diff --git a/[refs] b/[refs]
index 1bfd6aed7537..8ccb7be754c7 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bb7f5f6c26d0a304fb3af92591a1dddd39b6ac61
+refs/heads/master: 8c5dfd25519bf302ba43daa59976c4d675a594a7
diff --git a/trunk/Documentation/RCU/checklist.txt b/trunk/Documentation/RCU/checklist.txt
index accfe2f5247d..6e253407b3dc 100644
--- a/trunk/Documentation/RCU/checklist.txt
+++ b/trunk/Documentation/RCU/checklist.txt
@@ -298,15 +298,3 @@ over a rather long period of time, but improvements are always welcome!
 
 	Note that, rcu_assign_pointer() and rcu_dereference() relate to
 	SRCU just as they do to other forms of RCU.
-
-15.	The whole point of call_rcu(), synchronize_rcu(), and friends
-	is to wait until all pre-existing readers have finished before
-	carrying out some otherwise-destructive operation.  It is
-	therefore critically important to -first- remove any path
-	that readers can follow that could be affected by the
-	destructive operation, and -only- -then- invoke call_rcu(),
-	synchronize_rcu(), or friends.
-
-	Because these primitives only wait for pre-existing readers,
-	it is the caller's responsibility to guarantee safety to
-	any subsequent readers.
diff --git a/trunk/Documentation/feature-removal-schedule.txt b/trunk/Documentation/feature-removal-schedule.txt
index 20d3b94703a4..5ddbe350487a 100644
--- a/trunk/Documentation/feature-removal-schedule.txt
+++ b/trunk/Documentation/feature-removal-schedule.txt
@@ -335,12 +335,3 @@ Why:	In 2.6.18 the Secmark concept was introduced to replace the "compat_net"
 	Secmark, it is time to deprecate the older mechanism and start the
 	process of removing the old code.
 Who:	Paul Moore <paul.moore@hp.com>
----------------------------
-
-What:	sysfs ui for changing p4-clockmod parameters
-When:	September 2009
-Why:	See commits 129f8ae9b1b5be94517da76009ea956e89104ce8 and
-	e088e4c9cdb618675874becb91b2fd581ee707e6.
-	Removal is subject to fixing any remaining bugs in ACPI which may
-	cause the thermal throttling not to happen at the right time.
-Who:	Dave Jones <davej@redhat.com>, Matthew Garrett <mjg@redhat.com>
diff --git a/trunk/Documentation/networking/ipv6.txt b/trunk/Documentation/networking/ipv6.txt
deleted file mode 100644
index 268e5c103dd8..000000000000
--- a/trunk/Documentation/networking/ipv6.txt
+++ /dev/null
@@ -1,35 +0,0 @@
-
-Options for the ipv6 module are supplied as parameters at load time.
-
-Module options may be given as command line arguments to the insmod
-or modprobe command, but are usually specified in either the
-/etc/modules.conf or /etc/modprobe.conf configuration file, or in a
-distro-specific configuration file.
-
-The available ipv6 module parameters are listed below.  If a parameter
-is not specified the default value is used.
-
-The parameters are as follows:
-
-disable
-
-	Specifies whether to load the IPv6 module, but disable all
-	its functionality.  This might be used when another module
-	has a dependency on the IPv6 module being loaded, but no
-	IPv6 addresses or operations are desired.
-
-	The possible values and their effects are:
-
-	0
-		IPv6 is enabled.
-
-		This is the default value.
-
-	1
-		IPv6 is disabled.
-
-		No IPv6 addresses will be added to interfaces, and
-		it will not be possible to open an IPv6 socket.
-
-		A reboot is required to enable IPv6.
-
diff --git a/trunk/arch/arm/mach-omap2/board-ldp.c b/trunk/arch/arm/mach-omap2/board-ldp.c
index 6031e179926b..f6a13451d1fd 100644
--- a/trunk/arch/arm/mach-omap2/board-ldp.c
+++ b/trunk/arch/arm/mach-omap2/board-ldp.c
@@ -81,7 +81,7 @@ static inline void __init ldp_init_smc911x(void)
 	}
 
 	ldp_smc911x_resources[0].start = cs_mem_base + 0x0;
-	ldp_smc911x_resources[0].end   = cs_mem_base + 0xff;
+	ldp_smc911x_resources[0].end   = cs_mem_base + 0xf;
 	udelay(100);
 
 	eth_gpio = LDP_SMC911X_GPIO;
diff --git a/trunk/arch/m68knommu/platform/5206e/config.c b/trunk/arch/m68knommu/platform/5206e/config.c
index db902540bf2c..d01a5d2b7557 100644
--- a/trunk/arch/m68knommu/platform/5206e/config.c
+++ b/trunk/arch/m68knommu/platform/5206e/config.c
@@ -17,7 +17,6 @@
 #include <asm/coldfire.h>
 #include <asm/mcfsim.h>
 #include <asm/mcfdma.h>
-#include <asm/mcfuart.h>
 
 /***************************************************************************/
 
diff --git a/trunk/arch/m68knommu/platform/528x/config.c b/trunk/arch/m68knommu/platform/528x/config.c
index 44baeb225dc7..dfdb5c2ed8e6 100644
--- a/trunk/arch/m68knommu/platform/528x/config.c
+++ b/trunk/arch/m68knommu/platform/528x/config.c
@@ -24,6 +24,7 @@
 #include <asm/coldfire.h>
 #include <asm/mcfsim.h>
 #include <asm/mcfuart.h>
+#include <asm/mcfqspi.h>
 
 #ifdef CONFIG_MTD_PARTITIONS
 #include <linux/mtd/partitions.h>
@@ -32,6 +33,233 @@
 /***************************************************************************/
 
 void coldfire_reset(void);
+static void coldfire_qspi_cs_control(u8 cs, u8 command);
+
+/***************************************************************************/
+
+#if defined(CONFIG_SPI)
+
+#if defined(CONFIG_WILDFIRE)
+#define SPI_NUM_CHIPSELECTS 	0x02
+#define SPI_PAR_VAL		0x07  /* Enable DIN, DOUT, CLK */
+#define SPI_CS_MASK		0x18
+
+#define FLASH_BLOCKSIZE		(1024*64)
+#define FLASH_NUMBLOCKS		16
+#define FLASH_TYPE		"m25p80"
+
+#define M25P80_CS		0
+#define MMC_CS			1
+
+#ifdef CONFIG_MTD_PARTITIONS
+static struct mtd_partition stm25p_partitions[] = {
+	/* sflash */
+	[0] = {
+		.name = "stm25p80",
+		.offset = 0x00000000,
+		.size = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS,
+		.mask_flags = 0
+	}
+};
+
+#endif
+
+#elif defined(CONFIG_WILDFIREMOD)
+
+#define SPI_NUM_CHIPSELECTS	0x08
+#define SPI_PAR_VAL		0x07  /* Enable DIN, DOUT, CLK */
+#define SPI_CS_MASK		0x78
+
+#define FLASH_BLOCKSIZE		(1024*64)
+#define FLASH_NUMBLOCKS		64
+#define FLASH_TYPE		"m25p32"
+/* Reserve 1M for the kernel parition */
+#define FLASH_KERNEL_SIZE   (1024 * 1024)
+
+#define M25P80_CS		5
+#define MMC_CS			6
+
+#ifdef CONFIG_MTD_PARTITIONS
+static struct mtd_partition stm25p_partitions[] = {
+	/* sflash */
+	[0] = {
+		.name = "kernel",
+		.offset = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS - FLASH_KERNEL_SIZE,
+		.size = FLASH_KERNEL_SIZE,
+		.mask_flags = 0
+	},
+	[1] = {
+		.name = "image",
+		.offset = 0x00000000,
+		.size = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS - FLASH_KERNEL_SIZE,
+		.mask_flags = 0
+	},
+	[2] = {
+		.name = "all",
+		.offset = 0x00000000,
+		.size = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS,
+		.mask_flags = 0
+	}
+};
+#endif
+
+#else
+#define SPI_NUM_CHIPSELECTS 	0x04
+#define SPI_PAR_VAL		0x7F  /* Enable DIN, DOUT, CLK, CS0 - CS4 */
+#endif
+
+#ifdef MMC_CS
+static struct coldfire_spi_chip flash_chip_info = {
+	.mode = SPI_MODE_0,
+	.bits_per_word = 16,
+	.del_cs_to_clk = 17,
+	.del_after_trans = 1,
+	.void_write_data = 0
+};
+
+static struct coldfire_spi_chip mmc_chip_info = {
+	.mode = SPI_MODE_0,
+	.bits_per_word = 16,
+	.del_cs_to_clk = 17,
+	.del_after_trans = 1,
+	.void_write_data = 0xFFFF
+};
+#endif
+
+#ifdef M25P80_CS
+static struct flash_platform_data stm25p80_platform_data = {
+	.name = "ST M25P80 SPI Flash chip",
+#ifdef CONFIG_MTD_PARTITIONS
+	.parts = stm25p_partitions,
+	.nr_parts = sizeof(stm25p_partitions) / sizeof(*stm25p_partitions),
+#endif
+	.type = FLASH_TYPE
+};
+#endif
+
+static struct spi_board_info spi_board_info[] __initdata = {
+#ifdef M25P80_CS
+	{
+		.modalias = "m25p80",
+		.max_speed_hz = 16000000,
+		.bus_num = 1,
+		.chip_select = M25P80_CS,
+		.platform_data = &stm25p80_platform_data,
+		.controller_data = &flash_chip_info
+	},
+#endif
+#ifdef MMC_CS
+	{
+		.modalias = "mmc_spi",
+		.max_speed_hz = 16000000,
+		.bus_num = 1,
+		.chip_select = MMC_CS,
+		.controller_data = &mmc_chip_info
+	}
+#endif
+};
+
+static struct coldfire_spi_master coldfire_master_info = {
+	.bus_num = 1,
+	.num_chipselect = SPI_NUM_CHIPSELECTS,
+	.irq_source = MCF5282_QSPI_IRQ_SOURCE,
+	.irq_vector = MCF5282_QSPI_IRQ_VECTOR,
+	.irq_mask = ((0x01 << MCF5282_QSPI_IRQ_SOURCE) | 0x01),
+	.irq_lp = 0x2B,  /* Level 5 and Priority 3 */
+	.par_val = SPI_PAR_VAL,
+	.cs_control = coldfire_qspi_cs_control,
+};
+
+static struct resource coldfire_spi_resources[] = {
+	[0] = {
+		.name = "qspi-par",
+		.start = MCF5282_QSPI_PAR,
+		.end = MCF5282_QSPI_PAR,
+		.flags = IORESOURCE_MEM
+	},
+
+	[1] = {
+		.name = "qspi-module",
+		.start = MCF5282_QSPI_QMR,
+		.end = MCF5282_QSPI_QMR + 0x18,
+		.flags = IORESOURCE_MEM
+	},
+
+	[2] = {
+		.name = "qspi-int-level",
+		.start = MCF5282_INTC0 + MCFINTC_ICR0 + MCF5282_QSPI_IRQ_SOURCE,
+		.end = MCF5282_INTC0 + MCFINTC_ICR0 + MCF5282_QSPI_IRQ_SOURCE,
+		.flags = IORESOURCE_MEM
+	},
+
+	[3] = {
+		.name = "qspi-int-mask",
+		.start = MCF5282_INTC0 + MCFINTC_IMRL,
+		.end = MCF5282_INTC0 + MCFINTC_IMRL,
+		.flags = IORESOURCE_MEM
+	}
+};
+
+static struct platform_device coldfire_spi = {
+	.name = "spi_coldfire",
+	.id = -1,
+	.resource = coldfire_spi_resources,
+	.num_resources = ARRAY_SIZE(coldfire_spi_resources),
+	.dev = {
+		.platform_data = &coldfire_master_info,
+	}
+};
+
+static void coldfire_qspi_cs_control(u8 cs, u8 command)
+{
+	u8 cs_bit = ((0x01 << cs) << 3) & SPI_CS_MASK;
+
+#if defined(CONFIG_WILDFIRE)
+	u8 cs_mask = ~(((0x01 << cs) << 3) & SPI_CS_MASK);
+#endif
+#if defined(CONFIG_WILDFIREMOD)
+	u8 cs_mask = (cs << 3) & SPI_CS_MASK;
+#endif
+
+	/*
+	 * Don't do anything if the chip select is not
+	 * one of the port qs pins.
+	 */
+	if (command & QSPI_CS_INIT) {
+#if defined(CONFIG_WILDFIRE)
+		MCF5282_GPIO_DDRQS  |= cs_bit;
+		MCF5282_GPIO_PQSPAR &= ~cs_bit;
+#endif
+
+#if defined(CONFIG_WILDFIREMOD)
+		MCF5282_GPIO_DDRQS  |= SPI_CS_MASK;
+		MCF5282_GPIO_PQSPAR &= ~SPI_CS_MASK;
+#endif
+	}
+
+	if (command & QSPI_CS_ASSERT) {
+		MCF5282_GPIO_PORTQS &= ~SPI_CS_MASK;
+		MCF5282_GPIO_PORTQS |= cs_mask;
+	} else if (command & QSPI_CS_DROP) {
+		MCF5282_GPIO_PORTQS |= SPI_CS_MASK;
+	}
+}
+
+static int __init spi_dev_init(void)
+{
+	int retval;
+
+	retval = platform_device_register(&coldfire_spi);
+	if (retval < 0)
+		return retval;
+
+	if (ARRAY_SIZE(spi_board_info))
+		retval = spi_register_board_info(spi_board_info, ARRAY_SIZE(spi_board_info));
+
+	return retval;
+}
+
+#endif /* CONFIG_SPI */
 
 /***************************************************************************/
 
diff --git a/trunk/arch/sh/boards/board-ap325rxa.c b/trunk/arch/sh/boards/board-ap325rxa.c
index 15b6d450fbf0..72da416f6162 100644
--- a/trunk/arch/sh/boards/board-ap325rxa.c
+++ b/trunk/arch/sh/boards/board-ap325rxa.c
@@ -22,7 +22,6 @@
 #include <linux/gpio.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/spi_gpio.h>
-#include <media/soc_camera.h>
 #include <media/soc_camera_platform.h>
 #include <media/sh_mobile_ceu.h>
 #include <video/sh_mobile_lcdc.h>
diff --git a/trunk/arch/x86/Kconfig b/trunk/arch/x86/Kconfig
index 87717f3687d2..31758378bcd2 100644
--- a/trunk/arch/x86/Kconfig
+++ b/trunk/arch/x86/Kconfig
@@ -1431,7 +1431,7 @@ config CRASH_DUMP
 config KEXEC_JUMP
 	bool "kexec jump (EXPERIMENTAL)"
 	depends on EXPERIMENTAL
-	depends on KEXEC && HIBERNATION
+	depends on KEXEC && HIBERNATION && X86_32
 	---help---
 	  Jump between original kernel and kexeced kernel and invoke
 	  code in physical address mode via KEXEC
diff --git a/trunk/arch/x86/include/asm/kexec.h b/trunk/arch/x86/include/asm/kexec.h
index 317ff1703d0b..0ceb6d19ed30 100644
--- a/trunk/arch/x86/include/asm/kexec.h
+++ b/trunk/arch/x86/include/asm/kexec.h
@@ -9,13 +9,13 @@
 # define PAGES_NR		4
 #else
 # define PA_CONTROL_PAGE	0
-# define VA_CONTROL_PAGE	1
-# define PA_TABLE_PAGE		2
-# define PA_SWAP_PAGE		3
-# define PAGES_NR		4
+# define PA_TABLE_PAGE		1
+# define PAGES_NR		2
 #endif
 
