diff --git a/Documentation/networking/ip-sysctl.txt 
b/Documentation/networking/ip-sysctl.txt
index bfe9242..7d4ecaa 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -147,7 +147,7 @@ tcp_adv_win_scale - INTEGER
        (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
        if it is <= 0.
        Possible values are [-31, 31], inclusive.
-       Default: 2
+       Default: 1
 
 tcp_allowed_congestion_control - STRING
        Show/set the congestion control choices available to non-privileged
@@ -407,7 +407,7 @@ tcp_rmem - vector of 3 INTEGERs: min, default, max
        net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
        automatic tuning of that socket's receive buffer size, in which
        case this value is ignored.
-       Default: between 87380B and 4MB, depending on RAM size.
+       Default: between 87380B and 6MB, depending on RAM size.
 
 tcp_sack - BOOLEAN
        Enable select acknowledgments (SACKS).
diff --git a/Makefile b/Makefile
index ac9701b..16b9abf 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 0
-SUBLEVEL = 31
+SUBLEVEL = 32
 EXTRAVERSION =
 NAME = Sneaky Weasel
 
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index e7f92a4..fea97f6 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -279,8 +279,6 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
        struct mm_struct *mm = &init_mm;
        unsigned int cpu = smp_processor_id();
 
-       printk("CPU%u: Booted secondary processor\n", cpu);
-
        /*
         * All kernel threads share the same mm context; grab a
         * reference and switch to it.
@@ -292,6 +290,8 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
        enter_lazy_tlb(mm, current);
        local_flush_tlb_all();
 
+       printk("CPU%u: Booted secondary processor\n", cpu);
+
        cpu_init();
        preempt_disable();
        trace_hardirqs_off();
diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c
index 62e7c61..0264ab4 100644
--- a/arch/arm/kernel/sys_arm.c
+++ b/arch/arm/kernel/sys_arm.c
@@ -115,7 +115,7 @@ int kernel_execve(const char *filename,
                  "Ir" (THREAD_START_SP - sizeof(regs)),
                  "r" (&regs),
                  "Ir" (sizeof(regs))
-               : "r0", "r1", "r2", "r3", "ip", "lr", "memory");
+               : "r0", "r1", "r2", "r3", "r8", "r9", "ip", "lr", "memory");
 
  out:
        return ret;
diff --git a/arch/arm/mach-orion5x/mpp.h b/arch/arm/mach-orion5x/mpp.h
index eac6897..db70e79 100644
--- a/arch/arm/mach-orion5x/mpp.h
+++ b/arch/arm/mach-orion5x/mpp.h
@@ -65,8 +65,8 @@
 #define MPP8_GIGE               MPP(8,  0x1, 0, 0, 1,   1,   1)
 
 #define MPP9_UNUSED            MPP(9,  0x0, 0, 0, 1,   1,   1)
-#define MPP9_GPIO              MPP(9,  0x0, 0, 0, 1,   1,   1)
-#define MPP9_GIGE               MPP(9,  0x1, 1, 1, 1,   1,   1)
+#define MPP9_GPIO              MPP(9,  0x0, 1, 1, 1,   1,   1)
+#define MPP9_GIGE               MPP(9,  0x1, 0, 0, 1,   1,   1)
 
 #define MPP10_UNUSED           MPP(10, 0x0, 0, 0, 1,   1,   1)
 #define MPP10_GPIO             MPP(10, 0x0, 1, 1, 1,   1,   1)
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index bc0e1d8..8799eae 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -266,7 +266,9 @@ good_area:
        return fault;
 
 check_stack:
-       if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
+       /* Don't allow expansion below FIRST_USER_ADDRESS */
+       if (vma->vm_flags & VM_GROWSDOWN &&
+           addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
                goto good_area;
 out:
        return fault;
diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
index 7c928da..d8de182 100644
--- a/arch/ia64/include/asm/unistd.h
+++ b/arch/ia64/include/asm/unistd.h
@@ -321,11 +321,12 @@
 #define __NR_syncfs                    1329
 #define __NR_setns                     1330
 #define __NR_sendmmsg                  1331
+#define __NR_accept4                   1334
 
 #ifdef __KERNEL__
 
 
-#define NR_syscalls                    308 /* length of syscall table */
+#define NR_syscalls                    311 /* length of syscall table */
 
 /*
  * The following defines stop scripts/checksyscalls.sh from complaining about
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 97dd2ab..df477f8 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1777,6 +1777,9 @@ sys_call_table:
        data8 sys_syncfs
        data8 sys_setns                         // 1330
        data8 sys_sendmmsg
+       data8 sys_ni_syscall    /* process_vm_readv */
+       data8 sys_ni_syscall    /* process_vm_writev */
+       data8 sys_accept4
 
        .org sys_call_table + 8*NR_syscalls     // guard against failures to 
increase NR_syscalls
 #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */
diff --git a/arch/sparc/kernel/central.c b/arch/sparc/kernel/central.c
index 7eef3f7..f5ddc0b 100644
--- a/arch/sparc/kernel/central.c
+++ b/arch/sparc/kernel/central.c
@@ -268,4 +268,4 @@ static int __init sunfire_init(void)
        return 0;
 }
 
-subsys_initcall(sunfire_init);
+fs_initcall(sunfire_init);
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index b57a594..874162a 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -495,11 +495,11 @@ xcall_fetch_glob_regs:
        stx             %o7, [%g1 + GR_SNAP_O7]
        stx             %i7, [%g1 + GR_SNAP_I7]
        /* Don't try this at home kids... */
-       rdpr            %cwp, %g2
-       sub             %g2, 1, %g7
+       rdpr            %cwp, %g3
+       sub             %g3, 1, %g7
        wrpr            %g7, %cwp
        mov             %i7, %g7
-       wrpr            %g2, %cwp
+       wrpr            %g3, %cwp
        stx             %g7, [%g1 + GR_SNAP_RPC]
        sethi           %hi(trap_block), %g7
        or              %g7, %lo(trap_block), %g7
diff --git a/arch/tile/kernel/compat_signal.c b/arch/tile/kernel/compat_signal.c
index a7869ad..41459d8 100644
--- a/arch/tile/kernel/compat_signal.c
+++ b/arch/tile/kernel/compat_signal.c
@@ -406,19 +406,17 @@ int compat_setup_rt_frame(int sig, struct k_sigaction 
*ka, siginfo_t *info,
         * Set up registers for signal handler.
         * Registers that we don't modify keep the value they had from
         * user-space at the time we took the signal.
+        * We always pass siginfo and mcontext, regardless of SA_SIGINFO,
+        * since some things rely on this (e.g. glibc's debug/segfault.c).
         */
        regs->pc = ptr_to_compat_reg(ka->sa.sa_handler);
        regs->ex1 = PL_ICS_EX1(USER_PL, 1); /* set crit sec in handler */
        regs->sp = ptr_to_compat_reg(frame);
        regs->lr = restorer;
        regs->regs[0] = (unsigned long) usig;
-
-       if (ka->sa.sa_flags & SA_SIGINFO) {
-               /* Need extra arguments, so mark to restore caller-saves. */
-               regs->regs[1] = ptr_to_compat_reg(&frame->info);
-               regs->regs[2] = ptr_to_compat_reg(&frame->uc);
-               regs->flags |= PT_FLAGS_CALLER_SAVES;
-       }
+       regs->regs[1] = ptr_to_compat_reg(&frame->info);
+       regs->regs[2] = ptr_to_compat_reg(&frame->uc);
+       regs->flags |= PT_FLAGS_CALLER_SAVES;
 
        /*
         * Notify any tracer that was single-stepping it.
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index 71f4727..5a98aa2 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -185,10 +185,22 @@ void __init setup_per_cpu_areas(void)
 #endif
        rc = -EINVAL;
        if (pcpu_chosen_fc != PCPU_FC_PAGE) {
-               const size_t atom_size = cpu_has_pse ? PMD_SIZE : PAGE_SIZE;
                const size_t dyn_size = PERCPU_MODULE_RESERVE +
                        PERCPU_DYNAMIC_RESERVE - PERCPU_FIRST_CHUNK_RESERVE;
+               size_t atom_size;
 
