From a1dd7ca7a7c82f37ac3c3276eb9288c3e0899c8c Mon Sep 17 00:00:00 2001
From: Vu Pham <vu@mellanox.com>
Date: Tue, 26 May 2009 14:51:00 -0400
Subject: [PATCH] --- yaml --- r: 145297 b: refs/heads/master c:
 68743082b560067e3e93eab8b2568f238e486865 h: refs/heads/master i:   145295:
 4883b31abb4582e4de00e39464e3f1fb7aa524b2 v: v3

---
 [refs]                                        |   2 +-
 .../sound/alsa/HD-Audio-Models.txt            |   1 -
 trunk/arch/powerpc/mm/mmu_context_nohash.c    |   6 +-
 .../arch/x86/kernel/cpu/cpufreq/p4-clockmod.c |   1 -
 .../arch/x86/kernel/cpu/cpufreq/powernow-k7.c |   2 -
 .../arch/x86/kernel/cpu/cpufreq/powernow-k8.c |  42 +++-----
 trunk/drivers/cpufreq/cpufreq.c               |   4 +-
 trunk/drivers/cpufreq/cpufreq_conservative.c  |   5 +-
 trunk/drivers/cpufreq/cpufreq_ondemand.c      |   5 +-
 trunk/drivers/isdn/gigaset/isocdata.c         |   2 +-
 trunk/drivers/lguest/x86/core.c               |  19 ++--
 trunk/drivers/md/bitmap.c                     |  13 ++-
 trunk/drivers/md/md.c                         |  31 ++----
 trunk/drivers/md/raid5.c                      |   6 +-
 trunk/drivers/net/Makefile                    |   2 +-
 trunk/drivers/net/gianfar.c                   |  11 +-
 trunk/drivers/net/mac8390.c                   |  10 +-
 trunk/drivers/net/r8169.c                     | 102 ++++++++----------
 trunk/drivers/net/wimax/i2400m/usb.c          |  35 +-----
 trunk/drivers/net/wireless/airo.c             |  23 ++--
 trunk/drivers/net/wireless/ath5k/phy.c        |  49 ++++-----
 trunk/drivers/net/wireless/ath5k/reset.c      |   8 +-
 trunk/drivers/net/wireless/iwlwifi/iwl-5000.c |   2 +-
 trunk/drivers/net/wireless/iwlwifi/iwl-agn.c  |   7 ++
 trunk/drivers/net/wireless/iwlwifi/iwl-scan.c |   7 +-
 .../net/wireless/iwlwifi/iwl3945-base.c       |   9 +-
 .../drivers/net/wireless/rt2x00/rt2x00debug.c |   2 +-
 trunk/kernel/kmod.c                           |   4 +-
 trunk/net/core/pktgen.c                       |   2 +-
 trunk/net/ipv4/fib_trie.c                     |   6 +-
 trunk/net/ipv4/route.c                        |  60 +++++++----
 trunk/net/ipv4/tcp_vegas.c                    |  11 +-
 trunk/net/ipv6/route.c                        |   3 -
 trunk/net/rxrpc/ar-connection.c               |  12 +--
 trunk/net/sunrpc/xprtrdma/verbs.c             |   3 +-
 trunk/net/wireless/reg.c                      |   7 --
 trunk/net/wireless/wext.c                     |   7 --
 trunk/sound/pci/hda/hda_intel.c               |   1 -
 trunk/sound/pci/hda/patch_realtek.c           |   6 --
 trunk/sound/pci/hda/patch_sigmatel.c          |  10 --
 40 files changed, 216 insertions(+), 322 deletions(-)

diff --git a/[refs] b/[refs]
index cd9c75b73d22..600e60594030 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 878a4f521bfe83c49694ac990058080fbe090812
+refs/heads/master: 68743082b560067e3e93eab8b2568f238e486865
diff --git a/trunk/Documentation/sound/alsa/HD-Audio-Models.txt b/trunk/Documentation/sound/alsa/HD-Audio-Models.txt
index 322869fc8a9e..8eec05bc079e 100644
--- a/trunk/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/trunk/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -334,7 +334,6 @@ STAC9227/9228/9229/927x
   ref-no-jd	Reference board without HP/Mic jack detection
   3stack	D965 3stack
   5stack	D965 5stack + SPDIF
-  5stack-no-fp	D965 5stack without front panel
   dell-3stack	Dell Dimension E520
   dell-bios	Fixes with Dell BIOS setup
   auto		BIOS setup (default)
diff --git a/trunk/arch/powerpc/mm/mmu_context_nohash.c b/trunk/arch/powerpc/mm/mmu_context_nohash.c
index 030d0005b4d2..a70e311bd457 100644
--- a/trunk/arch/powerpc/mm/mmu_context_nohash.c
+++ b/trunk/arch/powerpc/mm/mmu_context_nohash.c
@@ -127,12 +127,12 @@ static unsigned int steal_context_up(unsigned int id)
 
 	pr_debug("[%d] steal context %d from mm @%p\n", cpu, id, mm);
 
-	/* Flush the TLB for that context */
-	local_flush_tlb_mm(mm);
-
 	/* Mark this mm has having no context anymore */
 	mm->context.id = MMU_NO_CONTEXT;
 
+	/* Flush the TLB for that context */
+	local_flush_tlb_mm(mm);
+
 	/* XXX This clear should ultimately be part of local_flush_tlb_mm */
 	__clear_bit(id, stale_map[cpu]);
 
diff --git a/trunk/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c b/trunk/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
index 869615193720..6ac55bd341ae 100644
--- a/trunk/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/trunk/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
@@ -168,7 +168,6 @@ static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
 		case 0x0E: /* Core */
 		case 0x0F: /* Core Duo */
 		case 0x16: /* Celeron Core */
-		case 0x1C: /* Atom */
 			p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
 			return speedstep_get_frequency(SPEEDSTEP_CPU_PCORE);
 		case 0x0D: /* Pentium M (Dothan) */
diff --git a/trunk/arch/x86/kernel/cpu/cpufreq/powernow-k7.c b/trunk/arch/x86/kernel/cpu/cpufreq/powernow-k7.c
index a8363e5be4ef..3c28ccd49742 100644
--- a/trunk/arch/x86/kernel/cpu/cpufreq/powernow-k7.c
+++ b/trunk/arch/x86/kernel/cpu/cpufreq/powernow-k7.c
@@ -168,12 +168,10 @@ static int check_powernow(void)
 	return 1;
 }
 
-#ifdef CONFIG_X86_POWERNOW_K7_ACPI
 static void invalidate_entry(unsigned int entry)
 {
 	powernow_table[entry].frequency = CPUFREQ_ENTRY_INVALID;
 }
-#endif
 
 static int get_ranges(unsigned char *pst)
 {
diff --git a/trunk/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/trunk/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index f6b32d112357..4709ead2db52 100644
--- a/trunk/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/trunk/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -649,20 +649,6 @@ static void print_basics(struct powernow_k8_data *data)
 				data->batps);
 }
 
-static u32 freq_from_fid_did(u32 fid, u32 did)
-{
-	u32 mhz = 0;
-
-	if (boot_cpu_data.x86 == 0x10)
-		mhz = (100 * (fid + 0x10)) >> did;
-	else if (boot_cpu_data.x86 == 0x11)
-		mhz = (100 * (fid + 8)) >> did;
-	else
-		BUG();
-
-	return mhz * 1000;
-}
-
 static int fill_powernow_table(struct powernow_k8_data *data,
 		struct pst_s *pst, u8 maxvid)
 {
@@ -937,13 +923,8 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data,
 
 		powernow_table[i].index = index;
 