+#ifdef CONFIG_X86_32
 # define KEXEC_CONTROL_CODE_MAX_SIZE	2048
+#endif
 
 #ifndef __ASSEMBLY__
 
@@ -136,11 +136,10 @@ relocate_kernel(unsigned long indirection_page,
 		unsigned int has_pae,
 		unsigned int preserve_context);
 #else
-unsigned long
+NORET_TYPE void
 relocate_kernel(unsigned long indirection_page,
 		unsigned long page_list,
-		unsigned long start_address,
-		unsigned int preserve_context);
+		unsigned long start_address) ATTRIB_NORET;
 #endif
 
 #define ARCH_HAS_KIMAGE_ARCH
diff --git a/trunk/arch/x86/include/asm/linkage.h b/trunk/arch/x86/include/asm/linkage.h
index 12d55e773eb6..a0d70b46c27c 100644
--- a/trunk/arch/x86/include/asm/linkage.h
+++ b/trunk/arch/x86/include/asm/linkage.h
@@ -1,8 +1,6 @@
 #ifndef _ASM_X86_LINKAGE_H
 #define _ASM_X86_LINKAGE_H
 
-#include <linux/stringify.h>
-
 #undef notrace
 #define notrace __attribute__((no_instrument_function))
 
@@ -55,9 +53,14 @@
 	.globl name;	\
 	name:
 
-#if defined(CONFIG_X86_64) || defined(CONFIG_X86_ALIGNMENT_16)
-#define __ALIGN		.p2align 4, 0x90
-#define __ALIGN_STR	__stringify(__ALIGN)
+#ifdef CONFIG_X86_64
+#define __ALIGN .p2align 4,,15
+#define __ALIGN_STR ".p2align 4,,15"
+#endif
+
+#ifdef CONFIG_X86_ALIGNMENT_16
+#define __ALIGN .align 16,0x90
+#define __ALIGN_STR ".align 16,0x90"
 #endif
 
 #endif /* __ASSEMBLY__ */
diff --git a/trunk/arch/x86/kernel/cpu/common.c b/trunk/arch/x86/kernel/cpu/common.c
index 826d5c876278..f8869978bbb7 100644
--- a/trunk/arch/x86/kernel/cpu/common.c
+++ b/trunk/arch/x86/kernel/cpu/common.c
@@ -1078,8 +1078,7 @@ void __cpuinit cpu_init(void)
 
 	atomic_inc(&init_mm.mm_count);
 	me->active_mm = &init_mm;
-	if (me->mm)
-		BUG();
+	BUG_ON(me->mm);
 	enter_lazy_tlb(&init_mm, me);
 
 	load_sp0(t, &current->thread);
@@ -1145,8 +1144,7 @@ void __cpuinit cpu_init(void)
 	 */
 	atomic_inc(&init_mm.mm_count);
 	curr->active_mm = &init_mm;
-	if (curr->mm)
-		BUG();
+	BUG_ON(curr->mm);
 	enter_lazy_tlb(&init_mm, curr);
 
 	load_sp0(t, thread);
diff --git a/trunk/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c b/trunk/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
index 3178c3acd97e..b585e04cbc9e 100644
--- a/trunk/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/trunk/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
@@ -277,6 +277,7 @@ static struct cpufreq_driver p4clockmod_driver = {
 	.name		= "p4-clockmod",
 	.owner		= THIS_MODULE,
 	.attr		= p4clockmod_attr,
+	.hide_interface	= 1,
 };
 
 
diff --git a/trunk/arch/x86/kernel/cpu/mcheck/mce_64.c b/trunk/arch/x86/kernel/cpu/mcheck/mce_64.c
index ca14604611ec..bfbd5323a635 100644
--- a/trunk/arch/x86/kernel/cpu/mcheck/mce_64.c
+++ b/trunk/arch/x86/kernel/cpu/mcheck/mce_64.c
@@ -639,7 +639,7 @@ static void mce_init_timer(void)
 	if (!next_interval)
 		return;
 	setup_timer(t, mcheck_timer, smp_processor_id());
-	t->expires = round_jiffies(jiffies + next_interval);
+	t->expires = round_jiffies_relative(jiffies + next_interval);
 	add_timer(t);
 }
 
@@ -1110,7 +1110,7 @@ static int __cpuinit mce_cpu_callback(struct notifier_block *nfb,
 		break;
 	case CPU_DOWN_FAILED:
 	case CPU_DOWN_FAILED_FROZEN:
-		t->expires = round_jiffies(jiffies + next_interval);
+		t->expires = round_jiffies_relative(jiffies + next_interval);
 		add_timer_on(t, cpu);
 		smp_call_function_single(cpu, mce_reenable_cpu, &action, 1);
 		break;
diff --git a/trunk/arch/x86/kernel/machine_kexec_32.c b/trunk/arch/x86/kernel/machine_kexec_32.c
index e7368c1da01d..f5fc8c781a62 100644
--- a/trunk/arch/x86/kernel/machine_kexec_32.c
+++ b/trunk/arch/x86/kernel/machine_kexec_32.c
@@ -14,12 +14,12 @@
 #include <linux/ftrace.h>
 #include <linux/suspend.h>
 #include <linux/gfp.h>
-#include <linux/io.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
 #include <asm/tlbflush.h>
 #include <asm/mmu_context.h>
+#include <asm/io.h>
 #include <asm/apic.h>
 #include <asm/cpufeature.h>
 #include <asm/desc.h>
@@ -63,7 +63,7 @@ static void load_segments(void)
 		"\tmovl %%eax,%%fs\n"
 		"\tmovl %%eax,%%gs\n"
 		"\tmovl %%eax,%%ss\n"
-		: : : "eax", "memory");
+		::: "eax", "memory");
 #undef STR
 #undef __STR
 }
@@ -205,8 +205,7 @@ void machine_kexec(struct kimage *image)
 
 	if (image->preserve_context) {
 #ifdef CONFIG_X86_IO_APIC
-		/*
-		 * We need to put APICs in legacy mode so that we can
+		/* We need to put APICs in legacy mode so that we can
 		 * get timer interrupts in second kernel. kexec/kdump
 		 * paths already have calls to disable_IO_APIC() in
 		 * one form or other. kexec jump path also need
@@ -228,8 +227,7 @@ void machine_kexec(struct kimage *image)
 		page_list[PA_SWAP_PAGE] = (page_to_pfn(image->swap_page)
 						<< PAGE_SHIFT);
 
-	/*
-	 * The segment registers are funny things, they have both a
+	/* The segment registers are funny things, they have both a
 	 * visible and an invisible part.  Whenever the visible part is
 	 * set to a specific selector, the invisible part is loaded
 	 * with from a table in memory.  At no other time is the
@@ -239,12 +237,11 @@ void machine_kexec(struct kimage *image)
 	 * segments, before I zap the gdt with an invalid value.
 	 */
 	load_segments();
-	/*
-	 * The gdt & idt are now invalid.
+	/* The gdt & idt are now invalid.
 	 * If you want to load them you must set up your own idt & gdt.
 	 */
-	set_gdt(phys_to_virt(0), 0);
-	set_idt(phys_to_virt(0), 0);
+	set_gdt(phys_to_virt(0),0);
+	set_idt(phys_to_virt(0),0);
 
 	/* now call it */
 	image->start = relocate_kernel_ptr((unsigned long)image->head,
diff --git a/trunk/arch/x86/kernel/machine_kexec_64.c b/trunk/arch/x86/kernel/machine_kexec_64.c
index 89cea4d44679..6993d51b7fd8 100644
--- a/trunk/arch/x86/kernel/machine_kexec_64.c
+++ b/trunk/arch/x86/kernel/machine_kexec_64.c
@@ -12,47 +12,11 @@
 #include <linux/reboot.h>
 #include <linux/numa.h>
 #include <linux/ftrace.h>
-#include <linux/io.h>
-#include <linux/suspend.h>
 
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
 #include <asm/mmu_context.h>
-
-static int init_one_level2_page(struct kimage *image, pgd_t *pgd,
-				unsigned long addr)
-{
-	pud_t *pud;
-	pmd_t *pmd;
-	struct page *page;
-	int result = -ENOMEM;
-
-	addr &= PMD_MASK;
-	pgd += pgd_index(addr);
-	if (!pgd_present(*pgd)) {
-		page = kimage_alloc_control_pages(image, 0);
-		if (!page)
-			goto out;
-		pud = (pud_t *)page_address(page);
-		memset(pud, 0, PAGE_SIZE);
-		set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE));
-	}
-	pud = pud_offset(pgd, addr);
-	if (!pud_present(*pud)) {
-		page = kimage_alloc_control_pages(image, 0);
-		if (!page)
-			goto out;
-		pmd = (pmd_t *)page_address(page);
-		memset(pmd, 0, PAGE_SIZE);
-		set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE));
-	}
-	pmd = pmd_offset(pud, addr);
-	if (!pmd_present(*pmd))
-		set_pmd(pmd, __pmd(addr | __PAGE_KERNEL_LARGE_EXEC));
-	result = 0;
-out:
-	return result;
-}
+#include <asm/io.h>
 
 static void init_level2_page(pmd_t *level2p, unsigned long addr)
 {
@@ -119,8 +83,9 @@ static int init_level4_page(struct kimage *image, pgd_t *level4p,
 		}
 		level3p = (pud_t *)page_address(page);
 		result = init_level3_page(image, level3p, addr, last_addr);
-		if (result)
+		if (result) {
 			goto out;
+		}
 		set_pgd(level4p++, __pgd(__pa(level3p) | _KERNPG_TABLE));
 		addr += PGDIR_SIZE;
 	}
@@ -189,13 +154,6 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable)
 	int result;
 	level4p = (pgd_t *)__va(start_pgtable);
 	result = init_level4_page(image, level4p, 0, max_pfn << PAGE_SHIFT);
-	if (result)
-		return result;
-	/*
-	 * image->start may be outside 0 ~ max_pfn, for example when
-	 * jump back to original kernel from kexeced kernel
-	 */
-	result = init_one_level2_page(image, level4p, image->start);
 	if (result)
 		return result;
 	return init_transition_pgtable(image, level4p);
@@ -271,45 +229,20 @@ void machine_kexec(struct kimage *image)
 {
 	unsigned long page_list[PAGES_NR];
 	void *control_page;
-	int save_ftrace_enabled;
 
-#ifdef CONFIG_KEXEC_JUMP
-	if (kexec_image->preserve_context)
-		save_processor_state();
-#endif
-
-	save_ftrace_enabled = __ftrace_enabled_save();
+	tracer_disable();
 
 	/* Interrupts aren't acceptable while we reboot */
 	local_irq_disable();
 
-	if (image->preserve_context) {
-#ifdef CONFIG_X86_IO_APIC
-		/*
-		 * We need to put APICs in legacy mode so that we can
-		 * get timer interrupts in second kernel. kexec/kdump
-		 * paths already have calls to disable_IO_APIC() in
-		 * one form or other. kexec jump path also need
-		 * one.
-		 */
-		disable_IO_APIC();
-#endif
-	}
-
 	control_page = page_address(image->control_code_page) + PAGE_SIZE;
-	memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
+	memcpy(control_page, relocate_kernel, PAGE_SIZE);
 
 	page_list[PA_CONTROL_PAGE] = virt_to_phys(control_page);
-	page_list[VA_CONTROL_PAGE] = (unsigned long)control_page;
 	page_list[PA_TABLE_PAGE] =
 	  (unsigned long)__pa(page_address(image->control_code_page));
 
-	if (image->type == KEXEC_TYPE_DEFAULT)
-		page_list[PA_SWAP_PAGE] = (page_to_pfn(image->swap_page)
-						<< PAGE_SHIFT);
-
-	/*
-	 * The segment registers are funny things, they have both a
+	/* The segment registers are funny things, they have both a
 	 * visible and an invisible part.  Whenever the visible part is
 	 * set to a specific selector, the invisible part is loaded
 	 * with from a table in memory.  At no other time is the
@@ -319,25 +252,15 @@ void machine_kexec(struct kimage *image)
 	 * segments, before I zap the gdt with an invalid value.
 	 */
 	load_segments();
-	/*
-	 * The gdt & idt are now invalid.
+	/* The gdt & idt are now invalid.
 	 * If you want to load them you must set up your own idt & gdt.
 	 */
-	set_gdt(phys_to_virt(0), 0);
-	set_idt(phys_to_virt(0), 0);
+	set_gdt(phys_to_virt(0),0);
+	set_idt(phys_to_virt(0),0);
 
 	/* now call it */
-	image->start = relocate_kernel((unsigned long)image->head,
-				       (unsigned long)page_list,
-				       image->start,
-				       image->preserve_context);
-
-#ifdef CONFIG_KEXEC_JUMP
-	if (kexec_image->preserve_context)
-		restore_processor_state();
-#endif
-
-	__ftrace_enabled_restore(save_ftrace_enabled);
+	relocate_kernel((unsigned long)image->head, (unsigned long)page_list,
+			image->start);
 }
 
 void arch_crash_save_vmcoreinfo(void)
diff --git a/trunk/arch/x86/kernel/quirks.c b/trunk/arch/x86/kernel/quirks.c
index 309949e9e1c1..6a5a2970f4c5 100644
--- a/trunk/arch/x86/kernel/quirks.c
+++ b/trunk/arch/x86/kernel/quirks.c
@@ -74,8 +74,7 @@ static void ich_force_hpet_resume(void)
 	if (!force_hpet_address)
 		return;
 
-	if (rcba_base == NULL)
-		BUG();
+	BUG_ON(rcba_base == NULL);
 
 	/* read the Function Disable register, dword mode only */
 	val = readl(rcba_base + 0x3404);
diff --git a/trunk/arch/x86/kernel/relocate_kernel_32.S b/trunk/arch/x86/kernel/relocate_kernel_32.S
index 41235531b11c..2064d0aa8d28 100644
--- a/trunk/arch/x86/kernel/relocate_kernel_32.S
+++ b/trunk/arch/x86/kernel/relocate_kernel_32.S
@@ -17,8 +17,7 @@
 
 #define PTR(x) (x << 2)
 
-/*
- * control_page + KEXEC_CONTROL_CODE_MAX_SIZE
+/* control_page + KEXEC_CONTROL_CODE_MAX_SIZE
  * ~ control_page + PAGE_SIZE are used as data storage and stack for
  * jumping back
  */
@@ -77,10 +76,8 @@ relocate_kernel:
 	movl	%eax, CP_PA_SWAP_PAGE(%edi)
 	movl	%ebx, CP_PA_BACKUP_PAGES_MAP(%edi)
 
-	/*
-	 * get physical address of control page now
-	 * this is impossible after page table switch
-	 */
+	/* get physical address of control page now */
+	/* this is impossible after page table switch */
 	movl	PTR(PA_CONTROL_PAGE)(%ebp), %edi
 
 	/* switch to new set of page tables */
@@ -100,8 +97,7 @@ identity_mapped:
 	/* store the start address on the stack */
 	pushl   %edx
 
-	/*
-	 * Set cr0 to a known state:
+	/* Set cr0 to a known state:
 	 *  - Paging disabled
 	 *  - Alignment check disabled
 	 *  - Write protect disabled
@@ -117,8 +113,7 @@ identity_mapped:
 	/* clear cr4 if applicable */
 	testl	%ecx, %ecx
 	jz	1f
-	/*
-	 * Set cr4 to a known state:
+	/* Set cr4 to a known state:
 	 * Setting everything to zero seems safe.
 	 */
 	xorl	%eax, %eax
@@ -137,18 +132,15 @@ identity_mapped:
 	call	swap_pages
 	addl	$8, %esp
 
-	/*
-	 * To be certain of avoiding problems with self-modifying code
+	/* To be certain of avoiding problems with self-modifying code
 	 * I need to execute a serializing instruction here.
 	 * So I flush the TLB, it's handy, and not processor dependent.
 	 */
 	xorl	%eax, %eax
 	movl	%eax, %cr3
 
