKEY },
+        { KEY_F4,       KEY_DASHBOARD,      APPLE_FLAG_FKEY },
         { KEY_F5,       KEY_KBDILLUMDOWN,   APPLE_FLAG_FKEY },
         { KEY_F6,       KEY_KBDILLUMUP,     APPLE_FLAG_FKEY },
         { KEY_F7,       KEY_PREVIOUSSONG,   APPLE_FLAG_FKEY },
@@ -418,6 +419,12 @@ static const struct hid_device_id apple_devices[] = {
                 .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_JIS),
                 .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO),
+                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
+                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY),
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index d3671b4049c0..147ec591a806 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1250,9 +1250,11 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BRIGHT, USB_DEVICE_ID_BRIGHT_ABNT2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
@@ -1265,7 +1267,6 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_EZKEY, USB_DEVICE_ID_BTC_8193) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GENERIC_13BA, USB_DEVICE_ID_GENERIC_13BA_KBD_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_KWORLD, USB_DEVICE_ID_KWORLD_RADIO_FM700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER) },
@@ -1409,6 +1410,7 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ALCOR, USB_DEVICE_ID_ALCOR_USBRS232) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_LCM)},
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_LCM2)},
+        { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) },
@@ -1486,6 +1488,7 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_GTCO, USB_DEVICE_ID_GTCO_1007) },
         { HID_USB_DEVICE(USB_VENDOR_ID_IMATION, USB_DEVICE_ID_DISC_STAKKA) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KBGEAR, USB_DEVICE_ID_KBGEAR_JAMSTUDIO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KWORLD, USB_DEVICE_ID_KWORLD_RADIO_FM700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_GPEN_560) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CASSY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POCKETCASSY) },
@@ -1573,6 +1576,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING2_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
         { }
@@ -1730,7 +1736,7 @@ static int __init hid_init(void)
                 goto err_bus;
 
 #ifdef CONFIG_HID_COMPAT
-        hid_compat_wq = create_workqueue("hid_compat");
+        hid_compat_wq = create_singlethread_workqueue("hid_compat");
         if (!hid_compat_wq) {
                 hidraw_exit();
                 goto err;
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index f05bcbbbb0d5..d70075dd3d81 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -82,6 +82,9 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_ANSI    0x0230
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_ISO     0x0231
 #define USB_DEVICE_ID_APPLE_WELLSPRING2_JIS     0x0232
+#define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI    0x0236
+#define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO     0x0237
+#define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS     0x0238
 #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY    0x030a
 #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY     0x030b
 #define USB_DEVICE_ID_APPLE_ATV_IRCONTROL       0x8241
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 894d52e05bf9..7685ae6808c4 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -38,7 +38,7 @@ static int hidraw_major;
 static struct cdev hidraw_cdev;
 static struct class *hidraw_class;
 static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
-static DEFINE_SPINLOCK(minors_lock);
+static DEFINE_MUTEX(minors_lock);
 
 static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
@@ -159,13 +159,13 @@ static int hidraw_open(struct inode *inode, struct file *file)
         struct hidraw_list *list;
         int err = 0;
 
-        lock_kernel();
         if (!(list = kzalloc(sizeof(struct hidraw_list), GFP_KERNEL))) {
                 err = -ENOMEM;
                 goto out;
         }
 
-        spin_lock(&minors_lock);
+        lock_kernel();
+        mutex_lock(&minors_lock);
         if (!hidraw_table[minor]) {
                 printk(KERN_EMERG "hidraw device with minor %d doesn't exist\n",
                                 minor);
@@ -180,13 +180,16 @@ static int hidraw_open(struct inode *inode, struct file *file)
         file->private_data = list;
 
         dev = hidraw_table[minor];
-        if (!dev->open++)
-                dev->hid->ll_driver->open(dev->hid);
+        if (!dev->open++) {
+                err = dev->hid->ll_driver->open(dev->hid);
+                if (err < 0)
+                        dev->open--;
+        }
 
 out_unlock:
-        spin_unlock(&minors_lock);
-out:
+        mutex_unlock(&minors_lock);
         unlock_kernel();
+out:
         return err;
 
 }
@@ -310,7 +313,7 @@ int hidraw_connect(struct hid_device *hid)
 
         result = -EINVAL;
 
-        spin_lock(&minors_lock);
+        mutex_lock(&minors_lock);
 
         for (minor = 0; minor < HIDRAW_MAX_DEVICES; minor++) {
                 if (hidraw_table[minor])
@@ -320,9 +323,8 @@ int hidraw_connect(struct hid_device *hid)
                 break;
         }
 
-        spin_unlock(&minors_lock);
-
         if (result) {
+                mutex_unlock(&minors_lock);
                 kfree(dev);
                 goto out;
         }
@@ -331,14 +333,14 @@ int hidraw_connect(struct hid_device *hid)
                                  NULL, "%s%d", "hidraw", minor);
 
         if (IS_ERR(dev->dev)) {
-                spin_lock(&minors_lock);
                 hidraw_table[minor] = NULL;
-                spin_unlock(&minors_lock);
+                mutex_unlock(&minors_lock);
                 result = PTR_ERR(dev->dev);
                 kfree(dev);
                 goto out;
         }
 
+        mutex_unlock(&minors_lock);
         init_waitqueue_head(&dev->wait);
         INIT_LIST_HEAD(&dev->list);
 
@@ -360,9 +362,9 @@ void hidraw_disconnect(struct hid_device *hid)
 
         hidraw->exist = 0;
 
-        spin_lock(&minors_lock);
+        mutex_lock(&minors_lock);
         hidraw_table[hidraw->minor] = NULL;
-        spin_unlock(&minors_lock);
+        mutex_unlock(&minors_lock);
 
         device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
 
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 18e5ddd722cd..d746bf8284dd 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -781,6 +781,8 @@ static int usbhid_start(struct hid_device *hid)
         unsigned int n, insize = 0;
         int ret;
 
+        clear_bit(HID_DISCONNECTED, &usbhid->iofl);
+
         usbhid->bufsize = HID_MIN_BUFFER_SIZE;
         hid_find_max_report(hid, HID_INPUT_REPORT, &usbhid->bufsize);
         hid_find_max_report(hid, HID_OUTPUT_REPORT, &usbhid->bufsize);
@@ -847,12 +849,6 @@ static int usbhid_start(struct hid_device *hid)
                 }
         }
 
-        if (!usbhid->urbin) {
-                err_hid("couldn't find an input interrupt endpoint");
-                ret = -ENODEV;
-                goto fail;
-        }
-
         init_waitqueue_head(&usbhid->wait);
         INIT_WORK(&usbhid->reset_work, hid_reset);
         setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
@@ -888,6 +884,9 @@ fail:
         usb_free_urb(usbhid->urbin);
         usb_free_urb(usbhid->urbout);
         usb_free_urb(usbhid->urbctrl);
+        usbhid->urbin = NULL;
+        usbhid->urbout = NULL;
+        usbhid->urbctrl = NULL;
         hid_free_buffers(dev, hid);
         mutex_unlock(&usbhid->setup);
         return ret;
@@ -924,6 +923,9 @@ static void usbhid_stop(struct hid_device *hid)
         usb_free_urb(usbhid->urbin);
         usb_free_urb(usbhid->urbctrl);
         usb_free_urb(usbhid->urbout);
+        usbhid->urbin = NULL; /* don't mess up next start */
+        usbhid->urbctrl = NULL;
+        usbhid->urbout = NULL;
 
         hid_free_buffers(hid_to_usb_dev(hid), hid);
         mutex_unlock(&usbhid->setup);
@@ -940,15 +942,26 @@ static struct hid_ll_driver usb_hid_driver = {
 
 static int hid_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
+        struct usb_host_interface *interface = intf->cur_altsetting;
         struct usb_device *dev = interface_to_usbdev(intf);
         struct usbhid_device *usbhid;
         struct hid_device *hid;
+        unsigned int n, has_in = 0;
         size_t len;
         int ret;
 
         dbg_hid("HID probe called for ifnum %d\n",
                         intf->altsetting->desc.bInterfaceNumber);
 
+        for (n = 0; n < interface->desc.bNumEndpoints; n++)
+                if (usb_endpoint_is_int_in(&interface->endpoint[n].desc))
+                        has_in++;
+        if (!has_in) {
+                dev_err(&intf->dev, "couldn't find an input interrupt "
+                                "endpoint\n");
+                return -ENODEV;
+        }
+
         hid = hid_allocate_device();
         if (IS_ERR(hid))
                 return PTR_ERR(hid);
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 488e45cd43d7..f7dce8b9f64b 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -128,6 +128,9 @@ static const char* temperature_sensors_sets[][36] = {
 /* Set 13: iMac 8,1 */
         { "TA0P", "TC0D", "TC0H", "TC0P", "TG0D", "TG0H", "TG0P", "TH0P",
           "TL0P", "TO0P", "TW0P", "Tm0P", "Tp0P", NULL },
+/* Set 14: iMac 6,1 */
+        { "TA0P", "TC0D", "TC0H", "TC0P", "TG0D", "TG0H", "TG0P", "TH0P",
+          "TO0P", "Tp0P", NULL },
 };
 
 /* List of keys used to read/write fan speeds */
@@ -1296,6 +1299,8 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
         { .accelerometer = 1, .light = 1, .temperature_set = 12 },
 /* iMac 8: light sensor only, temperature set 13 */
         { .accelerometer = 0, .light = 0, .temperature_set = 13 },
+/* iMac 6: light sensor only, temperature set 14 */
+        { .accelerometer = 0, .light = 0, .temperature_set = 14 },
 };
 
 /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
@@ -1349,10 +1354,18 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
           DMI_MATCH(DMI_BOARD_VENDOR,"Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME,"MacPro2") },
                 &applesmc_dmi_data[4]},
+        { applesmc_dmi_match, "Apple MacPro", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacPro") },
+                &applesmc_dmi_data[4]},
         { applesmc_dmi_match, "Apple iMac 8", {
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "iMac8") },
                 &applesmc_dmi_data[13]},
+        { applesmc_dmi_match, "Apple iMac 6", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "iMac6") },
+                &applesmc_dmi_data[14]},
         { applesmc_dmi_match, "Apple iMac 5", {
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "iMac5") },
diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
index 752b5c44df9c..c002144c76bc 100644
--- a/drivers/hwmon/lis3lv02d.c
+++ b/drivers/hwmon/lis3lv02d.c
@@ -33,7 +33,6 @@
 #include <linux/wait.h>
 #include <linux/poll.h>
 #include <linux/freezer.h>
-#include <linux/version.h>
 #include <linux/uaccess.h>
 #include <acpi/acpi_drivers.h>
 #include <asm/atomic.h>
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 640cbb237328..3384a717fec0 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -318,7 +318,8 @@ static int sh_mobile_i2c_isr_rx(struct sh_mobile_i2c_data *pd)
                 } else
                         data = i2c_op(pd, OP_RX, 0);
 
-                pd->msg->buf[real_pos] = data;
+                if (real_pos >= 0)
+                        pd->msg->buf[real_pos] = data;
         } while (0);
 
         pd->pos++;
diff --git a/drivers/ide/ide-cs.c b/drivers/ide/ide-cs.c
index cb199c815b53..f50210fe558f 100644
--- a/drivers/ide/ide-cs.c
+++ b/drivers/ide/ide-cs.c
@@ -444,6 +444,7 @@ static struct pcmcia_device_id ide_ids[] = {
         PCMCIA_DEVICE_PROD_ID1("STI Flash", 0xe4a13209),
         PCMCIA_DEVICE_PROD_ID12("STI", "Flash 5.0", 0xbf2df18d, 0x8cb57a0e),
         PCMCIA_MFC_DEVICE_PROD_ID12(1, "SanDisk", "ConnectPlus", 0x7a954bd9, 0x74be00c6),
+        PCMCIA_DEVICE_PROD_ID2("Flash Card", 0x5a362506),
         PCMCIA_DEVICE_NULL,
 };
 MODULE_DEVICE_TABLE(pcmcia, ide_ids);
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index bb904a0a98bd..1bfc55d7a26c 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -1641,8 +1641,10 @@ isdn_net_ciscohdlck_slarp_send_reply(isdn_net_local *lp)
         /* slarp reply, send own ip/netmask; if values are nonsense remote
          * should think we are unable to provide it with an address via SLARP */
         p += put_u32(p, CISCO_SLARP_REPLY);
-        p += put_u32(p, addr);  // address
-        p += put_u32(p, mask);  // netmask
+        *(__be32 *)p = addr;    // address
+        p += 4;
+        *(__be32 *)p = mask;    // netmask
+        p += 4;
         p += put_u16(p, 0);     // unused
 
         isdn_net_write_super(lp, skb);
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 4840733cd903..3d7f4923cd13 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -441,13 +441,13 @@ static void process_queued_ios(struct work_struct *work)
                 __choose_pgpath(m);
 
         pgpath = m->current_pgpath;
-        m->pgpath_to_activate = m->current_pgpath;
 
         if ((pgpath && !m->queue_io) ||
             (!pgpath && !m->queue_if_no_path))
                 must_queue = 0;
 
-        if (m->pg_init_required && !m->pg_init_in_progress) {
+        if (m->pg_init_required && !m->pg_init_in_progress && pgpath) {
+                m->pgpath_to_activate = pgpath;
                 m->pg_init_count++;
                 m->pg_init_required = 0;
                 m->pg_init_in_progress = 1;
@@ -708,6 +708,10 @@ static int parse_hw_handler(struct arg_set *as, struct multipath *m)
                 m->hw_handler_name = NULL;
                 return -EINVAL;
         }
+
+        if (hw_argc > 1)
+                DMWARN("Ignoring user-specified arguments for "
+                       "hardware handler \"%s\"", m->hw_handler_name);
         consume(as, hw_argc - 1);
 
         return 0;
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 9d7b53ed75b2..ec43f9fa4b2a 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -1032,6 +1032,7 @@ static void mirror_dtr(struct dm_target *ti)
 
         del_timer_sync(&ms->timer);
         flush_workqueue(ms->kmirrord_wq);
+        flush_scheduled_work();
         dm_kcopyd_client_destroy(ms->kcopyd_client);
         destroy_workqueue(ms->kmirrord_wq);
         free_context(ms, ti, ms->nr_mirrors);
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index a2d068dbe9e2..9e4ef88d421e 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -320,8 +320,10 @@ int __init dm_stripe_init(void)
         int r;
 
         r = dm_register_target(&stripe_target);
-        if (r < 0)
+        if (r < 0) {
                 DMWARN("target registration failed");
+                return r;
+        }
 
         kstriped = create_singlethread_workqueue("kstriped");
         if (!kstriped) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6963ad148408..c99e4728ff41 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -375,7 +375,7 @@ static void start_io_acct(struct dm_io *io)
         dm_disk(md)->part0.in_flight = atomic_inc_return(&md->pending);
 }
 
-static int end_io_acct(struct dm_io *io)
+static void end_io_acct(struct dm_io *io)
 {
         struct mapped_device *md = io->md;
         struct bio *bio = io->bio;
@@ -391,7 +391,9 @@ static int end_io_acct(struct dm_io *io)
         dm_disk(md)->part0.in_flight = pending =
                 atomic_dec_return(&md->pending);
 
-        return !pending;
+        /* nudge anyone waiting on suspend queue */
+        if (!pending)
+                wake_up(&md->wait);
 }
 
 /*
@@ -499,9 +501,7 @@ static void dec_pending(struct dm_io *io, int error)
                         spin_unlock_irqrestore(&io->md->pushback_lock, flags);
                 }
 
-                if (end_io_acct(io))
-                        /* nudge anyone waiting on suspend queue */
-                        wake_up(&io->md->wait);
+                end_io_acct(io);
 
                 if (io->error != DM_ENDIO_REQUEUE) {
                         blk_add_trace_bio(io->md->queue, io->bio,
@@ -937,16 +937,24 @@ static void dm_unplug_all(struct request_queue *q)
 
 static int dm_any_congested(void *congested_data, int bdi_bits)
 {
-        int r;
-        struct mapped_device *md = (struct mapped_device *) congested_data;
-        struct dm_table *map = dm_get_table(md);
+        int r = bdi_bits;
+        struct mapped_device *md = congested_data;
+        struct dm_table *map;
 
-        if (!map || test_bit(DMF_BLOCK_IO, &md->flags))
-                r = bdi_bits;
-        else
-                r = dm_table_any_congested(map, bdi_bits);
+        atomic_inc(&md->pending);
+
+        if (!test_bit(DMF_BLOCK_IO, &md->flags)) {
+                map = dm_get_table(md);
+                if (map) {
+                        r = dm_table_any_congested(map, bdi_bits);
+                        dm_table_put(map);
+                }
+        }
+
+        if (!atomic_dec_return(&md->pending))
+                /* nudge anyone waiting on suspend queue */
+                wake_up(&md->wait);
 
-        dm_table_put(map);
         return r;
 }
 
diff --git a/drivers/media/video/tvaudio.c b/drivers/media/video/tvaudio.c
index b59e47272abf..3720f0e03a16 100644
--- a/drivers/media/video/tvaudio.c
+++ b/drivers/media/video/tvaudio.c
@@ -1,5 +1,5 @@
 /*
- * experimental driver for simple i2c audio chips.
+ * Driver for simple i2c audio chips.
  *
  * Copyright (c) 2000 Gerd Knorr
  * based on code by:
@@ -7,6 +7,10 @@
  *   Steve VanDeBogart (vandebo@uclink.berkeley.edu)
  *   Greg Alexander (galexand@acm.org)
  *
+ * Copyright(c) 2005-2008 Mauro Carvalho Chehab
+ *      - Some cleanups, code fixes, etc
+ *      - Convert it to V4L2 API
+ *
  * This code is placed under the terms of the GNU General Public License
  *
  * OPTIONS:
@@ -30,6 +34,7 @@
 
 #include <media/tvaudio.h>
 #include <media/v4l2-common.h>
+#include <media/v4l2-ioctl.h>
 #include <media/v4l2-chip-ident.h>
 #include <media/v4l2-i2c-drv-legacy.h>
 
@@ -58,7 +63,6 @@ typedef int  (*checkit)(struct CHIPSTATE*);
 typedef int  (*initialize)(struct CHIPSTATE*);
 typedef int  (*getmode)(struct CHIPSTATE*);
 typedef void (*setmode)(struct CHIPSTATE*, int mode);
-typedef void (*checkmode)(struct CHIPSTATE*);
 
 /* i2c command */
 typedef struct AUDIOCMD {
@@ -79,6 +83,7 @@ struct CHIPDESC {
 #define CHIP_HAS_VOLUME      1
 #define CHIP_HAS_BASSTREBLE  2
 #define CHIP_HAS_INPUTSEL    4
+#define CHIP_NEED_CHECKMODE  8
 
         /* various i2c command sequences */
         audiocmd   init;
@@ -96,23 +101,20 @@ struct CHIPDESC {
         getmode  getmode;
         setmode  setmode;
 
-        /* check / autoswitch audio after channel switches */
-        checkmode  checkmode;
-
         /* input switch register + values for v4l inputs */
         int  inputreg;
         int  inputmap[4];
         int  inputmute;
         int  inputmask;
 };
-static struct CHIPDESC chiplist[];
 
 /* current state of the chip */
 struct CHIPSTATE {
         struct i2c_client *c;
 
-        /* index into CHIPDESC array */
-        int type;
+        /* chip-specific description - should point to
+           an entry at CHIPDESC table */
+        struct CHIPDESC *desc;
 
         /* shadow register set */
         audiocmd   shadow;
@@ -152,7 +154,7 @@ static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
 {
         unsigned char buffer[2];
 
-        if (-1 == subaddr) {
+        if (subaddr < 0) {
                 v4l_dbg(1, debug, chip->c, "%s: chip_write: 0x%x\n",
                         chip->c->name, val);
                 chip->shadow.bytes[1] = val;
@@ -163,6 +165,13 @@ static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
                         return -1;
                 }
         } else {
+                if (subaddr + 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
+                        v4l_info(chip->c,
+                                "Tried to access a non-existent register: %d\n",
+                                subaddr);
+                        return -EINVAL;
+                }
+
                 v4l_dbg(1, debug, chip->c, "%s: chip_write: reg%d=0x%x\n",
                         chip->c->name, subaddr, val);
                 chip->shadow.bytes[subaddr+1] = val;
@@ -177,12 +186,20 @@ static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
         return 0;
 }
 
-static int chip_write_masked(struct CHIPSTATE *chip, int subaddr, int val, int mask)
+static int chip_write_masked(struct CHIPSTATE *chip,
+                             int subaddr, int val, int mask)
 {
         if (mask != 0) {
-                if (-1 == subaddr) {
+                if (subaddr < 0) {
                         val = (chip->shadow.bytes[1] & ~mask) | (val & mask);
                 } else {
+                        if (subaddr + 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
+                                v4l_info(chip->c,
+                                        "Tried to access a non-existent register: %d\n",
+                                        subaddr);
+                                return -EINVAL;
+                        }
+
                         val = (chip->shadow.bytes[subaddr+1] & ~mask) | (val & mask);
                 }
         }
@@ -228,6 +245,15 @@ static int chip_cmd(struct CHIPSTATE *chip, char *name, audiocmd *cmd)
         if (0 == cmd->count)
                 return 0;
 
+        if (cmd->count + cmd->bytes[0] - 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
+                v4l_info(chip->c,
+                         "Tried to access a non-existent register range: %d to %d\n",
+                         cmd->bytes[0] + 1, cmd->bytes[0] + cmd->count - 1);
+                return -EINVAL;
+        }
+
+        /* FIXME: it seems that the shadow bytes are wrong bellow !*/
+
         /* update our shadow register set; print bytes if (debug > 0) */
         v4l_dbg(1, debug, chip->c, "%s: chip_cmd(%s): reg=%d, data:",
                 chip->c->name, name,cmd->bytes[0]);
@@ -263,7 +289,8 @@ static void chip_thread_wake(unsigned long data)
 static int chip_thread(void *data)
 {
         struct CHIPSTATE *chip = data;
-        struct CHIPDESC  *desc = chiplist + chip->type;
+        struct CHIPDESC  *desc = chip->desc;
+        int mode;
 
         v4l_dbg(1, debug, chip->c, "%s: thread started\n", chip->c->name);
         set_freezable();
@@ -282,7 +309,26 @@ static int chip_thread(void *data)
                         continue;
 
                 /* have a look what's going on */
-                desc->checkmode(chip);
+                mode = desc->getmode(chip);
+                if (mode == chip->prevmode)
+                        continue;
+
+                /* chip detected a new audio mode - set it */
+                v4l_dbg(1, debug, chip->c, "%s: thread checkmode\n",
+                        chip->c->name);
+
+                chip->prevmode = mode;
+
+                if (mode & V4L2_TUNER_MODE_STEREO)
+                        desc->setmode(chip, V4L2_TUNER_MODE_STEREO);
+                if (mode & V4L2_TUNER_MODE_LANG1_LANG2)
+                        desc->setmode(chip, V4L2_TUNER_MODE_STEREO);
+                else if (mode & V4L2_TUNER_MODE_LANG1)
+                        desc->setmode(chip, V4L2_TUNER_MODE_LANG1);
+                else if (mode & V4L2_TUNER_MODE_LANG2)
+                        desc->setmode(chip, V4L2_TUNER_MODE_LANG2);
+                else
+                        desc->setmode(chip, V4L2_TUNER_MODE_MONO);
 
                 /* schedule next check */
                 mod_timer(&chip->wt, jiffies+msecs_to_jiffies(2000));
@@ -292,29 +338,6 @@ static int chip_thread(void *data)
         return 0;
 }
 
-static void generic_checkmode(struct CHIPSTATE *chip)
-{
-        struct CHIPDESC  *desc = chiplist + chip->type;
-        int mode = desc->getmode(chip);
-
-        if (mode == chip->prevmode)
-        return;
-
-        v4l_dbg(1, debug, chip->c, "%s: thread checkmode\n", chip->c->name);
-        chip->prevmode = mode;
-
-        if (mode & V4L2_TUNER_MODE_STEREO)
-                desc->setmode(chip,V4L2_TUNER_MODE_STEREO);
-        if (mode & V4L2_TUNER_MODE_LANG1_LANG2)
-                desc->setmode(chip,V4L2_TUNER_MODE_STEREO);
-        else if (mode & V4L2_TUNER_MODE_LANG1)
-                desc->setmode(chip,V4L2_TUNER_MODE_LANG1);
-        else if (mode & V4L2_TUNER_MODE_LANG2)
-                desc->setmode(chip,V4L2_TUNER_MODE_LANG2);
-        else
-                desc->setmode(chip,V4L2_TUNER_MODE_MONO);
-}
-
 /* ---------------------------------------------------------------------- */
 /* audio chip descriptions - defines+functions for tda9840                */
 
@@ -777,7 +800,7 @@ static struct tda9874a_MODES {
         char *name;
         audiocmd cmd;
 } tda9874a_modelist[9] = {
-  {     "A2, B/G",
+  {     "A2, B/G", /* default */
         { 9, { TDA9874A_C1FRA, 0x72,0x95,0x55, 0x77,0xA0,0x00, 0x00,0x00 }} },
   {     "A2, M (Korea)",
         { 9, { TDA9874A_C1FRA, 0x5D,0xC0,0x00, 0x62,0x6A,0xAA, 0x20,0x22 }} },
@@ -791,7 +814,7 @@ static struct tda9874a_MODES {
         { 9, { TDA9874A_C1FRA, 0x7D,0x00,0x00, 0x88,0x8A,0xAA, 0x08,0x33 }} },
   {     "NICAM, B/G",
         { 9, { TDA9874A_C1FRA, 0x72,0x95,0x55, 0x79,0xEA,0xAA, 0x08,0x33 }} },
-  {     "NICAM, D/K", /* default */
+  {     "NICAM, D/K",
         { 9, { TDA9874A_C1FRA, 0x87,0x6A,0xAA, 0x79,0xEA,0xAA, 0x08,0x33 }} },
   {     "NICAM, L",
         { 9, { TDA9874A_C1FRA, 0x87,0x6A,0xAA, 0x79,0xEA,0xAA, 0x09,0x33 }} }
@@ -981,7 +1004,7 @@ static int tda9874a_initialize(struct CHIPSTATE *chip)
 {
         if (tda9874a_SIF > 2)
                 tda9874a_SIF = 1;
-        if (tda9874a_STD > 8)
+        if (tda9874a_STD >= ARRAY_SIZE(tda9874a_modelist))
                 tda9874a_STD = 0;
         if(tda9874a_AMSEL > 1)
                 tda9874a_AMSEL = 0;
@@ -1089,7 +1112,7 @@ static int tda8425_shift12(int val) { return (val >> 12) | 0xf0; }
 
 static int tda8425_initialize(struct CHIPSTATE *chip)
 {
-        struct CHIPDESC *desc = chiplist + chip->type;
+        struct CHIPDESC *desc = chip->desc;
         int inputmap[4] = { /* tuner    */ TDA8425_S1_CH2, /* radio  */ TDA8425_S1_CH1,
                             /* extern   */ TDA8425_S1_CH1, /* intern */ TDA8425_S1_OFF};
 
@@ -1259,27 +1282,28 @@ static struct CHIPDESC chiplist[] = {
                 .addr_lo    = I2C_ADDR_TDA9840 >> 1,
                 .addr_hi    = I2C_ADDR_TDA9840 >> 1,
                 .registers  = 5,
+                .flags      = CHIP_NEED_CHECKMODE,
 
+                /* callbacks */
                 .checkit    = tda9840_checkit,
                 .getmode    = tda9840_getmode,
                 .setmode    = tda9840_setmode,
-                .checkmode  = generic_checkmode,
 
                 .init       = { 2, { TDA9840_TEST, TDA9840_TEST_INT1SN
                                 /* ,TDA9840_SW, TDA9840_MONO */} }
         },
         {
                 .name       = "tda9873h",
-                .checkit    = tda9873_checkit,
                 .insmodopt  = &tda9873,
                 .addr_lo    = I2C_ADDR_TDA985x_L >> 1,
                 .addr_hi    = I2C_ADDR_TDA985x_H >> 1,
                 .registers  = 3,
-                .flags      = CHIP_HAS_INPUTSEL,
+                .flags      = CHIP_HAS_INPUTSEL | CHIP_NEED_CHECKMODE,
 
+                /* callbacks */
+                .checkit    = tda9873_checkit,
                 .getmode    = tda9873_getmode,
                 .setmode    = tda9873_setmode,
-                .checkmode  = generic_checkmode,
 
                 .init       = { 4, { TDA9873_SW, 0xa4, 0x06, 0x03 } },
                 .inputreg   = TDA9873_SW,
@@ -1290,15 +1314,16 @@ static struct CHIPDESC chiplist[] = {
         },
         {
                 .name       = "tda9874h/a",
-                .checkit    = tda9874a_checkit,
-                .initialize = tda9874a_initialize,
                 .insmodopt  = &tda9874a,
                 .addr_lo    = I2C_ADDR_TDA9874 >> 1,
                 .addr_hi    = I2C_ADDR_TDA9874 >> 1,
+                .flags      = CHIP_NEED_CHECKMODE,
 
+                /* callbacks */
+                .initialize = tda9874a_initialize,
+                .checkit    = tda9874a_checkit,
                 .getmode    = tda9874a_getmode,
                 .setmode    = tda9874a_setmode,
-                .checkmode  = generic_checkmode,
         },
         {
                 .name       = "tda9850",
@@ -1324,10 +1349,11 @@ static struct CHIPDESC chiplist[] = {
                 .rightreg   = TDA9855_VR,
                 .bassreg    = TDA9855_BA,
                 .treblereg  = TDA9855_TR,
+
+                /* callbacks */
                 .volfunc    = tda9855_volume,
                 .bassfunc   = tda9855_bass,
                 .treblefunc = tda9855_treble,
-
                 .getmode    = tda985x_getmode,
                 .setmode    = tda985x_setmode,
 
@@ -1348,6 +1374,8 @@ static struct CHIPDESC chiplist[] = {
                 .rightreg   = TEA6300_VL,
                 .bassreg    = TEA6300_BA,
                 .treblereg  = TEA6300_TR,
+
+                /* callbacks */
                 .volfunc    = tea6300_shift10,
                 .bassfunc   = tea6300_shift12,
                 .treblefunc = tea6300_shift12,
@@ -1358,7 +1386,6 @@ static struct CHIPDESC chiplist[] = {
         },
         {
                 .name       = "tea6320",
-                .initialize = tea6320_initialize,
                 .insmodopt  = &tea6320,
                 .addr_lo    = I2C_ADDR_TEA6300 >> 1,
                 .addr_hi    = I2C_ADDR_TEA6300 >> 1,
@@ -1369,6 +1396,9 @@ static struct CHIPDESC chiplist[] = {
                 .rightreg   = TEA6320_V,
                 .bassreg    = TEA6320_BA,
                 .treblereg  = TEA6320_TR,
+
+                /* callbacks */
+                .initialize = tea6320_initialize,
                 .volfunc    = tea6320_volume,
                 .bassfunc   = tea6320_shift11,
                 .treblefunc = tea6320_shift11,
@@ -1401,16 +1431,18 @@ static struct CHIPDESC chiplist[] = {
                 .rightreg   = TDA8425_VR,
                 .bassreg    = TDA8425_BA,
                 .treblereg  = TDA8425_TR,
+
+                /* callbacks */
+                .initialize = tda8425_initialize,
                 .volfunc    = tda8425_shift10,
                 .bassfunc   = tda8425_shift12,
                 .treblefunc = tda8425_shift12,
+                .setmode    = tda8425_setmode,
 
                 .inputreg   = TDA8425_S1,
                 .inputmap   = { TDA8425_S1_CH1, TDA8425_S1_CH1, TDA8425_S1_CH1 },
                 .inputmute  = TDA8425_S1_OFF,
 
-                .setmode    = tda8425_setmode,
-                .initialize = tda8425_initialize,
         },
         {
                 .name       = "pic16c54 (PV951)",
@@ -1434,10 +1466,11 @@ static struct CHIPDESC chiplist[] = {
                 .addr_lo    = I2C_ADDR_TDA9840 >> 1,
                 .addr_hi    = I2C_ADDR_TDA9840 >> 1,
                 .registers  = 2,
+                .flags      = CHIP_NEED_CHECKMODE,
 
+                /* callbacks */
                 .getmode    = ta8874z_getmode,
                 .setmode    = ta8874z_setmode,
-                .checkmode  = generic_checkmode,
 
                 .init       = {2, { TA8874Z_MONO_SET, TA8874Z_SEPARATION_DEFAULT}},
         },
@@ -1481,6 +1514,7 @@ static int chip_probe(struct i2c_client *client, const struct i2c_device_id *id)
         }
         if (desc->name == NULL) {
                 v4l_dbg(1, debug, client, "no matching chip description found\n");
+                kfree(chip);
                 return -EIO;
         }
         v4l_info(client, "%s found @ 0x%x (%s)\n", desc->name, client->addr<<1, client->adapter->name);
@@ -1494,7 +1528,7 @@ static int chip_probe(struct i2c_client *client, const struct i2c_device_id *id)
         /* fill required data structures */
         if (!id)
                 strlcpy(client->name, desc->name, I2C_NAME_SIZE);
-        chip->type = desc-chiplist;
+        chip->desc = desc;
         chip->shadow.count = desc->registers+1;
         chip->prevmode = -1;
         chip->audmode = V4L2_TUNER_MODE_LANG1;
@@ -1506,20 +1540,49 @@ static int chip_probe(struct i2c_client *client, const struct i2c_device_id *id)
                 chip_cmd(chip,"init",&desc->init);
 
         if (desc->flags & CHIP_HAS_VOLUME) {
-                chip->left   = desc->leftinit   ? desc->leftinit   : 65535;
-                chip->right  = desc->rightinit  ? desc->rightinit  : 65535;
-                chip_write(chip,desc->leftreg,desc->volfunc(chip->left));
-                chip_write(chip,desc->rightreg,desc->volfunc(chip->right));
+                if (!desc->volfunc) {
+                        /* This shouldn't be happen. Warn user, but keep working
+                           without volume controls
+                         */
+                        v4l_info(chip->c, "volume callback undefined!\n");
+                        desc->flags &= ~CHIP_HAS_VOLUME;
+                } else {
+                        chip->left  = desc->leftinit  ? desc->leftinit  : 65535;
+                        chip->right = desc->rightinit ? desc->rightinit : 65535;
+                        chip_write(chip, desc->leftreg,
+                                   desc->volfunc(chip->left));
+                        chip_write(chip, desc->rightreg,
+                                   desc->volfunc(chip->right));
+                }
         }
         if (desc->flags & CHIP_HAS_BASSTREBLE) {
-                chip->treble = desc->trebleinit ? desc->trebleinit : 32768;
-                chip->bass   = desc->bassinit   ? desc->bassinit   : 32768;
-                chip_write(chip,desc->bassreg,desc->bassfunc(chip->bass));
-                chip_write(chip,desc->treblereg,desc->treblefunc(chip->treble));
+                if (!desc->bassfunc || !desc->treblefunc) {
+                        /* This shouldn't be happen. Warn user, but keep working
+                           without bass/treble controls
+                         */
+                        v4l_info(chip->c, "bass/treble callbacks undefined!\n");
+                        desc->flags &= ~CHIP_HAS_BASSTREBLE;
+                } else {
+                        chip->treble = desc->trebleinit ?
+                                                desc->trebleinit : 32768;
+                        chip->bass   = desc->bassinit   ?
+                                                desc->bassinit   : 32768;
+                        chip_write(chip, desc->bassreg,
+                                   desc->bassfunc(chip->bass));
+                        chip_write(chip, desc->treblereg,
+                                   desc->treblefunc(chip->treble));
+                }
         }
 
         chip->thread = NULL;
-        if (desc->checkmode) {
+        if (desc->flags & CHIP_NEED_CHECKMODE) {
+                if (!desc->getmode || !desc->setmode) {
+                        /* This shouldn't be happen. Warn user, but keep working
+                           without kthread
+                         */
+                        v4l_info(chip->c, "set/get mode callbacks undefined!\n");
+                        return 0;
+                }
                 /* start async thread */
                 init_timer(&chip->wt);
                 chip->wt.function = chip_thread_wake;
@@ -1552,7 +1615,7 @@ static int chip_remove(struct i2c_client *client)
 static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
                             struct v4l2_control *ctrl)
 {
-        struct CHIPDESC *desc = chiplist + chip->type;
+        struct CHIPDESC *desc = chip->desc;
 
         switch (ctrl->id) {
         case V4L2_CID_AUDIO_MUTE:
@@ -1576,13 +1639,13 @@ static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
                 return 0;
         }
         case V4L2_CID_AUDIO_BASS:
-                if (desc->flags & CHIP_HAS_BASSTREBLE)
+                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                         break;
                 ctrl->value = chip->bass;
                 return 0;
         case V4L2_CID_AUDIO_TREBLE:
-                if (desc->flags & CHIP_HAS_BASSTREBLE)
-                        return -EINVAL;
+                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+                        break;
                 ctrl->value = chip->treble;
                 return 0;
         }
@@ -1592,7 +1655,7 @@ static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
 static int tvaudio_set_ctrl(struct CHIPSTATE *chip,
                             struct v4l2_control *ctrl)
 {
-        struct CHIPDESC *desc = chiplist + chip->type;
+        struct CHIPDESC *desc = chip->desc;
 
         switch (ctrl->id) {
         case V4L2_CID_AUDIO_MUTE:
@@ -1642,16 +1705,15 @@ static int tvaudio_set_ctrl(struct CHIPSTATE *chip,
                 return 0;
         }
         case V4L2_CID_AUDIO_BASS:
-                if (desc->flags & CHIP_HAS_BASSTREBLE)
+                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                         break;
                 chip->bass = ctrl->value;
                 chip_write(chip,desc->bassreg,desc->bassfunc(chip->bass));
 
                 return 0;
         case V4L2_CID_AUDIO_TREBLE:
-                if (desc->flags & CHIP_HAS_BASSTREBLE)
-                        return -EINVAL;
-
+                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+                        break;
                 chip->treble = ctrl->value;
                 chip_write(chip,desc->treblereg,desc->treblefunc(chip->treble));
 
@@ -1668,9 +1730,12 @@ static int chip_command(struct i2c_client *client,
                         unsigned int cmd, void *arg)
 {
         struct CHIPSTATE *chip = i2c_get_clientdata(client);
-        struct CHIPDESC  *desc = chiplist + chip->type;
+        struct CHIPDESC  *desc = chip->desc;
 
-        v4l_dbg(1, debug, chip->c, "%s: chip_command 0x%x\n", chip->c->name, cmd);
+        if (debug > 0) {
+                v4l_i2c_print_ioctl(chip->c, cmd);
+                printk("\n");
+        }
 
         switch (cmd) {
         case AUDC_SET_RADIO:
@@ -1695,7 +1760,7 @@ static int chip_command(struct i2c_client *client,
                                 break;
                         case V4L2_CID_AUDIO_BASS:
                         case V4L2_CID_AUDIO_TREBLE:
-                                if (desc->flags & CHIP_HAS_BASSTREBLE)
+                                if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                                         return -EINVAL;
                                 break;
                         default:
@@ -1792,12 +1857,20 @@ static int chip_command(struct i2c_client *client,
                 break;
         case VIDIOC_S_FREQUENCY:
                 chip->mode = 0; /* automatic */
-                if (desc->checkmode && desc->setmode) {
+
+                /* For chips that provide getmode and setmode, and doesn't
+                   automatically follows the stereo carrier, a kthread is
+                   created to set the audio standard. In this case, when then
+                   the video channel is changed, tvaudio starts on MONO mode.
+                   After waiting for 2 seconds, the kernel thread is called,
+                   to follow whatever audio standard is pointed by the
+                   audio carrier.
+                 */
+                if (chip->thread) {
                         desc->setmode(chip,V4L2_TUNER_MODE_MONO);
                         if (chip->prevmode != V4L2_TUNER_MODE_MONO)
                                 chip->prevmode = -1; /* reset previous mode */
                         mod_timer(&chip->wt, jiffies+msecs_to_jiffies(2000));
-                        /* the thread will call checkmode() later */
                 }
                 break;
 
@@ -1836,9 +1909,3 @@ static struct v4l2_i2c_driver_data v4l2_i2c_data = {
         .legacy_probe = chip_legacy_probe,
         .id_table = chip_id,
 };
-
-/*
- * Local variables:
- * c-basic-offset: 8
- * End:
- */
diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
index b57326ae464d..0b5bd85dfcec 100644
--- a/drivers/mfd/da903x.c
+++ b/drivers/mfd/da903x.c
@@ -267,7 +267,7 @@ static int da9030_mask_events(struct da903x_chip *chip, unsigned int events)
 {
         uint8_t v[3];
 
-        chip->events_mask &= ~events;
+        chip->events_mask |= events;
 
         v[0] = (chip->events_mask & 0xff);
         v[1] = (chip->events_mask >> 8) & 0xff;
diff --git a/drivers/mfd/wm8350-i2c.c b/drivers/mfd/wm8350-i2c.c
index 8dfe21bb3bd1..3e0ce0e50ea2 100644
--- a/drivers/mfd/wm8350-i2c.c
+++ b/drivers/mfd/wm8350-i2c.c
@@ -30,7 +30,12 @@ static int wm8350_i2c_read_device(struct wm8350 *wm8350, char reg,
         ret = i2c_master_send(wm8350->i2c_client, &reg, 1);
         if (ret < 0)
                 return ret;
-        return i2c_master_recv(wm8350->i2c_client, dest, bytes);
+        ret = i2c_master_recv(wm8350->i2c_client, dest, bytes);
+        if (ret < 0)
+                return ret;
+        if (ret != bytes)
+                return -EIO;
+        return 0;
 }
 
 static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
@@ -38,13 +43,19 @@ static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
 {
         /* we add 1 byte for device register */
         u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
+        int ret;
 
         if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
                 return -EINVAL;
 
         msg[0] = reg;
         memcpy(&msg[1], src, bytes);
-        return i2c_master_send(wm8350->i2c_client, msg, bytes + 1);
+        ret = i2c_master_send(wm8350->i2c_client, msg, bytes + 1);
+        if (ret < 0)
+                return ret;
+        if (ret != bytes + 1)
+                return -EIO;
+        return 0;
 }
 
 static int wm8350_i2c_probe(struct i2c_client *i2c,
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index 976b35d1d035..0207dd59090d 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -18,6 +18,7 @@
 #include <linux/ctype.h>
 #include <linux/delay.h>
 #include <linux/idr.h>
+#include <linux/sched.h>
 
 #include <linux/c2port.h>
 
diff --git a/drivers/misc/sgi-gru/Makefile b/drivers/misc/sgi-gru/Makefile
index d03597a521b0..9e9170b3599a 100644
--- a/drivers/misc/sgi-gru/Makefile
+++ b/drivers/misc/sgi-gru/Makefile
@@ -1,3 +1,7 @@
+ifdef CONFIG_SGI_GRU_DEBUG
+  EXTRA_CFLAGS  += -DDEBUG
+endif
+
 obj-$(CONFIG_SGI_GRU) := gru.o
 gru-y := grufile.o grumain.o grufault.o grutlbpurge.o gruprocfs.o grukservices.o
 
diff --git a/drivers/mtd/maps/cdb89712.c b/drivers/mtd/maps/cdb89712.c
index e5059aa3c724..8d92d8db9a98 100644
--- a/drivers/mtd/maps/cdb89712.c
+++ b/drivers/mtd/maps/cdb89712.c
@@ -14,7 +14,18 @@
 #include <linux/mtd/map.h>
 #include <linux/mtd/partitions.h>
 
-
+/* dynamic ioremap() areas */
+#define FLASH_START      0x00000000
+#define FLASH_SIZE       0x800000
+#define FLASH_WIDTH      4
+
+#define SRAM_START       0x60000000
+#define SRAM_SIZE        0xc000
+#define SRAM_WIDTH       4
+
+#define BOOTROM_START    0x70000000
+#define BOOTROM_SIZE     0x80
+#define BOOTROM_WIDTH    4
 
 
 static struct mtd_info *flash_mtd;
diff --git a/drivers/mtd/maps/h720x-flash.c b/drivers/mtd/maps/h720x-flash.c
index 35fef655ccc4..3b959fad1c4e 100644
--- a/drivers/mtd/maps/h720x-flash.c
+++ b/drivers/mtd/maps/h720x-flash.c
@@ -24,8 +24,8 @@ static struct mtd_info *mymtd;
 static struct map_info h720x_map = {
         .name =         "H720X",
         .bankwidth =    4,
-        .size =         FLASH_SIZE,
-        .phys =         FLASH_PHYS,
+        .size =         H720X_FLASH_SIZE,
+        .phys =         H720X_FLASH_PHYS,
 };
 
 static struct mtd_partition h720x_partitions[] = {
@@ -70,7 +70,7 @@ int __init h720x_mtd_init(void)
 
         char    *part_type = NULL;
 
-        h720x_map.virt = ioremap(FLASH_PHYS, FLASH_SIZE);
+        h720x_map.virt = ioremap(h720x_map.phys, h720x_map.size);
 
         if (!h720x_map.virt) {
                 printk(KERN_ERR "H720x-MTD: ioremap failed\n");
diff --git a/drivers/net/atl1e/atl1e_hw.c b/drivers/net/atl1e/atl1e_hw.c
index 8cbc1b59bd62..4a7700620119 100644
--- a/drivers/net/atl1e/atl1e_hw.c
+++ b/drivers/net/atl1e/atl1e_hw.c
@@ -163,9 +163,6 @@ int atl1e_read_mac_addr(struct atl1e_hw *hw)
  * atl1e_hash_mc_addr
  *  purpose
  *      set hash value for a multicast address
- *      hash calcu processing :
- *          1. calcu 32bit CRC for multicast address
- *          2. reverse crc with MSB to LSB
  */
 u32 atl1e_hash_mc_addr(struct atl1e_hw *hw, u8 *mc_addr)
 {
@@ -174,7 +171,6 @@ u32 atl1e_hash_mc_addr(struct atl1e_hw *hw, u8 *mc_addr)
         int i;
 
         crc32 = ether_crc_le(6, mc_addr);
-        crc32 = ~crc32;
         for (i = 0; i < 32; i++)
                 value |= (((crc32 >> i) & 1) << (31 - i));
 
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 246d92b42636..aef403d299ee 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -3404,14 +3404,8 @@ static void atl1_get_wol(struct net_device *netdev,
 {
         struct atl1_adapter *adapter = netdev_priv(netdev);
 
-        wol->supported = WAKE_UCAST | WAKE_MCAST | WAKE_BCAST | WAKE_MAGIC;
+        wol->supported = WAKE_MAGIC;
         wol->wolopts = 0;
-        if (adapter->wol & ATLX_WUFC_EX)
-                wol->wolopts |= WAKE_UCAST;
-        if (adapter->wol & ATLX_WUFC_MC)
-                wol->wolopts |= WAKE_MCAST;
-        if (adapter->wol & ATLX_WUFC_BC)
-                wol->wolopts |= WAKE_BCAST;
         if (adapter->wol & ATLX_WUFC_MAG)
                 wol->wolopts |= WAKE_MAGIC;
         return;
@@ -3422,15 +3416,10 @@ static int atl1_set_wol(struct net_device *netdev,
 {
         struct atl1_adapter *adapter = netdev_priv(netdev);
 
-        if (wol->wolopts & (WAKE_PHY | WAKE_ARP | WAKE_MAGICSECURE))
+        if (wol->wolopts & (WAKE_PHY | WAKE_UCAST | WAKE_MCAST | WAKE_BCAST |
+                WAKE_ARP | WAKE_MAGICSECURE))
                 return -EOPNOTSUPP;
         adapter->wol = 0;
-        if (wol->wolopts & WAKE_UCAST)
-                adapter->wol |= ATLX_WUFC_EX;
-        if (wol->wolopts & WAKE_MCAST)
-                adapter->wol |= ATLX_WUFC_MC;
-        if (wol->wolopts & WAKE_BCAST)
-                adapter->wol |= ATLX_WUFC_BC;
         if (wol->wolopts & WAKE_MAGIC)
                 adapter->wol |= ATLX_WUFC_MAG;
         return 0;
diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
index f5bdc92c1a65..8571e8c0bc67 100644
--- a/drivers/net/atlx/atl2.c
+++ b/drivers/net/atlx/atl2.c
@@ -1690,9 +1690,11 @@ static int atl2_resume(struct pci_dev *pdev)
 
         ATL2_WRITE_REG(&adapter->hw, REG_WOL_CTRL, 0);
 
-        err = atl2_request_irq(adapter);
-        if (netif_running(netdev) && err)
-                return err;
+        if (netif_running(netdev)) {
+                err = atl2_request_irq(adapter);
+                if (err)
+                        return err;
+        }
 
         atl2_reset_hw(&adapter->hw);
 
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 3d69fae781cf..e8bfcce6b319 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -166,7 +166,7 @@
 
 #define DRV_NAME                "e100"
 #define DRV_EXT                 "-NAPI"
-#define DRV_VERSION             "3.5.23-k4"DRV_EXT
+#define DRV_VERSION             "3.5.23-k6"DRV_EXT
 #define DRV_DESCRIPTION         "Intel(R) PRO/100 Network Driver"
 #define DRV_COPYRIGHT           "Copyright(c) 1999-2006 Intel Corporation"
 #define PFX                     DRV_NAME ": "
@@ -1804,7 +1804,7 @@ static int e100_rx_alloc_skb(struct nic *nic, struct rx *rx)
                 struct rfd *prev_rfd = (struct rfd *)rx->prev->skb->data;
                 put_unaligned_le32(rx->dma_addr, &prev_rfd->link);
                 pci_dma_sync_single_for_device(nic->pdev, rx->prev->dma_addr,
-                        sizeof(struct rfd), PCI_DMA_TODEVICE);
+                        sizeof(struct rfd), PCI_DMA_BIDIRECTIONAL);
         }
 
         return 0;
@@ -1823,7 +1823,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
 
         /* Need to sync before taking a peek at cb_complete bit */
         pci_dma_sync_single_for_cpu(nic->pdev, rx->dma_addr,
-                sizeof(struct rfd), PCI_DMA_FROMDEVICE);
+                sizeof(struct rfd), PCI_DMA_BIDIRECTIONAL);
         rfd_status = le16_to_cpu(rfd->status);
 
         DPRINTK(RX_STATUS, DEBUG, "status=0x%04X\n", rfd_status);
@@ -1850,7 +1850,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
 
         /* Get data */
         pci_unmap_single(nic->pdev, rx->dma_addr,
-                RFD_BUF_LEN, PCI_DMA_FROMDEVICE);
+                RFD_BUF_LEN, PCI_DMA_BIDIRECTIONAL);
 
         /* If this buffer has the el bit, but we think the receiver
          * is still running, check to see if it really stopped while
@@ -1943,7 +1943,7 @@ static void e100_rx_clean(struct nic *nic, unsigned int *work_done,
                 new_before_last_rfd->command |= cpu_to_le16(cb_el);
                 pci_dma_sync_single_for_device(nic->pdev,
                         new_before_last_rx->dma_addr, sizeof(struct rfd),
-                        PCI_DMA_TODEVICE);
+                        PCI_DMA_BIDIRECTIONAL);
 
                 /* Now that we have a new stopping point, we can clear the old
                  * stopping point.  We must sync twice to get the proper
@@ -1951,11 +1951,11 @@ static void e100_rx_clean(struct nic *nic, unsigned int *work_done,
                 old_before_last_rfd->command &= ~cpu_to_le16(cb_el);
                 pci_dma_sync_single_for_device(nic->pdev,
                         old_before_last_rx->dma_addr, sizeof(struct rfd),
-                        PCI_DMA_TODEVICE);
+                        PCI_DMA_BIDIRECTIONAL);
                 old_before_last_rfd->size = cpu_to_le16(VLAN_ETH_FRAME_LEN);
                 pci_dma_sync_single_for_device(nic->pdev,
                         old_before_last_rx->dma_addr, sizeof(struct rfd),
-                        PCI_DMA_TODEVICE);
+                        PCI_DMA_BIDIRECTIONAL);
         }
 
         if(restart_required) {
@@ -1978,7 +1978,7 @@ static void e100_rx_clean_list(struct nic *nic)
                 for(rx = nic->rxs, i = 0; i < count; rx++, i++) {
                         if(rx->skb) {
                                 pci_unmap_single(nic->pdev, rx->dma_addr,
-                                        RFD_BUF_LEN, PCI_DMA_FROMDEVICE);
+                                        RFD_BUF_LEN, PCI_DMA_BIDIRECTIONAL);
                                 dev_kfree_skb(rx->skb);
                         }
                 }
@@ -2021,7 +2021,7 @@ static int e100_rx_alloc_list(struct nic *nic)
         before_last->command |= cpu_to_le16(cb_el);
         before_last->size = 0;
         pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
-                sizeof(struct rfd), PCI_DMA_TODEVICE);
+                sizeof(struct rfd), PCI_DMA_BIDIRECTIONAL);
 
         nic->rx_to_use = nic->rx_to_clean = nic->rxs;
         nic->ru_running = RU_SUSPENDED;
@@ -2222,7 +2222,7 @@ static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode)
         msleep(10);
 
         pci_dma_sync_single_for_cpu(nic->pdev, nic->rx_to_clean->dma_addr,
-                        RFD_BUF_LEN, PCI_DMA_FROMDEVICE);
+                        RFD_BUF_LEN, PCI_DMA_BIDIRECTIONAL);
 
         if(memcmp(nic->rx_to_clean->skb->data + sizeof(struct rfd),
            skb->data, ETH_DATA_LEN))
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index 6a3893acfe04..c854c96f5ab3 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -1774,7 +1774,8 @@ static void e1000_get_wol(struct net_device *netdev,
 
         /* this function will set ->supported = 0 and return 1 if wol is not
          * supported by this hardware */
-        if (e1000_wol_exclusion(adapter, wol))
+        if (e1000_wol_exclusion(adapter, wol) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return;
 
         /* apply any specific unsupported masks here */
@@ -1811,7 +1812,8 @@ static int e1000_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & (WAKE_PHY | WAKE_ARP | WAKE_MAGICSECURE))
                 return -EOPNOTSUPP;
 
-        if (e1000_wol_exclusion(adapter, wol))
+        if (e1000_wol_exclusion(adapter, wol) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return wol->wolopts ? -EOPNOTSUPP : 0;
 
         switch (hw->device_id) {
@@ -1838,6 +1840,8 @@ static int e1000_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & WAKE_MAGIC)
                 adapter->wol |= E1000_WUFC_MAG;
 
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
+
         return 0;
 }
 
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index fac82152e4c8..872799b746f5 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1179,6 +1179,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 
         /* initialize the wol settings based on the eeprom settings */
         adapter->wol = adapter->eeprom_wol;
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
         /* print bus type/speed/width info */
         DPRINTK(PROBE, INFO, "(PCI%s:%s:%s) ",
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index c55de1c027af..c55fd6fdb91c 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -299,6 +299,7 @@ struct e1000_adapter {
         unsigned long led_status;
 
         unsigned int flags;
+        unsigned int flags2;
         struct work_struct downshift_task;
         struct work_struct update_phy_task;
 };
@@ -306,6 +307,7 @@ struct e1000_adapter {
 struct e1000_info {
         enum e1000_mac_type     mac;
         unsigned int            flags;
+        unsigned int            flags2;
         u32                     pba;
         s32                     (*get_variants)(struct e1000_adapter *);
         struct e1000_mac_operations *mac_ops;
@@ -347,6 +349,9 @@ struct e1000_info {
 #define FLAG_RX_RESTART_NOW               (1 << 30)
 #define FLAG_MSI_TEST_FAILED              (1 << 31)
 
+/* CRC Stripping defines */
+#define FLAG2_CRC_STRIPPING               (1 << 0)
+
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
 #define E1000_GET_DESC(R, i, type)      (&(((struct type *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index 70c11c811a08..62421ce96311 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -1713,7 +1713,8 @@ static void e1000_get_wol(struct net_device *netdev,
         wol->supported = 0;
         wol->wolopts = 0;
 
-        if (!(adapter->flags & FLAG_HAS_WOL))
+        if (!(adapter->flags & FLAG_HAS_WOL) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return;
 
         wol->supported = WAKE_UCAST | WAKE_MCAST |
@@ -1751,7 +1752,8 @@ static int e1000_set_wol(struct net_device *netdev,
         if (wol->wolopts & WAKE_MAGICSECURE)
                 return -EOPNOTSUPP;
 
-        if (!(adapter->flags & FLAG_HAS_WOL))
+        if (!(adapter->flags & FLAG_HAS_WOL) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return wol->wolopts ? -EOPNOTSUPP : 0;
 
         /* these settings will always override what we currently have */
@@ -1770,6 +1772,8 @@ static int e1000_set_wol(struct net_device *netdev,
         if (wol->wolopts & WAKE_ARP)
                 adapter->wol |= E1000_WUFC_ARP;
 
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
+
         return 0;
 }
 
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index abd492b7336d..91795f78c3e4 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -499,6 +499,10 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                         goto next_desc;
                 }
 
+                /* adjust length to remove Ethernet CRC */
+                if (!(adapter->flags2 & FLAG2_CRC_STRIPPING))
+                        length -= 4;
+
                 total_rx_bytes += length;
                 total_rx_packets++;
 