+               /*
+                * On 64bit, use PMD_SIZE for atom_size so that embedded
+                * percpu areas are aligned to PMD.  This, in the future,
+                * can also allow using PMD mappings in vmalloc area.  Use
+                * PAGE_SIZE on 32bit as vmalloc space is highly contended
+                * and large vmalloc area allocs can easily fail.
+                */
+#ifdef CONFIG_X86_64
+               atom_size = PMD_SIZE;
+#else
+               atom_size = PAGE_SIZE;
+#endif
                rc = pcpu_embed_first_chunk(PERCPU_FIRST_CHUNK_RESERVE,
                                            dyn_size, atom_size,
                                            pcpu_cpu_distance,
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 0fb662a..b50c593 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -62,6 +62,7 @@
 #include <asm/reboot.h>
 #include <asm/stackprotector.h>
 #include <asm/hypervisor.h>
+#include <asm/pci_x86.h>
 
 #include "xen-ops.h"
 #include "mmu.h"
@@ -1259,8 +1260,10 @@ asmlinkage void __init xen_start_kernel(void)
                /* Make sure ACS will be enabled */
                pci_request_acs();
        }
-               
-
+#ifdef CONFIG_PCI
+       /* PCI BIOS service won't work from a PV guest. */
+       pci_probe &= ~PCI_PROBE_BIOS;
+#endif
        xen_raw_console_write("about to get started...\n");
 
        xen_setup_runstate_info(0);
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 5f76c0a..d957dce 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -320,8 +320,13 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
 {
        if (val & _PAGE_PRESENT) {
                unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
+               unsigned long pfn = mfn_to_pfn(mfn);
+
                pteval_t flags = val & PTE_FLAGS_MASK;
-               val = ((pteval_t)mfn_to_pfn(mfn) << PAGE_SHIFT) | flags;
+               if (unlikely(pfn == ~0))
+                       val = flags & ~_PAGE_PRESENT;
+               else
+                       val = ((pteval_t)pfn << PAGE_SHIFT) | flags;
        }
 
        return val;
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 0bd4832..79ddcde 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -422,6 +422,14 @@ static struct dmi_system_id __initdata 
acpisleep_dmi_table[] = {
        },
        {
        .callback = init_nvs_nosave,
+       .ident = "Sony Vaio VPCCW29FX",
+       .matches = {
+               DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+               DMI_MATCH(DMI_PRODUCT_NAME, "VPCCW29FX"),
+               },
+       },
+       {
+       .callback = init_nvs_nosave,
        .ident = "Averatec AV1020-ED2",
        .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "AVERATEC"),
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index e0b25de..98caccf 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -173,6 +173,7 @@ config CRYPTO_DEV_MV_CESA
        select CRYPTO_ALGAPI
        select CRYPTO_AES
        select CRYPTO_BLKCIPHER2
+       select CRYPTO_HASH
        help
          This driver allows you to utilize the Cryptographic Engines and
          Security Accelerator (CESA) which can be found on the Marvell Orion
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 2967002..80ccce9 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -350,18 +350,19 @@ config GPIO_LANGWELL
          Say Y here to support Intel Langwell/Penwell GPIO.
 
 config GPIO_PCH
-       tristate "Intel EG20T PCH / OKI SEMICONDUCTOR ML7223 IOH GPIO"
+       tristate "Intel EG20T PCH/LAPIS Semiconductor IOH(ML7223/ML7831) GPIO"
        depends on PCI && X86
        help
          This driver is for PCH(Platform controller Hub) GPIO of Intel Topcliff
          which is an IOH(Input/Output Hub) for x86 embedded processor.
          This driver can access PCH GPIO device.
 
-         This driver also can be used for OKI SEMICONDUCTOR IOH(Input/
-         Output Hub), ML7223.
+         This driver also can be used for LAPIS Semiconductor IOH(Input/
+         Output Hub), ML7223 and ML7831.
          ML7223 IOH is for MP(Media Phone) use.
-         ML7223 is companion chip for Intel Atom E6xx series.
-         ML7223 is completely compatible for Intel EG20T PCH.
+         ML7831 IOH is for general purpose use.
+         ML7223/ML7831 is companion chip for Intel Atom E6xx series.
+         ML7223/ML7831 is completely compatible for Intel EG20T PCH.
 
 config GPIO_ML_IOH
        tristate "OKI SEMICONDUCTOR ML7213 IOH GPIO support"
diff --git a/drivers/gpio/pch_gpio.c b/drivers/gpio/pch_gpio.c
index 36919e7..de26978 100644
--- a/drivers/gpio/pch_gpio.c
+++ b/drivers/gpio/pch_gpio.c
@@ -287,6 +287,7 @@ static int pch_gpio_resume(struct pci_dev *pdev)
 static DEFINE_PCI_DEVICE_TABLE(pch_gpio_pcidev_id) = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8803) },
        { PCI_DEVICE(PCI_VENDOR_ID_ROHM, 0x8014) },
+       { PCI_DEVICE(PCI_VENDOR_ID_ROHM, 0x8803) },
        { 0, }
 };
 MODULE_DEVICE_TABLE(pci, pch_gpio_pcidev_id);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index bc83428..a2b3f21 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -348,6 +348,8 @@ void mddev_suspend(mddev_t *mddev)
        synchronize_rcu();
        wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0);
        mddev->pers->quiesce(mddev, 1);
+
+       del_timer_sync(&mddev->safemode_timer);
 }
 EXPORT_SYMBOL_GPL(mddev_suspend);
 
diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index a43ed6c..12b91ae 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -1017,22 +1017,6 @@ static int ene_probe(struct pnp_dev *pnp_dev, const 
struct pnp_device_id *id)
 
        spin_lock_init(&dev->hw_lock);
 
-       /* claim the resources */
-       error = -EBUSY;
-       dev->hw_io = pnp_port_start(pnp_dev, 0);
-       if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
-               dev->hw_io = -1;
-               dev->irq = -1;
-               goto error;
-       }
-
-       dev->irq = pnp_irq(pnp_dev, 0);
-       if (request_irq(dev->irq, ene_isr,
-                       IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
-               dev->irq = -1;
-               goto error;
-       }
-
        pnp_set_drvdata(pnp_dev, dev);
        dev->pnp_dev = pnp_dev;
 
@@ -1085,6 +1069,22 @@ static int ene_probe(struct pnp_dev *pnp_dev, const 
struct pnp_device_id *id)
        device_set_wakeup_capable(&pnp_dev->dev, true);
        device_set_wakeup_enable(&pnp_dev->dev, true);
 
+       /* claim the resources */
+       error = -EBUSY;
+       dev->hw_io = pnp_port_start(pnp_dev, 0);
+       if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
+               dev->hw_io = -1;
+               dev->irq = -1;
+               goto error;
+       }
+
+       dev->irq = pnp_irq(pnp_dev, 0);
+       if (request_irq(dev->irq, ene_isr,
+                       IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
+               dev->irq = -1;
+               goto error;
+       }
+
        error = rc_register_device(rdev);
        if (error < 0)
                goto error;
diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c
index 7f7079b..4218f73 100644
--- a/drivers/media/rc/fintek-cir.c
+++ b/drivers/media/rc/fintek-cir.c
@@ -504,16 +504,6 @@ static int fintek_probe(struct pnp_dev *pdev, const struct 
pnp_device_id *dev_id
 
        spin_lock_init(&fintek->fintek_lock);
 
-       ret = -EBUSY;
-       /* now claim resources */
-       if (!request_region(fintek->cir_addr,
-                           fintek->cir_port_len, FINTEK_DRIVER_NAME))
-               goto failure;
-
-       if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
-                       FINTEK_DRIVER_NAME, (void *)fintek))
-               goto failure;
-
        pnp_set_drvdata(pdev, fintek);
        fintek->pdev = pdev;
 
@@ -548,6 +538,16 @@ static int fintek_probe(struct pnp_dev *pdev, const struct 
pnp_device_id *dev_id
        /* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */
        rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD);
 