-	/*
-	 * set all of the registers to known values
-	 * leave %esp alone
-	 */
+	/* set all of the registers to known values */
+	/* leave %esp alone */
 
 	testl	%esi, %esi
 	jnz 1f
diff --git a/trunk/arch/x86/kernel/relocate_kernel_64.S b/trunk/arch/x86/kernel/relocate_kernel_64.S
index 4de8f5b3d476..d32cfb27a479 100644
--- a/trunk/arch/x86/kernel/relocate_kernel_64.S
+++ b/trunk/arch/x86/kernel/relocate_kernel_64.S
@@ -19,77 +19,29 @@
 #define PTR(x) (x << 3)
 #define PAGE_ATTR (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED | _PAGE_DIRTY)
 
-/*
- * control_page + KEXEC_CONTROL_CODE_MAX_SIZE
- * ~ control_page + PAGE_SIZE are used as data storage and stack for
- * jumping back
- */
-#define DATA(offset)		(KEXEC_CONTROL_CODE_MAX_SIZE+(offset))
-
-/* Minimal CPU state */
-#define RSP			DATA(0x0)
-#define CR0			DATA(0x8)
-#define CR3			DATA(0x10)
-#define CR4			DATA(0x18)
-
-/* other data */
-#define CP_PA_TABLE_PAGE	DATA(0x20)
-#define CP_PA_SWAP_PAGE		DATA(0x28)
-#define CP_PA_BACKUP_PAGES_MAP	DATA(0x30)
-
 	.text
 	.align PAGE_SIZE
 	.code64
 	.globl relocate_kernel
 relocate_kernel:
-	/*
-	 * %rdi indirection_page
+	/* %rdi indirection_page
 	 * %rsi page_list
 	 * %rdx start address
-	 * %rcx preserve_context
 	 */
 
-	/* Save the CPU context, used for jumping back */
-	pushq %rbx
-	pushq %rbp
-	pushq %r12
-	pushq %r13
-	pushq %r14
-	pushq %r15
-	pushf
-
-	movq	PTR(VA_CONTROL_PAGE)(%rsi), %r11
-	movq	%rsp, RSP(%r11)
-	movq	%cr0, %rax
-	movq	%rax, CR0(%r11)
-	movq	%cr3, %rax
-	movq	%rax, CR3(%r11)
-	movq	%cr4, %rax
-	movq	%rax, CR4(%r11)
-
 	/* zero out flags, and disable interrupts */
 	pushq $0
 	popfq
 
-	/*
-	 * get physical address of control page now
-	 * this is impossible after page table switch
-	 */
+	/* get physical address of control page now */
+	/* this is impossible after page table switch */
 	movq	PTR(PA_CONTROL_PAGE)(%rsi), %r8
 
 	/* get physical address of page table now too */
-	movq	PTR(PA_TABLE_PAGE)(%rsi), %r9
-
-	/* get physical address of swap page now */
-	movq	PTR(PA_SWAP_PAGE)(%rsi), %r10
-
-	/* save some information for jumping back */
-	movq	%r9, CP_PA_TABLE_PAGE(%r11)
-	movq	%r10, CP_PA_SWAP_PAGE(%r11)
-	movq	%rdi, CP_PA_BACKUP_PAGES_MAP(%r11)
+	movq	PTR(PA_TABLE_PAGE)(%rsi), %rcx
 
 	/* Switch to the identity mapped page tables */
-	movq	%r9, %cr3
+	movq	%rcx, %cr3
 
 	/* setup a new stack at the end of the physical control page */
 	lea	PAGE_SIZE(%r8), %rsp
@@ -103,8 +55,7 @@ identity_mapped:
 	/* store the start address on the stack */
 	pushq   %rdx
 
-	/*
-	 * Set cr0 to a known state:
+	/* Set cr0 to a known state:
 	 *  - Paging enabled
 	 *  - Alignment check disabled
 	 *  - Write protect disabled
@@ -117,8 +68,7 @@ identity_mapped:
 	orl	$(X86_CR0_PG | X86_CR0_PE), %eax
 	movq	%rax, %cr0
 
-	/*
-	 * Set cr4 to a known state:
+	/* Set cr4 to a known state:
 	 *  - physical address extension enabled
 	 */
 	movq	$X86_CR4_PAE, %rax
@@ -128,87 +78,9 @@ identity_mapped:
 1:
 
 	/* Flush the TLB (needed?) */
-	movq	%r9, %cr3
-
-	movq	%rcx, %r11
-	call	swap_pages
-
-	/*
-	 * To be certain of avoiding problems with self-modifying code
-	 * I need to execute a serializing instruction here.
-	 * So I flush the TLB by reloading %cr3 here, it's handy,
-	 * and not processor dependent.
-	 */
-	movq	%cr3, %rax
-	movq	%rax, %cr3
-
-	/*
-	 * set all of the registers to known values
-	 * leave %rsp alone
-	 */
-
-	testq	%r11, %r11
-	jnz 1f
-	xorq	%rax, %rax
-	xorq	%rbx, %rbx
-	xorq    %rcx, %rcx
-	xorq    %rdx, %rdx
-	xorq    %rsi, %rsi
-	xorq    %rdi, %rdi
-	xorq    %rbp, %rbp
-	xorq	%r8,  %r8
-	xorq	%r9,  %r9
-	xorq	%r10, %r9
-	xorq	%r11, %r11
-	xorq	%r12, %r12
-	xorq	%r13, %r13
-	xorq	%r14, %r14
-	xorq	%r15, %r15
-
-	ret
-
-1:
-	popq	%rdx
-	leaq	PAGE_SIZE(%r10), %rsp
-	call	*%rdx
-
-	/* get the re-entry point of the peer system */
-	movq	0(%rsp), %rbp
-	call	1f
-1:
-	popq	%r8
-	subq	$(1b - relocate_kernel), %r8
-	movq	CP_PA_SWAP_PAGE(%r8), %r10
-	movq	CP_PA_BACKUP_PAGES_MAP(%r8), %rdi
-	movq	CP_PA_TABLE_PAGE(%r8), %rax
-	movq	%rax, %cr3
-	lea	PAGE_SIZE(%r8), %rsp
-	call	swap_pages
-	movq	$virtual_mapped, %rax
-	pushq	%rax
-	ret
-
-virtual_mapped:
-	movq	RSP(%r8), %rsp
-	movq	CR4(%r8), %rax
-	movq	%rax, %cr4
-	movq	CR3(%r8), %rax
-	movq	CR0(%r8), %r8
-	movq	%rax, %cr3
-	movq	%r8, %cr0
-	movq	%rbp, %rax
-
-	popf
-	popq	%r15
-	popq	%r14
-	popq	%r13
-	popq	%r12
-	popq	%rbp
-	popq	%rbx
-	ret
+	movq	%rcx, %cr3
 
 	/* Do the copies */
-swap_pages:
 	movq	%rdi, %rcx 	/* Put the page_list in %rcx */
 	xorq	%rdi, %rdi
 	xorq	%rsi, %rsi
@@ -240,27 +112,36 @@ swap_pages:
 	movq	%rcx,   %rsi  /* For ever source page do a copy */
 	andq	$0xfffffffffffff000, %rsi
 
-	movq	%rdi, %rdx
-	movq	%rsi, %rax
-
-	movq	%r10, %rdi
 	movq	$512,   %rcx
 	rep ; movsq
+	jmp	0b
+3:
 
-	movq	%rax, %rdi
-	movq	%rdx, %rsi
-	movq	$512,   %rcx
-	rep ; movsq
+	/* To be certain of avoiding problems with self-modifying code
+	 * I need to execute a serializing instruction here.
+	 * So I flush the TLB by reloading %cr3 here, it's handy,
+	 * and not processor dependent.
+	 */
+	movq	%cr3, %rax
+	movq	%rax, %cr3
 
-	movq	%rdx, %rdi
-	movq	%r10, %rsi
-	movq	$512,   %rcx
-	rep ; movsq
+	/* set all of the registers to known values */
+	/* leave %rsp alone */
 
-	lea	PAGE_SIZE(%rax), %rsi
-	jmp	0b
-3:
-	ret
+	xorq	%rax, %rax
+	xorq	%rbx, %rbx
+	xorq    %rcx, %rcx
+	xorq    %rdx, %rdx
+	xorq    %rsi, %rsi
+	xorq    %rdi, %rdi
+	xorq    %rbp, %rbp
+	xorq	%r8,  %r8
+	xorq	%r9,  %r9
+	xorq	%r10, %r9
+	xorq	%r11, %r11
+	xorq	%r12, %r12
+	xorq	%r13, %r13
+	xorq	%r14, %r14
+	xorq	%r15, %r15
 
-	.globl kexec_control_code_size
-.set kexec_control_code_size, . - relocate_kernel
+	ret
diff --git a/trunk/arch/x86/kernel/visws_quirks.c b/trunk/arch/x86/kernel/visws_quirks.c
index 31ffc24eec4d..191a876e9e87 100644
--- a/trunk/arch/x86/kernel/visws_quirks.c
+++ b/trunk/arch/x86/kernel/visws_quirks.c
@@ -578,7 +578,7 @@ static struct irq_chip piix4_virtual_irq_type = {
 static irqreturn_t piix4_master_intr(int irq, void *dev_id)
 {
 	int realirq;
-	struct irq_desc *desc;
+	irq_desc_t *desc;
 	unsigned long flags;
 
 	spin_lock_irqsave(&i8259A_lock, flags);
diff --git a/trunk/arch/x86/kernel/vmlinux_64.lds.S b/trunk/arch/x86/kernel/vmlinux_64.lds.S
index 5bf54e40c6ef..fbfced6f6800 100644
--- a/trunk/arch/x86/kernel/vmlinux_64.lds.S
+++ b/trunk/arch/x86/kernel/vmlinux_64.lds.S
@@ -275,10 +275,3 @@ ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
 ASSERT((per_cpu__irq_stack_union == 0),
         "irq_stack_union is not at start of per-cpu area");
 #endif
-
-#ifdef CONFIG_KEXEC
-#include <asm/kexec.h>
-
-ASSERT(kexec_control_code_size <= KEXEC_CONTROL_CODE_MAX_SIZE,
-       "kexec control code size is too big")
-#endif
diff --git a/trunk/arch/x86/lguest/boot.c b/trunk/arch/x86/lguest/boot.c
index 9fe4ddaa8f6f..f3a5305b8adf 100644
--- a/trunk/arch/x86/lguest/boot.c
+++ b/trunk/arch/x86/lguest/boot.c
@@ -348,11 +348,6 @@ static void lguest_cpuid(unsigned int *ax, unsigned int *bx,
 		 * flush_tlb_user() for both user and kernel mappings unless
 		 * the Page Global Enable (PGE) feature bit is set. */
 		*dx |= 0x00002000;
-		/* We also lie, and say we're family id 5.  6 or greater
-		 * leads to a rdmsr in early_init_intel which we can't handle.
-		 * Family ID is returned as bits 8-12 in ax. */
-		*ax &= 0xFFFFF0FF;
-		*ax |= 0x00000500;
 		break;
 	case 0x80000000:
 		/* Futureproof this a little: if they ask how much extended
@@ -599,21 +594,19 @@ static void __init lguest_init_IRQ(void)
 		/* Some systems map "vectors" to interrupts weirdly.  Lguest has
 		 * a straightforward 1 to 1 mapping, so force that here. */
 		__get_cpu_var(vector_irq)[vector] = i;
-		if (vector != SYSCALL_VECTOR)
-			set_intr_gate(vector, interrupt[i]);
+		if (vector != SYSCALL_VECTOR) {
+			set_intr_gate(vector,
+				      interrupt[vector-FIRST_EXTERNAL_VECTOR]);
+			set_irq_chip_and_handler_name(i, &lguest_irq_controller,
+						      handle_level_irq,
+						      "level");
+		}
 	}
 	/* This call is required to set up for 4k stacks, where we have
 	 * separate stacks for hard and soft interrupts. */
 	irq_ctx_init(smp_processor_id());
 }
 
-void lguest_setup_irq(unsigned int irq)
-{
-	irq_to_desc_alloc_cpu(irq, 0);
-	set_irq_chip_and_handler_name(irq, &lguest_irq_controller,
-				      handle_level_irq, "level");
-}
-
 /*
  * Time.
  *
diff --git a/trunk/arch/xtensa/Kconfig b/trunk/arch/xtensa/Kconfig
index 981200830432..6c873dceb177 100644
--- a/trunk/arch/xtensa/Kconfig
+++ b/trunk/arch/xtensa/Kconfig
@@ -103,6 +103,9 @@ config MATH_EMULATION
 	help
 	Can we use information of configuration file?
 
+config HIGHMEM
+	bool "High memory support"
+
 endmenu
 
 menu "Platform options"
diff --git a/trunk/arch/xtensa/kernel/setup.c b/trunk/arch/xtensa/kernel/setup.c
index 4ec1633c2941..9606d2bd1dd9 100644
--- a/trunk/arch/xtensa/kernel/setup.c
+++ b/trunk/arch/xtensa/kernel/setup.c
@@ -44,8 +44,6 @@
 #include <asm/setup.h>
 #include <asm/param.h>
 
-#include <platform/hardware.h>
-
 #if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_DUMMY_CONSOLE)
 struct screen_info screen_info = { 0, 24, 0, 0, 0, 80, 0, 0, 0, 24, 1, 16};
 #endif
diff --git a/trunk/arch/xtensa/kernel/traps.c b/trunk/arch/xtensa/kernel/traps.c
index c44f830b6c7a..c7a021d9f696 100644
--- a/trunk/arch/xtensa/kernel/traps.c
+++ b/trunk/arch/xtensa/kernel/traps.c
@@ -30,7 +30,6 @@
 #include <linux/stringify.h>
 #include <linux/kallsyms.h>
 #include <linux/delay.h>
-#include <linux/hardirq.h>
 
 #include <asm/ptrace.h>
 #include <asm/timex.h>
diff --git a/trunk/arch/xtensa/mm/fault.c b/trunk/arch/xtensa/mm/fault.c
index bdd860d93f72..33f366be323f 100644
--- a/trunk/arch/xtensa/mm/fault.c
+++ b/trunk/arch/xtensa/mm/fault.c
@@ -14,7 +14,6 @@
 
 #include <linux/mm.h>
 #include <linux/module.h>
-#include <linux/hardirq.h>
 #include <asm/mmu_context.h>
 #include <asm/cacheflush.h>
 #include <asm/hardirq.h>
diff --git a/trunk/arch/xtensa/platforms/iss/console.c b/trunk/arch/xtensa/platforms/iss/console.c
index 25d46c84eb08..efed8897bef3 100644
--- a/trunk/arch/xtensa/platforms/iss/console.c
+++ b/trunk/arch/xtensa/platforms/iss/console.c
@@ -140,14 +140,16 @@ static void rs_poll(unsigned long priv)
 }
 
 
-static int rs_put_char(struct tty_struct *tty, unsigned char ch)
+static void rs_put_char(struct tty_struct *tty, unsigned char ch)
 {
 	char buf[2];
 
