38 files changed, 519 insertions, 291 deletions

diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index a1725e6488d..7888501ad9e 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -1341,7 +1341,7 @@ static struct request *set_next_request(void)
 {
         struct request_queue *q;
         int cnt = FD_MAX_UNITS;
-        struct request *rq;
+        struct request *rq = NULL;
 
         /* Find next queue we can dispatch from */
         fdc_queue = fdc_queue + 1;
diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
index 4e4cc6c828c..605a67e40bb 100644
--- a/drivers/block/ataflop.c
+++ b/drivers/block/ataflop.c
@@ -1399,7 +1399,7 @@ static struct request *set_next_request(void)
 {
         struct request_queue *q;
         int old_pos = fdc_queue;
-        struct request *rq;
+        struct request *rq = NULL;
 
         do {
                 q = unit[fdc_queue].disk->queue;
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index a67d0a611a8..f291587d753 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -66,6 +66,7 @@ MODULE_VERSION("3.6.26");
 MODULE_LICENSE("GPL");
 
 static DEFINE_MUTEX(cciss_mutex);
+static struct proc_dir_entry *proc_cciss;
 
 #include "cciss_cmd.h"
 #include "cciss.h"
@@ -363,8 +364,6 @@ static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
 #define ENG_GIG_FACTOR (ENG_GIG/512)
 #define ENGAGE_SCSI     "engage scsi"
 
-static struct proc_dir_entry *proc_cciss;
-
 static void cciss_seq_show_header(struct seq_file *seq)
 {
         ctlr_info_t *h = seq->private;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 255035cfc88..4f9e22f2913 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -65,7 +65,7 @@ enum blkif_state {
 
 struct blk_shadow {
         struct blkif_request req;
-        unsigned long request;
+        struct request *request;
         unsigned long frame[BLKIF_MAX_SEGMENTS_PER_REQUEST];
 };
 
@@ -136,7 +136,7 @@ static void add_id_to_freelist(struct blkfront_info *info,
                                unsigned long id)
 {
         info->shadow[id].req.id  = info->shadow_free;
-        info->shadow[id].request = 0;
+        info->shadow[id].request = NULL;
         info->shadow_free = id;
 }
 
@@ -245,14 +245,11 @@ static int blkif_ioctl(struct block_device *bdev, fmode_t mode,
 }
 
 /*
- * blkif_queue_request
+ * Generate a Xen blkfront IO request from a blk layer request.  Reads
+ * and writes are handled as expected.  Since we lack a loose flush
+ * request, we map flushes into a full ordered barrier.
  *
- * request block io
- *
- * id: for guest use only.
- * operation: BLKIF_OP_{READ,WRITE,PROBE}
- * buffer: buffer to read/write into. this should be a
- *   virtual address in the guest os.
+ * @req: a request struct
  */
 static int blkif_queue_request(struct request *req)
 {
@@ -281,7 +278,7 @@ static int blkif_queue_request(struct request *req)
         /* Fill out a communications ring structure. */
         ring_req = RING_GET_REQUEST(&info->ring, info->ring.req_prod_pvt);
         id = get_id_from_freelist(info);
-        info->shadow[id].request = (unsigned long)req;
+        info->shadow[id].request = req;
 
         ring_req->id = id;
         ring_req->sector_number = (blkif_sector_t)blk_rq_pos(req);
@@ -290,6 +287,18 @@ static int blkif_queue_request(struct request *req)
         ring_req->operation = rq_data_dir(req) ?
                 BLKIF_OP_WRITE : BLKIF_OP_READ;
 
+        if (req->cmd_flags & (REQ_FLUSH | REQ_FUA)) {
+                /*
+                 * Ideally we could just do an unordered
+                 * flush-to-disk, but all we have is a full write
+                 * barrier at the moment.  However, a barrier write is
+                 * a superset of FUA, so we can implement it the same
+                 * way.  (It's also a FLUSH+FUA, since it is
+                 * guaranteed ordered WRT previous writes.)
+                 */
+                ring_req->operation = BLKIF_OP_WRITE_BARRIER;
+        }
+
         ring_req->nr_segments = blk_rq_map_sg(req->q, req, info->sg);
         BUG_ON(ring_req->nr_segments > BLKIF_MAX_SEGMENTS_PER_REQUEST);
 
@@ -634,7 +643,7 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
 
                 bret = RING_GET_RESPONSE(&info->ring, i);
                 id   = bret->id;
-                req  = (struct request *)info->shadow[id].request;
+                req  = info->shadow[id].request;
 
                 blkif_completion(&info->shadow[id]);
 