+       ret = -EBUSY;
+       /* now claim resources */
+       if (!request_region(fintek->cir_addr,
+                           fintek->cir_port_len, FINTEK_DRIVER_NAME))
+               goto failure;
+
+       if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
+                       FINTEK_DRIVER_NAME, (void *)fintek))
+               goto failure;
+
        ret = rc_register_device(rdev);
        if (ret)
                goto failure;
diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
index ecd3d02..c5ca091 100644
--- a/drivers/media/rc/ite-cir.c
+++ b/drivers/media/rc/ite-cir.c
@@ -1519,16 +1519,6 @@ static int ite_probe(struct pnp_dev *pdev, const struct 
pnp_device_id
        /* initialize raw event */
        init_ir_raw_event(&itdev->rawir);
 
-       ret = -EBUSY;
-       /* now claim resources */
-       if (!request_region(itdev->cir_addr,
-                               dev_desc->io_region_size, ITE_DRIVER_NAME))
-               goto failure;
-
-       if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
-                       ITE_DRIVER_NAME, (void *)itdev))
-               goto failure;
-
        /* set driver data into the pnp device */
        pnp_set_drvdata(pdev, itdev);
        itdev->pdev = pdev;
@@ -1604,6 +1594,16 @@ static int ite_probe(struct pnp_dev *pdev, const struct 
pnp_device_id
        rdev->driver_name = ITE_DRIVER_NAME;
        rdev->map_name = RC_MAP_RC6_MCE;
 
+       ret = -EBUSY;
+       /* now claim resources */
+       if (!request_region(itdev->cir_addr,
+                               dev_desc->io_region_size, ITE_DRIVER_NAME))
+               goto failure;
+
+       if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
+                       ITE_DRIVER_NAME, (void *)itdev))
+               goto failure;
+
        ret = rc_register_device(rdev);
        if (ret)
                goto failure;
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index 9fd019e..c212276 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -1027,24 +1027,6 @@ static int nvt_probe(struct pnp_dev *pdev, const struct 
pnp_device_id *dev_id)
        spin_lock_init(&nvt->nvt_lock);
        spin_lock_init(&nvt->tx.lock);
 
-       ret = -EBUSY;
-       /* now claim resources */
-       if (!request_region(nvt->cir_addr,
-                           CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
-               goto failure;
-
-       if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
-                       NVT_DRIVER_NAME, (void *)nvt))
-               goto failure;
-
-       if (!request_region(nvt->cir_wake_addr,
-                           CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
-               goto failure;
-
-       if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
-                       NVT_DRIVER_NAME, (void *)nvt))
-               goto failure;
-
        pnp_set_drvdata(pdev, nvt);
        nvt->pdev = pdev;
 
@@ -1091,6 +1073,24 @@ static int nvt_probe(struct pnp_dev *pdev, const struct 
pnp_device_id *dev_id)
        rdev->tx_resolution = XYZ;
 #endif
 
+       ret = -EBUSY;
+       /* now claim resources */
+       if (!request_region(nvt->cir_addr,
+                           CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+               goto failure;
+
+       if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
+                       NVT_DRIVER_NAME, (void *)nvt))
+               goto failure;
+
+       if (!request_region(nvt->cir_wake_addr,
+                           CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+               goto failure;
+
+       if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
+                       NVT_DRIVER_NAME, (void *)nvt))
+               goto failure;
+
        ret = rc_register_device(rdev);
        if (ret)
                goto failure;
diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
index 6f03846..9e55a0c 100644
--- a/drivers/media/rc/winbond-cir.c
+++ b/drivers/media/rc/winbond-cir.c
@@ -1003,39 +1003,10 @@ wbcir_probe(struct pnp_dev *device, const struct 
pnp_device_id *dev_id)
                "(w: 0x%lX, e: 0x%lX, s: 0x%lX, i: %u)\n",
                data->wbase, data->ebase, data->sbase, data->irq);
 
-       if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
-               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-                       data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
-               err = -EBUSY;
-               goto exit_free_data;
-       }
-
-       if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
-               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-                       data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
-               err = -EBUSY;
-               goto exit_release_wbase;
-       }
-
-       if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
-               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-                       data->sbase, data->sbase + SP_IOMEM_LEN - 1);
-               err = -EBUSY;
-               goto exit_release_ebase;
-       }
-
-       err = request_irq(data->irq, wbcir_irq_handler,
-                         IRQF_DISABLED, DRVNAME, device);
-       if (err) {
-               dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
-               err = -EBUSY;
-               goto exit_release_sbase;
-       }
-
        led_trigger_register_simple("cir-tx", &data->txtrigger);
        if (!data->txtrigger) {
                err = -ENOMEM;
-               goto exit_free_irq;
+               goto exit_free_data;
        }
 
        led_trigger_register_simple("cir-rx", &data->rxtrigger);
@@ -1074,9 +1045,38 @@ wbcir_probe(struct pnp_dev *device, const struct 
pnp_device_id *dev_id)
        data->dev->priv = data;
        data->dev->dev.parent = &device->dev;
 
+       if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
+               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+                       data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
+               err = -EBUSY;
+               goto exit_free_rc;
+       }
+
+       if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
+               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+                       data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
+               err = -EBUSY;
+               goto exit_release_wbase;
+       }
+
+       if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
+               dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+                       data->sbase, data->sbase + SP_IOMEM_LEN - 1);
+               err = -EBUSY;
+               goto exit_release_ebase;
+       }
+
+       err = request_irq(data->irq, wbcir_irq_handler,
+                         IRQF_DISABLED, DRVNAME, device);
+       if (err) {
+               dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
+               err = -EBUSY;
+               goto exit_release_sbase;
+       }
+
        err = rc_register_device(data->dev);
        if (err)
-               goto exit_free_rc;
+               goto exit_free_irq;
 
        device_init_wakeup(&device->dev, 1);
 
@@ -1084,14 +1084,6 @@ wbcir_probe(struct pnp_dev *device, const struct 
pnp_device_id *dev_id)
 
        return 0;
 
-exit_free_rc:
-       rc_free_device(data->dev);
-exit_unregister_led:
-       led_classdev_unregister(&data->led);
-exit_unregister_rxtrigger:
-       led_trigger_unregister_simple(data->rxtrigger);
-exit_unregister_txtrigger:
-       led_trigger_unregister_simple(data->txtrigger);
 exit_free_irq:
        free_irq(data->irq, device);
 exit_release_sbase:
@@ -1100,6 +1092,14 @@ exit_release_ebase:
        release_region(data->ebase, EHFUNC_IOMEM_LEN);
 exit_release_wbase:
        release_region(data->wbase, WAKEUP_IOMEM_LEN);
+exit_free_rc:
+       rc_free_device(data->dev);
+exit_unregister_led:
+       led_classdev_unregister(&data->led);
+exit_unregister_rxtrigger:
+       led_trigger_unregister_simple(data->rxtrigger);
+exit_unregister_txtrigger:
+       led_trigger_unregister_simple(data->txtrigger);
 exit_free_data:
        kfree(data);
        pnp_set_drvdata(device, NULL);
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 93359fa..0c3f234 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2543,7 +2543,7 @@ config S6GMAC
 source "drivers/net/stmmac/Kconfig"
 
 config PCH_GBE
-       tristate "Intel EG20T PCH / OKI SEMICONDUCTOR ML7223 IOH GbE"
+       tristate "Intel EG20T PCH/OKI SEMICONDUCTOR IOH(ML7223/ML7831) GbE"
        depends on PCI
        select MII
        ---help---
@@ -2556,10 +2556,11 @@ config PCH_GBE
          This driver enables Gigabit Ethernet function.
 