+	if (!tty)
+		return;
+
 	buf[0] = ch;
 	buf[1] = '\0';		/* Is this NULL necessary? */
 	__simc (SYS_write, 1, (unsigned long) buf, 1, 0, 0);
-	return 1;
 }
 
 static void rs_flush_chars(struct tty_struct *tty)
diff --git a/trunk/drivers/base/node.c b/trunk/drivers/base/node.c
index f8f578a71b25..43fa90b837ee 100644
--- a/trunk/drivers/base/node.c
+++ b/trunk/drivers/base/node.c
@@ -303,7 +303,7 @@ int unregister_mem_sect_under_nodes(struct memory_block *mem_blk)
 	sect_start_pfn = section_nr_to_pfn(mem_blk->phys_index);
 	sect_end_pfn = sect_start_pfn + PAGES_PER_SECTION - 1;
 	for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) {
-		int nid;
+		unsigned int nid;
 
 		nid = get_nid_for_pfn(pfn);
 		if (nid < 0)
diff --git a/trunk/drivers/block/aoe/aoedev.c b/trunk/drivers/block/aoe/aoedev.c
index eeea477d9601..cc250577d405 100644
--- a/trunk/drivers/block/aoe/aoedev.c
+++ b/trunk/drivers/block/aoe/aoedev.c
@@ -173,7 +173,7 @@ skbfree(struct sk_buff *skb)
 		return;
 	while (atomic_read(&skb_shinfo(skb)->dataref) != 1 && i-- > 0)
 		msleep(Sms);
-	if (i < 0) {
+	if (i <= 0) {
 		printk(KERN_ERR
 			"aoe: %s holds ref: %s\n",
 			skb->dev ? skb->dev->name : "netif",
diff --git a/trunk/drivers/char/agp/amd64-agp.c b/trunk/drivers/char/agp/amd64-agp.c
index d765afda9c2a..52f4361eb6e4 100644
--- a/trunk/drivers/char/agp/amd64-agp.c
+++ b/trunk/drivers/char/agp/amd64-agp.c
@@ -271,15 +271,15 @@ static __devinit int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp,
 	nb_order = (nb_order >> 1) & 7;
 	pci_read_config_dword(nb, AMD64_GARTAPERTUREBASE, &nb_base);
 	nb_aper = nb_base << 25;
+	if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order)) {
+		return 0;
+	}
 
 	/* Northbridge seems to contain crap. Try the AGP bridge. */
 
 	pci_read_config_word(agp, cap+0x14, &apsize);
-	if (apsize == 0xffff) {
-		if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order))
-			return 0;
+	if (apsize == 0xffff)
 		return -1;
-	}
 
 	apsize &= 0xfff;
 	/* Some BIOS use weird encodings not in the AGPv3 table. */
@@ -301,11 +301,6 @@ static __devinit int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp,
 		order = nb_order;
 	}
 
-	if (nb_order >= order) {
-		if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order))
-			return 0;
-	}
-
 	dev_info(&agp->dev, "aperture from AGP @ %Lx size %u MB\n",
 		 aper, 32 << order);
 	if (order < 0 || !agp_aperture_valid(aper, (32*1024*1024)<<order))
diff --git a/trunk/drivers/char/agp/intel-agp.c b/trunk/drivers/char/agp/intel-agp.c
index 4373adb2119a..c7714185f831 100644
--- a/trunk/drivers/char/agp/intel-agp.c
+++ b/trunk/drivers/char/agp/intel-agp.c
@@ -633,15 +633,13 @@ static void intel_i830_init_gtt_entries(void)
 			break;
 		}
 	}
-	if (gtt_entries > 0) {
+	if (gtt_entries > 0)
 		dev_info(&agp_bridge->dev->dev, "detected %dK %s memory\n",
 		       gtt_entries / KB(1), local ? "local" : "stolen");
-		gtt_entries /= KB(4);
-	} else {
+	else
 		dev_info(&agp_bridge->dev->dev,
 		       "no pre-allocated video memory detected\n");
-		gtt_entries = 0;
-	}
+	gtt_entries /= KB(4);
 
 	intel_private.gtt_entries = gtt_entries;
 }
diff --git a/trunk/drivers/cpufreq/cpufreq.c b/trunk/drivers/cpufreq/cpufreq.c
index d6daf3c507d3..b55cb67435bd 100644
--- a/trunk/drivers/cpufreq/cpufreq.c
+++ b/trunk/drivers/cpufreq/cpufreq.c
@@ -754,6 +754,11 @@ static struct kobj_type ktype_cpufreq = {
 	.release	= cpufreq_sysfs_release,
 };
 
+static struct kobj_type ktype_empty_cpufreq = {
+	.sysfs_ops	= &sysfs_ops,
+	.release	= cpufreq_sysfs_release,
+};
+
 
 /**
  * cpufreq_add_dev - add a CPU device
@@ -887,26 +892,36 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
 	memcpy(&new_policy, policy, sizeof(struct cpufreq_policy));
 
 	/* prepare interface data */
-	ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq, &sys_dev->kobj,
-				   "cpufreq");
-	if (ret)
-		goto err_out_driver_exit;
-
-	/* set up files for this cpu device */
-	drv_attr = cpufreq_driver->attr;
-	while ((drv_attr) && (*drv_attr)) {
-		ret = sysfs_create_file(&policy->kobj, &((*drv_attr)->attr));
+	if (!cpufreq_driver->hide_interface) {
+		ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq,
+					   &sys_dev->kobj, "cpufreq");
 		if (ret)
 			goto err_out_driver_exit;
-		drv_attr++;
-	}
-	if (cpufreq_driver->get) {
-		ret = sysfs_create_file(&policy->kobj, &cpuinfo_cur_freq.attr);
-		if (ret)
-			goto err_out_driver_exit;
-	}
-	if (cpufreq_driver->target) {
-		ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
+
+		/* set up files for this cpu device */
+		drv_attr = cpufreq_driver->attr;
+		while ((drv_attr) && (*drv_attr)) {
+			ret = sysfs_create_file(&policy->kobj,
+						&((*drv_attr)->attr));
+			if (ret)
+				goto err_out_driver_exit;
+			drv_attr++;
+		}
+		if (cpufreq_driver->get) {
+			ret = sysfs_create_file(&policy->kobj,
+						&cpuinfo_cur_freq.attr);
+			if (ret)
+				goto err_out_driver_exit;
+		}
+		if (cpufreq_driver->target) {
+			ret = sysfs_create_file(&policy->kobj,
+						&scaling_cur_freq.attr);
+			if (ret)
+				goto err_out_driver_exit;
+		}
+	} else {
+		ret = kobject_init_and_add(&policy->kobj, &ktype_empty_cpufreq,
+					   &sys_dev->kobj, "cpufreq");
 		if (ret)
 			goto err_out_driver_exit;
 	}
diff --git a/trunk/drivers/hwmon/lm85.c b/trunk/drivers/hwmon/lm85.c
index b251d8674b41..cfc1ee90f5a3 100644
--- a/trunk/drivers/hwmon/lm85.c
+++ b/trunk/drivers/hwmon/lm85.c
@@ -72,7 +72,6 @@ I2C_CLIENT_INSMOD_7(lm85b, lm85c, adm1027, adt7463, adt7468, emc6d100,
 #define	LM85_COMPANY_SMSC		0x5c
 #define	LM85_VERSTEP_VMASK              0xf0
 #define	LM85_VERSTEP_GENERIC		0x60
-#define	LM85_VERSTEP_GENERIC2		0x70
 #define	LM85_VERSTEP_LM85C		0x60
 #define	LM85_VERSTEP_LM85B		0x62
 #define	LM85_VERSTEP_ADM1027		0x60
@@ -335,7 +334,6 @@ static struct lm85_data *lm85_update_device(struct device *dev);
 static const struct i2c_device_id lm85_id[] = {
 	{ "adm1027", adm1027 },
 	{ "adt7463", adt7463 },
-	{ "adt7468", adt7468 },
 	{ "lm85", any_chip },
 	{ "lm85b", lm85b },
 	{ "lm85c", lm85c },
@@ -410,8 +408,7 @@ static ssize_t show_vid_reg(struct device *dev, struct device_attribute *attr,
 	struct lm85_data *data = lm85_update_device(dev);
 	int vid;
 
-	if ((data->type == adt7463 || data->type == adt7468) &&
-	    (data->vid & 0x80)) {
+	if (data->type == adt7463 && (data->vid & 0x80)) {
 		/* 6-pin VID (VRM 10) */
 		vid = vid_from_reg(data->vid & 0x3f, data->vrm);
 	} else {
@@ -1156,8 +1153,7 @@ static int lm85_detect(struct i2c_client *client, int kind,
 			address, company, verstep);
 
 		/* All supported chips have the version in common */
-		if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC &&
-		    (verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC2) {
+		if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC) {
 			dev_dbg(&adapter->dev, "Autodetection failed: "
 				"unsupported version\n");
 			return -ENODEV;
diff --git a/trunk/drivers/lguest/lguest_device.c b/trunk/drivers/lguest/lguest_device.c
index 8132533d71f9..b4d44e571d76 100644
--- a/trunk/drivers/lguest/lguest_device.c
+++ b/trunk/drivers/lguest/lguest_device.c
@@ -212,9 +212,6 @@ static void lg_notify(struct virtqueue *vq)
 	hcall(LHCALL_NOTIFY, lvq->config.pfn << PAGE_SHIFT, 0, 0);
 }
 
-/* An extern declaration inside a C file is bad form.  Don't do it. */
-extern void lguest_setup_irq(unsigned int irq);
-
 /* This routine finds the first virtqueue described in the configuration of
  * this device and sets it up.
  *
@@ -269,9 +266,6 @@ static struct virtqueue *lg_find_vq(struct virtio_device *vdev,
 		goto unmap;
 	}
 
-	/* Make sure the interrupt is allocated. */
-	lguest_setup_irq(lvq->config.irq);
-
 	/* Tell the interrupt for this virtqueue to go to the virtio_ring
 	 * interrupt handler. */
 	/* FIXME: We used to have a flag for the Host to tell us we could use
diff --git a/trunk/drivers/md/md.c b/trunk/drivers/md/md.c
index a307f87eb90e..03b4cd0a6344 100644
--- a/trunk/drivers/md/md.c
+++ b/trunk/drivers/md/md.c
@@ -214,7 +214,12 @@ static inline mddev_t *mddev_get(mddev_t *mddev)
 	return mddev;
 }
 
-static void mddev_delayed_delete(struct work_struct *ws);
+static void mddev_delayed_delete(struct work_struct *ws)
+{
+	mddev_t *mddev = container_of(ws, mddev_t, del_work);
+	kobject_del(&mddev->kobj);
+	kobject_put(&mddev->kobj);
+}
 
 static void mddev_put(mddev_t *mddev)
 {
@@ -3537,21 +3542,6 @@ static struct kobj_type md_ktype = {
 
 int mdp_major = 0;
 
-static void mddev_delayed_delete(struct work_struct *ws)
-{
-	mddev_t *mddev = container_of(ws, mddev_t, del_work);
-
-	if (mddev->private == &md_redundancy_group) {
-		sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
-		if (mddev->sysfs_action)
-			sysfs_put(mddev->sysfs_action);
-		mddev->sysfs_action = NULL;
-		mddev->private = NULL;
-	}
-	kobject_del(&mddev->kobj);
-	kobject_put(&mddev->kobj);
-}
-
 static int md_alloc(dev_t dev, char *name)
 {
 	static DEFINE_MUTEX(disks_mutex);
@@ -4043,9 +4033,13 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
 			mddev->queue->merge_bvec_fn = NULL;
 			mddev->queue->unplug_fn = NULL;
 			mddev->queue->backing_dev_info.congested_fn = NULL;
+			if (mddev->pers->sync_request) {
+				sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
+				if (mddev->sysfs_action)
+					sysfs_put(mddev->sysfs_action);
+				mddev->sysfs_action = NULL;
+			}
 			module_put(mddev->pers->owner);
-			if (mddev->pers->sync_request)
-				mddev->private = &md_redundancy_group;
 			mddev->pers = NULL;
 			/* tell userspace to handle 'inactive' */
 			sysfs_notify_dirent(mddev->sysfs_state);
diff --git a/trunk/drivers/mtd/devices/mtd_dataflash.c b/trunk/drivers/mtd/devices/mtd_dataflash.c
index 6d9f810565c8..d44f741ae229 100644
--- a/trunk/drivers/mtd/devices/mtd_dataflash.c
+++ b/trunk/drivers/mtd/devices/mtd_dataflash.c
@@ -821,8 +821,7 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
 					if (!(info->flags & IS_POW2PS))
 						return info;
 				}
-			} else
-				return info;
+			}
 		}
 	}
 
diff --git a/trunk/drivers/mtd/maps/physmap.c b/trunk/drivers/mtd/maps/physmap.c
index 229718222db7..4b122e7ab4b3 100644
--- a/trunk/drivers/mtd/maps/physmap.c
+++ b/trunk/drivers/mtd/maps/physmap.c
@@ -46,19 +46,16 @@ static int physmap_flash_remove(struct platform_device *dev)
 
 	physmap_data = dev->dev.platform_data;
 
-	if (info->cmtd) {
 #ifdef CONFIG_MTD_PARTITIONS
-		if (info->nr_parts || physmap_data->nr_parts)
-			del_mtd_partitions(info->cmtd);
-		else
-			del_mtd_device(info->cmtd);
-#else
-		del_mtd_device(info->cmtd);
-#endif
-	}
-#ifdef CONFIG_MTD_PARTITIONS
-	if (info->nr_parts)
+	if (info->nr_parts) {
+		del_mtd_partitions(info->cmtd);
 		kfree(info->parts);
+	} else if (physmap_data->nr_parts)
+		del_mtd_partitions(info->cmtd);
+	else
+		del_mtd_device(info->cmtd);
+#else
+	del_mtd_device(info->cmtd);
 #endif
 
 #ifdef CONFIG_MTD_CONCAT
diff --git a/trunk/drivers/net/arm/ks8695net.c b/trunk/drivers/net/arm/ks8695net.c
index f3a127434897..1cf2f949c0b4 100644
--- a/trunk/drivers/net/arm/ks8695net.c
+++ b/trunk/drivers/net/arm/ks8695net.c
@@ -560,7 +560,7 @@ ks8695_reset(struct ks8695_priv *ksp)
 		msleep(1);
 	}
 