@@ -647,6 +656,16 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
                                 printk(KERN_WARNING "blkfront: %s: write barrier op failed\n",
                                        info->gd->disk_name);
                                 error = -EOPNOTSUPP;
+                        }
+                        if (unlikely(bret->status == BLKIF_RSP_ERROR &&
+                                     info->shadow[id].req.nr_segments == 0)) {
+                                printk(KERN_WARNING "blkfront: %s: empty write barrier op failed\n",
+                                       info->gd->disk_name);
+                                error = -EOPNOTSUPP;
+                        }
+                        if (unlikely(error)) {
+                                if (error == -EOPNOTSUPP)
+                                        error = 0;
                                 info->feature_flush = 0;
                                 xlvbd_flush(info);
                         }
@@ -899,7 +918,7 @@ static int blkif_recover(struct blkfront_info *info)
         /* Stage 3: Find pending requests and requeue them. */
         for (i = 0; i < BLK_RING_SIZE; i++) {
                 /* Not in use? */
-                if (copy[i].request == 0)
+                if (!copy[i].request)
                         continue;
 
                 /* Grab a request slot and copy shadow state into it. */
@@ -916,9 +935,7 @@ static int blkif_recover(struct blkfront_info *info)
                                 req->seg[j].gref,
                                 info->xbdev->otherend_id,
                                 pfn_to_mfn(info->shadow[req->id].frame[j]),
-                                rq_data_dir(
-                                        (struct request *)
-                                        info->shadow[req->id].request));
+                                rq_data_dir(info->shadow[req->id].request));
                 info->shadow[req->id].req = *req;
 
                 info->ring.req_prod_pvt++;
@@ -1067,14 +1084,8 @@ static void blkfront_connect(struct blkfront_info *info)
          */
         info->feature_flush = 0;
 
-        /*
-         * The driver doesn't properly handled empty flushes, so
-         * lets disable barrier support for now.
-         */
-#if 0
         if (!err && barrier)
-                info->feature_flush = REQ_FLUSH;
-#endif
+                info->feature_flush = REQ_FLUSH | REQ_FUA;
 
         err = xlvbd_alloc_gendisk(sectors, info, binfo, sector_size);
         if (err) {
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 1030f842013..c17a305ecb2 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/wait.h>
+#include <linux/acpi.h>
 #include "tpm.h"
 
 #define TPM_HEADER_SIZE 10
@@ -78,6 +79,26 @@ enum tis_defaults {
 static LIST_HEAD(tis_chips);
 static DEFINE_SPINLOCK(tis_lock);
 
+#ifdef CONFIG_ACPI
+static int is_itpm(struct pnp_dev *dev)
+{
+        struct acpi_device *acpi = pnp_acpi_device(dev);
+        struct acpi_hardware_id *id;
+
+        list_for_each_entry(id, &acpi->pnp.ids, list) {
+                if (!strcmp("INTC0102", id->id))
+                        return 1;
+        }
+
+        return 0;
+}
+#else
+static int is_itpm(struct pnp_dev *dev)
+{
+        return 0;
+}
+#endif
+
 static int check_locality(struct tpm_chip *chip, int l)
 {
         if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
@@ -472,6 +493,9 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
                  "1.2 TPM (device-id 0x%X, rev-id %d)\n",
                  vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
 
+        if (is_itpm(to_pnp_dev(dev)))
+                itpm = 1;
+
         if (itpm)
                 dev_info(dev, "Intel iTPM workaround enabled\n");
 
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index b3781399b38..ba2898b3639 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -10,16 +10,16 @@ obj-$(CONFIG_EDAC)			:= edac_stub.o
 obj-$(CONFIG_EDAC_MM_EDAC)              += edac_core.o
 obj-$(CONFIG_EDAC_MCE)                  += edac_mce.o
 