          This driver also can be used for OKI SEMICONDUCTOR IOH(Input/
-         Output Hub), ML7223.
-         ML7223 IOH is for MP(Media Phone) use.
-         ML7223 is companion chip for Intel Atom E6xx series.
-         ML7223 is completely compatible for Intel EG20T PCH.
+         Output Hub), ML7223/ML7831.
+         ML7223 IOH is for MP(Media Phone) use. ML7831 IOH is for general
+         purpose use.
+         ML7223/ML7831 is companion chip for Intel Atom E6xx series.
+         ML7223/ML7831 is completely compatible for Intel EG20T PCH.
 
 endif # NETDEV_1000
 
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c 
b/drivers/net/pch_gbe/pch_gbe_main.c
index eac3c5c..236d00e 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -39,6 +39,9 @@ const char pch_driver_version[] = DRV_VERSION;
 #define PCI_VENDOR_ID_ROHM                     0x10db
 #define PCI_DEVICE_ID_ROHM_ML7223_GBE          0x8013
 
+/* Macros for ML7831 */
+#define PCI_DEVICE_ID_ROHM_ML7831_GBE          0x8802
+
 #define PCH_GBE_TX_WEIGHT         64
 #define PCH_GBE_RX_WEIGHT         64
 #define PCH_GBE_RX_BUFFER_WRITE   16
@@ -717,13 +720,6 @@ static void pch_gbe_configure_rx(struct pch_gbe_adapter 
*adapter)
        iowrite32(rdba, &hw->reg->RX_DSC_BASE);
        iowrite32(rdlen, &hw->reg->RX_DSC_SIZE);
        iowrite32((rdba + rdlen), &hw->reg->RX_DSC_SW_P);
-
-       /* Enables Receive DMA */
-       rxdma = ioread32(&hw->reg->DMA_CTRL);
-       rxdma |= PCH_GBE_RX_DMA_EN;
-       iowrite32(rxdma, &hw->reg->DMA_CTRL);
-       /* Enables Receive */
-       iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
 }
 
 /**
@@ -1097,6 +1093,19 @@ void pch_gbe_update_stats(struct pch_gbe_adapter 
*adapter)
        spin_unlock_irqrestore(&adapter->stats_lock, flags);
 }
 
+static void pch_gbe_start_receive(struct pch_gbe_hw *hw)
+{
+       u32 rxdma;
+
+       /* Enables Receive DMA */
+       rxdma = ioread32(&hw->reg->DMA_CTRL);
+       rxdma |= PCH_GBE_RX_DMA_EN;
+       iowrite32(rxdma, &hw->reg->DMA_CTRL);
+       /* Enables Receive */
+       iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
+       return;
+}
+
 /**
  * pch_gbe_intr - Interrupt Handler
  * @irq:   Interrupt number
@@ -1701,6 +1710,12 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
        struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
        int err;
 
+       /* Ensure we have a valid MAC */
+       if (!is_valid_ether_addr(adapter->hw.mac.addr)) {
+               pr_err("Error: Invalid MAC address\n");
+               return -EINVAL;
+       }
+
        /* hardware has been reset, we need to reload some things */
        pch_gbe_set_multi(netdev);
 
@@ -1717,6 +1732,7 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
        pch_gbe_alloc_tx_buffers(adapter, tx_ring);
        pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);
        adapter->tx_queue_len = netdev->tx_queue_len;
+       pch_gbe_start_receive(&adapter->hw);
 
        mod_timer(&adapter->watchdog_timer, jiffies);
 
@@ -2118,7 +2134,7 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, 
int budget)
                /* If no Tx and not enough Rx work done,
                 * exit the polling mode
                 */
-               if ((work_done < budget) || !netif_running(netdev))
+               if (work_done < budget)
                        poll_end_flag = true;
        }
 
@@ -2392,9 +2408,14 @@ static int pch_gbe_probe(struct pci_dev *pdev,
 
        memcpy(netdev->dev_addr, adapter->hw.mac.addr, netdev->addr_len);
        if (!is_valid_ether_addr(netdev->dev_addr)) {
-               dev_err(&pdev->dev, "Invalid MAC Address\n");
-               ret = -EIO;
-               goto err_free_adapter;
+               /*
+                * If the MAC is invalid (or just missing), display a warning
+                * but do not abort setting up the device. pch_gbe_up will
+                * prevent the interface from being brought up until a valid MAC
+                * is set.
+                */
+               dev_err(&pdev->dev, "Invalid MAC address, "
+                                   "interface disabled.\n");
        }
        setup_timer(&adapter->watchdog_timer, pch_gbe_watchdog,
                    (unsigned long)adapter);
@@ -2452,6 +2473,13 @@ static DEFINE_PCI_DEVICE_TABLE(pch_gbe_pcidev_id) = {
         .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
         .class_mask = (0xFFFF00)
         },
+       {.vendor = PCI_VENDOR_ID_ROHM,
+        .device = PCI_DEVICE_ID_ROHM_ML7831_GBE,
+        .subvendor = PCI_ANY_ID,
+        .subdevice = PCI_ANY_ID,
+        .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
+        .class_mask = (0xFFFF00)
+        },
        /* required last entry */
        {0}
 };
diff --git a/drivers/net/pch_gbe/pch_gbe_param.c 
b/drivers/net/pch_gbe/pch_gbe_param.c
index 5b5d90a..fb74ef9 100644
--- a/drivers/net/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/pch_gbe/pch_gbe_param.c
@@ -320,10 +320,10 @@ static void pch_gbe_check_copper_options(struct 
pch_gbe_adapter *adapter)
                        pr_debug("AutoNeg specified along with Speed or Duplex, 
AutoNeg parameter ignored\n");
                        hw->phy.autoneg_advertised = opt.def;
                } else {
-                       hw->phy.autoneg_advertised = AutoNeg;
-                       pch_gbe_validate_option(
-                               (int *)(&hw->phy.autoneg_advertised),
-                               &opt, adapter);
+                       int tmp = AutoNeg;
+
+                       pch_gbe_validate_option(&tmp, &opt, adapter);
+                       hw->phy.autoneg_advertised = tmp;
                }
        }
 
@@ -494,9 +494,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
                                         .p = fc_list } }
                };
-               hw->mac.fc = FlowControl;
-               pch_gbe_validate_option((int *)(&hw->mac.fc),
-                                               &opt, adapter);
+               int tmp = FlowControl;
+
+               pch_gbe_validate_option(&tmp, &opt, adapter);
+               hw->mac.fc = tmp;
        }
 
        pch_gbe_check_copper_options(adapter);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 80df3a8..f2e31c8 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -2344,8 +2344,13 @@ static struct sk_buff *receive_copy(struct sky2_port 
*sky2,
                skb_copy_from_linear_data(re->skb, skb->data, length);
                skb->ip_summed = re->skb->ip_summed;
                skb->csum = re->skb->csum;
+               skb->rxhash = re->skb->rxhash;
+               skb->vlan_tci = re->skb->vlan_tci;
+
                pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
                                               length, PCI_DMA_FROMDEVICE);
+               re->skb->vlan_tci = 0;
+               re->skb->rxhash = 0;
                re->skb->ip_summed = CHECKSUM_NONE;
                skb_put(skb, length);
        }
@@ -2430,9 +2435,6 @@ static struct sk_buff *sky2_receive(struct net_device 
*dev,
        struct sk_buff *skb = NULL;
        u16 count = (status & GMR_FS_LEN) >> 16;
 
-       if (status & GMR_FS_VLAN)
-               count -= VLAN_HLEN;     /* Account for vlan tag */
-
        netif_printk(sky2, rx_status, KERN_DEBUG, dev,
                     "rx slot %u status 0x%x len %d\n",
                     sky2->rx_next, status, length);
@@ -2440,6 +2442,9 @@ static struct sk_buff *sky2_receive(struct net_device 
*dev,
        sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending;
        prefetch(sky2->rx_ring + sky2->rx_next);
 
+       if (vlan_tx_tag_present(re->skb))
+               count -= VLAN_HLEN;     /* Account for vlan tag */
+
        /* This chip has hardware problems that generates bogus status.
         * So do only marginal checking and expect higher level protocols
         * to handle crap frames.
@@ -2497,11 +2502,8 @@ static inline void sky2_tx_done(struct net_device *dev, 
u16 last)
 }
 
 static inline void sky2_skb_rx(const struct sky2_port *sky2,
-                              u32 status, struct sk_buff *skb)
+                              struct sk_buff *skb)
 {
-       if (status & GMR_FS_VLAN)
-               __vlan_hwaccel_put_tag(skb, be16_to_cpu(sky2->rx_tag));
-
        if (skb->ip_summed == CHECKSUM_NONE)
                netif_receive_skb(skb);
        else
@@ -2555,6 +2557,14 @@ static void sky2_rx_checksum(struct sky2_port *sky2, u32 
status)
        }
 }
 