-	if (reset_timeout < 0) {
+	if (reset_timeout == 0) {
 		dev_crit(ksp->dev,
 			 "Timeout waiting for DMA engines to reset\n");
 		/* And blithely carry on */
diff --git a/trunk/drivers/net/bonding/bond_main.c b/trunk/drivers/net/bonding/bond_main.c
index e0578fe8c0db..9fb388388fb7 100644
--- a/trunk/drivers/net/bonding/bond_main.c
+++ b/trunk/drivers/net/bonding/bond_main.c
@@ -4113,7 +4113,7 @@ static int bond_neigh_setup(struct net_device *dev, struct neigh_parms *parms)
 		const struct net_device_ops *slave_ops
 			= slave->dev->netdev_ops;
 		if (slave_ops->ndo_neigh_setup)
-			return slave_ops->ndo_neigh_setup(slave->dev, parms);
+			return slave_ops->ndo_neigh_setup(dev, parms);
 	}
 	return 0;
 }
diff --git a/trunk/drivers/net/jme.c b/trunk/drivers/net/jme.c
index a6e1a35a13cb..08b34051c646 100644
--- a/trunk/drivers/net/jme.c
+++ b/trunk/drivers/net/jme.c
@@ -957,14 +957,13 @@ jme_process_receive(struct jme_adapter *jme, int limit)
 		goto out_inc;
 
 	i = atomic_read(&rxring->next_to_clean);
-	while (limit > 0) {
+	while (limit-- > 0) {
 		rxdesc = rxring->desc;
 		rxdesc += i;
 
 		if ((rxdesc->descwb.flags & cpu_to_le16(RXWBFLAG_OWN)) ||
 		!(rxdesc->descwb.desccnt & RXWBDCNT_WBCPL))
 			goto out;
-		--limit;
 
 		desccnt = rxdesc->descwb.desccnt & RXWBDCNT_DCNT;
 
diff --git a/trunk/drivers/net/pcmcia/3c574_cs.c b/trunk/drivers/net/pcmcia/3c574_cs.c
index 2404a838b1fe..e5cb6b1f0ebd 100644
--- a/trunk/drivers/net/pcmcia/3c574_cs.c
+++ b/trunk/drivers/net/pcmcia/3c574_cs.c
@@ -1035,8 +1035,7 @@ static int el3_rx(struct net_device *dev, int worklimit)
 	DEBUG(3, "%s: in rx_packet(), status %4.4x, rx_status %4.4x.\n",
 		  dev->name, inw(ioaddr+EL3_STATUS), inw(ioaddr+RxStatus));
 	while (!((rx_status = inw(ioaddr + RxStatus)) & 0x8000) &&
-			worklimit > 0) {
-		worklimit--;
+		   (--worklimit >= 0)) {
 		if (rx_status & 0x4000) { /* Error, update stats. */
 			short error = rx_status & 0x3800;
 			dev->stats.rx_errors++;
diff --git a/trunk/drivers/net/pcmcia/3c589_cs.c b/trunk/drivers/net/pcmcia/3c589_cs.c
index 1e01b8a6dbf3..73ecc657999d 100644
--- a/trunk/drivers/net/pcmcia/3c589_cs.c
+++ b/trunk/drivers/net/pcmcia/3c589_cs.c
@@ -857,8 +857,7 @@ static int el3_rx(struct net_device *dev)
     DEBUG(3, "%s: in rx_packet(), status %4.4x, rx_status %4.4x.\n",
 	  dev->name, inw(ioaddr+EL3_STATUS), inw(ioaddr+RX_STATUS));
     while (!((rx_status = inw(ioaddr + RX_STATUS)) & 0x8000) &&
-		    worklimit > 0) {
-	worklimit--;
+	   (--worklimit >= 0)) {
 	if (rx_status & 0x4000) { /* Error, update stats. */
 	    short error = rx_status & 0x3800;
 	    dev->stats.rx_errors++;
diff --git a/trunk/drivers/net/smc911x.h b/trunk/drivers/net/smc911x.h
index a45952e72018..870b4c33f108 100644
--- a/trunk/drivers/net/smc911x.h
+++ b/trunk/drivers/net/smc911x.h
@@ -42,16 +42,6 @@
   #define SMC_USE_16BIT		0
   #define SMC_USE_32BIT		1
   #define SMC_IRQ_SENSE		IRQF_TRIGGER_LOW
-#elif defined(CONFIG_ARCH_OMAP34XX)
-  #define SMC_USE_16BIT		0
-  #define SMC_USE_32BIT		1
-  #define SMC_IRQ_SENSE		IRQF_TRIGGER_LOW
-  #define SMC_MEM_RESERVED	1
-#elif defined(CONFIG_ARCH_OMAP24XX)
-  #define SMC_USE_16BIT		0
-  #define SMC_USE_32BIT		1
-  #define SMC_IRQ_SENSE		IRQF_TRIGGER_LOW
-  #define SMC_MEM_RESERVED	1
 #else
 /*
  * Default configuration
@@ -685,7 +675,6 @@ smc_pxa_dma_outsl(struct smc911x_local *lp, u_long physaddr,
 #define CHIP_9116	0x0116
 #define CHIP_9117	0x0117
 #define CHIP_9118	0x0118
-#define CHIP_9211	0x9211
 #define CHIP_9215	0x115A
 #define CHIP_9217	0x117A
 #define CHIP_9218	0x118A
@@ -700,7 +689,6 @@ static const struct chip_id chip_ids[] =  {
 	{ CHIP_9116, "LAN9116" },
 	{ CHIP_9117, "LAN9117" },
 	{ CHIP_9118, "LAN9118" },
-	{ CHIP_9211, "LAN9211" },
 	{ CHIP_9215, "LAN9215" },
 	{ CHIP_9217, "LAN9217" },
 	{ CHIP_9218, "LAN9218" },
diff --git a/trunk/drivers/net/sungem.c b/trunk/drivers/net/sungem.c
index 0fcb7503363d..8d64b1da0465 100644
--- a/trunk/drivers/net/sungem.c
+++ b/trunk/drivers/net/sungem.c
@@ -1229,7 +1229,7 @@ static void gem_reset(struct gem *gp)
 			break;
 	} while (val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST));
 
-	if (limit < 0)
+	if (limit <= 0)
 		printk(KERN_ERR "%s: SW reset is ghetto.\n", gp->dev->name);
 
 	if (gp->phy_type == phy_serialink || gp->phy_type == phy_serdes)
diff --git a/trunk/drivers/net/tg3.c b/trunk/drivers/net/tg3.c
index dabdf59f8016..b080f9493d83 100644
--- a/trunk/drivers/net/tg3.c
+++ b/trunk/drivers/net/tg3.c
@@ -1473,8 +1473,7 @@ static void tg3_phy_toggle_apd(struct tg3 *tp, bool enable)
 {
 	u32 reg;
 
-	if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS) ||
-	    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
+	if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS))
 		return;
 
 	reg = MII_TG3_MISC_SHDW_WREN |
diff --git a/trunk/drivers/net/tokenring/tmspci.c b/trunk/drivers/net/tokenring/tmspci.c
index e2150b3c83d9..5f601773c260 100644
--- a/trunk/drivers/net/tokenring/tmspci.c
+++ b/trunk/drivers/net/tokenring/tmspci.c
@@ -121,6 +121,11 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
 		goto err_out_trdev;
 	}
 
+	ret = request_irq(pdev->irq, tms380tr_interrupt, IRQF_SHARED,
+			  dev->name, dev);
+	if (ret)
+		goto err_out_region;
+
 	dev->base_addr	= pci_ioaddr;
 	dev->irq 	= pci_irq_line;
 	dev->dma	= 0;
@@ -137,7 +142,7 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
 	ret = tmsdev_init(dev, &pdev->dev);
 	if (ret) {
 		printk("%s: unable to get memory for dev->priv.\n", dev->name);
-		goto err_out_region;
+		goto err_out_irq;
 	}
 
 	tp = netdev_priv(dev);
@@ -152,11 +157,6 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
 
 	tp->tmspriv = cardinfo;
 
-	ret = request_irq(pdev->irq, tms380tr_interrupt, IRQF_SHARED,
-			  dev->name, dev);
-	if (ret)
-		goto err_out_tmsdev;
-
 	dev->open = tms380tr_open;
 	dev->stop = tms380tr_close;
 	pci_set_drvdata(pdev, dev);
@@ -164,15 +164,15 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
 
 	ret = register_netdev(dev);
 	if (ret)
-		goto err_out_irq;
+		goto err_out_tmsdev;
 	
 	return 0;
 
-err_out_irq:
-	free_irq(pdev->irq, dev);
 err_out_tmsdev:
 	pci_set_drvdata(pdev, NULL);
 	tmsdev_term(dev);
+err_out_irq:
+	free_irq(pdev->irq, dev);
 err_out_region:
 	release_region(pci_ioaddr, TMS_PCI_IO_EXTENT);
 err_out_trdev:
diff --git a/trunk/drivers/net/ucc_geth_mii.c b/trunk/drivers/net/ucc_geth_mii.c
index 0ada4edd56eb..54635911305c 100644
--- a/trunk/drivers/net/ucc_geth_mii.c
+++ b/trunk/drivers/net/ucc_geth_mii.c
@@ -107,7 +107,7 @@ int uec_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 static int uec_mdio_reset(struct mii_bus *bus)
 {
 	struct ucc_mii_mng __iomem *regs = (void __iomem *)bus->priv;
-	int timeout = PHY_INIT_TIMEOUT;
+	unsigned int timeout = PHY_INIT_TIMEOUT;
 
 	mutex_lock(&bus->mdio_lock);
 
@@ -123,7 +123,7 @@ static int uec_mdio_reset(struct mii_bus *bus)
 
 	mutex_unlock(&bus->mdio_lock);
 
-	if (timeout < 0) {
+	if (timeout <= 0) {
 		printk(KERN_ERR "%s: The MII Bus is stuck!\n", bus->name);
 		return -EBUSY;
 	}
diff --git a/trunk/drivers/net/usb/dm9601.c b/trunk/drivers/net/usb/dm9601.c
index 81682c6defa0..5b67bbf1987e 100644
--- a/trunk/drivers/net/usb/dm9601.c
+++ b/trunk/drivers/net/usb/dm9601.c
@@ -633,10 +633,6 @@ static const struct usb_device_id products[] = {
 	 },
 	{
 	USB_DEVICE(0x0a47, 0x9601),	/* Hirose USB-100 */
-	.driver_info = (unsigned long)&dm9601_info,
-	 },
-	{
-	USB_DEVICE(0x0fe6, 0x8101),	/* DM9601 USB to Fast Ethernet Adapter */
 	.driver_info = (unsigned long)&dm9601_info,
 	 },
 	{},			// END
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c b/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c
index 129e2d330abb..36bafeb353ce 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3868,7 +3868,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	}
 	err = iwl_eeprom_check_version(priv);
 	if (err)
-		goto out_free_eeprom;
+		goto out_iounmap;
 
 	/* extract MAC Address */
 	iwl_eeprom_get_mac(priv, priv->mac_addr);
@@ -3945,8 +3945,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	return 0;
 
  out_remove_sysfs:
-	destroy_workqueue(priv->workqueue);
-	priv->workqueue = NULL;
 	sysfs_remove_group(&pdev->dev.kobj, &iwl_attribute_group);
  out_uninit_drv:
 	iwl_uninit_drv(priv);
@@ -3955,8 +3953,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
  out_iounmap:
 	pci_iounmap(pdev, priv->hw_base);
  out_pci_release_regions:
-	pci_set_drvdata(pdev, NULL);
 	pci_release_regions(pdev);
+	pci_set_drvdata(pdev, NULL);
  out_pci_disable_device:
 	pci_disable_device(pdev);
  out_ieee80211_free_hw:
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c b/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 57dd34e256d8..93be74a1f139 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -7911,7 +7911,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 				CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
 	if (err < 0) {
 		IWL_DEBUG_INFO("Failed to init the card\n");
-		goto out_iounmap;
+		goto out_remove_sysfs;
 	}
 
 	/***********************
@@ -7921,7 +7921,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 	err = iwl3945_eeprom_init(priv);
 	if (err) {
 		IWL_ERROR("Unable to init EEPROM\n");
-		goto out_iounmap;
+		goto out_remove_sysfs;
 	}
 	/* MAC Address location in EEPROM same for 3945/4965 */
 	get_eeprom_mac(priv, priv->mac_addr);
@@ -7975,7 +7975,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 	err = iwl3945_init_channel_map(priv);
 	if (err) {
 		IWL_ERROR("initializing regulatory failed: %d\n", err);
-		goto out_unset_hw_setting;
+		goto out_release_irq;
 	}
 
 	err = iwl3945_init_geos(priv);
@@ -8045,22 +8045,25 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 	return 0;
 
  out_remove_sysfs:
-	destroy_workqueue(priv->workqueue);
-	priv->workqueue = NULL;
 	sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
  out_free_geos:
 	iwl3945_free_geos(priv);
  out_free_channel_map:
 	iwl3945_free_channel_map(priv);
- out_unset_hw_setting:
+
+
+ out_release_irq:
+	destroy_workqueue(priv->workqueue);
+	priv->workqueue = NULL;
 	iwl3945_unset_hw_setting(priv);
+
  out_iounmap:
 	pci_iounmap(pdev, priv->hw_base);
  out_pci_release_regions:
 	pci_release_regions(pdev);
  out_pci_disable_device:
-	pci_set_drvdata(pdev, NULL);
 	pci_disable_device(pdev);
+	pci_set_drvdata(pdev, NULL);
  out_ieee80211_free_hw:
 	ieee80211_free_hw(priv->hw);
  out:
diff --git a/trunk/drivers/net/wireless/p54/p54common.c b/trunk/drivers/net/wireless/p54/p54common.c
index f170106bf0ae..34561e6e816b 100644
--- a/trunk/drivers/net/wireless/p54/p54common.c
+++ b/trunk/drivers/net/wireless/p54/p54common.c
@@ -710,11 +710,10 @@ static struct sk_buff *p54_find_tx_entry(struct ieee80211_hw *dev,
 					   __le32 req_id)
 {
 	struct p54_common *priv = dev->priv;
-	struct sk_buff *entry;
+	struct sk_buff *entry = priv->tx_queue.next;
 	unsigned long flags;
 
 	spin_lock_irqsave(&priv->tx_queue.lock, flags);
-	entry = priv->tx_queue.next;
 	while (entry != (struct sk_buff *)&priv->tx_queue) {
 		struct p54_hdr *hdr = (struct p54_hdr *) entry->data;
 
@@ -733,7 +732,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
 	struct p54_common *priv = dev->priv;
 	struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
 	struct p54_frame_sent *payload = (struct p54_frame_sent *) hdr->data;
-	struct sk_buff *entry;
+	struct sk_buff *entry = (struct sk_buff *) priv->tx_queue.next;
 	u32 addr = le32_to_cpu(hdr->req_id) - priv->headroom;
 	struct memrecord *range = NULL;
 	u32 freed = 0;
@@ -742,7 +741,6 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
 	int count, idx;
 
 	spin_lock_irqsave(&priv->tx_queue.lock, flags);
-	entry = (struct sk_buff *) priv->tx_queue.next;
 	while (entry != (struct sk_buff *)&priv->tx_queue) {
 		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
 		struct p54_hdr *entry_hdr;
@@ -978,7 +976,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
 			       struct p54_hdr *data, u32 len)
 {
 	struct p54_common *priv = dev->priv;
-	struct sk_buff *entry;
+	struct sk_buff *entry = priv->tx_queue.next;
 	struct sk_buff *target_skb = NULL;
 	struct ieee80211_tx_info *info;
 	struct memrecord *range;
@@ -1016,7 +1014,6 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
 		}
 	}
 