-edac_core-objs  := edac_mc.o edac_device.o edac_mc_sysfs.o edac_pci_sysfs.o
-edac_core-objs  += edac_module.o edac_device_sysfs.o
+edac_core-y     := edac_mc.o edac_device.o edac_mc_sysfs.o edac_pci_sysfs.o
+edac_core-y     += edac_module.o edac_device_sysfs.o
 
 ifdef CONFIG_PCI
-edac_core-objs  += edac_pci.o edac_pci_sysfs.o
+edac_core-y     += edac_pci.o edac_pci_sysfs.o
 endif
 
 obj-$(CONFIG_EDAC_MCE_INJ)              += mce_amd_inj.o
 
-edac_mce_amd-objs                       := mce_amd.o
+edac_mce_amd-y                          := mce_amd.o
 obj-$(CONFIG_EDAC_DECODE_MCE)           += edac_mce_amd.o
 
 obj-$(CONFIG_EDAC_AMD76X)               += amd76x_edac.o
diff --git a/drivers/edac/mce_amd_inj.c b/drivers/edac/mce_amd_inj.c
index 8d0688f36d4..39faded3cad 100644
--- a/drivers/edac/mce_amd_inj.c
+++ b/drivers/edac/mce_amd_inj.c
@@ -139,7 +139,7 @@ static int __init edac_init_mce_inject(void)
         return 0;
 
 err_sysfs_create:
-        while (i-- >= 0)
+        while (--i >= 0)
                 sysfs_remove_file(mce_kobj, &sysfs_attrs[i]->attr);
 
         kobject_del(mce_kobj);
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 18fdd9703b4..1a467a91fb0 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/bug.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/firewire.h>
 #include <linux/firewire-constants.h>
@@ -26,8 +27,14 @@
 #include <asm/unaligned.h>
 #include <net/arp.h>
 
-#define FWNET_MAX_FRAGMENTS     25      /* arbitrary limit */
-#define FWNET_ISO_PAGE_COUNT    (PAGE_SIZE < 16 * 1024 ? 4 : 2)
+/* rx limits */
+#define FWNET_MAX_FRAGMENTS             30 /* arbitrary, > TX queue depth */
+#define FWNET_ISO_PAGE_COUNT            (PAGE_SIZE < 16*1024 ? 4 : 2)
+
+/* tx limits */
+#define FWNET_MAX_QUEUED_DATAGRAMS      20 /* < 64 = number of tlabels */
+#define FWNET_MIN_QUEUED_DATAGRAMS      10 /* should keep AT DMA busy enough */
+#define FWNET_TX_QUEUE_LEN              FWNET_MAX_QUEUED_DATAGRAMS /* ? */
 
 #define IEEE1394_BROADCAST_CHANNEL      31
 #define IEEE1394_ALL_NODES              (0xffc0 | 0x003f)
@@ -169,15 +176,8 @@ struct fwnet_device {
         struct fw_address_handler handler;
         u64 local_fifo;
 
-        /* List of packets to be sent */
-        struct list_head packet_list;
-        /*
-         * List of packets that were broadcasted.  When we get an ISO interrupt
-         * one of them has been sent
-         */
-        struct list_head broadcasted_list;
-        /* List of packets that have been sent but not yet acked */
-        struct list_head sent_list;
+        /* Number of tx datagrams that have been queued but not yet acked */
+        int queued_datagrams;
 
         struct list_head peer_list;
         struct fw_card *card;
@@ -195,7 +195,7 @@ struct fwnet_peer {
         unsigned pdg_size;        /* pd_list size */
 
         u16 datagram_label;       /* outgoing datagram label */
-        unsigned max_payload;     /* includes RFC2374_FRAG_HDR_SIZE overhead */
+        u16 max_payload;          /* includes RFC2374_FRAG_HDR_SIZE overhead */
         int node_id;
         int generation;
         unsigned speed;
@@ -203,22 +203,18 @@ struct fwnet_peer {
 
 /* This is our task struct. It's used for the packet complete callback.  */
 struct fwnet_packet_task {
-        /*
-         * ptask can actually be on dev->packet_list, dev->broadcasted_list,
-         * or dev->sent_list depending on its current state.
-         */
-        struct list_head pt_link;
         struct fw_transaction transaction;
         struct rfc2734_header hdr;
         struct sk_buff *skb;
         struct fwnet_device *dev;
 
         int outstanding_pkts;
-        unsigned max_payload;
         u64 fifo_addr;
         u16 dest_node;
+        u16 max_payload;
         u8 generation;
         u8 speed;
+        u8 enqueued;
 };
 
 /*
@@ -650,8 +646,6 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
                 net->stats.rx_packets++;
                 net->stats.rx_bytes += skb->len;
         }
-        if (netif_queue_stopped(net))
-                netif_wake_queue(net);
 
         return 0;
 