+static void sky2_rx_tag(struct sky2_port *sky2, u16 length)
+{
+       struct sk_buff *skb;
+
+       skb = sky2->rx_ring[sky2->rx_next].skb;
+       __vlan_hwaccel_put_tag(skb, be16_to_cpu(length));
+}
+
 static void sky2_rx_hash(struct sky2_port *sky2, u32 status)
 {
        struct sk_buff *skb;
@@ -2613,8 +2623,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int 
to_do, u16 idx)
                        }
 
                        skb->protocol = eth_type_trans(skb, dev);
-
-                       sky2_skb_rx(sky2, status, skb);
+                       sky2_skb_rx(sky2, skb);
 
                        /* Stop after net poll weight */
                        if (++work_done >= to_do)
@@ -2622,11 +2631,11 @@ static int sky2_status_intr(struct sky2_hw *hw, int 
to_do, u16 idx)
                        break;
 
                case OP_RXVLAN:
-                       sky2->rx_tag = length;
+                       sky2_rx_tag(sky2, length);
                        break;
 
                case OP_RXCHKSVLAN:
-                       sky2->rx_tag = length;
+                       sky2_rx_tag(sky2, length);
                        /* fall through */
                case OP_RXCHKS:
                        if (likely(dev->features & NETIF_F_RXCSUM))
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index 318c9ae..a79a166 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -2236,7 +2236,6 @@ struct sky2_port {
        u16                  rx_pending;
        u16                  rx_data_size;
        u16                  rx_nfrags;
-       u16                  rx_tag;
 
        struct {
                unsigned long last;
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index ab59300..361beb7 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -2363,7 +2363,7 @@ static int gem_suspend(struct pci_dev *pdev, pm_message_t 
state)
                netif_device_detach(dev);
 
                /* Switch off MAC, remember WOL setting */
-               gp->asleep_wol = gp->wake_on_lan;
+               gp->asleep_wol = !!gp->wake_on_lan;
                gem_do_stop(dev, gp->asleep_wol);
        } else
                gp->asleep_wol = 0;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index bc8c183..c4ab8a7 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -740,8 +740,13 @@ static inline unsigned int tg3_has_work(struct tg3_napi 
*tnapi)
                if (sblk->status & SD_STATUS_LINK_CHG)
                        work_exists = 1;
        }
-       /* check for RX/TX work to do */
-       if (sblk->idx[0].tx_consumer != tnapi->tx_cons ||
+
+       /* check for TX work to do */
+       if (sblk->idx[0].tx_consumer != tnapi->tx_cons)
+               work_exists = 1;
+
+       /* check for RX work to do */
+       if (tnapi->rx_rcb_prod_idx &&
            *(tnapi->rx_rcb_prod_idx) != tnapi->rx_rcb_ptr)
                work_exists = 1;
 
@@ -5216,6 +5221,9 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int 
work_done, int budget)
                        return work_done;
        }
 
+       if (!tnapi->rx_rcb_prod_idx)
+               return work_done;
+
        /* run RX thread, within the bounds set by NAPI.
         * All RX "locking" is done by ensuring outside
         * code synchronizes with tg3->napi.poll()
@@ -6626,6 +6634,12 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                 */
                switch (i) {
                default:
+                       if (tg3_flag(tp, ENABLE_RSS)) {
+                               tnapi->rx_rcb_prod_idx = NULL;
+                               break;
+                       }
+                       /* Fall through */
+               case 1:
                        tnapi->rx_rcb_prod_idx = &sblk->idx[0].rx_producer;
                        break;
                case 2:
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 3e33573..c44e0e4 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -398,7 +398,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, 
struct sk_buff *skb,
        u32 packet_len;
        u32 padbytes = 0xffff0000;
 
-       padlen = ((skb->len + 4) % 512) ? 0 : 4;
+       padlen = ((skb->len + 4) & (dev->maxpacket - 1)) ? 0 : 4;
 
        if ((!skb_cloned(skb)) &&
            ((headroom + tailroom) >= (4 + padlen))) {
@@ -420,7 +420,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, 
struct sk_buff *skb,
        cpu_to_le32s(&packet_len);
        skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
 
-       if ((skb->len % 512) == 0) {
+       if (padlen) {
                cpu_to_le32s(&padbytes);
                memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
                skb_put(skb, sizeof(padbytes));
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 13919dd..544c309 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -83,6 +83,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct 
usb_interface *intf)
        struct cdc_state                *info = (void *) &dev->data;
        int                             status;
        int                             rndis;
+       bool                            android_rndis_quirk = false;
        struct usb_driver               *driver = driver_of(intf);
        struct usb_cdc_mdlm_desc        *desc = NULL;
        struct usb_cdc_mdlm_detail_desc *detail = NULL;
@@ -195,6 +196,11 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct 
usb_interface *intf)
                                        info->control,
                                        info->u->bSlaveInterface0,
                                        info->data);
+                               /* fall back to hard-wiring for RNDIS */
+                               if (rndis) {
+                                       android_rndis_quirk = true;
+                                       goto next_desc;
+                               }
                                goto bad_desc;
                        }
                        if (info->control != intf) {
@@ -271,11 +277,15 @@ next_desc:
        /* Microsoft ActiveSync based and some regular RNDIS devices lack the
         * CDC descriptors, so we'll hard-wire the interfaces and not check
         * for descriptors.
+        *
+        * Some Android RNDIS devices have a CDC Union descriptor pointing
+        * to non-existing interfaces.  Ignore that and attempt the same
+        * hard-wired 0 and 1 interfaces.
         */
-       if (rndis && !info->u) {
+       if (rndis && (!info->u || android_rndis_quirk)) {
                info->control = usb_ifnum_to_if(dev->udev, 0);
                info->data = usb_ifnum_to_if(dev->udev, 1);
-               if (!info->control || !info->data) {
+               if (!info->control || !info->data || info->control != intf) {
                        dev_dbg(&intf->dev,
                                "rndis: master #0/%p slave #1/%p\n",
                                info->control,
@@ -472,6 +482,7 @@ static const struct driver_info wwan_info = {
 /*-------------------------------------------------------------------------*/
 
 #define HUAWEI_VENDOR_ID       0x12D1
+#define NOVATEL_VENDOR_ID      0x1410
 
 static const struct usb_device_id      products [] = {
 /*
@@ -589,6 +600,21 @@ static const struct usb_device_id  products [] = {
  * because of bugs/quirks in a given product (like Zaurus, above).
  */
 {
+       /* Novatel USB551L */
+       /* This match must come *before* the generic CDC-ETHER match so that
+        * we get FLAG_WWAN set on the device, since it's descriptors are
+        * generic CDC-ETHER.
+        */
+       .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+                | USB_DEVICE_ID_MATCH_PRODUCT
+                | USB_DEVICE_ID_MATCH_INT_INFO,
+       .idVendor               = NOVATEL_VENDOR_ID,
+       .idProduct              = 0xB001,
+       .bInterfaceClass        = USB_CLASS_COMM,
+       .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
+       .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+       .driver_info = (unsigned long)&wwan_info,
+}, {
        USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                        USB_CDC_PROTO_NONE),
        .driver_info = (unsigned long) &cdc_info,
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index f74f3ce..e5c15bb 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1190,7 +1190,7 @@ static const struct driver_info smsc95xx_info = {
        .rx_fixup       = smsc95xx_rx_fixup,
        .tx_fixup       = smsc95xx_tx_fixup,
        .status         = smsc95xx_status,
-       .flags          = FLAG_ETHER | FLAG_SEND_ZLP,
+       .flags          = FLAG_ETHER | FLAG_SEND_ZLP | FLAG_LINK_INTR,
 };
 
 static const struct usb_device_id products[] = {
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 46a6b67..dd225fc 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -277,17 +277,32 @@ int usbnet_change_mtu (struct net_device *net, int 
new_mtu)
 }
 EXPORT_SYMBOL_GPL(usbnet_change_mtu);
 