-		/* Frequency may be rounded for these */
-		if (boot_cpu_data.x86 == 0x10 || boot_cpu_data.x86 == 0x11) {
-			powernow_table[i].frequency =
-				freq_from_fid_did(lo & 0x3f, (lo >> 6) & 7);
-		} else
-			powernow_table[i].frequency =
-				data->acpi_data.states[i].core_frequency * 1000;
+		powernow_table[i].frequency =
+			data->acpi_data.states[i].core_frequency * 1000;
 	}
 	return 0;
 }
@@ -1234,16 +1215,13 @@ static int powernowk8_verify(struct cpufreq_policy *pol)
 	return cpufreq_frequency_table_verify(pol, data->powernow_table);
 }
 
-static const char ACPI_PSS_BIOS_BUG_MSG[] =
-	KERN_ERR FW_BUG PFX "No compatible ACPI _PSS objects found.\n"
-	KERN_ERR FW_BUG PFX "Try again with latest BIOS.\n";
-
 /* per CPU init entry point to the driver */
 static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
 {
 	struct powernow_k8_data *data;
 	cpumask_t oldmask;
 	int rc;
+	static int print_once;
 
 	if (!cpu_online(pol->cpu))
 		return -ENODEV;
@@ -1266,7 +1244,19 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
 		 * an UP version, and is deprecated by AMD.
 		 */
 		if (num_online_cpus() != 1) {
-			printk_once(ACPI_PSS_BIOS_BUG_MSG);
+			/*
+			 * Replace this one with print_once as soon as such a
+			 * thing gets introduced
+			 */
+			if (!print_once) {
+				WARN_ONCE(1, KERN_ERR FW_BUG PFX "Your BIOS "
+					"does not provide ACPI _PSS objects "
+					"in a way that Linux understands. "
+					"Please report this to the Linux ACPI"
+					" maintainers and complain to your "
+					"BIOS vendor.\n");
+				print_once++;
+			}
 			goto err_out;
 		}
 		if (pol->cpu != 0) {
diff --git a/trunk/drivers/cpufreq/cpufreq.c b/trunk/drivers/cpufreq/cpufreq.c
index 47d2ad0ae079..d270e8eb3e67 100644
--- a/trunk/drivers/cpufreq/cpufreq.c
+++ b/trunk/drivers/cpufreq/cpufreq.c
@@ -1070,11 +1070,11 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
 	spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
 #endif
 
-	unlock_policy_rwsem_write(cpu);
-
 	if (cpufreq_driver->target)
 		__cpufreq_governor(data, CPUFREQ_GOV_STOP);
 
+	unlock_policy_rwsem_write(cpu);
+
 	kobject_put(&data->kobj);
 
 	/* we need to make sure that the underlying kobj is actually
diff --git a/trunk/drivers/cpufreq/cpufreq_conservative.c b/trunk/drivers/cpufreq/cpufreq_conservative.c
index 7a74d175287b..2ecd95e4ab1a 100644
--- a/trunk/drivers/cpufreq/cpufreq_conservative.c
+++ b/trunk/drivers/cpufreq/cpufreq_conservative.c
@@ -91,9 +91,6 @@ static unsigned int dbs_enable;	/* number of CPUs using this policy */
  * (like __cpufreq_driver_target()) is being called with dbs_mutex taken, then
  * cpu_hotplug lock should be taken before that. Note that cpu_hotplug lock
  * is recursive for the same process. -Venki
- * DEADLOCK ALERT! (2) : do_dbs_timer() must not take the dbs_mutex, because it
- * would deadlock with cancel_delayed_work_sync(), which is needed for proper
- * raceless workqueue teardown.
  */
 static DEFINE_MUTEX(dbs_mutex);
 
@@ -545,7 +542,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
 	dbs_info->enable = 0;
-	cancel_delayed_work_sync(&dbs_info->work);
+	cancel_delayed_work(&dbs_info->work);
 }
 
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
diff --git a/trunk/drivers/cpufreq/cpufreq_ondemand.c b/trunk/drivers/cpufreq/cpufreq_ondemand.c
index e741c339df76..338f428a15b7 100644
--- a/trunk/drivers/cpufreq/cpufreq_ondemand.c
+++ b/trunk/drivers/cpufreq/cpufreq_ondemand.c
@@ -98,9 +98,6 @@ static unsigned int dbs_enable;	/* number of CPUs using this policy */
  * (like __cpufreq_driver_target()) is being called with dbs_mutex taken, then
  * cpu_hotplug lock should be taken before that. Note that cpu_hotplug lock
  * is recursive for the same process. -Venki
- * DEADLOCK ALERT! (2) : do_dbs_timer() must not take the dbs_mutex, because it
- * would deadlock with cancel_delayed_work_sync(), which is needed for proper
- * raceless workqueue teardown.
  */
 static DEFINE_MUTEX(dbs_mutex);
 
@@ -565,7 +562,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
 	dbs_info->enable = 0;
-	cancel_delayed_work_sync(&dbs_info->work);
+	cancel_delayed_work(&dbs_info->work);
 }
 
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
diff --git a/trunk/drivers/isdn/gigaset/isocdata.c b/trunk/drivers/isdn/gigaset/isocdata.c
index 29808c4fb1cb..b171e75cb52e 100644
--- a/trunk/drivers/isdn/gigaset/isocdata.c
+++ b/trunk/drivers/isdn/gigaset/isocdata.c
@@ -175,7 +175,7 @@ int gigaset_isowbuf_getbytes(struct isowbuf_t *iwb, int size)
 		return -EINVAL;
 	}
 	src = iwb->read;
-	if (unlikely(limit >= BAS_OUTBUFSIZE + BAS_OUTBUFPAD ||
+	if (unlikely(limit > BAS_OUTBUFSIZE + BAS_OUTBUFPAD ||
 		     (read < src && limit >= src))) {
 		pr_err("isoc write buffer frame reservation violated\n");
 		return -EFAULT;
diff --git a/trunk/drivers/lguest/x86/core.c b/trunk/drivers/lguest/x86/core.c
index eaf722fe309a..1a83910f674f 100644
--- a/trunk/drivers/lguest/x86/core.c
+++ b/trunk/drivers/lguest/x86/core.c
@@ -358,16 +358,6 @@ void lguest_arch_handle_trap(struct lg_cpu *cpu)
 			if (emulate_insn(cpu))
 				return;
 		}
-		/* If KVM is active, the vmcall instruction triggers a
-		 * General Protection Fault.  Normally it triggers an
-		 * invalid opcode fault (6): */
-	case 6:
-		/* We need to check if ring == GUEST_PL and
-		 * faulting instruction == vmcall. */
-		if (is_hypercall(cpu)) {
-			rewrite_hypercall(cpu);
-			return;
-		}
 		break;
 	case 14: /* We've intercepted a Page Fault. */
 		/* The Guest accessed a virtual address that wasn't mapped.
@@ -413,6 +403,15 @@ void lguest_arch_handle_trap(struct lg_cpu *cpu)
 		 * up the pointer now to indicate a hypercall is pending. */
 		cpu->hcall = (struct hcall_args *)cpu->regs;
 		return;
+	case 6:
+		/* kvm hypercalls trigger an invalid opcode fault (6).
+		 * We need to check if ring == GUEST_PL and
+		 * faulting instruction == vmcall. */
+		if (is_hypercall(cpu)) {
+			rewrite_hypercall(cpu);
+			return;
+		}
+		break;
 	}
 