-	entry = priv->tx_queue.next;
 	while (left--) {
 		u32 hole_size;
 		info = IEEE80211_SKB_CB(entry);
diff --git a/trunk/drivers/net/wireless/rt2x00/rt2500usb.c b/trunk/drivers/net/wireless/rt2x00/rt2500usb.c
index 3e2ac2bbb12f..af6b5847be5c 100644
--- a/trunk/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/trunk/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1952,8 +1952,6 @@ static struct usb_device_id rt2500usb_device_table[] = {
 	{ USB_DEVICE(0x13b1, 0x000d), USB_DEVICE_DATA(&rt2500usb_ops) },
 	{ USB_DEVICE(0x13b1, 0x0011), USB_DEVICE_DATA(&rt2500usb_ops) },
 	{ USB_DEVICE(0x13b1, 0x001a), USB_DEVICE_DATA(&rt2500usb_ops) },
-	/* CNet */
-	{ USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt2500usb_ops) },
 	/* Conceptronic */
 	{ USB_DEVICE(0x14b2, 0x3c02), USB_DEVICE_DATA(&rt2500usb_ops) },
 	/* D-LINK */
@@ -1978,20 +1976,14 @@ static struct usb_device_id rt2500usb_device_table[] = {
 	{ USB_DEVICE(0x148f, 0x2570), USB_DEVICE_DATA(&rt2500usb_ops) },
 	{ USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt2500usb_ops) },
 	{ USB_DEVICE(0x148f, 0x9020), USB_DEVICE_DATA(&rt2500usb_ops) },
-	/* Sagem */
-	{ USB_DEVICE(0x079b, 0x004b), USB_DEVICE_DATA(&rt2500usb_ops) },
 	/* Siemens */
 	{ USB_DEVICE(0x0681, 0x3c06), USB_DEVICE_DATA(&rt2500usb_ops) },
 	/* SMC */
 	{ USB_DEVICE(0x0707, 0xee13), USB_DEVICE_DATA(&rt2500usb_ops) },
 	/* Spairon */
 	{ USB_DEVICE(0x114b, 0x0110), USB_DEVICE_DATA(&rt2500usb_ops) },
-	/* SURECOM */
-	{ USB_DEVICE(0x0769, 0x11f3), USB_DEVICE_DATA(&rt2500usb_ops) },
 	/* Trust */
 	{ USB_DEVICE(0x0eb0, 0x9020), USB_DEVICE_DATA(&rt2500usb_ops) },
-	/* VTech */
-	{ USB_DEVICE(0x0f88, 0x3012), USB_DEVICE_DATA(&rt2500usb_ops) },
 	/* Zinwell */
 	{ USB_DEVICE(0x5a57, 0x0260), USB_DEVICE_DATA(&rt2500usb_ops) },
 	{ 0, }
diff --git a/trunk/drivers/net/wireless/rt2x00/rt73usb.c b/trunk/drivers/net/wireless/rt2x00/rt73usb.c
index cefee1b26cd8..96a8d69f8790 100644
--- a/trunk/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/trunk/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2281,18 +2281,7 @@ static const struct rt2x00_ops rt73usb_ops = {
  */
 static struct usb_device_id rt73usb_device_table[] = {
 	/* AboCom */
-	{ USB_DEVICE(0x07b8, 0xb21b), USB_DEVICE_DATA(&rt73usb_ops) },
-	{ USB_DEVICE(0x07b8, 0xb21c), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x07b8, 0xb21d), USB_DEVICE_DATA(&rt73usb_ops) },
-	{ USB_DEVICE(0x07b8, 0xb21e), USB_DEVICE_DATA(&rt73usb_ops) },
-	{ USB_DEVICE(0x07b8, 0xb21f), USB_DEVICE_DATA(&rt73usb_ops) },
-	/* AL */
-	{ USB_DEVICE(0x14b2, 0x3c10), USB_DEVICE_DATA(&rt73usb_ops) },
-	/* Amigo */
-	{ USB_DEVICE(0x148f, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
-	{ USB_DEVICE(0x0eb0, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
-	/* AMIT  */
-	{ USB_DEVICE(0x18c5, 0x0002), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Askey */
 	{ USB_DEVICE(0x1690, 0x0722), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* ASUS */
@@ -2305,9 +2294,7 @@ static struct usb_device_id rt73usb_device_table[] = {
 	{ USB_DEVICE(0x050d, 0x905c), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Billionton */
 	{ USB_DEVICE(0x1631, 0xc019), USB_DEVICE_DATA(&rt73usb_ops) },
-	{ USB_DEVICE(0x08dd, 0x0120), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Buffalo */
-	{ USB_DEVICE(0x0411, 0x00d8), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* CNet */
 	{ USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt73usb_ops) },
@@ -2321,11 +2308,6 @@ static struct usb_device_id rt73usb_device_table[] = {
 	{ USB_DEVICE(0x07d1, 0x3c04), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x07d1, 0x3c06), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x07d1, 0x3c07), USB_DEVICE_DATA(&rt73usb_ops) },
-	/* Edimax */
-	{ USB_DEVICE(0x7392, 0x7318), USB_DEVICE_DATA(&rt73usb_ops) },
-	{ USB_DEVICE(0x7392, 0x7618), USB_DEVICE_DATA(&rt73usb_ops) },
-	/* EnGenius */
-	{ USB_DEVICE(0x1740, 0x3701), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Gemtek */
 	{ USB_DEVICE(0x15a9, 0x0004), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Gigabyte */
@@ -2346,34 +2328,22 @@ static struct usb_device_id rt73usb_device_table[] = {
 	{ USB_DEVICE(0x0db0, 0xa861), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x0db0, 0xa874), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Ralink */
-	{ USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Qcom */
 	{ USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x18e8, 0x6238), USB_DEVICE_DATA(&rt73usb_ops) },
-	/* Samsung */
-	{ USB_DEVICE(0x04e8, 0x4471), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Senao */
 	{ USB_DEVICE(0x1740, 0x7100), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Sitecom */
-	{ USB_DEVICE(0x0df6, 0x0024), USB_DEVICE_DATA(&rt73usb_ops) },
-	{ USB_DEVICE(0x0df6, 0x0027), USB_DEVICE_DATA(&rt73usb_ops) },
-	{ USB_DEVICE(0x0df6, 0x002f), USB_DEVICE_DATA(&rt73usb_ops) },
-	{ USB_DEVICE(0x0df6, 0x90ac), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x0df6, 0x9712), USB_DEVICE_DATA(&rt73usb_ops) },
+	{ USB_DEVICE(0x0df6, 0x90ac), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Surecom */
 	{ USB_DEVICE(0x0769, 0x31f3), USB_DEVICE_DATA(&rt73usb_ops) },
-	/* Philips */
-	{ USB_DEVICE(0x0471, 0x200a), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Planex */
 	{ USB_DEVICE(0x2019, 0xab01), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x2019, 0xab50), USB_DEVICE_DATA(&rt73usb_ops) },
-	/* Zcom */
-	{ USB_DEVICE(0x0cde, 0x001c), USB_DEVICE_DATA(&rt73usb_ops) },
-	/* ZyXEL */
-	{ USB_DEVICE(0x0586, 0x3415), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ 0, }
 };
 
diff --git a/trunk/drivers/video/i810/i810_main.c b/trunk/drivers/video/i810/i810_main.c
index 2e940199fc89..a24e680d2b9c 100644
--- a/trunk/drivers/video/i810/i810_main.c
+++ b/trunk/drivers/video/i810/i810_main.c
@@ -993,7 +993,6 @@ static int i810_check_params(struct fb_var_screeninfo *var,
 	struct i810fb_par *par = info->par;
 	int line_length, vidmem, mode_valid = 0, retval = 0;
 	u32 vyres = var->yres_virtual, vxres = var->xres_virtual;
-
 	/*
 	 *  Memory limit
 	 */
@@ -1003,12 +1002,12 @@ static int i810_check_params(struct fb_var_screeninfo *var,
 	if (vidmem > par->fb.size) {
 		vyres = par->fb.size/line_length;
 		if (vyres < var->yres) {
-			vyres = info->var.yres;
+			vyres = yres;
 			vxres = par->fb.size/vyres;
 			vxres /= var->bits_per_pixel >> 3;
 			line_length = get_line_length(par, vxres, 
 						      var->bits_per_pixel);
-			vidmem = line_length * info->var.yres;
+			vidmem = line_length * yres;
 			if (vxres < var->xres) {
 				printk("i810fb: required video memory, "
 				       "%d bytes, for %dx%d-%d (virtual) "
diff --git a/trunk/drivers/video/sh_mobile_lcdcfb.c b/trunk/drivers/video/sh_mobile_lcdcfb.c
index 2c5d069e5f06..0e2b8fd24df1 100644
--- a/trunk/drivers/video/sh_mobile_lcdcfb.c
+++ b/trunk/drivers/video/sh_mobile_lcdcfb.c
@@ -446,6 +446,7 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
 {
 	struct sh_mobile_lcdc_chan *ch;
 	struct sh_mobile_lcdc_board_cfg	*board_cfg;
+	unsigned long tmp;
 	int k;
 
 	/* tell the board code to disable the panel */
@@ -455,8 +456,9 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
 		if (board_cfg->display_off)
 			board_cfg->display_off(board_cfg->board_data);
 
-		/* cleanup deferred io if enabled */
-		if (ch->info.fbdefio) {
+		/* cleanup deferred io if SYS bus */
+		tmp = ch->cfg.sys_bus_cfg.deferred_io_msec;
+		if (ch->ldmt1r_value & (1 << 12) && tmp) {
 			fb_deferred_io_cleanup(&ch->info);
 			ch->info.fbdefio = NULL;
 		}
diff --git a/trunk/fs/btrfs/ctree.c b/trunk/fs/btrfs/ctree.c
index 37f31b5529aa..42491d728e99 100644
--- a/trunk/fs/btrfs/ctree.c
+++ b/trunk/fs/btrfs/ctree.c
@@ -277,7 +277,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
 	if (*cow_ret == buf)
 		unlock_orig = 1;
 
-	btrfs_assert_tree_locked(buf);
+	WARN_ON(!btrfs_tree_locked(buf));
 
 	if (parent)
 		parent_start = parent->start;
@@ -2365,7 +2365,7 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
 	if (slot >= btrfs_header_nritems(upper) - 1)
 		return 1;
 
-	btrfs_assert_tree_locked(path->nodes[1]);
+	WARN_ON(!btrfs_tree_locked(path->nodes[1]));
 
 	right = read_node_slot(root, upper, slot + 1);
 	btrfs_tree_lock(right);
@@ -2562,7 +2562,7 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
 	if (right_nritems == 0)
 		return 1;
 
-	btrfs_assert_tree_locked(path->nodes[1]);
+	WARN_ON(!btrfs_tree_locked(path->nodes[1]));
 
 	left = read_node_slot(root, path->nodes[1], slot - 1);
 	btrfs_tree_lock(left);
@@ -4101,7 +4101,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
 
 		next = read_node_slot(root, c, slot);
 		if (!path->skip_locking) {
-			btrfs_assert_tree_locked(c);
+			WARN_ON(!btrfs_tree_locked(c));
 			btrfs_tree_lock(next);
 			btrfs_set_lock_blocking(next);
 		}
@@ -4126,7 +4126,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
 			reada_for_search(root, path, level, slot, 0);
 		next = read_node_slot(root, next, 0);
 		if (!path->skip_locking) {
-			btrfs_assert_tree_locked(path->nodes[level]);
+			WARN_ON(!btrfs_tree_locked(path->nodes[level]));
 			btrfs_tree_lock(next);
 			btrfs_set_lock_blocking(next);
 		}
diff --git a/trunk/fs/btrfs/disk-io.c b/trunk/fs/btrfs/disk-io.c
index 3e18175248e0..adda739a0215 100644
--- a/trunk/fs/btrfs/disk-io.c
+++ b/trunk/fs/btrfs/disk-io.c
@@ -857,7 +857,7 @@ int clean_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
 	struct inode *btree_inode = root->fs_info->btree_inode;
 	if (btrfs_header_generation(buf) ==
 	    root->fs_info->running_transaction->transid) {
-		btrfs_assert_tree_locked(buf);
+		WARN_ON(!btrfs_tree_locked(buf));
 
 		/* ugh, clear_extent_buffer_dirty can be expensive */
 		btrfs_set_lock_blocking(buf);
@@ -2361,7 +2361,7 @@ void btrfs_mark_buffer_dirty(struct extent_buffer *buf)
 
 	btrfs_set_lock_blocking(buf);
 
-	btrfs_assert_tree_locked(buf);
+	WARN_ON(!btrfs_tree_locked(buf));
 	if (transid != root->fs_info->generation) {
 		printk(KERN_CRIT "btrfs transid mismatch buffer %llu, "
 		       "found %llu running %llu\n",
diff --git a/trunk/fs/btrfs/extent-tree.c b/trunk/fs/btrfs/extent-tree.c
index 9abf81f71c46..6b5966aacf44 100644
--- a/trunk/fs/btrfs/extent-tree.c
+++ b/trunk/fs/btrfs/extent-tree.c
@@ -4418,13 +4418,13 @@ int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
 	path = btrfs_alloc_path();
 	BUG_ON(!path);
 
-	btrfs_assert_tree_locked(parent);
+	BUG_ON(!btrfs_tree_locked(parent));
 	parent_level = btrfs_header_level(parent);
 	extent_buffer_get(parent);
 	path->nodes[parent_level] = parent;
 	path->slots[parent_level] = btrfs_header_nritems(parent);
 
-	btrfs_assert_tree_locked(node);
+	BUG_ON(!btrfs_tree_locked(node));
 	level = btrfs_header_level(node);
 	extent_buffer_get(node);
 	path->nodes[level] = node;
diff --git a/trunk/fs/btrfs/locking.c b/trunk/fs/btrfs/locking.c
index 47b0a88c12a2..85506c4a3af7 100644
--- a/trunk/fs/btrfs/locking.c
+++ b/trunk/fs/btrfs/locking.c
@@ -220,8 +220,8 @@ int btrfs_tree_unlock(struct extent_buffer *eb)
 	return 0;
 }
 
-void btrfs_assert_tree_locked(struct extent_buffer *eb)
+int btrfs_tree_locked(struct extent_buffer *eb)
 {
-	if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
-		assert_spin_locked(&eb->lock);
+	return test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags) ||
+			spin_is_locked(&eb->lock);
 }
diff --git a/trunk/fs/btrfs/locking.h b/trunk/fs/btrfs/locking.h
index 6c4ce457168c..6bb0afbff928 100644
--- a/trunk/fs/btrfs/locking.h
+++ b/trunk/fs/btrfs/locking.h
@@ -21,11 +21,11 @@
 
 int btrfs_tree_lock(struct extent_buffer *eb);
 int btrfs_tree_unlock(struct extent_buffer *eb);
+int btrfs_tree_locked(struct extent_buffer *eb);
 
 int btrfs_try_tree_lock(struct extent_buffer *eb);
 int btrfs_try_spin_lock(struct extent_buffer *eb);
 
 void btrfs_set_lock_blocking(struct extent_buffer *eb);
 void btrfs_clear_lock_blocking(struct extent_buffer *eb);
-void btrfs_assert_tree_locked(struct extent_buffer *eb);
 #endif
diff --git a/trunk/fs/devpts/inode.c b/trunk/fs/devpts/inode.c
index bff4052b05e7..5f3231b9633f 100644
--- a/trunk/fs/devpts/inode.c
+++ b/trunk/fs/devpts/inode.c
@@ -198,6 +198,9 @@ static int mknod_ptmx(struct super_block *sb)
 
 	fsi->ptmx_dentry = dentry;
 	rc = 0;
+
+	printk(KERN_DEBUG "Created ptmx node in devpts ino %lu\n",
+			inode->i_ino);
 out:
 	mutex_unlock(&root->d_inode->i_mutex);
 	return rc;
@@ -366,6 +369,8 @@ static int new_pts_mount(struct file_system_type *fs_type, int flags,
 	struct pts_fs_info *fsi;
 	struct pts_mount_opts *opts;
 
+	printk(KERN_NOTICE "devpts: newinstance mount\n");
+
 	err = get_sb_nodev(fs_type, flags, data, devpts_fill_super, mnt);
 	if (err)
 		return err;
diff --git a/trunk/include/linux/cpufreq.h b/trunk/include/linux/cpufreq.h
index 161042746afc..384b38d3e8e2 100644
--- a/trunk/include/linux/cpufreq.h
+++ b/trunk/include/linux/cpufreq.h
@@ -234,6 +234,7 @@ struct cpufreq_driver {
 	int	(*suspend)	(struct cpufreq_policy *policy, pm_message_t pmsg);
 	int	(*resume)	(struct cpufreq_policy *policy);
 	struct freq_attr	**attr;
+	bool			hide_interface;
 };
 
 /* flags */
diff --git a/trunk/include/linux/netdevice.h b/trunk/include/linux/netdevice.h
index 659366734f3f..ec54785d34f9 100644
--- a/trunk/include/linux/netdevice.h
+++ b/trunk/include/linux/netdevice.h
@@ -1079,7 +1079,6 @@ extern void		synchronize_net(void);
 extern int 		register_netdevice_notifier(struct notifier_block *nb);
 extern int		unregister_netdevice_notifier(struct notifier_block *nb);
 extern int		init_dummy_netdev(struct net_device *dev);
-extern void		netdev_resync_ops(struct net_device *dev);
 
 extern int call_netdevice_notifiers(unsigned long val, struct net_device *dev);
 extern struct net_device	*dev_get_by_index(struct net *net, int ifindex);
diff --git a/trunk/include/net/net_namespace.h b/trunk/include/net/net_namespace.h
index ded434b032a4..6fc13d905c5f 100644
--- a/trunk/include/net/net_namespace.h
+++ b/trunk/include/net/net_namespace.h
@@ -109,6 +109,11 @@ extern struct list_head net_namespace_list;
 #ifdef CONFIG_NET_NS
 extern void __put_net(struct net *net);
 