+/* The caller must hold list->lock */
+static void __usbnet_queue_skb(struct sk_buff_head *list,
+                       struct sk_buff *newsk, enum skb_state state)
+{
+       struct skb_data *entry = (struct skb_data *) newsk->cb;
+
+       __skb_queue_tail(list, newsk);
+       entry->state = state;
+}
+
 /*-------------------------------------------------------------------------*/
 
 /* some LK 2.4 HCDs oopsed if we freed or resubmitted urbs from
  * completion callbacks.  2.5 should have fixed those bugs...
  */
 
-static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct 
sk_buff_head *list)
+static enum skb_state defer_bh(struct usbnet *dev, struct sk_buff *skb,
+               struct sk_buff_head *list, enum skb_state state)
 {
        unsigned long           flags;
+       enum skb_state          old_state;
+       struct skb_data *entry = (struct skb_data *) skb->cb;
 
        spin_lock_irqsave(&list->lock, flags);
+       old_state = entry->state;
+       entry->state = state;
        __skb_unlink(skb, list);
        spin_unlock(&list->lock);
        spin_lock(&dev->done.lock);
@@ -295,6 +310,7 @@ static void defer_bh(struct usbnet *dev, struct sk_buff 
*skb, struct sk_buff_hea
        if (dev->done.qlen == 1)
                tasklet_schedule(&dev->bh);
        spin_unlock_irqrestore(&dev->done.lock, flags);
+       return old_state;
 }
 
 /* some work can't be done in tasklets, so we use keventd
@@ -335,7 +351,6 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, 
gfp_t flags)
        entry = (struct skb_data *) skb->cb;
        entry->urb = urb;
        entry->dev = dev;
-       entry->state = rx_start;
        entry->length = 0;
 
        usb_fill_bulk_urb (urb, dev->udev, dev->in,
@@ -367,7 +382,7 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, 
gfp_t flags)
                        tasklet_schedule (&dev->bh);
                        break;
                case 0:
-                       __skb_queue_tail (&dev->rxq, skb);
+                       __usbnet_queue_skb(&dev->rxq, skb, rx_start);
                }
        } else {
                netif_dbg(dev, ifdown, dev->net, "rx: stopped\n");
@@ -418,16 +433,17 @@ static void rx_complete (struct urb *urb)
        struct skb_data         *entry = (struct skb_data *) skb->cb;
        struct usbnet           *dev = entry->dev;
        int                     urb_status = urb->status;
+       enum skb_state          state;
 
        skb_put (skb, urb->actual_length);
-       entry->state = rx_done;
+       state = rx_done;
        entry->urb = NULL;
 
        switch (urb_status) {
        /* success */
        case 0:
                if (skb->len < dev->net->hard_header_len) {
-                       entry->state = rx_cleanup;
+                       state = rx_cleanup;
                        dev->net->stats.rx_errors++;
                        dev->net->stats.rx_length_errors++;
                        netif_dbg(dev, rx_err, dev->net,
@@ -466,7 +482,7 @@ static void rx_complete (struct urb *urb)
                                  "rx throttle %d\n", urb_status);
                }
 block:
-               entry->state = rx_cleanup;
+               state = rx_cleanup;
                entry->urb = urb;
                urb = NULL;
                break;
@@ -477,17 +493,18 @@ block:
                // FALLTHROUGH
 
        default:
-               entry->state = rx_cleanup;
+               state = rx_cleanup;
                dev->net->stats.rx_errors++;
                netif_dbg(dev, rx_err, dev->net, "rx status %d\n", urb_status);
                break;
        }
 
-       defer_bh(dev, skb, &dev->rxq);
+       state = defer_bh(dev, skb, &dev->rxq, state);
 
        if (urb) {
                if (netif_running (dev->net) &&
-                   !test_bit (EVENT_RX_HALT, &dev->flags)) {
+                   !test_bit (EVENT_RX_HALT, &dev->flags) &&
+                   state != unlink_start) {
                        rx_submit (dev, urb, GFP_ATOMIC);
                        return;
                }
@@ -573,16 +590,23 @@ EXPORT_SYMBOL_GPL(usbnet_purge_paused_rxq);
 static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
 {
        unsigned long           flags;
-       struct sk_buff          *skb, *skbnext;
+       struct sk_buff          *skb;
        int                     count = 0;
 
        spin_lock_irqsave (&q->lock, flags);
-       skb_queue_walk_safe(q, skb, skbnext) {
+       while (!skb_queue_empty(q)) {
                struct skb_data         *entry;
                struct urb              *urb;
                int                     retval;
 
-               entry = (struct skb_data *) skb->cb;
+               skb_queue_walk(q, skb) {
+                       entry = (struct skb_data *) skb->cb;
+                       if (entry->state != unlink_start)
+                               goto found;
+               }
+               break;
+found:
+               entry->state = unlink_start;
                urb = entry->urb;
 
                /*
@@ -1033,8 +1057,7 @@ static void tx_complete (struct urb *urb)
        }
 
        usb_autopm_put_interface_async(dev->intf);
-       entry->state = tx_done;
-       defer_bh(dev, skb, &dev->txq);
+       (void) defer_bh(dev, skb, &dev->txq, tx_done);
 }
 
 /*-------------------------------------------------------------------------*/
@@ -1087,7 +1110,6 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
        entry = (struct skb_data *) skb->cb;
        entry->urb = urb;
        entry->dev = dev;
-       entry->state = tx_start;
        entry->length = length;
 
        usb_fill_bulk_urb (urb, dev->udev, dev->out,
@@ -1146,7 +1168,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                break;
        case 0:
                net->trans_start = jiffies;
-               __skb_queue_tail (&dev->txq, skb);
+               __usbnet_queue_skb(&dev->txq, skb, tx_start);
                if (dev->txq.qlen >= TX_QLEN (dev))
                        netif_stop_queue (net);
        }
diff --git a/drivers/platform/x86/sony-laptop.c 
b/drivers/platform/x86/sony-laptop.c
index bbd182e..35dae41 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -127,7 +127,7 @@ MODULE_PARM_DESC(minor,
                 "default is -1 (automatic)");
 #endif
 
-static int kbd_backlight;      /* = 1 */
+static int kbd_backlight = 1;
 module_param(kbd_backlight, int, 0444);
 MODULE_PARM_DESC(kbd_backlight,
                 "set this to 0 to disable keyboard backlight, "
diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
index ad6628c..a8fb668 100644
--- a/drivers/regulator/max8997.c
+++ b/drivers/regulator/max8997.c
@@ -688,7 +688,7 @@ static int max8997_set_voltage_buck(struct regulator_dev 
*rdev,
                }
 
                new_val++;
-       } while (desc->min + desc->step + new_val <= desc->max);
+       } while (desc->min + desc->step * new_val <= desc->max);
 
        new_idx = tmp_idx;
        new_val = tmp_val;
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 56a9f3f..168e67f 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -4037,10 +4037,10 @@ static int hpsa_request_irq(struct ctlr_info *h,
 