@@ -804,6 +808,10 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         pci_dma_sync_single_for_device(pdev, ps_page->dma,
                                 PAGE_SIZE, PCI_DMA_FROMDEVICE);
 
+                        /* remove the CRC */
+                        if (!(adapter->flags2 & FLAG2_CRC_STRIPPING))
+                                l1 -= 4;
+
                         skb_put(skb, l1);
                         goto copydone;
                 } /* if */
@@ -825,6 +833,12 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         skb->truesize += length;
                 }
 
+                /* strip the ethernet crc, problem is we're using pages now so
+                 * this whole operation can get a little cpu intensive
+                 */
+                if (!(adapter->flags2 & FLAG2_CRC_STRIPPING))
+                        pskb_trim(skb, skb->len - 4);
+
 copydone:
                 total_rx_bytes += skb->len;
                 total_rx_packets++;
@@ -2301,8 +2315,12 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
         else
                 rctl |= E1000_RCTL_LPE;
 
-        /* Enable hardware CRC frame stripping */
-        rctl |= E1000_RCTL_SECRC;
+        /* Some systems expect that the CRC is included in SMBUS traffic. The
+         * hardware strips the CRC before sending to both SMBUS (BMC) and to
+         * host memory when this is enabled
+         */
+        if (adapter->flags2 & FLAG2_CRC_STRIPPING)
+                rctl |= E1000_RCTL_SECRC;
 
         /* Setup buffer sizes */
         rctl &= ~E1000_RCTL_SZ_4096;
@@ -4766,6 +4784,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         adapter->ei = ei;
         adapter->pba = ei->pba;
         adapter->flags = ei->flags;
+        adapter->flags2 = ei->flags2;
         adapter->hw.adapter = adapter;
         adapter->hw.mac.type = ei->mac;
         adapter->msg_enable = (1 << NETIF_MSG_DRV | NETIF_MSG_PROBE) - 1;
@@ -4970,6 +4989,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 
         /* initialize the wol settings based on the eeprom settings */
         adapter->wol = adapter->eeprom_wol;
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
         /* reset the hardware with the new settings */
         e1000e_reset(adapter);
@@ -5008,6 +5028,7 @@ err_hw_init:
 err_sw_init:
         if (adapter->hw.flash_address)
                 iounmap(adapter->hw.flash_address);
+        e1000e_reset_interrupt_capability(adapter);
 err_flashmap:
         iounmap(adapter->hw.hw_addr);
 err_ioremap:
diff --git a/drivers/net/e1000e/param.c b/drivers/net/e1000e/param.c
index 77a3d7207a5f..e909f96698e8 100644
--- a/drivers/net/e1000e/param.c
+++ b/drivers/net/e1000e/param.c
@@ -151,6 +151,16 @@ E1000_PARAM(KumeranLockLoss, "Enable Kumeran lock loss workaround");
  */
 E1000_PARAM(WriteProtectNVM, "Write-protect NVM [WARNING: disabling this can lead to corrupted NVM]");
 
+/*
+ * Enable CRC Stripping
+ *
+ * Valid Range: 0, 1
+ *
+ * Default Value: 1 (enabled)
+ */
+E1000_PARAM(CrcStripping, "Enable CRC Stripping, disable if your BMC needs " \
+                          "the CRC");
+
 struct e1000_option {
         enum { enable_option, range_option, list_option } type;
         const char *name;
@@ -404,6 +414,21 @@ void __devinit e1000e_check_options(struct e1000_adapter *adapter)
                                 adapter->flags |= FLAG_SMART_POWER_DOWN;
                 }
         }
+        { /* CRC Stripping */
+                const struct e1000_option opt = {
+                        .type = enable_option,
+                        .name = "CRC Stripping",
+                        .err  = "defaulting to enabled",
+                        .def  = OPTION_ENABLED
+                };
+
+                if (num_CrcStripping > bd) {
+                        unsigned int crc_stripping = CrcStripping[bd];
+                        e1000_validate_option(&crc_stripping, &opt, adapter);
+                        if (crc_stripping == OPTION_ENABLED)
+                                adapter->flags2 |= FLAG2_CRC_STRIPPING;
+                }
+        }
         { /* Kumeran Lock Loss Workaround */
                 const struct e1000_option opt = {
                         .type = enable_option,
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 83a5cb6aa23b..c4af949bf860 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1407,6 +1407,10 @@ static int gfar_clean_tx_ring(struct net_device *dev)
                 if (bdp->status & TXBD_DEF)
                         dev->stats.collisions++;
 
+                /* Unmap the DMA memory */
+                dma_unmap_single(&priv->dev->dev, bdp->bufPtr,
+                                bdp->length, DMA_TO_DEVICE);
+
                 /* Free the sk buffer associated with this TxBD */
                 dev_kfree_skb_irq(priv->tx_skbuff[priv->skb_dirtytx]);
 
@@ -1666,6 +1670,9 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
 
                 skb = priv->rx_skbuff[priv->skb_currx];
 
+                dma_unmap_single(&priv->dev->dev, bdp->bufPtr,
+                                priv->rx_buffer_size, DMA_FROM_DEVICE);
+
                 /* We drop the frame if we failed to allocate a new buffer */
                 if (unlikely(!newskb || !(bdp->status & RXBD_LAST) ||
                                  bdp->status & RXBD_ERR)) {
@@ -1674,14 +1681,8 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
                         if (unlikely(!newskb))
                                 newskb = skb;
 
-                        if (skb) {
-                                dma_unmap_single(&priv->dev->dev,
-                                                bdp->bufPtr,
-                                                priv->rx_buffer_size,
-                                                DMA_FROM_DEVICE);
-
+                        if (skb)
                                 dev_kfree_skb_any(skb);
-                        }
                 } else {
                         /* Increment the number of packets */
                         dev->stats.rx_packets++;
diff --git a/drivers/net/igb/igb_ethtool.c b/drivers/net/igb/igb_ethtool.c
index 58906c984be9..89964fa739a0 100644
--- a/drivers/net/igb/igb_ethtool.c
+++ b/drivers/net/igb/igb_ethtool.c
@@ -1776,7 +1776,8 @@ static void igb_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
 
         /* this function will set ->supported = 0 and return 1 if wol is not
          * supported by this hardware */
-        if (igb_wol_exclusion(adapter, wol))
+        if (igb_wol_exclusion(adapter, wol) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return;
 
         /* apply any specific unsupported masks here */
@@ -1805,7 +1806,8 @@ static int igb_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & (WAKE_PHY | WAKE_ARP | WAKE_MAGICSECURE))
                 return -EOPNOTSUPP;
 
-        if (igb_wol_exclusion(adapter, wol))
+        if (igb_wol_exclusion(adapter, wol) ||
+            !device_can_wakeup(&adapter->pdev->dev))
                 return wol->wolopts ? -EOPNOTSUPP : 0;
 
         switch (hw->device_id) {
@@ -1825,6 +1827,8 @@ static int igb_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & WAKE_MAGIC)
                 adapter->wol |= E1000_WUFC_MAG;
 
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
+
         return 0;
 }
 
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 1f397cd99414..1cbae85b1426 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -1019,10 +1019,9 @@ static int __devinit igb_probe(struct pci_dev *pdev,
                         state &= ~PCIE_LINK_STATE_L0S;
                         pci_write_config_word(us_dev, pos + PCI_EXP_LNKCTL,
                                               state);
-                        printk(KERN_INFO "Disabling ASPM L0s upstream switch "
-                               "port %x:%x.%x\n", us_dev->bus->number,
-                               PCI_SLOT(us_dev->devfn),
-                               PCI_FUNC(us_dev->devfn));
+                        dev_info(&pdev->dev,
+                                 "Disabling ASPM L0s upstream switch port %s\n",
+                                 pci_name(us_dev));
                 }
         default:
                 break;
@@ -1244,6 +1243,7 @@ static int __devinit igb_probe(struct pci_dev *pdev,
 
         /* initialize the wol settings based on the eeprom settings */
         adapter->wol = adapter->eeprom_wol;
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
         /* reset the hardware with the new settings */
         igb_reset(adapter);
diff --git a/drivers/net/ipg.c b/drivers/net/ipg.c
index 7373dafbb3f7..059369885be1 100644
--- a/drivers/net/ipg.c
+++ b/drivers/net/ipg.c
@@ -1112,7 +1112,7 @@ static void ipg_nic_rx_free_skb(struct net_device *dev)
                 struct ipg_rx *rxfd = sp->rxd + entry;
 
                 pci_unmap_single(sp->pdev,
-                        le64_to_cpu(rxfd->frag_info & ~IPG_RFI_FRAGLEN),
+                        le64_to_cpu(rxfd->frag_info) & ~IPG_RFI_FRAGLEN,
                         sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
                 dev_kfree_skb_irq(sp->rx_buff[entry]);
                 sp->rx_buff[entry] = NULL;
@@ -1179,7 +1179,7 @@ static int ipg_nic_rx_check_error(struct net_device *dev)
                  */
                 if (sp->rx_buff[entry]) {
                         pci_unmap_single(sp->pdev,
-                                le64_to_cpu(rxfd->frag_info & ~IPG_RFI_FRAGLEN),
+                                le64_to_cpu(rxfd->frag_info) & ~IPG_RFI_FRAGLEN,
                                 sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
 
                         dev_kfree_skb_irq(sp->rx_buff[entry]);
@@ -1246,7 +1246,7 @@ static void ipg_nic_rx_with_start(struct net_device *dev,
         if (jumbo->found_start)
                 dev_kfree_skb_irq(jumbo->skb);
 
-        pci_unmap_single(pdev, le64_to_cpu(rxfd->frag_info & ~IPG_RFI_FRAGLEN),
+        pci_unmap_single(pdev, le64_to_cpu(rxfd->frag_info) & ~IPG_RFI_FRAGLEN,
                          sp->rx_buf_sz, PCI_DMA_FROMDEVICE);
 
         skb_put(skb, sp->rxfrag_size);
@@ -1349,7 +1349,7 @@ static int ipg_nic_rx_jumbo(struct net_device *dev)
                 unsigned int entry = curr % IPG_RFDLIST_LENGTH;
                 struct ipg_rx *rxfd = sp->rxd + entry;
 
-                if (!(rxfd->rfs & le64_to_cpu(IPG_RFS_RFDDONE)))
+                if (!(rxfd->rfs & cpu_to_le64(IPG_RFS_RFDDONE)))
                         break;
 
                 switch (ipg_nic_rx_check_frame_type(dev)) {
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 7548fb7360d9..36f2bb666bf7 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1287,7 +1287,34 @@ static void ixgbe_set_itr(struct ixgbe_adapter *adapter)
         return;
 }
 
-static inline void ixgbe_irq_enable(struct ixgbe_adapter *adapter);
+/**
+ * ixgbe_irq_disable - Mask off interrupt generation on the NIC
+ * @adapter: board private structure
+ **/
+static inline void ixgbe_irq_disable(struct ixgbe_adapter *adapter)
+{
+        IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC, ~0);
+        IXGBE_WRITE_FLUSH(&adapter->hw);
+        if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
+                int i;
+                for (i = 0; i < adapter->num_msix_vectors; i++)
+                        synchronize_irq(adapter->msix_entries[i].vector);
+        } else {
+                synchronize_irq(adapter->pdev->irq);
+        }
+}
+
+/**
+ * ixgbe_irq_enable - Enable default interrupt generation settings
+ * @adapter: board private structure
+ **/
+static inline void ixgbe_irq_enable(struct ixgbe_adapter *adapter)
+{
+        u32 mask;
+        mask = IXGBE_EIMS_ENABLE_MASK;
+        IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMS, mask);
+        IXGBE_WRITE_FLUSH(&adapter->hw);
+}
 
 /**
  * ixgbe_intr - legacy mode Interrupt Handler
@@ -1394,35 +1421,6 @@ static void ixgbe_free_irq(struct ixgbe_adapter *adapter)
 }
 
 /**
- * ixgbe_irq_disable - Mask off interrupt generation on the NIC
- * @adapter: board private structure
- **/
-static inline void ixgbe_irq_disable(struct ixgbe_adapter *adapter)
-{
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMC, ~0);
-        IXGBE_WRITE_FLUSH(&adapter->hw);
-        if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
-                int i;
-                for (i = 0; i < adapter->num_msix_vectors; i++)
-                        synchronize_irq(adapter->msix_entries[i].vector);
-        } else {
-                synchronize_irq(adapter->pdev->irq);
-        }
-}
-
-/**
- * ixgbe_irq_enable - Enable default interrupt generation settings
- * @adapter: board private structure
- **/
-static inline void ixgbe_irq_enable(struct ixgbe_adapter *adapter)
-{
-        u32 mask;
-        mask = IXGBE_EIMS_ENABLE_MASK;
-        IXGBE_WRITE_REG(&adapter->hw, IXGBE_EIMS, mask);
-        IXGBE_WRITE_FLUSH(&adapter->hw);
-}
-
-/**
  * ixgbe_configure_msi_and_legacy - Initialize PIN (INTA...) and MSI interrupts
  *
  **/
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index 81c6cdc3851f..665e70d620fc 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -912,23 +912,23 @@ jme_alloc_and_feed_skb(struct jme_adapter *jme, int idx)
                 skb_put(skb, framesize);
                 skb->protocol = eth_type_trans(skb, jme->dev);
 
-                if (jme_rxsum_ok(jme, rxdesc->descwb.flags))
+                if (jme_rxsum_ok(jme, le16_to_cpu(rxdesc->descwb.flags)))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                 else
                         skb->ip_summed = CHECKSUM_NONE;
 
-                if (rxdesc->descwb.flags & RXWBFLAG_TAGON) {
+                if (rxdesc->descwb.flags & cpu_to_le16(RXWBFLAG_TAGON)) {
                         if (jme->vlgrp) {
                                 jme->jme_vlan_rx(skb, jme->vlgrp,
-                                        le32_to_cpu(rxdesc->descwb.vlan));
+                                        le16_to_cpu(rxdesc->descwb.vlan));
                                 NET_STAT(jme).rx_bytes += 4;
                         }
                 } else {
                         jme->jme_rx(skb);
                 }
 
-                if ((le16_to_cpu(rxdesc->descwb.flags) & RXWBFLAG_DEST) ==
-                                RXWBFLAG_DEST_MUL)
+                if ((rxdesc->descwb.flags & cpu_to_le16(RXWBFLAG_DEST)) ==
+                    cpu_to_le16(RXWBFLAG_DEST_MUL))
                         ++(NET_STAT(jme).multicast);
 
                 jme->dev->last_rx = jiffies;
@@ -961,7 +961,7 @@ jme_process_receive(struct jme_adapter *jme, int limit)
                 rxdesc = rxring->desc;
                 rxdesc += i;
 
-                if ((rxdesc->descwb.flags & RXWBFLAG_OWN) ||
+                if ((rxdesc->descwb.flags & cpu_to_le16(RXWBFLAG_OWN)) ||
                 !(rxdesc->descwb.desccnt & RXWBDCNT_WBCPL))
                         goto out;
 
@@ -1763,10 +1763,9 @@ jme_expand_header(struct jme_adapter *jme, struct sk_buff *skb)
 }
 
 static int
-jme_tx_tso(struct sk_buff *skb,
-                u16 *mss, u8 *flags)
+jme_tx_tso(struct sk_buff *skb, __le16 *mss, u8 *flags)
 {
-        *mss = skb_shinfo(skb)->gso_size << TXDESC_MSS_SHIFT;
+        *mss = cpu_to_le16(skb_shinfo(skb)->gso_size << TXDESC_MSS_SHIFT);
         if (*mss) {
                 *flags |= TXFLAG_LSEN;
 
@@ -1826,11 +1825,11 @@ jme_tx_csum(struct jme_adapter *jme, struct sk_buff *skb, u8 *flags)
 }
 
 static inline void
-jme_tx_vlan(struct sk_buff *skb, u16 *vlan, u8 *flags)
+jme_tx_vlan(struct sk_buff *skb, __le16 *vlan, u8 *flags)
 {
         if (vlan_tx_tag_present(skb)) {
                 *flags |= TXFLAG_TAGON;
-                *vlan = vlan_tx_tag_get(skb);
+                *vlan = cpu_to_le16(vlan_tx_tag_get(skb));
         }
 }
 
diff --git a/drivers/net/mlx4/en_netdev.c b/drivers/net/mlx4/en_netdev.c
index a3f732418c49..96e709d6440a 100644
--- a/drivers/net/mlx4/en_netdev.c
+++ b/drivers/net/mlx4/en_netdev.c
@@ -656,10 +656,10 @@ static int mlx4_en_start_port(struct net_device *dev)
         /* Configure port */
         err = mlx4_SET_PORT_general(mdev->dev, priv->port,
                                     priv->rx_skb_size + ETH_FCS_LEN,
-                                    mdev->profile.tx_pause,
-                                    mdev->profile.tx_ppp,
-                                    mdev->profile.rx_pause,
-                                    mdev->profile.rx_ppp);
+                                    priv->prof->tx_pause,
+                                    priv->prof->tx_ppp,
+                                    priv->prof->rx_pause,
+                                    priv->prof->rx_ppp);
         if (err) {
                 mlx4_err(mdev, "Failed setting port general configurations"
                                " for port %d, with error %d\n", priv->port, err);
diff --git a/drivers/net/mlx4/en_params.c b/drivers/net/mlx4/en_params.c
index c2e69b1bcd0a..95706ee1c019 100644
--- a/drivers/net/mlx4/en_params.c
+++ b/drivers/net/mlx4/en_params.c
@@ -90,6 +90,7 @@ MLX4_EN_PARM_INT(rx_ring_size2, MLX4_EN_AUTO_CONF, "Rx ring size for port 2");
 int mlx4_en_get_profile(struct mlx4_en_dev *mdev)
 {
         struct mlx4_en_profile *params = &mdev->profile;
+        int i;
 
         params->rx_moder_cnt = min_t(int, rx_moder_cnt, MLX4_EN_AUTO_CONF);
         params->rx_moder_time = min_t(int, rx_moder_time, MLX4_EN_AUTO_CONF);
@@ -97,11 +98,13 @@ int mlx4_en_get_profile(struct mlx4_en_dev *mdev)
         params->rss_xor = (rss_xor != 0);
         params->rss_mask = rss_mask & 0x1f;
         params->num_lro = min_t(int, num_lro , MLX4_EN_MAX_LRO_DESCRIPTORS);
-        params->rx_pause = pprx;
-        params->rx_ppp = pfcrx;
-        params->tx_pause = pptx;
-        params->tx_ppp = pfctx;
-        if (params->rx_ppp || params->tx_ppp) {
+        for (i = 1; i <= MLX4_MAX_PORTS; i++) {
+                params->prof[i].rx_pause = pprx;
+                params->prof[i].rx_ppp = pfcrx;
+                params->prof[i].tx_pause = pptx;
+                params->prof[i].tx_ppp = pfctx;
+        }
+        if (pfcrx || pfctx) {
                 params->prof[1].tx_ring_num = MLX4_EN_TX_RING_NUM;
                 params->prof[2].tx_ring_num = MLX4_EN_TX_RING_NUM;
         } else {
@@ -407,14 +410,14 @@ static int mlx4_en_set_pauseparam(struct net_device *dev,
         struct mlx4_en_dev *mdev = priv->mdev;
         int err;
 
-        mdev->profile.tx_pause = pause->tx_pause != 0;
-        mdev->profile.rx_pause = pause->rx_pause != 0;
+        priv->prof->tx_pause = pause->tx_pause != 0;
+        priv->prof->rx_pause = pause->rx_pause != 0;
         err = mlx4_SET_PORT_general(mdev->dev, priv->port,
                                     priv->rx_skb_size + ETH_FCS_LEN,
-                                    mdev->profile.tx_pause,
-                                    mdev->profile.tx_ppp,
-                                    mdev->profile.rx_pause,
-                                    mdev->profile.rx_ppp);
+                                    priv->prof->tx_pause,
+                                    priv->prof->tx_ppp,
+                                    priv->prof->rx_pause,
+                                    priv->prof->rx_ppp);
         if (err)
                 mlx4_err(mdev, "Failed setting pause params to\n");
 
@@ -425,10 +428,9 @@ static void mlx4_en_get_pauseparam(struct net_device *dev,
                                  struct ethtool_pauseparam *pause)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
-        struct mlx4_en_dev *mdev = priv->mdev;
 
-        pause->tx_pause = mdev->profile.tx_pause;
-        pause->rx_pause = mdev->profile.rx_pause;
+        pause->tx_pause = priv->prof->tx_pause;
+        pause->rx_pause = priv->prof->rx_pause;
 }
 
 static void mlx4_en_get_ringparam(struct net_device *dev,
diff --git a/drivers/net/mlx4/mlx4_en.h b/drivers/net/mlx4/mlx4_en.h
index 11fb17c6e97b..98ddc0811f93 100644
--- a/drivers/net/mlx4/mlx4_en.h
+++ b/drivers/net/mlx4/mlx4_en.h
@@ -322,6 +322,10 @@ struct mlx4_en_port_profile {
         u32 rx_ring_num;
         u32 tx_ring_size;
         u32 rx_ring_size;
+        u8 rx_pause;
+        u8 rx_ppp;
+        u8 tx_pause;
+        u8 tx_ppp;
 };
 
 struct mlx4_en_profile {
@@ -333,10 +337,6 @@ struct mlx4_en_profile {
         int rx_moder_cnt;
         int rx_moder_time;
         int auto_moder;
-        u8 rx_pause;
-        u8 rx_ppp;
-        u8 tx_pause;
-        u8 tx_ppp;
         u8 no_reset;
         struct mlx4_en_port_profile prof[MLX4_MAX_PORTS + 1];
 };
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index b9dcdbd369f8..e513f76f2a9f 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -899,7 +899,8 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 if (skb != NULL) {
                         if (skb_queue_len(&mp->rx_recycle) <
                                         mp->default_rx_ring_size &&
-                            skb_recycle_check(skb, mp->skb_size))
+                            skb_recycle_check(skb, mp->skb_size +
+                                        dma_get_cache_alignment() - 1))
                                 __skb_queue_head(&mp->rx_recycle, skb);
                         else
                                 dev_kfree_skb(skb);
@@ -2435,8 +2436,8 @@ static int mv643xx_eth_shared_remove(struct platform_device *pdev)
         struct mv643xx_eth_shared_platform_data *pd = pdev->dev.platform_data;
 
         if (pd == NULL || pd->shared_smi == NULL) {
-                mdiobus_free(msp->smi_bus);
                 mdiobus_unregister(msp->smi_bus);
+                mdiobus_free(msp->smi_bus);
         }
         if (msp->err_interrupt != NO_IRQ)
                 free_irq(msp->err_interrupt, msp);
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index d8463b1c3df3..1b6f548c4411 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -33,8 +33,8 @@
 
 #define DRV_MODULE_NAME         "niu"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "0.9"
-#define DRV_MODULE_RELDATE      "May 4, 2008"
+#define DRV_MODULE_VERSION      "1.0"
+#define DRV_MODULE_RELDATE      "Nov 14, 2008"
 
 static char version[] __devinitdata =
         DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
@@ -406,7 +406,7 @@ static int esr2_set_rx_cfg(struct niu *np, unsigned long channel, u32 val)
 }
 
 /* Mode is always 10G fiber.  */
-static int serdes_init_niu(struct niu *np)
+static int serdes_init_niu_10g_fiber(struct niu *np)
 {
         struct niu_link_config *lp = &np->link_config;
         u32 tx_cfg, rx_cfg;
@@ -443,6 +443,223 @@ static int serdes_init_niu(struct niu *np)
         return 0;
 }
 
+static int serdes_init_niu_1g_serdes(struct niu *np)
+{
+        struct niu_link_config *lp = &np->link_config;
+        u16 pll_cfg, pll_sts;
+        int max_retry = 100;
+        u64 sig, mask, val;
+        u32 tx_cfg, rx_cfg;
+        unsigned long i;
+        int err;
+
+        tx_cfg = (PLL_TX_CFG_ENTX | PLL_TX_CFG_SWING_1375MV |
+                  PLL_TX_CFG_RATE_HALF);
+        rx_cfg = (PLL_RX_CFG_ENRX | PLL_RX_CFG_TERM_0P8VDDT |
+                  PLL_RX_CFG_ALIGN_ENA | PLL_RX_CFG_LOS_LTHRESH |
+                  PLL_RX_CFG_RATE_HALF);
+
+        if (np->port == 0)
+                rx_cfg |= PLL_RX_CFG_EQ_LP_ADAPTIVE;
+
+        if (lp->loopback_mode == LOOPBACK_PHY) {
+                u16 test_cfg = PLL_TEST_CFG_LOOPBACK_CML_DIS;
+
+                mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                           ESR2_TI_PLL_TEST_CFG_L, test_cfg);
+
+                tx_cfg |= PLL_TX_CFG_ENTEST;
+                rx_cfg |= PLL_RX_CFG_ENTEST;
+        }
+
+        /* Initialize PLL for 1G */
+        pll_cfg = (PLL_CFG_ENPLL | PLL_CFG_MPY_8X);
+
+        err = mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                         ESR2_TI_PLL_CFG_L, pll_cfg);
+        if (err) {
+                dev_err(np->device, PFX "NIU Port %d "
+                        "serdes_init_niu_1g_serdes: "
+                        "mdio write to ESR2_TI_PLL_CFG_L failed", np->port);
+                return err;
+        }
+
+        pll_sts = PLL_CFG_ENPLL;
+
+        err = mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                         ESR2_TI_PLL_STS_L, pll_sts);
+        if (err) {
+                dev_err(np->device, PFX "NIU Port %d "
+                        "serdes_init_niu_1g_serdes: "
+                        "mdio write to ESR2_TI_PLL_STS_L failed", np->port);
+                return err;
+        }
+
+        udelay(200);
+
+        /* Initialize all 4 lanes of the SERDES.  */
+        for (i = 0; i < 4; i++) {
+                err = esr2_set_tx_cfg(np, i, tx_cfg);
+                if (err)
+                        return err;
+        }
+
+        for (i = 0; i < 4; i++) {
+                err = esr2_set_rx_cfg(np, i, rx_cfg);
+                if (err)
+                        return err;
+        }
+
+        switch (np->port) {
+        case 0:
+                val = (ESR_INT_SRDY0_P0 | ESR_INT_DET0_P0);
+                mask = val;
+                break;
+
+        case 1:
+                val = (ESR_INT_SRDY0_P1 | ESR_INT_DET0_P1);
+                mask = val;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        while (max_retry--) {
+                sig = nr64(ESR_INT_SIGNALS);
+                if ((sig & mask) == val)
+                        break;
+
+                mdelay(500);
+        }
+
+        if ((sig & mask) != val) {
+                dev_err(np->device, PFX "Port %u signal bits [%08x] are not "
+                        "[%08x]\n", np->port, (int) (sig & mask), (int) val);
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+static int serdes_init_niu_10g_serdes(struct niu *np)
+{
+        struct niu_link_config *lp = &np->link_config;
+        u32 tx_cfg, rx_cfg, pll_cfg, pll_sts;
+        int max_retry = 100;
+        u64 sig, mask, val;
+        unsigned long i;
+        int err;
+
+        tx_cfg = (PLL_TX_CFG_ENTX | PLL_TX_CFG_SWING_1375MV);
+        rx_cfg = (PLL_RX_CFG_ENRX | PLL_RX_CFG_TERM_0P8VDDT |
+                  PLL_RX_CFG_ALIGN_ENA | PLL_RX_CFG_LOS_LTHRESH |
+                  PLL_RX_CFG_EQ_LP_ADAPTIVE);
+
+        if (lp->loopback_mode == LOOPBACK_PHY) {
+                u16 test_cfg = PLL_TEST_CFG_LOOPBACK_CML_DIS;
+
+                mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                           ESR2_TI_PLL_TEST_CFG_L, test_cfg);
+
+                tx_cfg |= PLL_TX_CFG_ENTEST;
+                rx_cfg |= PLL_RX_CFG_ENTEST;
+        }
+
+        /* Initialize PLL for 10G */
+        pll_cfg = (PLL_CFG_ENPLL | PLL_CFG_MPY_10X);
+
+        err = mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                         ESR2_TI_PLL_CFG_L, pll_cfg & 0xffff);
+        if (err) {
+                dev_err(np->device, PFX "NIU Port %d "
+                        "serdes_init_niu_10g_serdes: "
+                        "mdio write to ESR2_TI_PLL_CFG_L failed", np->port);
+                return err;
+        }
+
+        pll_sts = PLL_CFG_ENPLL;
+
+        err = mdio_write(np, np->port, NIU_ESR2_DEV_ADDR,
+                         ESR2_TI_PLL_STS_L, pll_sts & 0xffff);
+        if (err) {
+                dev_err(np->device, PFX "NIU Port %d "
+                        "serdes_init_niu_10g_serdes: "
+                        "mdio write to ESR2_TI_PLL_STS_L failed", np->port);
+                return err;
+        }
+
+        udelay(200);
+
+        /* Initialize all 4 lanes of the SERDES.  */
+        for (i = 0; i < 4; i++) {
+                err = esr2_set_tx_cfg(np, i, tx_cfg);
+                if (err)
+                        return err;
+        }
+
+        for (i = 0; i < 4; i++) {
+                err = esr2_set_rx_cfg(np, i, rx_cfg);
+                if (err)
+                        return err;
+        }
+
+        /* check if serdes is ready */
+
+        switch (np->port) {
+        case 0:
+                mask = ESR_INT_SIGNALS_P0_BITS;
+                val = (ESR_INT_SRDY0_P0 |
+                       ESR_INT_DET0_P0 |
+                       ESR_INT_XSRDY_P0 |
+                       ESR_INT_XDP_P0_CH3 |
+                       ESR_INT_XDP_P0_CH2 |
+                       ESR_INT_XDP_P0_CH1 |
+                       ESR_INT_XDP_P0_CH0);
+                break;
+
+        case 1:
+                mask = ESR_INT_SIGNALS_P1_BITS;
+                val = (ESR_INT_SRDY0_P1 |
+                       ESR_INT_DET0_P1 |
+                       ESR_INT_XSRDY_P1 |
+                       ESR_INT_XDP_P1_CH3 |
+                       ESR_INT_XDP_P1_CH2 |
+                       ESR_INT_XDP_P1_CH1 |
+                       ESR_INT_XDP_P1_CH0);
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        while (max_retry--) {
+                sig = nr64(ESR_INT_SIGNALS);
+                if ((sig & mask) == val)
+                        break;
+
+                mdelay(500);
+        }
+
+        if ((sig & mask) != val) {
+                pr_info(PFX "NIU Port %u signal bits [%08x] are not "
+                        "[%08x] for 10G...trying 1G\n",
+                        np->port, (int) (sig & mask), (int) val);
+
+                /* 10G failed, try initializing at 1G */
+                err = serdes_init_niu_1g_serdes(np);
+                if (!err) {
+                        np->flags &= ~NIU_FLAGS_10G;
+                        np->mac_xcvr = MAC_XCVR_PCS;
+                }  else {
+                        dev_err(np->device, PFX "Port %u 10G/1G SERDES "
+                                "Link Failed \n", np->port);
+                        return -ENODEV;
+                }
+        }
+        return 0;
+}
+
 static int esr_read_rxtx_ctrl(struct niu *np, unsigned long chan, u32 *val)
 {
         int err;
@@ -1954,13 +2171,23 @@ static const struct niu_phy_ops phy_ops_10g_serdes = {
         .link_status            = link_status_10g_serdes,
 };
 
+static const struct niu_phy_ops phy_ops_10g_serdes_niu = {
+        .serdes_init            = serdes_init_niu_10g_serdes,
+        .link_status            = link_status_10g_serdes,
+};
+
+static const struct niu_phy_ops phy_ops_1g_serdes_niu = {
+        .serdes_init            = serdes_init_niu_1g_serdes,
+        .link_status            = link_status_1g_serdes,
+};
+
 static const struct niu_phy_ops phy_ops_1g_rgmii = {
         .xcvr_init              = xcvr_init_1g_rgmii,
         .link_status            = link_status_1g_rgmii,
 };
 
 static const struct niu_phy_ops phy_ops_10g_fiber_niu = {
-        .serdes_init            = serdes_init_niu,
+        .serdes_init            = serdes_init_niu_10g_fiber,
         .xcvr_init              = xcvr_init_10g,
         .link_status            = link_status_10g,
 };
@@ -1998,11 +2225,21 @@ struct niu_phy_template {
         u32                             phy_addr_base;
 };
 
-static const struct niu_phy_template phy_template_niu = {
+static const struct niu_phy_template phy_template_niu_10g_fiber = {
         .ops            = &phy_ops_10g_fiber_niu,
         .phy_addr_base  = 16,
 };
 
+static const struct niu_phy_template phy_template_niu_10g_serdes = {
+        .ops            = &phy_ops_10g_serdes_niu,
+        .phy_addr_base  = 0,
+};
+
+static const struct niu_phy_template phy_template_niu_1g_serdes = {
+        .ops            = &phy_ops_1g_serdes_niu,
+        .phy_addr_base  = 0,
+};
+
 static const struct niu_phy_template phy_template_10g_fiber = {
         .ops            = &phy_ops_10g_fiber,
         .phy_addr_base  = 8,
@@ -2182,8 +2419,25 @@ static int niu_determine_phy_disposition(struct niu *np)
         u32 phy_addr_off = 0;
 
         if (plat_type == PLAT_TYPE_NIU) {
-                tp = &phy_template_niu;
-                phy_addr_off += np->port;
+                switch (np->flags &
+                        (NIU_FLAGS_10G |
+                         NIU_FLAGS_FIBER |
+                         NIU_FLAGS_XCVR_SERDES)) {
+                case NIU_FLAGS_10G | NIU_FLAGS_XCVR_SERDES:
+                        /* 10G Serdes */
+                        tp = &phy_template_niu_10g_serdes;
+                        break;
+                case NIU_FLAGS_XCVR_SERDES:
+                        /* 1G Serdes */
+                        tp = &phy_template_niu_1g_serdes;
+                        break;
+                case NIU_FLAGS_10G | NIU_FLAGS_FIBER:
+                        /* 10G Fiber */
+                default:
+                        tp = &phy_template_niu_10g_fiber;
+                        phy_addr_off += np->port;
+                        break;
+                }
         } else {
                 switch (np->flags &
                         (NIU_FLAGS_10G |
@@ -7213,6 +7467,12 @@ static int __devinit niu_phy_type_prop_decode(struct niu *np,
                 np->flags |= NIU_FLAGS_10G;
                 np->flags &= ~NIU_FLAGS_FIBER;
                 np->mac_xcvr = MAC_XCVR_XPCS;
+        } else if (!strcmp(phy_prop, "xgsd") || !strcmp(phy_prop, "gsd")) {
+                /* 10G Serdes or 1G Serdes, default to 10G */
+                np->flags |= NIU_FLAGS_10G;
+                np->flags &= ~NIU_FLAGS_FIBER;
+                np->flags |= NIU_FLAGS_XCVR_SERDES;
+                np->mac_xcvr = MAC_XCVR_XPCS;
         } else {
                 return -EINVAL;
         }
@@ -7741,6 +8001,8 @@ static int __devinit walk_phys(struct niu *np, struct niu_parent *parent)
         u32 val;
         int err;
 
+        num_10g = num_1g = 0;
+
         if (!strcmp(np->vpd.model, NIU_ALONSO_MDL_STR) ||
             !strcmp(np->vpd.model, NIU_KIMI_MDL_STR)) {
                 num_10g = 0;
@@ -7757,6 +8019,16 @@ static int __devinit walk_phys(struct niu *np, struct niu_parent *parent)
                 parent->num_ports = 2;
                 val = (phy_encode(PORT_TYPE_10G, 0) |
                        phy_encode(PORT_TYPE_10G, 1));
+        } else if ((np->flags & NIU_FLAGS_XCVR_SERDES) &&
+                   (parent->plat_type == PLAT_TYPE_NIU)) {
+                /* this is the Monza case */
+                if (np->flags & NIU_FLAGS_10G) {
+                        val = (phy_encode(PORT_TYPE_10G, 0) |
+                               phy_encode(PORT_TYPE_10G, 1));
+                } else {
+                        val = (phy_encode(PORT_TYPE_1G, 0) |
+                               phy_encode(PORT_TYPE_1G, 1));
+                }
         } else {
                 err = fill_phy_probe_info(np, parent, info);
                 if (err)
@@ -8656,7 +8928,9 @@ static void __devinit niu_device_announce(struct niu *np)
                                 dev->name,
                                 (np->flags & NIU_FLAGS_XMAC ? "XMAC" : "BMAC"),
                                 (np->flags & NIU_FLAGS_10G ? "10G" : "1G"),
-                                (np->flags & NIU_FLAGS_FIBER ? "FIBER" : "COPPER"),
+                                (np->flags & NIU_FLAGS_FIBER ? "FIBER" :
+                                 (np->flags & NIU_FLAGS_XCVR_SERDES ? "SERDES" :
+                                  "COPPER")),
                                 (np->mac_xcvr == MAC_XCVR_MII ? "MII" :
                                  (np->mac_xcvr == MAC_XCVR_PCS ? "PCS" : "XPCS")),
                                 np->vpd.phy_type);
diff --git a/drivers/net/niu.h b/drivers/net/niu.h
index c6fa883daa22..180ca8ae93de 100644
--- a/drivers/net/niu.h
+++ b/drivers/net/niu.h
@@ -1048,6 +1048,13 @@
 #define  PLL_CFG_LD_SHIFT               8
 #define  PLL_CFG_MPY                    0x0000001e
 #define  PLL_CFG_MPY_SHIFT              1
+#define  PLL_CFG_MPY_4X         0x0
+#define  PLL_CFG_MPY_5X         0x00000002
+#define  PLL_CFG_MPY_6X         0x00000004
+#define  PLL_CFG_MPY_8X         0x00000008
+#define  PLL_CFG_MPY_10X                0x0000000a
+#define  PLL_CFG_MPY_12X                0x0000000c
+#define  PLL_CFG_MPY_12P5X              0x0000000e
 #define  PLL_CFG_ENPLL                  0x00000001
 
 #define ESR2_TI_PLL_STS_L               (ESR2_BASE + 0x002)
@@ -1093,6 +1100,9 @@
 #define  PLL_TX_CFG_INVPAIR             0x00000080
 #define  PLL_TX_CFG_RATE                0x00000060
 #define  PLL_TX_CFG_RATE_SHIFT          5
+#define  PLL_TX_CFG_RATE_FULL           0x0
+#define  PLL_TX_CFG_RATE_HALF           0x20
+#define  PLL_TX_CFG_RATE_QUAD           0x40
 #define  PLL_TX_CFG_BUSWIDTH            0x0000001c
 #define  PLL_TX_CFG_BUSWIDTH_SHIFT      2
 #define  PLL_TX_CFG_ENTEST              0x00000002
@@ -1132,6 +1142,9 @@
 #define  PLL_RX_CFG_INVPAIR             0x00000080
 #define  PLL_RX_CFG_RATE                0x00000060
 #define  PLL_RX_CFG_RATE_SHIFT          5
+#define  PLL_RX_CFG_RATE_FULL           0x0
+#define  PLL_RX_CFG_RATE_HALF           0x20
+#define  PLL_RX_CFG_RATE_QUAD           0x40
 #define  PLL_RX_CFG_BUSWIDTH            0x0000001c
 #define  PLL_RX_CFG_BUSWIDTH_SHIFT      2
 #define  PLL_RX_CFG_ENTEST              0x00000002
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 4aa547947040..eb6411c4694f 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -227,6 +227,59 @@ static int m88e1111_config_init(struct phy_device *phydev)
         return 0;
 }
 
+static int m88e1118_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, MII_M1011_PHY_SCR,
+                        MII_M1011_PHY_SCR_AUTO_CROSS);
+        if (err < 0)
+                return err;
+
+        err = genphy_config_aneg(phydev);
+        return 0;
+}
+
+static int m88e1118_config_init(struct phy_device *phydev)
+{
+        int err;
+
+        /* Change address */
+        err = phy_write(phydev, 0x16, 0x0002);
+        if (err < 0)
+                return err;
+
+        /* Enable 1000 Mbit */
+        err = phy_write(phydev, 0x15, 0x1070);
+        if (err < 0)
+                return err;
+
+        /* Change address */
+        err = phy_write(phydev, 0x16, 0x0003);
+        if (err < 0)
+                return err;
+
+        /* Adjust LED Control */
+        err = phy_write(phydev, 0x10, 0x021e);
+        if (err < 0)
+                return err;
+
+        /* Reset address */
+        err = phy_write(phydev, 0x16, 0x0);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
 static int m88e1145_config_init(struct phy_device *phydev)
 {
         int err;
@@ -416,6 +469,19 @@ static struct phy_driver marvell_drivers[] = {
                 .driver = { .owner = THIS_MODULE },
         },
         {
+                .phy_id = 0x01410e10,
+                .phy_id_mask = 0xfffffff0,
+                .name = "Marvell 88E1118",
+                .features = PHY_GBIT_FEATURES,
+                .flags = PHY_HAS_INTERRUPT,
+                .config_init = &m88e1118_config_init,
+                .config_aneg = &m88e1118_config_aneg,
+                .read_status = &genphy_read_status,
+                .ack_interrupt = &marvell_ack_interrupt,
+                .config_intr = &marvell_config_intr,
+                .driver = {.owner = THIS_MODULE,},
+        },
+        {
                 .phy_id = 0x01410cd0,
                 .phy_id_mask = 0xfffffff0,
                 .name = "Marvell 88E1145",
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index d0ed1ef284a8..536bda1f428b 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -136,7 +136,7 @@ void mdiobus_unregister(struct mii_bus *bus)
         BUG_ON(bus->state != MDIOBUS_REGISTERED);
         bus->state = MDIOBUS_UNREGISTERED;
 
-        device_unregister(&bus->dev);
+        device_del(&bus->dev);
         for (i = 0; i < PHY_MAX_ADDR; i++) {
                 if (bus->phy_map[i])
                         device_unregister(&bus->phy_map[i]->dev);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index e11b03b2b25a..55bc24b234e3 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -227,8 +227,8 @@ struct phy_device * get_phy_device(struct mii_bus *bus, int addr)
         if (r)
                 return ERR_PTR(r);
 
-        /* If the phy_id is all Fs, there is no device there */
-        if (0xffffffff == phy_id)
+        /* If the phy_id is all Fs or all 0s, there is no device there */
+        if ((0xffff == phy_id) || (0x00 == phy_id))
                 return NULL;
 
         dev = phy_device_create(bus, addr, phy_id);
@@ -564,20 +564,32 @@ EXPORT_SYMBOL(genphy_restart_aneg);
  */
 int genphy_config_aneg(struct phy_device *phydev)
 {
-        int result = 0;
+        int result;
 
-        if (AUTONEG_ENABLE == phydev->autoneg) {
-                int result = genphy_config_advert(phydev);
+        if (AUTONEG_ENABLE != phydev->autoneg)
+                return genphy_setup_forced(phydev);
+
+        result = genphy_config_advert(phydev);
+
+        if (result < 0) /* error */
+                return result;
 
-                if (result < 0) /* error */
-                        return result;
+        if (result == 0) {
+                /* Advertisment hasn't changed, but maybe aneg was never on to
+                 * begin with?  Or maybe phy was isolated? */
+                int ctl = phy_read(phydev, MII_BMCR);
+
+                if (ctl < 0)
+                        return ctl;
+
+                if (!(ctl & BMCR_ANENABLE) || (ctl & BMCR_ISOLATE))
+                        result = 1; /* do restart aneg */
+        }
 
-                /* Only restart aneg if we are advertising something different
-                 * than we were before.  */
-                if (result > 0)
-                        result = genphy_restart_aneg(phydev);
-        } else
-                result = genphy_setup_forced(phydev);
+        /* Only restart aneg if we are advertising something different
+         * than we were before.  */
+        if (result > 0)
+                result = genphy_restart_aneg(phydev);
 
         return result;
 }
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index 3cdd07c45b6d..508452c02151 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -1515,9 +1515,6 @@ static u32 ql_get_link_state(struct ql3_adapter *qdev)
                 linkState = LS_UP;
         } else {
                 linkState = LS_DOWN;
-                if (netif_msg_link(qdev))
-                        printk(KERN_WARNING PFX
-                               "%s: Link is down.\n", qdev->ndev->name);
         }
         return linkState;
 }
@@ -1581,10 +1578,6 @@ static int ql_finish_auto_neg(struct ql3_adapter *qdev)
                         ql_mac_enable(qdev, 1);
                 }
 
-                if (netif_msg_link(qdev))
-                        printk(KERN_DEBUG PFX
-                               "%s: Change port_link_state LS_DOWN to LS_UP.\n",
-                               qdev->ndev->name);
                 qdev->port_link_state = LS_UP;
                 netif_start_queue(qdev->ndev);
                 netif_carrier_on(qdev->ndev);
@@ -1655,14 +1648,9 @@ static void ql_link_state_machine_work(struct work_struct *work)
                 /* Fall Through */
 
         case LS_DOWN:
-                if (netif_msg_link(qdev))
-                        printk(KERN_DEBUG PFX
-                               "%s: port_link_state = LS_DOWN.\n",
-                               qdev->ndev->name);
                 if (curr_link_state == LS_UP) {
                         if (netif_msg_link(qdev))
-                                printk(KERN_DEBUG PFX
-                                       "%s: curr_link_state = LS_UP.\n",
+                                printk(KERN_INFO PFX "%s: Link is up.\n",
                                        qdev->ndev->name);
                         if (ql_is_auto_neg_complete(qdev))
                                 ql_finish_auto_neg(qdev);
@@ -1670,6 +1658,7 @@ static void ql_link_state_machine_work(struct work_struct *work)
                         if (qdev->port_link_state == LS_UP)
                                 ql_link_down_detect_clear(qdev);
 
+                        qdev->port_link_state = LS_UP;
                 }
                 break;
 
@@ -1678,12 +1667,14 @@ static void ql_link_state_machine_work(struct work_struct *work)
                  * See if the link is currently down or went down and came
                  * back up
                  */
-                if ((curr_link_state == LS_DOWN) || ql_link_down_detect(qdev)) {
+                if (curr_link_state == LS_DOWN) {
                         if (netif_msg_link(qdev))
                                 printk(KERN_INFO PFX "%s: Link is down.\n",
                                        qdev->ndev->name);
                         qdev->port_link_state = LS_DOWN;
                 }
+                if (ql_link_down_detect(qdev))
+                        qdev->port_link_state = LS_DOWN;
                 break;
         }
         spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index a24bb68887ab..59f242a67714 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -927,7 +927,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct sh_eth_private *mdp = netdev_priv(ndev);
         struct sh_eth_txdesc *txdesc;
         u32 entry;
-        int flags;
+        unsigned long flags;
 
         spin_lock_irqsave(&mdp->lock, flags);
         if ((mdp->cur_tx - mdp->dirty_tx) >= (TX_RING_SIZE - 4)) {
@@ -1141,7 +1141,7 @@ static int sh_mdio_init(struct net_device *ndev, int id)
         /* Hook up MII support for ethtool */
         mdp->mii_bus->name = "sh_mii";
         mdp->mii_bus->parent = &ndev->dev;
-        mdp->mii_bus->id[0] = id;
+        snprintf(mdp->mii_bus->id, MII_BUS_ID_SIZE, "%x", id);
 
         /* PHY IRQ */
         mdp->mii_bus->irq = kmalloc(sizeof(int)*PHY_MAX_ADDR, GFP_KERNEL);
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index 1f26ab0e7986..b185cd12269c 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -1813,7 +1813,7 @@ static int __init smc911x_probe(struct net_device *dev)
         val = SMC_GET_BYTE_TEST(lp);
         DBG(SMC_DEBUG_MISC, "%s: endian probe returned 0x%04x\n", CARDNAME, val);
         if (val != 0x87654321) {
-                printk(KERN_ERR "Invalid chip endian 0x08%x\n",val);
+                printk(KERN_ERR "Invalid chip endian 0x%08x\n",val);
                 retval = -ENODEV;
                 goto err_out;
         }
diff --git a/drivers/net/ucc_geth_ethtool.c b/drivers/net/ucc_geth_ethtool.c
index 85f38a6b6a49..68a7f5414133 100644
--- a/drivers/net/ucc_geth_ethtool.c
+++ b/drivers/net/ucc_geth_ethtool.c
@@ -323,17 +323,17 @@ static void uec_get_ethtool_stats(struct net_device *netdev,
         if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_HARDWARE) {
                 base = (u32 __iomem *)&ugeth->ug_regs->tx64;
                 for (i = 0; i < UEC_HW_STATS_LEN; i++)
-                        data[j++] = (u64)in_be32(&base[i]);
+                        data[j++] = in_be32(&base[i]);
         }
         if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_TX) {
                 base = (u32 __iomem *)ugeth->p_tx_fw_statistics_pram;
                 for (i = 0; i < UEC_TX_FW_STATS_LEN; i++)
-                        data[j++] = (u64)in_be32(&base[i]);
+                        data[j++] = base ? in_be32(&base[i]) : 0;
         }
         if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX) {
                 base = (u32 __iomem *)ugeth->p_rx_fw_statistics_pram;
                 for (i = 0; i < UEC_RX_FW_STATS_LEN; i++)
-                        data[j++] = (u64)in_be32(&base[i]);
+                        data[j++] = base ? in_be32(&base[i]) : 0;
         }
 }
 
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 37ecf845edfe..de57490103fc 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1102,12 +1102,14 @@ static int ax88178_link_reset(struct usbnet *dev)
         mode = AX88178_MEDIUM_DEFAULT;
 
         if (ecmd.speed == SPEED_1000)
-                mode |= AX_MEDIUM_GM | AX_MEDIUM_ENCK;
+                mode |= AX_MEDIUM_GM;
         else if (ecmd.speed == SPEED_100)
                 mode |= AX_MEDIUM_PS;
         else
                 mode &= ~(AX_MEDIUM_PS | AX_MEDIUM_GM);
 
+        mode |= AX_MEDIUM_ENCK;
+
         if (ecmd.duplex == DUPLEX_FULL)
                 mode |= AX_MEDIUM_FD;
         else
@@ -1444,6 +1446,10 @@ static const struct usb_device_id	products [] = {
         // Apple USB Ethernet Adapter
         USB_DEVICE(0x05ac, 0x1402),
         .driver_info = (unsigned long) &ax88772_info,
+}, {
+        // Cables-to-Go USB Ethernet Adapter
+        USB_DEVICE(0x0b95, 0x772a),
+        .driver_info = (unsigned long) &ax88772_info,
 },
         { },            // END
 };
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 3590ea5a902d..11cb3e504e1c 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -2296,7 +2296,7 @@ static void velocity_set_multi(struct net_device *dev)
                 }
 
                 mac_set_cam_mask(regs, vptr->mCAMmask);
-                rx_mode = (RCR_AM | RCR_AB);
+                rx_mode = RCR_AM | RCR_AB | RCR_AP;
         }
         if (dev->mtu > 1500)
                 rx_mode |= RCR_AL;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8d690a0eb1a9..444c5cc05f03 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1384,7 +1384,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
 
                 rxq->queue[i] = NULL;
 
-                pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
+                pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->aligned_dma_addr,
                                             priv->hw_params.rx_buf_size,
                                             PCI_DMA_FROMDEVICE);
                 pkt = (struct iwl_rx_packet *)rxb->skb->data;
@@ -1436,8 +1436,8 @@ void iwl_rx_handle(struct iwl_priv *priv)
                         rxb->skb = NULL;
                 }
 
-                pci_unmap_single(priv->pci_dev, rxb->dma_addr,
-                                 priv->hw_params.rx_buf_size,
+                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
+                                 priv->hw_params.rx_buf_size + 256,
                                  PCI_DMA_FROMDEVICE);
                 spin_lock_irqsave(&rxq->lock, flags);
                 list_add_tail(&rxb->list, &priv->rxq.rx_used);
@@ -2341,7 +2341,6 @@ static void iwl_bg_alive_start(struct work_struct *data)
         mutex_lock(&priv->mutex);
         iwl_alive_start(priv);
         mutex_unlock(&priv->mutex);
-        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
 }
 
 static void iwl4965_bg_rf_kill(struct work_struct *work)
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index c018121085e9..9966d4e384ce 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -89,7 +89,8 @@ extern struct iwl_cfg iwl5100_abg_cfg;
 #define DEFAULT_LONG_RETRY_LIMIT  4U
 
 struct iwl_rx_mem_buffer {
-        dma_addr_t dma_addr;
+        dma_addr_t real_dma_addr;
+        dma_addr_t aligned_dma_addr;
         struct sk_buff *skb;
         struct list_head list;
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 7cde9d76ff5d..0509c16dbe75 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -204,7 +204,7 @@ int iwl_rx_queue_restock(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->dma_addr);
+                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->aligned_dma_addr);
                 rxq->queue[rxq->write] = rxb;
                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                 rxq->free_count--;
@@ -251,7 +251,7 @@ void iwl_rx_allocate(struct iwl_priv *priv)
                 rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
 
                 /* Alloc a new receive buffer */
-                rxb->skb = alloc_skb(priv->hw_params.rx_buf_size,
+                rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
                                 __GFP_NOWARN | GFP_ATOMIC);
                 if (!rxb->skb) {
                         if (net_ratelimit())
@@ -266,9 +266,17 @@ void iwl_rx_allocate(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Get physical address of RB/SKB */
-                rxb->dma_addr =
-                    pci_map_single(priv->pci_dev, rxb->skb->data,
-                           priv->hw_params.rx_buf_size, PCI_DMA_FROMDEVICE);
+                rxb->real_dma_addr = pci_map_single(
+                                        priv->pci_dev,
+                                        rxb->skb->data,
+                                        priv->hw_params.rx_buf_size + 256,
+                                        PCI_DMA_FROMDEVICE);
+                /* dma address must be no more than 36 bits */
+                BUG_ON(rxb->real_dma_addr & ~DMA_BIT_MASK(36));
+                /* and also 256 byte aligned! */
+                rxb->aligned_dma_addr = ALIGN(rxb->real_dma_addr, 256);
+                skb_reserve(rxb->skb, rxb->aligned_dma_addr - rxb->real_dma_addr);
+
                 list_add_tail(&rxb->list, &rxq->rx_free);
                 rxq->free_count++;
         }
@@ -300,8 +308,8 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
                 if (rxq->pool[i].skb != NULL) {
                         pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].dma_addr,
-                                         priv->hw_params.rx_buf_size,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size + 256,
                                          PCI_DMA_FROMDEVICE);
                         dev_kfree_skb(rxq->pool[i].skb);
                 }
@@ -354,8 +362,8 @@ void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                  * to an SKB, so we need to unmap and free potential storage */
                 if (rxq->pool[i].skb != NULL) {
                         pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].dma_addr,
-                                         priv->hw_params.rx_buf_size,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size + 256,
                                          PCI_DMA_FROMDEVICE);
                         priv->alloc_rxb_skb--;
                         dev_kfree_skb(rxq->pool[i].skb);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 285b53e7e261..45a6b0c35695 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -6012,7 +6012,6 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
         mutex_lock(&priv->mutex);
         iwl3945_alive_start(priv);
         mutex_unlock(&priv->mutex);
-        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
 }
 
 static void iwl3945_bg_rf_kill(struct work_struct *work)
diff --git a/drivers/net/wireless/libertas_tf/if_usb.c b/drivers/net/wireless/libertas_tf/if_usb.c
index 1cc03a8dd67a..59634c33b1f9 100644
--- a/drivers/net/wireless/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/libertas_tf/if_usb.c
@@ -331,7 +331,7 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
         /* Fill the receive configuration URB and initialise the Rx call back */
         usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
                           usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
-                          (void *) (skb->tail),
+                          skb_tail_pointer(skb),
                           MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn, cardp);
 
         cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
diff --git a/drivers/parport/Kconfig b/drivers/parport/Kconfig
index 209b4a464bcf..855f389eea40 100644
--- a/drivers/parport/Kconfig
+++ b/drivers/parport/Kconfig
@@ -36,7 +36,7 @@ if PARPORT
 config PARPORT_PC
         tristate "PC-style hardware"
         depends on (!SPARC64 || PCI) && !SPARC32 && !M32R && !FRV && \
-                (!M68K || ISA) && !MN10300 && !AVR32
+                (!M68K || ISA) && !MN10300 && !AVR32 && !BLACKFIN
         ---help---
           You should say Y here if you have a PC-style parallel port. All
           IBM PC compatible computers and some Alphas have PC-style
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index a2692724b68f..5c8baa43ac9c 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -1655,12 +1655,14 @@ int __init init_dmars(void)
                         iommu->flush.flush_context = __iommu_flush_context;
                         iommu->flush.flush_iotlb = __iommu_flush_iotlb;
                         printk(KERN_INFO "IOMMU 0x%Lx: using Register based "
-                               "invalidation\n", drhd->reg_base_addr);
+                               "invalidation\n",
+                               (unsigned long long)drhd->reg_base_addr);
                 } else {
                         iommu->flush.flush_context = qi_flush_context;
                         iommu->flush.flush_iotlb = qi_flush_iotlb;
                         printk(KERN_INFO "IOMMU 0x%Lx: using Queued "
-                               "invalidation\n", drhd->reg_base_addr);
+                               "invalidation\n",
+                               (unsigned long long)drhd->reg_base_addr);
                 }
         }
 