 	/* We didn't handle the trap, so it needs to go to the Guest. */
diff --git a/trunk/drivers/md/bitmap.c b/trunk/drivers/md/bitmap.c
index 56df1cee8fb3..47c68bc75a17 100644
--- a/trunk/drivers/md/bitmap.c
+++ b/trunk/drivers/md/bitmap.c
@@ -1097,12 +1097,14 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 	}
 	bitmap->allclean = 1;
 
-	spin_lock_irqsave(&bitmap->lock, flags);
 	for (j = 0; j < bitmap->chunks; j++) {
 		bitmap_counter_t *bmc;
-		if (!bitmap->filemap)
+		spin_lock_irqsave(&bitmap->lock, flags);
+		if (!bitmap->filemap) {
 			/* error or shutdown */
+			spin_unlock_irqrestore(&bitmap->lock, flags);
 			break;
+		}
 
 		page = filemap_get_page(bitmap, j);
 
@@ -1119,8 +1121,6 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 					write_page(bitmap, page, 0);
 					bitmap->allclean = 0;
 				}
-				spin_lock_irqsave(&bitmap->lock, flags);
-				j |= (PAGE_BITS - 1);
 				continue;
 			}
 
@@ -1181,10 +1181,9 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 					ext2_clear_bit(file_page_offset(j), paddr);
 				kunmap_atomic(paddr, KM_USER0);
 			}
-		} else
-			j |= PAGE_COUNTER_MASK;
+		}
+		spin_unlock_irqrestore(&bitmap->lock, flags);
 	}
-	spin_unlock_irqrestore(&bitmap->lock, flags);
 
 	/* now sync the final page */
 	if (lastpage != NULL) {
diff --git a/trunk/drivers/md/md.c b/trunk/drivers/md/md.c
index 641b211fe3fe..fccc8343a250 100644
--- a/trunk/drivers/md/md.c
+++ b/trunk/drivers/md/md.c
@@ -1375,9 +1375,6 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
 
 	sb->raid_disks = cpu_to_le32(mddev->raid_disks);
 	sb->size = cpu_to_le64(mddev->dev_sectors);
-	sb->chunksize = cpu_to_le32(mddev->chunk_size >> 9);
-	sb->level = cpu_to_le32(mddev->level);
-	sb->layout = cpu_to_le32(mddev->layout);
 
 	if (mddev->bitmap && mddev->bitmap_file == NULL) {
 		sb->bitmap_offset = cpu_to_le32((__u32)mddev->bitmap_offset);
@@ -3306,9 +3303,7 @@ static ssize_t
 action_show(mddev_t *mddev, char *page)
 {
 	char *type = "idle";
-	if (test_bit(MD_RECOVERY_FROZEN, &mddev->recovery))
-		type = "frozen";
-	else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
+	if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
 	    (!mddev->ro && test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))) {
 		if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery))
 			type = "reshape";
@@ -3331,12 +3326,7 @@ action_store(mddev_t *mddev, const char *page, size_t len)
 	if (!mddev->pers || !mddev->pers->sync_request)
 		return -EINVAL;
 
-	if (cmd_match(page, "frozen"))
-		set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
-	else
-		clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
-
-	if (cmd_match(page, "idle") || cmd_match(page, "frozen")) {
+	if (cmd_match(page, "idle")) {
 		if (mddev->sync_thread) {
 			set_bit(MD_RECOVERY_INTR, &mddev->recovery);
 			md_unregister_thread(mddev->sync_thread);
@@ -3690,7 +3680,7 @@ array_size_store(mddev_t *mddev, const char *buf, size_t len)
 		if (strict_blocks_to_sectors(buf, &sectors) < 0)
 			return -EINVAL;
 		if (mddev->pers && mddev->pers->size(mddev, 0, 0) < sectors)
-			return -E2BIG;
+			return -EINVAL;
 
 		mddev->external_size = 1;
 	}
@@ -5567,7 +5557,7 @@ static struct block_device_operations md_fops =
 	.owner		= THIS_MODULE,
 	.open		= md_open,
 	.release	= md_release,
-	.ioctl		= md_ioctl,
+	.locked_ioctl	= md_ioctl,
 	.getgeo		= md_getgeo,
 	.media_changed	= md_media_changed,
 	.revalidate_disk= md_revalidate,
@@ -6362,13 +6352,12 @@ void md_do_sync(mddev_t *mddev)
 
 		skipped = 0;
 
-		if (!test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
-		    ((mddev->curr_resync > mddev->curr_resync_completed &&
-		      (mddev->curr_resync - mddev->curr_resync_completed)
-		      > (max_sectors >> 4)) ||
-		     (j - mddev->curr_resync_completed)*2
-		     >= mddev->resync_max - mddev->curr_resync_completed
-			    )) {
+		if ((mddev->curr_resync > mddev->curr_resync_completed &&
+		     (mddev->curr_resync - mddev->curr_resync_completed)
+		    > (max_sectors >> 4)) ||
+		    (j - mddev->curr_resync_completed)*2
+		    >= mddev->resync_max - mddev->curr_resync_completed
+			) {
 			/* time to update curr_resync_completed */
 			blk_unplug(mddev->queue);
 			wait_event(mddev->recovery_wait,
diff --git a/trunk/drivers/md/raid5.c b/trunk/drivers/md/raid5.c
index 3c3626d2a1f9..4616bc3a6e71 100644
--- a/trunk/drivers/md/raid5.c
+++ b/trunk/drivers/md/raid5.c
@@ -3811,13 +3811,13 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
 	safepos = conf->reshape_safe;
 	sector_div(safepos, data_disks);
 	if (mddev->delta_disks < 0) {
-		writepos -= min(reshape_sectors, writepos);
+		writepos -= reshape_sectors;
 		readpos += reshape_sectors;
 		safepos += reshape_sectors;
 	} else {
 		writepos += reshape_sectors;
-		readpos -= min(reshape_sectors, readpos);
-		safepos -= min(reshape_sectors, safepos);
+		readpos -= reshape_sectors;
+		safepos -= reshape_sectors;
 	}
 
 	/* 'writepos' is the most advanced device address we might write.
diff --git a/trunk/drivers/net/Makefile b/trunk/drivers/net/Makefile
index a1c25cb4669f..1fc4602a6ff2 100644
--- a/trunk/drivers/net/Makefile
+++ b/trunk/drivers/net/Makefile
@@ -102,7 +102,7 @@ obj-$(CONFIG_HAMACHI) += hamachi.o
 obj-$(CONFIG_NET) += Space.o loopback.o
 obj-$(CONFIG_SEEQ8005) += seeq8005.o
 obj-$(CONFIG_NET_SB1000) += sb1000.o
-obj-$(CONFIG_MAC8390) += mac8390.o
+obj-$(CONFIG_MAC8390) += mac8390.o 8390.o
 obj-$(CONFIG_APNE) += apne.o 8390.o
 obj-$(CONFIG_PCMCIA_PCNET) += 8390.o
 obj-$(CONFIG_HP100) += hp100.o
diff --git a/trunk/drivers/net/gianfar.c b/trunk/drivers/net/gianfar.c
index a0519184e54e..b2c49679bba7 100644
--- a/trunk/drivers/net/gianfar.c
+++ b/trunk/drivers/net/gianfar.c
@@ -1885,17 +1885,8 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
 
 			if (unlikely(!newskb))
 				newskb = skb;
-			else if (skb) {
-				/*
-				 * We need to reset ->data to what it
-				 * was before gfar_new_skb() re-aligned
-				 * it to an RXBUF_ALIGNMENT boundary
-				 * before we put the skb back on the
-				 * recycle list.
-				 */
-				skb->data = skb->head + NET_SKB_PAD;
+			else if (skb)
 				__skb_queue_head(&priv->rx_recycle, skb);
-			}
 		} else {
 			/* Increment the number of packets */
 			dev->stats.rx_packets++;
diff --git a/trunk/drivers/net/mac8390.c b/trunk/drivers/net/mac8390.c
index f26667d5eaae..8e884869a05b 100644
--- a/trunk/drivers/net/mac8390.c
+++ b/trunk/drivers/net/mac8390.c
@@ -304,7 +304,7 @@ struct net_device * __init mac8390_probe(int unit)
 	if (!MACH_IS_MAC)
 		return ERR_PTR(-ENODEV);
 