        if (h->msix_vector || h->msi_vector)
                rc = request_irq(h->intr[h->intr_mode], msixhandler,
-                               IRQF_DISABLED, h->devname, h);
+                               0, h->devname, h);
        else
                rc = request_irq(h->intr[h->intr_mode], intxhandler,
-                               IRQF_DISABLED, h->devname, h);
+                               IRQF_SHARED, h->devname, h);
        if (rc) {
                dev_err(&h->pdev->dev, "unable to get irq %d for %s\n",
                       h->intr[h->intr_mode], h->devname);
diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
index bfc2dc4..0b3da7c 100644
--- a/fs/ext3/ialloc.c
+++ b/fs/ext3/ialloc.c
@@ -561,8 +561,12 @@ got:
        if (IS_DIRSYNC(inode))
                handle->h_sync = 1;
        if (insert_inode_locked(inode) < 0) {
-               err = -EINVAL;
-               goto fail_drop;
+               /*
+                * Likely a bitmap corruption causing inode to be allocated
+                * twice.
+                */
+               err = -EIO;
+               goto fail;
        }
        spin_lock(&sbi->s_next_gen_lock);
        inode->i_generation = sbi->s_next_generation++;
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 21bb2f6..412469b 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -1021,8 +1021,12 @@ got:
        if (IS_DIRSYNC(inode))
                ext4_handle_sync(handle);
        if (insert_inode_locked(inode) < 0) {
-               err = -EINVAL;
-               goto fail_drop;
+               /*
+                * Likely a bitmap corruption causing inode to be allocated
+                * twice.
+                */
+               err = -EIO;
+               goto fail;
        }
        spin_lock(&sbi->s_next_gen_lock);
        inode->i_generation = sbi->s_next_generation++;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 19fe4e3..c2865cc 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -487,18 +487,19 @@ ext4_xattr_release_block(handle_t *handle, struct inode 
*inode,
                ext4_free_blocks(handle, inode, bh, 0, 1,
                                 EXT4_FREE_BLOCKS_METADATA |
                                 EXT4_FREE_BLOCKS_FORGET);
+               unlock_buffer(bh);
        } else {
                le32_add_cpu(&BHDR(bh)->h_refcount, -1);
+               if (ce)
+                       mb_cache_entry_release(ce);
+               unlock_buffer(bh);
                error = ext4_handle_dirty_metadata(handle, inode, bh);
                if (IS_SYNC(inode))
                        ext4_handle_sync(handle);
                dquot_free_block(inode, 1);
                ea_bdebug(bh, "refcount now=%d; releasing",
                          le32_to_cpu(BHDR(bh)->h_refcount));
-               if (ce)
-                       mb_cache_entry_release(ce);
        }
-       unlock_buffer(bh);
 out:
        ext4_std_error(inode->i_sb, error);
        return;
diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
index 31dce61..4bbd521 100644
--- a/fs/jffs2/gc.c
+++ b/fs/jffs2/gc.c
@@ -225,8 +225,8 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
                        return 0;
 
                D1(printk(KERN_DEBUG "No progress from erasing blocks; doing GC 
anyway\n"));
-               spin_lock(&c->erase_completion_lock);
                mutex_lock(&c->alloc_sem);
+               spin_lock(&c->erase_completion_lock);
        }
 
        /* First, work out which block we're garbage-collecting */
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 3d67302..30f6548 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1771,6 +1771,7 @@ static int _nfs4_do_open(struct inode *dir, struct path 
*path, fmode_t fmode, in
                        nfs_setattr_update_inode(state->inode, sattr);
                nfs_post_op_update_inode(state->inode, opendata->o_res.f_attr);
        }
+       nfs_revalidate_inode(server, state->inode);
        nfs4_opendata_put(opendata);
        nfs4_put_state_owner(sp);
        *res = state;
diff --git a/fs/super.c b/fs/super.c
index ab3d672..caf4dfa 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1009,6 +1009,8 @@ int freeze_super(struct super_block *sb)
                        printk(KERN_ERR
                                "VFS:Filesystem freeze failed\n");
                        sb->s_frozen = SB_UNFROZEN;
+                       smp_wmb();
+                       wake_up(&sb->s_wait_unfrozen);
                        deactivate_locked_super(sb);
                        return ret;
                }
diff --git a/include/asm-generic/statfs.h b/include/asm-generic/statfs.h
index 0fd28e0..c749af9 100644
--- a/include/asm-generic/statfs.h
+++ b/include/asm-generic/statfs.h
@@ -15,7 +15,7 @@ typedef __kernel_fsid_t       fsid_t;
  * with a 10' pole.
  */
 #ifndef __statfs_word
-#if BITS_PER_LONG == 64
+#if __BITS_PER_LONG == 64
 #define __statfs_word long
 #else
 #define __statfs_word __u32
diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
index c6db9fb..bb1fac5 100644
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -141,7 +141,7 @@ static inline unsigned __read_seqcount_begin(const 
seqcount_t *s)
        unsigned ret;
 
 repeat:
-       ret = s->sequence;
+       ret = ACCESS_ONCE(s->sequence);
        if (unlikely(ret & 1)) {
                cpu_relax();
                goto repeat;
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 605b0aa..76f4396 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -191,7 +191,8 @@ extern void usbnet_cdc_status(struct usbnet *, struct urb 
*);
 enum skb_state {
        illegal = 0,
        tx_start, tx_done,
-       rx_start, rx_done, rx_cleanup
+       rx_start, rx_done, rx_cleanup,
+       unlink_start
 };
 
 struct skb_data {      /* skb->cb is one of these */
diff --git a/init/do_mounts.c b/init/do_mounts.c
index ef6478f..8959eb3 100644
--- a/init/do_mounts.c
+++ b/init/do_mounts.c
@@ -432,7 +432,7 @@ void __init change_floppy(char *fmt, ...)
 void __init mount_root(void)
 {
 #ifdef CONFIG_ROOT_NFS
-       if (MAJOR(ROOT_DEV) == UNNAMED_MAJOR) {
+       if (ROOT_DEV == Root_NFS) {
                if (mount_nfs_root())
                        return;
 
diff --git a/kernel/compat.c b/kernel/compat.c
index fc9eb093..3507c93 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -318,25 +318,54 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t 
__user *set)
 
 #ifdef __ARCH_WANT_SYS_SIGPROCMASK
 
-asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user 
*set,
-               compat_old_sigset_t __user *oset)
+/*
+ * sys_sigprocmask SIG_SETMASK sets the first (compat) word of the
+ * blocked set of signals to the supplied signal set
+ */
+static inline void compat_sig_setmask(sigset_t *blocked, compat_sigset_word 
set)
 {
-       old_sigset_t s;
-       long ret;
-       mm_segment_t old_fs;
+       memcpy(blocked->sig, &set, sizeof(set));
+}
 
-       if (set && get_user(s, set))
-               return -EFAULT;
-       old_fs = get_fs();
-       set_fs(KERNEL_DS);
-       ret = sys_sigprocmask(how,
-                             set ? (old_sigset_t __user *) &s : NULL,
-                             oset ? (old_sigset_t __user *) &s : NULL);
-       set_fs(old_fs);
-       if (ret == 0)
-               if (oset)
-                       ret = put_user(s, oset);
-       return ret;
+asmlinkage long compat_sys_sigprocmask(int how,
+                                      compat_old_sigset_t __user *nset,
+                                      compat_old_sigset_t __user *oset)
+{
+       old_sigset_t old_set, new_set;
+       sigset_t new_blocked;
+
+       old_set = current->blocked.sig[0];
+
+       if (nset) {
+               if (get_user(new_set, nset))
+                       return -EFAULT;
+               new_set &= ~(sigmask(SIGKILL) | sigmask(SIGSTOP));
+
+               new_blocked = current->blocked;
+
+               switch (how) {
+               case SIG_BLOCK:
+                       sigaddsetmask(&new_blocked, new_set);
+                       break;
+               case SIG_UNBLOCK:
+                       sigdelsetmask(&new_blocked, new_set);
+                       break;
+               case SIG_SETMASK:
+                       compat_sig_setmask(&new_blocked, new_set);
+                       break;
+               default:
+                       return -EINVAL;
+               }
+
+               set_current_blocked(&new_blocked);
+       }
+
+       if (oset) {
+               if (put_user(old_set, oset))
+                       return -EFAULT;
+       }
+
+       return 0;
 }
 