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index b3a63edb6901..ae5ec76dca77 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -63,7 +63,7 @@ static acpi_status acpi_run_osc(acpi_handle handle,
         union acpi_object in_params[4];
         struct acpi_buffer output = {ACPI_ALLOCATE_BUFFER, NULL};
         union acpi_object *out_obj;
-        u32 osc_dw0, flags = osc_args->capbuf[OSC_QUERY_TYPE];
+        u32 errors, flags = osc_args->capbuf[OSC_QUERY_TYPE];
 
         /* Setting up input parameters */
         input.count = 4;
@@ -92,15 +92,16 @@ static acpi_status acpi_run_osc(acpi_handle handle,
                 status = AE_TYPE;
                 goto out_kfree;
         }
-        osc_dw0 = *((u32 *)out_obj->buffer.pointer);
-        if (osc_dw0) {
-                if (osc_dw0 & OSC_REQUEST_ERROR)
+        /* Need to ignore the bit0 in result code */
+        errors = *((u32 *)out_obj->buffer.pointer) & ~(1 << 0);
+        if (errors) {
+                if (errors & OSC_REQUEST_ERROR)
                         printk(KERN_DEBUG "_OSC request fails\n"); 
-                if (osc_dw0 & OSC_INVALID_UUID_ERROR)
+                if (errors & OSC_INVALID_UUID_ERROR)
                         printk(KERN_DEBUG "_OSC invalid UUID\n"); 
-                if (osc_dw0 & OSC_INVALID_REVISION_ERROR)
+                if (errors & OSC_INVALID_REVISION_ERROR)
                         printk(KERN_DEBUG "_OSC invalid revision\n"); 
-                if (osc_dw0 & OSC_CAPABILITIES_MASK_ERROR) {
+                if (errors & OSC_CAPABILITIES_MASK_ERROR) {
                         if (flags & OSC_QUERY_ENABLE)
                                 goto out_success;
                         printk(KERN_DEBUG "_OSC FW not grant req. control\n");
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 21f2ac639cab..28af496b441e 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1832,7 +1832,7 @@ int pci_reset_function(struct pci_dev *dev)
         if (!(cap & PCI_EXP_DEVCAP_FLR))
                 return -ENOTTY;
 
-        if (!dev->msi_enabled && !dev->msix_enabled)
+        if (!dev->msi_enabled && !dev->msix_enabled && dev->irq != 0)
                 disable_irq(dev->irq);
         pci_save_state(dev);
 
@@ -1841,7 +1841,7 @@ int pci_reset_function(struct pci_dev *dev)
         r = pci_execute_reset_function(dev);
 
         pci_restore_state(dev);
-        if (!dev->msi_enabled && !dev->msix_enabled)
+        if (!dev->msi_enabled && !dev->msix_enabled && dev->irq != 0)
                 enable_irq(dev->irq);
 
         return r;
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index dcce9f5d8465..4a110b7b2673 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -351,10 +351,11 @@ int verify_cis_cache(struct pcmcia_socket *s)
         char *buf;
 
         buf = kmalloc(256, GFP_KERNEL);
-        if (buf == NULL)
+        if (buf == NULL) {
                 dev_printk(KERN_WARNING, &s->dev,
                            "no memory for verifying CIS\n");
                 return -ENOMEM;
+        }
         list_for_each_entry(cis, &s->cis_cache, node) {
                 int len = cis->len;
 
diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
index c68c5d338285..0660ad182589 100644
--- a/drivers/pcmcia/cs.c
+++ b/drivers/pcmcia/cs.c
@@ -186,12 +186,6 @@ int pcmcia_register_socket(struct pcmcia_socket *socket)
 
         spin_lock_init(&socket->lock);
 
-        if (socket->resource_ops->init) {
-                ret = socket->resource_ops->init(socket);
-                if (ret)
-                        return (ret);
-        }
-
         /* try to obtain a socket number [yes, it gets ugly if we
          * register more than 2^sizeof(unsigned int) pcmcia
          * sockets... but the socket number is deprecated
@@ -226,7 +220,7 @@ int pcmcia_register_socket(struct pcmcia_socket *socket)
         /* set proper values in socket->dev */
         dev_set_drvdata(&socket->dev, socket);
         socket->dev.class = &pcmcia_socket_class;
-        snprintf(socket->dev.bus_id, BUS_ID_SIZE, "pcmcia_socket%u", socket->sock);
+        dev_set_name(&socket->dev, "pcmcia_socket%u", socket->sock);
 
         /* base address = 0, map = 0 */
         socket->cis_mem.flags = 0;
@@ -239,6 +233,12 @@ int pcmcia_register_socket(struct pcmcia_socket *socket)
         mutex_init(&socket->skt_mutex);
         spin_lock_init(&socket->thread_lock);
 
+        if (socket->resource_ops->init) {
+                ret = socket->resource_ops->init(socket);
+                if (ret)
+                        goto err;
+        }
+
         tsk = kthread_run(pccardd, socket, "pccardd");
         if (IS_ERR(tsk)) {
                 ret = PTR_ERR(tsk);
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 795660255490..47cab31ff6e4 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -622,7 +622,6 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
 {
         struct pcmcia_device *p_dev, *tmp_dev;
         unsigned long flags;
-        int bus_id_len;
 
         s = pcmcia_get_socket(s);
         if (!s)
@@ -650,12 +649,12 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
         /* by default don't allow DMA */
         p_dev->dma_mask = DMA_MASK_NONE;
         p_dev->dev.dma_mask = &p_dev->dma_mask;
-        bus_id_len = sprintf (p_dev->dev.bus_id, "%d.%d", p_dev->socket->sock, p_dev->device_no);
-
-        p_dev->devname = kmalloc(6 + bus_id_len + 1, GFP_KERNEL);
+        dev_set_name(&p_dev->dev, "%d.%d", p_dev->socket->sock, p_dev->device_no);
+        if (!dev_name(&p_dev->dev))
+                goto err_free;
+        p_dev->devname = kasprintf(GFP_KERNEL, "pcmcia%s", dev_name(&p_dev->dev));
         if (!p_dev->devname)
                 goto err_free;
-        sprintf (p_dev->devname, "pcmcia%s", p_dev->dev.bus_id);
         ds_dev_dbg(3, &p_dev->dev, "devname is %s\n", p_dev->devname);
 
         spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
@@ -668,6 +667,8 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
         list_for_each_entry(tmp_dev, &s->devices_list, socket_device_list)
                 if (p_dev->func == tmp_dev->func) {
                         p_dev->function_config = tmp_dev->function_config;
+                        p_dev->io = tmp_dev->io;
+                        p_dev->irq = tmp_dev->irq;
                         kref_get(&p_dev->function_config->ref);
                 }
 
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 76d4a98f0955..f5d0ba8e22d5 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -302,9 +302,10 @@ int pcmcia_modify_configuration(struct pcmcia_device *p_dev,
         /* We only allow changing Vpp1 and Vpp2 to the same value */
         if ((mod->Attributes & CONF_VPP1_CHANGE_VALID) &&
             (mod->Attributes & CONF_VPP2_CHANGE_VALID)) {
-                if (mod->Vpp1 != mod->Vpp2)
+                if (mod->Vpp1 != mod->Vpp2) {
                         ds_dbg(s, 0, "Vpp1 and Vpp2 must be the same\n");
                         return -EINVAL;
+                }
                 s->socket.Vpp = mod->Vpp1;
                 if (s->ops->set_socket(s, &s->socket)) {
                         dev_printk(KERN_WARNING, &s->dev,
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index 17f4ecf1c0c5..9ca22c7aafb2 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -71,7 +71,7 @@ static DEFINE_MUTEX(rsrc_mutex);
 ======================================================================*/
 
 static struct resource *
-make_resource(resource_size_t b, resource_size_t n, int flags, char *name)
+make_resource(resource_size_t b, resource_size_t n, int flags, const char *name)
 {
         struct resource *res = kzalloc(sizeof(*res), GFP_KERNEL);
 
@@ -624,7 +624,7 @@ static int nonstatic_adjust_io_region(struct resource *res, unsigned long r_star
 static struct resource *nonstatic_find_io_region(unsigned long base, int num,
                    unsigned long align, struct pcmcia_socket *s)
 {
-        struct resource *res = make_resource(0, num, IORESOURCE_IO, s->dev.bus_id);
+        struct resource *res = make_resource(0, num, IORESOURCE_IO, dev_name(&s->dev));
         struct socket_data *s_data = s->resource_data;
         struct pcmcia_align_data data;
         unsigned long min = base;
@@ -658,7 +658,7 @@ static struct resource *nonstatic_find_io_region(unsigned long base, int num,
 static struct resource * nonstatic_find_mem_region(u_long base, u_long num,
                 u_long align, int low, struct pcmcia_socket *s)
 {
-        struct resource *res = make_resource(0, num, IORESOURCE_MEM, s->dev.bus_id);
+        struct resource *res = make_resource(0, num, IORESOURCE_MEM, dev_name(&s->dev));
         struct socket_data *s_data = s->resource_data;
         struct pcmcia_align_data data;
         unsigned long min, max;
diff --git a/drivers/rtc/rtc-sun4v.c b/drivers/rtc/rtc-sun4v.c
index 2012ccbb4a53..5b2261052a65 100644
--- a/drivers/rtc/rtc-sun4v.c
+++ b/drivers/rtc/rtc-sun4v.c
@@ -1,4 +1,4 @@
-/* rtc-sun4c.c: Hypervisor based RTC for SUN4V systems.
+/* rtc-sun4v.c: Hypervisor based RTC for SUN4V systems.
  *
  * Copyright (C) 2008 David S. Miller <davem@davemloft.net>
  */
@@ -7,21 +7,11 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/init.h>
-#include <linux/time.h>
 #include <linux/rtc.h>
 #include <linux/platform_device.h>
 
 #include <asm/hypervisor.h>
 
-MODULE_AUTHOR("David S. Miller <davem@davemloft.net>");
-MODULE_DESCRIPTION("SUN4V RTC driver");
-MODULE_LICENSE("GPL");
-
-struct sun4v_rtc {
-        struct rtc_device       *rtc;
-        spinlock_t              lock;
-};
-
 static unsigned long hypervisor_get_time(void)
 {
         unsigned long ret, time;
@@ -45,15 +35,7 @@ retry:
 
 static int sun4v_read_time(struct device *dev, struct rtc_time *tm)
 {
-        struct sun4v_rtc *p = dev_get_drvdata(dev);
-        unsigned long flags, secs;
-
-        spin_lock_irqsave(&p->lock, flags);
-        secs = hypervisor_get_time();
-        spin_unlock_irqrestore(&p->lock, flags);
-
-        rtc_time_to_tm(secs, tm);
-
+        rtc_time_to_tm(hypervisor_get_time(), tm);
         return 0;
 }
 
@@ -80,19 +62,14 @@ retry:
 
 static int sun4v_set_time(struct device *dev, struct rtc_time *tm)
 {
-        struct sun4v_rtc *p = dev_get_drvdata(dev);
-        unsigned long flags, secs;
+        unsigned long secs;
         int err;
 
         err = rtc_tm_to_time(tm, &secs);
         if (err)
                 return err;
 
-        spin_lock_irqsave(&p->lock, flags);
-        err = hypervisor_set_time(secs);
-        spin_unlock_irqrestore(&p->lock, flags);
-
-        return err;
+        return hypervisor_set_time(secs);
 }
 
 static const struct rtc_class_ops sun4v_rtc_ops = {
@@ -100,33 +77,22 @@ static const struct rtc_class_ops sun4v_rtc_ops = {
         .set_time       = sun4v_set_time,
 };
 
-static int __devinit sun4v_rtc_probe(struct platform_device *pdev)
+static int __init sun4v_rtc_probe(struct platform_device *pdev)
 {
-        struct sun4v_rtc *p = kzalloc(sizeof(*p), GFP_KERNEL);
-
-        if (!p)
-                return -ENOMEM;
-
-        spin_lock_init(&p->lock);
-
-        p->rtc = rtc_device_register("sun4v", &pdev->dev,
+        struct rtc_device *rtc = rtc_device_register("sun4v", &pdev->dev,
                                      &sun4v_rtc_ops, THIS_MODULE);
-        if (IS_ERR(p->rtc)) {
-                int err = PTR_ERR(p->rtc);
-                kfree(p);
-                return err;
-        }
-        platform_set_drvdata(pdev, p);
+        if (IS_ERR(rtc))
+                return PTR_ERR(rtc);
+
+        platform_set_drvdata(pdev, rtc);
         return 0;
 }
 
-static int __devexit sun4v_rtc_remove(struct platform_device *pdev)
+static int __exit sun4v_rtc_remove(struct platform_device *pdev)
 {
-        struct sun4v_rtc *p = platform_get_drvdata(pdev);
-
-        rtc_device_unregister(p->rtc);
-        kfree(p);
+        struct rtc_device *rtc = platform_get_drvdata(pdev);
 
+        rtc_device_unregister(rtc);
         return 0;
 }
 
@@ -135,13 +101,12 @@ static struct platform_driver sun4v_rtc_driver = {
                 .name   = "rtc-sun4v",
                 .owner  = THIS_MODULE,
         },
-        .probe          = sun4v_rtc_probe,
-        .remove         = __devexit_p(sun4v_rtc_remove),
+        .remove         = __exit_p(sun4v_rtc_remove),
 };
 
 static int __init sun4v_rtc_init(void)
 {
-        return platform_driver_register(&sun4v_rtc_driver);
+        return platform_driver_probe(&sun4v_rtc_driver, sun4v_rtc_probe);
 }
 
 static void __exit sun4v_rtc_exit(void)
@@ -151,3 +116,7 @@ static void __exit sun4v_rtc_exit(void)
 
 module_init(sun4v_rtc_init);
 module_exit(sun4v_rtc_exit);
+
+MODULE_AUTHOR("David S. Miller <davem@davemloft.net>");
+MODULE_DESCRIPTION("SUN4V RTC driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 4b76fca64a6f..363bd1303d21 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1746,6 +1746,11 @@ restart:
                         goto restart;
                 }
 
+                /* log sense for fatal error */
+                if (cqr->status == DASD_CQR_FAILED) {
+                        dasd_log_sense(cqr, &cqr->irb);
+                }
+
                 /* First of all call extended error reporting. */
                 if (dasd_eer_enabled(base) &&
                     cqr->status == DASD_CQR_FAILED) {
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index eb5f1b8bc57f..ec9c0bcf66ee 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -324,6 +324,9 @@ static int do_assign_storage(sclp_cmdw_t cmd, u16 rn)
         case 0x0120:
                 break;
         default:
+                pr_warning("assign storage failed (cmd=0x%08x, "
+                           "response=0x%04x, rn=0x%04x)\n", cmd,
+                           sccb->header.response_code, rn);
                 rc = -EIO;
                 break;
         }
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 4e78c82194b4..4e4008325e28 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -874,11 +874,15 @@ void ccw_device_move_to_orphanage(struct work_struct *work)
         replacing_cdev = get_disc_ccwdev_by_dev_id(&dev_id, cdev);
         if (replacing_cdev) {
                 sch_attach_disconnected_device(sch, replacing_cdev);
+                /* Release reference from get_disc_ccwdev_by_dev_id() */
+                put_device(&cdev->dev);
                 return;
         }
         replacing_cdev = get_orphaned_ccwdev_by_dev_id(css, &dev_id);
         if (replacing_cdev) {
                 sch_attach_orphaned_device(sch, replacing_cdev);
+                /* Release reference from get_orphaned_ccwdev_by_dev_id() */
+                put_device(&cdev->dev);
                 return;
         }
         sch_create_and_recog_new_device(sch);
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/kvm/kvm_virtio.c
index ff4a6931bb8e..3d442444c618 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/kvm/kvm_virtio.c
@@ -322,13 +322,13 @@ static int __init kvm_devices_init(void)
                 return rc;
         }
 
-        rc = vmem_add_mapping(PFN_PHYS(max_pfn), PAGE_SIZE);
+        rc = vmem_add_mapping(real_memory_size, PAGE_SIZE);
         if (rc) {
                 s390_root_dev_unregister(kvm_root);
                 return rc;
         }
 
-        kvm_devices = (void *) PFN_PHYS(max_pfn);
+        kvm_devices = (void *) real_memory_size;
 
         ctl_set_bit(0, 9);
         register_external_interrupt(0x2603, kvm_extint_handler);
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 3b56220fb900..3d4e3e3f3fc0 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -610,7 +610,8 @@ struct zfcp_port *zfcp_port_enqueue(struct zfcp_adapter *adapter, u64 wwpn,
         atomic_set_mask(status | ZFCP_STATUS_COMMON_REMOVE, &port->status);
         atomic_set(&port->refcount, 0);
 
-        dev_set_name(&port->sysfs_device, "0x%016llx", wwpn);
+        dev_set_name(&port->sysfs_device, "0x%016llx",
+                     (unsigned long long)wwpn);
         port->sysfs_device.parent = &adapter->ccw_device->dev;
 
         port->sysfs_device.release = zfcp_sysfs_port_release;
diff --git a/drivers/s390/scsi/zfcp_ccw.c b/drivers/s390/scsi/zfcp_ccw.c
index b04038c74786..951a8d409d1d 100644
--- a/drivers/s390/scsi/zfcp_ccw.c
+++ b/drivers/s390/scsi/zfcp_ccw.c
@@ -116,7 +116,9 @@ static int zfcp_ccw_set_online(struct ccw_device *ccw_device)
         zfcp_erp_adapter_reopen(adapter, ZFCP_STATUS_COMMON_ERP_FAILED, 85,
                                 NULL);
         zfcp_erp_wait(adapter);
-        goto out;
+        up(&zfcp_data.config_sema);
+        flush_work(&adapter->scan_work);
+        return 0;
 
  out_scsi_register:
         zfcp_erp_thread_kill(adapter);
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 060f5f2352ec..31012d58cfb7 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -30,7 +30,7 @@ static void zfcp_dbf_hexdump(debug_info_t *dbf, void *to, int to_len,
                 dump->offset = offset;
                 dump->size = min(from_len - offset, room);
                 memcpy(dump->data, from + offset, dump->size);
-                debug_event(dbf, level, dump, dump->size);
+                debug_event(dbf, level, dump, dump->size + sizeof(*dump));
         }
 }
 
@@ -108,7 +108,7 @@ static int zfcp_dbf_view_header(debug_info_t *id, struct debug_view *view,
                              t.tv_sec, t.tv_nsec);
                 zfcp_dbf_out(&p, "cpu", "%02i", entry->id.fields.cpuid);
         } else  {
-                zfcp_dbf_outd(&p, NULL, dump->data, dump->size, dump->offset,
+                zfcp_dbf_outd(&p, "", dump->data, dump->size, dump->offset,
                               dump->total_size);
                 if ((dump->offset + dump->size) == dump->total_size)
                         p += sprintf(p, "\n");
@@ -366,6 +366,7 @@ static void zfcp_hba_dbf_view_response(char **p,
                         break;
                 zfcp_dbf_out(p, "scsi_cmnd", "0x%0Lx", r->u.fcp.cmnd);
                 zfcp_dbf_out(p, "scsi_serial", "0x%016Lx", r->u.fcp.serial);
+                p += sprintf(*p, "\n");
                 break;
 
         case FSF_QTCB_OPEN_PORT_WITH_DID:
@@ -465,7 +466,8 @@ static int zfcp_hba_dbf_view_format(debug_info_t *id, struct debug_view *view,
         else if (strncmp(r->tag, "berr", ZFCP_DBF_TAG_SIZE) == 0)
                 zfcp_hba_dbf_view_berr(&p, &r->u.berr);
 
-        p += sprintf(p, "\n");
+        if (strncmp(r->tag, "resp", ZFCP_DBF_TAG_SIZE) != 0)
+                p += sprintf(p, "\n");
         return p - out_buf;
 }
 
@@ -880,6 +882,7 @@ void zfcp_san_dbf_event_ct_request(struct zfcp_fsf_req *fsf_req)
         struct ct_hdr *hdr = sg_virt(ct->req);
         struct zfcp_san_dbf_record *r = &adapter->san_dbf_buf;
         struct zfcp_san_dbf_record_ct_request *oct = &r->u.ct_req;
+        int level = 3;
         unsigned long flags;
 
         spin_lock_irqsave(&adapter->san_dbf_lock, flags);
@@ -896,9 +899,10 @@ void zfcp_san_dbf_event_ct_request(struct zfcp_fsf_req *fsf_req)
         oct->options = hdr->options;
         oct->max_res_size = hdr->max_res_size;
         oct->len = min((int)ct->req->length - (int)sizeof(struct ct_hdr),
-                       ZFCP_DBF_CT_PAYLOAD);
-        memcpy(oct->payload, (void *)hdr + sizeof(struct ct_hdr), oct->len);
-        debug_event(adapter->san_dbf, 3, r, sizeof(*r));
+                       ZFCP_DBF_SAN_MAX_PAYLOAD);
+        debug_event(adapter->san_dbf, level, r, sizeof(*r));
+        zfcp_dbf_hexdump(adapter->san_dbf, r, sizeof(*r), level,
+                         (void *)hdr + sizeof(struct ct_hdr), oct->len);
         spin_unlock_irqrestore(&adapter->san_dbf_lock, flags);
 }
 
@@ -914,6 +918,7 @@ void zfcp_san_dbf_event_ct_response(struct zfcp_fsf_req *fsf_req)
         struct ct_hdr *hdr = sg_virt(ct->resp);
         struct zfcp_san_dbf_record *r = &adapter->san_dbf_buf;
         struct zfcp_san_dbf_record_ct_response *rct = &r->u.ct_resp;
+        int level = 3;
         unsigned long flags;
 
         spin_lock_irqsave(&adapter->san_dbf_lock, flags);
@@ -929,9 +934,10 @@ void zfcp_san_dbf_event_ct_response(struct zfcp_fsf_req *fsf_req)
         rct->expl = hdr->reason_code_expl;
         rct->vendor_unique = hdr->vendor_unique;
         rct->len = min((int)ct->resp->length - (int)sizeof(struct ct_hdr),
-                       ZFCP_DBF_CT_PAYLOAD);
-        memcpy(rct->payload, (void *)hdr + sizeof(struct ct_hdr), rct->len);
-        debug_event(adapter->san_dbf, 3, r, sizeof(*r));
+                       ZFCP_DBF_SAN_MAX_PAYLOAD);
+        debug_event(adapter->san_dbf, level, r, sizeof(*r));
+        zfcp_dbf_hexdump(adapter->san_dbf, r, sizeof(*r), level,
+                         (void *)hdr + sizeof(struct ct_hdr), rct->len);
         spin_unlock_irqrestore(&adapter->san_dbf_lock, flags);
 }
 
@@ -954,7 +960,7 @@ static void zfcp_san_dbf_event_els(const char *tag, int level,
         rec->u.els.ls_code = ls_code;
         debug_event(adapter->san_dbf, level, rec, sizeof(*rec));
         zfcp_dbf_hexdump(adapter->san_dbf, rec, sizeof(*rec), level,
-                         buffer, min(buflen, ZFCP_DBF_ELS_MAX_PAYLOAD));
+                         buffer, min(buflen, ZFCP_DBF_SAN_MAX_PAYLOAD));
         spin_unlock_irqrestore(&adapter->san_dbf_lock, flags);
 }
 
@@ -1008,8 +1014,6 @@ static int zfcp_san_dbf_view_format(debug_info_t *id, struct debug_view *view,
                                     char *out_buf, const char *in_buf)
 {
         struct zfcp_san_dbf_record *r = (struct zfcp_san_dbf_record *)in_buf;
-        char *buffer = NULL;
-        int buflen = 0, total = 0;
         char *p = out_buf;
 
         if (strncmp(r->tag, "dump", ZFCP_DBF_TAG_SIZE) == 0)
@@ -1029,9 +1033,6 @@ static int zfcp_san_dbf_view_format(debug_info_t *id, struct debug_view *view,
                 zfcp_dbf_out(&p, "gs_subtype", "0x%02x", ct->gs_subtype);
                 zfcp_dbf_out(&p, "options", "0x%02x", ct->options);
                 zfcp_dbf_out(&p, "max_res_size", "0x%04x", ct->max_res_size);
-                total = ct->len;
-                buffer = ct->payload;
-                buflen = min(total, ZFCP_DBF_CT_PAYLOAD);
         } else if (strncmp(r->tag, "rctc", ZFCP_DBF_TAG_SIZE) == 0) {
                 struct zfcp_san_dbf_record_ct_response *ct = &r->u.ct_resp;
                 zfcp_dbf_out(&p, "cmd_rsp_code", "0x%04x", ct->cmd_rsp_code);
@@ -1039,23 +1040,12 @@ static int zfcp_san_dbf_view_format(debug_info_t *id, struct debug_view *view,
                 zfcp_dbf_out(&p, "reason_code", "0x%02x", ct->reason_code);
                 zfcp_dbf_out(&p, "reason_code_expl", "0x%02x", ct->expl);
                 zfcp_dbf_out(&p, "vendor_unique", "0x%02x", ct->vendor_unique);
-                total = ct->len;
-                buffer = ct->payload;
-                buflen = min(total, ZFCP_DBF_CT_PAYLOAD);
         } else if (strncmp(r->tag, "oels", ZFCP_DBF_TAG_SIZE) == 0 ||
                    strncmp(r->tag, "rels", ZFCP_DBF_TAG_SIZE) == 0 ||
                    strncmp(r->tag, "iels", ZFCP_DBF_TAG_SIZE) == 0) {
                 struct zfcp_san_dbf_record_els *els = &r->u.els;
                 zfcp_dbf_out(&p, "ls_code", "0x%02x", els->ls_code);
-                total = els->len;
-                buffer = els->payload;
-                buflen = min(total, ZFCP_DBF_ELS_PAYLOAD);
         }
-
-        zfcp_dbf_outd(&p, "payload", buffer, buflen, 0, total);
-        if (buflen == total)
-                p += sprintf(p, "\n");
-
         return p - out_buf;
 }
 
diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h
index e8f450801fea..5d6b2dff855b 100644
--- a/drivers/s390/scsi/zfcp_dbf.h
+++ b/drivers/s390/scsi/zfcp_dbf.h
@@ -163,8 +163,6 @@ struct zfcp_san_dbf_record_ct_request {
         u8 options;
         u16 max_res_size;
         u32 len;
-#define ZFCP_DBF_CT_PAYLOAD     24
-        u8 payload[ZFCP_DBF_CT_PAYLOAD];
 } __attribute__ ((packed));
 
 struct zfcp_san_dbf_record_ct_response {
@@ -174,15 +172,11 @@ struct zfcp_san_dbf_record_ct_response {
         u8 expl;
         u8 vendor_unique;
         u32 len;
-        u8 payload[ZFCP_DBF_CT_PAYLOAD];
 } __attribute__ ((packed));
 
 struct zfcp_san_dbf_record_els {
         u8 ls_code;
         u32 len;
-#define ZFCP_DBF_ELS_PAYLOAD    32
-#define ZFCP_DBF_ELS_MAX_PAYLOAD 1024
-        u8 payload[ZFCP_DBF_ELS_PAYLOAD];
 } __attribute__ ((packed));
 
 struct zfcp_san_dbf_record {
@@ -196,6 +190,8 @@ struct zfcp_san_dbf_record {
                 struct zfcp_san_dbf_record_ct_response ct_resp;
                 struct zfcp_san_dbf_record_els els;
         } u;
+#define ZFCP_DBF_SAN_MAX_PAYLOAD 1024
+        u8 payload[32];
 } __attribute__ ((packed));
 
 struct zfcp_scsi_dbf_record {
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 9040f738ff33..35364f64da7f 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -472,6 +472,7 @@ static void zfcp_erp_strategy_check_fsfreq(struct zfcp_erp_action *act)
                                    ZFCP_STATUS_ERP_TIMEDOUT)) {
                         act->fsf_req->status |= ZFCP_STATUS_FSFREQ_DISMISSED;
                         zfcp_rec_dbf_event_action(142, act);
+                        act->fsf_req->erp_action = NULL;
                 }
                 if (act->status & ZFCP_STATUS_ERP_TIMEDOUT)
                         zfcp_rec_dbf_event_action(143, act);
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 5ae1d497e5ed..d024442ee128 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -683,6 +683,7 @@ static struct zfcp_fsf_req *zfcp_fsf_alloc_noqtcb(mempool_t *pool)
         if (!req)
                 return NULL;
         memset(req, 0, sizeof(*req));
+        req->pool = pool;
         return req;
 }
 
@@ -769,28 +770,24 @@ static struct zfcp_fsf_req *zfcp_fsf_req_create(struct zfcp_adapter *adapter,
 static int zfcp_fsf_req_send(struct zfcp_fsf_req *req)
 {
         struct zfcp_adapter *adapter = req->adapter;
-        struct zfcp_qdio_queue *req_q = &adapter->req_q;
+        unsigned long flags;
         int idx;
 
         /* put allocated FSF request into hash table */
-        spin_lock(&adapter->req_list_lock);
+        spin_lock_irqsave(&adapter->req_list_lock, flags);
         idx = zfcp_reqlist_hash(req->req_id);
         list_add_tail(&req->list, &adapter->req_list[idx]);
-        spin_unlock(&adapter->req_list_lock);
+        spin_unlock_irqrestore(&adapter->req_list_lock, flags);
 
-        req->qdio_outb_usage = atomic_read(&req_q->count);
+        req->qdio_outb_usage = atomic_read(&adapter->req_q.count);
         req->issued = get_clock();
         if (zfcp_qdio_send(req)) {
-                /* Queues are down..... */
                 del_timer(&req->timer);
-                spin_lock(&adapter->req_list_lock);
-                zfcp_reqlist_remove(adapter, req);
-                spin_unlock(&adapter->req_list_lock);
-                /* undo changes in request queue made for this request */
-                atomic_add(req->sbal_number, &req_q->count);
-                req_q->first -= req->sbal_number;
-                req_q->first += QDIO_MAX_BUFFERS_PER_Q;
-                req_q->first %= QDIO_MAX_BUFFERS_PER_Q; /* wrap */
+                spin_lock_irqsave(&adapter->req_list_lock, flags);
+                /* lookup request again, list might have changed */
+                if (zfcp_reqlist_find_safe(adapter, req))
+                        zfcp_reqlist_remove(adapter, req);
+                spin_unlock_irqrestore(&adapter->req_list_lock, flags);
                 zfcp_erp_adapter_reopen(adapter, 0, 116, req);
                 return -EIO;
         }
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index ca8f85f3dad4..e46fd3e9f68f 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -24,14 +24,10 @@ char *zfcp_get_fcp_sns_info_ptr(struct fcp_rsp_iu *fcp_rsp_iu)
 static void zfcp_scsi_slave_destroy(struct scsi_device *sdpnt)
 {
         struct zfcp_unit *unit = (struct zfcp_unit *) sdpnt->hostdata;
-        WARN_ON(!unit);
-        if (unit) {
-                atomic_clear_mask(ZFCP_STATUS_UNIT_REGISTERED, &unit->status);
-                sdpnt->hostdata = NULL;
-                unit->device = NULL;
-                zfcp_erp_unit_failed(unit, 12, NULL);
-                zfcp_unit_put(unit);
-        }
+        atomic_clear_mask(ZFCP_STATUS_UNIT_REGISTERED, &unit->status);
+        unit->device = NULL;
+        zfcp_erp_unit_failed(unit, 12, NULL);
+        zfcp_unit_put(unit);
 }
 
 static int zfcp_scsi_slave_configure(struct scsi_device *sdp)
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index 8aba4fdfb522..6194ed5d02c4 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -2445,7 +2445,7 @@ static s32 adpt_i2o_to_scsi(void __iomem *reply, struct scsi_cmnd* cmd)
         hba_status = detailed_status >> 8;
 
         // calculate resid for sg 
-        scsi_set_resid(cmd, scsi_bufflen(cmd) - readl(reply+5));
+        scsi_set_resid(cmd, scsi_bufflen(cmd) - readl(reply+20));
 
         pHba = (adpt_hba*) cmd->device->host->hostdata[0];
 
@@ -2456,7 +2456,7 @@ static s32 adpt_i2o_to_scsi(void __iomem *reply, struct scsi_cmnd* cmd)
                 case I2O_SCSI_DSC_SUCCESS:
                         cmd->result = (DID_OK << 16);
                         // handle underflow
-                        if(readl(reply+5) < cmd->underflow ) {
+                        if (readl(reply+20) < cmd->underflow) {
                                 cmd->result = (DID_ERROR <<16);
                                 printk(KERN_WARNING"%s: SCSI CMD underflow\n",pHba->name);
                         }
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 28c9da7d4a5c..7dc62deb4087 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -4402,6 +4402,10 @@ mega_internal_command(adapter_t *adapter, megacmd_t *mc, mega_passthru *pthru)
         scb_t   *scb;
         int     rval;
 
+        scmd = scsi_allocate_command(GFP_KERNEL);
+        if (!scmd)
+                return -ENOMEM;
+
         /*
          * The internal commands share one command id and hence are
          * serialized. This is so because we want to reserve maximum number of
@@ -4412,12 +4416,11 @@ mega_internal_command(adapter_t *adapter, megacmd_t *mc, mega_passthru *pthru)
         scb = &adapter->int_scb;
         memset(scb, 0, sizeof(scb_t));
 
-        scmd = &adapter->int_scmd;
-        memset(scmd, 0, sizeof(Scsi_Cmnd));
-
         sdev = kzalloc(sizeof(struct scsi_device), GFP_KERNEL);
         scmd->device = sdev;
 
+        memset(adapter->int_cdb, 0, sizeof(adapter->int_cdb));
+        scmd->cmnd = adapter->int_cdb;
         scmd->device->host = adapter->host;
         scmd->host_scribble = (void *)scb;
         scmd->cmnd[0] = MEGA_INTERNAL_CMD;
@@ -4456,6 +4459,8 @@ mega_internal_command(adapter_t *adapter, megacmd_t *mc, mega_passthru *pthru)
 
         mutex_unlock(&adapter->int_mtx);
 
+        scsi_free_command(GFP_KERNEL, scmd);
+
         return rval;
 }
 
diff --git a/drivers/scsi/megaraid.h b/drivers/scsi/megaraid.h
index ee70bd4ae4ba..795201fa0b48 100644
--- a/drivers/scsi/megaraid.h
+++ b/drivers/scsi/megaraid.h
@@ -888,8 +888,8 @@ typedef struct {
 
         u8      sglen;  /* f/w supported scatter-gather list length */
 
+        unsigned char int_cdb[MAX_COMMAND_SIZE];
         scb_t                   int_scb;
-        Scsi_Cmnd               int_scmd;
         struct mutex            int_mtx;        /* To synchronize the internal
                                                 commands */
         struct completion       int_waitq;      /* wait queue for internal
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index f25f41a499e5..b97194096d8e 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -2547,7 +2547,6 @@ typedef struct scsi_qla_host {
         uint8_t         fcode_revision[16];
         uint32_t        fw_revision[4];
 
-        uint16_t        fdt_odd_index;
         uint32_t        fdt_wrt_disable;
         uint32_t        fdt_erase_cmd;
         uint32_t        fdt_block_size;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index a470f2d3270d..4218f20f5ed5 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -140,7 +140,6 @@ int
 qla2100_pci_config(scsi_qla_host_t *ha)
 {
         uint16_t w;
-        uint32_t d;
         unsigned long flags;
         struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
 
@@ -151,10 +150,7 @@ qla2100_pci_config(scsi_qla_host_t *ha)
         w |= (PCI_COMMAND_PARITY | PCI_COMMAND_SERR);
         pci_write_config_word(ha->pdev, PCI_COMMAND, w);
 
-        /* Reset expansion ROM address decode enable */
-        pci_read_config_dword(ha->pdev, PCI_ROM_ADDRESS, &d);
-        d &= ~PCI_ROM_ADDRESS_ENABLE;
-        pci_write_config_dword(ha->pdev, PCI_ROM_ADDRESS, d);
+        pci_disable_rom(ha->pdev);
 
         /* Get PCI bus information. */
         spin_lock_irqsave(&ha->hardware_lock, flags);
@@ -174,7 +170,6 @@ int
 qla2300_pci_config(scsi_qla_host_t *ha)
 {
         uint16_t        w;
-        uint32_t        d;
         unsigned long   flags = 0;
         uint32_t        cnt;
         struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
@@ -236,10 +231,7 @@ qla2300_pci_config(scsi_qla_host_t *ha)
 
         pci_write_config_byte(ha->pdev, PCI_LATENCY_TIMER, 0x80);
 
-        /* Reset expansion ROM address decode enable */
-        pci_read_config_dword(ha->pdev, PCI_ROM_ADDRESS, &d);
-        d &= ~PCI_ROM_ADDRESS_ENABLE;
-        pci_write_config_dword(ha->pdev, PCI_ROM_ADDRESS, d);
+        pci_disable_rom(ha->pdev);
 
         /* Get PCI bus information. */
         spin_lock_irqsave(&ha->hardware_lock, flags);
@@ -259,7 +251,6 @@ int
 qla24xx_pci_config(scsi_qla_host_t *ha)
 {
         uint16_t w;
-        uint32_t d;
         unsigned long flags = 0;
         struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
 
@@ -281,10 +272,7 @@ qla24xx_pci_config(scsi_qla_host_t *ha)
         if (pci_find_capability(ha->pdev, PCI_CAP_ID_EXP))
                 pcie_set_readrq(ha->pdev, 2048);
 
-        /* Reset expansion ROM address decode enable */
-        pci_read_config_dword(ha->pdev, PCI_ROM_ADDRESS, &d);
-        d &= ~PCI_ROM_ADDRESS_ENABLE;
-        pci_write_config_dword(ha->pdev, PCI_ROM_ADDRESS, d);
+        pci_disable_rom(ha->pdev);
 
         ha->chip_revision = ha->pdev->revision;
 
@@ -306,7 +294,6 @@ int
 qla25xx_pci_config(scsi_qla_host_t *ha)
 {
         uint16_t w;
-        uint32_t d;
 
         pci_set_master(ha->pdev);
         pci_try_set_mwi(ha->pdev);
@@ -320,10 +307,7 @@ qla25xx_pci_config(scsi_qla_host_t *ha)
         if (pci_find_capability(ha->pdev, PCI_CAP_ID_EXP))
                 pcie_set_readrq(ha->pdev, 2048);
 
-        /* Reset expansion ROM address decode enable */
-        pci_read_config_dword(ha->pdev, PCI_ROM_ADDRESS, &d);
-        d &= ~PCI_ROM_ADDRESS_ENABLE;
-        pci_write_config_dword(ha->pdev, PCI_ROM_ADDRESS, d);
+        pci_disable_rom(ha->pdev);
 
         ha->chip_revision = ha->pdev->revision;
 
@@ -980,7 +964,6 @@ qla2x00_setup_chip(scsi_qla_host_t *ha)
                                     &ha->fw_minor_version,
                                     &ha->fw_subminor_version,
                                     &ha->fw_attributes, &ha->fw_memory_size);
-                                qla2x00_resize_request_q(ha);
                                 ha->flags.npiv_supported = 0;
                                 if ((IS_QLA24XX(ha) || IS_QLA25XX(ha) ||
                                      IS_QLA84XX(ha)) &&
@@ -992,6 +975,7 @@ qla2x00_setup_chip(scsi_qla_host_t *ha)
                                                 ha->max_npiv_vports =
                                                     MIN_MULTI_ID_FABRIC - 1;
                                 }
+                                qla2x00_resize_request_q(ha);
 
                                 if (ql2xallocfwdump)
                                         qla2x00_alloc_fw_dump(ha);
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 36bc6851e23d..3402746ec128 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -1964,7 +1964,7 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *ha, uint16_t *cur_xchg_cnt,
                         *cur_iocb_cnt = mcp->mb[7];
                 if (orig_iocb_cnt)
                         *orig_iocb_cnt = mcp->mb[10];
-                if (max_npiv_vports)
+                if (ha->flags.npiv_supported && max_npiv_vports)
                         *max_npiv_vports = mcp->mb[11];
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 21dd182ad512..35567203ef61 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -728,6 +728,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
                 if (ha->isp_ops->abort_command(ha, sp)) {
                         DEBUG2(printk("%s(%ld): abort_command "
                             "mbx failed.\n", __func__, ha->host_no));
+                        ret = FAILED;
                 } else {
                         DEBUG3(printk("%s(%ld): abort_command "
                             "mbx success.\n", __func__, ha->host_no));
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index 90a13211717f..e4af678eb2d6 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -722,6 +722,7 @@ done:
 static void
 qla2xxx_get_fdt_info(scsi_qla_host_t *ha)
 {
+#define FLASH_BLK_SIZE_4K       0x1000
 #define FLASH_BLK_SIZE_32K      0x8000
 #define FLASH_BLK_SIZE_64K      0x10000
         const char *loc, *locations[] = { "MID", "FDT" };
@@ -755,7 +756,6 @@ qla2xxx_get_fdt_info(scsi_qla_host_t *ha)
         loc = locations[1];
         mid = le16_to_cpu(fdt->man_id);
         fid = le16_to_cpu(fdt->id);
-        ha->fdt_odd_index = mid == 0x1f;
         ha->fdt_wrt_disable = fdt->wrt_disable_bits;
         ha->fdt_erase_cmd = flash_conf_to_access_addr(0x0300 | fdt->erase_cmd);
         ha->fdt_block_size = le32_to_cpu(fdt->block_size);
@@ -788,8 +788,7 @@ no_flash_data:
                 ha->fdt_block_size = FLASH_BLK_SIZE_64K;
                 break;
         case 0x1f: /* Atmel 26DF081A. */
-                ha->fdt_odd_index = 1;
-                ha->fdt_block_size = FLASH_BLK_SIZE_64K;
+                ha->fdt_block_size = FLASH_BLK_SIZE_4K;
                 ha->fdt_erase_cmd = flash_conf_to_access_addr(0x0320);
                 ha->fdt_unprotect_sec_cmd = flash_conf_to_access_addr(0x0339);
                 ha->fdt_protect_sec_cmd = flash_conf_to_access_addr(0x0336);
@@ -801,9 +800,9 @@ no_flash_data:
         }
 done:
         DEBUG2(qla_printk(KERN_DEBUG, ha, "FDT[%s]: (0x%x/0x%x) erase=0x%x "
-            "pro=%x upro=%x idx=%d wrtd=0x%x blk=0x%x.\n", loc, mid, fid,
+            "pro=%x upro=%x wrtd=0x%x blk=0x%x.\n", loc, mid, fid,
             ha->fdt_erase_cmd, ha->fdt_protect_sec_cmd,
-            ha->fdt_unprotect_sec_cmd, ha->fdt_odd_index, ha->fdt_wrt_disable,
+            ha->fdt_unprotect_sec_cmd, ha->fdt_wrt_disable,
             ha->fdt_block_size));
 }
 
@@ -987,13 +986,9 @@ qla24xx_write_flash_data(scsi_qla_host_t *ha, uint32_t *dwptr, uint32_t faddr,
         qla24xx_unprotect_flash(ha);
 
         for (liter = 0; liter < dwords; liter++, faddr++, dwptr++) {
-                if (ha->fdt_odd_index) {
-                        findex = faddr << 2;
-                        fdata = findex & sec_mask;
-                } else {
-                        findex = faddr;
-                        fdata = (findex & sec_mask) << 2;
-                }
+
+                findex = faddr;
+                fdata = (findex & sec_mask) << 2;
 
                 /* Are we at the beginning of a sector? */
                 if ((findex & rest_addr) == 0) {
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index be5e299df528..eea6720adf16 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.02.01-k8"
+#define QLA2XXX_VERSION      "8.02.01-k9"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    2
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 94ed262bdf0c..386361778ebb 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -1340,9 +1340,10 @@ int scsi_decide_disposition(struct scsi_cmnd *scmd)
                  * LLD/transport was disrupted during processing of the IO.
                  * The transport class is now blocked/blocking,
                  * and the transport will decide what to do with the IO
-                 * based on its timers and recovery capablilities.
+                 * based on its timers and recovery capablilities if
+                 * there are enough retries.
                  */
-                return ADD_TO_MLQUEUE;
+                goto maybe_retry;
         case DID_TRANSPORT_FAILFAST:
                 /*
                  * The transport decided to failfast the IO (most likely
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 5c0f32c7fbf6..165fc010978c 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -144,9 +144,9 @@ static void put_char(struct uart_port *port, char c)
                 status = sci_in(port, SCxSR);
         } while (!(status & SCxSR_TDxE(port)));
 
-        sci_out(port, SCxTDR, c);
         sci_in(port, SCxSR);            /* Dummy read */
         sci_out(port, SCxSR, SCxSR_TDxE_CLEAR(port));
+        sci_out(port, SCxTDR, c);
 
         spin_unlock_irqrestore(&port->lock, flags);
 }
@@ -478,10 +478,10 @@ static void sci_transmit_chars(struct uart_port *port)
                 return;
         }
 
-        if (port->type == PORT_SCIF)
-                count = scif_txroom(port);
-        else
+        if (port->type == PORT_SCI)
                 count = sci_txroom(port);
+        else
+                count = scif_txroom(port);
 
         do {
                 unsigned char c;
@@ -510,7 +510,7 @@ static void sci_transmit_chars(struct uart_port *port)
         } else {
                 ctrl = sci_in(port, SCSCR);
 
-                if (port->type == PORT_SCIF) {
+                if (port->type != PORT_SCI) {
                         sci_in(port, SCxSR); /* Dummy read */
                         sci_out(port, SCxSR, SCxSR_TDxE_CLEAR(port));
                 }
@@ -536,10 +536,10 @@ static inline void sci_receive_chars(struct uart_port *port)
                 return;
 
         while (1) {
-                if (port->type == PORT_SCIF)
-                        count = scif_rxroom(port);
-                else
+                if (port->type == PORT_SCI)
                         count = sci_rxroom(port);
+                else
+                        count = scif_rxroom(port);
 
                 /* Don't copy more bytes than there is room for in the buffer */
                 count = tty_buffer_request_room(tty, count);
@@ -714,7 +714,7 @@ static inline int sci_handle_breaks(struct uart_port *port)
 
 #if defined(SCIF_ORER)
         /* XXX: Handle SCIF overrun error */
-        if (port->type == PORT_SCIF && (sci_in(port, SCLSR) & SCIF_ORER) != 0) {
+        if (port->type != PORT_SCI && (sci_in(port, SCLSR) & SCIF_ORER) != 0) {
                 sci_out(port, SCLSR, 0);
                 if (tty_insert_flip_char(tty, 0, TTY_OVERRUN)) {
                         copied++;
@@ -1042,7 +1042,7 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
 
         sci_out(port, SCSCR, 0x00);     /* TE=0, RE=0, CKE1=0 */
 
-        if (port->type == PORT_SCIF)
+        if (port->type != PORT_SCI)
                 sci_out(port, SCFCR, SCFCR_RFRST | SCFCR_TFRST);
 
         smr_val = sci_in(port, SCSMR) & 3;
@@ -1085,6 +1085,7 @@ static const char *sci_type(struct uart_port *port)
                 case PORT_SCI:  return "sci";
                 case PORT_SCIF: return "scif";
                 case PORT_IRDA: return "irda";
+                case PORT_SCIFA:        return "scifa";
         }
 
         return NULL;
@@ -1112,6 +1113,7 @@ static void sci_config_port(struct uart_port *port, int flags)
                 s->init_pins = sci_init_pins_sci;
                 break;
         case PORT_SCIF:
+        case PORT_SCIFA:
                 s->init_pins = sci_init_pins_scif;
                 break;
         case PORT_IRDA:
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index 6163a45f968f..9f33b064172e 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -289,18 +289,18 @@
 #define CPU_SCIx_FNS(name, sci_offset, sci_size, scif_offset, scif_size)\
   static inline unsigned int sci_##name##_in(struct uart_port *port)    \
   {                                                                     \
-    if (port->type == PORT_SCI) {                                       \
-      SCI_IN(sci_size, sci_offset)                                      \
-    } else {                                                            \
-      SCI_IN(scif_size, scif_offset);                                   \
+    if (port->type == PORT_SCIF) {                                      \
+      SCI_IN(scif_size, scif_offset)                                    \
+    } else {    /* PORT_SCI or PORT_SCIFA */                            \
+      SCI_IN(sci_size, sci_offset);                                     \
     }                                                                   \
   }                                                                     \
   static inline void sci_##name##_out(struct uart_port *port, unsigned int value) \
   {                                                                     \
-    if (port->type == PORT_SCI) {                                       \
-      SCI_OUT(sci_size, sci_offset, value)                              \
-    } else {                                                            \
-      SCI_OUT(scif_size, scif_offset, value);                           \
+    if (port->type == PORT_SCIF) {                                      \
+      SCI_OUT(scif_size, scif_offset, value)                            \
+    } else {    /* PORT_SCI or PORT_SCIFA */                            \
+      SCI_OUT(sci_size, sci_offset, value);                             \
     }                                                                   \
   }
 
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index dae87b1a4c6e..cf12f2d84be2 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -352,21 +352,21 @@ static int map_dma_buffers(struct driver_data *drv_data)
         } else
                 drv_data->tx_map_len = drv_data->len;
 
-        /* Stream map the rx buffer */
-        drv_data->rx_dma = dma_map_single(dev, drv_data->rx,
-                                                drv_data->rx_map_len,
-                                                DMA_FROM_DEVICE);
-        if (dma_mapping_error(dev, drv_data->rx_dma))
-                return 0;
-
-        /* Stream map the tx buffer */
+        /* Stream map the tx buffer. Always do DMA_TO_DEVICE first
+         * so we flush the cache *before* invalidating it, in case
+         * the tx and rx buffers overlap.
+         */
         drv_data->tx_dma = dma_map_single(dev, drv_data->tx,
-                                                drv_data->tx_map_len,
-                                                DMA_TO_DEVICE);
+                                        drv_data->tx_map_len, DMA_TO_DEVICE);
+        if (dma_mapping_error(dev, drv_data->tx_dma))
+                return 0;
 
-        if (dma_mapping_error(dev, drv_data->tx_dma)) {
-                dma_unmap_single(dev, drv_data->rx_dma,
+        /* Stream map the rx buffer */
+        drv_data->rx_dma = dma_map_single(dev, drv_data->rx,
                                         drv_data->rx_map_len, DMA_FROM_DEVICE);
+        if (dma_mapping_error(dev, drv_data->rx_dma)) {
+                dma_unmap_single(dev, drv_data->tx_dma,
+                                        drv_data->tx_map_len, DMA_TO_DEVICE);
                 return 0;
         }
 
diff --git a/drivers/spi/spi_imx.c b/drivers/spi/spi_imx.c
index 61ba147e384d..0b4db0ce78d6 100644
--- a/drivers/spi/spi_imx.c
+++ b/drivers/spi/spi_imx.c
@@ -506,20 +506,6 @@ static int map_dma_buffers(struct driver_data *drv_data)
         if (!IS_DMA_ALIGNED(drv_data->rx) || !IS_DMA_ALIGNED(drv_data->tx))
                 return -1;
 
-        /* NULL rx means write-only transfer and no map needed
-           since rx DMA will not be used */
-        if (drv_data->rx) {
-                buf = drv_data->rx;
-                drv_data->rx_dma = dma_map_single(
-                                        dev,
-                                        buf,
-                                        drv_data->len,
-                                        DMA_FROM_DEVICE);
-                if (dma_mapping_error(dev, drv_data->rx_dma))
-                        return -1;
-                drv_data->rx_dma_needs_unmap = 1;
-        }
-
         if (drv_data->tx == NULL) {
                 /* Read only message --> use drv_data->dummy_dma_buf for dummy
                    writes to achive reads */
@@ -533,18 +519,31 @@ static int map_dma_buffers(struct driver_data *drv_data)
                                         buf,
                                         drv_data->tx_map_len,
                                         DMA_TO_DEVICE);
-        if (dma_mapping_error(dev, drv_data->tx_dma)) {
-                if (drv_data->rx_dma) {
-                        dma_unmap_single(dev,
-                                        drv_data->rx_dma,
-                                        drv_data->len,
-                                        DMA_FROM_DEVICE);
-                        drv_data->rx_dma_needs_unmap = 0;
-                }
+        if (dma_mapping_error(dev, drv_data->tx_dma))
                 return -1;
-        }
         drv_data->tx_dma_needs_unmap = 1;
 
+        /* NULL rx means write-only transfer and no map needed
+         * since rx DMA will not be used */
+        if (drv_data->rx) {
+                buf = drv_data->rx;
+                drv_data->rx_dma = dma_map_single(dev,
+                                                buf,
+                                                drv_data->len,
+                                                DMA_FROM_DEVICE);
+                if (dma_mapping_error(dev, drv_data->rx_dma)) {
+                        if (drv_data->tx_dma) {
+                                dma_unmap_single(dev,
+                                                drv_data->tx_dma,
+                                                drv_data->tx_map_len,
+                                                DMA_TO_DEVICE);
+                                drv_data->tx_dma_needs_unmap = 0;
+                        }
+                        return -1;
+                }
+                drv_data->rx_dma_needs_unmap = 1;
+        }
+
         return 0;
 }
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 20104443081a..d50a99f70aee 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -158,16 +158,12 @@ static int acm_wb_is_avail(struct acm *acm)
 }
 
 /*
- * Finish write.
+ * Finish write. Caller must hold acm->write_lock
  */
 static void acm_write_done(struct acm *acm, struct acm_wb *wb)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&acm->write_lock, flags);
         wb->use = 0;
         acm->transmitting--;
-        spin_unlock_irqrestore(&acm->write_lock, flags);
 }
 
 /*
@@ -482,6 +478,7 @@ static void acm_write_bulk(struct urb *urb)
 {
         struct acm_wb *wb = urb->context;
         struct acm *acm = wb->instance;
+        unsigned long flags;
 
         if (verbose || urb->status
                         || (urb->actual_length != urb->transfer_buffer_length))
@@ -490,7 +487,9 @@ static void acm_write_bulk(struct urb *urb)
                         urb->transfer_buffer_length,
                         urb->status);
 
+        spin_lock_irqsave(&acm->write_lock, flags);
         acm_write_done(acm, wb);
+        spin_unlock_irqrestore(&acm->write_lock, flags);
         if (ACM_READY(acm))
                 schedule_work(&acm->work);
         else
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 887738577b28..6d1048faf08e 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1091,6 +1091,7 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
                                 continue;
                         dev_dbg(&dev->dev, "unregistering interface %s\n",
                                 dev_name(&interface->dev));
+                        interface->unregistering = 1;
                         usb_remove_sysfs_intf_files(interface);
                         device_del(&interface->dev);
                 }
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index f66fba11fbd5..4fb65fdc9dc3 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -840,7 +840,7 @@ int usb_create_sysfs_intf_files(struct usb_interface *intf)
         struct usb_host_interface *alt = intf->cur_altsetting;
         int retval;
 
-        if (intf->sysfs_files_created)
+        if (intf->sysfs_files_created || intf->unregistering)
                 return 0;
 
         /* The interface string may be present in some altsettings
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index 4342bd9c3bb6..1f68af9db3f7 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -85,8 +85,8 @@ EXPORT_SYMBOL_GPL(usb_alloc_urb);
  * Must be called when a user of a urb is finished with it.  When the last user
  * of the urb calls this function, the memory of the urb is freed.
  *
- * Note: The transfer buffer associated with the urb is not freed, that must be
- * done elsewhere.
+ * Note: The transfer buffer associated with the urb is not freed unless the
+ * URB_FREE_BUFFER transfer flag is set.
  */
 void usb_free_urb(struct urb *urb)
 {
diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
index 5ee1590b8e9c..c1d34df0b157 100644
--- a/drivers/usb/gadget/f_acm.c
+++ b/drivers/usb/gadget/f_acm.c
@@ -463,7 +463,11 @@ static int acm_cdc_notify(struct f_acm *acm, u8 type, u16 value,
         notify->wLength = cpu_to_le16(length);
         memcpy(buf, data, length);
 
+        /* ep_queue() can complete immediately if it fills the fifo... */
+        spin_unlock(&acm->lock);
         status = usb_ep_queue(ep, req, GFP_ATOMIC);
+        spin_lock(&acm->lock);
+
         if (status < 0) {
                 ERROR(acm->port.func.config->cdev,
                                 "acm ttyGS%d can't notify serial state, %d\n",
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 659b3d9671c4..428b5993575a 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -172,7 +172,6 @@ static struct usb_interface_descriptor rndis_data_intf __initdata = {
         .bDescriptorType =      USB_DT_INTERFACE,
 
         /* .bInterfaceNumber = DYNAMIC */
-        .bAlternateSetting =    1,
         .bNumEndpoints =        2,
         .bInterfaceClass =      USB_CLASS_CDC_DATA,
         .bInterfaceSubClass =   0,
@@ -303,7 +302,7 @@ static void rndis_response_available(void *_rndis)
         __le32                          *data = req->buf;
         int                             status;
 
-        if (atomic_inc_return(&rndis->notify_count))
+        if (atomic_inc_return(&rndis->notify_count) != 1)
                 return;
 
         /* Send RNDIS RESPONSE_AVAILABLE notification; a
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 56f592dc0b36..f3a75a929e0a 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -110,29 +110,18 @@ config USB_ISP116X_HCD
 
 config USB_ISP1760_HCD
         tristate "ISP 1760 HCD support"
-        depends on USB && EXPERIMENTAL
+        depends on USB && EXPERIMENTAL && (PCI || PPC_OF)
         ---help---
           The ISP1760 chip is a USB 2.0 host controller.
 