+static inline int net_alive(struct net *net)
+{
+	return net && atomic_read(&net->count);
+}
+
 static inline struct net *get_net(struct net *net)
 {
 	atomic_inc(&net->count);
@@ -140,6 +145,11 @@ int net_eq(const struct net *net1, const struct net *net2)
 }
 #else
 
+static inline int net_alive(struct net *net)
+{
+	return 1;
+}
+
 static inline struct net *get_net(struct net *net)
 {
 	return net;
@@ -224,23 +234,6 @@ struct pernet_operations {
 	void (*exit)(struct net *net);
 };
 
-/*
- * Use these carefully.  If you implement a network device and it
- * needs per network namespace operations use device pernet operations,
- * otherwise use pernet subsys operations.
- *
- * This is critically important.  Most of the network code cleanup
- * runs with the assumption that dev_remove_pack has been called so no
- * new packets will arrive during and after the cleanup functions have
- * been called.  dev_remove_pack is not per namespace so instead the
- * guarantee of no more packets arriving in a network namespace is
- * provided by ensuring that all network devices and all sockets have
- * left the network namespace before the cleanup methods are called.
- *
- * For the longest time the ipv4 icmp code was registered as a pernet
- * device which caused kernel oops, and panics during network
- * namespace cleanup.   So please don't get this wrong.
- */
 extern int register_pernet_subsys(struct pernet_operations *);
 extern void unregister_pernet_subsys(struct pernet_operations *);
 extern int register_pernet_gen_subsys(int *id, struct pernet_operations *);
diff --git a/trunk/init/Kconfig b/trunk/init/Kconfig
index 38396ec7ee36..95a66131403a 100644
--- a/trunk/init/Kconfig
+++ b/trunk/init/Kconfig
@@ -735,9 +735,6 @@ config CC_OPTIMIZE_FOR_SIZE
 config SYSCTL
 	bool
 
-config ANON_INODES
-	bool
-
 menuconfig EMBEDDED
 	bool "Configure standard kernel features (for small systems)"
 	help
@@ -843,6 +840,18 @@ config PCSPKR_PLATFORM
           This option allows to disable the internal PC-Speaker
           support, saving some memory.
 
+config COMPAT_BRK
+	bool "Disable heap randomization"
+	default y
+	help
+	  Randomizing heap placement makes heap exploits harder, but it
+	  also breaks ancient binaries (including anything libc5 based).
+	  This option changes the bootup default to heap randomization
+	  disabled, and can be overriden runtime by setting
+	  /proc/sys/kernel/randomize_va_space to 2.
+
+	  On non-ancient distros (post-2000 ones) N is usually a safe choice.
+
 config BASE_FULL
 	default y
 	bool "Enable full-sized data structures for core" if EMBEDDED
@@ -860,6 +869,9 @@ config FUTEX
 	  support for "fast userspace mutexes".  The resulting kernel may not
 	  run glibc-based applications correctly.
 
+config ANON_INODES
+	bool
+
 config EPOLL
 	bool "Enable eventpoll support" if EMBEDDED
 	default y
@@ -945,18 +957,6 @@ config SLUB_DEBUG
 	  SLUB sysfs support. /sys/slab will not exist and there will be
 	  no support for cache validation etc.
 
-config COMPAT_BRK
-	bool "Disable heap randomization"
-	default y
-	help
-	  Randomizing heap placement makes heap exploits harder, but it
-	  also breaks ancient binaries (including anything libc5 based).
-	  This option changes the bootup default to heap randomization
-	  disabled, and can be overriden runtime by setting
-	  /proc/sys/kernel/randomize_va_space to 2.
-
-	  On non-ancient distros (post-2000 ones) N is usually a safe choice.
-
 choice
 	prompt "Choose SLAB allocator"
 	default SLUB
diff --git a/trunk/kernel/fork.c b/trunk/kernel/fork.c
index 6715ebc3761d..8de303bdd4e5 100644
--- a/trunk/kernel/fork.c
+++ b/trunk/kernel/fork.c
@@ -1184,6 +1184,10 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #endif
 	clear_all_latency_tracing(p);
 
+	/* Our parent execution domain becomes current domain
+	   These must match for thread signalling to apply */
+	p->parent_exec_id = p->self_exec_id;
+
 	/* ok, now we should be set up.. */
 	p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
 	p->pdeath_signal = 0;
@@ -1221,13 +1225,10 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 		set_task_cpu(p, smp_processor_id());
 
 	/* CLONE_PARENT re-uses the old parent */
-	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+	if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
 		p->real_parent = current->real_parent;
-		p->parent_exec_id = current->parent_exec_id;
-	} else {
+	else
 		p->real_parent = current;
-		p->parent_exec_id = current->self_exec_id;
-	}
 
 	spin_lock(&current->sighand->siglock);
 
diff --git a/trunk/kernel/tsacct.c b/trunk/kernel/tsacct.c
index 00d59d048edf..43f891b05a4b 100644
--- a/trunk/kernel/tsacct.c
+++ b/trunk/kernel/tsacct.c
@@ -122,10 +122,8 @@ void acct_update_integrals(struct task_struct *tsk)
 	if (likely(tsk->mm)) {
 		cputime_t time, dtime;
 		struct timeval value;
-		unsigned long flags;
 		u64 delta;
 
-		local_irq_save(flags);
 		time = tsk->stime + tsk->utime;
 		dtime = cputime_sub(time, tsk->acct_timexpd);
 		jiffies_to_timeval(cputime_to_jiffies(dtime), &value);
@@ -133,12 +131,10 @@ void acct_update_integrals(struct task_struct *tsk)
 		delta = delta * USEC_PER_SEC + value.tv_usec;
 
 		if (delta == 0)
-			goto out;
+			return;
 		tsk->acct_timexpd = time;
 		tsk->acct_rss_mem1 += delta * get_mm_rss(tsk->mm);
 		tsk->acct_vm_mem1 += delta * tsk->mm->total_vm;
-	out:
-		local_irq_restore(flags);
 	}
 }
 
diff --git a/trunk/kernel/user.c b/trunk/kernel/user.c
index fbb300e6191f..6a9b696128c8 100644
--- a/trunk/kernel/user.c
+++ b/trunk/kernel/user.c
@@ -286,12 +286,14 @@ int __init uids_sysfs_init(void)
 /* work function to remove sysfs directory for a user and free up
  * corresponding structures.
  */
-static void cleanup_user_struct(struct work_struct *w)
+static void remove_user_sysfs_dir(struct work_struct *w)
 {
 	struct user_struct *up = container_of(w, struct user_struct, work);
 	unsigned long flags;
 	int remove_user = 0;
 
+	if (up->user_ns != &init_user_ns)
+		return;
 	/* Make uid_hash_remove() + sysfs_remove_file() + kobject_del()
 	 * atomic.
 	 */
@@ -310,11 +312,9 @@ static void cleanup_user_struct(struct work_struct *w)
 	if (!remove_user)
 		goto done;
 
-	if (up->user_ns == &init_user_ns) {
-		kobject_uevent(&up->kobj, KOBJ_REMOVE);
-		kobject_del(&up->kobj);
-		kobject_put(&up->kobj);
-	}
+	kobject_uevent(&up->kobj, KOBJ_REMOVE);
+	kobject_del(&up->kobj);
+	kobject_put(&up->kobj);
 
 	sched_destroy_user(up);
 	key_put(up->uid_keyring);
@@ -335,7 +335,7 @@ static void free_user(struct user_struct *up, unsigned long flags)
 	atomic_inc(&up->__count);
 	spin_unlock_irqrestore(&uidhash_lock, flags);
 
-	INIT_WORK(&up->work, cleanup_user_struct);
+	INIT_WORK(&up->work, remove_user_sysfs_dir);
 	schedule_work(&up->work);
 }
 
diff --git a/trunk/lib/idr.c b/trunk/lib/idr.c
index dab4bca86f5d..c11c5765cdef 100644
--- a/trunk/lib/idr.c
+++ b/trunk/lib/idr.c
@@ -449,7 +449,6 @@ void idr_remove_all(struct idr *idp)
 
 	n = idp->layers * IDR_BITS;
 	p = idp->top;
-	rcu_assign_pointer(idp->top, NULL);
 	max = 1 << n;
 
 	id = 0;
@@ -468,6 +467,7 @@ void idr_remove_all(struct idr *idp)
 			p = *--paa;
 		}
 	}
+	rcu_assign_pointer(idp->top, NULL);
 	idp->layers = 0;
 }
 EXPORT_SYMBOL(idr_remove_all);
diff --git a/trunk/net/802/tr.c b/trunk/net/802/tr.c
index f47ae289d83b..158150fee462 100644
--- a/trunk/net/802/tr.c
+++ b/trunk/net/802/tr.c
@@ -668,5 +668,3 @@ module_init(rif_init);
 
 EXPORT_SYMBOL(tr_type_trans);
 EXPORT_SYMBOL(alloc_trdev);
-
-MODULE_LICENSE("GPL");
diff --git a/trunk/net/8021q/vlan_dev.c b/trunk/net/8021q/vlan_dev.c
index 1b34135cf990..4a19acd3a32b 100644
--- a/trunk/net/8021q/vlan_dev.c
+++ b/trunk/net/8021q/vlan_dev.c
@@ -553,7 +553,7 @@ static int vlan_dev_neigh_setup(struct net_device *dev, struct neigh_parms *pa)
 	int err = 0;
 
 	if (netif_device_present(real_dev) && ops->ndo_neigh_setup)
-		err = ops->ndo_neigh_setup(real_dev, pa);
+		err = ops->ndo_neigh_setup(dev, pa);
 
 	return err;
 }
@@ -639,7 +639,6 @@ static int vlan_dev_init(struct net_device *dev)
 		dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
 		dev->netdev_ops         = &vlan_netdev_ops;
 	}
-	netdev_resync_ops(dev);
 
 	if (is_vlan_dev(real_dev))
 		subclass = 1;
diff --git a/trunk/net/core/dev.c b/trunk/net/core/dev.c
index f1129706ce7b..72b0d26fd46d 100644
--- a/trunk/net/core/dev.c
+++ b/trunk/net/core/dev.c
@@ -2267,6 +2267,12 @@ int netif_receive_skb(struct sk_buff *skb)
 
 	rcu_read_lock();
 
+	/* Don't receive packets in an exiting network namespace */
+	if (!net_alive(dev_net(skb->dev))) {
+		kfree_skb(skb);
+		goto out;
+	}
+
 #ifdef CONFIG_NET_CLS_ACT
 	if (skb->tc_verd & TC_NCLS) {
 		skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
@@ -4282,39 +4288,6 @@ unsigned long netdev_fix_features(unsigned long features, const char *name)
 }
 EXPORT_SYMBOL(netdev_fix_features);
 
-/* Some devices need to (re-)set their netdev_ops inside
- * ->init() or similar.  If that happens, we have to setup
- * the compat pointers again.
- */
-void netdev_resync_ops(struct net_device *dev)
-{
-#ifdef CONFIG_COMPAT_NET_DEV_OPS
-	const struct net_device_ops *ops = dev->netdev_ops;
-
-	dev->init = ops->ndo_init;
-	dev->uninit = ops->ndo_uninit;
-	dev->open = ops->ndo_open;
-	dev->change_rx_flags = ops->ndo_change_rx_flags;
-	dev->set_rx_mode = ops->ndo_set_rx_mode;
-	dev->set_multicast_list = ops->ndo_set_multicast_list;
-	dev->set_mac_address = ops->ndo_set_mac_address;
-	dev->validate_addr = ops->ndo_validate_addr;
-	dev->do_ioctl = ops->ndo_do_ioctl;
-	dev->set_config = ops->ndo_set_config;
-	dev->change_mtu = ops->ndo_change_mtu;
-	dev->neigh_setup = ops->ndo_neigh_setup;
-	dev->tx_timeout = ops->ndo_tx_timeout;
-	dev->get_stats = ops->ndo_get_stats;
-	dev->vlan_rx_register = ops->ndo_vlan_rx_register;
-	dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
-	dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-	dev->poll_controller = ops->ndo_poll_controller;
-#endif
-#endif
-}
-EXPORT_SYMBOL(netdev_resync_ops);
-
 /**
  *	register_netdevice	- register a network device
  *	@dev: device to register
@@ -4359,7 +4332,27 @@ int register_netdevice(struct net_device *dev)
 	 * This is temporary until all network devices are converted.
 	 */
 	if (dev->netdev_ops) {
-		netdev_resync_ops(dev);
+		const struct net_device_ops *ops = dev->netdev_ops;
+
+		dev->init = ops->ndo_init;
+		dev->uninit = ops->ndo_uninit;
+		dev->open = ops->ndo_open;
+		dev->change_rx_flags = ops->ndo_change_rx_flags;
+		dev->set_rx_mode = ops->ndo_set_rx_mode;
+		dev->set_multicast_list = ops->ndo_set_multicast_list;
+		dev->set_mac_address = ops->ndo_set_mac_address;
+		dev->validate_addr = ops->ndo_validate_addr;
+		dev->do_ioctl = ops->ndo_do_ioctl;
+		dev->set_config = ops->ndo_set_config;
+		dev->change_mtu = ops->ndo_change_mtu;
+		dev->tx_timeout = ops->ndo_tx_timeout;
+		dev->get_stats = ops->ndo_get_stats;
+		dev->vlan_rx_register = ops->ndo_vlan_rx_register;
+		dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
+		dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+		dev->poll_controller = ops->ndo_poll_controller;
+#endif
 	} else {
 		char drivername[64];
 		pr_info("%s (%s): not using net_device_ops yet\n",
diff --git a/trunk/net/core/net-sysfs.c b/trunk/net/core/net-sysfs.c
index 484f58750eba..6ac29a46e23e 100644
--- a/trunk/net/core/net-sysfs.c
+++ b/trunk/net/core/net-sysfs.c
@@ -77,9 +77,7 @@ static ssize_t netdev_store(struct device *dev, struct device_attribute *attr,
 	if (endp == buf)
 		goto err;
 
-	if (!rtnl_trylock())
-		return -ERESTARTSYS;
-
+	rtnl_lock();
 	if (dev_isalive(net)) {
 		if ((ret = (*set)(net, new)) == 0)
 			ret = len;
diff --git a/trunk/net/core/net_namespace.c b/trunk/net/core/net_namespace.c
index e3bebd36f053..2adb1a7d361f 100644
--- a/trunk/net/core/net_namespace.c
+++ b/trunk/net/core/net_namespace.c
@@ -157,6 +157,9 @@ static void cleanup_net(struct work_struct *work)
 	struct pernet_operations *ops;
 	struct net *net;
 
+	/* Be very certain incoming network packets will not find us */
+	rcu_barrier();
+
 	net = container_of(work, struct net, work);
 
 	mutex_lock(&net_mutex);
diff --git a/trunk/net/ipv4/icmp.c b/trunk/net/ipv4/icmp.c
index fc562d29cc46..705b33b184a3 100644
--- a/trunk/net/ipv4/icmp.c
+++ b/trunk/net/ipv4/icmp.c
@@ -1205,7 +1205,7 @@ static struct pernet_operations __net_initdata icmp_sk_ops = {
 
 int __init icmp_init(void)
 {
-	return register_pernet_subsys(&icmp_sk_ops);
+	return register_pernet_device(&icmp_sk_ops);
 }
 