@@ -660,8 +654,6 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
         net->stats.rx_dropped++;
 
         dev_kfree_skb_any(skb);
-        if (netif_queue_stopped(net))
-                netif_wake_queue(net);
 
         return -ENOENT;
 }
@@ -793,15 +785,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
          * Datagram is not complete, we're done for the
          * moment.
          */
-        spin_unlock_irqrestore(&dev->lock, flags);
-
-        return 0;
+        retval = 0;
  fail:
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        if (netif_queue_stopped(net))
-                netif_wake_queue(net);
-
         return retval;
 }
 
@@ -901,11 +888,19 @@ static void fwnet_free_ptask(struct fwnet_packet_task *ptask)
         kmem_cache_free(fwnet_packet_task_cache, ptask);
 }
 
+/* Caller must hold dev->lock. */
+static void dec_queued_datagrams(struct fwnet_device *dev)
+{
+        if (--dev->queued_datagrams == FWNET_MIN_QUEUED_DATAGRAMS)
+                netif_wake_queue(dev->netdev);
+}
+
 static int fwnet_send_packet(struct fwnet_packet_task *ptask);
 
 static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
 {
         struct fwnet_device *dev = ptask->dev;
+        struct sk_buff *skb = ptask->skb;
         unsigned long flags;
         bool free;
 
@@ -914,10 +909,14 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
         ptask->outstanding_pkts--;
 
         /* Check whether we or the networking TX soft-IRQ is last user. */
-        free = (ptask->outstanding_pkts == 0 && !list_empty(&ptask->pt_link));
+        free = (ptask->outstanding_pkts == 0 && ptask->enqueued);
+        if (free)
+                dec_queued_datagrams(dev);
 
-        if (ptask->outstanding_pkts == 0)
-                list_del(&ptask->pt_link);
+        if (ptask->outstanding_pkts == 0) {
+                dev->netdev->stats.tx_packets++;
+                dev->netdev->stats.tx_bytes += skb->len;
+        }
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
@@ -926,7 +925,6 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                 u16 fg_off;
                 u16 datagram_label;
                 u16 lf;
-                struct sk_buff *skb;
 
                 /* Update the ptask to point to the next fragment and send it */
                 lf = fwnet_get_hdr_lf(&ptask->hdr);
@@ -953,7 +951,7 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                         datagram_label = fwnet_get_hdr_dgl(&ptask->hdr);
                         break;
                 }
-                skb = ptask->skb;
+
                 skb_pull(skb, ptask->max_payload);
                 if (ptask->outstanding_pkts > 1) {
                         fwnet_make_sf_hdr(&ptask->hdr, RFC2374_HDR_INTFRAG,
@@ -970,6 +968,31 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                 fwnet_free_ptask(ptask);
 }
 
+static void fwnet_transmit_packet_failed(struct fwnet_packet_task *ptask)
+{
+        struct fwnet_device *dev = ptask->dev;
+        unsigned long flags;
+        bool free;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* One fragment failed; don't try to send remaining fragments. */
+        ptask->outstanding_pkts = 0;
+
+        /* Check whether we or the networking TX soft-IRQ is last user. */
+        free = ptask->enqueued;
+        if (free)
+                dec_queued_datagrams(dev);
+
+        dev->netdev->stats.tx_dropped++;
+        dev->netdev->stats.tx_errors++;
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        if (free)
+                fwnet_free_ptask(ptask);
+}
+
 static void fwnet_write_complete(struct fw_card *card, int rcode,
                                  void *payload, size_t length, void *data)
 {
@@ -977,11 +1000,12 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
 
         ptask = data;
 
-        if (rcode == RCODE_COMPLETE)
+        if (rcode == RCODE_COMPLETE) {
                 fwnet_transmit_packet_done(ptask);
-        else
+        } else {
                 fw_error("fwnet_write_complete: failed: %x\n", rcode);
-                /* ??? error recovery */
+                fwnet_transmit_packet_failed(ptask);
+        }
 }
 
 static int fwnet_send_packet(struct fwnet_packet_task *ptask)
@@ -1039,9 +1063,11 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
                 spin_lock_irqsave(&dev->lock, flags);
 
                 /* If the AT tasklet already ran, we may be last user. */
-                free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+                free = (ptask->outstanding_pkts == 0 && !ptask->enqueued);
                 if (!free)
-                        list_add_tail(&ptask->pt_link, &dev->broadcasted_list);
+                        ptask->enqueued = true;
+                else
+                        dec_queued_datagrams(dev);
 
                 spin_unlock_irqrestore(&dev->lock, flags);
 
@@ -1056,9 +1082,11 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
         spin_lock_irqsave(&dev->lock, flags);
 