           This driver does not support isochronous transfers or OTG.
+          This USB controller is usually attached to a non-DMA-Master
+          capable bus. NXP's eval kit brings this chip on PCI card
+          where the chip itself is behind a PLB to simulate such
+          a bus.
 
           To compile this driver as a module, choose M here: the
-          module will be called isp1760-hcd.
-
-config USB_ISP1760_PCI
-        bool "Support for the PCI bus"
-        depends on USB_ISP1760_HCD && PCI
-        ---help---
-          Enables support for the device present on the PCI bus.
-          This should only be required if you happen to have the eval kit from
-          NXP and you are going to test it.
-
-config USB_ISP1760_OF
-        bool "Support for the OF platform bus"
-        depends on USB_ISP1760_HCD && PPC_OF
-        ---help---
-          Enables support for the device present on the PowerPC
-          OpenFirmware platform bus.
+          module will be called isp1760.
 
 config USB_OHCI_HCD
         tristate "OHCI HCD support"
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 15a803b206b8..4725d15d096f 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -643,7 +643,7 @@ static int ehci_run (struct usb_hcd *hcd)
 static irqreturn_t ehci_irq (struct usb_hcd *hcd)
 {
         struct ehci_hcd         *ehci = hcd_to_ehci (hcd);
-        u32                     status, pcd_status = 0, cmd;
+        u32                     status, masked_status, pcd_status = 0, cmd;
         int                     bh;
 
         spin_lock (&ehci->lock);
@@ -656,14 +656,14 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                 goto dead;
         }
 
-        status &= INTR_MASK;
-        if (!status) {                  /* irq sharing? */
+        masked_status = status & INTR_MASK;
+        if (!masked_status) {           /* irq sharing? */
                 spin_unlock(&ehci->lock);
                 return IRQ_NONE;
         }
 
         /* clear (just) interrupts */
-        ehci_writel(ehci, status, &ehci->regs->status);
+        ehci_writel(ehci, masked_status, &ehci->regs->status);
         cmd = ehci_readl(ehci, &ehci->regs->command);
         bh = 0;
 
@@ -734,18 +734,17 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
 
         /* PCI errors [4.15.2.4] */
         if (unlikely ((status & STS_FATAL) != 0)) {
+                ehci_err(ehci, "fatal error\n");
                 dbg_cmd(ehci, "fatal", cmd);
                 dbg_status(ehci, "fatal", status);
-                if (status & STS_HALT) {
-                        ehci_err (ehci, "fatal error\n");
+                ehci_halt(ehci);
 dead:
-                        ehci_reset (ehci);
-                        ehci_writel(ehci, 0, &ehci->regs->configured_flag);
-                        /* generic layer kills/unlinks all urbs, then
-                         * uses ehci_stop to clean up the rest
-                         */
-                        bh = 1;
-                }
+                ehci_reset(ehci);
+                ehci_writel(ehci, 0, &ehci->regs->configured_flag);
+                /* generic layer kills/unlinks all urbs, then
+                 * uses ehci_stop to clean up the rest
+                 */
+                bh = 1;
         }
 
         if (bh)
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index c46a58f9181d..9d0ea573aef6 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -66,6 +66,8 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
 {
         struct ehci_hcd         *ehci = hcd_to_ehci(hcd);
         struct pci_dev          *pdev = to_pci_dev(hcd->self.controller);
+        struct pci_dev          *p_smbus;
+        u8                      rev;
         u32                     temp;
         int                     retval;
 
@@ -166,6 +168,25 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                         pci_write_config_byte(pdev, 0x4b, tmp | 0x20);
                 }
                 break;
+        case PCI_VENDOR_ID_ATI:
+                /* SB700 old version has a bug in EHCI controller,
+                 * which causes usb devices lose response in some cases.
+                 */
+                if (pdev->device == 0x4396) {
+                        p_smbus = pci_get_device(PCI_VENDOR_ID_ATI,
+                                                 PCI_DEVICE_ID_ATI_SBX00_SMBUS,
+                                                 NULL);
+                        if (!p_smbus)
+                                break;
+                        rev = p_smbus->revision;
+                        if ((rev == 0x3a) || (rev == 0x3b)) {
+                                u8 tmp;
+                                pci_read_config_byte(pdev, 0x53, &tmp);
+                                pci_write_config_byte(pdev, 0x53, tmp | (1<<3));
+                        }
+                        pci_dev_put(p_smbus);
+                }
+                break;
         }
 
         ehci_reset(ehci);
diff --git a/drivers/usb/host/ehci-ps3.c b/drivers/usb/host/ehci-ps3.c
index 0eba894bcb01..9c9da35abc6c 100644
--- a/drivers/usb/host/ehci-ps3.c
+++ b/drivers/usb/host/ehci-ps3.c
@@ -205,6 +205,7 @@ static int ps3_ehci_remove(struct ps3_system_bus_device *dev)
 
         tmp = hcd->irq;
 
+        ehci_shutdown(hcd);
         usb_remove_hcd(hcd);
 
         ps3_system_bus_set_driver_data(dev, NULL);
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 4a0c5a78b2ed..a081ee65bde6 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -918,7 +918,7 @@ iso_stream_init (
                  */
                 stream->usecs = HS_USECS_ISO (maxp);
                 bandwidth = stream->usecs * 8;
-                bandwidth /= 1 << (interval - 1);
+                bandwidth /= interval;
 
         } else {
                 u32             addr;
@@ -951,7 +951,7 @@ iso_stream_init (
                 } else
                         stream->raw_mask = smask_out [hs_transfers - 1];
                 bandwidth = stream->usecs + stream->c_usecs;
-                bandwidth /= 1 << (interval + 2);
+                bandwidth /= interval << 3;
 
                 /* stream->splits gets created from raw_mask later */
                 stream->address = cpu_to_hc32(ehci, addr);
diff --git a/drivers/usb/host/isp1760-if.c b/drivers/usb/host/isp1760-if.c
index af849f596135..b87ca7cf4b37 100644
--- a/drivers/usb/host/isp1760-if.c
+++ b/drivers/usb/host/isp1760-if.c
@@ -14,16 +14,16 @@
 #include "../core/hcd.h"
 #include "isp1760-hcd.h"
 
-#ifdef CONFIG_USB_ISP1760_OF
+#ifdef CONFIG_PPC_OF
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #endif
 
-#ifdef CONFIG_USB_ISP1760_PCI
+#ifdef CONFIG_PCI
 #include <linux/pci.h>
 #endif
 
-#ifdef CONFIG_USB_ISP1760_OF
+#ifdef CONFIG_PPC_OF
 static int of_isp1760_probe(struct of_device *dev,
                 const struct of_device_id *match)
 {
@@ -128,7 +128,7 @@ static struct of_platform_driver isp1760_of_driver = {
 };
 #endif
 
-#ifdef CONFIG_USB_ISP1760_PCI
+#ifdef CONFIG_PCI
 static u32 nxp_pci_io_base;
 static u32 iolength;
 static u32 pci_mem_phy0;
@@ -288,28 +288,28 @@ static struct pci_driver isp1761_pci_driver = {
 
 static int __init isp1760_init(void)
 {
-        int ret = -ENODEV;
+        int ret;
 
         init_kmem_once();
 
-#ifdef CONFIG_USB_ISP1760_OF
+#ifdef CONFIG_PPC_OF
         ret = of_register_platform_driver(&isp1760_of_driver);
         if (ret) {
                 deinit_kmem_cache();
                 return ret;
         }
 #endif
-#ifdef CONFIG_USB_ISP1760_PCI
+#ifdef CONFIG_PCI
         ret = pci_register_driver(&isp1761_pci_driver);
         if (ret)
                 goto unreg_of;
 #endif
         return ret;
 
-#ifdef CONFIG_USB_ISP1760_PCI
+#ifdef CONFIG_PCI
 unreg_of:
 #endif
-#ifdef CONFIG_USB_ISP1760_OF
+#ifdef CONFIG_PPC_OF
         of_unregister_platform_driver(&isp1760_of_driver);
 #endif
         deinit_kmem_cache();
@@ -319,10 +319,10 @@ module_init(isp1760_init);
 
 static void __exit isp1760_exit(void)
 {
-#ifdef CONFIG_USB_ISP1760_OF
+#ifdef CONFIG_PPC_OF
         of_unregister_platform_driver(&isp1760_of_driver);
 #endif
-#ifdef CONFIG_USB_ISP1760_PCI
+#ifdef CONFIG_PCI
         pci_unregister_driver(&isp1761_pci_driver);
 #endif
         deinit_kmem_cache();
diff --git a/drivers/usb/host/ohci-ps3.c b/drivers/usb/host/ohci-ps3.c
index 2089d8a46c4b..3c1a3b5f89f1 100644
--- a/drivers/usb/host/ohci-ps3.c
+++ b/drivers/usb/host/ohci-ps3.c
@@ -192,7 +192,7 @@ fail_start:
         return result;
 }
 
-static int ps3_ohci_remove (struct ps3_system_bus_device *dev)
+static int ps3_ohci_remove(struct ps3_system_bus_device *dev)
 {
         unsigned int tmp;
         struct usb_hcd *hcd =
@@ -205,6 +205,7 @@ static int ps3_ohci_remove (struct ps3_system_bus_device *dev)
 
         tmp = hcd->irq;
 
+        ohci_shutdown(hcd);
         usb_remove_hcd(hcd);
 
         ps3_system_bus_set_driver_data(dev, NULL);
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index c18d8790c410..2376f24f3c83 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1763,11 +1763,12 @@ static void r8a66597_timer(unsigned long _r8a66597)
 {
         struct r8a66597 *r8a66597 = (struct r8a66597 *)_r8a66597;
         unsigned long flags;
+        int port;
 
         spin_lock_irqsave(&r8a66597->lock, flags);
 
-        r8a66597_root_hub_control(r8a66597, 0);
-        r8a66597_root_hub_control(r8a66597, 1);
+        for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++)
+                r8a66597_root_hub_control(r8a66597, port);
 
         spin_unlock_irqrestore(&r8a66597->lock, flags);
 }
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 69c34a58e205..b4ec716de7da 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3270,6 +3270,7 @@ static struct usb_device_id sisusb_table [] = {
         { USB_DEVICE(0x0711, 0x0900) },
         { USB_DEVICE(0x0711, 0x0901) },
         { USB_DEVICE(0x0711, 0x0902) },
+        { USB_DEVICE(0x0711, 0x0903) },
         { USB_DEVICE(0x0711, 0x0918) },
         { USB_DEVICE(0x182d, 0x021c) },
         { USB_DEVICE(0x182d, 0x0269) },
diff --git a/drivers/usb/misc/vstusb.c b/drivers/usb/misc/vstusb.c
index 8648470c81ca..63dff9ba73c5 100644
--- a/drivers/usb/misc/vstusb.c
+++ b/drivers/usb/misc/vstusb.c
@@ -620,7 +620,7 @@ static long vstusb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                                 __func__);
                         retval = -EFAULT;
                 } else {
-                        dev_dbg(&dev->dev, "%s: recv %d bytes from pipe %d\n",
+                        dev_dbg(&dev->dev, "%s: recv %zd bytes from pipe %d\n",
                                 __func__, usb_data.count, usb_data.pipe);
                 }
 
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index c9de3f027aab..e06810aef2df 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -687,7 +687,10 @@ static ssize_t mon_bin_read(struct file *file, char __user *buf,
         }
 
         if (rp->b_read >= sizeof(struct mon_bin_hdr)) {
-                step_len = min(nbytes, (size_t)ep->len_cap);
+                step_len = ep->len_cap;
+                step_len -= rp->b_read - sizeof(struct mon_bin_hdr);
+                if (step_len > nbytes)
+                        step_len = nbytes;
                 offset = rp->b_out + PKT_SIZE;
                 offset += rp->b_read - sizeof(struct mon_bin_hdr);
                 if (offset >= rp->b_size)
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 4a35745b30be..5280dba9b1fb 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -114,8 +114,8 @@
 
 
 
-unsigned debug;
-module_param(debug, uint, S_IRUGO | S_IWUSR);
+unsigned musb_debug;
+module_param(musb_debug, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Debug message level. Default = 0");
 
 #define DRIVER_AUTHOR "Mentor Graphics, Texas Instruments, Nokia"
@@ -2248,7 +2248,7 @@ static int __init musb_init(void)
                 "host"
 #endif
                 ", debug=%d\n",
-                musb_driver_name, debug);
+                musb_driver_name, musb_debug);
         return platform_driver_probe(&musb_driver, musb_probe);
 }
 
diff --git a/drivers/usb/musb/musb_debug.h b/drivers/usb/musb/musb_debug.h
index 4d2794441b15..9fc1db44c72c 100644
--- a/drivers/usb/musb/musb_debug.h
+++ b/drivers/usb/musb/musb_debug.h
@@ -48,11 +48,11 @@
                                 __func__, __LINE__ , ## args); \
         } } while (0)
 
-extern unsigned debug;
+extern unsigned musb_debug;
 
 static inline int _dbg_level(unsigned l)
 {
-        return debug >= l;
+        return musb_debug >= l;
 }
 
 #define DBG(level, fmt, args...) xprintk(level, KERN_DEBUG, fmt, ## args)
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 3133990f04ec..cc64462d4c4e 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -378,6 +378,19 @@ musb_giveback(struct musb_qh *qh, struct urb *urb, int status)
 
                 switch (qh->type) {
 
+                case USB_ENDPOINT_XFER_CONTROL:
+                case USB_ENDPOINT_XFER_BULK:
+                        /* fifo policy for these lists, except that NAKing
+                         * should rotate a qh to the end (for fairness).
+                         */
+                        if (qh->mux == 1) {
+                                head = qh->ring.prev;
+                                list_del(&qh->ring);
+                                kfree(qh);
+                                qh = first_qh(head);
+                                break;
+                        }
+
                 case USB_ENDPOINT_XFER_ISOC:
                 case USB_ENDPOINT_XFER_INT:
                         /* this is where periodic bandwidth should be
@@ -388,17 +401,6 @@ musb_giveback(struct musb_qh *qh, struct urb *urb, int status)
                         kfree(qh);
                         qh = NULL;
                         break;
-
-                case USB_ENDPOINT_XFER_CONTROL:
-                case USB_ENDPOINT_XFER_BULK:
-                        /* fifo policy for these lists, except that NAKing
-                         * should rotate a qh to the end (for fairness).
-                         */
-                        head = qh->ring.prev;
-                        list_del(&qh->ring);
-                        kfree(qh);
-                        qh = first_qh(head);
-                        break;
                 }
         }
         return qh;
@@ -1507,10 +1509,29 @@ void musb_host_rx(struct musb *musb, u8 epnum)
                 musb_writew(hw_ep->regs, MUSB_RXCSR, val);
 
 #ifdef CONFIG_USB_INVENTRA_DMA
+                if (usb_pipeisoc(pipe)) {
+                        struct usb_iso_packet_descriptor *d;
+
+                        d = urb->iso_frame_desc + qh->iso_idx;
+                        d->actual_length = xfer_len;
+
+                        /* even if there was an error, we did the dma
+                         * for iso_frame_desc->length
+                         */
+                        if (d->status != EILSEQ && d->status != -EOVERFLOW)
+                                d->status = 0;
+
+                        if (++qh->iso_idx >= urb->number_of_packets)
+                                done = true;
+                        else
+                                done = false;
+
+                } else  {
                 /* done if urb buffer is full or short packet is recd */
                 done = (urb->actual_length + xfer_len >=
                                 urb->transfer_buffer_length
                         || dma->actual_len < qh->maxpacket);
+                }
 
                 /* send IN token for next packet, without AUTOREQ */
                 if (!done) {
@@ -1547,7 +1568,8 @@ void musb_host_rx(struct musb *musb, u8 epnum)
                 if (dma) {
                         struct dma_controller   *c;
                         u16                     rx_count;
-                        int                     ret;
+                        int                     ret, length;
+                        dma_addr_t              buf;
 
                         rx_count = musb_readw(epio, MUSB_RXCOUNT);
 
@@ -1560,6 +1582,35 @@ void musb_host_rx(struct musb *musb, u8 epnum)
 
                         c = musb->dma_controller;
 
+                        if (usb_pipeisoc(pipe)) {
+                                int status = 0;
+                                struct usb_iso_packet_descriptor *d;
+
+                                d = urb->iso_frame_desc + qh->iso_idx;
+
+                                if (iso_err) {
+                                        status = -EILSEQ;
+                                        urb->error_count++;
+                                }
+                                if (rx_count > d->length) {
+                                        if (status == 0) {
+                                                status = -EOVERFLOW;
+                                                urb->error_count++;
+                                        }
+                                        DBG(2, "** OVERFLOW %d into %d\n",\
+                                            rx_count, d->length);
+
+                                        length = d->length;
+                                } else
+                                        length = rx_count;
+                                d->status = status;
+                                buf = urb->transfer_dma + d->offset;
+                        } else {
+                                length = rx_count;
+                                buf = urb->transfer_dma +
+                                                urb->actual_length;
+                        }
+
                         dma->desired_mode = 0;
 #ifdef USE_MODE1
                         /* because of the issue below, mode 1 will
@@ -1571,6 +1622,12 @@ void musb_host_rx(struct musb *musb, u8 epnum)
                                                 urb->actual_length)
                                         > qh->maxpacket)
                                 dma->desired_mode = 1;
+                        if (rx_count < hw_ep->max_packet_sz_rx) {
+                                length = rx_count;
+                                dma->bDesiredMode = 0;
+                        } else {
+                                length = urb->transfer_buffer_length;
+                        }
 #endif
 
 /* Disadvantage of using mode 1:
@@ -1608,12 +1665,7 @@ void musb_host_rx(struct musb *musb, u8 epnum)
                          */
                         ret = c->channel_program(
                                 dma, qh->maxpacket,
-                                dma->desired_mode,
-                                urb->transfer_dma
-                                        + urb->actual_length,
-                                (dma->desired_mode == 0)
-                                        ? rx_count
-                                        : urb->transfer_buffer_length);
+                                dma->desired_mode, buf, length);
 
                         if (!ret) {
                                 c->channel_release(dma);
@@ -1631,19 +1683,6 @@ void musb_host_rx(struct musb *musb, u8 epnum)
                 }
         }
 
-        if (dma && usb_pipeisoc(pipe)) {
-                struct usb_iso_packet_descriptor        *d;
-                int                                     iso_stat = status;
-
-                d = urb->iso_frame_desc + qh->iso_idx;
-                d->actual_length += xfer_len;
-                if (iso_err) {
-                        iso_stat = -EILSEQ;
-                        urb->error_count++;
-                }
-                d->status = iso_stat;
-        }
-
 finish:
         urb->actual_length += xfer_len;
         qh->offset += xfer_len;
@@ -1671,22 +1710,9 @@ static int musb_schedule(
         struct list_head        *head = NULL;
 
         /* use fixed hardware for control and bulk */
-        switch (qh->type) {
-        case USB_ENDPOINT_XFER_CONTROL:
+        if (qh->type == USB_ENDPOINT_XFER_CONTROL) {
                 head = &musb->control;
                 hw_ep = musb->control_ep;
-                break;
-        case USB_ENDPOINT_XFER_BULK:
-                hw_ep = musb->bulk_ep;
-                if (is_in)
-                        head = &musb->in_bulk;
-                else
-                        head = &musb->out_bulk;
-                break;
-        }
-        if (head) {
-                idle = list_empty(head);
-                list_add_tail(&qh->ring, head);
                 goto success;
         }
 
@@ -1725,19 +1751,34 @@ static int musb_schedule(
                 else
                         diff = hw_ep->max_packet_sz_tx - qh->maxpacket;
 
-                if (diff > 0 && best_diff > diff) {
+                if (diff >= 0 && best_diff > diff) {
                         best_diff = diff;
                         best_end = epnum;
                 }
         }
-        if (best_end < 0)
+        /* use bulk reserved ep1 if no other ep is free */
+        if (best_end < 0 && qh->type == USB_ENDPOINT_XFER_BULK) {
+                hw_ep = musb->bulk_ep;
+                if (is_in)
+                        head = &musb->in_bulk;
+                else
+                        head = &musb->out_bulk;
+                goto success;
+        } else if (best_end < 0) {
                 return -ENOSPC;
+        }
 
         idle = 1;
+        qh->mux = 0;
         hw_ep = musb->endpoints + best_end;
         musb->periodic[best_end] = qh;
         DBG(4, "qh %p periodic slot %d\n", qh, best_end);
 success:
+        if (head) {
+                idle = list_empty(head);
+                list_add_tail(&qh->ring, head);
+                qh->mux = 1;
+        }
         qh->hw_ep = hw_ep;
         qh->hep->hcpriv = qh;
         if (idle)
@@ -2015,11 +2056,13 @@ static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                         sched = &musb->control;
                         break;
                 case USB_ENDPOINT_XFER_BULK:
-                        if (usb_pipein(urb->pipe))
-                                sched = &musb->in_bulk;
-                        else
-                                sched = &musb->out_bulk;
-                        break;
+                        if (qh->mux == 1) {
+                                if (usb_pipein(urb->pipe))
+                                        sched = &musb->in_bulk;
+                                else
+                                        sched = &musb->out_bulk;
+                                break;
+                        }
                 default:
                         /* REVISIT when we get a schedule tree, periodic
                          * transfers won't always be at the head of a
@@ -2067,11 +2110,13 @@ musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
                 sched = &musb->control;
                 break;
         case USB_ENDPOINT_XFER_BULK:
-                if (is_in)
-                        sched = &musb->in_bulk;
-                else
-                        sched = &musb->out_bulk;
-                break;
+                if (qh->mux == 1) {
+                        if (is_in)
+                                sched = &musb->in_bulk;
+                        else
+                                sched = &musb->out_bulk;
+                        break;
+                }
         default:
                 /* REVISIT when we get a schedule tree, periodic transfers
                  * won't always be at the head of a singleton queue...
diff --git a/drivers/usb/musb/musb_host.h b/drivers/usb/musb/musb_host.h
index 77bcdb9d5b32..0b7fbcd21963 100644
--- a/drivers/usb/musb/musb_host.h
+++ b/drivers/usb/musb/musb_host.h
@@ -53,6 +53,7 @@ struct musb_qh {
 
         struct list_head        ring;           /* of musb_qh */
         /* struct musb_qh               *next; */       /* for periodic tree */
+        u8                      mux;            /* qh multiplexed to hw_ep */
 
         unsigned                offset;         /* in urb->transfer_buffer */
         unsigned                segsize;        /* current xfer fragment */
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 9d2dcb121c5e..ce6c162920f7 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -53,7 +53,9 @@ static void musb_do_idle(unsigned long _musb)
 {
         struct musb     *musb = (void *)_musb;
         unsigned long   flags;
+#ifdef CONFIG_USB_MUSB_HDRC_HCD
         u8      power;
+#endif
         u8      devctl;
 
         devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index b73b036f3d77..ee8fca92a4ac 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -605,7 +605,7 @@ void musb_platform_set_mode(struct musb *musb, u8 musb_mode)
 
         if (musb->board_mode != MUSB_OTG) {
                 ERR("Changing mode currently only supported in OTG mode\n");
-                return;
+                return -EINVAL;
         }
 
         otg_stat = musb_readl(tbase, TUSB_DEV_OTG_STAT);
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
index 8008d0bc80ad..cfaf1f085535 100644
--- a/drivers/usb/serial/cp2101.c
+++ b/drivers/usb/serial/cp2101.c
@@ -56,6 +56,7 @@ static void cp2101_shutdown(struct usb_serial *);
 static int debug;
 
 static struct usb_device_id id_table [] = {
+        { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
         { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
         { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
         { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
@@ -67,6 +68,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x10C4, 0x800A) }, /* SPORTident BSM7-D-USB main station */
         { USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */
         { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
+        { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */
         { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
         { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
         { USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */
@@ -85,6 +87,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
         { USB_DEVICE(0x10c4, 0x8293) }, /* Telegesys ETRX2USB */
         { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
+        { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
         { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index bd07eaa300b9..6fa1ec441b61 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -160,6 +160,11 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 
 #define NOVATELWIRELESS_VENDOR_ID               0x1410
 
+/* YISO PRODUCTS */
+
+#define YISO_VENDOR_ID                          0x0EAB
+#define YISO_PRODUCT_U893                       0xC893
+
 /* MERLIN EVDO PRODUCTS */
 #define NOVATELWIRELESS_PRODUCT_V640            0x1100
 #define NOVATELWIRELESS_PRODUCT_V620            0x1110
@@ -408,6 +413,7 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(AXESSTEL_VENDOR_ID, AXESSTEL_PRODUCT_MV110H) },
         { USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_MSA501HS) },
         { USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_ET502HS) },
+        { USB_DEVICE(YISO_VENDOR_ID, YISO_PRODUCT_U893) },
         { USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_1) },
         { USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_2) },
         { USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_1004) },
diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig
index 3d9249632ae1..c68b738900bd 100644
--- a/drivers/usb/storage/Kconfig
+++ b/drivers/usb/storage/Kconfig
@@ -2,8 +2,8 @@
 # USB Storage driver configuration
 #
 
-comment "NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'"
-comment "may also be needed; see USB_STORAGE Help for more information"
+comment "NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;"
+comment "see USB_STORAGE Help for more information"
         depends on USB
 
 config USB_STORAGE
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index fb9e20e624c1..6da9a7a962a8 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -167,6 +167,13 @@ UNUSUAL_DEV(  0x0421, 0x005d, 0x0001, 0x0600,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY ),
 
+/* Patch for Nokia 5310 capacity */
+UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x0591,
+                "Nokia",
+                "5310",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY ),
+
 /* Reported by Mario Rettig <mariorettig@web.de> */
 UNUSUAL_DEV(  0x0421, 0x042e, 0x0100, 0x0100,
                 "Nokia",
@@ -233,14 +240,14 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
                 US_FL_MAX_SECTORS_64 ),
 
 /* Reported by Cedric Godin <cedric@belbone.be> */
-UNUSUAL_DEV(  0x0421, 0x04b9, 0x0551, 0x0551,
+UNUSUAL_DEV(  0x0421, 0x04b9, 0x0500, 0x0551,
                 "Nokia",
                 "5300",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY ),
 
 /* Reported by Richard Nauber <RichardNauber@web.de> */
-UNUSUAL_DEV(  0x0421, 0x04fa, 0x0601, 0x0601,
+UNUSUAL_DEV(  0x0421, 0x04fa, 0x0550, 0x0660,
                 "Nokia",
                 "6300",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
@@ -253,6 +260,14 @@ UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x0591,
         US_SC_DEVICE, US_PR_DEVICE, NULL,
         US_FL_FIX_CAPACITY ),
 
+/* Submitted by Ricky Wong Yung Fei <evilbladewarrior@gmail.com> */
+/* Nokia 7610 Supernova - Too many sectors reported in usb storage mode */
+UNUSUAL_DEV(  0x0421, 0x00f5, 0x0000, 0x0470,
+        "Nokia",
+        "7610 Supernova",
+        US_SC_DEVICE, US_PR_DEVICE, NULL,
+        US_FL_FIX_CAPACITY ),
+
 /* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
 UNUSUAL_DEV(  0x0424, 0x0fdc, 0x0210, 0x0210,
                 "SMSC",
@@ -418,6 +433,13 @@ UNUSUAL_DEV(  0x04b0, 0x0417, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY),
 
+/* Reported by paul ready <lxtwin@homecall.co.uk> */
+UNUSUAL_DEV(  0x04b0, 0x0419, 0x0100, 0x0200,
+                "NIKON",
+                "NIKON DSC D300",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY),
+
 /* Reported by Doug Maxey (dwm@austin.ibm.com) */
 UNUSUAL_DEV(  0x04b3, 0x4001, 0x0110, 0x0110,
                 "IBM",
@@ -1258,6 +1280,13 @@ UNUSUAL_DEV( 0x0839, 0x000a, 0x0001, 0x0001,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY),
 
+/* Reported by Luciano Rocha <luciano@eurotux.com> */
+UNUSUAL_DEV( 0x0840, 0x0082, 0x0001, 0x0001,
+                "Argosy",
+                "Storage",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY),
+
 /* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
  * Flag will support Bulk devices which use a standards-violating 32-byte
  * Command Block Wrapper. Here, the "DC2MEGA" cameras (several brands) with
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index f8d0a57a07cb..9a577a800db5 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -132,7 +132,7 @@ static void init_backlight(struct atmel_lcdfb_info *sinfo)
 
         bl = backlight_device_register("backlight", &sinfo->pdev->dev,
                         sinfo, &atmel_lcdc_bl_ops);
-        if (IS_ERR(sinfo->backlight)) {
+        if (IS_ERR(bl)) {
                 dev_err(&sinfo->pdev->dev, "error %ld on backlight register\n",
                                 PTR_ERR(bl));
                 return;
diff --git a/drivers/video/backlight/da903x.c b/drivers/video/backlight/da903x.c
index 242c38250166..93bb4340cc64 100644
--- a/drivers/video/backlight/da903x.c
+++ b/drivers/video/backlight/da903x.c
@@ -119,6 +119,7 @@ static int da903x_backlight_probe(struct platform_device *pdev)
         default:
                 dev_err(&pdev->dev, "invalid backlight device ID(%d)\n",
                                 pdev->id);
+                kfree(data);
                 return -EINVAL;
         }
 
@@ -130,6 +131,7 @@ static int da903x_backlight_probe(struct platform_device *pdev)
                         data, &da903x_backlight_ops);
         if (IS_ERR(bl)) {
                 dev_err(&pdev->dev, "failed to register backlight\n");
+                kfree(data);
                 return PTR_ERR(bl);
         }
 
diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
index 8e1731d3b228..680e57b616cd 100644
--- a/drivers/video/backlight/lcd.c
+++ b/drivers/video/backlight/lcd.c
@@ -42,10 +42,13 @@ static int fb_notifier_callback(struct notifier_block *self,
 
         mutex_lock(&ld->ops_lock);
         if (!ld->ops->check_fb || ld->ops->check_fb(ld, evdata->info)) {
-                if (event == FB_EVENT_BLANK)
-                        ld->ops->set_power(ld, *(int *)evdata->data);
-                else
-                        ld->ops->set_mode(ld, evdata->data);
+                if (event == FB_EVENT_BLANK) {
+                        if (ld->ops->set_power)
+                                ld->ops->set_power(ld, *(int *)evdata->data);
+                } else {
+                        if (ld->ops->set_mode)
+                                ld->ops->set_mode(ld, evdata->data);
+                }
         }
         mutex_unlock(&ld->ops_lock);
         return 0;
diff --git a/drivers/video/cirrusfb.c b/drivers/video/cirrusfb.c
index 8a8760230bc7..a2aa6ddffbe2 100644
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/cirrusfb.c
@@ -2462,8 +2462,7 @@ static int __init cirrusfb_init(void)
 
 #ifndef MODULE
 static int __init cirrusfb_setup(char *options) {
-        char *this_opt, s[32];
-        int i;
+        char *this_opt;
 
         DPRINTK("ENTER\n");
 
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 1d5ae39cb271..3c65b0d67617 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -230,7 +230,7 @@ static void fb_set_logo_directpalette(struct fb_info *info,
         greenshift = info->var.green.offset;
         blueshift = info->var.blue.offset;
 
-        for (i = 32; i < logo->clutsize; i++)
+        for (i = 32; i < 32 + logo->clutsize; i++)
                 palette[i] = i << redshift | i << greenshift | i << blueshift;
 }
 
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 97204497d9f7..cc59c52e1103 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -804,6 +804,9 @@ static int pxafb_smart_thread(void *arg)
 
 static int pxafb_smart_init(struct pxafb_info *fbi)
 {
+        if (!(fbi->lccr0 | LCCR0_LCDT))
+                return 0;
+
         fbi->smart_thread = kthread_run(pxafb_smart_thread, fbi,
                                         "lcd_refresh");
         if (IS_ERR(fbi->smart_thread)) {
@@ -1372,7 +1375,7 @@ static void pxafb_decode_mach_info(struct pxafb_info *fbi,
         fbi->cmap_inverse       = inf->cmap_inverse;
         fbi->cmap_static        = inf->cmap_static;
 
-        switch (lcd_conn & 0xf) {
+        switch (lcd_conn & LCD_TYPE_MASK) {
         case LCD_TYPE_MONO_STN:
                 fbi->lccr0 = LCCR0_CMS;
                 break;
diff --git a/drivers/video/tmiofb.c b/drivers/video/tmiofb.c
index 2a380011e9ba..7baf2dd12d50 100644
--- a/drivers/video/tmiofb.c
+++ b/drivers/video/tmiofb.c
@@ -222,6 +222,9 @@ static irqreturn_t tmiofb_irq(int irq, void *__info)
         unsigned int bbisc = tmio_ioread16(par->lcr + LCR_BBISC);
 
 
+        tmio_iowrite16(bbisc, par->lcr + LCR_BBISC);
+
+#ifdef CONFIG_FB_TMIO_ACCELL
         /*
          * We were in polling mode and now we got correct irq.
          * Switch back to IRQ-based sync of command FIFO
@@ -231,9 +234,6 @@ static irqreturn_t tmiofb_irq(int irq, void *__info)
                 par->use_polling = false;
         }
 
-        tmio_iowrite16(bbisc, par->lcr + LCR_BBISC);
-
-#ifdef CONFIG_FB_TMIO_ACCELL
         if (bbisc & 1)
                 wake_up(&par->wait_acc);
 #endif
@@ -938,7 +938,9 @@ static void tmiofb_dump_regs(struct platform_device *dev)
 static int tmiofb_suspend(struct platform_device *dev, pm_message_t state)
 {
         struct fb_info *info = platform_get_drvdata(dev);
+#ifdef CONFIG_FB_TMIO_ACCELL
         struct tmiofb_par *par = info->par;
+#endif
         struct mfd_cell *cell = dev->dev.platform_data;
         int retval = 0;
 
@@ -950,12 +952,14 @@ static int tmiofb_suspend(struct platform_device *dev, pm_message_t state)
                 info->fbops->fb_sync(info);
 
 
+#ifdef CONFIG_FB_TMIO_ACCELL
         /*
          * The fb should be usable even if interrupts are disabled (and they are
          * during suspend/resume). Switch temporary to forced polling.
          */
         printk(KERN_INFO "tmiofb: switching to polling\n");
         par->use_polling = true;
+#endif
         tmiofb_hw_stop(dev);
 
         if (cell->suspend)
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index 0132eae06f55..73ac754ad801 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -2036,30 +2036,30 @@ static int viafb_vt1636_proc_write(struct file *file,
         return count;
 }
 
-static void viafb_init_proc(struct proc_dir_entry *viafb_entry)
+static void viafb_init_proc(struct proc_dir_entry **viafb_entry)
 {
         struct proc_dir_entry *entry;
-        viafb_entry = proc_mkdir("viafb", NULL);
+        *viafb_entry = proc_mkdir("viafb", NULL);
         if (viafb_entry) {
-                entry = create_proc_entry("dvp0", 0, viafb_entry);
+                entry = create_proc_entry("dvp0", 0, *viafb_entry);
                 if (entry) {
                         entry->owner = THIS_MODULE;
                         entry->read_proc = viafb_dvp0_proc_read;
                         entry->write_proc = viafb_dvp0_proc_write;
                 }
-                entry = create_proc_entry("dvp1", 0, viafb_entry);
+                entry = create_proc_entry("dvp1", 0, *viafb_entry);
                 if (entry) {
                         entry->owner = THIS_MODULE;
                         entry->read_proc = viafb_dvp1_proc_read;
                         entry->write_proc = viafb_dvp1_proc_write;
                 }
-                entry = create_proc_entry("dfph", 0, viafb_entry);
+                entry = create_proc_entry("dfph", 0, *viafb_entry);
                 if (entry) {
                         entry->owner = THIS_MODULE;
                         entry->read_proc = viafb_dfph_proc_read;
                         entry->write_proc = viafb_dfph_proc_write;
                 }
-                entry = create_proc_entry("dfpl", 0, viafb_entry);
+                entry = create_proc_entry("dfpl", 0, *viafb_entry);
                 if (entry) {
                         entry->owner = THIS_MODULE;
                         entry->read_proc = viafb_dfpl_proc_read;
@@ -2068,7 +2068,7 @@ static void viafb_init_proc(struct proc_dir_entry *viafb_entry)
                 if (VT1636_LVDS == viaparinfo->chip_info->lvds_chip_info.
                         lvds_chip_name || VT1636_LVDS ==
                     viaparinfo->chip_info->lvds_chip_info2.lvds_chip_name) {
-                        entry = create_proc_entry("vt1636", 0, viafb_entry);
+                        entry = create_proc_entry("vt1636", 0, *viafb_entry);
                         if (entry) {
                                 entry->owner = THIS_MODULE;
                                 entry->read_proc = viafb_vt1636_proc_read;
@@ -2087,6 +2087,7 @@ static void viafb_remove_proc(struct proc_dir_entry *viafb_entry)
         remove_proc_entry("dfpl", viafb_entry);
         remove_proc_entry("vt1636", viafb_entry);
         remove_proc_entry("vt1625", viafb_entry);
+        remove_proc_entry("viafb", NULL);
 }
 
 static int __devinit via_pci_probe(void)
@@ -2348,7 +2349,7 @@ static int __devinit via_pci_probe(void)
                   viafbinfo->node, viafbinfo->fix.id, default_var.xres,
                   default_var.yres, default_var.bits_per_pixel);
 
-        viafb_init_proc(viaparinfo->proc_entry);
+        viafb_init_proc(&viaparinfo->proc_entry);
         viafb_init_dac(IGA2);
         return 0;
 }
diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
index 1295625c4825..c973889110c8 100644
--- a/drivers/w1/masters/omap_hdq.c
+++ b/drivers/w1/masters/omap_hdq.c
@@ -86,8 +86,8 @@ static struct platform_driver omap_hdq_driver = {
 static u8 omap_w1_read_byte(void *_hdq);
 static void omap_w1_write_byte(void *_hdq, u8 byte);
 static u8 omap_w1_reset_bus(void *_hdq);
-static void omap_w1_search_bus(void *_hdq, u8 search_type,
-        w1_slave_found_callback slave_found);
+static void omap_w1_search_bus(void *_hdq, struct w1_master *master_dev,
+                u8 search_type, w1_slave_found_callback slave_found);
 
 
 static struct w1_bus_master omap_w1_master = {
@@ -231,8 +231,8 @@ static u8 omap_w1_reset_bus(void *_hdq)
 }
 
 /* W1 search callback function */
-static void omap_w1_search_bus(void *_hdq, u8 search_type,
-        w1_slave_found_callback slave_found)
+static void omap_w1_search_bus(void *_hdq, struct w1_master *master_dev,
+                u8 search_type, w1_slave_found_callback slave_found)
 {
         u64 module_id, rn_le, cs, id;
 
@@ -249,7 +249,7 @@ static void omap_w1_search_bus(void *_hdq, u8 search_type,
         cs = w1_calc_crc8((u8 *)&rn_le, 7);
         id = (cs << 56) | module_id;
 
-        slave_found(_hdq, id);
+        slave_found(master_dev, id);
 }
 
 static int _omap_hdq_reset(struct hdq_data *hdq_data)
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index a0fb5eac407c..526c191e84ea 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -122,14 +122,7 @@ static struct timer_list balloon_timer;
 static void scrub_page(struct page *page)
 {
 #ifdef CONFIG_XEN_SCRUB_PAGES
-        if (PageHighMem(page)) {
-                void *v = kmap(page);
-                clear_page(v);
-                kunmap(v);
-        } else {
-                void *v = page_address(page);
-                clear_page(v);
-        }
+        clear_highpage(page);
 #endif
 }
 
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 8855331b2fba..e078b7aea143 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -8,7 +8,11 @@ handling fcntl(F_SETLEASE).  Convert cifs to using blocking tcp
 sends, and also let tcp autotune the socket send and receive buffers.
 This reduces the number of EAGAIN errors returned by TCP/IP in
 high stress workloads (and the number of retries on socket writes
-when sending large SMBWriteX requests).
+when sending large SMBWriteX requests).  Fix case in which a portion of
+data can in some cases not get written to the file on the server before the
+file is closed.  Fix DFS parsing to properly handle path consumed field,
+and to handle certain codepage conversions better.  Fix mount and
+umount race that can cause oops in mount or umount or reconnect.
 
 Version 1.54
 ------------
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 69a12aae91d3..490e34bbf27a 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -107,12 +107,13 @@ void cifs_dump_mids(struct TCP_Server_Info *server)
 #ifdef CONFIG_PROC_FS
 static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
 {
-        struct list_head *tmp;
-        struct list_head *tmp1;
+        struct list_head *tmp1, *tmp2, *tmp3;
         struct mid_q_entry *mid_entry;
+        struct TCP_Server_Info *server;
         struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
-        int i;
+        int i, j;
+        __u32 dev_type;
 
         seq_puts(m,
                     "Display Internal CIFS Data Structures for Debugging\n"
@@ -122,46 +123,78 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
         seq_printf(m, "Servers:");
 
         i = 0;
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalSMBSessionList) {
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp1, &cifs_tcp_ses_list) {
+                server = list_entry(tmp1, struct TCP_Server_Info,
+                                    tcp_ses_list);
                 i++;
-                ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
-                if ((ses->serverDomain == NULL) || (ses->serverOS == NULL) ||
-                   (ses->serverNOS == NULL)) {
-                        seq_printf(m, "\nentry for %s not fully "
-                                        "displayed\n\t", ses->serverName);
-                } else {
-                        seq_printf(m,
-                                    "\n%d) Name: %s  Domain: %s Mounts: %d OS:"
-                                    " %s  \n\tNOS: %s\tCapability: 0x%x\n\tSMB"
+                list_for_each(tmp2, &server->smb_ses_list) {
+                        ses = list_entry(tmp2, struct cifsSesInfo,
+                                         smb_ses_list);
+                        if ((ses->serverDomain == NULL) ||
+                                (ses->serverOS == NULL) ||
+                                (ses->serverNOS == NULL)) {
+                                seq_printf(m, "\n%d) entry for %s not fully "
+                                           "displayed\n\t", i, ses->serverName);
+                        } else {
+                                seq_printf(m,
+                                    "\n%d) Name: %s  Domain: %s Uses: %d OS:"
+                                    " %s\n\tNOS: %s\tCapability: 0x%x\n\tSMB"
                                     " session status: %d\t",
                                 i, ses->serverName, ses->serverDomain,
-                                atomic_read(&ses->inUse),
-                                ses->serverOS, ses->serverNOS,
+                                ses->ses_count, ses->serverOS, ses->serverNOS,
                                 ses->capabilities, ses->status);
-                }
-                if (ses->server) {
+                        }
                         seq_printf(m, "TCP status: %d\n\tLocal Users To "
-                                    "Server: %d SecMode: 0x%x Req On Wire: %d",
-                                ses->server->tcpStatus,
-                                atomic_read(&ses->server->socketUseCount),
-                                ses->server->secMode,
-                                atomic_read(&ses->server->inFlight));
+                                   "Server: %d SecMode: 0x%x Req On Wire: %d",
+                                   server->tcpStatus, server->srv_count,
+                                   server->secMode,
+                                   atomic_read(&server->inFlight));
 
 #ifdef CONFIG_CIFS_STATS2
                         seq_printf(m, " In Send: %d In MaxReq Wait: %d",
-                                atomic_read(&ses->server->inSend),
-                                atomic_read(&ses->server->num_waiters));
+                                atomic_read(&server->inSend),
+                                atomic_read(&server->num_waiters));
 #endif
 
-                        seq_puts(m, "\nMIDs:\n");
+                        seq_puts(m, "\n\tShares:");
+                        j = 0;
+                        list_for_each(tmp3, &ses->tcon_list) {
+                                tcon = list_entry(tmp3, struct cifsTconInfo,
+                                                  tcon_list);
+                                ++j;
+                                dev_type = le32_to_cpu(tcon->fsDevInfo.DeviceType);
+                                seq_printf(m, "\n\t%d) %s Mounts: %d ", j,
+                                           tcon->treeName, tcon->tc_count);
+                                if (tcon->nativeFileSystem) {
+                                        seq_printf(m, "Type: %s ",
+                                                   tcon->nativeFileSystem);
+                                }
+                                seq_printf(m, "DevInfo: 0x%x Attributes: 0x%x"
+                                        "\nPathComponentMax: %d Status: 0x%d",
+                                        le32_to_cpu(tcon->fsDevInfo.DeviceCharacteristics),
+                                        le32_to_cpu(tcon->fsAttrInfo.Attributes),
+                                        le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength),
+                                        tcon->tidStatus);
+                                if (dev_type == FILE_DEVICE_DISK)
+                                        seq_puts(m, " type: DISK ");
+                                else if (dev_type == FILE_DEVICE_CD_ROM)
+                                        seq_puts(m, " type: CDROM ");
+                                else
+                                        seq_printf(m, " type: %d ", dev_type);
+
+                                if (tcon->need_reconnect)
+                                        seq_puts(m, "\tDISCONNECTED ");
+                                seq_putc(m, '\n');
+                        }
+
+                        seq_puts(m, "\n\tMIDs:\n");
 
                         spin_lock(&GlobalMid_Lock);
-                        list_for_each(tmp1, &ses->server->pending_mid_q) {
-                                mid_entry = list_entry(tmp1, struct
-                                        mid_q_entry,
+                        list_for_each(tmp3, &server->pending_mid_q) {
+                                mid_entry = list_entry(tmp3, struct mid_q_entry,
                                         qhead);
-                                seq_printf(m, "State: %d com: %d pid:"
+                                seq_printf(m, "\tState: %d com: %d pid:"
                                                 " %d tsk: %p mid %d\n",
                                                 mid_entry->midState,
                                                 (int)mid_entry->command,
@@ -171,44 +204,8 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
                         }
                         spin_unlock(&GlobalMid_Lock);
                 }
-
-        }
-        read_unlock(&GlobalSMBSeslock);
-        seq_putc(m, '\n');
-
-        seq_puts(m, "Shares:");
-
-        i = 0;
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                __u32 dev_type;
-                i++;
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                dev_type = le32_to_cpu(tcon->fsDevInfo.DeviceType);
-                seq_printf(m, "\n%d) %s Uses: %d ", i,
-                                 tcon->treeName, atomic_read(&tcon->useCount));
-                if (tcon->nativeFileSystem) {
-                        seq_printf(m, "Type: %s ",
-                                         tcon->nativeFileSystem);
-                }
-                seq_printf(m, "DevInfo: 0x%x Attributes: 0x%x"
-                                 "\nPathComponentMax: %d Status: %d",
-                            le32_to_cpu(tcon->fsDevInfo.DeviceCharacteristics),
-                            le32_to_cpu(tcon->fsAttrInfo.Attributes),
-                            le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength),
-                            tcon->tidStatus);
-                if (dev_type == FILE_DEVICE_DISK)
-                        seq_puts(m, " type: DISK ");
-                else if (dev_type == FILE_DEVICE_CD_ROM)
-                        seq_puts(m, " type: CDROM ");
-                else
-                        seq_printf(m, " type: %d ", dev_type);
-
-                if (tcon->tidStatus == CifsNeedReconnect)
-                        seq_puts(m, "\tDISCONNECTED ");
         }
-        read_unlock(&GlobalSMBSeslock);
-
+        read_unlock(&cifs_tcp_ses_lock);
         seq_putc(m, '\n');
 
         /* BB add code to dump additional info such as TCP session info now */
@@ -234,7 +231,9 @@ static ssize_t cifs_stats_proc_write(struct file *file,
 {
         char c;
         int rc;
-        struct list_head *tmp;
+        struct list_head *tmp1, *tmp2, *tmp3;
+        struct TCP_Server_Info *server;
+        struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
 
         rc = get_user(c, buffer);
@@ -242,33 +241,42 @@ static ssize_t cifs_stats_proc_write(struct file *file,
                 return rc;
 
         if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
-                read_lock(&GlobalSMBSeslock);
 #ifdef CONFIG_CIFS_STATS2
                 atomic_set(&totBufAllocCount, 0);
                 atomic_set(&totSmBufAllocCount, 0);
 #endif /* CONFIG_CIFS_STATS2 */
-                list_for_each(tmp, &GlobalTreeConnectionList) {
-                        tcon = list_entry(tmp, struct cifsTconInfo,
-                                        cifsConnectionList);
-                        atomic_set(&tcon->num_smbs_sent, 0);
-                        atomic_set(&tcon->num_writes, 0);
-                        atomic_set(&tcon->num_reads, 0);
-                        atomic_set(&tcon->num_oplock_brks, 0);
-                        atomic_set(&tcon->num_opens, 0);
-                        atomic_set(&tcon->num_closes, 0);
-                        atomic_set(&tcon->num_deletes, 0);
-                        atomic_set(&tcon->num_mkdirs, 0);
-                        atomic_set(&tcon->num_rmdirs, 0);
-                        atomic_set(&tcon->num_renames, 0);
-                        atomic_set(&tcon->num_t2renames, 0);
-                        atomic_set(&tcon->num_ffirst, 0);
-                        atomic_set(&tcon->num_fnext, 0);
-                        atomic_set(&tcon->num_fclose, 0);
-                        atomic_set(&tcon->num_hardlinks, 0);
-                        atomic_set(&tcon->num_symlinks, 0);
-                        atomic_set(&tcon->num_locks, 0);
+                read_lock(&cifs_tcp_ses_lock);
+                list_for_each(tmp1, &cifs_tcp_ses_list) {
+                        server = list_entry(tmp1, struct TCP_Server_Info,
+                                            tcp_ses_list);
+                        list_for_each(tmp2, &server->smb_ses_list) {
+                                ses = list_entry(tmp2, struct cifsSesInfo,
+                                                 smb_ses_list);
+                                list_for_each(tmp3, &ses->tcon_list) {
+                                        tcon = list_entry(tmp3,
+                                                          struct cifsTconInfo,
+                                                          tcon_list);
+                                        atomic_set(&tcon->num_smbs_sent, 0);
+                                        atomic_set(&tcon->num_writes, 0);
+                                        atomic_set(&tcon->num_reads, 0);
+                                        atomic_set(&tcon->num_oplock_brks, 0);
+                                        atomic_set(&tcon->num_opens, 0);
+                                        atomic_set(&tcon->num_closes, 0);
+                                        atomic_set(&tcon->num_deletes, 0);
+                                        atomic_set(&tcon->num_mkdirs, 0);
+                                        atomic_set(&tcon->num_rmdirs, 0);
+                                        atomic_set(&tcon->num_renames, 0);
+                                        atomic_set(&tcon->num_t2renames, 0);
+                                        atomic_set(&tcon->num_ffirst, 0);
+                                        atomic_set(&tcon->num_fnext, 0);
+                                        atomic_set(&tcon->num_fclose, 0);
+                                        atomic_set(&tcon->num_hardlinks, 0);
+                                        atomic_set(&tcon->num_symlinks, 0);
+                                        atomic_set(&tcon->num_locks, 0);
+                                }
+                        }
                 }
-                read_unlock(&GlobalSMBSeslock);
+                read_unlock(&cifs_tcp_ses_lock);
         }
 
         return count;
@@ -277,7 +285,9 @@ static ssize_t cifs_stats_proc_write(struct file *file,
 static int cifs_stats_proc_show(struct seq_file *m, void *v)
 {
         int i;
-        struct list_head *tmp;
+        struct list_head *tmp1, *tmp2, *tmp3;
+        struct TCP_Server_Info *server;
+        struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
 
         seq_printf(m,
@@ -306,44 +316,55 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
                 GlobalCurrentXid, GlobalMaxActiveXid);
 
         i = 0;
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                i++;
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                seq_printf(m, "\n%d) %s", i, tcon->treeName);
-                if (tcon->tidStatus == CifsNeedReconnect)
-                        seq_puts(m, "\tDISCONNECTED ");
-                seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
-                        atomic_read(&tcon->num_smbs_sent),
-                        atomic_read(&tcon->num_oplock_brks));
-                seq_printf(m, "\nReads:  %d Bytes: %lld",
-                        atomic_read(&tcon->num_reads),
-                        (long long)(tcon->bytes_read));
-                seq_printf(m, "\nWrites: %d Bytes: %lld",
-                        atomic_read(&tcon->num_writes),
-                        (long long)(tcon->bytes_written));
-                seq_printf(m,
-                        "\nLocks: %d HardLinks: %d Symlinks: %d",
-                        atomic_read(&tcon->num_locks),
-                        atomic_read(&tcon->num_hardlinks),
-                        atomic_read(&tcon->num_symlinks));
-
-                seq_printf(m, "\nOpens: %d Closes: %d Deletes: %d",
-                        atomic_read(&tcon->num_opens),
-                        atomic_read(&tcon->num_closes),
-                        atomic_read(&tcon->num_deletes));
-                seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
-                        atomic_read(&tcon->num_mkdirs),
-                        atomic_read(&tcon->num_rmdirs));
-                seq_printf(m, "\nRenames: %d T2 Renames %d",
-                        atomic_read(&tcon->num_renames),
-                        atomic_read(&tcon->num_t2renames));
-                seq_printf(m, "\nFindFirst: %d FNext %d FClose %d",
-                        atomic_read(&tcon->num_ffirst),
-                        atomic_read(&tcon->num_fnext),
-                        atomic_read(&tcon->num_fclose));
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp1, &cifs_tcp_ses_list) {
+                server = list_entry(tmp1, struct TCP_Server_Info,
+                                    tcp_ses_list);
+                list_for_each(tmp2, &server->smb_ses_list) {
+                        ses = list_entry(tmp2, struct cifsSesInfo,
+                                         smb_ses_list);
+                        list_for_each(tmp3, &ses->tcon_list) {
+                                tcon = list_entry(tmp3,
+                                                  struct cifsTconInfo,
+                                                  tcon_list);
+                                i++;
+                                seq_printf(m, "\n%d) %s", i, tcon->treeName);
+                                if (tcon->need_reconnect)
+                                        seq_puts(m, "\tDISCONNECTED ");
+                                seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
+                                        atomic_read(&tcon->num_smbs_sent),
+                                        atomic_read(&tcon->num_oplock_brks));
+                                seq_printf(m, "\nReads:  %d Bytes: %lld",
+                                        atomic_read(&tcon->num_reads),
+                                        (long long)(tcon->bytes_read));
+                                seq_printf(m, "\nWrites: %d Bytes: %lld",
+                                        atomic_read(&tcon->num_writes),
+                                        (long long)(tcon->bytes_written));
+                                seq_printf(m, "\nLocks: %d HardLinks: %d "
+                                              "Symlinks: %d",
+                                        atomic_read(&tcon->num_locks),
+                                        atomic_read(&tcon->num_hardlinks),
+                                        atomic_read(&tcon->num_symlinks));
+                                seq_printf(m, "\nOpens: %d Closes: %d"
+                                              "Deletes: %d",
+                                        atomic_read(&tcon->num_opens),
+                                        atomic_read(&tcon->num_closes),
+                                        atomic_read(&tcon->num_deletes));
+                                seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
+                                        atomic_read(&tcon->num_mkdirs),
+                                        atomic_read(&tcon->num_rmdirs));
+                                seq_printf(m, "\nRenames: %d T2 Renames %d",
+                                        atomic_read(&tcon->num_renames),
+                                        atomic_read(&tcon->num_t2renames));
+                                seq_printf(m, "\nFindFirst: %d FNext %d "
+                                              "FClose %d",
+                                        atomic_read(&tcon->num_ffirst),
+                                        atomic_read(&tcon->num_fnext),
+                                        atomic_read(&tcon->num_fclose));
+                        }
+                }
         }
-        read_unlock(&GlobalSMBSeslock);
+        read_unlock(&cifs_tcp_ses_lock);
 
         seq_putc(m, '\n');
         return 0;
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index d2c8eef84f3c..e1c18362ba46 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -106,7 +106,8 @@ static char *cifs_get_share_name(const char *node_name)
 /**
  * compose_mount_options        -       creates mount options for refferral
  * @sb_mountdata:       parent/root DFS mount options (template)
- * @ref_unc:            refferral server UNC
+ * @dentry:             point where we are going to mount
+ * @ref:                server's referral
  * @devname:            pointer for saving device name
  *
  * creates mount options for submount based on template options sb_mountdata
@@ -116,7 +117,8 @@ static char *cifs_get_share_name(const char *node_name)
  * Caller is responcible for freeing retunrned value if it is not error.
  */
 static char *compose_mount_options(const char *sb_mountdata,
-                                   const char *ref_unc,
+                                   struct dentry *dentry,
+                                   const struct dfs_info3_param *ref,
                                    char **devname)
 {
         int rc;
@@ -126,11 +128,12 @@ static char *compose_mount_options(const char *sb_mountdata,
         char *srvIP = NULL;
         char sep = ',';
         int off, noff;
+        char *fullpath;
 
         if (sb_mountdata == NULL)
                 return ERR_PTR(-EINVAL);
 