-	dev = ____alloc_ei_netdev(0);
+	dev = alloc_ei_netdev();
 	if (!dev)
 		return ERR_PTR(-ENOMEM);
 
@@ -481,10 +481,10 @@ void cleanup_module(void)
 static const struct net_device_ops mac8390_netdev_ops = {
 	.ndo_open 		= mac8390_open,
 	.ndo_stop		= mac8390_close,
-	.ndo_start_xmit		= __ei_start_xmit,
-	.ndo_tx_timeout		= __ei_tx_timeout,
-	.ndo_get_stats		= __ei_get_stats,
-	.ndo_set_multicast_list = __ei_set_multicast_list,
+	.ndo_start_xmit		= ei_start_xmit,
+	.ndo_tx_timeout		= ei_tx_timeout,
+	.ndo_get_stats		= ei_get_stats,
+	.ndo_set_multicast_list = ei_set_multicast_list,
 	.ndo_validate_addr	= eth_validate_addr,
 	.ndo_set_mac_address 	= eth_mac_addr,
 	.ndo_change_mtu		= eth_change_mtu,
diff --git a/trunk/drivers/net/r8169.c b/trunk/drivers/net/r8169.c
index 8247a945a1d9..0b6e8c896835 100644
--- a/trunk/drivers/net/r8169.c
+++ b/trunk/drivers/net/r8169.c
@@ -3554,64 +3554,54 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
 	int handled = 0;
 	int status;
 
-	/* loop handling interrupts until we have no new ones or
-	 * we hit a invalid/hotplug case.
-	 */
 	status = RTL_R16(IntrStatus);
-	while (status && status != 0xffff) {
-		handled = 1;
 
-		/* Handle all of the error cases first. These will reset
-		 * the chip, so just exit the loop.
-		 */
-		if (unlikely(!netif_running(dev))) {
-			rtl8169_asic_down(ioaddr);
-			break;
-		}
+	/* hotplug/major error/no more work/shared irq */
+	if ((status == 0xffff) || !status)
+		goto out;
 
-		/* Work around for rx fifo overflow */
-		if (unlikely(status & RxFIFOOver) &&
-		(tp->mac_version == RTL_GIGA_MAC_VER_11)) {
-			netif_stop_queue(dev);
-			rtl8169_tx_timeout(dev);
-			break;
-		}
+	handled = 1;
 
-		if (unlikely(status & SYSErr)) {
-			rtl8169_pcierr_interrupt(dev);
-			break;
-		}
+	if (unlikely(!netif_running(dev))) {
+		rtl8169_asic_down(ioaddr);
+		goto out;
+	}
 
-		if (status & LinkChg)
-			rtl8169_check_link_status(dev, tp, ioaddr);
+	status &= tp->intr_mask;
+	RTL_W16(IntrStatus,
+		(status & RxFIFOOver) ? (status | RxOverflow) : status);
 
-		/* We need to see the lastest version of tp->intr_mask to
-		 * avoid ignoring an MSI interrupt and having to wait for
-		 * another event which may never come.
-		 */
-		smp_rmb();
-		if (status & tp->intr_mask & tp->napi_event) {
-			RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
-			tp->intr_mask = ~tp->napi_event;
-
-			if (likely(napi_schedule_prep(&tp->napi)))
-				__napi_schedule(&tp->napi);
-			else if (netif_msg_intr(tp)) {
-				printk(KERN_INFO "%s: interrupt %04x in poll\n",
-				dev->name, status);
-			}
-		}
+	if (!(status & tp->intr_event))
+		goto out;
 
-		/* We only get a new MSI interrupt when all active irq
-		 * sources on the chip have been acknowledged. So, ack
-		 * everything we've seen and check if new sources have become
-		 * active to avoid blocking all interrupts from the chip.
-		 */
-		RTL_W16(IntrStatus,
-			(status & RxFIFOOver) ? (status | RxOverflow) : status);
-		status = RTL_R16(IntrStatus);
+	/* Work around for rx fifo overflow */
+	if (unlikely(status & RxFIFOOver) &&
+	    (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+		netif_stop_queue(dev);
+		rtl8169_tx_timeout(dev);
+		goto out;
+	}
+
+	if (unlikely(status & SYSErr)) {
+		rtl8169_pcierr_interrupt(dev);
+		goto out;
 	}
 
+	if (status & LinkChg)
+		rtl8169_check_link_status(dev, tp, ioaddr);
+
+	if (status & tp->napi_event) {
+		RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
+		tp->intr_mask = ~tp->napi_event;
+
+		if (likely(napi_schedule_prep(&tp->napi)))
+			__napi_schedule(&tp->napi);
+		else if (netif_msg_intr(tp)) {
+			printk(KERN_INFO "%s: interrupt %04x in poll\n",
+			       dev->name, status);
+		}
+	}
+out:
 	return IRQ_RETVAL(handled);
 }
 
@@ -3627,15 +3617,13 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
 
 	if (work_done < budget) {
 		napi_complete(napi);
-
-		/* We need for force the visibility of tp->intr_mask
-		 * for other CPUs, as we can loose an MSI interrupt
-		 * and potentially wait for a retransmit timeout if we don't.
-		 * The posted write to IntrMask is safe, as it will
-		 * eventually make it to the chip and we won't loose anything
-		 * until it does.
-		 */
 		tp->intr_mask = 0xffff;
+		/*
+		 * 20040426: the barrier is not strictly required but the
+		 * behavior of the irq handler could be less predictable
+		 * without it. Btw, the lack of flush for the posted pci
+		 * write is safe - FR
+		 */
 		smp_wmb();
 		RTL_W16(IntrMask, tp->intr_event);
 	}
diff --git a/trunk/drivers/net/wimax/i2400m/usb.c b/trunk/drivers/net/wimax/i2400m/usb.c
index 17851321b7fd..ca4151a9e222 100644
--- a/trunk/drivers/net/wimax/i2400m/usb.c
+++ b/trunk/drivers/net/wimax/i2400m/usb.c
@@ -505,52 +505,27 @@ int i2400mu_suspend(struct usb_interface *iface, pm_message_t pm_msg)
 #ifdef CONFIG_PM
 	struct usb_device *usb_dev = i2400mu->usb_dev;
 #endif
-	unsigned is_autosuspend = 0;
 	struct i2400m *i2400m = &i2400mu->i2400m;
 