 EXPORT_SYMBOL(icmp_err_convert);
diff --git a/trunk/net/ipv4/tcp_ipv4.c b/trunk/net/ipv4/tcp_ipv4.c
index cf74c416831a..19d7b429a262 100644
--- a/trunk/net/ipv4/tcp_ipv4.c
+++ b/trunk/net/ipv4/tcp_ipv4.c
@@ -2443,7 +2443,7 @@ static struct pernet_operations __net_initdata tcp_sk_ops = {
 void __init tcp_v4_init(void)
 {
 	inet_hashinfo_init(&tcp_hashinfo);
-	if (register_pernet_subsys(&tcp_sk_ops))
+	if (register_pernet_device(&tcp_sk_ops))
 		panic("Failed to create the TCP control socket.\n");
 }
 
diff --git a/trunk/net/ipv6/addrconf.c b/trunk/net/ipv6/addrconf.c
index 1220e2c7831e..f9afb452249c 100644
--- a/trunk/net/ipv6/addrconf.c
+++ b/trunk/net/ipv6/addrconf.c
@@ -493,17 +493,15 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
 	read_unlock(&dev_base_lock);
 }
 
-static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
+static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 {
 	struct net *net;
 
 	net = (struct net *)table->extra2;
 	if (p == &net->ipv6.devconf_dflt->forwarding)
-		return 0;
-
-	if (!rtnl_trylock())
-		return -ERESTARTSYS;
+		return;
 
+	rtnl_lock();
 	if (p == &net->ipv6.devconf_all->forwarding) {
 		__s32 newf = net->ipv6.devconf_all->forwarding;
 		net->ipv6.devconf_dflt->forwarding = newf;
@@ -514,7 +512,6 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 
 	if (*p)
 		rt6_purge_dflt_routers(net);
-	return 1;
 }
 #endif
 
@@ -2611,6 +2608,9 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
 	ASSERT_RTNL();
 
+	if ((dev->flags & IFF_LOOPBACK) && how == 1)
+		how = 0;
+
 	rt6_ifdown(net, dev);
 	neigh_ifdown(&nd_tbl, dev);
 
@@ -3983,7 +3983,7 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
 	ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
 
 	if (write)
-		ret = addrconf_fixup_forwarding(ctl, valp, val);
+		addrconf_fixup_forwarding(ctl, valp, val);
 	return ret;
 }
 
@@ -4019,7 +4019,8 @@ static int addrconf_sysctl_forward_strategy(ctl_table *table,
 	}
 
 	*valp = new;
-	return addrconf_fixup_forwarding(table, valp, val);
+	addrconf_fixup_forwarding(table, valp, val);
+	return 1;
 }
 
 static struct addrconf_sysctl_table
@@ -4445,6 +4446,25 @@ int unregister_inet6addr_notifier(struct notifier_block *nb)
 
 EXPORT_SYMBOL(unregister_inet6addr_notifier);
 
+static void addrconf_net_exit(struct net *net)
+{
+	struct net_device *dev;
+
+	rtnl_lock();
+	/* clean dev list */
+	for_each_netdev(net, dev) {
+		if (__in6_dev_get(dev) == NULL)
+			continue;
+		addrconf_ifdown(dev, 1);
+	}
+	addrconf_ifdown(net->loopback_dev, 2);
+	rtnl_unlock();
+}
+
+static struct pernet_operations addrconf_net_ops = {
+	.exit = addrconf_net_exit,
+};
+
 /*
  *	Init / cleanup code
  */
@@ -4486,6 +4506,10 @@ int __init addrconf_init(void)
 	if (err)
 		goto errlo;
 
+	err = register_pernet_device(&addrconf_net_ops);
+	if (err)
+		return err;
+
 	register_netdevice_notifier(&ipv6_dev_notf);
 
 	addrconf_verify(0);
@@ -4515,22 +4539,15 @@ int __init addrconf_init(void)
 void addrconf_cleanup(void)
 {
 	struct inet6_ifaddr *ifa;
-	struct net_device *dev;
 	int i;
 
 	unregister_netdevice_notifier(&ipv6_dev_notf);
+	unregister_pernet_device(&addrconf_net_ops);
+
 	unregister_pernet_subsys(&addrconf_ops);
 
 	rtnl_lock();
 
-	/* clean dev list */
-	for_each_netdev(&init_net, dev) {
-		if (__in6_dev_get(dev) == NULL)
-			continue;
-		addrconf_ifdown(dev, 1);
-	}
-	addrconf_ifdown(init_net.loopback_dev, 2);
-
 	/*
 	 *	Check hash table.
 	 */
@@ -4551,4 +4568,6 @@ void addrconf_cleanup(void)
 
 	del_timer(&addr_chk_timer);
 	rtnl_unlock();
+
+	unregister_pernet_subsys(&addrconf_net_ops);
 }
diff --git a/trunk/net/ipv6/af_inet6.c b/trunk/net/ipv6/af_inet6.c
index da944eca2ca6..c802bc1658a8 100644
--- a/trunk/net/ipv6/af_inet6.c
+++ b/trunk/net/ipv6/af_inet6.c
@@ -72,10 +72,6 @@ MODULE_LICENSE("GPL");
 static struct list_head inetsw6[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw6_lock);
 
-static int disable_ipv6 = 0;
-module_param_named(disable, disable_ipv6, int, 0);
-MODULE_PARM_DESC(disable, "Disable IPv6 such that it is non-functional");
-
 static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
 {
 	const int offset = sk->sk_prot->obj_size - sizeof(struct ipv6_pinfo);
@@ -995,21 +991,10 @@ static int __init inet6_init(void)
 {
 	struct sk_buff *dummy_skb;
 	struct list_head *r;
-	int err = 0;
+	int err;
 
 	BUILD_BUG_ON(sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb));
 
-	/* Register the socket-side information for inet6_create.  */
-	for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
-		INIT_LIST_HEAD(r);
-
-	if (disable_ipv6) {
-		printk(KERN_INFO
-		       "IPv6: Loaded, but administratively disabled, "
-		       "reboot required to enable\n");
-		goto out;
-	}
-
 	err = proto_register(&tcpv6_prot, 1);
 	if (err)
 		goto out;
@@ -1027,6 +1012,10 @@ static int __init inet6_init(void)
 		goto out_unregister_udplite_proto;
 
 
+	/* Register the socket-side information for inet6_create.  */
+	for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
+		INIT_LIST_HEAD(r);
+
 	/* We MUST register RAW sockets before we create the ICMP6,
 	 * IGMP6, or NDISC control sockets.
 	 */
diff --git a/trunk/net/netlink/af_netlink.c b/trunk/net/netlink/af_netlink.c
index 3ae3cb816563..9eb895c7a2a9 100644
--- a/trunk/net/netlink/af_netlink.c
+++ b/trunk/net/netlink/af_netlink.c
@@ -1084,13 +1084,6 @@ static inline int do_one_set_err(struct sock *sk,
 	return 0;
 }
 
-/**
- * netlink_set_err - report error to broadcast listeners
- * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
- * @pid: the PID of a process that we want to skip (if any)
- * @groups: the broadcast group that will notice the error
- * @code: error code, must be negative (as usual in kernelspace)
- */
 void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
 {
 	struct netlink_set_err_data info;
@@ -1100,8 +1093,7 @@ void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
 	info.exclude_sk = ssk;
 	info.pid = pid;
 	info.group = group;
-	/* sk->sk_err wants a positive error value */
-	info.code = -code;
+	info.code = code;
 
 	read_lock(&nl_table_lock);
 
diff --git a/trunk/net/sched/act_police.c b/trunk/net/sched/act_police.c
index f8f047b61245..5c72a116b1a4 100644
--- a/trunk/net/sched/act_police.c
+++ b/trunk/net/sched/act_police.c
@@ -183,6 +183,13 @@ static int tcf_act_police_locate(struct nlattr *nla, struct nlattr *est,
 		if (R_tab == NULL)
 			goto failure;
 
+		if (!est && (ret == ACT_P_CREATED ||
+			     !gen_estimator_active(&police->tcf_bstats,
+						   &police->tcf_rate_est))) {
+			err = -EINVAL;
+			goto failure;
+		}
+
 		if (parm->peakrate.rate) {
 			P_tab = qdisc_get_rtab(&parm->peakrate,
 					       tb[TCA_POLICE_PEAKRATE]);
@@ -198,12 +205,6 @@ static int tcf_act_police_locate(struct nlattr *nla, struct nlattr *est,
 					    &police->tcf_lock, est);
 		if (err)
 			goto failure_unlock;
-	} else if (tb[TCA_POLICE_AVRATE] &&
-		   (ret == ACT_P_CREATED ||
-		    !gen_estimator_active(&police->tcf_bstats,
-					  &police->tcf_rate_est))) {
-		err = -EINVAL;
-		goto failure_unlock;
 	}
 
 	/* No failure allowed after this point */
diff --git a/trunk/net/sctp/protocol.c b/trunk/net/sctp/protocol.c
index c4986d0f7419..b78e3be69013 100644
--- a/trunk/net/sctp/protocol.c
+++ b/trunk/net/sctp/protocol.c
@@ -717,20 +717,15 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
 static int sctp_ctl_sock_init(void)
 {
 	int err;
-	sa_family_t family = PF_INET;
+	sa_family_t family;
 
 	if (sctp_get_pf_specific(PF_INET6))
 		family = PF_INET6;
+	else
+		family = PF_INET;
 
 	err = inet_ctl_sock_create(&sctp_ctl_sock, family,
 				   SOCK_SEQPACKET, IPPROTO_SCTP, &init_net);
-
-	/* If IPv6 socket could not be created, try the IPv4 socket */
-	if (err < 0 && family == PF_INET6)
-		err = inet_ctl_sock_create(&sctp_ctl_sock, AF_INET,
-					   SOCK_SEQPACKET, IPPROTO_SCTP,
-					   &init_net);
-
 	if (err < 0) {
 		printk(KERN_ERR
 		       "SCTP: Failed to create the SCTP control socket.\n");
@@ -1327,8 +1322,9 @@ SCTP_STATIC __init int sctp_init(void)
 out:
 	return status;
 err_v6_add_protocol:
-	sctp_v4_del_protocol();
+	sctp_v6_del_protocol();
 err_add_protocol:
+	sctp_v4_del_protocol();
 	inet_ctl_sock_destroy(sctp_ctl_sock);
 err_ctl_sock_init:
 	sctp_v6_protosw_exit();
@@ -1339,6 +1335,7 @@ SCTP_STATIC __init int sctp_init(void)
 	sctp_v4_pf_exit();
 	sctp_v6_pf_exit();
 	sctp_sysctl_unregister();
+	list_del(&sctp_af_inet.list);
 	free_pages((unsigned long)sctp_port_hashtable,
 		   get_order(sctp_port_hashsize *
 			     sizeof(struct sctp_bind_hashbucket)));
@@ -1386,6 +1383,7 @@ SCTP_STATIC __exit void sctp_exit(void)
 	sctp_v4_pf_exit();
 
 	sctp_sysctl_unregister();
+	list_del(&sctp_af_inet.list);
 
 	free_pages((unsigned long)sctp_assoc_hashtable,
 		   get_order(sctp_assoc_hashsize *
diff --git a/trunk/net/sctp/sm_sideeffect.c b/trunk/net/sctp/sm_sideeffect.c
index b5495aecab60..e1d6076b4f59 100644
--- a/trunk/net/sctp/sm_sideeffect.c
+++ b/trunk/net/sctp/sm_sideeffect.c
@@ -787,48 +787,36 @@ static void sctp_cmd_process_operr(sctp_cmd_seq_t *cmds,
 				   struct sctp_association *asoc,
 				   struct sctp_chunk *chunk)
 {
+	struct sctp_operr_chunk *operr_chunk;
 	struct sctp_errhdr *err_hdr;
-	struct sctp_ulpevent *ev;
-
-	while (chunk->chunk_end > chunk->skb->data) {
-		err_hdr = (struct sctp_errhdr *)(chunk->skb->data);
-
-		ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
-						     GFP_ATOMIC);
-		if (!ev)
-			return;
 
-		sctp_ulpq_tail_event(&asoc->ulpq, ev);
+	operr_chunk = (struct sctp_operr_chunk *)chunk->chunk_hdr;
+	err_hdr = &operr_chunk->err_hdr;
 
-		switch (err_hdr->cause) {
-		case SCTP_ERROR_UNKNOWN_CHUNK:
-		{
-			sctp_chunkhdr_t *unk_chunk_hdr;
-
-			unk_chunk_hdr = (sctp_chunkhdr_t *)err_hdr->variable;
-			switch (unk_chunk_hdr->type) {
-			/* ADDIP 4.1 A9) If the peer responds to an ASCONF with
-			 * an ERROR chunk reporting that it did not recognized
-			 * the ASCONF chunk type, the sender of the ASCONF MUST
-			 * NOT send any further ASCONF chunks and MUST stop its
-			 * T-4 timer.
-			 */
-			case SCTP_CID_ASCONF:
-				if (asoc->peer.asconf_capable == 0)
-					break;
+	switch (err_hdr->cause) {
+	case SCTP_ERROR_UNKNOWN_CHUNK:
+	{
+		struct sctp_chunkhdr *unk_chunk_hdr;
 
-				asoc->peer.asconf_capable = 0;
-				sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
+		unk_chunk_hdr = (struct sctp_chunkhdr *)err_hdr->variable;
+		switch (unk_chunk_hdr->type) {
+		/* ADDIP 4.1 A9) If the peer responds to an ASCONF with an
+		 * ERROR chunk reporting that it did not recognized the ASCONF
+		 * chunk type, the sender of the ASCONF MUST NOT send any
+		 * further ASCONF chunks and MUST stop its T-4 timer.
+		 */
+		case SCTP_CID_ASCONF:
+			asoc->peer.asconf_capable = 0;
+			sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
 					SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
-				break;
-			default:
-				break;
-			}
 			break;
-		}
 		default:
 			break;
 		}
+		break;
+	}
+	default:
+		break;
 	}
 }
 
diff --git a/trunk/net/sctp/sm_statefuns.c b/trunk/net/sctp/sm_statefuns.c
index f88dfded0e3a..3a0cd075914f 100644
--- a/trunk/net/sctp/sm_statefuns.c
+++ b/trunk/net/sctp/sm_statefuns.c
@@ -3163,6 +3163,7 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
 					sctp_cmd_seq_t *commands)
 {
 	struct sctp_chunk *chunk = arg;
+	struct sctp_ulpevent *ev;
 
 	if (!sctp_vtag_verify(chunk, asoc))
 		return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -3172,10 +3173,21 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
 		return sctp_sf_violation_chunklen(ep, asoc, type, arg,
 						  commands);
 
-	sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
-			SCTP_CHUNK(chunk));
+	while (chunk->chunk_end > chunk->skb->data) {
+		ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
+						     GFP_ATOMIC);
+		if (!ev)
+			goto nomem;
 
+		sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
+				SCTP_ULPEVENT(ev));
+		sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
+				SCTP_CHUNK(chunk));
+	}
 	return SCTP_DISPOSITION_CONSUME;
+
+nomem:
+	return SCTP_DISPOSITION_NOMEM;
 }
 
 /*
diff --git a/trunk/net/wireless/reg.c b/trunk/net/wireless/reg.c
index bd0a16c3de5e..85c9034c59b2 100644
--- a/trunk/net/wireless/reg.c
+++ b/trunk/net/wireless/reg.c
@@ -380,8 +380,7 @@ static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
 
 	freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
 
-	if (freq_range->end_freq_khz <= freq_range->start_freq_khz ||
-			freq_range->max_bandwidth_khz > freq_diff)
+	if (freq_diff <= 0 || freq_range->max_bandwidth_khz > freq_diff)
 		return false;
 
 	return true;