-        *devname = cifs_get_share_name(ref_unc);
+        *devname = cifs_get_share_name(ref->node_name);
         rc = dns_resolve_server_name_to_ip(*devname, &srvIP);
         if (rc != 0) {
                 cERROR(1, ("%s: Failed to resolve server part of %s to IP",
@@ -138,7 +141,12 @@ static char *compose_mount_options(const char *sb_mountdata,
                 mountdata = ERR_PTR(rc);
                 goto compose_mount_options_out;
         }
-        md_len = strlen(sb_mountdata) + strlen(srvIP) + strlen(ref_unc) + 3;
+        /* md_len = strlen(...) + 12 for 'sep+prefixpath='
+         * assuming that we have 'unc=' and 'ip=' in
+         * the original sb_mountdata
+         */
+        md_len = strlen(sb_mountdata) + strlen(srvIP) +
+                strlen(ref->node_name) + 12;
         mountdata = kzalloc(md_len+1, GFP_KERNEL);
         if (mountdata == NULL) {
                 mountdata = ERR_PTR(-ENOMEM);
@@ -152,41 +160,56 @@ static char *compose_mount_options(const char *sb_mountdata,
                         strncpy(mountdata, sb_mountdata, 5);
                         off += 5;
         }
-        while ((tkn_e = strchr(sb_mountdata+off, sep))) {
-                noff = (tkn_e - (sb_mountdata+off)) + 1;
-                if (strnicmp(sb_mountdata+off, "unc=", 4) == 0) {
+
+        do {
+                tkn_e = strchr(sb_mountdata + off, sep);
+                if (tkn_e == NULL)
+                        noff = strlen(sb_mountdata + off);
+                else
+                        noff = tkn_e - (sb_mountdata + off) + 1;
+
+                if (strnicmp(sb_mountdata + off, "unc=", 4) == 0) {
                         off += noff;
                         continue;
                 }
-                if (strnicmp(sb_mountdata+off, "ip=", 3) == 0) {
+                if (strnicmp(sb_mountdata + off, "ip=", 3) == 0) {
                         off += noff;
                         continue;
                 }
-                if (strnicmp(sb_mountdata+off, "prefixpath=", 3) == 0) {
+                if (strnicmp(sb_mountdata + off, "prefixpath=", 11) == 0) {
                         off += noff;
                         continue;
                 }
-                strncat(mountdata, sb_mountdata+off, noff);
+                strncat(mountdata, sb_mountdata + off, noff);
                 off += noff;
-        }
-        strcat(mountdata, sb_mountdata+off);
+        } while (tkn_e);
+        strcat(mountdata, sb_mountdata + off);
         mountdata[md_len] = '\0';
 
         /* copy new IP and ref share name */
-        strcat(mountdata, ",ip=");
+        if (mountdata[strlen(mountdata) - 1] != sep)
+                strncat(mountdata, &sep, 1);
+        strcat(mountdata, "ip=");
         strcat(mountdata, srvIP);
-        strcat(mountdata, ",unc=");
+        strncat(mountdata, &sep, 1);
+        strcat(mountdata, "unc=");
         strcat(mountdata, *devname);
 
         /* find & copy prefixpath */
-        tkn_e = strchr(ref_unc+2, '\\');
-        if (tkn_e) {
-                tkn_e = strchr(tkn_e+1, '\\');
-                if (tkn_e) {
-                        strcat(mountdata, ",prefixpath=");
-                        strcat(mountdata, tkn_e+1);
-                }
+        tkn_e = strchr(ref->node_name + 2, '\\');
+        if (tkn_e == NULL) /* invalid unc, missing share name*/
+                goto compose_mount_options_out;
+
+        fullpath = build_path_from_dentry(dentry);
+        tkn_e = strchr(tkn_e + 1, '\\');
+        if (tkn_e || strlen(fullpath) - (ref->path_consumed)) {
+                strncat(mountdata, &sep, 1);
+                strcat(mountdata, "prefixpath=");
+                if (tkn_e)
+                        strcat(mountdata, tkn_e + 1);
+                strcat(mountdata, fullpath + (ref->path_consumed));
         }
+        kfree(fullpath);
 
         /*cFYI(1,("%s: parent mountdata: %s", __func__,sb_mountdata));*/
         /*cFYI(1, ("%s: submount mountdata: %s", __func__, mountdata ));*/
@@ -198,7 +221,7 @@ compose_mount_options_out:
 
 
 static struct vfsmount *cifs_dfs_do_refmount(const struct vfsmount *mnt_parent,
-                struct dentry *dentry, char *ref_unc)
+                struct dentry *dentry, const struct dfs_info3_param *ref)
 {
         struct cifs_sb_info *cifs_sb;
         struct vfsmount *mnt;
@@ -207,7 +230,7 @@ static struct vfsmount *cifs_dfs_do_refmount(const struct vfsmount *mnt_parent,
 
         cifs_sb = CIFS_SB(dentry->d_inode->i_sb);
         mountdata = compose_mount_options(cifs_sb->mountdata,
-                                                ref_unc, &devname);
+                                                dentry, ref, &devname);
 
         if (IS_ERR(mountdata))
                 return (struct vfsmount *)mountdata;
@@ -310,7 +333,7 @@ cifs_dfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
                         }
                         mnt = cifs_dfs_do_refmount(nd->path.mnt,
                                                 nd->path.dentry,
-                                                referrals[i].node_name);
+                                                referrals + i);
                         cFYI(1, ("%s: cifs_dfs_do_refmount:%s , mnt:%p",
                                          __func__,
                                         referrals[i].node_name, mnt));
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index fcee9298b620..0ab2fb5afef1 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -73,8 +73,8 @@ struct key_type cifs_spnego_key_type = {
  * strlen(";sec=ntlmsspi") */
 #define MAX_MECH_STR_LEN        13
 
-/* max possible addr len eg FEDC:BA98:7654:3210:FEDC:BA98:7654:3210/60 */
-#define MAX_IPV6_ADDR_LEN       42
+/* max possible addr len eg FEDC:BA98:7654:3210:FEDC:BA98:7654:3210/128 */
+#define MAX_IPV6_ADDR_LEN       43
 
 /* strlen of "host=" */
 #define HOST_KEY_LEN            5
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index ac5915d61dca..d9cf467309e8 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -514,10 +514,11 @@ static void cifs_umount_begin(struct super_block *sb)
         tcon = cifs_sb->tcon;
         if (tcon == NULL)
                 return;
-        down(&tcon->tconSem);
-        if (atomic_read(&tcon->useCount) == 1)
+
+        read_lock(&cifs_tcp_ses_lock);
+        if (tcon->tc_count == 1)
                 tcon->tidStatus = CifsExiting;
-        up(&tcon->tconSem);
+        read_unlock(&cifs_tcp_ses_lock);
 
         /* cancel_brl_requests(tcon); */ /* BB mark all brl mids as exiting */
         /* cancel_notify_requests(tcon); */
@@ -1013,7 +1014,7 @@ static int cifs_oplock_thread(void *dummyarg)
                                 not bother sending an oplock release if session
                                 to server still is disconnected since oplock
                                 already released by the server in that case */
-                        if (pTcon->tidStatus != CifsNeedReconnect) {
+                        if (!pTcon->need_reconnect) {
                                 rc = CIFSSMBLock(0, pTcon, netfid,
                                                 0 /* len */ , 0 /* offset */, 0,
                                                 0, LOCKING_ANDX_OPLOCK_RELEASE,
@@ -1031,24 +1032,24 @@ static int cifs_oplock_thread(void *dummyarg)
 static int cifs_dnotify_thread(void *dummyarg)
 {
         struct list_head *tmp;
-        struct cifsSesInfo *ses;
+        struct TCP_Server_Info *server;
 
         do {
                 if (try_to_freeze())
                         continue;
                 set_current_state(TASK_INTERRUPTIBLE);
                 schedule_timeout(15*HZ);
-                read_lock(&GlobalSMBSeslock);
                 /* check if any stuck requests that need
                    to be woken up and wakeq so the
                    thread can wake up and error out */
-                list_for_each(tmp, &GlobalSMBSessionList) {
-                        ses = list_entry(tmp, struct cifsSesInfo,
-                                cifsSessionList);
-                        if (ses->server && atomic_read(&ses->server->inFlight))
-                                wake_up_all(&ses->server->response_q);
+                read_lock(&cifs_tcp_ses_lock);
+                list_for_each(tmp, &cifs_tcp_ses_list) {
+                        server = list_entry(tmp, struct TCP_Server_Info,
+                                         tcp_ses_list);
+                        if (atomic_read(&server->inFlight))
+                                wake_up_all(&server->response_q);
                 }
-                read_unlock(&GlobalSMBSeslock);
+                read_unlock(&cifs_tcp_ses_lock);
         } while (!kthread_should_stop());
 
         return 0;
@@ -1059,9 +1060,7 @@ init_cifs(void)
 {
         int rc = 0;
         cifs_proc_init();
-/*      INIT_LIST_HEAD(&GlobalServerList);*/    /* BB not implemented yet */
-        INIT_LIST_HEAD(&GlobalSMBSessionList);
-        INIT_LIST_HEAD(&GlobalTreeConnectionList);
+        INIT_LIST_HEAD(&cifs_tcp_ses_list);
         INIT_LIST_HEAD(&GlobalOplock_Q);
 #ifdef CONFIG_CIFS_EXPERIMENTAL
         INIT_LIST_HEAD(&GlobalDnotifyReqList);
@@ -1089,6 +1088,7 @@ init_cifs(void)
         GlobalMaxActiveXid = 0;
         memset(Local_System_Name, 0, 15);
         rwlock_init(&GlobalSMBSeslock);
+        rwlock_init(&cifs_tcp_ses_lock);
         spin_lock_init(&GlobalMid_Lock);
 
         if (cifs_max_pending < 2) {
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 1cb1189f24e0..c57c0565547f 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -85,8 +85,7 @@ enum securityEnum {
 };
 
 enum protocolEnum {
-        IPV4 = 0,
-        IPV6,
+        TCP = 0,
         SCTP
         /* Netbios frames protocol not supported at this time */
 };
@@ -122,6 +121,9 @@ struct cifs_cred {
  */
 
 struct TCP_Server_Info {
+        struct list_head tcp_ses_list;
+        struct list_head smb_ses_list;
+        int srv_count; /* reference counter */
         /* 15 character server name + 0x20 16th byte indicating type = srv */
         char server_RFC1001_name[SERVER_NAME_LEN_WITH_NULL];
         char unicode_server_Name[SERVER_NAME_LEN_WITH_NULL * 2];
@@ -143,7 +145,6 @@ struct TCP_Server_Info {
         bool svlocal:1;                 /* local server or remote */
         bool noblocksnd;                /* use blocking sendmsg */
         bool noautotune;                /* do not autotune send buf sizes */
-        atomic_t socketUseCount; /* number of open cifs sessions on socket */
         atomic_t inFlight;  /* number of requests on the wire to server */
 #ifdef CONFIG_CIFS_STATS2
         atomic_t inSend; /* requests trying to send */
@@ -194,13 +195,14 @@ struct cifsUidInfo {
  * Session structure.  One of these for each uid session with a particular host
  */
 struct cifsSesInfo {
-        struct list_head cifsSessionList;
+        struct list_head smb_ses_list;
+        struct list_head tcon_list;
         struct semaphore sesSem;
 #if 0
         struct cifsUidInfo *uidInfo;    /* pointer to user info */
 #endif
         struct TCP_Server_Info *server; /* pointer to server info */
-        atomic_t inUse; /* # of mounts (tree connections) on this ses */
+        int ses_count;          /* reference counter */
         enum statusEnum status;
         unsigned overrideSecFlg;  /* if non-zero override global sec flags */
         __u16 ipc_tid;          /* special tid for connection to IPC share */
@@ -216,6 +218,7 @@ struct cifsSesInfo {
         char userName[MAX_USERNAME_SIZE + 1];
         char *domainName;
         char *password;
+        bool need_reconnect:1; /* connection reset, uid now invalid */
 };
 /* no more than one of the following three session flags may be set */
 #define CIFS_SES_NT4 1
@@ -230,16 +233,15 @@ struct cifsSesInfo {
  * session
  */
 struct cifsTconInfo {
-        struct list_head cifsConnectionList;
+        struct list_head tcon_list;
+        int tc_count;
         struct list_head openFileList;
-        struct semaphore tconSem;
         struct cifsSesInfo *ses;        /* pointer to session associated with */
         char treeName[MAX_TREE_SIZE + 1]; /* UNC name of resource in ASCII */
         char *nativeFileSystem;
         __u16 tid;              /* The 2 byte tree id */
         __u16 Flags;            /* optional support bits */
         enum statusEnum tidStatus;
-        atomic_t useCount;      /* how many explicit/implicit mounts to share */
 #ifdef CONFIG_CIFS_STATS
         atomic_t num_smbs_sent;
         atomic_t num_writes;
@@ -288,6 +290,7 @@ struct cifsTconInfo {
         bool unix_ext:1;  /* if false disable Linux extensions to CIFS protocol
                                 for this mount even if server would support */
         bool local_lease:1; /* check leases (only) on local system not remote */
+        bool need_reconnect:1; /* connection reset, tid now invalid */
         /* BB add field for back pointer to sb struct(s)? */
 };
 
@@ -588,22 +591,30 @@ require use of the stronger protocol */
 #endif
 
 /*
- * The list of servers that did not respond with NT LM 0.12.
- * This list helps improve performance and eliminate the messages indicating
- * that we had a communications error talking to the server in this list.
+ * the list of TCP_Server_Info structures, ie each of the sockets
+ * connecting our client to a distinct server (ip address), is
+ * chained together by cifs_tcp_ses_list. The list of all our SMB
+ * sessions (and from that the tree connections) can be found
+ * by iterating over cifs_tcp_ses_list
  */
-/* Feature not supported */
-/* GLOBAL_EXTERN struct servers_not_supported *NotSuppList; */
+GLOBAL_EXTERN struct list_head          cifs_tcp_ses_list;
 
 /*
- * The following is a hash table of all the users we know about.
+ * This lock protects the cifs_tcp_ses_list, the list of smb sessions per
+ * tcp session, and the list of tcon's per smb session. It also protects
+ * the reference counters for the server, smb session, and tcon. Finally,
+ * changes to the tcon->tidStatus should be done while holding this lock.
  */
-GLOBAL_EXTERN struct smbUidInfo *GlobalUidList[UID_HASH];
+GLOBAL_EXTERN rwlock_t          cifs_tcp_ses_lock;
 
-/* GLOBAL_EXTERN struct list_head GlobalServerList; BB not implemented yet */
-GLOBAL_EXTERN struct list_head GlobalSMBSessionList;
-GLOBAL_EXTERN struct list_head GlobalTreeConnectionList;
-GLOBAL_EXTERN rwlock_t GlobalSMBSeslock;  /* protects list inserts on 3 above */
+/*
+ * This lock protects the cifs_file->llist and cifs_file->flist
+ * list operations, and updates to some flags (cifs_file->invalidHandle)
+ * It will be moved to either use the tcon->stat_lock or equivalent later.
+ * If cifs_tcp_ses_lock and the lock below are both needed to be held, then
+ * the cifs_tcp_ses_lock must be grabbed first and released last.
+ */
+GLOBAL_EXTERN rwlock_t GlobalSMBSeslock;
 
 GLOBAL_EXTERN struct list_head GlobalOplock_Q;
 
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index d5eac48fc415..2af8626ced43 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -190,10 +190,10 @@ small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                 /* need to prevent multiple threads trying to
                 simultaneously reconnect the same SMB session */
                         down(&tcon->ses->sesSem);
-                        if (tcon->ses->status == CifsNeedReconnect)
+                        if (tcon->ses->need_reconnect)
                                 rc = cifs_setup_session(0, tcon->ses,
                                                         nls_codepage);
-                        if (!rc && (tcon->tidStatus == CifsNeedReconnect)) {
+                        if (!rc && (tcon->need_reconnect)) {
                                 mark_open_files_invalid(tcon);
                                 rc = CIFSTCon(0, tcon->ses, tcon->treeName,
                                               tcon, nls_codepage);
@@ -337,10 +337,10 @@ smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                 /* need to prevent multiple threads trying to
                 simultaneously reconnect the same SMB session */
                         down(&tcon->ses->sesSem);
-                        if (tcon->ses->status == CifsNeedReconnect)
+                        if (tcon->ses->need_reconnect)
                                 rc = cifs_setup_session(0, tcon->ses,
                                                         nls_codepage);
-                        if (!rc && (tcon->tidStatus == CifsNeedReconnect)) {
+                        if (!rc && (tcon->need_reconnect)) {
                                 mark_open_files_invalid(tcon);
                                 rc = CIFSTCon(0, tcon->ses, tcon->treeName,
                                               tcon, nls_codepage);
@@ -664,8 +664,9 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                         rc = -EIO;
                         goto neg_err_exit;
                 }
-
-                if (server->socketUseCount.counter > 1) {
+                read_lock(&cifs_tcp_ses_lock);
+                if (server->srv_count > 1) {
+                        read_unlock(&cifs_tcp_ses_lock);
                         if (memcmp(server->server_GUID,
                                    pSMBr->u.extended_response.
                                    GUID, 16) != 0) {
@@ -674,9 +675,11 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                                         pSMBr->u.extended_response.GUID,
                                         16);
                         }
-                } else
+                } else {
+                        read_unlock(&cifs_tcp_ses_lock);
                         memcpy(server->server_GUID,
                                pSMBr->u.extended_response.GUID, 16);
+                }
 
                 if (count == 16) {
                         server->secType = RawNTLMSSP;
@@ -739,50 +742,31 @@ CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon)
         int rc = 0;
 
         cFYI(1, ("In tree disconnect"));
-        /*
-         *  If last user of the connection and
-         *  connection alive - disconnect it
-         *  If this is the last connection on the server session disconnect it
-         *  (and inside session disconnect we should check if tcp socket needs
-         *  to be freed and kernel thread woken up).
-         */
-        if (tcon)
-                down(&tcon->tconSem);
-        else
-                return -EIO;
 
-        atomic_dec(&tcon->useCount);
-        if (atomic_read(&tcon->useCount) > 0) {
-                up(&tcon->tconSem);
-                return -EBUSY;
-        }
+        /* BB: do we need to check this? These should never be NULL. */
+        if ((tcon->ses == NULL) || (tcon->ses->server == NULL))
+                return -EIO;
 
-        /* No need to return error on this operation if tid invalidated and
-        closed on server already e.g. due to tcp session crashing */
-        if (tcon->tidStatus == CifsNeedReconnect) {
-                up(&tcon->tconSem);
+        /*
+         * No need to return error on this operation if tid invalidated and
+         * closed on server already e.g. due to tcp session crashing. Also,
+         * the tcon is no longer on the list, so no need to take lock before
+         * checking this.
+         */
+        if (tcon->need_reconnect)
                 return 0;
-        }
 
-        if ((tcon->ses == NULL) || (tcon->ses->server == NULL)) {
-                up(&tcon->tconSem);
-                return -EIO;
-        }
         rc = small_smb_init(SMB_COM_TREE_DISCONNECT, 0, tcon,
                             (void **)&smb_buffer);
-        if (rc) {
-                up(&tcon->tconSem);
+        if (rc)
                 return rc;
-        }
 
         rc = SendReceiveNoRsp(xid, tcon->ses, smb_buffer, 0);
         if (rc)
                 cFYI(1, ("Tree disconnect failed %d", rc));
 
-        up(&tcon->tconSem);
-
         /* No need to return error on this operation if tid invalidated and
-        closed on server already e.g. due to tcp session crashing */
+           closed on server already e.g. due to tcp session crashing */
         if (rc == -EAGAIN)
                 rc = 0;
 
@@ -796,43 +780,36 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
         int rc = 0;
 
         cFYI(1, ("In SMBLogoff for session disconnect"));
-        if (ses)
-                down(&ses->sesSem);
-        else
+
+        /*
+         * BB: do we need to check validity of ses and server? They should
+         * always be valid since we have an active reference. If not, that
+         * should probably be a BUG()
+         */
+        if (!ses || !ses->server)
                 return -EIO;
 
-        atomic_dec(&ses->inUse);
-        if (atomic_read(&ses->inUse) > 0) {
-                up(&ses->sesSem);
-                return -EBUSY;
-        }
+        down(&ses->sesSem);
+        if (ses->need_reconnect)
+                goto session_already_dead; /* no need to send SMBlogoff if uid
+                                              already closed due to reconnect */
         rc = small_smb_init(SMB_COM_LOGOFF_ANDX, 2, NULL, (void **)&pSMB);
         if (rc) {
                 up(&ses->sesSem);
                 return rc;
         }
 
-        if (ses->server) {
-                pSMB->hdr.Mid = GetNextMid(ses->server);
+        pSMB->hdr.Mid = GetNextMid(ses->server);
 
-                if (ses->server->secMode &
+        if (ses->server->secMode &
                    (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
                         pSMB->hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
-        }
 
         pSMB->hdr.Uid = ses->Suid;
 
         pSMB->AndXCommand = 0xFF;
         rc = SendReceiveNoRsp(xid, ses, (struct smb_hdr *) pSMB, 0);
-        if (ses->server) {
-                atomic_dec(&ses->server->socketUseCount);
-                if (atomic_read(&ses->server->socketUseCount) == 0) {
-                        spin_lock(&GlobalMid_Lock);
-                        ses->server->tcpStatus = CifsExiting;
-                        spin_unlock(&GlobalMid_Lock);
-                        rc = -ESHUTDOWN;
-                }
-        }
+session_already_dead:
         up(&ses->sesSem);
 
         /* if session dead then we do not need to do ulogoff,
@@ -3922,6 +3899,27 @@ GetInodeNumOut:
         return rc;
 }
 
+/* computes length of UCS string converted to host codepage
+ * @src:        UCS string
+ * @maxlen:     length of the input string in UCS characters
+ *              (not in bytes)
+ *
+ * return:      size of input string in host codepage
+ */
+static int hostlen_fromUCS(const __le16 *src, const int maxlen,
+                const struct nls_table *nls_codepage) {
+        int i;
+        int hostlen = 0;
+        char to[4];
+        int charlen;
+        for (i = 0; (i < maxlen) && src[i]; ++i) {
+                charlen = nls_codepage->uni2char(le16_to_cpu(src[i]),
+                                to, NLS_MAX_CHARSET_SIZE);
+                hostlen += charlen > 0 ? charlen : 1;
+        }
+        return hostlen;
+}
+
 /* parses DFS refferal V3 structure
  * caller is responsible for freeing target_nodes
  * returns:
@@ -3932,7 +3930,8 @@ static int
 parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 unsigned int *num_of_nodes,
                 struct dfs_info3_param **target_nodes,
-                const struct nls_table *nls_codepage)
+                const struct nls_table *nls_codepage, int remap,
+                const char *searchName)
 {
         int i, rc = 0;
         char *data_end;
@@ -3983,7 +3982,17 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 struct dfs_info3_param *node = (*target_nodes)+i;
 
                 node->flags = le16_to_cpu(pSMBr->DFSFlags);
-                node->path_consumed = le16_to_cpu(pSMBr->PathConsumed);
+                if (is_unicode) {
+                        __le16 *tmp = kmalloc(strlen(searchName)*2, GFP_KERNEL);
+                        cifsConvertToUCS((__le16 *) tmp, searchName,
+                                        PATH_MAX, nls_codepage, remap);
+                        node->path_consumed = hostlen_fromUCS(tmp,
+                                        le16_to_cpu(pSMBr->PathConsumed)/2,
+                                        nls_codepage);
+                        kfree(tmp);
+                } else
+                        node->path_consumed = le16_to_cpu(pSMBr->PathConsumed);
+
                 node->server_type = le16_to_cpu(ref->ServerType);
                 node->ref_flag = le16_to_cpu(ref->ReferralEntryFlags);
 
@@ -4116,7 +4125,8 @@ getDFSRetry:
 
         /* parse returned result into more usable form */
         rc = parse_DFS_referrals(pSMBr, num_of_nodes,
-                                 target_nodes, nls_codepage);
+                                 target_nodes, nls_codepage, remap,
+                                 searchName);
 
 GetDFSRefExit:
         cifs_buf_release(pSMB);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e9f9248cb3fe..c7d341714586 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -124,7 +124,7 @@ static int
 cifs_reconnect(struct TCP_Server_Info *server)
 {
         int rc = 0;
-        struct list_head *tmp;
+        struct list_head *tmp, *tmp2;
         struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
         struct mid_q_entry *mid_entry;
@@ -144,23 +144,17 @@ cifs_reconnect(struct TCP_Server_Info *server)
 
         /* before reconnecting the tcp session, mark the smb session (uid)
                 and the tid bad so they are not used until reconnected */
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalSMBSessionList) {
-                ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
-                if (ses->server) {
-                        if (ses->server == server) {
-                                ses->status = CifsNeedReconnect;
-                                ses->ipc_tid = 0;
-                        }
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &server->smb_ses_list) {
+                ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
+                ses->need_reconnect = true;
+                ses->ipc_tid = 0;
+                list_for_each(tmp2, &ses->tcon_list) {
+                        tcon = list_entry(tmp2, struct cifsTconInfo, tcon_list);
+                        tcon->need_reconnect = true;
                 }
-                /* else tcp and smb sessions need reconnection */
-        }
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                if ((tcon->ses) && (tcon->ses->server == server))
-                        tcon->tidStatus = CifsNeedReconnect;
         }
-        read_unlock(&GlobalSMBSeslock);
+        read_unlock(&cifs_tcp_ses_lock);
         /* do not want to be sending data on a socket we are freeing */
         down(&server->tcpSem);
         if (server->ssocket) {
@@ -193,7 +187,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         while ((server->tcpStatus != CifsExiting) &&
                (server->tcpStatus != CifsGood)) {
                 try_to_freeze();
-                if (server->protocolType == IPV6) {
+                if (server->addr.sockAddr6.sin6_family == AF_INET6) {
                         rc = ipv6_connect(&server->addr.sockAddr6,
                                           &server->ssocket, server->noautotune);
                 } else {
@@ -417,9 +411,14 @@ incomplete_rcv:
                         msleep(1); /* minimum sleep to prevent looping
                                 allowing socket to clear and app threads to set
                                 tcpStatus CifsNeedReconnect if server hung */
-                        if (pdu_length < 4)
+                        if (pdu_length < 4) {
+                                iov.iov_base = (4 - pdu_length) +
+                                                        (char *)smb_buffer;
+                                iov.iov_len = pdu_length;
+                                smb_msg.msg_control = NULL;
+                                smb_msg.msg_controllen = 0;
                                 goto incomplete_rcv;
-                        else
+                        } else
                                 continue;
                 } else if (length <= 0) {
                         if (server->tcpStatus == CifsNew) {
@@ -654,6 +653,11 @@ multi_t2_fnd:
                 }
         } /* end while !EXITING */
 
+        /* take it off the list, if it's not already */
+        write_lock(&cifs_tcp_ses_lock);
+        list_del_init(&server->tcp_ses_list);
+        write_unlock(&cifs_tcp_ses_lock);
+
         spin_lock(&GlobalMid_Lock);
         server->tcpStatus = CifsExiting;
         spin_unlock(&GlobalMid_Lock);
@@ -686,29 +690,29 @@ multi_t2_fnd:
         if (smallbuf) /* no sense logging a debug message if NULL */
                 cifs_small_buf_release(smallbuf);
 
-        read_lock(&GlobalSMBSeslock);
+        /*
+         * BB: we shouldn't have to do any of this. It shouldn't be
+         * possible to exit from the thread with active SMB sessions
+         */
+        read_lock(&cifs_tcp_ses_lock);
         if (list_empty(&server->pending_mid_q)) {
                 /* loop through server session structures attached to this and
                     mark them dead */
-                list_for_each(tmp, &GlobalSMBSessionList) {
-                        ses =
-                            list_entry(tmp, struct cifsSesInfo,
-                                       cifsSessionList);
-                        if (ses->server == server) {
-                                ses->status = CifsExiting;
-                                ses->server = NULL;
-                        }
+                list_for_each(tmp, &server->smb_ses_list) {
+                        ses = list_entry(tmp, struct cifsSesInfo,
+                                         smb_ses_list);
+                        ses->status = CifsExiting;
+                        ses->server = NULL;
                 }
-                read_unlock(&GlobalSMBSeslock);
+                read_unlock(&cifs_tcp_ses_lock);
         } else {
                 /* although we can not zero the server struct pointer yet,
                 since there are active requests which may depnd on them,
                 mark the corresponding SMB sessions as exiting too */
-                list_for_each(tmp, &GlobalSMBSessionList) {
+                list_for_each(tmp, &server->smb_ses_list) {
                         ses = list_entry(tmp, struct cifsSesInfo,
-                                         cifsSessionList);
-                        if (ses->server == server)
-                                ses->status = CifsExiting;
+                                         smb_ses_list);
+                        ses->status = CifsExiting;
                 }
 
                 spin_lock(&GlobalMid_Lock);
@@ -723,7 +727,7 @@ multi_t2_fnd:
                         }
                 }
                 spin_unlock(&GlobalMid_Lock);
-                read_unlock(&GlobalSMBSeslock);
+                read_unlock(&cifs_tcp_ses_lock);
                 /* 1/8th of sec is more than enough time for them to exit */
                 msleep(125);
         }
@@ -745,14 +749,13 @@ multi_t2_fnd:
         if there are any pointing to this (e.g
         if a crazy root user tried to kill cifsd
         kernel thread explicitly this might happen) */
-        write_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalSMBSessionList) {
-                ses = list_entry(tmp, struct cifsSesInfo,
-                                cifsSessionList);
-                if (ses->server == server)
-                        ses->server = NULL;
+        /* BB: This shouldn't be necessary, see above */
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &server->smb_ses_list) {
+                ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
+                ses->server = NULL;
         }
-        write_unlock(&GlobalSMBSeslock);
+        read_unlock(&cifs_tcp_ses_lock);
 
         kfree(server->hostname);
         task_to_wake = xchg(&server->tsk, NULL);
@@ -1352,94 +1355,158 @@ cifs_parse_mount_options(char *options, const char *devname,
         return 0;
 }
 
-static struct cifsSesInfo *
-cifs_find_tcp_session(struct in_addr *target_ip_addr,
-                      struct in6_addr *target_ip6_addr,
-                      char *userName, struct TCP_Server_Info **psrvTcp)
+static struct TCP_Server_Info *
+cifs_find_tcp_session(struct sockaddr *addr)
 {
         struct list_head *tmp;
-        struct cifsSesInfo *ses;
-
-        *psrvTcp = NULL;
+        struct TCP_Server_Info *server;
+        struct sockaddr_in *addr4 = (struct sockaddr_in *) addr;
+        struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *) addr;
+
+        write_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &cifs_tcp_ses_list) {
+                server = list_entry(tmp, struct TCP_Server_Info,
+                                    tcp_ses_list);
+                /*
+                 * the demux thread can exit on its own while still in CifsNew
+                 * so don't accept any sockets in that state. Since the
+                 * tcpStatus never changes back to CifsNew it's safe to check
+                 * for this without a lock.
+                 */
+                if (server->tcpStatus == CifsNew)
+                        continue;
 
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalSMBSessionList) {
-                ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
-                if (!ses->server)
+                if (addr->sa_family == AF_INET &&
+                    (addr4->sin_addr.s_addr !=
+                     server->addr.sockAddr.sin_addr.s_addr))
+                        continue;
+                else if (addr->sa_family == AF_INET6 &&
+                         memcmp(&server->addr.sockAddr6.sin6_addr,
+                                &addr6->sin6_addr, sizeof(addr6->sin6_addr)))
                         continue;
 
-                if (target_ip_addr &&
-                    ses->server->addr.sockAddr.sin_addr.s_addr != target_ip_addr->s_addr)
-                                continue;
-                else if (target_ip6_addr &&
-                         memcmp(&ses->server->addr.sockAddr6.sin6_addr,
-                                target_ip6_addr, sizeof(*target_ip6_addr)))
-                                continue;
-                /* BB lock server and tcp session; increment use count here?? */
+                ++server->srv_count;
+                write_unlock(&cifs_tcp_ses_lock);
+                cFYI(1, ("Existing tcp session with server found"));
+                return server;
+        }
+        write_unlock(&cifs_tcp_ses_lock);
+        return NULL;
+}
 
-                /* found a match on the TCP session */
-                *psrvTcp = ses->server;
+static void
+cifs_put_tcp_session(struct TCP_Server_Info *server)
+{
+        struct task_struct *task;
 
-                /* BB check if reconnection needed */
-                if (strncmp(ses->userName, userName, MAX_USERNAME_SIZE) == 0) {
-                        read_unlock(&GlobalSMBSeslock);
-                        /* Found exact match on both TCP and
-                           SMB sessions */
-                        return ses;
-                }
-                /* else tcp and smb sessions need reconnection */
+        write_lock(&cifs_tcp_ses_lock);
+        if (--server->srv_count > 0) {
+                write_unlock(&cifs_tcp_ses_lock);
+                return;
         }
-        read_unlock(&GlobalSMBSeslock);
 
-        return NULL;
+        list_del_init(&server->tcp_ses_list);
+        write_unlock(&cifs_tcp_ses_lock);
+
+        spin_lock(&GlobalMid_Lock);
+        server->tcpStatus = CifsExiting;
+        spin_unlock(&GlobalMid_Lock);
+
+        task = xchg(&server->tsk, NULL);
+        if (task)
+                force_sig(SIGKILL, task);
 }
 
-static struct cifsTconInfo *
-find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
+static struct cifsSesInfo *
+cifs_find_smb_ses(struct TCP_Server_Info *server, char *username)
 {
         struct list_head *tmp;
-        struct cifsTconInfo *tcon;
-        __be32 old_ip;
-
-        read_lock(&GlobalSMBSeslock);
+        struct cifsSesInfo *ses;
 
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                cFYI(1, ("Next tcon"));
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                if (!tcon->ses || !tcon->ses->server)
+        write_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &server->smb_ses_list) {
+                ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
+                if (strncmp(ses->userName, username, MAX_USERNAME_SIZE))
                         continue;
 
-                old_ip = tcon->ses->server->addr.sockAddr.sin_addr.s_addr;
-                cFYI(1, ("old ip addr: %x == new ip %x ?",
-                        old_ip, new_target_ip_addr));
+                ++ses->ses_count;
+                write_unlock(&cifs_tcp_ses_lock);
+                return ses;
+        }
+        write_unlock(&cifs_tcp_ses_lock);
+        return NULL;
+}
 
-                if (old_ip != new_target_ip_addr)
-                        continue;
+static void
+cifs_put_smb_ses(struct cifsSesInfo *ses)
+{
+        int xid;
+        struct TCP_Server_Info *server = ses->server;
 
-                /* BB lock tcon, server, tcp session and increment use count? */
-                /* found a match on the TCP session */
-                /* BB check if reconnection needed */
-                cFYI(1, ("IP match, old UNC: %s new: %s",
-                        tcon->treeName, uncName));
+        write_lock(&cifs_tcp_ses_lock);
+        if (--ses->ses_count > 0) {
+                write_unlock(&cifs_tcp_ses_lock);
+                return;
+        }
 
-                if (strncmp(tcon->treeName, uncName, MAX_TREE_SIZE))
-                        continue;
+        list_del_init(&ses->smb_ses_list);
+        write_unlock(&cifs_tcp_ses_lock);
 
-                cFYI(1, ("and old usr: %s new: %s",
-                        tcon->treeName, uncName));
+        if (ses->status == CifsGood) {
+                xid = GetXid();
+                CIFSSMBLogoff(xid, ses);
+                _FreeXid(xid);
+        }
+        sesInfoFree(ses);
+        cifs_put_tcp_session(server);
+}
 
-                if (strncmp(tcon->ses->userName, userName, MAX_USERNAME_SIZE))
+static struct cifsTconInfo *
+cifs_find_tcon(struct cifsSesInfo *ses, const char *unc)
+{
+        struct list_head *tmp;
+        struct cifsTconInfo *tcon;
+
+        write_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &ses->tcon_list) {
+                tcon = list_entry(tmp, struct cifsTconInfo, tcon_list);
+                if (tcon->tidStatus == CifsExiting)
+                        continue;
+                if (strncmp(tcon->treeName, unc, MAX_TREE_SIZE))
                         continue;
 
-                /* matched smb session (user name) */
-                read_unlock(&GlobalSMBSeslock);
+                ++tcon->tc_count;
+                write_unlock(&cifs_tcp_ses_lock);
                 return tcon;
         }
-
-        read_unlock(&GlobalSMBSeslock);
+        write_unlock(&cifs_tcp_ses_lock);
         return NULL;
 }
 
+static void
+cifs_put_tcon(struct cifsTconInfo *tcon)
+{
+        int xid;
+        struct cifsSesInfo *ses = tcon->ses;
+
+        write_lock(&cifs_tcp_ses_lock);
+        if (--tcon->tc_count > 0) {
+                write_unlock(&cifs_tcp_ses_lock);
+                return;
+        }
+
+        list_del_init(&tcon->tcon_list);
+        write_unlock(&cifs_tcp_ses_lock);
+
+        xid = GetXid();
+        CIFSSMBTDis(xid, tcon);
+        _FreeXid(xid);
+
+        DeleteTconOplockQEntries(tcon);
+        tconInfoFree(tcon);
+        cifs_put_smb_ses(ses);
+}
+
 int
 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
@@ -1876,14 +1943,90 @@ convert_delimiter(char *path, char delim)
         }
 }
 
-static void
-kill_cifsd(struct TCP_Server_Info *server)
+static void setup_cifs_sb(struct smb_vol *pvolume_info,
+                          struct cifs_sb_info *cifs_sb)
 {
-        struct task_struct *task;
-
-        task = xchg(&server->tsk, NULL);
-        if (task)
-                force_sig(SIGKILL, task);
+        if (pvolume_info->rsize > CIFSMaxBufSize) {
+                cERROR(1, ("rsize %d too large, using MaxBufSize",
+                        pvolume_info->rsize));
+                cifs_sb->rsize = CIFSMaxBufSize;
+        } else if ((pvolume_info->rsize) &&
+                        (pvolume_info->rsize <= CIFSMaxBufSize))
+                cifs_sb->rsize = pvolume_info->rsize;
+        else /* default */
+                cifs_sb->rsize = CIFSMaxBufSize;
+
+        if (pvolume_info->wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
+                cERROR(1, ("wsize %d too large, using 4096 instead",
+                          pvolume_info->wsize));
+                cifs_sb->wsize = 4096;
+        } else if (pvolume_info->wsize)
+                cifs_sb->wsize = pvolume_info->wsize;
+        else
+                cifs_sb->wsize = min_t(const int,
+                                        PAGEVEC_SIZE * PAGE_CACHE_SIZE,
+                                        127*1024);
+                /* old default of CIFSMaxBufSize was too small now
+                   that SMB Write2 can send multiple pages in kvec.
+                   RFC1001 does not describe what happens when frame
+                   bigger than 128K is sent so use that as max in
+                   conjunction with 52K kvec constraint on arch with 4K
+                   page size  */
+
+        if (cifs_sb->rsize < 2048) {
+                cifs_sb->rsize = 2048;
+                /* Windows ME may prefer this */
+                cFYI(1, ("readsize set to minimum: 2048"));
+        }
+        /* calculate prepath */
+        cifs_sb->prepath = pvolume_info->prepath;
+        if (cifs_sb->prepath) {
+                cifs_sb->prepathlen = strlen(cifs_sb->prepath);
+                /* we can not convert the / to \ in the path
+                separators in the prefixpath yet because we do not
+                know (until reset_cifs_unix_caps is called later)
+                whether POSIX PATH CAP is available. We normalize
+                the / to \ after reset_cifs_unix_caps is called */
+                pvolume_info->prepath = NULL;
+        } else
+                cifs_sb->prepathlen = 0;
+        cifs_sb->mnt_uid = pvolume_info->linux_uid;
+        cifs_sb->mnt_gid = pvolume_info->linux_gid;
+        cifs_sb->mnt_file_mode = pvolume_info->file_mode;
+        cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
+        cFYI(1, ("file mode: 0x%x  dir mode: 0x%x",
+                cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
+
+        if (pvolume_info->noperm)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
+        if (pvolume_info->setuids)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
+        if (pvolume_info->server_ino)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
+        if (pvolume_info->remap)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
+        if (pvolume_info->no_xattr)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
+        if (pvolume_info->sfu_emul)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
+        if (pvolume_info->nobrl)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
+        if (pvolume_info->cifs_acl)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
+        if (pvolume_info->override_uid)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
+        if (pvolume_info->override_gid)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
+        if (pvolume_info->dynperm)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
+        if (pvolume_info->direct_io) {
+                cFYI(1, ("mounting share using direct i/o"));
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
+        }
+
+        if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
+                cERROR(1, ("mount option dynperm ignored if cifsacl "
+                           "mount option supported"));
 }
 
 int
@@ -1892,13 +2035,12 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 {
         int rc = 0;
         int xid;
-        int address_type = AF_INET;
         struct socket *csocket = NULL;
-        struct sockaddr_in sin_server;
-        struct sockaddr_in6 sin_server6;
+        struct sockaddr addr;
+        struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
+        struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
         struct smb_vol volume_info;
         struct cifsSesInfo *pSesInfo = NULL;
-        struct cifsSesInfo *existingCifsSes = NULL;
         struct cifsTconInfo *tcon = NULL;
         struct TCP_Server_Info *srvTcp = NULL;
 
@@ -1906,6 +2048,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 
 /* cFYI(1, ("Entering cifs_mount. Xid: %d with: %s", xid, mount_data)); */
 
+        memset(&addr, 0, sizeof(struct sockaddr));
         memset(&volume_info, 0, sizeof(struct smb_vol));
         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
                 rc = -EINVAL;
@@ -1928,16 +2071,16 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 
         if (volume_info.UNCip && volume_info.UNC) {
                 rc = cifs_inet_pton(AF_INET, volume_info.UNCip,
-                                    &sin_server.sin_addr.s_addr);
+                                    &sin_server->sin_addr.s_addr);
 
                 if (rc <= 0) {
                         /* not ipv4 address, try ipv6 */
                         rc = cifs_inet_pton(AF_INET6, volume_info.UNCip,
-                                            &sin_server6.sin6_addr.in6_u);
+                                            &sin_server6->sin6_addr.in6_u);
                         if (rc > 0)
-                                address_type = AF_INET6;
+                                addr.sa_family = AF_INET6;
                 } else {
-                        address_type = AF_INET;
+                        addr.sa_family = AF_INET;
                 }
 
                 if (rc <= 0) {
@@ -1977,41 +2120,25 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 }
         }
 
-        if (address_type == AF_INET)
-                existingCifsSes = cifs_find_tcp_session(&sin_server.sin_addr,
-                        NULL /* no ipv6 addr */,
-                        volume_info.username, &srvTcp);
-        else if (address_type == AF_INET6) {
-                cFYI(1, ("looking for ipv6 address"));
-                existingCifsSes = cifs_find_tcp_session(NULL /* no ipv4 addr */,
-                        &sin_server6.sin6_addr,
-                        volume_info.username, &srvTcp);
-        } else {
-                rc = -EINVAL;
-                goto out;
-        }
-
-        if (srvTcp) {
-                cFYI(1, ("Existing tcp session with server found"));
-        } else {        /* create socket */
-                if (volume_info.port)
-                        sin_server.sin_port = htons(volume_info.port);
-                else
-                        sin_server.sin_port = 0;
-                if (address_type == AF_INET6) {
+        srvTcp = cifs_find_tcp_session(&addr);
+        if (!srvTcp) { /* create socket */
+                if (addr.sa_family == AF_INET6) {
                         cFYI(1, ("attempting ipv6 connect"));
                         /* BB should we allow ipv6 on port 139? */
                         /* other OS never observed in Wild doing 139 with v6 */
-                        rc = ipv6_connect(&sin_server6, &csocket,
+                        sin_server6->sin6_port = htons(volume_info.port);
+                        rc = ipv6_connect(sin_server6, &csocket,
                                         volume_info.noblocksnd);
-                } else
-                        rc = ipv4_connect(&sin_server, &csocket,
+                } else {
+                        sin_server->sin_port = htons(volume_info.port);
+                        rc = ipv4_connect(sin_server, &csocket,
                                   volume_info.source_rfc1001_name,
                                   volume_info.target_rfc1001_name,
                                   volume_info.noblocksnd,
                                   volume_info.noautotune);
+                }
                 if (rc < 0) {
-                        cERROR(1, ("Error connecting to IPv4 socket. "
+                        cERROR(1, ("Error connecting to socket. "
                                    "Aborting operation"));
                         if (csocket != NULL)
                                 sock_release(csocket);
@@ -2026,12 +2153,15 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 } else {
                         srvTcp->noblocksnd = volume_info.noblocksnd;
                         srvTcp->noautotune = volume_info.noautotune;
-                        memcpy(&srvTcp->addr.sockAddr, &sin_server,
-                                sizeof(struct sockaddr_in));
+                        if (addr.sa_family == AF_INET6)
+                                memcpy(&srvTcp->addr.sockAddr6, sin_server6,
+                                        sizeof(struct sockaddr_in6));
+                        else
+                                memcpy(&srvTcp->addr.sockAddr, sin_server,
+                                        sizeof(struct sockaddr_in));
                         atomic_set(&srvTcp->inFlight, 0);
                         /* BB Add code for ipv6 case too */
                         srvTcp->ssocket = csocket;
-                        srvTcp->protocolType = IPV4;
                         srvTcp->hostname = extract_hostname(volume_info.UNC);
                         if (IS_ERR(srvTcp->hostname)) {
                                 rc = PTR_ERR(srvTcp->hostname);
@@ -2061,15 +2191,28 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                         memcpy(srvTcp->server_RFC1001_name,
                                 volume_info.target_rfc1001_name, 16);
                         srvTcp->sequence_number = 0;
+                        INIT_LIST_HEAD(&srvTcp->tcp_ses_list);
+                        INIT_LIST_HEAD(&srvTcp->smb_ses_list);
+                        ++srvTcp->srv_count;
+                        write_lock(&cifs_tcp_ses_lock);
+                        list_add(&srvTcp->tcp_ses_list,
+                                 &cifs_tcp_ses_list);
+                        write_unlock(&cifs_tcp_ses_lock);
                 }
         }
 
-        if (existingCifsSes) {
-                pSesInfo = existingCifsSes;
+        pSesInfo = cifs_find_smb_ses(srvTcp, volume_info.username);
+        if (pSesInfo) {
                 cFYI(1, ("Existing smb sess found (status=%d)",
                         pSesInfo->status));
+                /*
+                 * The existing SMB session already has a reference to srvTcp,
+                 * so we can put back the extra one we got before
+                 */
+                cifs_put_tcp_session(srvTcp);
+
                 down(&pSesInfo->sesSem);
-                if (pSesInfo->status == CifsNeedReconnect) {
+                if (pSesInfo->need_reconnect) {
                         cFYI(1, ("Session needs reconnect"));
                         rc = cifs_setup_session(xid, pSesInfo,
                                                 cifs_sb->local_nls);
@@ -2078,187 +2221,101 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         } else if (!rc) {
                 cFYI(1, ("Existing smb sess not found"));
                 pSesInfo = sesInfoAlloc();
-                if (pSesInfo == NULL)
+                if (pSesInfo == NULL) {
                         rc = -ENOMEM;
-                else {
-                        pSesInfo->server = srvTcp;
-                        sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
-                                NIPQUAD(sin_server.sin_addr.s_addr));
-                }
+                        goto mount_fail_check;
+                }
+
+                /* new SMB session uses our srvTcp ref */
+                pSesInfo->server = srvTcp;
+                sprintf(pSesInfo->serverName, "%u.%u.%u.%u",
+                        NIPQUAD(sin_server->sin_addr.s_addr));
+
+                write_lock(&cifs_tcp_ses_lock);
+                list_add(&pSesInfo->smb_ses_list, &srvTcp->smb_ses_list);
+                write_unlock(&cifs_tcp_ses_lock);
+
+                /* volume_info.password freed at unmount */
+                if (volume_info.password) {
+                        pSesInfo->password = volume_info.password;
+                        /* set to NULL to prevent freeing on exit */
+                        volume_info.password = NULL;
+                }
+                if (volume_info.username)
+                        strncpy(pSesInfo->userName, volume_info.username,
+                                MAX_USERNAME_SIZE);
+                if (volume_info.domainname) {
+                        int len = strlen(volume_info.domainname);
+                        pSesInfo->domainName = kmalloc(len + 1, GFP_KERNEL);
+                        if (pSesInfo->domainName)
+                                strcpy(pSesInfo->domainName,
+                                        volume_info.domainname);
+                }
+                pSesInfo->linux_uid = volume_info.linux_uid;
+                pSesInfo->overrideSecFlg = volume_info.secFlg;
+                down(&pSesInfo->sesSem);
 
-                if (!rc) {
-                        /* volume_info.password freed at unmount */
-                        if (volume_info.password) {
-                                pSesInfo->password = volume_info.password;
-                                /* set to NULL to prevent freeing on exit */
-                                volume_info.password = NULL;
-                        }
-                        if (volume_info.username)
-                                strncpy(pSesInfo->userName,
-                                        volume_info.username,
-                                        MAX_USERNAME_SIZE);
-                        if (volume_info.domainname) {
-                                int len = strlen(volume_info.domainname);
-                                pSesInfo->domainName =
-                                        kmalloc(len + 1, GFP_KERNEL);
-                                if (pSesInfo->domainName)
-                                        strcpy(pSesInfo->domainName,
-                                                volume_info.domainname);
-                        }
-                        pSesInfo->linux_uid = volume_info.linux_uid;
-                        pSesInfo->overrideSecFlg = volume_info.secFlg;
-                        down(&pSesInfo->sesSem);
-                        /* BB FIXME need to pass vol->secFlgs BB */
-                        rc = cifs_setup_session(xid, pSesInfo,
-                                                cifs_sb->local_nls);
-                        up(&pSesInfo->sesSem);
-                        if (!rc)
-                                atomic_inc(&srvTcp->socketUseCount);
-                }
+                /* BB FIXME need to pass vol->secFlgs BB */
+                rc = cifs_setup_session(xid, pSesInfo,
+                                        cifs_sb->local_nls);
+                up(&pSesInfo->sesSem);
         }
 
         /* search for existing tcon to this server share */
         if (!rc) {
-                if (volume_info.rsize > CIFSMaxBufSize) {
-                        cERROR(1, ("rsize %d too large, using MaxBufSize",
-                                volume_info.rsize));
-                        cifs_sb->rsize = CIFSMaxBufSize;
-                } else if ((volume_info.rsize) &&
-                                (volume_info.rsize <= CIFSMaxBufSize))
-                        cifs_sb->rsize = volume_info.rsize;
-                else /* default */
-                        cifs_sb->rsize = CIFSMaxBufSize;
-
-                if (volume_info.wsize > PAGEVEC_SIZE * PAGE_CACHE_SIZE) {
-                        cERROR(1, ("wsize %d too large, using 4096 instead",
-                                  volume_info.wsize));
-                        cifs_sb->wsize = 4096;
-                } else if (volume_info.wsize)
-                        cifs_sb->wsize = volume_info.wsize;
-                else
-                        cifs_sb->wsize =
-                                min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
-                                        127*1024);
-                        /* old default of CIFSMaxBufSize was too small now
-                           that SMB Write2 can send multiple pages in kvec.
-                           RFC1001 does not describe what happens when frame
-                           bigger than 128K is sent so use that as max in
-                           conjunction with 52K kvec constraint on arch with 4K
-                           page size  */
-
-                if (cifs_sb->rsize < 2048) {
-                        cifs_sb->rsize = 2048;
-                        /* Windows ME may prefer this */
-                        cFYI(1, ("readsize set to minimum: 2048"));
-                }
-                /* calculate prepath */
-                cifs_sb->prepath = volume_info.prepath;
-                if (cifs_sb->prepath) {
-                        cifs_sb->prepathlen = strlen(cifs_sb->prepath);
-                        /* we can not convert the / to \ in the path
-                        separators in the prefixpath yet because we do not
-                        know (until reset_cifs_unix_caps is called later)
-                        whether POSIX PATH CAP is available. We normalize
-                        the / to \ after reset_cifs_unix_caps is called */
-                        volume_info.prepath = NULL;
-                } else
-                        cifs_sb->prepathlen = 0;
-                cifs_sb->mnt_uid = volume_info.linux_uid;
-                cifs_sb->mnt_gid = volume_info.linux_gid;
-                cifs_sb->mnt_file_mode = volume_info.file_mode;
-                cifs_sb->mnt_dir_mode = volume_info.dir_mode;
-                cFYI(1, ("file mode: 0x%x  dir mode: 0x%x",
-                        cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode));
-
-                if (volume_info.noperm)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
-                if (volume_info.setuids)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
-                if (volume_info.server_ino)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
-                if (volume_info.remap)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
-                if (volume_info.no_xattr)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
-                if (volume_info.sfu_emul)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_UNX_EMUL;
-                if (volume_info.nobrl)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_BRL;
-                if (volume_info.cifs_acl)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
-                if (volume_info.override_uid)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
-                if (volume_info.override_gid)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
-                if (volume_info.dynperm)
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
-                if (volume_info.direct_io) {
-                        cFYI(1, ("mounting share using direct i/o"));
-                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
-                }
+                setup_cifs_sb(&volume_info, cifs_sb);
 
-                if ((volume_info.cifs_acl) && (volume_info.dynperm))
-                        cERROR(1, ("mount option dynperm ignored if cifsacl "
-                                   "mount option supported"));
-
-                tcon =
-                    find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
-                             volume_info.username);
+                tcon = cifs_find_tcon(pSesInfo, volume_info.UNC);
                 if (tcon) {
                         cFYI(1, ("Found match on UNC path"));
-                        /* we can have only one retry value for a connection
-                           to a share so for resources mounted more than once
-                           to the same server share the last value passed in
-                           for the retry flag is used */
-                        tcon->retry = volume_info.retry;
-                        tcon->nocase = volume_info.nocase;
-                        tcon->local_lease = volume_info.local_lease;
+                        /* existing tcon already has a reference */
+                        cifs_put_smb_ses(pSesInfo);
                         if (tcon->seal != volume_info.seal)
                                 cERROR(1, ("transport encryption setting "
                                            "conflicts with existing tid"));
                 } else {
                         tcon = tconInfoAlloc();
-                        if (tcon == NULL)
+                        if (tcon == NULL) {
                                 rc = -ENOMEM;
-                        else {
-                                /* check for null share name ie connecting to
-                                 * dfs root */
-
-                                /* BB check if this works for exactly length
-                                 * three strings */
-                                if ((strchr(volume_info.UNC + 3, '\\') == NULL)
-                                    && (strchr(volume_info.UNC + 3, '/') ==
-                                        NULL)) {
-/*                                      rc = connect_to_dfs_path(xid, pSesInfo,
-                                                "", cifs_sb->local_nls,
-                                                cifs_sb->mnt_cifs_flags &
-                                                  CIFS_MOUNT_MAP_SPECIAL_CHR);*/
-                                        cFYI(1, ("DFS root not supported"));
-                                        rc = -ENODEV;
-                                        goto out;
-                                } else {
-                                        /* BB Do we need to wrap sesSem around
-                                         * this TCon call and Unix SetFS as
-                                         * we do on SessSetup and reconnect? */
-                                        rc = CIFSTCon(xid, pSesInfo,
-                                                volume_info.UNC,
-                                                tcon, cifs_sb->local_nls);
-                                        cFYI(1, ("CIFS Tcon rc = %d", rc));
-                                        if (volume_info.nodfs) {
-                                                tcon->Flags &=
-                                                        ~SMB_SHARE_IS_IN_DFS;
-                                                cFYI(1, ("DFS disabled (%d)",
-                                                        tcon->Flags));
-                                        }
-                                }
-                                if (!rc) {
-                                        atomic_inc(&pSesInfo->inUse);
-                                        tcon->retry = volume_info.retry;
-                                        tcon->nocase = volume_info.nocase;
-                                        tcon->seal = volume_info.seal;
+                                goto mount_fail_check;
+                        }
+                        tcon->ses = pSesInfo;
+
+                        /* check for null share name ie connect to dfs root */
+                        if ((strchr(volume_info.UNC + 3, '\\') == NULL)
+                            && (strchr(volume_info.UNC + 3, '/') == NULL)) {
+                                /* rc = connect_to_dfs_path(...) */
+                                cFYI(1, ("DFS root not supported"));
+                                rc = -ENODEV;
+                                goto mount_fail_check;
+                        } else {
+                                /* BB Do we need to wrap sesSem around
+                                 * this TCon call and Unix SetFS as
+                                 * we do on SessSetup and reconnect? */
+                                rc = CIFSTCon(xid, pSesInfo, volume_info.UNC,
+                                              tcon, cifs_sb->local_nls);
+                                cFYI(1, ("CIFS Tcon rc = %d", rc));
+                                if (volume_info.nodfs) {
+                                        tcon->Flags &= ~SMB_SHARE_IS_IN_DFS;
+                                        cFYI(1, ("DFS disabled (%d)",
+                                                tcon->Flags));
                                 }
                         }
-                }
+                        if (rc)
+                                goto mount_fail_check;
+                        tcon->seal = volume_info.seal;
+                        write_lock(&cifs_tcp_ses_lock);
+                        list_add(&tcon->tcon_list, &pSesInfo->tcon_list);
+                        write_unlock(&cifs_tcp_ses_lock);
+                }
+
+                /* we can have only one retry value for a connection
+                   to a share so for resources mounted more than once
+                   to the same server share the last value passed in
+                   for the retry flag is used */
+                tcon->retry = volume_info.retry;
+                tcon->nocase = volume_info.nocase;
+                tcon->local_lease = volume_info.local_lease;
         }
         if (pSesInfo) {
                 if (pSesInfo->capabilities & CAP_LARGE_FILES) {
@@ -2270,80 +2327,49 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
         sb->s_time_gran = 100;
 