 #endif
diff --git a/kernel/fork.c b/kernel/fork.c
index a4e453b..4712e3e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -48,6 +48,7 @@
 #include <linux/audit.h>
 #include <linux/memcontrol.h>
 #include <linux/ftrace.h>
+#include <linux/proc_fs.h>
 #include <linux/profile.h>
 #include <linux/rmap.h>
 #include <linux/ksm.h>
@@ -1378,6 +1379,8 @@ bad_fork_cleanup_io:
        if (p->io_context)
                exit_io_context(p);
 bad_fork_cleanup_namespaces:
+       if (unlikely(clone_flags & CLONE_NEWPID))
+               pid_ns_release_proc(p->nsproxy->pid_ns);
        exit_task_namespaces(p);
 bad_fork_cleanup_mm:
        if (p->mm) {
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index f7001ac..00b0abb 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2398,7 +2398,6 @@ retry_avoidcopy:
                if (outside_reserve) {
                        BUG_ON(huge_pte_none(pte));
                        if (unmap_ref_private(mm, vma, old_page, address)) {
-                               BUG_ON(page_count(old_page) != 1);
                                BUG_ON(huge_pte_none(pte));
                                spin_lock(&mm->page_table_lock);
                                goto retry_avoidcopy;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 283068f..ffb99b4 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4605,6 +4605,12 @@ static void mem_cgroup_usage_unregister_event(struct 
cgroup *cgrp,
 swap_buffers:
        /* Swap primary and spare array */
        thresholds->spare = thresholds->primary;
+       /* If all events are unregistered, free the spare array */
+       if (!new) {
+               kfree(thresholds->spare);
+               thresholds->spare = NULL;
+       }
+
        rcu_assign_pointer(thresholds->primary, new);
 
        /* To be sure that nobody uses thresholds */
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index 6e93dc7..e39e3ef 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -83,8 +83,7 @@ void __init free_bootmem_late(unsigned long addr, unsigned 
long size)
 
 static void __init __free_pages_memory(unsigned long start, unsigned long end)
 {
-       int i;
-       unsigned long start_aligned, end_aligned;
+       unsigned long i, start_aligned, end_aligned;
        int order = ilog2(BITS_PER_LONG);
 
        start_aligned = (start + (BITS_PER_LONG - 1)) & ~(BITS_PER_LONG - 1);
diff --git a/mm/percpu.c b/mm/percpu.c
index 0ae7a09..af0cc7a 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1630,6 +1630,16 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, 
size_t dyn_size,
                areas[group] = ptr;
 
                base = min(ptr, base);
+       }
+
+       /*
+        * Copy data and free unused parts.  This should happen after all
+        * allocations are complete; otherwise, we may end up with
+        * overlapping groups.
+        */
+       for (group = 0; group < ai->nr_groups; group++) {
+               struct pcpu_group_info *gi = &ai->groups[group];
+               void *ptr = areas[group];
 
                for (i = 0; i < gi->nr_units; i++, ptr += ai->unit_size) {
                        if (gi->cpu_map[i] == NR_CPUS) {
diff --git a/net/core/dev.c b/net/core/dev.c
index f134f88..1e77897 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1406,14 +1406,34 @@ EXPORT_SYMBOL(register_netdevice_notifier);
  *     register_netdevice_notifier(). The notifier is unlinked into the
  *     kernel structures and may then be reused. A negative errno code
  *     is returned on a failure.
+ *
+ *     After unregistering unregister and down device events are synthesized
+ *     for all devices on the device list to the removed notifier to remove
+ *     the need for special case cleanup code.
  */
 
 int unregister_netdevice_notifier(struct notifier_block *nb)
 {
+       struct net_device *dev;
+       struct net *net;
        int err;
 
        rtnl_lock();
        err = raw_notifier_chain_unregister(&netdev_chain, nb);
+       if (err)
+               goto unlock;
+
+       for_each_net(net) {
+               for_each_netdev(net, dev) {
+                       if (dev->flags & IFF_UP) {
+                               nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
+                               nb->notifier_call(nb, NETDEV_DOWN, dev);
+                       }
+                       nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
+                       nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
+               }
+       }
+unlock:
        rtnl_unlock();
        return err;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 80b988f..6db041d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -850,8 +850,7 @@ new_segment:
 wait_for_sndbuf:
                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-               if (copied)
-                       tcp_push(sk, flags & ~MSG_MORE, mss_now, 
TCP_NAGLE_PUSH);
+               tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
 
                if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                        goto do_error;
@@ -3221,7 +3220,7 @@ void __init tcp_init(void)
 {
        struct sk_buff *skb = NULL;
        unsigned long limit;
-       int i, max_share, cnt;
+       int i, max_rshare, max_wshare, cnt;
        unsigned long jiffy = jiffies;
 
        BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
@@ -3285,15 +3284,16 @@ void __init tcp_init(void)
 
        /* Set per-socket limits to no more than 1/128 the pressure threshold */
        limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
-       max_share = min(4UL*1024*1024, limit);
+       max_wshare = min(4UL*1024*1024, limit);
+       max_rshare = min(6UL*1024*1024, limit);
 
        sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
        sysctl_tcp_wmem[1] = 16*1024;
-       sysctl_tcp_wmem[2] = max(64*1024, max_share);
+       sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
 
        sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
        sysctl_tcp_rmem[1] = 87380;
-       sysctl_tcp_rmem[2] = max(87380, max_share);
+       sysctl_tcp_rmem[2] = max(87380, max_rshare);
 
        printk(KERN_INFO "TCP: Hash tables configured "
               "(established %u bind %u)\n",
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c3a9f03..7410a8c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -83,7 +83,7 @@ int sysctl_tcp_ecn __read_mostly = 2;
 EXPORT_SYMBOL(sysctl_tcp_ecn);
 int sysctl_tcp_dsack __read_mostly = 1;
 int sysctl_tcp_app_win __read_mostly = 31;
-int sysctl_tcp_adv_win_scale __read_mostly = 2;
+int sysctl_tcp_adv_win_scale __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 int sysctl_tcp_stdurg __read_mostly;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 858ca23..ea52d02 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -441,8 +441,9 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock 
*sk, struct msghdr *m
 
                daddr = lip->l2tp_addr.s_addr;
        } else {
+               rc = -EDESTADDRREQ;
                if (sk->sk_state != TCP_ESTABLISHED)
-                       return -EDESTADDRREQ;
+                       goto out;
 
                daddr = inet->inet_daddr;
                connected = 1;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 2f68459..945f3dd 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -350,10 +350,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc 
*sch)
        if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
                if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
                    (skb->ip_summed == CHECKSUM_PARTIAL &&
-                    skb_checksum_help(skb))) {
-                       sch->qstats.drops++;
-                       return NET_XMIT_DROP;
-               }
+                    skb_checksum_help(skb)))
+                       return qdisc_drop(skb, sch);
 
                skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() 
% 8);
        }
diff --git a/sound/pci/echoaudio/echoaudio_dsp.c 
b/sound/pci/echoaudio/echoaudio_dsp.c
index 64417a7..d8c670c 100644
--- a/sound/pci/echoaudio/echoaudio_dsp.c
+++ b/sound/pci/echoaudio/echoaudio_dsp.c
@@ -475,7 +475,7 @@ static int load_firmware(struct echoaudio *chip)
        const struct firmware *fw;
        int box_type, err;
 
-       if (snd_BUG_ON(!chip->dsp_code_to_load || !chip->comm_page))
+       if (snd_BUG_ON(!chip->comm_page))
                return -EPERM;
 
        /* See if the ASIC is present and working - only if the DSP is already 
loaded */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 981b6fd..c5c9788 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -702,11 +702,13 @@ static unsigned int azx_rirb_get_response(struct hda_bus 
*bus,
 {
        struct azx *chip = bus->private_data;
        unsigned long timeout;
+       unsigned long loopcounter;
        int do_poll = 0;
 
  again:
        timeout = jiffies + msecs_to_jiffies(1000);
-       for (;;) {
+
+       for (loopcounter = 0;; loopcounter++) {
                if (chip->polling_mode || do_poll) {
                        spin_lock_irq(&chip->reg_lock);
                        azx_update_rirb(chip);
@@ -722,7 +724,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus 
*bus,
                }
                if (time_after(jiffies, timeout))
                        break;
-               if (bus->needs_damn_long_delay)
+               if (bus->needs_damn_long_delay || loopcounter > 3000)
                        msleep(2); /* temporary workaround */
                else {
                        udelay(10);
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to