         /* If the AT tasklet already ran, we may be last user. */
-        free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+        free = (ptask->outstanding_pkts == 0 && !ptask->enqueued);
         if (!free)
-                list_add_tail(&ptask->pt_link, &dev->sent_list);
+                ptask->enqueued = true;
+        else
+                dec_queued_datagrams(dev);
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
@@ -1224,6 +1252,15 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
         struct fwnet_peer *peer;
         unsigned long flags;
 
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* Can this happen? */
+        if (netif_queue_stopped(dev->netdev)) {
+                spin_unlock_irqrestore(&dev->lock, flags);
+
+                return NETDEV_TX_BUSY;
+        }
+
         ptask = kmem_cache_alloc(fwnet_packet_task_cache, GFP_ATOMIC);
         if (ptask == NULL)
                 goto fail;
@@ -1242,9 +1279,6 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
         proto = hdr_buf.h_proto;
         dg_size = skb->len;
 
-        /* serialize access to peer, including peer->datagram_label */
-        spin_lock_irqsave(&dev->lock, flags);
-
         /*
          * Set the transmission type for the packet.  ARP packets and IP
          * broadcast packets are sent via GASP.
@@ -1266,7 +1300,7 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
 
                 peer = fwnet_peer_find_by_guid(dev, be64_to_cpu(guid));
                 if (!peer || peer->fifo == FWNET_NO_FIFO_ADDR)
-                        goto fail_unlock;
+                        goto fail;
 
                 generation         = peer->generation;
                 dest_node          = peer->node_id;
@@ -1320,18 +1354,21 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
                 max_payload += RFC2374_FRAG_HDR_SIZE;
         }
 
+        if (++dev->queued_datagrams == FWNET_MAX_QUEUED_DATAGRAMS)
+                netif_stop_queue(dev->netdev);
+
         spin_unlock_irqrestore(&dev->lock, flags);
 
         ptask->max_payload = max_payload;
-        INIT_LIST_HEAD(&ptask->pt_link);
+        ptask->enqueued    = 0;
 
         fwnet_send_packet(ptask);
 
         return NETDEV_TX_OK;
 
- fail_unlock:
-        spin_unlock_irqrestore(&dev->lock, flags);
  fail:
+        spin_unlock_irqrestore(&dev->lock, flags);
+
         if (ptask)
                 kmem_cache_free(fwnet_packet_task_cache, ptask);
 
@@ -1377,7 +1414,7 @@ static void fwnet_init_dev(struct net_device *net)
         net->addr_len           = FWNET_ALEN;
         net->hard_header_len    = FWNET_HLEN;
         net->type               = ARPHRD_IEEE1394;
-        net->tx_queue_len       = 10;
+        net->tx_queue_len       = FWNET_TX_QUEUE_LEN;
 }
 
 /* caller must hold fwnet_device_mutex */
@@ -1457,14 +1494,9 @@ static int fwnet_probe(struct device *_dev)
         dev->broadcast_rcv_context = NULL;
         dev->broadcast_xmt_max_payload = 0;
         dev->broadcast_xmt_datagramlabel = 0;
-
         dev->local_fifo = FWNET_NO_FIFO_ADDR;
-
-        INIT_LIST_HEAD(&dev->packet_list);
-        INIT_LIST_HEAD(&dev->broadcasted_list);
-        INIT_LIST_HEAD(&dev->sent_list);
+        dev->queued_datagrams = 0;
         INIT_LIST_HEAD(&dev->peer_list);
-
         dev->card = card;
         dev->netdev = net;
 
@@ -1522,7 +1554,7 @@ static int fwnet_remove(struct device *_dev)
         struct fwnet_peer *peer = dev_get_drvdata(_dev);
         struct fwnet_device *dev = peer->dev;
         struct net_device *net;
-        struct fwnet_packet_task *ptask, *pt_next;
+        int i;
 
         mutex_lock(&fwnet_device_mutex);
 