-/* on error free sesinfo and tcon struct if needed */
+mount_fail_check:
+        /* on error free sesinfo and tcon struct if needed */
         if (rc) {
-                /* if session setup failed, use count is zero but
-                we still need to free cifsd thread */
-                if (atomic_read(&srvTcp->socketUseCount) == 0) {
-                        spin_lock(&GlobalMid_Lock);
-                        srvTcp->tcpStatus = CifsExiting;
-                        spin_unlock(&GlobalMid_Lock);
-                        kill_cifsd(srvTcp);
-                }
-                 /* If find_unc succeeded then rc == 0 so we can not end */
-                if (tcon)  /* up accidently freeing someone elses tcon struct */
-                        tconInfoFree(tcon);
-                if (existingCifsSes == NULL) {
-                        if (pSesInfo) {
-                                if ((pSesInfo->server) &&
-                                    (pSesInfo->status == CifsGood)) {
-                                        int temp_rc;
-                                        temp_rc = CIFSSMBLogoff(xid, pSesInfo);
-                                        /* if the socketUseCount is now zero */
-                                        if ((temp_rc == -ESHUTDOWN) &&
-                                            (pSesInfo->server))
-                                                kill_cifsd(pSesInfo->server);
-                                } else {
-                                        cFYI(1, ("No session or bad tcon"));
-                                        if (pSesInfo->server) {
-                                                spin_lock(&GlobalMid_Lock);
-                                                srvTcp->tcpStatus = CifsExiting;
-                                                spin_unlock(&GlobalMid_Lock);
-                                                kill_cifsd(pSesInfo->server);
-                                        }
-                                }
-                                sesInfoFree(pSesInfo);
-                                /* pSesInfo = NULL; */
-                        }
-                }
-        } else {
-                atomic_inc(&tcon->useCount);
-                cifs_sb->tcon = tcon;
-                tcon->ses = pSesInfo;
-
-                /* do not care if following two calls succeed - informational */
-                if (!tcon->ipc) {
-                        CIFSSMBQFSDeviceInfo(xid, tcon);
-                        CIFSSMBQFSAttributeInfo(xid, tcon);
-                }
-
-                /* tell server which Unix caps we support */
-                if (tcon->ses->capabilities & CAP_UNIX)
-                        /* reset of caps checks mount to see if unix extensions
-                           disabled for just this mount */
-                        reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
+                /* If find_unc succeeded then rc == 0 so we can not end */
+                /* up accidently freeing someone elses tcon struct */
+                if (tcon)
+                        cifs_put_tcon(tcon);
+                else if (pSesInfo)
+                        cifs_put_smb_ses(pSesInfo);
                 else
-                        tcon->unix_ext = 0; /* server does not support them */
+                        cifs_put_tcp_session(srvTcp);
+                goto out;
+        }
+        cifs_sb->tcon = tcon;
 
-                /* convert forward to back slashes in prepath here if needed */
-                if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
-                        convert_delimiter(cifs_sb->prepath,
-                                          CIFS_DIR_SEP(cifs_sb));
+        /* do not care if following two calls succeed - informational */
+        if (!tcon->ipc) {
+                CIFSSMBQFSDeviceInfo(xid, tcon);
+                CIFSSMBQFSAttributeInfo(xid, tcon);
+        }
 
-                if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
-                        cifs_sb->rsize = 1024 * 127;
-                        cFYI(DBG2,
-                                ("no very large read support, rsize now 127K"));
-                }
-                if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
-                        cifs_sb->wsize = min(cifs_sb->wsize,
-                                             (tcon->ses->server->maxBuf -
-                                              MAX_CIFS_HDR_SIZE));
-                if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
-                        cifs_sb->rsize = min(cifs_sb->rsize,
-                                             (tcon->ses->server->maxBuf -
-                                              MAX_CIFS_HDR_SIZE));
+        /* tell server which Unix caps we support */
+        if (tcon->ses->capabilities & CAP_UNIX)
+                /* reset of caps checks mount to see if unix extensions
+                   disabled for just this mount */
+                reset_cifs_unix_caps(xid, tcon, sb, &volume_info);
+        else
+                tcon->unix_ext = 0; /* server does not support them */
+
+        /* convert forward to back slashes in prepath here if needed */
+        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
+                convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb));
+
+        if ((tcon->unix_ext == 0) && (cifs_sb->rsize > (1024 * 127))) {
+                cifs_sb->rsize = 1024 * 127;
+                cFYI(DBG2, ("no very large read support, rsize now 127K"));
         }
+        if (!(tcon->ses->capabilities & CAP_LARGE_WRITE_X))
+                cifs_sb->wsize = min(cifs_sb->wsize,
+                               (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
+        if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
+                cifs_sb->rsize = min(cifs_sb->rsize,
+                               (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
 
         /* volume_info.password is freed above when existing session found
         (in which case it is not needed anymore) but when new sesion is created
@@ -3513,6 +3539,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
         /* above now done in SendReceive */
         if ((rc == 0) && (tcon != NULL)) {
                 tcon->tidStatus = CifsGood;
+                tcon->need_reconnect = false;
                 tcon->tid = smb_buffer_response->Tid;
                 bcc_ptr = pByteArea(smb_buffer_response);
                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
@@ -3584,48 +3611,17 @@ int
 cifs_umount(struct super_block *sb, struct cifs_sb_info *cifs_sb)
 {
         int rc = 0;
-        int xid;
-        struct cifsSesInfo *ses = NULL;
         char *tmp;
 
-        xid = GetXid();
-
-        if (cifs_sb->tcon) {
-                ses = cifs_sb->tcon->ses; /* save ptr to ses before delete tcon!*/
-                rc = CIFSSMBTDis(xid, cifs_sb->tcon);
-                if (rc == -EBUSY) {
-                        FreeXid(xid);
-                        return 0;
-                }
-                DeleteTconOplockQEntries(cifs_sb->tcon);
-                tconInfoFree(cifs_sb->tcon);
-                if ((ses) && (ses->server)) {
-                        /* save off task so we do not refer to ses later */
-                        cFYI(1, ("About to do SMBLogoff "));
-                        rc = CIFSSMBLogoff(xid, ses);
-                        if (rc == -EBUSY) {
-                                FreeXid(xid);
-                                return 0;
-                        } else if (rc == -ESHUTDOWN) {
-                                cFYI(1, ("Waking up socket by sending signal"));
-                                if (ses->server)
-                                        kill_cifsd(ses->server);
-                                rc = 0;
-                        } /* else - we have an smb session
-                                left on this socket do not kill cifsd */
-                } else
-                        cFYI(1, ("No session or bad tcon"));
-        }
+        if (cifs_sb->tcon)
+                cifs_put_tcon(cifs_sb->tcon);
 
         cifs_sb->tcon = NULL;
         tmp = cifs_sb->prepath;
         cifs_sb->prepathlen = 0;
         cifs_sb->prepath = NULL;
         kfree(tmp);
-        if (ses)
-                sesInfoFree(ses);
 
-        FreeXid(xid);
         return rc;
 }
 
@@ -3741,6 +3737,7 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                 cFYI(1, ("CIFS Session Established successfully"));
                         spin_lock(&GlobalMid_Lock);
                         pSesInfo->status = CifsGood;
+                        pSesInfo->need_reconnect = false;
                         spin_unlock(&GlobalMid_Lock);
         }
 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index ead1a3bb0256..b691b893a848 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -488,12 +488,13 @@ int cifs_close(struct inode *inode, struct file *file)
         pTcon = cifs_sb->tcon;
         if (pSMBFile) {
                 struct cifsLockInfo *li, *tmp;
-
+                write_lock(&GlobalSMBSeslock);
                 pSMBFile->closePend = true;
                 if (pTcon) {
                         /* no sense reconnecting to close a file that is
                            already closed */
-                        if (pTcon->tidStatus != CifsNeedReconnect) {
+                        if (!pTcon->need_reconnect) {
+                                write_unlock(&GlobalSMBSeslock);
                                 timeout = 2;
                                 while ((atomic_read(&pSMBFile->wrtPending) != 0)
                                         && (timeout <= 2048)) {
@@ -510,12 +511,15 @@ int cifs_close(struct inode *inode, struct file *file)
                                         timeout *= 4;
                                 }
                                 if (atomic_read(&pSMBFile->wrtPending))
-                                        cERROR(1,
-                                                ("close with pending writes"));
-                                rc = CIFSSMBClose(xid, pTcon,
+                                        cERROR(1, ("close with pending write"));
+                                if (!pTcon->need_reconnect &&
+                                    !pSMBFile->invalidHandle)
+                                        rc = CIFSSMBClose(xid, pTcon,
                                                   pSMBFile->netfid);
-                        }
-                }
+                        } else
+                                write_unlock(&GlobalSMBSeslock);
+                } else
+                        write_unlock(&GlobalSMBSeslock);
 
                 /* Delete any outstanding lock records.
                    We'll lose them when the file is closed anyway. */
@@ -587,15 +591,18 @@ int cifs_closedir(struct inode *inode, struct file *file)
                 pTcon = cifs_sb->tcon;
 
                 cFYI(1, ("Freeing private data in close dir"));
+                write_lock(&GlobalSMBSeslock);
                 if (!pCFileStruct->srch_inf.endOfSearch &&
                     !pCFileStruct->invalidHandle) {
                         pCFileStruct->invalidHandle = true;
+                        write_unlock(&GlobalSMBSeslock);
                         rc = CIFSFindClose(xid, pTcon, pCFileStruct->netfid);
                         cFYI(1, ("Closing uncompleted readdir with rc %d",
                                  rc));
                         /* not much we can do if it fails anyway, ignore rc */
                         rc = 0;
-                }
+                } else
+                        write_unlock(&GlobalSMBSeslock);
                 ptmp = pCFileStruct->srch_inf.ntwrk_buf_start;
                 if (ptmp) {
                         cFYI(1, ("closedir free smb buf in srch struct"));
@@ -1404,7 +1411,10 @@ retry:
                         if ((wbc->nr_to_write -= n_iov) <= 0)
                                 done = 1;
                         index = next;
-                }
+                } else
+                        /* Need to re-find the pages we skipped */
+                        index = pvec.pages[0]->index + 1;
+
                 pagevec_release(&pvec);
         }
         if (!scanned && !done) {
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 88786ba02d27..9ee3f689c2b0 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -75,12 +75,12 @@ sesInfoAlloc(void)
 
         ret_buf = kzalloc(sizeof(struct cifsSesInfo), GFP_KERNEL);
         if (ret_buf) {
-                write_lock(&GlobalSMBSeslock);
                 atomic_inc(&sesInfoAllocCount);
                 ret_buf->status = CifsNew;
-                list_add(&ret_buf->cifsSessionList, &GlobalSMBSessionList);
+                ++ret_buf->ses_count;
+                INIT_LIST_HEAD(&ret_buf->smb_ses_list);
+                INIT_LIST_HEAD(&ret_buf->tcon_list);
                 init_MUTEX(&ret_buf->sesSem);
-                write_unlock(&GlobalSMBSeslock);
         }
         return ret_buf;
 }
@@ -93,10 +93,7 @@ sesInfoFree(struct cifsSesInfo *buf_to_free)
                 return;
         }
 
-        write_lock(&GlobalSMBSeslock);
         atomic_dec(&sesInfoAllocCount);
-        list_del(&buf_to_free->cifsSessionList);
-        write_unlock(&GlobalSMBSeslock);
         kfree(buf_to_free->serverOS);
         kfree(buf_to_free->serverDomain);
         kfree(buf_to_free->serverNOS);
@@ -111,17 +108,14 @@ tconInfoAlloc(void)
         struct cifsTconInfo *ret_buf;
         ret_buf = kzalloc(sizeof(struct cifsTconInfo), GFP_KERNEL);
         if (ret_buf) {
-                write_lock(&GlobalSMBSeslock);
                 atomic_inc(&tconInfoAllocCount);
-                list_add(&ret_buf->cifsConnectionList,
-                         &GlobalTreeConnectionList);
                 ret_buf->tidStatus = CifsNew;
+                ++ret_buf->tc_count;
                 INIT_LIST_HEAD(&ret_buf->openFileList);
-                init_MUTEX(&ret_buf->tconSem);
+                INIT_LIST_HEAD(&ret_buf->tcon_list);
 #ifdef CONFIG_CIFS_STATS
                 spin_lock_init(&ret_buf->stat_lock);
 #endif
-                write_unlock(&GlobalSMBSeslock);
         }
         return ret_buf;
 }
@@ -133,10 +127,7 @@ tconInfoFree(struct cifsTconInfo *buf_to_free)
                 cFYI(1, ("Null buffer passed to tconInfoFree"));
                 return;
         }
-        write_lock(&GlobalSMBSeslock);
         atomic_dec(&tconInfoAllocCount);
-        list_del(&buf_to_free->cifsConnectionList);
-        write_unlock(&GlobalSMBSeslock);
         kfree(buf_to_free->nativeFileSystem);
         kfree(buf_to_free);
 }
@@ -350,9 +341,9 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
                                 if (current->fsuid != treeCon->ses->linux_uid) {
                                         cFYI(1, ("Multiuser mode and UID "
                                                  "did not match tcon uid"));
-                                        read_lock(&GlobalSMBSeslock);
-                                        list_for_each(temp_item, &GlobalSMBSessionList) {
-                                                ses = list_entry(temp_item, struct cifsSesInfo, cifsSessionList);
+                                        read_lock(&cifs_tcp_ses_lock);
+                                        list_for_each(temp_item, &treeCon->ses->server->smb_ses_list) {
+                                                ses = list_entry(temp_item, struct cifsSesInfo, smb_ses_list);
                                                 if (ses->linux_uid == current->fsuid) {
                                                         if (ses->server == treeCon->ses->server) {
                                                                 cFYI(1, ("found matching uid substitute right smb_uid"));
@@ -364,7 +355,7 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
                                                         }
                                                 }
                                         }
-                                        read_unlock(&GlobalSMBSeslock);
+                                        read_unlock(&cifs_tcp_ses_lock);
                                 }
                         }
                 }
@@ -497,9 +488,10 @@ bool
 is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
 {
         struct smb_com_lock_req *pSMB = (struct smb_com_lock_req *)buf;
-        struct list_head *tmp;
-        struct list_head *tmp1;
+        struct list_head *tmp, *tmp1, *tmp2;
+        struct cifsSesInfo *ses;
         struct cifsTconInfo *tcon;
+        struct cifsInodeInfo *pCifsInode;
         struct cifsFileInfo *netfile;
 
         cFYI(1, ("Checking for oplock break or dnotify response"));
@@ -554,42 +546,45 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
                 return false;
 
         /* look up tcon based on tid & uid */
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &GlobalTreeConnectionList) {
-                tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                if ((tcon->tid == buf->Tid) && (srv == tcon->ses->server)) {
+        read_lock(&cifs_tcp_ses_lock);
+        list_for_each(tmp, &srv->smb_ses_list) {
+                ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
+                list_for_each(tmp1, &ses->tcon_list) {
+                        tcon = list_entry(tmp1, struct cifsTconInfo, tcon_list);
+                        if (tcon->tid != buf->Tid)
+                                continue;
+
                         cifs_stats_inc(&tcon->num_oplock_brks);
-                        list_for_each(tmp1, &tcon->openFileList) {
-                                netfile = list_entry(tmp1, struct cifsFileInfo,
+                        write_lock(&GlobalSMBSeslock);
+                        list_for_each(tmp2, &tcon->openFileList) {
+                                netfile = list_entry(tmp2, struct cifsFileInfo,
                                                      tlist);
-                                if (pSMB->Fid == netfile->netfid) {
-                                        struct cifsInodeInfo *pCifsInode;
-                                        read_unlock(&GlobalSMBSeslock);
-                                        cFYI(1,
-                                            ("file id match, oplock break"));
-                                        pCifsInode =
-                                                CIFS_I(netfile->pInode);
-                                        pCifsInode->clientCanCacheAll = false;
-                                        if (pSMB->OplockLevel == 0)
-                                                pCifsInode->clientCanCacheRead
-                                                        = false;
-                                        pCifsInode->oplockPending = true;
-                                        AllocOplockQEntry(netfile->pInode,
-                                                          netfile->netfid,
-                                                          tcon);
-                                        cFYI(1,
-                                            ("about to wake up oplock thread"));
-                                        if (oplockThread)
-                                            wake_up_process(oplockThread);
-                                        return true;
-                                }
+                                if (pSMB->Fid != netfile->netfid)
+                                        continue;
+
+                                write_unlock(&GlobalSMBSeslock);
+                                read_unlock(&cifs_tcp_ses_lock);
+                                cFYI(1, ("file id match, oplock break"));
+                                pCifsInode = CIFS_I(netfile->pInode);
+                                pCifsInode->clientCanCacheAll = false;
+                                if (pSMB->OplockLevel == 0)
+                                        pCifsInode->clientCanCacheRead = false;
+                                pCifsInode->oplockPending = true;
+                                AllocOplockQEntry(netfile->pInode,
+                                                  netfile->netfid, tcon);
+                                cFYI(1, ("about to wake up oplock thread"));
+                                if (oplockThread)
+                                        wake_up_process(oplockThread);
+
+                                return true;
                         }
-                        read_unlock(&GlobalSMBSeslock);
+                        write_unlock(&GlobalSMBSeslock);
+                        read_unlock(&cifs_tcp_ses_lock);
                         cFYI(1, ("No matching file for oplock break"));
                         return true;
                 }
         }
-        read_unlock(&GlobalSMBSeslock);
+        read_unlock(&cifs_tcp_ses_lock);
         cFYI(1, ("Can not process oplock break for non-existent connection"));
         return true;
 }
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 58d57299f2a0..9f51f9bf0292 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -741,11 +741,14 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
            (index_to_find < first_entry_in_buffer)) {
                 /* close and restart search */
                 cFYI(1, ("search backing up - close and restart search"));
+                write_lock(&GlobalSMBSeslock);
                 if (!cifsFile->srch_inf.endOfSearch &&
                     !cifsFile->invalidHandle) {
                         cifsFile->invalidHandle = true;
+                        write_unlock(&GlobalSMBSeslock);
                         CIFSFindClose(xid, pTcon, cifsFile->netfid);
-                }
+                } else
+                        write_unlock(&GlobalSMBSeslock);
                 if (cifsFile->srch_inf.ntwrk_buf_start) {
                         cFYI(1, ("freeing SMB ff cache buf on search rewind"));
                         if (cifsFile->srch_inf.smallBuf)
diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index d910501de6d2..8d86b7960f0d 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -812,7 +812,7 @@ int dlm_release_lockspace(void *lockspace, int force)
         error = release_lockspace(ls, force);
         if (!error)
                 ls_count--;
-        else if (!ls_count)
+        if (!ls_count)
                 threads_stop();
         mutex_unlock(&ls_lock);
 
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index e22bc3961345..0d713b691941 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1037,17 +1037,14 @@ static int
 decrypt_passphrase_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
                                          struct ecryptfs_crypt_stat *crypt_stat)
 {
-        struct scatterlist dst_sg;
-        struct scatterlist src_sg;
+        struct scatterlist dst_sg[2];
+        struct scatterlist src_sg[2];
         struct mutex *tfm_mutex;
         struct blkcipher_desc desc = {
                 .flags = CRYPTO_TFM_REQ_MAY_SLEEP
         };
         int rc = 0;
 
-        sg_init_table(&dst_sg, 1);
-        sg_init_table(&src_sg, 1);
-
         if (unlikely(ecryptfs_verbosity > 0)) {
                 ecryptfs_printk(
                         KERN_DEBUG, "Session key encryption key (size [%d]):\n",
@@ -1066,8 +1063,8 @@ decrypt_passphrase_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
         }
         rc = virt_to_scatterlist(auth_tok->session_key.encrypted_key,
                                  auth_tok->session_key.encrypted_key_size,
-                                 &src_sg, 1);
-        if (rc != 1) {
+                                 src_sg, 2);
+        if (rc < 1 || rc > 2) {
                 printk(KERN_ERR "Internal error whilst attempting to convert "
                         "auth_tok->session_key.encrypted_key to scatterlist; "
                         "expected rc = 1; got rc = [%d]. "
@@ -1079,8 +1076,8 @@ decrypt_passphrase_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
                 auth_tok->session_key.encrypted_key_size;
         rc = virt_to_scatterlist(auth_tok->session_key.decrypted_key,
                                  auth_tok->session_key.decrypted_key_size,
-                                 &dst_sg, 1);
-        if (rc != 1) {
+                                 dst_sg, 2);
+        if (rc < 1 || rc > 2) {
                 printk(KERN_ERR "Internal error whilst attempting to convert "
                         "auth_tok->session_key.decrypted_key to scatterlist; "
                         "expected rc = 1; got rc = [%d]\n", rc);
@@ -1096,7 +1093,7 @@ decrypt_passphrase_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
                 rc = -EINVAL;
                 goto out;
         }
-        rc = crypto_blkcipher_decrypt(&desc, &dst_sg, &src_sg,
+        rc = crypto_blkcipher_decrypt(&desc, dst_sg, src_sg,
                                       auth_tok->session_key.encrypted_key_size);
         mutex_unlock(tfm_mutex);
         if (unlikely(rc)) {
@@ -1539,8 +1536,8 @@ write_tag_3_packet(char *dest, size_t *remaining_bytes,
         size_t i;
         size_t encrypted_session_key_valid = 0;
         char session_key_encryption_key[ECRYPTFS_MAX_KEY_BYTES];
-        struct scatterlist dst_sg;
-        struct scatterlist src_sg;
+        struct scatterlist dst_sg[2];
+        struct scatterlist src_sg[2];
         struct mutex *tfm_mutex = NULL;
         u8 cipher_code;
         size_t packet_size_length;
@@ -1619,8 +1616,8 @@ write_tag_3_packet(char *dest, size_t *remaining_bytes,
                 ecryptfs_dump_hex(session_key_encryption_key, 16);
         }
         rc = virt_to_scatterlist(crypt_stat->key, key_rec->enc_key_size,
-                                 &src_sg, 1);
-        if (rc != 1) {
+                                 src_sg, 2);
+        if (rc < 1 || rc > 2) {
                 ecryptfs_printk(KERN_ERR, "Error generating scatterlist "
                                 "for crypt_stat session key; expected rc = 1; "
                                 "got rc = [%d]. key_rec->enc_key_size = [%d]\n",
@@ -1629,8 +1626,8 @@ write_tag_3_packet(char *dest, size_t *remaining_bytes,
                 goto out;
         }
         rc = virt_to_scatterlist(key_rec->enc_key, key_rec->enc_key_size,
-                                 &dst_sg, 1);
-        if (rc != 1) {
+                                 dst_sg, 2);
+        if (rc < 1 || rc > 2) {
                 ecryptfs_printk(KERN_ERR, "Error generating scatterlist "
                                 "for crypt_stat encrypted session key; "
                                 "expected rc = 1; got rc = [%d]. "
@@ -1651,7 +1648,7 @@ write_tag_3_packet(char *dest, size_t *remaining_bytes,
         rc = 0;
         ecryptfs_printk(KERN_DEBUG, "Encrypting [%d] bytes of the key\n",
                         crypt_stat->key_size);
-        rc = crypto_blkcipher_encrypt(&desc, &dst_sg, &src_sg,
+        rc = crypto_blkcipher_encrypt(&desc, dst_sg, src_sg,
                                       (*key_rec).enc_key_size);
         mutex_unlock(tfm_mutex);
         if (rc) {
diff --git a/fs/hostfs/hostfs.h b/fs/hostfs/hostfs.h
index 6ae9011b95eb..2f34f8f2134b 100644
--- a/fs/hostfs/hostfs.h
+++ b/fs/hostfs/hostfs.h
@@ -81,7 +81,7 @@ extern int do_rmdir(const char *file);
 extern int do_mknod(const char *file, int mode, unsigned int major,
                     unsigned int minor);
 extern int link_file(const char *from, const char *to);
-extern int do_readlink(char *file, char *buf, int size);
+extern int hostfs_do_readlink(char *file, char *buf, int size);
 extern int rename_file(char *from, char *to);
 extern int do_statfs(char *root, long *bsize_out, long long *blocks_out,
                      long long *bfree_out, long long *bavail_out,
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 7f34f4385de0..3a31451ac170 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -168,7 +168,7 @@ static char *follow_link(char *link)
                 if (name == NULL)
                         goto out;
 
-                n = do_readlink(link, name, len);
+                n = hostfs_do_readlink(link, name, len);
                 if (n < len)
                         break;
                 len *= 2;
@@ -943,7 +943,7 @@ int hostfs_link_readpage(struct file *file, struct page *page)
         name = inode_name(page->mapping->host, 0);
         if (name == NULL)
                 return -ENOMEM;
-        err = do_readlink(name, buffer, PAGE_CACHE_SIZE);
+        err = hostfs_do_readlink(name, buffer, PAGE_CACHE_SIZE);
         kfree(name);
         if (err == PAGE_CACHE_SIZE)
                 err = -E2BIG;
diff --git a/fs/hostfs/hostfs_user.c b/fs/hostfs/hostfs_user.c
index 53fd0a67c11a..b79424f93282 100644
--- a/fs/hostfs/hostfs_user.c
+++ b/fs/hostfs/hostfs_user.c
@@ -377,7 +377,7 @@ int link_file(const char *to, const char *from)
         return 0;
 }
 
-int do_readlink(char *file, char *buf, int size)
+int hostfs_do_readlink(char *file, char *buf, int size)
 {
         int n;
 
diff --git a/fs/inotify.c b/fs/inotify.c
index 690e72595e6e..7bbed1b89825 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -106,6 +106,20 @@ void get_inotify_watch(struct inotify_watch *watch)
 }
 EXPORT_SYMBOL_GPL(get_inotify_watch);
 
+int pin_inotify_watch(struct inotify_watch *watch)
+{
+        struct super_block *sb = watch->inode->i_sb;
+        spin_lock(&sb_lock);
+        if (sb->s_count >= S_BIAS) {
+                atomic_inc(&sb->s_active);
+                spin_unlock(&sb_lock);
+                atomic_inc(&watch->count);
+                return 1;
+        }
+        spin_unlock(&sb_lock);
+        return 0;
+}
+
 /**
  * put_inotify_watch - decrements the ref count on a given watch.  cleans up
  * watch references if the count reaches zero.  inotify_watch is freed by
@@ -124,6 +138,13 @@ void put_inotify_watch(struct inotify_watch *watch)
 }
 EXPORT_SYMBOL_GPL(put_inotify_watch);
 
+void unpin_inotify_watch(struct inotify_watch *watch)
+{
+        struct super_block *sb = watch->inode->i_sb;
+        put_inotify_watch(watch);
+        deactivate_super(sb);
+}
+
 /*
  * inotify_handle_get_wd - returns the next WD for use by the given handle
  *
@@ -479,6 +500,112 @@ void inotify_init_watch(struct inotify_watch *watch)
 }
 EXPORT_SYMBOL_GPL(inotify_init_watch);
 
+/*
+ * Watch removals suck violently.  To kick the watch out we need (in this
+ * order) inode->inotify_mutex and ih->mutex.  That's fine if we have
+ * a hold on inode; however, for all other cases we need to make damn sure
+ * we don't race with umount.  We can *NOT* just grab a reference to a
+ * watch - inotify_unmount_inodes() will happily sail past it and we'll end
+ * with reference to inode potentially outliving its superblock.  Ideally
+ * we just want to grab an active reference to superblock if we can; that
+ * will make sure we won't go into inotify_umount_inodes() until we are
+ * done.  Cleanup is just deactivate_super().  However, that leaves a messy
+ * case - what if we *are* racing with umount() and active references to
+ * superblock can't be acquired anymore?  We can bump ->s_count, grab
+ * ->s_umount, which will almost certainly wait until the superblock is shut
+ * down and the watch in question is pining for fjords.  That's fine, but
+ * there is a problem - we might have hit the window between ->s_active
+ * getting to 0 / ->s_count - below S_BIAS (i.e. the moment when superblock
+ * is past the point of no return and is heading for shutdown) and the
+ * moment when deactivate_super() acquires ->s_umount.  We could just do
+ * drop_super() yield() and retry, but that's rather antisocial and this
+ * stuff is luser-triggerable.  OTOH, having grabbed ->s_umount and having
+ * found that we'd got there first (i.e. that ->s_root is non-NULL) we know
+ * that we won't race with inotify_umount_inodes().  So we could grab a
+ * reference to watch and do the rest as above, just with drop_super() instead
+ * of deactivate_super(), right?  Wrong.  We had to drop ih->mutex before we
+ * could grab ->s_umount.  So the watch could've been gone already.
+ *
+ * That still can be dealt with - we need to save watch->wd, do idr_find()
+ * and compare its result with our pointer.  If they match, we either have
+ * the damn thing still alive or we'd lost not one but two races at once,
+ * the watch had been killed and a new one got created with the same ->wd
+ * at the same address.  That couldn't have happened in inotify_destroy(),
+ * but inotify_rm_wd() could run into that.  Still, "new one got created"
+ * is not a problem - we have every right to kill it or leave it alone,
+ * whatever's more convenient.
+ *
+ * So we can use idr_find(...) == watch && watch->inode->i_sb == sb as
+ * "grab it and kill it" check.  If it's been our original watch, we are
+ * fine, if it's a newcomer - nevermind, just pretend that we'd won the
+ * race and kill the fscker anyway; we are safe since we know that its
+ * superblock won't be going away.
+ *
+ * And yes, this is far beyond mere "not very pretty"; so's the entire
+ * concept of inotify to start with.
+ */
+
+/**
+ * pin_to_kill - pin the watch down for removal
+ * @ih: inotify handle
+ * @watch: watch to kill
+ *
+ * Called with ih->mutex held, drops it.  Possible return values:
+ * 0 - nothing to do, it has died
+ * 1 - remove it, drop the reference and deactivate_super()
+ * 2 - remove it, drop the reference and drop_super(); we tried hard to avoid
+ * that variant, since it involved a lot of PITA, but that's the best that
+ * could've been done.
+ */
+static int pin_to_kill(struct inotify_handle *ih, struct inotify_watch *watch)
+{
+        struct super_block *sb = watch->inode->i_sb;
+        s32 wd = watch->wd;
+
+        spin_lock(&sb_lock);
+        if (sb->s_count >= S_BIAS) {
+                atomic_inc(&sb->s_active);
+                spin_unlock(&sb_lock);
+                get_inotify_watch(watch);
+                mutex_unlock(&ih->mutex);
+                return 1;       /* the best outcome */
+        }
+        sb->s_count++;
+        spin_unlock(&sb_lock);
+        mutex_unlock(&ih->mutex); /* can't grab ->s_umount under it */
+        down_read(&sb->s_umount);
+        if (likely(!sb->s_root)) {
+                /* fs is already shut down; the watch is dead */
+                drop_super(sb);
+                return 0;
+        }
+        /* raced with the final deactivate_super() */
+        mutex_lock(&ih->mutex);
+        if (idr_find(&ih->idr, wd) != watch || watch->inode->i_sb != sb) {
+                /* the watch is dead */
+                mutex_unlock(&ih->mutex);
+                drop_super(sb);
+                return 0;
+        }
+        /* still alive or freed and reused with the same sb and wd; kill */
+        get_inotify_watch(watch);
+        mutex_unlock(&ih->mutex);
+        return 2;
+}
+
+static void unpin_and_kill(struct inotify_watch *watch, int how)
+{
+        struct super_block *sb = watch->inode->i_sb;
+        put_inotify_watch(watch);
+        switch (how) {
+        case 1:
+                deactivate_super(sb);
+                break;
+        case 2:
+                drop_super(sb);
+        }
+}
+
 /**
  * inotify_destroy - clean up and destroy an inotify instance
  * @ih: inotify handle
@@ -490,11 +617,15 @@ void inotify_destroy(struct inotify_handle *ih)
          * pretty.  We cannot do a simple iteration over the list, because we
          * do not know the inode until we iterate to the watch.  But we need to
          * hold inode->inotify_mutex before ih->mutex.  The following works.
+         *
+         * AV: it had to become even uglier to start working ;-/
          */
         while (1) {
                 struct inotify_watch *watch;
                 struct list_head *watches;
+                struct super_block *sb;
                 struct inode *inode;
+                int how;
 
                 mutex_lock(&ih->mutex);
                 watches = &ih->watches;
@@ -503,8 +634,10 @@ void inotify_destroy(struct inotify_handle *ih)
                         break;
                 }
                 watch = list_first_entry(watches, struct inotify_watch, h_list);
-                get_inotify_watch(watch);
-                mutex_unlock(&ih->mutex);
+                sb = watch->inode->i_sb;
+                how = pin_to_kill(ih, watch);
+                if (!how)
+                        continue;
 
                 inode = watch->inode;
                 mutex_lock(&inode->inotify_mutex);
@@ -518,7 +651,7 @@ void inotify_destroy(struct inotify_handle *ih)
 
                 mutex_unlock(&ih->mutex);
                 mutex_unlock(&inode->inotify_mutex);
-                put_inotify_watch(watch);
+                unpin_and_kill(watch, how);
         }
 
         /* free this handle: the put matching the get in inotify_init() */
@@ -719,7 +852,9 @@ void inotify_evict_watch(struct inotify_watch *watch)
 int inotify_rm_wd(struct inotify_handle *ih, u32 wd)
 {
         struct inotify_watch *watch;
+        struct super_block *sb;
         struct inode *inode;
+        int how;
 
         mutex_lock(&ih->mutex);
         watch = idr_find(&ih->idr, wd);
@@ -727,9 +862,12 @@ int inotify_rm_wd(struct inotify_handle *ih, u32 wd)
                 mutex_unlock(&ih->mutex);
                 return -EINVAL;
         }
-        get_inotify_watch(watch);
+        sb = watch->inode->i_sb;
+        how = pin_to_kill(ih, watch);
+        if (!how)
+                return 0;
+
         inode = watch->inode;
-        mutex_unlock(&ih->mutex);
 
         mutex_lock(&inode->inotify_mutex);
         mutex_lock(&ih->mutex);
@@ -740,7 +878,7 @@ int inotify_rm_wd(struct inotify_handle *ih, u32 wd)
 
         mutex_unlock(&ih->mutex);
         mutex_unlock(&inode->inotify_mutex);
-        put_inotify_watch(watch);
+        unpin_and_kill(watch, how);
 
         return 0;
 }
diff --git a/fs/namei.c b/fs/namei.c
index 09ce58e49e72..d34e0f9681c6 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1378,7 +1378,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
         if (IS_APPEND(dir))
                 return -EPERM;
         if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
-            IS_IMMUTABLE(victim->d_inode))
+            IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
                 return -EPERM;
         if (isdir) {
                 if (!S_ISDIR(victim->d_inode->i_mode))
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index 633f7a0ebb2c..6d5b213b8a9b 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -348,8 +348,8 @@ static ssize_t whole_disk_show(struct device *dev,
 static DEVICE_ATTR(whole_disk, S_IRUSR | S_IRGRP | S_IROTH,
                    whole_disk_show, NULL);
 
-int add_partition(struct gendisk *disk, int partno,
-                  sector_t start, sector_t len, int flags)
+struct hd_struct *add_partition(struct gendisk *disk, int partno,
+                                sector_t start, sector_t len, int flags)
 {
         struct hd_struct *p;
         dev_t devt = MKDEV(0, 0);
@@ -361,15 +361,15 @@ int add_partition(struct gendisk *disk, int partno,
 
         err = disk_expand_part_tbl(disk, partno);
         if (err)
-                return err;
+                return ERR_PTR(err);
         ptbl = disk->part_tbl;
 
         if (ptbl->part[partno])
-                return -EBUSY;
+                return ERR_PTR(-EBUSY);
 
         p = kzalloc(sizeof(*p), GFP_KERNEL);
         if (!p)
-                return -ENOMEM;
+                return ERR_PTR(-EBUSY);
 
         if (!init_part_stats(p)) {
                 err = -ENOMEM;
@@ -395,7 +395,7 @@ int add_partition(struct gendisk *disk, int partno,
 
         err = blk_alloc_devt(p, &devt);
         if (err)
-                goto out_free;
+                goto out_free_stats;
         pdev->devt = devt;
 
         /* delay uevent until 'holders' subdir is created */
@@ -424,18 +424,20 @@ int add_partition(struct gendisk *disk, int partno,
         if (!ddev->uevent_suppress)
                 kobject_uevent(&pdev->kobj, KOBJ_ADD);
 
-        return 0;
+        return p;
 
+out_free_stats:
+        free_part_stats(p);
 out_free:
         kfree(p);
-        return err;
+        return ERR_PTR(err);
 out_del:
         kobject_put(p->holder_dir);
         device_del(pdev);
 out_put:
         put_device(pdev);
         blk_free_devt(devt);
-        return err;
+        return ERR_PTR(err);
 }
 
 /* Not exported, helper to add_disk(). */
@@ -566,15 +568,16 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
                                disk->disk_name, p, (unsigned long long) size);
                         size = get_capacity(disk) - from;
                 }
-                res = add_partition(disk, p, from, size, state->parts[p].flags);
-                if (res) {
-                        printk(KERN_ERR " %s: p%d could not be added: %d\n",
-                                disk->disk_name, p, -res);
+                part = add_partition(disk, p, from, size,
+                                     state->parts[p].flags);
+                if (IS_ERR(part)) {
+                        printk(KERN_ERR " %s: p%d could not be added: %ld\n",
+                               disk->disk_name, p, -PTR_ERR(part));
                         continue;
                 }
 #ifdef CONFIG_BLK_DEV_MD
                 if (state->parts[p].flags & ADDPART_FLAG_RAID)
-                        md_autodetect_dev(bdev->bd_dev+p);
+                        md_autodetect_dev(part_to_dev(part)->devt);
 #endif
         }
         kfree(state);
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 94fcfff6863a..06ed10b7da9e 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -31,6 +31,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
         inode->i_flags |= S_PRIVATE; /* tell selinux to ignore this inode */
         inode->i_mode = table->mode;
+        inode->i_uid = inode->i_gid = 0;
         if (!table->child) {
                 inode->i_mode |= S_IFREG;
                 inode->i_op = &proc_sys_inode_operations;
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index 2691926fb506..8e540d32c9fe 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -74,8 +74,6 @@ static inline int cpuset_do_slab_mem_spread(void)
         return current->flags & PF_SPREAD_SLAB;
 }
 
-extern void cpuset_track_online_nodes(void);
-
 extern int current_cpuset_is_being_rebound(void);
 
 extern void rebuild_sched_domains(void);
@@ -151,8 +149,6 @@ static inline int cpuset_do_slab_mem_spread(void)
         return 0;
 }
 
-static inline void cpuset_track_online_nodes(void) {}
-
 static inline int current_cpuset_is_being_rebound(void)
 {
         return 0;
diff --git a/include/linux/debug_locks.h b/include/linux/debug_locks.h
index 4aaa4afb1cb9..096476f1fb35 100644
--- a/include/linux/debug_locks.h
+++ b/include/linux/debug_locks.h
@@ -17,7 +17,7 @@ extern int debug_locks_off(void);
 ({                                                                      \
         int __ret = 0;                                                  \
                                                                         \
-        if (unlikely(c)) {                                              \
+        if (!oops_in_progress && unlikely(c)) {                         \
                 if (debug_locks_off() && !debug_locks_silent)           \
                         WARN_ON(1);                                     \
                 __ret = 1;                                              \
diff --git a/include/linux/futex.h b/include/linux/futex.h
index 586ab56a3ec3..8f627b9ae2b1 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -164,6 +164,8 @@ union futex_key {
         } both;
 };
 
+#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = NULL } }
+
 #ifdef CONFIG_FUTEX
 extern void exit_robust_list(struct task_struct *curr);
 extern void exit_pi_state_list(struct task_struct *curr);
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index e439e6aed832..3df7742ce246 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -522,7 +522,9 @@ extern char *disk_name (struct gendisk *hd, int partno, char *buf);
 
 extern int disk_expand_part_tbl(struct gendisk *disk, int target);
 extern int rescan_partitions(struct gendisk *disk, struct block_device *bdev);
-extern int __must_check add_partition(struct gendisk *, int, sector_t, sector_t, int);
+extern struct hd_struct * __must_check add_partition(struct gendisk *disk,
+                                                     int partno, sector_t start,
+                                                     sector_t len, int flags);
 extern void delete_partition(struct gendisk *, int);
 extern void printk_all_partitions(void);
 
diff --git a/include/linux/inotify.h b/include/linux/inotify.h
index bd578578a8b9..37ea2894b3c0 100644
--- a/include/linux/inotify.h
+++ b/include/linux/inotify.h
@@ -134,6 +134,8 @@ extern void inotify_remove_watch_locked(struct inotify_handle *,
                                         struct inotify_watch *);
 extern void get_inotify_watch(struct inotify_watch *);
 extern void put_inotify_watch(struct inotify_watch *);
+extern int pin_inotify_watch(struct inotify_watch *);
+extern void unpin_inotify_watch(struct inotify_watch *);
 
 #else
 
@@ -228,6 +230,15 @@ static inline void put_inotify_watch(struct inotify_watch *watch)
 {
 }
 
+extern inline int pin_inotify_watch(struct inotify_watch *watch)
+{
+        return 0;
+}
+
+extern inline void unpin_inotify_watch(struct inotify_watch *watch)
+{
+}
+
 #endif  /* CONFIG_INOTIFY */
 
 #endif  /* __KERNEL __ */
diff --git a/include/linux/input.h b/include/linux/input.h
index b86fb5581ce6..5341e8251f8c 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -238,6 +238,7 @@ struct input_absinfo {
 #define KEY_KPEQUAL             117
 #define KEY_KPPLUSMINUS         118
 #define KEY_PAUSE               119
+#define KEY_SCALE               120     /* AL Compiz Scale (Expose) */
 
 #define KEY_KPCOMMA             121
 #define KEY_HANGEUL             122
@@ -322,6 +323,7 @@ struct input_absinfo {
 #define KEY_PAUSECD             201
 #define KEY_PROG3               202
 #define KEY_PROG4               203
+#define KEY_DASHBOARD           204     /* AL Dashboard */
 #define KEY_SUSPEND             205
 #define KEY_CLOSE               206     /* AC Close */
 #define KEY_PLAY                207
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index fba141d3ca07..269df5a17b30 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -141,6 +141,15 @@ extern int _cond_resched(void);
                 (__x < 0) ? -__x : __x;         \
         })
 
+#ifdef CONFIG_PROVE_LOCKING
+void might_fault(void);
+#else
+static inline void might_fault(void)
+{
+        might_sleep();
+}
+#endif
+
 extern struct atomic_notifier_head panic_notifier_list;
 extern long (*panic_blink)(long time);
 NORET_TYPE void panic(const char * fmt, ...)
@@ -188,6 +197,8 @@ extern unsigned long long memparse(const char *ptr, char **retptr);
 extern int core_kernel_text(unsigned long addr);
 extern int __kernel_text_address(unsigned long addr);
 extern int kernel_text_address(unsigned long addr);
+extern int func_ptr_is_kernel_text(void *ptr);
+
 struct pid;
 extern struct pid *session_of_pgrp(struct pid *pgrp);
 
@@ -318,32 +329,36 @@ static inline char *pack_hex_byte(char *buf, u8 byte)
         return buf;
 }
 
-#define pr_emerg(fmt, arg...) \
-        printk(KERN_EMERG fmt, ##arg)
-#define pr_alert(fmt, arg...) \
-        printk(KERN_ALERT fmt, ##arg)
-#define pr_crit(fmt, arg...) \
-        printk(KERN_CRIT fmt, ##arg)
-#define pr_err(fmt, arg...) \
-        printk(KERN_ERR fmt, ##arg)
-#define pr_warning(fmt, arg...) \
-        printk(KERN_WARNING fmt, ##arg)
-#define pr_notice(fmt, arg...) \
-        printk(KERN_NOTICE fmt, ##arg)
-#define pr_info(fmt, arg...) \
-        printk(KERN_INFO fmt, ##arg)
+#ifndef pr_fmt
+#define pr_fmt(fmt) fmt
+#endif
+
+#define pr_emerg(fmt, ...) \
+        printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_alert(fmt, ...) \
+        printk(KERN_ALERT pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_crit(fmt, ...) \
+        printk(KERN_CRIT pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_err(fmt, ...) \
+        printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_warning(fmt, ...) \
+        printk(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_notice(fmt, ...) \
+        printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_info(fmt, ...) \
+        printk(KERN_INFO pr_fmt(fmt), ##__VA_ARGS__)
 
 /* If you are writing a driver, please use dev_dbg instead */
 #if defined(CONFIG_DYNAMIC_PRINTK_DEBUG)
 #define pr_debug(fmt, ...) do { \
-        dynamic_pr_debug(fmt, ##__VA_ARGS__); \
+        dynamic_pr_debug(pr_fmt(fmt), ##__VA_ARGS__); \
         } while (0)
 #elif defined(DEBUG)
-#define pr_debug(fmt, arg...) \
-        printk(KERN_DEBUG fmt, ##arg)
+#define pr_debug(fmt, ...) \
+        printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
 #else
-#define pr_debug(fmt, arg...) \
-        ({ if (0) printk(KERN_DEBUG fmt, ##arg); 0; })
+#define pr_debug(fmt, ...) \
+        ({ if (0) printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__); 0; })
 #endif
 
 /*
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index 331e5f1c2d8e..8956daf64abd 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -73,6 +73,8 @@ struct lock_class_key {
         struct lockdep_subclass_key     subkeys[MAX_LOCKDEP_SUBCLASSES];
 };
 
+#define LOCKSTAT_POINTS         4
+
 /*
  * The lock-class itself:
  */
@@ -119,7 +121,8 @@ struct lock_class {
         int                             name_version;
 
 #ifdef CONFIG_LOCK_STAT
-        unsigned long                   contention_point[4];
+        unsigned long                   contention_point[LOCKSTAT_POINTS];
+        unsigned long                   contending_point[LOCKSTAT_POINTS];
 #endif
 };
 
@@ -144,6 +147,7 @@ enum bounce_type {
 
 struct lock_class_stats {
         unsigned long                   contention_point[4];
+        unsigned long                   contending_point[4];
         struct lock_time                read_waittime;
         struct lock_time                write_waittime;
         struct lock_time                read_holdtime;
@@ -165,6 +169,7 @@ struct lockdep_map {
         const char                      *name;
 #ifdef CONFIG_LOCK_STAT
         int                             cpu;
+        unsigned long                   ip;
 #endif
 };
 
@@ -331,10 +336,11 @@ static inline void lockdep_on(void)
 # define lock_set_subclass(l, s, i)             do { } while (0)
 # define lockdep_init()                         do { } while (0)
 # define lockdep_info()                         do { } while (0)
-# define lockdep_init_map(lock, name, key, sub) do { (void)(key); } while (0)
+# define lockdep_init_map(lock, name, key, sub) \
+                do { (void)(name); (void)(key); } while (0)
 # define lockdep_set_class(lock, key)           do { (void)(key); } while (0)
 # define lockdep_set_class_and_name(lock, key, name) \
-                do { (void)(key); } while (0)
+                do { (void)(key); (void)(name); } while (0)
 #define lockdep_set_class_and_subclass(lock, key, sub) \
                 do { (void)(key); } while (0)
 #define lockdep_set_subclass(lock, sub)         do { } while (0)
@@ -355,7 +361,7 @@ struct lock_class_key { };
 #ifdef CONFIG_LOCK_STAT
 
 extern void lock_contended(struct lockdep_map *lock, unsigned long ip);
-extern void lock_acquired(struct lockdep_map *lock);
+extern void lock_acquired(struct lockdep_map *lock, unsigned long ip);
 
 #define LOCK_CONTENDED(_lock, try, lock)                        \
 do {                                                            \
@@ -363,13 +369,13 @@ do {								\
                 lock_contended(&(_lock)->dep_map, _RET_IP_);    \
                 lock(_lock);                                    \
         }                                                       \
-        lock_acquired(&(_lock)->dep_map);                       \
+        lock_acquired(&(_lock)->dep_map, _RET_IP_);                     \
 } while (0)
 
 #else /* CONFIG_LOCK_STAT */
 
 #define lock_contended(lockdep_map, ip) do {} while (0)
-#define lock_acquired(lockdep_map) do {} while (0)
+#define lock_acquired(lockdep_map, ip) do {} while (0)
 
 #define LOCK_CONTENDED(_lock, try, lock) \
         lock(_lock)
@@ -480,4 +486,22 @@ static inline void print_irqtrace_events(struct task_struct *curr)
 # define lock_map_release(l)                    do { } while (0)
 #endif
 
+#ifdef CONFIG_PROVE_LOCKING
+# define might_lock(lock)                                               \
+do {                                                                    \
+        typecheck(struct lockdep_map *, &(lock)->dep_map);              \
+        lock_acquire(&(lock)->dep_map, 0, 0, 0, 2, NULL, _THIS_IP_);    \
+        lock_release(&(lock)->dep_map, 0, _THIS_IP_);                   \
+} while (0)
+# define might_lock_read(lock)                                          \
+do {                                                                    \
+        typecheck(struct lockdep_map *, &(lock)->dep_map);              \
+        lock_acquire(&(lock)->dep_map, 0, 0, 1, 2, NULL, _THIS_IP_);    \
+        lock_release(&(lock)->dep_map, 0, _THIS_IP_);                   \
+} while (0)
+#else
+# define might_lock(lock) do { } while (0)
+# define might_lock_read(lock) do { } while (0)
+#endif
+
 #endif /* __LINUX_LOCKDEP_H */
diff --git a/include/linux/mutex.h b/include/linux/mutex.h
index bc6da10ceee0..7a0e5c4f8072 100644
--- a/include/linux/mutex.h
+++ b/include/linux/mutex.h
@@ -144,6 +144,8 @@ extern int __must_check mutex_lock_killable(struct mutex *lock);
 /*
  * NOTE: mutex_trylock() follows the spin_trylock() convention,
  *       not the down_trylock() convention!
+ *
+ * Returns 1 if the mutex has been acquired successfully, and 0 on contention.
  */
 extern int mutex_trylock(struct mutex *lock);
 extern void mutex_unlock(struct mutex *lock);
diff --git a/include/linux/net.h b/include/linux/net.h
index 6dc14a240042..4515efae4c39 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -40,7 +40,7 @@
 #define SYS_GETSOCKOPT  15              /* sys_getsockopt(2)            */
 #define SYS_SENDMSG     16              /* sys_sendmsg(2)               */
 #define SYS_RECVMSG     17              /* sys_recvmsg(2)               */
-#define SYS_PACCEPT     18              /* sys_paccept(2)               */
+#define SYS_ACCEPT4     18              /* sys_accept4(2)               */
 
 typedef enum {
         SS_FREE = 0,                    /* not allocated                */
@@ -100,7 +100,7 @@ enum sock_type {
  * remaining bits are used as flags. */
 #define SOCK_TYPE_MASK 0xf
 
-/* Flags for socket, socketpair, paccept */
+/* Flags for socket, socketpair, accept4 */
 #define SOCK_CLOEXEC    O_CLOEXEC
 #ifndef SOCK_NONBLOCK
 #define SOCK_NONBLOCK   O_NONBLOCK
@@ -223,8 +223,6 @@ extern int 	     sock_map_fd(struct socket *sock, int flags);
 extern struct socket *sockfd_lookup(int fd, int *err);
 #define              sockfd_put(sock) fput(sock->file)
 extern int           net_ratelimit(void);
-extern long          do_accept(int fd, struct sockaddr __user *upeer_sockaddr,
-                               int __user *upeer_addrlen, int flags);
 
 #define net_random()            random32()
 #define net_srandom(seed)       srandom32((__force u32)seed)
diff --git a/include/linux/rcuclassic.h b/include/linux/rcuclassic.h
index 5f89b62e6983..301dda829e37 100644
--- a/include/linux/rcuclassic.h
+++ b/include/linux/rcuclassic.h
@@ -41,7 +41,7 @@
 #include <linux/seqlock.h>
 
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
-#define RCU_SECONDS_TILL_STALL_CHECK    ( 3 * HZ) /* for rcp->jiffies_stall */
+#define RCU_SECONDS_TILL_STALL_CHECK    (10 * HZ) /* for rcp->jiffies_stall */
 #define RCU_SECONDS_TILL_STALL_RECHECK  (30 * HZ) /* for rcp->jiffies_stall */
 #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
 
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 536b0ca46a03..e097c2e6b6dc 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -120,6 +120,9 @@ unsigned long ring_buffer_overruns(struct ring_buffer *buffer);
 u64 ring_buffer_time_stamp(int cpu);
 void ring_buffer_normalize_time_stamp(int cpu, u64 *ts);
 
+void tracing_on(void);
+void tracing_off(void);
+
 enum ring_buffer_flags {
         RB_FL_OVERWRITE         = 1 << 0,
 };
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index e27f216361fc..4e4f1277f3bf 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -155,6 +155,9 @@
 
 #define PORT_SC26XX     82
 
+/* SH-SCI */
+#define PORT_SCIFA      83
+
 #ifdef __KERNEL__
 
 #include <linux/compiler.h>
diff --git a/include/linux/slab.h b/include/linux/slab.h
index ba965c84ae06..000da12b5cf0 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -23,6 +23,34 @@
 #define SLAB_CACHE_DMA          0x00004000UL    /* Use GFP_DMA memory */
 #define SLAB_STORE_USER         0x00010000UL    /* DEBUG: Store the last owner for bug hunting */
 #define SLAB_PANIC              0x00040000UL    /* Panic if kmem_cache_create() fails */
+/*
+ * SLAB_DESTROY_BY_RCU - **WARNING** READ THIS!
+ *
+ * This delays freeing the SLAB page by a grace period, it does _NOT_
+ * delay object freeing. This means that if you do kmem_cache_free()
+ * that memory location is free to be reused at any time. Thus it may
+ * be possible to see another object there in the same RCU grace period.
+ *
+ * This feature only ensures the memory location backing the object
+ * stays valid, the trick to using this is relying on an independent
+ * object validation pass. Something like:
+ *
+ *  rcu_read_lock()
+ * again:
+ *  obj = lockless_lookup(key);
+ *  if (obj) {
+ *    if (!try_get_ref(obj)) // might fail for free objects
+ *      goto again;
+ *
+ *    if (obj->key != key) { // not the object we expected
+ *      put_ref(obj);
+ *      goto again;
+ *    }
+ *  }
+ *  rcu_read_unlock();
+ *
+ * See also the comment on struct slab_rcu in mm/slab.c.
+ */
 #define SLAB_DESTROY_BY_RCU     0x00080000UL    /* Defer freeing slabs to RCU */
 #define SLAB_MEM_SPREAD         0x00100000UL    /* Spread some memory over cpuset */
 #define SLAB_TRACE              0x00200000UL    /* Trace allocations and frees */
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index d6ff145919ca..04fb47bfb920 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -410,8 +410,7 @@ asmlinkage long sys_getsockopt(int fd, int level, int optname,
 asmlinkage long sys_bind(int, struct sockaddr __user *, int);
 asmlinkage long sys_connect(int, struct sockaddr __user *, int);
 asmlinkage long sys_accept(int, struct sockaddr __user *, int __user *);
-asmlinkage long sys_paccept(int, struct sockaddr __user *, int __user *,
-                            const __user sigset_t *, size_t, int);
+asmlinkage long sys_accept4(int, struct sockaddr __user *, int __user *, int);
 asmlinkage long sys_getsockname(int, struct sockaddr __user *, int __user *);
 asmlinkage long sys_getpeername(int, struct sockaddr __user *, int __user *);
 asmlinkage long sys_send(int, void __user *, size_t, unsigned);
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index fec6decfb983..6b58367d145e 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -78,7 +78,7 @@ static inline unsigned long __copy_from_user_nocache(void *to,
                                                         \
                 set_fs(KERNEL_DS);                      \
                 pagefault_disable();                    \
-                ret = __get_user(retval, (__force typeof(retval) __user *)(addr));              \
+                ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval));            \
                 pagefault_enable();                     \
                 set_fs(old_fs);                         \
                 ret;                                    \
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 8fa973bede5e..f72aa51f7bcd 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -108,6 +108,7 @@ enum usb_interface_condition {
  *      (in probe()), bound to a driver, or unbinding (in disconnect())
  * @is_active: flag set when the interface is bound and not suspended.
  * @sysfs_files_created: sysfs attributes exist
+ * @unregistering: flag set when the interface is being unregistered
  * @needs_remote_wakeup: flag set when the driver requires remote-wakeup
  *      capability during autosuspend.
  * @needs_altsetting0: flag set when a set-interface request for altsetting 0
@@ -163,6 +164,7 @@ struct usb_interface {
         enum usb_interface_condition condition;         /* state of binding */
         unsigned is_active:1;           /* the interface is not suspended */
         unsigned sysfs_files_created:1; /* the sysfs attributes exist */
+        unsigned unregistering:1;       /* unregistration is in progress */
         unsigned needs_remote_wakeup:1; /* driver requires remote wakeup */
         unsigned needs_altsetting0:1;   /* switch to altsetting 0 is pending */
         unsigned needs_binding:1;       /* needs delayed unbind/rebind */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 8856e2d60e9f..73d81bc6aa75 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -74,14 +74,6 @@
  */
 