-#ifdef CONFIG_PM
-	if (usb_dev->auto_pm > 0)
-		is_autosuspend = 1;
-#endif
-
 	d_fnstart(3, dev, "(iface %p pm_msg %u)\n", iface, pm_msg.event);
 	if (i2400m->updown == 0)
 		goto no_firmware;
-	if (i2400m->state == I2400M_SS_DATA_PATH_CONNECTED && is_autosuspend) {
-		/* ugh -- the device is connected and this suspend
-		 * request is an autosuspend one (not a system standby
-		 * / hibernate).
-		 *
-		 * The only way the device can go to standby is if the
-		 * link with the base station is in IDLE mode; that
-		 * were the case, we'd be in status
-		 * I2400M_SS_CONNECTED_IDLE. But we are not.
-		 *
-		 * If we *tell* him to go power save now, it'll reset
-		 * as a precautionary measure, so if this is an
-		 * autosuspend thing, say no and it'll come back
-		 * later, when the link is IDLE
-		 */
-		result = -EBADF;
-		d_printf(1, dev, "fw up, link up, not-idle, autosuspend: "
-			 "not entering powersave\n");
-		goto error_not_now;
-	}
-	d_printf(1, dev, "fw up: entering powersave\n");
+	d_printf(1, dev, "fw up, requesting standby\n");
 	atomic_dec(&i2400mu->do_autopm);
 	result = i2400m_cmd_enter_powersave(i2400m);
 	atomic_inc(&i2400mu->do_autopm);
-	if (result < 0 && !is_autosuspend) {
+#ifdef CONFIG_PM
+	if (result < 0 && usb_dev->auto_pm == 0) {
 		/* System suspend, can't fail */
 		dev_err(dev, "failed to suspend, will reset on resume\n");
 		result = 0;
 	}
+#endif
 	if (result < 0)
 		goto error_enter_powersave;
 	i2400mu_notification_release(i2400mu);
-	d_printf(1, dev, "powersave requested\n");
+	d_printf(1, dev, "fw up, got standby\n");
 error_enter_powersave:
-error_not_now:
 no_firmware:
 	d_fnend(3, dev, "(iface %p pm_msg %u) = %d\n",
 		iface, pm_msg.event, result);
diff --git a/trunk/drivers/net/wireless/airo.c b/trunk/drivers/net/wireless/airo.c
index 9eabf4d1f2e7..d73475739127 100644
--- a/trunk/drivers/net/wireless/airo.c
+++ b/trunk/drivers/net/wireless/airo.c
@@ -6467,7 +6467,6 @@ static int airo_get_encode(struct net_device *dev,
 {
 	struct airo_info *local = dev->ml_priv;
 	int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
-	int wep_key_len;
 	u8 buf[16];
 
 	if (!local->wep_capable)
@@ -6501,13 +6500,11 @@ static int airo_get_encode(struct net_device *dev,
 	dwrq->flags |= index + 1;
 
 	/* Copy the key to the user buffer */
-	wep_key_len = get_wep_key(local, index, &buf[0], sizeof(buf));
-	if (wep_key_len < 0) {
-		dwrq->length = 0;
-	} else {
-		dwrq->length = wep_key_len;
+	dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf));
+	if (dwrq->length != -1)
 		memcpy(extra, buf, dwrq->length);
-	}
+	else
+		dwrq->length = 0;
 
 	return 0;
 }
@@ -6620,7 +6617,7 @@ static int airo_get_encodeext(struct net_device *dev,
 	struct airo_info *local = dev->ml_priv;
 	struct iw_point *encoding = &wrqu->encoding;
 	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-	int idx, max_key_len, wep_key_len;
+	int idx, max_key_len;
 	u8 buf[16];
 
 	if (!local->wep_capable)
@@ -6664,13 +6661,11 @@ static int airo_get_encodeext(struct net_device *dev,
 	memset(extra, 0, 16);
 	
 	/* Copy the key to the user buffer */
-	wep_key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
-	if (wep_key_len < 0) {
-		ext->key_len = 0;
-	} else {
-		ext->key_len = wep_key_len;
+	ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
+	if (ext->key_len != -1)
 		memcpy(extra, buf, ext->key_len);
-	}
+	else
+		ext->key_len = 0;
 
 	return 0;
 }
diff --git a/trunk/drivers/net/wireless/ath5k/phy.c b/trunk/drivers/net/wireless/ath5k/phy.c
index b48b29dca3d2..9e2faae5ae94 100644
--- a/trunk/drivers/net/wireless/ath5k/phy.c
+++ b/trunk/drivers/net/wireless/ath5k/phy.c
@@ -1487,35 +1487,28 @@ ath5k_get_linear_pcdac_min(const u8 *stepL, const u8 *stepR,
 {
 	s8 tmp;
 	s16 min_pwrL, min_pwrR;
-	s16 pwr_i;
-
-	if (pwrL[0] == pwrL[1])
-		min_pwrL = pwrL[0];
-	else {
-		pwr_i = pwrL[0];
-		do {
-			pwr_i--;
-			tmp = (s8) ath5k_get_interpolated_value(pwr_i,
-							pwrL[0], pwrL[1],
-							stepL[0], stepL[1]);
-		} while (tmp > 1);
-
-		min_pwrL = pwr_i;
-	}
+	s16 pwr_i = pwrL[0];
 
-	if (pwrR[0] == pwrR[1])
-		min_pwrR = pwrR[0];
-	else {
-		pwr_i = pwrR[0];
-		do {
-			pwr_i--;
-			tmp = (s8) ath5k_get_interpolated_value(pwr_i,
-							pwrR[0], pwrR[1],
-							stepR[0], stepR[1]);
-		} while (tmp > 1);
-
-		min_pwrR = pwr_i;
-	}
+	do {
+		pwr_i--;
+		tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+						pwrL[0], pwrL[1],
+						stepL[0], stepL[1]);
+
+	} while (tmp > 1);
+
+	min_pwrL = pwr_i;
+
+	pwr_i = pwrR[0];
+	do {
+		pwr_i--;
+		tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+						pwrR[0], pwrR[1],
+						stepR[0], stepR[1]);
+
+	} while (tmp > 1);
+
+	min_pwrR = pwr_i;
 
 	/* Keep the right boundary so that it works for both curves */
 	return max(min_pwrL, min_pwrR);
diff --git a/trunk/drivers/net/wireless/ath5k/reset.c b/trunk/drivers/net/wireless/ath5k/reset.c
index 5f72c111c2e8..7a17d31b2fd9 100644
--- a/trunk/drivers/net/wireless/ath5k/reset.c
+++ b/trunk/drivers/net/wireless/ath5k/reset.c
@@ -26,7 +26,7 @@
 \*****************************/
 
 #include <linux/pci.h> 		/* To determine if a card is pci-e */
-#include <linux/log2.h>
+#include <linux/bitops.h>	/* For get_bitmask_order */
 #include "ath5k.h"
 #include "reg.h"
 #include "base.h"
@@ -69,10 +69,10 @@ static inline int ath5k_hw_write_ofdm_timings(struct ath5k_hw *ah,
 
 	/* Get exponent
 	 * ALGO: coef_exp = 14 - highest set bit position */
-	coef_exp = ilog2(coef_scaled);
+	coef_exp = get_bitmask_order(coef_scaled);
 
 	/* Doesn't make sense if it's zero*/
-	if (!coef_scaled || !coef_exp)
+	if (!coef_exp)
 		return -EINVAL;
 
 	/* Note: we've shifted coef_scaled by 24 */
@@ -359,7 +359,7 @@ int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
 			mode |= AR5K_PHY_MODE_FREQ_5GHZ;
 
 			if (ah->ah_radio == AR5K_RF5413)
-				clock = AR5K_PHY_PLL_40MHZ_5413;
+				clock |= AR5K_PHY_PLL_40MHZ_5413;
 			else
 				clock |= AR5K_PHY_PLL_40MHZ;
 