 /**
- * enum ieee80211_notification_type - Low level driver notification
- * @IEEE80211_NOTIFY_RE_ASSOC: start the re-association sequence
- */
-enum ieee80211_notification_types {
-        IEEE80211_NOTIFY_RE_ASSOC,
-};
-
-/**
  * struct ieee80211_ht_bss_info - describing BSS's HT characteristics
  *
  * This structure describes most essential parameters needed
@@ -1798,18 +1790,6 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw, const u8 *ra,
                                      u16 tid);
 
 /**
- * ieee80211_notify_mac - low level driver notification
- * @hw: pointer as obtained from ieee80211_alloc_hw().
- * @notif_type: enum ieee80211_notification_types
- *
- * This function must be called by low level driver to inform mac80211 of
- * low level driver status change or force mac80211 to re-assoc for low
- * level driver internal error that require re-assoc.
- */
-void ieee80211_notify_mac(struct ieee80211_hw *hw,
-                          enum ieee80211_notification_types  notif_type);
-
-/**
  * ieee80211_find_sta - find a station
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
diff --git a/include/net/sock.h b/include/net/sock.h
index c04f9e18ea22..2f47107f6d0f 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -815,7 +815,7 @@ static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)
  */
 #define sock_lock_init_class_and_name(sk, sname, skey, name, key)       \
 do {                                                                    \
-        sk->sk_lock.owned = 0;                                  \
+        sk->sk_lock.owned = 0;                                          \
         init_waitqueue_head(&sk->sk_lock.wq);                           \
         spin_lock_init(&(sk)->sk_lock.slock);                           \
         debug_check_no_locks_freed((void *)&(sk)->sk_lock,              \
diff --git a/init/Kconfig b/init/Kconfig
index 2f850d800d94..f763762d544a 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -771,8 +771,7 @@ config SLAB
         help
           The regular slab allocator that is established and known to work
           well in all environments. It organizes cache hot objects in
-          per cpu and per node queues. SLAB is the default choice for
-          a slab allocator.
+          per cpu and per node queues.
 
 config SLUB
         bool "SLUB (Unqueued Allocator)"
@@ -781,7 +780,8 @@ config SLUB
            instead of managing queues of cached objects (SLAB approach).
            Per cpu caching is realized using slabs of objects instead
            of queues of objects. SLUB can use memory efficiently
-           and has enhanced diagnostics.
+           and has enhanced diagnostics. SLUB is the default choice for
+           a slab allocator.
 
 config SLOB
         depends on EMBEDDED
diff --git a/ipc/util.c b/ipc/util.c
index 49b3ea615dc5..361fd1c96fcf 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -266,9 +266,17 @@ int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
         if (ids->in_use >= size)
                 return -ENOSPC;
 
+        spin_lock_init(&new->lock);
+        new->deleted = 0;
+        rcu_read_lock();
+        spin_lock(&new->lock);
+
         err = idr_get_new(&ids->ipcs_idr, new, &id);
-        if (err)
+        if (err) {
+                spin_unlock(&new->lock);
+                rcu_read_unlock();
                 return err;
+        }
 
         ids->in_use++;
 
@@ -280,10 +288,6 @@ int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
                 ids->seq = 0;
 
         new->id = ipc_buildid(id, new->seq);
-        spin_lock_init(&new->lock);
-        new->deleted = 0;
-        rcu_read_lock();
-        spin_lock(&new->lock);
         return id;
 }
 
diff --git a/kernel/Makefile b/kernel/Makefile
index 9a3ec66a9d84..19fad003b19d 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -11,8 +11,6 @@ obj-y     = sched.o fork.o exec_domain.o panic.o printk.o \
             hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
             notifier.o ksysfs.o pm_qos_params.o sched_clock.o
 
-CFLAGS_REMOVE_sched.o = -mno-spe
-
 ifdef CONFIG_FUNCTION_TRACER
 # Do not trace debug files and internal ftrace files
 CFLAGS_REMOVE_lockdep.o = -pg
@@ -21,7 +19,7 @@ CFLAGS_REMOVE_mutex-debug.o = -pg
 CFLAGS_REMOVE_rtmutex-debug.o = -pg
 CFLAGS_REMOVE_cgroup-debug.o = -pg
 CFLAGS_REMOVE_sched_clock.o = -pg
-CFLAGS_REMOVE_sched.o = -mno-spe -pg
+CFLAGS_REMOVE_sched.o = -pg
 endif
 
 obj-$(CONFIG_FREEZER) += freezer.o
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index 8ba0e0d934f2..8b509441f49a 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -24,6 +24,7 @@ struct audit_chunk {
         struct list_head trees;         /* with root here */
         int dead;
         int count;
+        atomic_long_t refs;
         struct rcu_head head;
         struct node {
                 struct list_head list;
@@ -56,7 +57,8 @@ static LIST_HEAD(prune_list);
  * tree is refcounted; one reference for "some rules on rules_list refer to
  * it", one for each chunk with pointer to it.
  *
- * chunk is refcounted by embedded inotify_watch.
+ * chunk is refcounted by embedded inotify_watch + .refs (non-zero refcount
+ * of watch contributes 1 to .refs).
  *
  * node.index allows to get from node.list to containing chunk.
  * MSB of that sucker is stolen to mark taggings that we might have to
@@ -121,6 +123,7 @@ static struct audit_chunk *alloc_chunk(int count)
         INIT_LIST_HEAD(&chunk->hash);
         INIT_LIST_HEAD(&chunk->trees);
         chunk->count = count;
+        atomic_long_set(&chunk->refs, 1);
         for (i = 0; i < count; i++) {
                 INIT_LIST_HEAD(&chunk->owners[i].list);
                 chunk->owners[i].index = i;
@@ -129,9 +132,8 @@ static struct audit_chunk *alloc_chunk(int count)
         return chunk;
 }
 
-static void __free_chunk(struct rcu_head *rcu)
+static void free_chunk(struct audit_chunk *chunk)
 {
-        struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
         int i;
 
         for (i = 0; i < chunk->count; i++) {
@@ -141,14 +143,16 @@ static void __free_chunk(struct rcu_head *rcu)
         kfree(chunk);
 }
 
-static inline void free_chunk(struct audit_chunk *chunk)
+void audit_put_chunk(struct audit_chunk *chunk)
 {
-        call_rcu(&chunk->head, __free_chunk);
+        if (atomic_long_dec_and_test(&chunk->refs))
+                free_chunk(chunk);
 }
 
-void audit_put_chunk(struct audit_chunk *chunk)
+static void __put_chunk(struct rcu_head *rcu)
 {
-        put_inotify_watch(&chunk->watch);
+        struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
+        audit_put_chunk(chunk);
 }
 
 enum {HASH_SIZE = 128};
@@ -176,7 +180,7 @@ struct audit_chunk *audit_tree_lookup(const struct inode *inode)
 
         list_for_each_entry_rcu(p, list, hash) {
                 if (p->watch.inode == inode) {
-                        get_inotify_watch(&p->watch);
+                        atomic_long_inc(&p->refs);
                         return p;
                 }
         }
@@ -194,17 +198,49 @@ int audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree)
 
 /* tagging and untagging inodes with trees */
 
-static void untag_chunk(struct audit_chunk *chunk, struct node *p)
+static struct audit_chunk *find_chunk(struct node *p)
+{
+        int index = p->index & ~(1U<<31);
+        p -= index;
+        return container_of(p, struct audit_chunk, owners[0]);
+}
+
+static void untag_chunk(struct node *p)
 {
+        struct audit_chunk *chunk = find_chunk(p);
         struct audit_chunk *new;
         struct audit_tree *owner;
         int size = chunk->count - 1;
         int i, j;
 
+        if (!pin_inotify_watch(&chunk->watch)) {
+                /*
+                 * Filesystem is shutting down; all watches are getting
+                 * evicted, just take it off the node list for this
+                 * tree and let the eviction logics take care of the
+                 * rest.
+                 */
+                owner = p->owner;
+                if (owner->root == chunk) {
+                        list_del_init(&owner->same_root);
+                        owner->root = NULL;
+                }
+                list_del_init(&p->list);
+                p->owner = NULL;
+                put_tree(owner);
+                return;
+        }
+
+        spin_unlock(&hash_lock);
+
+        /*
+         * pin_inotify_watch() succeeded, so the watch won't go away
+         * from under us.
+         */
         mutex_lock(&chunk->watch.inode->inotify_mutex);
         if (chunk->dead) {
                 mutex_unlock(&chunk->watch.inode->inotify_mutex);
-                return;
+                goto out;
         }
 
         owner = p->owner;
@@ -221,7 +257,7 @@ static void untag_chunk(struct audit_chunk *chunk, struct node *p)
                 inotify_evict_watch(&chunk->watch);
                 mutex_unlock(&chunk->watch.inode->inotify_mutex);
                 put_inotify_watch(&chunk->watch);
-                return;
+                goto out;
         }
 
         new = alloc_chunk(size);
@@ -263,7 +299,7 @@ static void untag_chunk(struct audit_chunk *chunk, struct node *p)
         inotify_evict_watch(&chunk->watch);
         mutex_unlock(&chunk->watch.inode->inotify_mutex);
         put_inotify_watch(&chunk->watch);
-        return;
+        goto out;
 
 Fallback:
         // do the best we can
@@ -277,6 +313,9 @@ Fallback:
         put_tree(owner);
         spin_unlock(&hash_lock);
         mutex_unlock(&chunk->watch.inode->inotify_mutex);
+out:
+        unpin_inotify_watch(&chunk->watch);
+        spin_lock(&hash_lock);
 }
 
 static int create_chunk(struct inode *inode, struct audit_tree *tree)
@@ -387,13 +426,6 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
         return 0;
 }
 
-static struct audit_chunk *find_chunk(struct node *p)
-{
-        int index = p->index & ~(1U<<31);
-        p -= index;
-        return container_of(p, struct audit_chunk, owners[0]);
-}
-
 static void kill_rules(struct audit_tree *tree)
 {
         struct audit_krule *rule, *next;
@@ -431,17 +463,10 @@ static void prune_one(struct audit_tree *victim)
         spin_lock(&hash_lock);
         while (!list_empty(&victim->chunks)) {
                 struct node *p;
-                struct audit_chunk *chunk;
 
                 p = list_entry(victim->chunks.next, struct node, list);
-                chunk = find_chunk(p);
-                get_inotify_watch(&chunk->watch);
-                spin_unlock(&hash_lock);
-
-                untag_chunk(chunk, p);
 
-                put_inotify_watch(&chunk->watch);
-                spin_lock(&hash_lock);
+                untag_chunk(p);
         }
         spin_unlock(&hash_lock);
         put_tree(victim);
@@ -469,7 +494,6 @@ static void trim_marked(struct audit_tree *tree)
 
         while (!list_empty(&tree->chunks)) {
                 struct node *node;
-                struct audit_chunk *chunk;
 
                 node = list_entry(tree->chunks.next, struct node, list);
 
@@ -477,14 +501,7 @@ static void trim_marked(struct audit_tree *tree)
                 if (!(node->index & (1U<<31)))
                         break;
 
-                chunk = find_chunk(node);
-                get_inotify_watch(&chunk->watch);
-                spin_unlock(&hash_lock);
-
-                untag_chunk(chunk, node);
-
-                put_inotify_watch(&chunk->watch);
-                spin_lock(&hash_lock);
+                untag_chunk(node);
         }
         if (!tree->root && !tree->goner) {
                 tree->goner = 1;
@@ -878,7 +895,7 @@ static void handle_event(struct inotify_watch *watch, u32 wd, u32 mask,
 static void destroy_watch(struct inotify_watch *watch)
 {
         struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch);
-        free_chunk(chunk);
+        call_rcu(&chunk->head, __put_chunk);
 }
 
 static const struct inotify_operations rtree_inotify_ops = {
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index b7d354e2b0ef..9fd85a4640a0 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1094,8 +1094,8 @@ static void audit_inotify_unregister(struct list_head *in_list)
         list_for_each_entry_safe(p, n, in_list, ilist) {
                 list_del(&p->ilist);
                 inotify_rm_watch(audit_ih, &p->wdata);
-                /* the put matching the get in audit_do_del_rule() */
-                put_inotify_watch(&p->wdata);
+                /* the unpin matching the pin in audit_do_del_rule() */
+                unpin_inotify_watch(&p->wdata);
         }
 }
 
@@ -1389,9 +1389,13 @@ static inline int audit_del_rule(struct audit_entry *entry,
                                 /* Put parent on the inotify un-registration
                                  * list.  Grab a reference before releasing
                                  * audit_filter_mutex, to be released in
-                                 * audit_inotify_unregister(). */
-                                list_add(&parent->ilist, &inotify_list);
-                                get_inotify_watch(&parent->wdata);
+                                 * audit_inotify_unregister().
+                                 * If filesystem is going away, just leave
+                                 * the sucker alone, eviction will take
+                                 * care of it.
+                                 */
+                                if (pin_inotify_watch(&parent->wdata))
+                                        list_add(&parent->ilist, &inotify_list);
                         }
                 }
         }
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 358e77564e6f..fe00b3b983a8 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2039,10 +2039,13 @@ int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry)
         struct cgroup *cgrp;
         struct cgroup_iter it;
         struct task_struct *tsk;
+
         /*
-         * Validate dentry by checking the superblock operations
+         * Validate dentry by checking the superblock operations,
+         * and make sure it's a directory.
          */
-        if (dentry->d_sb->s_op != &cgroup_ops)
+        if (dentry->d_sb->s_op != &cgroup_ops ||
+            !S_ISDIR(dentry->d_inode->i_mode))
                  goto err;
 
         ret = 0;
@@ -2472,10 +2475,7 @@ static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
                 mutex_unlock(&cgroup_mutex);
                 return -EBUSY;
         }
-
-        parent = cgrp->parent;
-        root = cgrp->root;
-        sb = root->sb;
+        mutex_unlock(&cgroup_mutex);
 
         /*
          * Call pre_destroy handlers of subsys. Notify subsystems
@@ -2483,7 +2483,14 @@ static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
          */
         cgroup_call_pre_destroy(cgrp);
 
-        if (cgroup_has_css_refs(cgrp)) {
+        mutex_lock(&cgroup_mutex);
+        parent = cgrp->parent;
+        root = cgrp->root;
+        sb = root->sb;
+
+        if (atomic_read(&cgrp->count)
+            || !list_empty(&cgrp->children)
+            || cgroup_has_css_refs(cgrp)) {
                 mutex_unlock(&cgroup_mutex);
                 return -EBUSY;
         }
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 3e00526f52ec..da7ff6137f37 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -36,6 +36,7 @@
 #include <linux/list.h>
 #include <linux/mempolicy.h>
 #include <linux/mm.h>
+#include <linux/memory.h>
 #include <linux/module.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
@@ -587,7 +588,6 @@ static int generate_sched_domains(cpumask_t **domains,
         int ndoms;              /* number of sched domains in result */
         int nslot;              /* next empty doms[] cpumask_t slot */
 
-        ndoms = 0;
         doms = NULL;
         dattr = NULL;
         csa = NULL;
@@ -674,10 +674,8 @@ restart:
          * Convert <csn, csa> to <ndoms, doms> and populate cpu masks.
          */
         doms = kmalloc(ndoms * sizeof(cpumask_t), GFP_KERNEL);
-        if (!doms) {
-                ndoms = 0;
+        if (!doms)
                 goto done;
-        }
 
         /*
          * The rest of the code, including the scheduler, can deal with
@@ -732,6 +730,13 @@ restart:
 done:
         kfree(csa);
 
+        /*
+         * Fallback to the default domain if kmalloc() failed.
+         * See comments in partition_sched_domains().
+         */
+        if (doms == NULL)
+                ndoms = 1;
+
         *domains    = doms;
         *attributes = dattr;
         return ndoms;
@@ -2011,12 +2016,23 @@ static int cpuset_track_online_cpus(struct notifier_block *unused_nb,
  * Call this routine anytime after node_states[N_HIGH_MEMORY] changes.
  * See also the previous routine cpuset_track_online_cpus().
  */
-void cpuset_track_online_nodes(void)
+static int cpuset_track_online_nodes(struct notifier_block *self,
+                                unsigned long action, void *arg)
 {
         cgroup_lock();
-        top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
-        scan_for_empty_cpusets(&top_cpuset);
+        switch (action) {
+        case MEM_ONLINE:
+                top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
+                break;
+        case MEM_OFFLINE:
+                top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
+                scan_for_empty_cpusets(&top_cpuset);
+                break;
+        default:
+                break;
+        }
         cgroup_unlock();
+        return NOTIFY_OK;
 }
 #endif
 
@@ -2032,6 +2048,7 @@ void __init cpuset_init_smp(void)
         top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
 
         hotcpu_notifier(cpuset_track_online_cpus, 0);
+        hotplug_memory_notifier(cpuset_track_online_nodes, 10);
 }
 
 /**
diff --git a/kernel/exit.c b/kernel/exit.c
index b9c4d8bb72e5..30fcdf16737a 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -40,7 +40,6 @@
 #include <linux/cn_proc.h>
 #include <linux/mutex.h>
 #include <linux/futex.h>
-#include <linux/compat.h>
 #include <linux/pipe_fs_i.h>
 #include <linux/audit.h> /* for audit_free() */
 #include <linux/resource.h>
@@ -1059,14 +1058,6 @@ NORET_TYPE void do_exit(long code)
                 exit_itimers(tsk->signal);
         }
         acct_collect(code, group_dead);
-#ifdef CONFIG_FUTEX
-        if (unlikely(tsk->robust_list))
-                exit_robust_list(tsk);
-#ifdef CONFIG_COMPAT
-        if (unlikely(tsk->compat_robust_list))
-                compat_exit_robust_list(tsk);
-#endif
-#endif
         if (group_dead)
                 tty_audit_exit();
         if (unlikely(tsk->audit_context))
diff --git a/kernel/extable.c b/kernel/extable.c
index a26cb2e17023..adf0cc9c02d6 100644
--- a/kernel/extable.c
+++ b/kernel/extable.c
@@ -66,3 +66,19 @@ int kernel_text_address(unsigned long addr)
                 return 1;
         return module_text_address(addr) != NULL;
 }
+
+/*
+ * On some architectures (PPC64, IA64) function pointers
+ * are actually only tokens to some data that then holds the
+ * real function address. As a result, to find if a function
+ * pointer is part of the kernel text, we need to do some
+ * special dereferencing first.
+ */
+int func_ptr_is_kernel_text(void *ptr)
+{
+        unsigned long addr;
+        addr = (unsigned long) dereference_function_descriptor(ptr);
+        if (core_kernel_text(addr))
+                return 1;
+        return module_text_address(addr) != NULL;
+}
diff --git a/kernel/fork.c b/kernel/fork.c
index f6083561dfe0..2a372a0e206f 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -40,6 +40,7 @@
 #include <linux/jiffies.h>
 #include <linux/tracehook.h>
 #include <linux/futex.h>
+#include <linux/compat.h>
 #include <linux/task_io_accounting_ops.h>
 #include <linux/rcupdate.h>
 #include <linux/ptrace.h>
@@ -519,6 +520,16 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
         struct completion *vfork_done = tsk->vfork_done;
 
+        /* Get rid of any futexes when releasing the mm */
+#ifdef CONFIG_FUTEX
+        if (unlikely(tsk->robust_list))
+                exit_robust_list(tsk);
+#ifdef CONFIG_COMPAT
+        if (unlikely(tsk->compat_robust_list))
+                compat_exit_robust_list(tsk);
+#endif
+#endif
+
         /* Get rid of any cached register state */
         deactivate_mm(tsk, mm);
 
diff --git a/kernel/futex.c b/kernel/futex.c
index 8af10027514b..e10c5c8786a6 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -123,24 +123,6 @@ struct futex_hash_bucket {
 static struct futex_hash_bucket futex_queues[1<<FUTEX_HASHBITS];
 
 /*
- * Take mm->mmap_sem, when futex is shared
- */
-static inline void futex_lock_mm(struct rw_semaphore *fshared)
-{
-        if (fshared)
-                down_read(fshared);
-}
-
-/*
- * Release mm->mmap_sem, when the futex is shared
- */
-static inline void futex_unlock_mm(struct rw_semaphore *fshared)
-{
-        if (fshared)
-                up_read(fshared);
-}
-
-/*
  * We hash on the keys returned from get_futex_key (see below).
  */
 static struct futex_hash_bucket *hash_futex(union futex_key *key)
@@ -161,6 +143,45 @@ static inline int match_futex(union futex_key *key1, union futex_key *key2)
                 && key1->both.offset == key2->both.offset);
 }
 
+/*
+ * Take a reference to the resource addressed by a key.
+ * Can be called while holding spinlocks.
+ *
+ */
+static void get_futex_key_refs(union futex_key *key)
+{
+        if (!key->both.ptr)
+                return;
+
+        switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
+        case FUT_OFF_INODE:
+                atomic_inc(&key->shared.inode->i_count);
+                break;
+        case FUT_OFF_MMSHARED:
+                atomic_inc(&key->private.mm->mm_count);
+                break;
+        }
+}
+
+/*
+ * Drop a reference to the resource addressed by a key.
+ * The hash bucket spinlock must not be held.
+ */
+static void drop_futex_key_refs(union futex_key *key)
+{
+        if (!key->both.ptr)
+                return;
+
+        switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
+        case FUT_OFF_INODE:
+                iput(key->shared.inode);
+                break;
+        case FUT_OFF_MMSHARED:
+                mmdrop(key->private.mm);
+                break;
+        }
+}
+
 /**
  * get_futex_key - Get parameters which are the keys for a futex.
  * @uaddr: virtual address of the futex
@@ -179,12 +200,10 @@ static inline int match_futex(union futex_key *key1, union futex_key *key2)
  * For other futexes, it points to &current->mm->mmap_sem and
  * caller must have taken the reader lock. but NOT any spinlocks.
  */
-static int get_futex_key(u32 __user *uaddr, struct rw_semaphore *fshared,
-                         union futex_key *key)
+static int get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key)
 {
         unsigned long address = (unsigned long)uaddr;
         struct mm_struct *mm = current->mm;
-        struct vm_area_struct *vma;
         struct page *page;
         int err;
 
@@ -208,100 +227,50 @@ static int get_futex_key(u32 __user *uaddr, struct rw_semaphore *fshared,
                         return -EFAULT;
                 key->private.mm = mm;
                 key->private.address = address;
+                get_futex_key_refs(key);
                 return 0;
         }
-        /*
-         * The futex is hashed differently depending on whether
-         * it's in a shared or private mapping.  So check vma first.
-         */
-        vma = find_extend_vma(mm, address);
-        if (unlikely(!vma))
-                return -EFAULT;
 
-        /*
-         * Permissions.
-         */
-        if (unlikely((vma->vm_flags & (VM_IO|VM_READ)) != VM_READ))
-                return (vma->vm_flags & VM_IO) ? -EPERM : -EACCES;
+again:
+        err = get_user_pages_fast(address, 1, 0, &page);
+        if (err < 0)
+                return err;
+
+        lock_page(page);
+        if (!page->mapping) {
+                unlock_page(page);
+                put_page(page);
+                goto again;
+        }
 
         /*
          * Private mappings are handled in a simple way.
          *
          * NOTE: When userspace waits on a MAP_SHARED mapping, even if
          * it's a read-only handle, it's expected that futexes attach to
-         * the object not the particular process.  Therefore we use
-         * VM_MAYSHARE here, not VM_SHARED which is restricted to shared
-         * mappings of _writable_ handles.
+         * the object not the particular process.
          */
-        if (likely(!(vma->vm_flags & VM_MAYSHARE))) {
-                key->both.offset |= FUT_OFF_MMSHARED; /* reference taken on mm */
+        if (PageAnon(page)) {
+                key->both.offset |= FUT_OFF_MMSHARED; /* ref taken on mm */
                 key->private.mm = mm;
                 key->private.address = address;
-                return 0;
+        } else {
+                key->both.offset |= FUT_OFF_INODE; /* inode-based key */
+                key->shared.inode = page->mapping->host;
+                key->shared.pgoff = page->index;
         }
 
-        /*
-         * Linear file mappings are also simple.
-         */
-        key->shared.inode = vma->vm_file->f_path.dentry->d_inode;
-        key->both.offset |= FUT_OFF_INODE; /* inode-based key. */
-        if (likely(!(vma->vm_flags & VM_NONLINEAR))) {
-                key->shared.pgoff = (((address - vma->vm_start) >> PAGE_SHIFT)
-                                     + vma->vm_pgoff);
-                return 0;
-        }
+        get_futex_key_refs(key);
 
-        /*
-         * We could walk the page table to read the non-linear
-         * pte, and get the page index without fetching the page
-         * from swap.  But that's a lot of code to duplicate here
-         * for a rare case, so we simply fetch the page.
-         */
-        err = get_user_pages(current, mm, address, 1, 0, 0, &page, NULL);
-        if (err >= 0) {
-                key->shared.pgoff =
-                        page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
-                put_page(page);
-                return 0;
-        }
-        return err;
-}
-
-/*
- * Take a reference to the resource addressed by a key.
- * Can be called while holding spinlocks.
- *
- */
-static void get_futex_key_refs(union futex_key *key)
-{
-        if (key->both.ptr == NULL)
-                return;
-        switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
-                case FUT_OFF_INODE:
-                        atomic_inc(&key->shared.inode->i_count);
-                        break;
-                case FUT_OFF_MMSHARED:
-                        atomic_inc(&key->private.mm->mm_count);
-                        break;
-        }
+        unlock_page(page);
+        put_page(page);
+        return 0;
 }
 
-/*
- * Drop a reference to the resource addressed by a key.
- * The hash bucket spinlock must not be held.
- */
-static void drop_futex_key_refs(union futex_key *key)
+static inline
+void put_futex_key(int fshared, union futex_key *key)
 {
-        if (!key->both.ptr)
-                return;
-        switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
-                case FUT_OFF_INODE:
-                        iput(key->shared.inode);
-                        break;
-                case FUT_OFF_MMSHARED:
-                        mmdrop(key->private.mm);
-                        break;
-        }
+        drop_futex_key_refs(key);
 }
 
 static u32 cmpxchg_futex_value_locked(u32 __user *uaddr, u32 uval, u32 newval)
@@ -328,10 +297,8 @@ static int get_futex_value_locked(u32 *dest, u32 __user *from)
 
 /*
  * Fault handling.
- * if fshared is non NULL, current->mm->mmap_sem is already held
  */
-static int futex_handle_fault(unsigned long address,
-                              struct rw_semaphore *fshared, int attempt)
+static int futex_handle_fault(unsigned long address, int attempt)
 {
         struct vm_area_struct * vma;
         struct mm_struct *mm = current->mm;
@@ -340,8 +307,7 @@ static int futex_handle_fault(unsigned long address,
         if (attempt > 2)
                 return ret;
 
-        if (!fshared)
-                down_read(&mm->mmap_sem);
+        down_read(&mm->mmap_sem);
         vma = find_vma(mm, address);
         if (vma && address >= vma->vm_start &&
             (vma->vm_flags & VM_WRITE)) {
@@ -361,8 +327,7 @@ static int futex_handle_fault(unsigned long address,
                                 current->min_flt++;
                 }
         }
-        if (!fshared)
-                up_read(&mm->mmap_sem);
+        up_read(&mm->mmap_sem);
         return ret;
 }
 
@@ -385,6 +350,7 @@ static int refill_pi_state_cache(void)
         /* pi_mutex gets initialized later */
         pi_state->owner = NULL;
         atomic_set(&pi_state->refcount, 1);
+        pi_state->key = FUTEX_KEY_INIT;
 
         current->pi_state_cache = pi_state;
 
@@ -462,7 +428,7 @@ void exit_pi_state_list(struct task_struct *curr)
         struct list_head *next, *head = &curr->pi_state_list;
         struct futex_pi_state *pi_state;
         struct futex_hash_bucket *hb;
-        union futex_key key;
+        union futex_key key = FUTEX_KEY_INIT;
 
         if (!futex_cmpxchg_enabled)
                 return;
@@ -719,20 +685,17 @@ double_lock_hb(struct futex_hash_bucket *hb1, struct futex_hash_bucket *hb2)
  * Wake up all waiters hashed on the physical page that is mapped
  * to this virtual address:
  */
-static int futex_wake(u32 __user *uaddr, struct rw_semaphore *fshared,
-                      int nr_wake, u32 bitset)
+static int futex_wake(u32 __user *uaddr, int fshared, int nr_wake, u32 bitset)
 {
         struct futex_hash_bucket *hb;
         struct futex_q *this, *next;
         struct plist_head *head;
-        union futex_key key;
+        union futex_key key = FUTEX_KEY_INIT;
         int ret;
 
         if (!bitset)
                 return -EINVAL;
 
-        futex_lock_mm(fshared);
-
         ret = get_futex_key(uaddr, fshared, &key);
         if (unlikely(ret != 0))
                 goto out;
@@ -760,7 +723,7 @@ static int futex_wake(u32 __user *uaddr, struct rw_semaphore *fshared,
 
         spin_unlock(&hb->lock);
 out:
-        futex_unlock_mm(fshared);
+        put_futex_key(fshared, &key);
         return ret;
 }
 
@@ -769,19 +732,16 @@ out:
  * to this virtual address:
  */
 static int
-futex_wake_op(u32 __user *uaddr1, struct rw_semaphore *fshared,
-              u32 __user *uaddr2,
+futex_wake_op(u32 __user *uaddr1, int fshared, u32 __user *uaddr2,
               int nr_wake, int nr_wake2, int op)
 {
-        union futex_key key1, key2;
+        union futex_key key1 = FUTEX_KEY_INIT, key2 = FUTEX_KEY_INIT;
         struct futex_hash_bucket *hb1, *hb2;
         struct plist_head *head;
         struct futex_q *this, *next;
         int ret, op_ret, attempt = 0;
 
 retryfull:
-        futex_lock_mm(fshared);
-
         ret = get_futex_key(uaddr1, fshared, &key1);
         if (unlikely(ret != 0))
                 goto out;
@@ -826,18 +786,12 @@ retry:
                  */
                 if (attempt++) {
                         ret = futex_handle_fault((unsigned long)uaddr2,
-                                                 fshared, attempt);
+                                                 attempt);
                         if (ret)
                                 goto out;
                         goto retry;
                 }
 
-                /*
-                 * If we would have faulted, release mmap_sem,
-                 * fault it in and start all over again.
-                 */
-                futex_unlock_mm(fshared);
-
                 ret = get_user(dummy, uaddr2);
                 if (ret)
                         return ret;
@@ -873,7 +827,8 @@ retry:
         if (hb1 != hb2)
                 spin_unlock(&hb2->lock);
 out:
-        futex_unlock_mm(fshared);
+        put_futex_key(fshared, &key2);
+        put_futex_key(fshared, &key1);
 
         return ret;
 }
@@ -882,19 +837,16 @@ out:
  * Requeue all waiters hashed on one physical page to another
  * physical page.
  */
-static int futex_requeue(u32 __user *uaddr1, struct rw_semaphore *fshared,
-                         u32 __user *uaddr2,
+static int futex_requeue(u32 __user *uaddr1, int fshared, u32 __user *uaddr2,
                          int nr_wake, int nr_requeue, u32 *cmpval)
 {
-        union futex_key key1, key2;
+        union futex_key key1 = FUTEX_KEY_INIT, key2 = FUTEX_KEY_INIT;
         struct futex_hash_bucket *hb1, *hb2;
         struct plist_head *head1;
         struct futex_q *this, *next;
         int ret, drop_count = 0;
 
  retry:
-        futex_lock_mm(fshared);
-
         ret = get_futex_key(uaddr1, fshared, &key1);
         if (unlikely(ret != 0))
                 goto out;
@@ -917,12 +869,6 @@ static int futex_requeue(u32 __user *uaddr1, struct rw_semaphore *fshared,
                         if (hb1 != hb2)
                                 spin_unlock(&hb2->lock);
 
-                        /*
-                         * If we would have faulted, release mmap_sem, fault
-                         * it in and start all over again.
-                         */
-                        futex_unlock_mm(fshared);
-
                         ret = get_user(curval, uaddr1);
 
                         if (!ret)
@@ -974,7 +920,8 @@ out_unlock:
                 drop_futex_key_refs(&key1);
 
 out:
-        futex_unlock_mm(fshared);
+        put_futex_key(fshared, &key2);
+        put_futex_key(fshared, &key1);
         return ret;
 }
 
@@ -1096,8 +1043,7 @@ static void unqueue_me_pi(struct futex_q *q)
  * private futexes.
  */
 static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
-                                struct task_struct *newowner,
-                                struct rw_semaphore *fshared)
+                                struct task_struct *newowner, int fshared)
 {
         u32 newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
         struct futex_pi_state *pi_state = q->pi_state;
@@ -1176,7 +1122,7 @@ retry:
 handle_fault:
         spin_unlock(q->lock_ptr);
 
-        ret = futex_handle_fault((unsigned long)uaddr, fshared, attempt++);
+        ret = futex_handle_fault((unsigned long)uaddr, attempt++);
 
         spin_lock(q->lock_ptr);
 
@@ -1200,7 +1146,7 @@ handle_fault:
 
 static long futex_wait_restart(struct restart_block *restart);
 
-static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
+static int futex_wait(u32 __user *uaddr, int fshared,
                       u32 val, ktime_t *abs_time, u32 bitset)
 {
         struct task_struct *curr = current;
@@ -1218,8 +1164,7 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
         q.pi_state = NULL;
         q.bitset = bitset;
  retry:
-        futex_lock_mm(fshared);
-
+        q.key = FUTEX_KEY_INIT;
         ret = get_futex_key(uaddr, fshared, &q.key);
         if (unlikely(ret != 0))
                 goto out_release_sem;
@@ -1251,12 +1196,6 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
         if (unlikely(ret)) {
                 queue_unlock(&q, hb);
 
-                /*
-                 * If we would have faulted, release mmap_sem, fault it in and
-                 * start all over again.
-                 */
-                futex_unlock_mm(fshared);
-
                 ret = get_user(uval, uaddr);
 
                 if (!ret)
@@ -1271,12 +1210,6 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
         queue_me(&q, hb);
 
         /*
-         * Now the futex is queued and we have checked the data, we
-         * don't want to hold mmap_sem while we sleep.
-         */
-        futex_unlock_mm(fshared);
-
-        /*
          * There might have been scheduling since the queue_me(), as we
          * cannot hold a spinlock across the get_user() in case it
          * faults, and we cannot just set TASK_INTERRUPTIBLE state when
@@ -1363,7 +1296,7 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
         queue_unlock(&q, hb);
 
  out_release_sem:
-        futex_unlock_mm(fshared);
+        put_futex_key(fshared, &q.key);
         return ret;
 }
 
@@ -1371,13 +1304,13 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
 static long futex_wait_restart(struct restart_block *restart)
 {
         u32 __user *uaddr = (u32 __user *)restart->futex.uaddr;
-        struct rw_semaphore *fshared = NULL;
+        int fshared = 0;
         ktime_t t;
 
         t.tv64 = restart->futex.time;
         restart->fn = do_no_restart_syscall;
         if (restart->futex.flags & FLAGS_SHARED)
-                fshared = &current->mm->mmap_sem;
+                fshared = 1;
         return (long)futex_wait(uaddr, fshared, restart->futex.val, &t,
                                 restart->futex.bitset);
 }
@@ -1389,7 +1322,7 @@ static long futex_wait_restart(struct restart_block *restart)
  * if there are waiters then it will block, it does PI, etc. (Due to
  * races the kernel might see a 0 value of the futex too.)
  */
-static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
+static int futex_lock_pi(u32 __user *uaddr, int fshared,
                          int detect, ktime_t *time, int trylock)
 {
         struct hrtimer_sleeper timeout, *to = NULL;
@@ -1412,8 +1345,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
 
         q.pi_state = NULL;
  retry:
-        futex_lock_mm(fshared);
-
+        q.key = FUTEX_KEY_INIT;
         ret = get_futex_key(uaddr, fshared, &q.key);
         if (unlikely(ret != 0))
                 goto out_release_sem;
@@ -1502,7 +1434,6 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
                          * exit to complete.
                          */
                         queue_unlock(&q, hb);
-                        futex_unlock_mm(fshared);
                         cond_resched();
                         goto retry;
 
@@ -1534,12 +1465,6 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
          */
         queue_me(&q, hb);
 
-        /*
-         * Now the futex is queued and we have checked the data, we
-         * don't want to hold mmap_sem while we sleep.
-         */
-        futex_unlock_mm(fshared);
-
         WARN_ON(!q.pi_state);
         /*
          * Block on the PI mutex:
@@ -1552,7 +1477,6 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
                 ret = ret ? 0 : -EWOULDBLOCK;
         }
 
-        futex_lock_mm(fshared);
         spin_lock(q.lock_ptr);
 
         if (!ret) {
@@ -1618,7 +1542,6 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
 
         /* Unqueue and drop the lock */
         unqueue_me_pi(&q);
-        futex_unlock_mm(fshared);
 
         if (to)
                 destroy_hrtimer_on_stack(&to->timer);
@@ -1628,7 +1551,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
         queue_unlock(&q, hb);
 
  out_release_sem:
-        futex_unlock_mm(fshared);
+        put_futex_key(fshared, &q.key);
         if (to)
                 destroy_hrtimer_on_stack(&to->timer);
         return ret;
@@ -1645,15 +1568,12 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
         queue_unlock(&q, hb);
 
         if (attempt++) {
-                ret = futex_handle_fault((unsigned long)uaddr, fshared,
-                                         attempt);
+                ret = futex_handle_fault((unsigned long)uaddr, attempt);
                 if (ret)
                         goto out_release_sem;
                 goto retry_unlocked;
         }
 
-        futex_unlock_mm(fshared);
-
         ret = get_user(uval, uaddr);
         if (!ret && (uval != -EFAULT))
                 goto retry;
@@ -1668,13 +1588,13 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
  * This is the in-kernel slowpath: we look up the PI state (if any),
  * and do the rt-mutex unlock.
  */
-static int futex_unlock_pi(u32 __user *uaddr, struct rw_semaphore *fshared)
+static int futex_unlock_pi(u32 __user *uaddr, int fshared)
 {
         struct futex_hash_bucket *hb;
         struct futex_q *this, *next;
         u32 uval;
         struct plist_head *head;
-        union futex_key key;
+        union futex_key key = FUTEX_KEY_INIT;
         int ret, attempt = 0;
 
 retry:
@@ -1685,10 +1605,6 @@ retry:
          */
         if ((uval & FUTEX_TID_MASK) != task_pid_vnr(current))
                 return -EPERM;
-        /*
-         * First take all the futex related locks:
-         */
-        futex_lock_mm(fshared);
 
         ret = get_futex_key(uaddr, fshared, &key);
         if (unlikely(ret != 0))
@@ -1747,7 +1663,7 @@ retry_unlocked:
 out_unlock:
         spin_unlock(&hb->lock);
 out:
-        futex_unlock_mm(fshared);
+        put_futex_key(fshared, &key);
 
         return ret;
 
@@ -1763,16 +1679,13 @@ pi_faulted:
         spin_unlock(&hb->lock);
 
         if (attempt++) {
-                ret = futex_handle_fault((unsigned long)uaddr, fshared,
-                                         attempt);
+                ret = futex_handle_fault((unsigned long)uaddr, attempt);
                 if (ret)
                         goto out;
                 uval = 0;
                 goto retry_unlocked;
         }
 
-        futex_unlock_mm(fshared);
-
         ret = get_user(uval, uaddr);
         if (!ret && (uval != -EFAULT))
                 goto retry;
@@ -1898,8 +1811,7 @@ retry:
                  * PI futexes happens in exit_pi_state():
                  */
                 if (!pi && (uval & FUTEX_WAITERS))
-                        futex_wake(uaddr, &curr->mm->mmap_sem, 1,
-                                   FUTEX_BITSET_MATCH_ANY);
+                        futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY);
         }
         return 0;
 }
@@ -1995,10 +1907,10 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
 {
         int ret = -ENOSYS;
         int cmd = op & FUTEX_CMD_MASK;
-        struct rw_semaphore *fshared = NULL;
+        int fshared = 0;
 
         if (!(op & FUTEX_PRIVATE_FLAG))
-                fshared = &current->mm->mmap_sem;
+                fshared = 1;
 
         switch (cmd) {
         case FUTEX_WAIT:
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 5072cf1685a2..7b8b0f21a5b1 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -304,17 +304,24 @@ int sprint_symbol(char *buffer, unsigned long address)
         char *modname;
         const char *name;
         unsigned long offset, size;
-        char namebuf[KSYM_NAME_LEN];
+        int len;
 
-        name = kallsyms_lookup(address, &size, &offset, &modname, namebuf);
+        name = kallsyms_lookup(address, &size, &offset, &modname, buffer);
         if (!name)
                 return sprintf(buffer, "0x%lx", address);
 
+        if (name != buffer)
+                strcpy(buffer, name);
+        len = strlen(buffer);
+        buffer += len;
+
         if (modname)
-                return sprintf(buffer, "%s+%#lx/%#lx [%s]", name, offset,
-                                size, modname);
+                len += sprintf(buffer, "+%#lx/%#lx [%s]",
+                                                offset, size, modname);
         else
-                return sprintf(buffer, "%s+%#lx/%#lx", name, offset, size);
+                len += sprintf(buffer, "+%#lx/%#lx", offset, size);
+
+        return len;
 }
 
 /* Look up a kernel symbol and print it to the kernel messages. */
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 06e157119d2b..e4bdda8dcf04 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -136,16 +136,16 @@ static inline struct lock_class *hlock_class(struct held_lock *hlock)
 #ifdef CONFIG_LOCK_STAT
 static DEFINE_PER_CPU(struct lock_class_stats[MAX_LOCKDEP_KEYS], lock_stats);
 
-static int lock_contention_point(struct lock_class *class, unsigned long ip)
+static int lock_point(unsigned long points[], unsigned long ip)
 {
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(class->contention_point); i++) {
-                if (class->contention_point[i] == 0) {
-                        class->contention_point[i] = ip;
+        for (i = 0; i < LOCKSTAT_POINTS; i++) {
+                if (points[i] == 0) {
+                        points[i] = ip;
                         break;
                 }
-                if (class->contention_point[i] == ip)
+                if (points[i] == ip)
                         break;
         }
 
@@ -185,6 +185,9 @@ struct lock_class_stats lock_stats(struct lock_class *class)
                 for (i = 0; i < ARRAY_SIZE(stats.contention_point); i++)
                         stats.contention_point[i] += pcs->contention_point[i];
 
+                for (i = 0; i < ARRAY_SIZE(stats.contending_point); i++)
+                        stats.contending_point[i] += pcs->contending_point[i];
+
                 lock_time_add(&pcs->read_waittime, &stats.read_waittime);
                 lock_time_add(&pcs->write_waittime, &stats.write_waittime);
 
@@ -209,6 +212,7 @@ void clear_lock_stats(struct lock_class *class)
                 memset(cpu_stats, 0, sizeof(struct lock_class_stats));
         }
         memset(class->contention_point, 0, sizeof(class->contention_point));
+        memset(class->contending_point, 0, sizeof(class->contending_point));
 }
 
 static struct lock_class_stats *get_lock_stats(struct lock_class *class)
@@ -2999,7 +3003,7 @@ __lock_contended(struct lockdep_map *lock, unsigned long ip)
         struct held_lock *hlock, *prev_hlock;
         struct lock_class_stats *stats;
         unsigned int depth;
-        int i, point;
+        int i, contention_point, contending_point;
 
         depth = curr->lockdep_depth;
         if (DEBUG_LOCKS_WARN_ON(!depth))
@@ -3023,18 +3027,22 @@ __lock_contended(struct lockdep_map *lock, unsigned long ip)
 found_it:
         hlock->waittime_stamp = sched_clock();
 
-        point = lock_contention_point(hlock_class(hlock), ip);
+        contention_point = lock_point(hlock_class(hlock)->contention_point, ip);
+        contending_point = lock_point(hlock_class(hlock)->contending_point,
+                                      lock->ip);
 
         stats = get_lock_stats(hlock_class(hlock));
-        if (point < ARRAY_SIZE(stats->contention_point))
-                stats->contention_point[point]++;
+        if (contention_point < LOCKSTAT_POINTS)
+                stats->contention_point[contention_point]++;
+        if (contending_point < LOCKSTAT_POINTS)
+                stats->contending_point[contending_point]++;
         if (lock->cpu != smp_processor_id())
                 stats->bounces[bounce_contended + !!hlock->read]++;
         put_lock_stats(stats);
 }
 
 static void
-__lock_acquired(struct lockdep_map *lock)
+__lock_acquired(struct lockdep_map *lock, unsigned long ip)
 {
         struct task_struct *curr = current;
         struct held_lock *hlock, *prev_hlock;
@@ -3083,6 +3091,7 @@ found_it:
         put_lock_stats(stats);
 
         lock->cpu = cpu;
+        lock->ip = ip;
 }
 
 void lock_contended(struct lockdep_map *lock, unsigned long ip)
@@ -3104,7 +3113,7 @@ void lock_contended(struct lockdep_map *lock, unsigned long ip)
 }
 EXPORT_SYMBOL_GPL(lock_contended);
 
-void lock_acquired(struct lockdep_map *lock)
+void lock_acquired(struct lockdep_map *lock, unsigned long ip)
 {
         unsigned long flags;
 
@@ -3117,7 +3126,7 @@ void lock_acquired(struct lockdep_map *lock)
         raw_local_irq_save(flags);
         check_flags(flags);
         current->lockdep_recursion = 1;
-        __lock_acquired(lock);
+        __lock_acquired(lock, ip);
         current->lockdep_recursion = 0;
         raw_local_irq_restore(flags);
 }
@@ -3276,10 +3285,10 @@ void __init lockdep_info(void)
 {
         printk("Lock dependency validator: Copyright (c) 2006 Red Hat, Inc., Ingo Molnar\n");
 
-        printk("... MAX_LOCKDEP_SUBCLASSES:    %lu\n", MAX_LOCKDEP_SUBCLASSES);
+        printk("... MAX_LOCKDEP_SUBCLASSES:  %lu\n", MAX_LOCKDEP_SUBCLASSES);
         printk("... MAX_LOCK_DEPTH:          %lu\n", MAX_LOCK_DEPTH);
         printk("... MAX_LOCKDEP_KEYS:        %lu\n", MAX_LOCKDEP_KEYS);
-        printk("... CLASSHASH_SIZE:           %lu\n", CLASSHASH_SIZE);
+        printk("... CLASSHASH_SIZE:          %lu\n", CLASSHASH_SIZE);
         printk("... MAX_LOCKDEP_ENTRIES:     %lu\n", MAX_LOCKDEP_ENTRIES);
         printk("... MAX_LOCKDEP_CHAINS:      %lu\n", MAX_LOCKDEP_CHAINS);
         printk("... CHAINHASH_SIZE:          %lu\n", CHAINHASH_SIZE);
diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
index 20dbcbf9c7dd..13716b813896 100644
--- a/kernel/lockdep_proc.c
+++ b/kernel/lockdep_proc.c
@@ -470,11 +470,12 @@ static void seq_line(struct seq_file *m, char c, int offset, int length)
 
 static void snprint_time(char *buf, size_t bufsiz, s64 nr)
 {
-        unsigned long rem;
+        s64 div;
+        s32 rem;
 
         nr += 5; /* for display rounding */
-        rem = do_div(nr, 1000); /* XXX: do_div_signed */
-        snprintf(buf, bufsiz, "%lld.%02d", (long long)nr, (int)rem/10);
+        div = div_s64_rem(nr, 1000, &rem);
+        snprintf(buf, bufsiz, "%lld.%02d", (long long)div, (int)rem/10);
 }
 
 static void seq_time(struct seq_file *m, s64 time)
@@ -556,7 +557,7 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
         if (stats->read_holdtime.nr)
                 namelen += 2;
 
-        for (i = 0; i < ARRAY_SIZE(class->contention_point); i++) {
+        for (i = 0; i < LOCKSTAT_POINTS; i++) {
                 char sym[KSYM_SYMBOL_LEN];
                 char ip[32];
 
@@ -573,6 +574,23 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
                                 stats->contention_point[i],
                                 ip, sym);
         }
+        for (i = 0; i < LOCKSTAT_POINTS; i++) {
+                char sym[KSYM_SYMBOL_LEN];
+                char ip[32];
+
+                if (class->contending_point[i] == 0)
+                        break;
+
+                if (!i)
+                        seq_line(m, '-', 40-namelen, namelen);
+
+                sprint_symbol(sym, class->contending_point[i]);
+                snprintf(ip, sizeof(ip), "[<%p>]",
+                                (void *)class->contending_point[i]);
+                seq_printf(m, "%40s %14lu %29s %s\n", name,
+                                stats->contending_point[i],
+                                ip, sym);
+        }
         if (i) {
                 seq_puts(m, "\n");
                 seq_line(m, '.', 0, 40 + 1 + 10 * (14 + 1));
@@ -582,7 +600,7 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
 
 static void seq_header(struct seq_file *m)
 {
-        seq_printf(m, "lock_stat version 0.2\n");
+        seq_printf(m, "lock_stat version 0.3\n");
         seq_line(m, '-', 0, 40 + 1 + 10 * (14 + 1));
         seq_printf(m, "%40s %14s %14s %14s %14s %14s %14s %14s %14s "
                         "%14s %14s\n",
diff --git a/kernel/mutex.c b/kernel/mutex.c
index 12c779dc65d4..4f45d4b658ef 100644
--- a/kernel/mutex.c
+++ b/kernel/mutex.c
@@ -59,7 +59,7 @@ EXPORT_SYMBOL(__mutex_init);
  * We also put the fastpath first in the kernel image, to make sure the
  * branch is predicted by the CPU as default-untaken.
  */
-static void noinline __sched
+static __used noinline void __sched
 __mutex_lock_slowpath(atomic_t *lock_count);
 
 /***
@@ -96,7 +96,7 @@ void inline __sched mutex_lock(struct mutex *lock)
 EXPORT_SYMBOL(mutex_lock);
 #endif
 
-static noinline void __sched __mutex_unlock_slowpath(atomic_t *lock_count);
+static __used noinline void __sched __mutex_unlock_slowpath(atomic_t *lock_count);
 
 /***
  * mutex_unlock - release the mutex
@@ -184,7 +184,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
         }
 
 done:
-        lock_acquired(&lock->dep_map);
+        lock_acquired(&lock->dep_map, ip);
         /* got the lock - rejoice! */
         mutex_remove_waiter(lock, &waiter, task_thread_info(task));
         debug_mutex_set_owner(lock, task_thread_info(task));
@@ -268,7 +268,7 @@ __mutex_unlock_common_slowpath(atomic_t *lock_count, int nested)
 /*
  * Release the lock, slowpath:
  */
-static noinline void
+static __used noinline void
 __mutex_unlock_slowpath(atomic_t *lock_count)
 {
         __mutex_unlock_common_slowpath(lock_count, 1);
@@ -313,7 +313,7 @@ int __sched mutex_lock_killable(struct mutex *lock)
 }
 EXPORT_SYMBOL(mutex_lock_killable);
 
-static noinline void __sched
+static __used noinline void __sched
 __mutex_lock_slowpath(atomic_t *lock_count)
 {
         struct mutex *lock = container_of(lock_count, struct mutex, count);
diff --git a/kernel/notifier.c b/kernel/notifier.c
index 4282c0a40a57..61d5aa5eced3 100644
--- a/kernel/notifier.c
+++ b/kernel/notifier.c
@@ -82,6 +82,14 @@ static int __kprobes notifier_call_chain(struct notifier_block **nl,
 
         while (nb && nr_to_call) {
                 next_nb = rcu_dereference(nb->next);
+
+#ifdef CONFIG_DEBUG_NOTIFIERS
+                if (unlikely(!func_ptr_is_kernel_text(nb->notifier_call))) {
+                        WARN(1, "Invalid notifier called!");
+                        nb = next_nb;
+                        continue;
+                }
+#endif
                 ret = nb->notifier_call(nb, val, v);
 
                 if (nr_calls)
diff --git a/kernel/power/main.c b/kernel/power/main.c
index 19122cf6d827..b8f7ce9473e8 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -174,7 +174,7 @@ static void suspend_test_finish(const char *label)
          * has some performance issues.  The stack dump of a WARN_ON
          * is more likely to get the right attention than a printk...
          */
-        WARN_ON(msec > (TEST_SUSPEND_SECONDS * 1000));
+        WARN(msec > (TEST_SUSPEND_SECONDS * 1000), "Component: %s\n", label);
 }
 
 #else
diff --git a/kernel/profile.c b/kernel/profile.c
index 9830a037d8db..5b7d1ac7124c 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -544,7 +544,7 @@ static const struct file_operations proc_profile_operations = {
 };
 
 #ifdef CONFIG_SMP
-static void __init profile_nop(void *unused)
+static inline void profile_nop(void *unused)
 {
 }
 
diff --git a/kernel/rcuclassic.c b/kernel/rcuclassic.c
index 37f72e551542..e503a002f330 100644
--- a/kernel/rcuclassic.c
+++ b/kernel/rcuclassic.c
@@ -191,7 +191,7 @@ static void print_other_cpu_stall(struct rcu_ctrlblk *rcp)
 
         /* OK, time to rat on our buddy... */
 
-        printk(KERN_ERR "RCU detected CPU stalls:");
+        printk(KERN_ERR "INFO: RCU detected CPU stalls:");
         for_each_possible_cpu(cpu) {
                 if (cpu_isset(cpu, rcp->cpumask))
                         printk(" %d", cpu);
@@ -204,7 +204,7 @@ static void print_cpu_stall(struct rcu_ctrlblk *rcp)
 {
         unsigned long flags;
 
-        printk(KERN_ERR "RCU detected CPU %d stall (t=%lu/%lu jiffies)\n",
+        printk(KERN_ERR "INFO: RCU detected CPU %d stall (t=%lu/%lu jiffies)\n",
                         smp_processor_id(), jiffies,
                         jiffies - rcp->gp_start);
         dump_stack();
diff --git a/kernel/relay.c b/kernel/relay.c
index 8d13a7855c08..32b0befdcb6a 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -400,7 +400,7 @@ void relay_reset(struct rchan *chan)
         }
 
         mutex_lock(&relay_channels_mutex);
-        for_each_online_cpu(i)
+        for_each_possible_cpu(i)
                 if (chan->buf[i])
                         __relay_reset(chan->buf[i], 0);
         mutex_unlock(&relay_channels_mutex);
@@ -611,10 +611,9 @@ struct rchan *relay_open(const char *base_filename,
         return chan;
 
 free_bufs:
-        for_each_online_cpu(i) {
-                if (!chan->buf[i])
-                        break;
-                relay_close_buf(chan->buf[i]);
+        for_each_possible_cpu(i) {
+                if (chan->buf[i])
+                        relay_close_buf(chan->buf[i]);
         }
 
         kref_put(&chan->kref, relay_destroy_channel);
diff --git a/kernel/sched.c b/kernel/sched.c
index b388c9b243e9..558e5f284269 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4337,7 +4337,7 @@ void __kprobes sub_preempt_count(int val)
         /*
          * Underflow?
          */
-        if (DEBUG_LOCKS_WARN_ON(val > preempt_count()))
+       if (DEBUG_LOCKS_WARN_ON(val > preempt_count() - (!!kernel_locked())))
                 return;
         /*
          * Is the spinlock portion underflowing?
@@ -7788,13 +7788,14 @@ static int dattrs_equal(struct sched_domain_attr *cur, int idx_cur,
  *
  * The passed in 'doms_new' should be kmalloc'd. This routine takes
  * ownership of it and will kfree it when done with it. If the caller
- * failed the kmalloc call, then it can pass in doms_new == NULL,
- * and partition_sched_domains() will fallback to the single partition
- * 'fallback_doms', it also forces the domains to be rebuilt.
+ * failed the kmalloc call, then it can pass in doms_new == NULL &&
+ * ndoms_new == 1, and partition_sched_domains() will fallback to
+ * the single partition 'fallback_doms', it also forces the domains
+ * to be rebuilt.
  *
- * If doms_new==NULL it will be replaced with cpu_online_map.
- * ndoms_new==0 is a special case for destroying existing domains.
- * It will not create the default domain.
+ * If doms_new == NULL it will be replaced with cpu_online_map.
+ * ndoms_new == 0 is a special case for destroying existing domains,
+ * and it will not create the default domain.
  *
  * Call with hotplug lock held
  */
diff --git a/kernel/softlockup.c b/kernel/softlockup.c
index 3953e4aed733..884e6cd2769c 100644
--- a/kernel/softlockup.c
+++ b/kernel/softlockup.c
@@ -164,7 +164,7 @@ unsigned long __read_mostly sysctl_hung_task_check_count = 1024;
 /*
  * Zero means infinite timeout - no checking done:
  */
-unsigned long __read_mostly sysctl_hung_task_timeout_secs = 120;
+unsigned long __read_mostly sysctl_hung_task_timeout_secs = 480;
 
 unsigned long __read_mostly sysctl_hung_task_warnings = 10;
 
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 9bc4c00872c9..24e8ceacc388 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -112,7 +112,7 @@ static int chill(void *unused)
 int __stop_machine(int (*fn)(void *), void *data, const cpumask_t *cpus)
 {
         struct work_struct *sm_work;
-        int i;
+        int i, ret;
 
         /* Set up initial state. */
         mutex_lock(&lock);
@@ -137,8 +137,9 @@ int __stop_machine(int (*fn)(void *), void *data, const cpumask_t *cpus)
         /* This will release the thread on our CPU. */
         put_cpu();
         flush_workqueue(stop_machine_wq);
+        ret = active.fnret;
         mutex_unlock(&lock);
-        return active.fnret;
+        return ret;
 }
 
 int stop_machine(int (*fn)(void *), void *data, const cpumask_t *cpus)
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index a77b27b11b04..e14a23281707 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -31,7 +31,7 @@ cond_syscall(sys_socketpair);
 cond_syscall(sys_bind);
 cond_syscall(sys_listen);
 cond_syscall(sys_accept);
-cond_syscall(sys_paccept);
+cond_syscall(sys_accept4);
 cond_syscall(sys_connect);
 cond_syscall(sys_getsockname);
 cond_syscall(sys_getpeername);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 4a39d24568c8..78db083390f0 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -185,7 +185,6 @@ enum {
 };
 
 static int ftrace_filtered;
-static int tracing_on;
 
 static LIST_HEAD(ftrace_new_addrs);
 
@@ -327,96 +326,89 @@ ftrace_record_ip(unsigned long ip)
 
 static int
 __ftrace_replace_code(struct dyn_ftrace *rec,
-                      unsigned char *old, unsigned char *new, int enable)
+                      unsigned char *nop, int enable)
 {
         unsigned long ip, fl;
+        unsigned char *call, *old, *new;
 
         ip = rec->ip;
 
-        if (ftrace_filtered && enable) {
+        /*
+         * If this record is not to be traced and
+         * it is not enabled then do nothing.
+         *
+         * If this record is not to be traced and
+         * it is enabled then disabled it.
+         *
+         */
+        if (rec->flags & FTRACE_FL_NOTRACE) {
+                if (rec->flags & FTRACE_FL_ENABLED)
+                        rec->flags &= ~FTRACE_FL_ENABLED;
+                else
+                        return 0;
+
+        } else if (ftrace_filtered && enable) {
                 /*
-                 * If filtering is on:
-                 *
-                 * If this record is set to be filtered and
-                 * is enabled then do nothing.
-                 *
-                 * If this record is set to be filtered and
-                 * it is not enabled, enable it.
-                 *
-                 * If this record is not set to be filtered
-                 * and it is not enabled do nothing.
-                 *
-                 * If this record is set not to trace then
-                 * do nothing.
-                 *
-                 * If this record is set not to trace and
-                 * it is enabled then disable it.
-                 *
-                 * If this record is not set to be filtered and
-                 * it is enabled, disable it.
+                 * Filtering is on:
                  */
 
-                fl = rec->flags & (FTRACE_FL_FILTER | FTRACE_FL_NOTRACE |
-                                   FTRACE_FL_ENABLED);
+                fl = rec->flags & (FTRACE_FL_FILTER | FTRACE_FL_ENABLED);
 
-                if ((fl ==  (FTRACE_FL_FILTER | FTRACE_FL_ENABLED)) ||
-                    (fl ==  (FTRACE_FL_FILTER | FTRACE_FL_NOTRACE)) ||
-                    !fl || (fl == FTRACE_FL_NOTRACE))
+                /* Record is filtered and enabled, do nothing */
+                if (fl == (FTRACE_FL_FILTER | FTRACE_FL_ENABLED))
                         return 0;
 
-                /*
-                 * If it is enabled disable it,
-                 * otherwise enable it!
-                 */
-                if (fl & FTRACE_FL_ENABLED) {
-                        /* swap new and old */
-                        new = old;
-                        old = ftrace_call_replace(ip, FTRACE_ADDR);
+                /* Record is not filtered and is not enabled do nothing */
+                if (!fl)
+                        return 0;
+
+                /* Record is not filtered but enabled, disable it */
+                if (fl == FTRACE_FL_ENABLED)
                         rec->flags &= ~FTRACE_FL_ENABLED;
-                } else {
-                        new = ftrace_call_replace(ip, FTRACE_ADDR);
+                else
+                /* Otherwise record is filtered but not enabled, enable it */
                         rec->flags |= FTRACE_FL_ENABLED;
-                }
         } else {
+                /* Disable or not filtered */
 
                 if (enable) {
-                        /*
-                         * If this record is set not to trace and is
-                         * not enabled, do nothing.
-                         */
-                        fl = rec->flags & (FTRACE_FL_NOTRACE | FTRACE_FL_ENABLED);
-                        if (fl == FTRACE_FL_NOTRACE)
-                                return 0;
-
-                        new = ftrace_call_replace(ip, FTRACE_ADDR);
-                } else
-                        old = ftrace_call_replace(ip, FTRACE_ADDR);
-
-                if (enable) {
+                        /* if record is enabled, do nothing */
                         if (rec->flags & FTRACE_FL_ENABLED)
                                 return 0;
+
                         rec->flags |= FTRACE_FL_ENABLED;
+
                 } else {
+
+                        /* if record is not enabled do nothing */
                         if (!(rec->flags & FTRACE_FL_ENABLED))
                                 return 0;
+
                         rec->flags &= ~FTRACE_FL_ENABLED;
                 }
         }
 
+        call = ftrace_call_replace(ip, FTRACE_ADDR);
+
+        if (rec->flags & FTRACE_FL_ENABLED) {
+                old = nop;
+                new = call;
+        } else {
+                old = call;
+                new = nop;
+        }
+
         return ftrace_modify_code(ip, old, new);
 }
 
 static void ftrace_replace_code(int enable)
 {
         int i, failed;
-        unsigned char *new = NULL, *old = NULL;
+        unsigned char *nop = NULL;
         struct dyn_ftrace *rec;
         struct ftrace_page *pg;
 
-        if (enable)
-                old = ftrace_nop_replace();
-        else
-                new = ftrace_nop_replace();
+        nop = ftrace_nop_replace();
 
         for (pg = ftrace_pages_start; pg; pg = pg->next) {
                 for (i = 0; i < pg->index; i++) {
@@ -434,7 +426,7 @@ static void ftrace_replace_code(int enable)
                                 unfreeze_record(rec);
                         }
 
-                        failed = __ftrace_replace_code(rec, old, new, enable);
+                        failed = __ftrace_replace_code(rec, nop, enable);
                         if (failed && (rec->flags & FTRACE_FL_CONVERTED)) {
                                 rec->flags |= FTRACE_FL_FAILED;
                                 if ((system_state == SYSTEM_BOOTING) ||
@@ -506,13 +498,10 @@ static int __ftrace_modify_code(void *data)
 {
         int *command = data;
 
-        if (*command & FTRACE_ENABLE_CALLS) {
+        if (*command & FTRACE_ENABLE_CALLS)
                 ftrace_replace_code(1);
-                tracing_on = 1;
-        } else if (*command & FTRACE_DISABLE_CALLS) {
+        else if (*command & FTRACE_DISABLE_CALLS)
                 ftrace_replace_code(0);
-                tracing_on = 0;
-        }
 
         if (*command & FTRACE_UPDATE_TRACE_FUNC)
                 ftrace_update_ftrace_func(ftrace_trace_function);
@@ -538,8 +527,7 @@ static void ftrace_startup(void)
 
         mutex_lock(&ftrace_start_lock);
         ftrace_start++;
-        if (ftrace_start == 1)
-                command |= FTRACE_ENABLE_CALLS;
+        command |= FTRACE_ENABLE_CALLS;
 
         if (saved_ftrace_func != ftrace_trace_function) {
                 saved_ftrace_func = ftrace_trace_function;
@@ -677,7 +665,7 @@ static int __init ftrace_dyn_table_alloc(unsigned long num_to_init)
 
         cnt = num_to_init / ENTRIES_PER_PAGE;
         pr_info("ftrace: allocating %ld entries in %d pages\n",
-                num_to_init, cnt);
+                num_to_init, cnt + 1);
 
         for (i = 0; i < cnt; i++) {
                 pg->next = (void *)get_zeroed_page(GFP_KERNEL);
@@ -738,6 +726,9 @@ t_next(struct seq_file *m, void *v, loff_t *pos)
                     ((iter->flags & FTRACE_ITER_FAILURES) &&
                      !(rec->flags & FTRACE_FL_FAILED)) ||
 
+                    ((iter->flags & FTRACE_ITER_FILTER) &&
+                     !(rec->flags & FTRACE_FL_FILTER)) ||
+
                     ((iter->flags & FTRACE_ITER_NOTRACE) &&
                      !(rec->flags & FTRACE_FL_NOTRACE))) {
                         rec = NULL;
@@ -757,13 +748,11 @@ static void *t_start(struct seq_file *m, loff_t *pos)
         void *p = NULL;
         loff_t l = -1;
 
-        if (*pos != iter->pos) {
-                for (p = t_next(m, p, &l); p && l < *pos; p = t_next(m, p, &l))
-                        ;
-        } else {
-                l = *pos;
-                p = t_next(m, p, &l);
-        }
+        if (*pos > iter->pos)
+                *pos = iter->pos;
+
+        l = *pos;
+        p = t_next(m, p, &l);
 
         return p;
 }
@@ -774,15 +763,21 @@ static void t_stop(struct seq_file *m, void *p)
 
 static int t_show(struct seq_file *m, void *v)
 {
+        struct ftrace_iterator *iter = m->private;
         struct dyn_ftrace *rec = v;
         char str[KSYM_SYMBOL_LEN];
+        int ret = 0;
 
         if (!rec)
                 return 0;
 
         kallsyms_lookup(rec->ip, NULL, NULL, NULL, str);
 
-        seq_printf(m, "%s\n", str);
+        ret = seq_printf(m, "%s\n", str);
+        if (ret < 0) {
+                iter->pos--;
+                iter->idx--;
+        }
 
         return 0;
 }
@@ -808,7 +803,7 @@ ftrace_avail_open(struct inode *inode, struct file *file)
                 return -ENOMEM;
 
         iter->pg = ftrace_pages_start;
-        iter->pos = -1;
+        iter->pos = 0;
 
         ret = seq_open(file, &show_ftrace_seq_ops);
         if (!ret) {
@@ -895,7 +890,7 @@ ftrace_regex_open(struct inode *inode, struct file *file, int enable)
 
         if (file->f_mode & FMODE_READ) {
                 iter->pg = ftrace_pages_start;
-                iter->pos = -1;
+                iter->pos = 0;
                 iter->flags = enable ? FTRACE_ITER_FILTER :
                         FTRACE_ITER_NOTRACE;
 
@@ -1186,7 +1181,7 @@ ftrace_regex_release(struct inode *inode, struct file *file, int enable)
 
         mutex_lock(&ftrace_sysctl_lock);
         mutex_lock(&ftrace_start_lock);
-        if (iter->filtered && ftrace_start && ftrace_enabled)
+        if (ftrace_start && ftrace_enabled)
                 ftrace_run_update_code(FTRACE_ENABLE_CALLS);
         mutex_unlock(&ftrace_start_lock);
         mutex_unlock(&ftrace_sysctl_lock);
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 2f76193c3489..f780e9552f91 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -16,14 +16,49 @@
 #include <linux/list.h>
 #include <linux/fs.h>
 
+#include "trace.h"
+
+/* Global flag to disable all recording to ring buffers */
+static int ring_buffers_off __read_mostly;
+
+/**
+ * tracing_on - enable all tracing buffers
+ *
+ * This function enables all tracing buffers that may have been
+ * disabled with tracing_off.
+ */
+void tracing_on(void)
+{
+        ring_buffers_off = 0;
+}
+
+/**
+ * tracing_off - turn off all tracing buffers
+ *
+ * This function stops all tracing buffers from recording data.
+ * It does not disable any overhead the tracers themselves may
+ * be causing. This function simply causes all recording to
+ * the ring buffers to fail.
+ */
+void tracing_off(void)
+{
+        ring_buffers_off = 1;
+}
+
 /* Up this if you want to test the TIME_EXTENTS and normalization */
 #define DEBUG_SHIFT 0
 
 /* FIXME!!! */
 u64 ring_buffer_time_stamp(int cpu)
 {
+        u64 time;
+
+        preempt_disable_notrace();
         /* shift to debug/test normalization and TIME_EXTENTS */
-        return sched_clock() << DEBUG_SHIFT;
+        time = sched_clock() << DEBUG_SHIFT;
+        preempt_enable_notrace();
+
+        return time;
 }
 
 void ring_buffer_normalize_time_stamp(int cpu, u64 *ts)
@@ -503,6 +538,12 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size)
         LIST_HEAD(pages);
         int i, cpu;
 
+        /*
+         * Always succeed at resizing a non-existent buffer:
+         */
+        if (!buffer)
+                return size;
+
         size = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
         size *= BUF_PAGE_SIZE;
         buffer_size = buffer->pages * BUF_PAGE_SIZE;
@@ -576,6 +617,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size)
                 list_del_init(&page->list);
                 free_buffer_page(page);
         }
+        mutex_unlock(&buffer->mutex);
         return -ENOMEM;
 }
 
@@ -1133,6 +1175,9 @@ ring_buffer_lock_reserve(struct ring_buffer *buffer,
         struct ring_buffer_event *event;
         int cpu, resched;
 
+        if (ring_buffers_off)
+                return NULL;
+
         if (atomic_read(&buffer->record_disabled))
                 return NULL;
 
@@ -1249,6 +1294,9 @@ int ring_buffer_write(struct ring_buffer *buffer,
         int ret = -EBUSY;
         int cpu, resched;
 
+        if (ring_buffers_off)
+                return -EBUSY;
+
         if (atomic_read(&buffer->record_disabled))
                 return -EBUSY;
 
@@ -2070,3 +2118,69 @@ int ring_buffer_swap_cpu(struct ring_buffer *buffer_a,
         return 0;
 }
 
+static ssize_t
+rb_simple_read(struct file *filp, char __user *ubuf,
+               size_t cnt, loff_t *ppos)
+{
+        int *p = filp->private_data;
+        char buf[64];
+        int r;
+
+        /* !ring_buffers_off == tracing_on */
+        r = sprintf(buf, "%d\n", !*p);
+
+        return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+}
+
+static ssize_t
+rb_simple_write(struct file *filp, const char __user *ubuf,
+                size_t cnt, loff_t *ppos)
+{
+        int *p = filp->private_data;
+        char buf[64];
+        long val;
+        int ret;
+
+        if (cnt >= sizeof(buf))
+                return -EINVAL;
+
+        if (copy_from_user(&buf, ubuf, cnt))
+                return -EFAULT;
+
+        buf[cnt] = 0;
+
+        ret = strict_strtoul(buf, 10, &val);
+        if (ret < 0)
+                return ret;
+
+        /* !ring_buffers_off == tracing_on */
+        *p = !val;
+
+        (*ppos)++;
+
+        return cnt;
+}
+
+static struct file_operations rb_simple_fops = {
+        .open           = tracing_open_generic,
+        .read           = rb_simple_read,
+        .write          = rb_simple_write,
+};
+
+
+static __init int rb_init_debugfs(void)
+{
+        struct dentry *d_tracer;
+        struct dentry *entry;
+
+        d_tracer = tracing_init_dentry();
+
+        entry = debugfs_create_file("tracing_on", 0644, d_tracer,
+                                    &ring_buffers_off, &rb_simple_fops);
+        if (!entry)
+                pr_warning("Could not create debugfs 'tracing_on' entry\n");
+
+        return 0;
+}
+
+fs_initcall(rb_init_debugfs);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 697eda36b86a..d86e3252f300 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1936,6 +1936,7 @@ __tracing_open(struct inode *inode, struct file *file, int *ret)
                         ring_buffer_read_finish(iter->buffer_iter[cpu]);
         }
         mutex_unlock(&trace_types_lock);
+        kfree(iter);
 
         return ERR_PTR(-ENOMEM);
 }
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index b0f239e443bc..1e3fd3e3436a 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -545,6 +545,16 @@ config DEBUG_SG
 
           If unsure, say N.
 
+config DEBUG_NOTIFIERS
+        bool "Debug notifier call chains"
+        depends on DEBUG_KERNEL
+        help
+          Enable this to turn on sanity checking for notifier call chains.
+          This is most useful for kernel developers to make sure that
+          modules properly unregister themselves from notifier chains.
+          This is a relatively cheap check but if you care about maximum
+          performance, say N.
+
 config FRAME_POINTER
         bool "Compile the kernel with frame pointers"
         depends on DEBUG_KERNEL && \
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 8d2688ff1352..b7b449dafbe5 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -395,7 +395,7 @@ void sg_miter_stop(struct sg_mapping_iter *miter)
                         WARN_ON(!irqs_disabled());
                         kunmap_atomic(miter->addr, KM_BIO_SRC_IRQ);
                 } else
-                        kunmap(miter->addr);
+                        kunmap(miter->page);
 
                 miter->page = NULL;
                 miter->addr = NULL;
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 78330c37a61b..5f6c629a924d 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -467,9 +467,13 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
         dma_addr_t dev_addr;
         void *ret;
         int order = get_order(size);
+        u64 dma_mask = DMA_32BIT_MASK;
+
+        if (hwdev && hwdev->coherent_dma_mask)
+                dma_mask = hwdev->coherent_dma_mask;
 
         ret = (void *)__get_free_pages(flags, order);
-        if (ret && address_needs_mapping(hwdev, virt_to_bus(ret), size)) {
+        if (ret && !is_buffer_dma_capable(dma_mask, virt_to_bus(ret), size)) {
                 /*
                  * The allocated memory isn't reachable by the device.
                  * Fall back on swiotlb_map_single().
@@ -493,9 +497,9 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
         dev_addr = virt_to_bus(ret);
 
         /* Confirm address can be DMA'd by device */
-        if (address_needs_mapping(hwdev, dev_addr, size)) {
+        if (!is_buffer_dma_capable(dma_mask, dev_addr, size)) {
                 printk("hwdev DMA mask = 0x%016Lx, dev_addr = 0x%016Lx\n",
-                       (unsigned long long)*hwdev->dma_mask,
+                       (unsigned long long)dma_mask,
                        (unsigned long long)dev_addr);
 
                 /* DMA_TO_DEVICE to avoid memcpy in unmap_single */
diff --git a/mm/memory.c b/mm/memory.c
index 164951c47305..fc031d68327e 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3049,3 +3049,18 @@ void print_vma_addr(char *prefix, unsigned long ip)
         }
         up_read(&current->mm->mmap_sem);
 }
+
+#ifdef CONFIG_PROVE_LOCKING
+void might_fault(void)
+{
+        might_sleep();
+        /*
+         * it would be nicer only to annotate paths which are not under
+         * pagefault_disable, however that requires a larger audit and
+         * providing helpers like get_user_atomic.
+         */
+        if (!in_atomic() && current->mm)
+                might_lock_read(&current->mm->mmap_sem);
+}
+EXPORT_SYMBOL(might_fault);
+#endif
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 6837a1014372..b5b2b15085a8 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -22,7 +22,6 @@
 #include <linux/highmem.h>
 #include <linux/vmalloc.h>
 #include <linux/ioport.h>
-#include <linux/cpuset.h>
 #include <linux/delay.h>
 #include <linux/migrate.h>
 #include <linux/page-isolation.h>
@@ -498,8 +497,6 @@ int add_memory(int nid, u64 start, u64 size)
         /* we online node here. we can't roll back from here. */
         node_set_online(nid);
 
-        cpuset_track_online_nodes();
-
         if (new_pgdat) {
                 ret = register_one_node(nid);
                 /*
diff --git a/mm/migrate.c b/mm/migrate.c
index 385db89f0c33..1e0d6b237f44 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -522,15 +522,12 @@ static int writeout(struct address_space *mapping, struct page *page)
         remove_migration_ptes(page, page);
 
         rc = mapping->a_ops->writepage(page, &wbc);
-        if (rc < 0)
-                /* I/O Error writing */
-                return -EIO;
 
         if (rc != AOP_WRITEPAGE_ACTIVATE)
                 /* unlocked. Relock */
                 lock_page(page);
 
-        return -EAGAIN;
+        return (rc < 0) ? -EIO : -EAGAIN;
 }
 
 /*
diff --git a/mm/mlock.c b/mm/mlock.c
index a6da2aee940a..1ada366570cb 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -162,7 +162,7 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         unsigned long addr = start;
         struct page *pages[16]; /* 16 gives a reasonable batch */
         int nr_pages = (end - start) / PAGE_SIZE;
-        int ret;
+        int ret = 0;
         int gup_flags = 0;
 
         VM_BUG_ON(start & ~PAGE_MASK);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index ba6b0f5f7fac..30f826d484f0 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -324,14 +324,14 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
 
         BUG_ON(size & ~PAGE_MASK);
 
-        addr = ALIGN(vstart, align);
-
         va = kmalloc_node(sizeof(struct vmap_area),
                         gfp_mask & GFP_RECLAIM_MASK, node);
         if (unlikely(!va))
                 return ERR_PTR(-ENOMEM);
 
 retry:
+        addr = ALIGN(vstart, align);
+
         spin_lock(&vmap_area_lock);
         /* XXX: could have a last_hole cache */
         n = vmap_area_root.rb_node;
@@ -362,7 +362,7 @@ retry:
                                 goto found;
                 }
 
-                while (addr + size >= first->va_start && addr + size <= vend) {
+                while (addr + size > first->va_start && addr + size <= vend) {
                         addr = ALIGN(first->va_end + PAGE_SIZE, align);
 
                         n = rb_next(&first->rb_node);
@@ -522,13 +522,24 @@ static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
 }
 
 /*
+ * Kick off a purge of the outstanding lazy areas. Don't bother if somebody
+ * is already purging.
+ */
+static void try_purge_vmap_area_lazy(void)
+{
+        unsigned long start = ULONG_MAX, end = 0;
+
+        __purge_vmap_area_lazy(&start, &end, 0, 0);
+}
+
+/*
  * Kick off a purge of the outstanding lazy areas.
  */
 static void purge_vmap_area_lazy(void)
 {
         unsigned long start = ULONG_MAX, end = 0;
 
-        __purge_vmap_area_lazy(&start, &end, 0, 0);
+        __purge_vmap_area_lazy(&start, &end, 1, 0);
 }
 
 /*
@@ -539,7 +550,7 @@ static void free_unmap_vmap_area(struct vmap_area *va)
         va->flags |= VM_LAZY_FREE;
         atomic_add((va->va_end - va->va_start) >> PAGE_SHIFT, &vmap_lazy_nr);
         if (unlikely(atomic_read(&vmap_lazy_nr) > lazy_max_pages()))
-                purge_vmap_area_lazy();
+                try_purge_vmap_area_lazy();
 }
 
 static struct vmap_area *find_vmap_area(unsigned long addr)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 3b5860294bb6..7ea1440b53db 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -623,6 +623,8 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                  * Try to allocate it some swap space here.
                  */
                 if (PageAnon(page) && !PageSwapCache(page)) {
+                        if (!(sc->gfp_mask & __GFP_IO))
+                                goto keep_locked;
                         switch (try_to_munlock(page)) {
                         case SWAP_FAIL:         /* shouldn't happen */
                         case SWAP_AGAIN:
@@ -634,6 +636,7 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                         }
                         if (!add_to_swap(page, GFP_ATOMIC))
                                 goto activate_locked;
+                        may_enter_fs = 1;
                 }
 #endif /* CONFIG_SWAP */
 
@@ -1386,9 +1389,9 @@ static void get_scan_ratio(struct zone *zone, struct scan_control *sc,
         file_prio = 200 - sc->swappiness;
 
         /*
-         *                  anon       recent_rotated[0]
-         * %anon = 100 * ----------- / ----------------- * IO cost
-         *               anon + file      rotate_sum
+         * The amount of pressure on anon vs file pages is inversely
+         * proportional to the fraction of recently scanned pages on
+         * each list that were recently referenced and in active use.
          */
         ap = (anon_prio + 1) * (zone->recent_scanned[0] + 1);
         ap /= zone->recent_rotated[0] + 1;
@@ -2368,39 +2371,6 @@ int page_evictable(struct page *page, struct vm_area_struct *vma)
         return 1;
 }
 
-static void show_page_path(struct page *page)
-{
-        char buf[256];
-        if (page_is_file_cache(page)) {
-                struct address_space *mapping = page->mapping;
-                struct dentry *dentry;
-                pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
-
-                spin_lock(&mapping->i_mmap_lock);
-                dentry = d_find_alias(mapping->host);
-                printk(KERN_INFO "rescued: %s %lu\n",
-                       dentry_path(dentry, buf, 256), pgoff);
-                spin_unlock(&mapping->i_mmap_lock);
-        } else {
-#if defined(CONFIG_MM_OWNER) && defined(CONFIG_MMU)
-                struct anon_vma *anon_vma;
-                struct vm_area_struct *vma;
-
-                anon_vma = page_lock_anon_vma(page);
-                if (!anon_vma)
-                        return;
-
-                list_for_each_entry(vma, &anon_vma->head, anon_vma_node) {
-                        printk(KERN_INFO "rescued: anon %s\n",
-                               vma->vm_mm->owner->comm);
-                        break;
-                }
-                page_unlock_anon_vma(anon_vma);
-#endif
-        }
-}
-
-
 /**
  * check_move_unevictable_page - check page for evictability and move to appropriate zone lru list
  * @page: page to check evictability and move to appropriate lru list
@@ -2421,8 +2391,6 @@ retry:
         if (page_evictable(page, NULL)) {
                 enum lru_list l = LRU_INACTIVE_ANON + page_is_file_cache(page);
 
-                show_page_path(page);
-
                 __dec_zone_state(zone, NR_UNEVICTABLE);
                 list_move(&page->lru, &zone->lru[l].list);
                 __inc_zone_state(zone, NR_INACTIVE_ANON + l);
diff --git a/net/9p/Kconfig b/net/9p/Kconfig
index c42c0c400bf9..0663f99e977a 100644
--- a/net/9p/Kconfig
+++ b/net/9p/Kconfig
@@ -13,22 +13,24 @@ menuconfig NET_9P
 
           If unsure, say N.
 
+if NET_9P
+
 config NET_9P_VIRTIO
-        depends on NET_9P && EXPERIMENTAL && VIRTIO
+        depends on EXPERIMENTAL && VIRTIO
         tristate "9P Virtio Transport (Experimental)"
         help
           This builds support for a transports between
           guest partitions and a host partition.
 
 config NET_9P_RDMA
-        depends on NET_9P && INFINIBAND && EXPERIMENTAL
+        depends on INET && INFINIBAND && EXPERIMENTAL
         tristate "9P RDMA Transport (Experimental)"
         help
-          This builds support for a RDMA transport.
+          This builds support for an RDMA transport.
 
 config NET_9P_DEBUG
         bool "Debug information"
-        depends on NET_9P
         help
           Say Y if you want the 9P subsystem to log debug information.
 
+endif
diff --git a/net/compat.c b/net/compat.c
index 6ce1a1cadcc0..a3a2ba0fac08 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -725,7 +725,7 @@ EXPORT_SYMBOL(compat_mc_getsockopt);
 static unsigned char nas[19]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
                                 AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
                                 AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-                                AL(6)};
+                                AL(4)};
 #undef AL
 
 asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
@@ -738,52 +738,13 @@ asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, uns
         return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
-asmlinkage long compat_sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
-                                   int __user *upeer_addrlen,
-                                   const compat_sigset_t __user *sigmask,
-                                   compat_size_t sigsetsize, int flags)
-{
-        compat_sigset_t ss32;
-        sigset_t ksigmask, sigsaved;
-        int ret;
-
-        if (sigmask) {
-                if (sigsetsize != sizeof(compat_sigset_t))
-                        return -EINVAL;
-                if (copy_from_user(&ss32, sigmask, sizeof(ss32)))
-                        return -EFAULT;
-                sigset_from_compat(&ksigmask, &ss32);
-
-                sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
-                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
-        }
-
-        ret = do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
-
-        if (ret == -ERESTARTNOHAND) {
-                /*
-                 * Don't restore the signal mask yet. Let do_signal() deliver
-                 * the signal on the way back to userspace, before the signal
-                 * mask is restored.
-                 */
-                if (sigmask) {
-                        memcpy(&current->saved_sigmask, &sigsaved,
-                               sizeof(sigsaved));
-                        set_restore_sigmask();
-                }
-        } else if (sigmask)
-                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
-
-        return ret;
-}
-
 asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
 {
         int ret;
         u32 a[6];
         u32 a0, a1;
 
-        if (call < SYS_SOCKET || call > SYS_PACCEPT)
+        if (call < SYS_SOCKET || call > SYS_ACCEPT4)
                 return -EINVAL;
         if (copy_from_user(a, args, nas[call]))
                 return -EFAULT;
@@ -804,7 +765,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
                 ret = sys_listen(a0, a1);
                 break;
         case SYS_ACCEPT:
-                ret = do_accept(a0, compat_ptr(a1), compat_ptr(a[2]), 0);
+                ret = sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), 0);
                 break;
         case SYS_GETSOCKNAME:
                 ret = sys_getsockname(a0, compat_ptr(a1), compat_ptr(a[2]));
@@ -844,9 +805,8 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
         case SYS_RECVMSG:
                 ret = compat_sys_recvmsg(a0, compat_ptr(a1), a[2]);
                 break;
-        case SYS_PACCEPT:
-                ret = compat_sys_paccept(a0, compat_ptr(a1), compat_ptr(a[2]),
-                                         compat_ptr(a[3]), a[4], a[5]);
+        case SYS_ACCEPT4:
+                ret = sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), a[3]);
                 break;
         default:
                 ret = -EINVAL;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index a47f5bad110d..8997e912aaaf 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1973,13 +1973,7 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
 
         /* make sure that we don't pick a non-existing transmit queue */
         ntxq = pkt_dev->odev->real_num_tx_queues;
-        if (ntxq > num_online_cpus() && (pkt_dev->flags & F_QUEUE_MAP_CPU)) {
-                printk(KERN_WARNING "pktgen: WARNING: QUEUE_MAP_CPU "
-                       "disabled because CPU count (%d) exceeds number "
-                       "of tx queues (%d) on %s\n", num_online_cpus(), ntxq,
-                       pkt_dev->odev->name);
-                pkt_dev->flags &= ~F_QUEUE_MAP_CPU;
-        }
+
         if (ntxq <= pkt_dev->queue_map_min) {
                 printk(KERN_WARNING "pktgen: WARNING: Requested "
                        "queue_map_min (zero-based) (%d) exceeds valid range "
@@ -2202,6 +2196,7 @@ static void set_cur_queue_map(struct pktgen_dev *pkt_dev)
                 }
                 pkt_dev->cur_queue_map = t;
         }
+        pkt_dev->cur_queue_map  = pkt_dev->cur_queue_map % pkt_dev->odev->real_num_tx_queues;
 }
 
 /* Increment/randomize headers according to flags and current values
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 31f29d2989fd..4dfb6b4d4559 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -878,7 +878,9 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                 if (ifm->ifi_change)
                         flags = (flags & ifm->ifi_change) |
                                 (dev->flags & ~ifm->ifi_change);
-                dev_change_flags(dev, flags);
+                err = dev_change_flags(dev, flags);
+                if (err < 0)
+                        goto errout;
         }
 
         if (tb[IFLA_TXQLEN])
diff --git a/net/core/scm.c b/net/core/scm.c
index ab242cc1acca..b12303dd39d9 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -75,7 +75,6 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                 if (!fpl)
                         return -ENOMEM;
                 *fplp = fpl;
-                INIT_LIST_HEAD(&fpl->list);
                 fpl->count = 0;
         }
         fpp = &fpl->fp[fpl->count];
@@ -301,7 +300,6 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
 
         new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
         if (new_fpl) {
-                INIT_LIST_HEAD(&new_fpl->list);
                 for (i=fpl->count-1; i>=0; i--)
                         get_file(fpl->fp[i]);
                 memcpy(new_fpl, fpl, sizeof(*fpl));
diff --git a/net/core/sock.c b/net/core/sock.c
index 5e2a3132a8c9..341e39456952 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -136,7 +136,6 @@
 static struct lock_class_key af_family_keys[AF_MAX];
 static struct lock_class_key af_family_slock_keys[AF_MAX];
 
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
 /*
  * Make lock validator output more readable. (we pre-construct these
  * strings build-time, so that runtime initialization of socket
@@ -187,7 +186,6 @@ static const char *af_family_clock_key_strings[AF_MAX+1] = {
   "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
   "clock-AF_MAX"
 };
-#endif
 
 /*
  * sk_callback_lock locking rules are per-address-family,
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1fbff5fa4241..1aa2dc9e380e 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1117,6 +1117,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                         },
                 },
                 .proto = sk->sk_protocol,
+                .flags = inet_sk_flowi_flags(sk),
                 .uli_u = {
                         .ports = {
                                 .sport = inet->sport,
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 861978a4f1a8..cfb38ac9d698 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -209,9 +209,17 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
 
                 hash = protocol & (MAX_INET_PROTOS - 1);
                 ipprot = rcu_dereference(inet_protos[hash]);
-                if (ipprot != NULL && (net == &init_net || ipprot->netns_ok)) {
+                if (ipprot != NULL) {
                         int ret;
 
+                        if (!net_eq(net, &init_net) && !ipprot->netns_ok) {
+                                if (net_ratelimit())
+                                        printk("%s: proto %d isn't netns-ready\n",
+                                                __func__, protocol);
+                                kfree_skb(skb);
+                                goto out;
+                        }
+
                         if (!ipprot->no_policy) {
                                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                                         kfree_skb(skb);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b42e082cc170..25924b1eb2ef 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1945,13 +1945,14 @@ int __init ip_mr_init(void)
                 goto proc_cache_fail;
 #endif
         return 0;
-reg_notif_fail:
-        kmem_cache_destroy(mrt_cachep);
 #ifdef CONFIG_PROC_FS
-proc_vif_fail:
-        unregister_netdevice_notifier(&ip_mr_notifier);
 proc_cache_fail:
         proc_net_remove(&init_net, "ip_mr_vif");
+proc_vif_fail:
+        unregister_netdevice_notifier(&ip_mr_notifier);
 #endif
+reg_notif_fail:
+        del_timer(&ipmr_expire_timer);
+        kmem_cache_destroy(mrt_cachep);
         return err;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cf02701ced48..98c1fd09be88 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -633,6 +633,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                                 .saddr = saddr,
                                                 .tos = tos } },
                                     .proto = sk->sk_protocol,
+                                    .flags = inet_sk_flowi_flags(sk),
                                     .uli_u = { .ports =
                                                { .sport = inet->sport,
                                                  .dport = dport } } };
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 410046a8cc91..e44deb8d4df2 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -661,6 +661,11 @@ int datagram_send_ctl(struct net *net,
                         switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1) {
+                                        err = -EINVAL;
+                                        goto exit_f;
+                                }
                                 break;
 #endif
                         default:
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 52a7eb0e2c2c..0524769632e7 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -224,7 +224,7 @@ static struct file_operations ip6mr_vif_fops = {
         .open    = ip6mr_vif_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 
 static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
@@ -338,7 +338,7 @@ static struct file_operations ip6mr_mfc_fops = {
         .open    = ipmr_mfc_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 #endif
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4e5eac301f91..2aa294be0c79 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -366,11 +366,16 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 }
 
                 /* routing header option needs extra check */
+                retv = -EINVAL;
                 if (optname == IPV6_RTHDR && opt && opt->srcrt) {
                         struct ipv6_rt_hdr *rthdr = opt->srcrt;
                         switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1)
+                                        goto sticky_done;
+
                                 break;
 #endif
                         default:
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 07f0b76e7427..97c17fdd6f75 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -132,7 +132,7 @@ static struct snmp_mib snmp6_udplite6_list[] = {
 
 static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
 {
-        static char name[32];
+        char name[32];
         int i;
 
         /* print by name -- deprecated items */
@@ -144,7 +144,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
                 p = icmp6type2name[icmptype];
                 if (!p) /* don't print un-named types here */
                         continue;
-                (void) snprintf(name, sizeof(name)-1, "Icmp6%s%s",
+                snprintf(name, sizeof(name), "Icmp6%s%s",
                         i & 0x100 ? "Out" : "In", p);
                 seq_printf(seq, "%-32s\t%lu\n", name,
                         snmp_fold_field(mib, i));
@@ -157,7 +157,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
                 val = snmp_fold_field(mib, i);
                 if (!val)
                         continue;
-                (void) snprintf(name, sizeof(name)-1, "Icmp6%sType%u",
+                snprintf(name, sizeof(name), "Icmp6%sType%u",
                         i & 0x100 ?  "Out" : "In", i & 0xff);
                 seq_printf(seq, "%-32s\t%lu\n", name, val);
         }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 14d165f0df75..409bb7716236 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2560,25 +2560,3 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
                 ieee80211_restart_sta_timer(sdata);
         rcu_read_unlock();
 }
-
-/* driver notification call */
-void ieee80211_notify_mac(struct ieee80211_hw *hw,
-                          enum ieee80211_notification_types  notif_type)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
-
-        switch (notif_type) {
-        case IEEE80211_NOTIFY_RE_ASSOC:
-                rtnl_lock();
-                list_for_each_entry(sdata, &local->interfaces, list) {
-                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                                continue;
-
-                        ieee80211_sta_req_auth(sdata, &sdata->u.sta);
-                }
-                rtnl_unlock();
-                break;
-        }
-}
-EXPORT_SYMBOL(ieee80211_notify_mac);
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index defeb7a0d502..9d211f12582b 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -33,9 +33,30 @@
 #include <net/phonet/phonet.h>
 #include <net/phonet/pn_dev.h>
 
-static struct net_proto_family phonet_proto_family;
-static struct phonet_protocol *phonet_proto_get(int protocol);
-static inline void phonet_proto_put(struct phonet_protocol *pp);
+/* Transport protocol registration */
+static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
+static DEFINE_SPINLOCK(proto_tab_lock);
+
+static struct phonet_protocol *phonet_proto_get(int protocol)
+{
+        struct phonet_protocol *pp;
+
+        if (protocol >= PHONET_NPROTO)
+                return NULL;
+
+        spin_lock(&proto_tab_lock);
+        pp = proto_tab[protocol];
+        if (pp && !try_module_get(pp->prot->owner))
+                pp = NULL;
+        spin_unlock(&proto_tab_lock);
+
+        return pp;
+}
+
+static inline void phonet_proto_put(struct phonet_protocol *pp)
+{
+        module_put(pp->prot->owner);
+}
 
 /* protocol family functions */
 
@@ -144,8 +165,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
         struct phonethdr *ph;
         int err;
 
-        if (skb->len + 2 > 0xffff) {
-                /* Phonet length field would overflow */
+        if (skb->len + 2 > 0xffff /* Phonet length field limit */ ||
+            skb->len + sizeof(struct phonethdr) > dev->mtu) {
                 err = -EMSGSIZE;
                 goto drop;
         }
@@ -375,10 +396,6 @@ static struct packet_type phonet_packet_type = {
         .func = phonet_rcv,
 };
 
-/* Transport protocol registration */
-static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static DEFINE_SPINLOCK(proto_tab_lock);
-
 int __init_or_module phonet_proto_register(int protocol,
                                                 struct phonet_protocol *pp)
 {
@@ -412,27 +429,6 @@ void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
 }
 EXPORT_SYMBOL(phonet_proto_unregister);
 
-static struct phonet_protocol *phonet_proto_get(int protocol)
-{
-        struct phonet_protocol *pp;
-
-        if (protocol >= PHONET_NPROTO)
-                return NULL;
-
-        spin_lock(&proto_tab_lock);
-        pp = proto_tab[protocol];
-        if (pp && !try_module_get(pp->prot->owner))
-                pp = NULL;
-        spin_unlock(&proto_tab_lock);
-
-        return pp;
-}
-
-static inline void phonet_proto_put(struct phonet_protocol *pp)
-{
-        module_put(pp->prot->owner);
-}
-
 /* Module registration */
 static int __init phonet_init(void)
 {
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b16ad2972c6b..6ab4a2f92ca0 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -417,6 +417,8 @@ static int qdisc_dump_stab(struct sk_buff *skb, struct qdisc_size_table *stab)
         struct nlattr *nest;
 
         nest = nla_nest_start(skb, TCA_STAB);
+        if (nest == NULL)
+                goto nla_put_failure;
         NLA_PUT(skb, TCA_STAB_BASE, sizeof(stab->szopts), &stab->szopts);
         nla_nest_end(skb, nest);
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 93cd30ce6501..cdcd16fcfeda 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -270,6 +270,8 @@ static void dev_watchdog_down(struct net_device *dev)
 void netif_carrier_on(struct net_device *dev)
 {
         if (test_and_clear_bit(__LINK_STATE_NOCARRIER, &dev->state)) {
+                if (dev->reg_state == NETREG_UNINITIALIZED)
+                        return;
                 linkwatch_fire_event(dev);
                 if (netif_running(dev))
                         __netdev_watchdog_up(dev);
@@ -285,8 +287,11 @@ EXPORT_SYMBOL(netif_carrier_on);
  */
 void netif_carrier_off(struct net_device *dev)
 {
-        if (!test_and_set_bit(__LINK_STATE_NOCARRIER, &dev->state))
+        if (!test_and_set_bit(__LINK_STATE_NOCARRIER, &dev->state)) {
+                if (dev->reg_state == NETREG_UNINITIALIZED)
+                        return;
                 linkwatch_fire_event(dev);
+        }
 }
 EXPORT_SYMBOL(netif_carrier_off);
 
diff --git a/net/socket.c b/net/socket.c
index 57550c3bcabe..92764d836891 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1426,8 +1426,8 @@ asmlinkage long sys_listen(int fd, int backlog)
  *      clean when we restucture accept also.
  */
 
-long do_accept(int fd, struct sockaddr __user *upeer_sockaddr,
-               int __user *upeer_addrlen, int flags)
+asmlinkage long sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
+                            int __user *upeer_addrlen, int flags)
 {
         struct socket *sock, *newsock;
         struct file *newfile;
@@ -1510,66 +1510,10 @@ out_fd:
         goto out_put;
 }
 
-#if 0
-#ifdef HAVE_SET_RESTORE_SIGMASK
-asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
-                            int __user *upeer_addrlen,
-                            const sigset_t __user *sigmask,
-                            size_t sigsetsize, int flags)
-{
-        sigset_t ksigmask, sigsaved;
-        int ret;
-
-        if (sigmask) {
-                /* XXX: Don't preclude handling different sized sigset_t's.  */
-                if (sigsetsize != sizeof(sigset_t))
-                        return -EINVAL;
-                if (copy_from_user(&ksigmask, sigmask, sizeof(ksigmask)))
-                        return -EFAULT;
-
-                sigdelsetmask(&ksigmask, sigmask(SIGKILL)|sigmask(SIGSTOP));
-                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
-        }
-
-        ret = do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
-
-        if (ret < 0 && signal_pending(current)) {
-                /*
-                 * Don't restore the signal mask yet. Let do_signal() deliver
-                 * the signal on the way back to userspace, before the signal
-                 * mask is restored.
-                 */
-                if (sigmask) {
-                        memcpy(&current->saved_sigmask, &sigsaved,
-                               sizeof(sigsaved));
-                        set_restore_sigmask();
-                }
-        } else if (sigmask)
-                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
-
-        return ret;
-}
-#else
-asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
-                            int __user *upeer_addrlen,
-                            const sigset_t __user *sigmask,
-                            size_t sigsetsize, int flags)
-{
-        /* The platform does not support restoring the signal mask in the
-         * return path.  So we do not allow using paccept() with a signal
-         * mask.  */
-        if (sigmask)
-                return -EINVAL;
-
-        return do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
-}
-#endif
-#endif
-
 asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
                            int __user *upeer_addrlen)
 {
-        return do_accept(fd, upeer_sockaddr, upeer_addrlen, 0);
+        return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
 }
 
 /*
@@ -2096,7 +2040,7 @@ static const unsigned char nargs[19]={
         AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
         AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
         AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-        AL(6)
+        AL(4)
 };
 
 #undef AL
@@ -2115,7 +2059,7 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
         unsigned long a0, a1;
         int err;
 
-        if (call < 1 || call > SYS_PACCEPT)
+        if (call < 1 || call > SYS_ACCEPT4)
                 return -EINVAL;
 
         /* copy_from_user should be SMP safe. */
@@ -2143,9 +2087,8 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
                 err = sys_listen(a0, a1);
                 break;
         case SYS_ACCEPT:
-                err =
-                    do_accept(a0, (struct sockaddr __user *)a1,
-                              (int __user *)a[2], 0);
+                err = sys_accept4(a0, (struct sockaddr __user *)a1,
+                                  (int __user *)a[2], 0);
                 break;
         case SYS_GETSOCKNAME:
                 err =
@@ -2192,12 +2135,9 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
         case SYS_RECVMSG:
                 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
                 break;
-        case SYS_PACCEPT:
-                err =
-                    sys_paccept(a0, (struct sockaddr __user *)a1,
-                                (int __user *)a[2],
-                                (const sigset_t __user *) a[3],
-                                a[4], a[5]);
+        case SYS_ACCEPT4:
+                err = sys_accept4(a0, (struct sockaddr __user *)a1,
+                                  (int __user *)a[2], a[3]);
                 break;
         default:
                 err = -EINVAL;
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 744b79fdcb19..4028502f0528 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -133,13 +133,29 @@ static int
 generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
 {
         struct generic_cred *gcred = container_of(cred, struct generic_cred, gc_base);
+        int i;
 
         if (gcred->acred.uid != acred->uid ||
             gcred->acred.gid != acred->gid ||
-            gcred->acred.group_info != acred->group_info ||
             gcred->acred.machine_cred != acred->machine_cred)
-                return 0;
+                goto out_nomatch;
+
+        /* Optimisation in the case where pointers are identical... */
+        if (gcred->acred.group_info == acred->group_info)
+                goto out_match;
+
+        /* Slow path... */
+        if (gcred->acred.group_info->ngroups != acred->group_info->ngroups)
+                goto out_nomatch;
+        for (i = 0; i < gcred->acred.group_info->ngroups; i++) {
+                if (GROUP_AT(gcred->acred.group_info, i) !=
+                                GROUP_AT(acred->group_info, i))
+                        goto out_nomatch;
+        }
+out_match:
         return 1;
+out_nomatch:
+        return 0;
 }
 
 void __init rpc_init_generic_auth(void)
diff --git a/sound/pci/hda/hda_beep.c b/sound/pci/hda/hda_beep.c
index 9b77b3e0fa98..3ecd7e797dee 100644
--- a/sound/pci/hda/hda_beep.c
+++ b/sound/pci/hda/hda_beep.c
@@ -37,6 +37,9 @@ static void snd_hda_generate_beep(struct work_struct *work)
                 container_of(work, struct hda_beep, beep_work);
         struct hda_codec *codec = beep->codec;
 
+        if (!beep->enabled)
+                return;
+
         /* generate tone */
         snd_hda_codec_write_cache(codec, beep->nid, 0,
                         AC_VERB_SET_BEEP_CONTROL, beep->tone);
@@ -85,6 +88,10 @@ int snd_hda_attach_beep_device(struct hda_codec *codec, int nid)
         snprintf(beep->phys, sizeof(beep->phys),
                 "card%d/codec#%d/beep0", codec->bus->card->number, codec->addr);
         input_dev = input_allocate_device();
+        if (!input_dev) {
+                kfree(beep);
+                return -ENOMEM;
+        }
 
         /* setup digital beep device */
         input_dev->name = "HDA Digital PCBeep";
@@ -115,6 +122,7 @@ int snd_hda_attach_beep_device(struct hda_codec *codec, int nid)
         beep->nid = nid;
         beep->dev = input_dev;
         beep->codec = codec;
+        beep->enabled = 1;
         codec->beep = beep;
 
         INIT_WORK(&beep->beep_work, &snd_hda_generate_beep);
diff --git a/sound/pci/hda/hda_beep.h b/sound/pci/hda/hda_beep.h
index de4036e6e710..b9679f081cae 100644
--- a/sound/pci/hda/hda_beep.h
+++ b/sound/pci/hda/hda_beep.h
@@ -31,6 +31,7 @@ struct hda_beep {
         char phys[32];
         int tone;
         int nid;
+        int enabled;
         struct work_struct beep_work; /* scheduled task for beep event */
 };
 
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 4300a679cd86..9563b5bbb272 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -36,9 +36,11 @@
 #include "hda_beep.h"
 
 #define NUM_CONTROL_ALLOC       32
+
+#define STAC_VREF_EVENT         0x00
+#define STAC_INSERT_EVENT       0x10
 #define STAC_PWR_EVENT          0x20
 #define STAC_HP_EVENT           0x30
-#define STAC_VREF_EVENT         0x40
 
 enum {
         STAC_REF,
@@ -1686,6 +1688,10 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
         /* SigmaTel reference board */
         SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
                       "DFI LanParty", STAC_92HD71BXX_REF),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30f2,
+                      "HP dv5", STAC_HP_M4),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30f4,
+                      "HP dv7", STAC_HP_M4),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x361a,
                                 "unknown HP", STAC_HP_M4),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
@@ -2587,8 +2593,10 @@ static struct snd_kcontrol_new stac92xx_control_templates[] = {
 };
 
 /* add dynamic controls */
-static int stac92xx_add_control_idx(struct sigmatel_spec *spec, int type,
-                int idx, const char *name, unsigned long val)
+static int stac92xx_add_control_temp(struct sigmatel_spec *spec,
+                                     struct snd_kcontrol_new *ktemp,
+                                     int idx, const char *name,
+                                     unsigned long val)
 {
         struct snd_kcontrol_new *knew;
 
@@ -2607,20 +2615,29 @@ static int stac92xx_add_control_idx(struct sigmatel_spec *spec, int type,
         }
 
         knew = &spec->kctl_alloc[spec->num_kctl_used];
-        *knew = stac92xx_control_templates[type];
+        *knew = *ktemp;
         knew->index = idx;
         knew->name = kstrdup(name, GFP_KERNEL);
-        if (! knew->name)
+        if (!knew->name)
                 return -ENOMEM;
         knew->private_value = val;
         spec->num_kctl_used++;
         return 0;
 }
 
+static inline int stac92xx_add_control_idx(struct sigmatel_spec *spec,
+                                           int type, int idx, const char *name,
+                                           unsigned long val)
+{
+        return stac92xx_add_control_temp(spec,
+                                         &stac92xx_control_templates[type],
+                                         idx, name, val);
+}
+
 
 /* add dynamic controls */
-static int stac92xx_add_control(struct sigmatel_spec *spec, int type,
-                const char *name, unsigned long val)
+static inline int stac92xx_add_control(struct sigmatel_spec *spec, int type,
+                                       const char *name, unsigned long val)
 {
         return stac92xx_add_control_idx(spec, type, 0, name, val);
 }
@@ -3062,6 +3079,43 @@ static int stac92xx_auto_create_beep_ctls(struct hda_codec *codec,
         return 0;
 }
 
+#ifdef CONFIG_SND_HDA_INPUT_BEEP
+#define stac92xx_dig_beep_switch_info snd_ctl_boolean_mono_info
+
+static int stac92xx_dig_beep_switch_get(struct snd_kcontrol *kcontrol,
+                                        struct snd_ctl_elem_value *ucontrol)
+{
+        struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
+        ucontrol->value.integer.value[0] = codec->beep->enabled;
+        return 0;
+}
+
+static int stac92xx_dig_beep_switch_put(struct snd_kcontrol *kcontrol,
+                                        struct snd_ctl_elem_value *ucontrol)
+{
+        struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
+        int enabled = !!ucontrol->value.integer.value[0];
+        if (codec->beep->enabled != enabled) {
+                codec->beep->enabled = enabled;
+                return 1;
+        }
+        return 0;
+}
+
+static struct snd_kcontrol_new stac92xx_dig_beep_ctrl = {
+        .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+        .info = stac92xx_dig_beep_switch_info,
+        .get = stac92xx_dig_beep_switch_get,
+        .put = stac92xx_dig_beep_switch_put,
+};
+
+static int stac92xx_beep_switch_ctl(struct hda_codec *codec)
+{
+        return stac92xx_add_control_temp(codec->spec, &stac92xx_dig_beep_ctrl,
+                                         0, "PC Beep Playback Switch", 0);
+}
+#endif
+
 static int stac92xx_auto_create_mux_input_ctls(struct hda_codec *codec)
 {
         struct sigmatel_spec *spec = codec->spec;
@@ -3368,6 +3422,7 @@ static int stac92xx_parse_auto_config(struct hda_codec *codec, hda_nid_t dig_out
 #ifdef CONFIG_SND_HDA_INPUT_BEEP
         if (spec->digbeep_nid > 0) {
                 hda_nid_t nid = spec->digbeep_nid;
+                unsigned int caps;
 
                 err = stac92xx_auto_create_beep_ctls(codec, nid);
                 if (err < 0)
@@ -3375,6 +3430,14 @@ static int stac92xx_parse_auto_config(struct hda_codec *codec, hda_nid_t dig_out
                 err = snd_hda_attach_beep_device(codec, nid);
                 if (err < 0)
                         return err;
+                /* if no beep switch is available, make its own one */
+                caps = query_amp_caps(codec, nid, HDA_OUTPUT);
+                if (codec->beep &&
+                    !((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT)) {
+                        err = stac92xx_beep_switch_ctl(codec);
+                        if (err < 0)
+                                return err;
+                }
         }
 #endif
 
@@ -4419,6 +4482,13 @@ again:
                 stac92xx_set_config_regs(codec);
         }
 
+        if (spec->board_config > STAC_92HD71BXX_REF) {
+                /* GPIO0 = EAPD */
+                spec->gpio_mask = 0x01;
+                spec->gpio_dir = 0x01;
+                spec->gpio_data = 0x01;
+        }
+
         switch (codec->vendor_id) {
         case 0x111d76b6: /* 4 Port without Analog Mixer */
         case 0x111d76b7:
@@ -4429,10 +4499,10 @@ again:
                 codec->slave_dig_outs = stac92hd71bxx_slave_dig_outs;
                 break;
         case 0x111d7608: /* 5 Port with Analog Mixer */
-                switch (codec->subsystem_id) {
-                case 0x103c361a:
+                switch (spec->board_config) {
+                case STAC_HP_M4:
                         /* Enable VREF power saving on GPIO1 detect */
-                        snd_hda_codec_write(codec, codec->afg, 0,
+                        snd_hda_codec_write_cache(codec, codec->afg, 0,
                                 AC_VERB_SET_GPIO_UNSOLICITED_RSP_MASK, 0x02);
                         snd_hda_codec_write_cache(codec, codec->afg, 0,
                                         AC_VERB_SET_UNSOLICITED_ENABLE,
@@ -4478,13 +4548,6 @@ again:
         spec->aloopback_mask = 0x50;
         spec->aloopback_shift = 0;
 
-        if (spec->board_config > STAC_92HD71BXX_REF) {
-                /* GPIO0 = EAPD */
-                spec->gpio_mask = 0x01;
-                spec->gpio_dir = 0x01;
-                spec->gpio_data = 0x01;
-        }
-
         spec->powerdown_adcs = 1;
         spec->digbeep_nid = 0x26;
         spec->mux_nids = stac92hd71bxx_mux_nids;
@@ -4832,7 +4895,7 @@ static int patch_stac9205(struct hda_codec *codec)
                 stac92xx_set_config_reg(codec, 0x20, 0x1c410030);
 
                 /* Enable unsol response for GPIO4/Dock HP connection */
-                snd_hda_codec_write(codec, codec->afg, 0,
+                snd_hda_codec_write_cache(codec, codec->afg, 0,
                         AC_VERB_SET_GPIO_UNSOLICITED_RSP_MASK, 0x10);
                 snd_hda_codec_write_cache(codec, codec->afg, 0,
                                           AC_VERB_SET_UNSOLICITED_ENABLE,
diff --git a/sound/pci/pcxhr/pcxhr.c b/sound/pci/pcxhr/pcxhr.c
index 0e06c6c9fcc0..73de6e989b3d 100644
--- a/sound/pci/pcxhr/pcxhr.c
+++ b/sound/pci/pcxhr/pcxhr.c
@@ -1229,8 +1229,11 @@ static int __devinit pcxhr_probe(struct pci_dev *pci, const struct pci_device_id
                 return -ENOMEM;
         }
 
-        if (snd_BUG_ON(pci_id->driver_data >= PCI_ID_LAST))
+        if (snd_BUG_ON(pci_id->driver_data >= PCI_ID_LAST)) {
+                kfree(mgr);
+                pci_disable_device(pci);
                 return -ENODEV;
+        }
         card_name = pcxhr_board_params[pci_id->driver_data].board_name;
         mgr->playback_chips = pcxhr_board_params[pci_id->driver_data].playback_chips;
         mgr->capture_chips  = pcxhr_board_params[pci_id->driver_data].capture_chips;