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-5000.c b/trunk/drivers/net/wireless/iwlwifi/iwl-5000.c
index 9452461ce864..e5ca2511a81a 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -46,7 +46,7 @@
 #include "iwl-6000-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 2
+#define IWL5000_UCODE_API_MAX 1
 #define IWL5150_UCODE_API_MAX 2
 
 /* Lowest firmware API version supported */
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c b/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c
index f46ba2475776..3bb28db4a40f 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -669,6 +669,13 @@ static int iwl_set_mode(struct iwl_priv *priv, int mode)
 	if (!iwl_is_ready_rf(priv))
 		return -EAGAIN;
 
+	cancel_delayed_work(&priv->scan_check);
+	if (iwl_scan_cancel_timeout(priv, 100)) {
+		IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
+		IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
+		return -EAGAIN;
+	}
+
 	iwl_commit_rxon(priv);
 
 	return 0;
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-scan.c b/trunk/drivers/net/wireless/iwlwifi/iwl-scan.c
index 6330b91e37ce..e7c65c4f741b 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -227,6 +227,9 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
 	/* The HW is no longer scanning */
 	clear_bit(STATUS_SCAN_HW, &priv->status);
 
+	/* The scan completion notification came in, so kill that timer... */
+	cancel_delayed_work(&priv->scan_check);
+
 	IWL_DEBUG_INFO(priv, "Scan pass on %sGHz took %dms\n",
 		       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
 						"2.4" : "5.2",
@@ -709,8 +712,6 @@ static void iwl_bg_request_scan(struct work_struct *data)
 
 	mutex_lock(&priv->mutex);
 
-	cancel_delayed_work(&priv->scan_check);
-
 	if (!iwl_is_ready(priv)) {
 		IWL_WARN(priv, "request scan called when driver not ready.\n");
 		goto done;
@@ -924,8 +925,6 @@ void iwl_bg_scan_completed(struct work_struct *work)
 
 	IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
 
-	cancel_delayed_work(&priv->scan_check);
-
 	ieee80211_scan_completed(priv->hw, false);
 
 	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c b/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
index ff4d0e41d7c4..4cce66133500 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -782,6 +782,13 @@ static int iwl3945_set_mode(struct iwl_priv *priv, int mode)
 	if (!iwl_is_ready_rf(priv))
 		return -EAGAIN;
 
+	cancel_delayed_work(&priv->scan_check);
+	if (iwl_scan_cancel_timeout(priv, 100)) {
+		IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
+		IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
+		return -EAGAIN;
+	}
+
 	iwl3945_commit_rxon(priv);
 
 	return 0;
@@ -3291,8 +3298,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
 	mutex_lock(&priv->mutex);
 
-	cancel_delayed_work(&priv->scan_check);
-
 	if (!iwl_is_ready(priv)) {
 		IWL_WARN(priv, "request scan called when driver not ready.\n");
 		goto done;
diff --git a/trunk/drivers/net/wireless/rt2x00/rt2x00debug.c b/trunk/drivers/net/wireless/rt2x00/rt2x00debug.c
index 7b3ee8c2eaef..07d378ef0b46 100644
--- a/trunk/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/trunk/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -138,7 +138,7 @@ void rt2x00debug_update_crypto(struct rt2x00_dev *rt2x00dev,
 
 	if (cipher == CIPHER_TKIP_NO_MIC)
 		cipher = CIPHER_TKIP;
-	if (cipher == CIPHER_NONE || cipher >= CIPHER_MAX)
+	if (cipher == CIPHER_NONE || cipher > CIPHER_MAX)
 		return;
 
 	/* Remove CIPHER_NONE index */
diff --git a/trunk/kernel/kmod.c b/trunk/kernel/kmod.c
index 7e95bedb2bfc..b750675251e5 100644
--- a/trunk/kernel/kmod.c
+++ b/trunk/kernel/kmod.c
@@ -370,10 +370,8 @@ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv,
 	sub_info->argv = argv;
 	sub_info->envp = envp;
 	sub_info->cred = prepare_usermodehelper_creds();
-	if (!sub_info->cred) {
-		kfree(sub_info);
+	if (!sub_info->cred)
 		return NULL;
-	}
 
   out:
 	return sub_info;
diff --git a/trunk/net/core/pktgen.c b/trunk/net/core/pktgen.c
index 0666a827bc62..3779c1438c11 100644
--- a/trunk/net/core/pktgen.c
+++ b/trunk/net/core/pktgen.c
@@ -2447,7 +2447,7 @@ static inline void free_SAs(struct pktgen_dev *pkt_dev)
 	if (pkt_dev->cflows) {
 		/* let go of the SAs if we have them */
 		int i = 0;
-		for (;  i < pkt_dev->cflows; i++) {
+		for (;  i < pkt_dev->nflows; i++){
 			struct xfrm_state *x = pkt_dev->flows[i].x;
 			if (x) {
 				xfrm_state_put(x);
diff --git a/trunk/net/ipv4/fib_trie.c b/trunk/net/ipv4/fib_trie.c
index 33c7c85dfe40..ec0ae490f0b6 100644
--- a/trunk/net/ipv4/fib_trie.c
+++ b/trunk/net/ipv4/fib_trie.c
@@ -986,12 +986,9 @@ fib_find_node(struct trie *t, u32 key)
 static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
 {
 	int wasfull;
-	t_key cindex, key;
+	t_key cindex, key = tn->key;
 	struct tnode *tp;
 
-	preempt_disable();
-	key = tn->key;
-
 	while (tn != NULL && (tp = node_parent((struct node *)tn)) != NULL) {
 		cindex = tkey_extract_bits(key, tp->pos, tp->bits);
 		wasfull = tnode_full(tp, tnode_get_child(tp, cindex));
@@ -1010,7 +1007,6 @@ static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
 	if (IS_TNODE(tn))
 		tn = (struct tnode *)resize(t, (struct tnode *)tn);
 
-	preempt_enable();
 	return (struct node *)tn;
 }
 
diff --git a/trunk/net/ipv4/route.c b/trunk/net/ipv4/route.c
index 28205e5bfa9b..c4c60e9f068a 100644
--- a/trunk/net/ipv4/route.c
+++ b/trunk/net/ipv4/route.c
@@ -784,8 +784,8 @@ static void rt_check_expire(void)
 {
 	static unsigned int rover;
 	unsigned int i = rover, goal;
-	struct rtable *rth, *aux, **rthp;
-	unsigned long samples = 0;
+	struct rtable *rth, **rthp;
+	unsigned long length = 0, samples = 0;
 	unsigned long sum = 0, sum2 = 0;
 	u64 mult;
 
@@ -795,9 +795,9 @@ static void rt_check_expire(void)
 	goal = (unsigned int)mult;
 	if (goal > rt_hash_mask)
 		goal = rt_hash_mask + 1;
+	length = 0;
 	for (; goal > 0; goal--) {
 		unsigned long tmo = ip_rt_gc_timeout;
-		unsigned long length;
 
 		i = (i + 1) & rt_hash_mask;
 		rthp = &rt_hash_table[i].chain;
@@ -809,10 +809,8 @@ static void rt_check_expire(void)
 
 		if (*rthp == NULL)
 			continue;
-		length = 0;
 		spin_lock_bh(rt_hash_lock_addr(i));
 		while ((rth = *rthp) != NULL) {
-			prefetch(rth->u.dst.rt_next);
 			if (rt_is_expired(rth)) {
 				*rthp = rth->u.dst.rt_next;
 				rt_free(rth);
@@ -821,30 +819,33 @@ static void rt_check_expire(void)
 			if (rth->u.dst.expires) {
 				/* Entry is expired even if it is in use */
 				if (time_before_eq(jiffies, rth->u.dst.expires)) {
-nofree:
 					tmo >>= 1;
 					rthp = &rth->u.dst.rt_next;
 					/*
-					 * We only count entries on
+					 * Only bump our length if the hash
+					 * inputs on entries n and n+1 are not
+					 * the same, we only count entries on
 					 * a chain with equal hash inputs once
 					 * so that entries for different QOS
 					 * levels, and other non-hash input
 					 * attributes don't unfairly skew
 					 * the length computation
 					 */
-					for (aux = rt_hash_table[i].chain;;) {
-						if (aux == rth) {
-							length += ONE;
-							break;
-						}
-						if (compare_hash_inputs(&aux->fl, &rth->fl))
-							break;
-						aux = aux->u.dst.rt_next;
-					}
+					if ((*rthp == NULL) ||
+					    !compare_hash_inputs(&(*rthp)->fl,
+								 &rth->fl))
+						length += ONE;
 					continue;
 				}
-			} else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout))
-				goto nofree;
+			} else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout)) {
+				tmo >>= 1;
+				rthp = &rth->u.dst.rt_next;
+				if ((*rthp == NULL) ||
+				    !compare_hash_inputs(&(*rthp)->fl,
+							 &rth->fl))
+					length += ONE;
+				continue;
+			}
 
 			/* Cleanup aged off entries. */
 			*rthp = rth->u.dst.rt_next;
@@ -1067,6 +1068,7 @@ out:	return 0;
 static int rt_intern_hash(unsigned hash, struct rtable *rt, struct rtable **rp)
 {
 	struct rtable	*rth, **rthp;
+	struct rtable	*rthi;
 	unsigned long	now;
 	struct rtable *cand, **candp;
 	u32 		min_score;
@@ -1086,6 +1088,7 @@ static int rt_intern_hash(unsigned hash, struct rtable *rt, struct rtable **rp)
 	}
 
 	rthp = &rt_hash_table[hash].chain;
+	rthi = NULL;
 
 	spin_lock_bh(rt_hash_lock_addr(hash));
 	while ((rth = *rthp) != NULL) {
@@ -1131,6 +1134,17 @@ static int rt_intern_hash(unsigned hash, struct rtable *rt, struct rtable **rp)
 		chain_length++;
 
 		rthp = &rth->u.dst.rt_next;
+
+		/*
+		 * check to see if the next entry in the chain
+		 * contains the same hash input values as rt.  If it does
+		 * This is where we will insert into the list, instead of
+		 * at the head.  This groups entries that differ by aspects not
+		 * relvant to the hash function together, which we use to adjust
+		 * our chain length
+		 */
+		if (*rthp && compare_hash_inputs(&(*rthp)->fl, &rt->fl))
+			rthi = rth;
 	}
 
 	if (cand) {
@@ -1191,7 +1205,10 @@ static int rt_intern_hash(unsigned hash, struct rtable *rt, struct rtable **rp)
 		}
 	}
 
-	rt->u.dst.rt_next = rt_hash_table[hash].chain;
+	if (rthi)
+		rt->u.dst.rt_next = rthi->u.dst.rt_next;
+	else
+		rt->u.dst.rt_next = rt_hash_table[hash].chain;
 
 #if RT_CACHE_DEBUG >= 2
 	if (rt->u.dst.rt_next) {
@@ -1207,7 +1224,10 @@ static int rt_intern_hash(unsigned hash, struct rtable *rt, struct rtable **rp)
 	 * previous writes to rt are comitted to memory
 	 * before making rt visible to other CPUS.
 	 */
-	rcu_assign_pointer(rt_hash_table[hash].chain, rt);
+	if (rthi)
+		rcu_assign_pointer(rthi->u.dst.rt_next, rt);
+	else
+		rcu_assign_pointer(rt_hash_table[hash].chain, rt);
 
 	spin_unlock_bh(rt_hash_lock_addr(hash));
 	*rp = rt;
diff --git a/trunk/net/ipv4/tcp_vegas.c b/trunk/net/ipv4/tcp_vegas.c
index c6743eec9b7d..a453aac91bd3 100644
--- a/trunk/net/ipv4/tcp_vegas.c
+++ b/trunk/net/ipv4/tcp_vegas.c
@@ -158,11 +158,6 @@ void tcp_vegas_cwnd_event(struct sock *sk, enum tcp_ca_event event)
 }
 EXPORT_SYMBOL_GPL(tcp_vegas_cwnd_event);
 
-static inline u32 tcp_vegas_ssthresh(struct tcp_sock *tp)
-{
-	return  min(tp->snd_ssthresh, tp->snd_cwnd-1);
-}
-
 static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 {
 	struct tcp_sock *tp = tcp_sk(sk);
@@ -226,10 +221,11 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 			 */
 			diff = tp->snd_cwnd * (rtt-vegas->baseRTT) / vegas->baseRTT;
 
-			if (diff > gamma && tp->snd_cwnd <= tp->snd_ssthresh) {
+			if (diff > gamma && tp->snd_ssthresh > 2 ) {
 				/* Going too fast. Time to slow down
 				 * and switch to congestion avoidance.
 				 */
+				tp->snd_ssthresh = 2;
 
 				/* Set cwnd to match the actual rate
 				 * exactly:
@@ -239,7 +235,6 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 				 * utilization.
 				 */
 				tp->snd_cwnd = min(tp->snd_cwnd, (u32)target_cwnd+1);
-				tp->snd_ssthresh = tcp_vegas_ssthresh(tp);
 
 			} else if (tp->snd_cwnd <= tp->snd_ssthresh) {
 				/* Slow start.  */
@@ -255,8 +250,6 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 					 * we slow down.
 					 */
 					tp->snd_cwnd--;
-					tp->snd_ssthresh
-						= tcp_vegas_ssthresh(tp);
 				} else if (diff < alpha) {
 					/* We don't have enough extra packets
 					 * in the network, so speed up.
diff --git a/trunk/net/ipv6/route.c b/trunk/net/ipv6/route.c
index 032a5ec391c5..1394ddb6e35c 100644
--- a/trunk/net/ipv6/route.c
+++ b/trunk/net/ipv6/route.c
@@ -137,7 +137,6 @@ static struct rt6_info ip6_null_entry_template = {
 		}
 	},
 	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
-	.rt6i_protocol  = RTPROT_KERNEL,
 	.rt6i_metric	= ~(u32) 0,
 	.rt6i_ref	= ATOMIC_INIT(1),
 };
@@ -160,7 +159,6 @@ static struct rt6_info ip6_prohibit_entry_template = {
 		}
 	},
 	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
-	.rt6i_protocol  = RTPROT_KERNEL,
 	.rt6i_metric	= ~(u32) 0,
 	.rt6i_ref	= ATOMIC_INIT(1),
 };
@@ -178,7 +176,6 @@ static struct rt6_info ip6_blk_hole_entry_template = {
 		}
 	},
 	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
-	.rt6i_protocol  = RTPROT_KERNEL,
 	.rt6i_metric	= ~(u32) 0,
 	.rt6i_ref	= ATOMIC_INIT(1),
 };
diff --git a/trunk/net/rxrpc/ar-connection.c b/trunk/net/rxrpc/ar-connection.c
index 67e38a056240..0f1218b8d289 100644
--- a/trunk/net/rxrpc/ar-connection.c
+++ b/trunk/net/rxrpc/ar-connection.c
@@ -343,9 +343,9 @@ static int rxrpc_connect_exclusive(struct rxrpc_sock *rx,
 		/* not yet present - create a candidate for a new connection
 		 * and then redo the check */
 		conn = rxrpc_alloc_connection(gfp);
-		if (!conn) {
-			_leave(" = -ENOMEM");
-			return -ENOMEM;
+		if (IS_ERR(conn)) {
+			_leave(" = %ld", PTR_ERR(conn));
+			return PTR_ERR(conn);
 		}
 
 		conn->trans = trans;
@@ -508,9 +508,9 @@ int rxrpc_connect_call(struct rxrpc_sock *rx,
 		/* not yet present - create a candidate for a new connection and then
 		 * redo the check */
 		candidate = rxrpc_alloc_connection(gfp);
-		if (!candidate) {
-			_leave(" = -ENOMEM");
-			return -ENOMEM;
+		if (IS_ERR(candidate)) {
+			_leave(" = %ld", PTR_ERR(candidate));
+			return PTR_ERR(candidate);
 		}
 
 		candidate->trans = trans;
diff --git a/trunk/net/sunrpc/xprtrdma/verbs.c b/trunk/net/sunrpc/xprtrdma/verbs.c
index 3b21e0cc5e69..465aafc2007f 100644
--- a/trunk/net/sunrpc/xprtrdma/verbs.c
+++ b/trunk/net/sunrpc/xprtrdma/verbs.c
@@ -1495,7 +1495,8 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
 	frmr_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
 	frmr_wr.wr.fast_reg.length = i << PAGE_SHIFT;
 	frmr_wr.wr.fast_reg.access_flags = (writing ?
-				IB_ACCESS_REMOTE_WRITE : IB_ACCESS_REMOTE_READ);
+				IB_ACCESS_REMOTE_WRITE | IB_ACCESS_LOCAL_WRITE :
+				IB_ACCESS_REMOTE_READ);
 	frmr_wr.wr.fast_reg.rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey;
 	DECR_CQCOUNT(&r_xprt->rx_ep);
 
diff --git a/trunk/net/wireless/reg.c b/trunk/net/wireless/reg.c
index 487cb627ddba..08265ca15785 100644
--- a/trunk/net/wireless/reg.c
+++ b/trunk/net/wireless/reg.c
@@ -1551,13 +1551,6 @@ static int regulatory_hint_core(const char *alpha2)
 
 	queue_regulatory_request(request);
 
-	/*
-	 * This ensures last_request is populated once modules
-	 * come swinging in and calling regulatory hints and
-	 * wiphy_apply_custom_regulatory().
-	 */
-	flush_scheduled_work();
-
 	return 0;
 }
 
diff --git a/trunk/net/wireless/wext.c b/trunk/net/wireless/wext.c
index 0e59f9ae9b81..cb6a5bb85d80 100644
--- a/trunk/net/wireless/wext.c
+++ b/trunk/net/wireless/wext.c
@@ -786,13 +786,6 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
 			err = -EFAULT;
 			goto out;
 		}
-
-		if (cmd == SIOCSIWENCODEEXT) {
-			struct iw_encode_ext *ee = (void *) extra;
-
-			if (iwp->length < sizeof(*ee) + ee->key_len)
-				return -EFAULT;
-		}
 	}
 
 	err = handler(dev, info, (union iwreq_data *) iwp, extra);
diff --git a/trunk/sound/pci/hda/hda_intel.c b/trunk/sound/pci/hda/hda_intel.c
index 3128e1a6bc65..21e99cfa8c49 100644
--- a/trunk/sound/pci/hda/hda_intel.c
+++ b/trunk/sound/pci/hda/hda_intel.c
@@ -2141,7 +2141,6 @@ static struct snd_pci_quirk probe_mask_list[] __devinitdata = {
 	/* including bogus ALC268 in slot#2 that conflicts with ALC888 */
 	SND_PCI_QUIRK(0x17c0, 0x4085, "Medion MD96630", 0x01),
 	/* forced codec slots */
-	SND_PCI_QUIRK(0x1043, 0x1262, "ASUS W5Fm", 0x103),
 	SND_PCI_QUIRK(0x1046, 0x1262, "ASUS W5F", 0x103),
 	{}
 };
diff --git a/trunk/sound/pci/hda/patch_realtek.c b/trunk/sound/pci/hda/patch_realtek.c
index 0fd258eba3a5..bcbb736f94f0 100644
--- a/trunk/sound/pci/hda/patch_realtek.c
+++ b/trunk/sound/pci/hda/patch_realtek.c
@@ -776,12 +776,6 @@ static void alc_set_input_pin(struct hda_codec *codec, hda_nid_t nid,
 		pincap = (pincap & AC_PINCAP_VREF) >> AC_PINCAP_VREF_SHIFT;
 		if (pincap & AC_PINCAP_VREF_80)
 			val = PIN_VREF80;
-		else if (pincap & AC_PINCAP_VREF_50)
-			val = PIN_VREF50;
-		else if (pincap & AC_PINCAP_VREF_100)
-			val = PIN_VREF100;
-		else if (pincap & AC_PINCAP_VREF_GRD)
-			val = PIN_VREFGRD;
 	}
 	snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, val);
 }
diff --git a/trunk/sound/pci/hda/patch_sigmatel.c b/trunk/sound/pci/hda/patch_sigmatel.c
index d2fd8ef6aef8..03b3646018a1 100644
--- a/trunk/sound/pci/hda/patch_sigmatel.c
+++ b/trunk/sound/pci/hda/patch_sigmatel.c
@@ -150,7 +150,6 @@ enum {
 	STAC_D965_REF,
 	STAC_D965_3ST,
 	STAC_D965_5ST,
-	STAC_D965_5ST_NO_FP,
 	STAC_DELL_3ST,
 	STAC_DELL_BIOS,
 	STAC_927X_MODELS
@@ -2155,13 +2154,6 @@ static unsigned int d965_5st_pin_configs[14] = {
 	0x40000100, 0x40000100
 };
 
-static unsigned int d965_5st_no_fp_pin_configs[14] = {
-	0x40000100, 0x40000100, 0x0181304e, 0x01014010,
-	0x01a19040, 0x01011012, 0x01016011, 0x40000100,
-	0x40000100, 0x40000100, 0x40000100, 0x01442070,
-	0x40000100, 0x40000100
-};
-
 static unsigned int dell_3st_pin_configs[14] = {
 	0x02211230, 0x02a11220, 0x01a19040, 0x01114210,
 	0x01111212, 0x01116211, 0x01813050, 0x01112214,
@@ -2174,7 +2166,6 @@ static unsigned int *stac927x_brd_tbl[STAC_927X_MODELS] = {
 	[STAC_D965_REF]  = ref927x_pin_configs,
 	[STAC_D965_3ST]  = d965_3st_pin_configs,
 	[STAC_D965_5ST]  = d965_5st_pin_configs,
-	[STAC_D965_5ST_NO_FP]  = d965_5st_no_fp_pin_configs,
 	[STAC_DELL_3ST]  = dell_3st_pin_configs,
 	[STAC_DELL_BIOS] = NULL,
 };
@@ -2185,7 +2176,6 @@ static const char *stac927x_models[STAC_927X_MODELS] = {
 	[STAC_D965_REF]		= "ref",
 	[STAC_D965_3ST]		= "3stack",
 	[STAC_D965_5ST]		= "5stack",
-	[STAC_D965_5ST_NO_FP]	= "5stack-no-fp",
 	[STAC_DELL_3ST]		= "dell-3stack",
 	[STAC_DELL_BIOS]	= "dell-bios",
 };