@@ -1540,21 +1572,9 @@ static int fwnet_remove(struct device *_dev)
                                               dev->card);
                         fw_iso_context_destroy(dev->broadcast_rcv_context);
                 }
-                list_for_each_entry_safe(ptask, pt_next,
-                                         &dev->packet_list, pt_link) {
-                        dev_kfree_skb_any(ptask->skb);
-                        kmem_cache_free(fwnet_packet_task_cache, ptask);
-                }
-                list_for_each_entry_safe(ptask, pt_next,
-                                         &dev->broadcasted_list, pt_link) {
-                        dev_kfree_skb_any(ptask->skb);
-                        kmem_cache_free(fwnet_packet_task_cache, ptask);
-                }
-                list_for_each_entry_safe(ptask, pt_next,
-                                         &dev->sent_list, pt_link) {
-                        dev_kfree_skb_any(ptask->skb);
-                        kmem_cache_free(fwnet_packet_task_cache, ptask);
-                }
+                for (i = 0; dev->queued_datagrams && i < 5; i++)
+                        ssleep(1);
+                WARN_ON(dev->queued_datagrams);
                 list_del(&dev->dev_link);
 
                 free_netdev(net);
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 2e847a90bad..f2b5bab5e6a 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1627,7 +1627,7 @@ __setup("icn=", icn_setup);
 static int __init icn_init(void)
 {
         char *p;
-        char rev[10];
+        char rev[20];
 
         memset(&dev, 0, sizeof(icn_dev));
         dev.memaddr = (membase & 0x0ffc000);
@@ -1637,9 +1637,10 @@ static int __init icn_init(void)
         spin_lock_init(&dev.devlock);
 
         if ((p = strchr(revision, ':'))) {
-                strcpy(rev, p + 1);
+                strncpy(rev, p + 1, 20);
                 p = strchr(rev, '$');
-                *p = 0;
+                if (p)
+                        *p = 0;
         } else
                 strcpy(rev, " ??? ");
         printk(KERN_NOTICE "ICN-ISDN-driver Rev%smem=0x%08lx\n", rev,
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 8f86d702e46..31ae07a3657 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1559,7 +1559,7 @@ void mmc_stop_host(struct mmc_host *host)
 
         if (host->caps & MMC_CAP_DISABLE)
                 cancel_delayed_work(&host->disable);
-        cancel_delayed_work(&host->detect);
+        cancel_delayed_work_sync(&host->detect);
         mmc_flush_scheduled_work();
 
         /* clear pm flags now and let card drivers set them as needed */
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 995261f7fd7..77f93c3b880 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -375,7 +375,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
         struct mmc_card *oldcard)
 {
         struct mmc_card *card;
-        int err, ddr = MMC_SDR_MODE;
+        int err, ddr = 0;
         u32 cid[4];
         unsigned int max_dtr;
 
@@ -562,7 +562,11 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                                1 << bus_width, ddr);
                         err = 0;
                 } else {
-                        mmc_card_set_ddr_mode(card);
+                        if (ddr)
+                                mmc_card_set_ddr_mode(card);
+                        else
+                                ddr = MMC_SDR_MODE;
+
                         mmc_set_bus_width_ddr(card->host, bus_width, ddr);
                 }
         }
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index c3ad1058cd3..efef5f94ac4 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -547,9 +547,11 @@ static void mmc_sdio_detect(struct mmc_host *host)
         BUG_ON(!host->card);
 
         /* Make sure card is powered before detecting it */
-        err = pm_runtime_get_sync(&host->card->dev);
-        if (err < 0)
-                goto out;
+        if (host->caps & MMC_CAP_POWER_OFF_CARD) {
+                err = pm_runtime_get_sync(&host->card->dev);
+                if (err < 0)
+                        goto out;
+        }
 
         mmc_claim_host(host);
 
@@ -560,6 +562,20 @@ static void mmc_sdio_detect(struct mmc_host *host)
 
         mmc_release_host(host);
 
+        /*
+         * Tell PM core it's OK to power off the card now.
+         *
+         * The _sync variant is used in order to ensure that the card
+         * is left powered off in case an error occurred, and the card
+         * is going to be removed.
+         *
+         * Since there is no specific reason to believe a new user
+         * is about to show up at this point, the _sync variant is
+         * desirable anyway.
+         */
+        if (host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_put_sync(&host->card->dev);
+
 out:
         if (err) {
                 mmc_sdio_remove(host);
@@ -568,9 +584,6 @@ out:
                 mmc_detach_bus(host);
                 mmc_release_host(host);
         }
-
-        /* Tell PM core that we're done */
-        pm_runtime_put(&host->card->dev);
 }
 
 /*
@@ -718,16 +731,21 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr)
         card = host->card;
 
         /*
-         * Let runtime PM core know our card is active
+         * Enable runtime PM only if supported by host+card+board
          */
-        err = pm_runtime_set_active(&card->dev);
-        if (err)
-                goto remove;
+        if (host->caps & MMC_CAP_POWER_OFF_CARD) {
+                /*
+                 * Let runtime PM core know our card is active
+                 */
+                err = pm_runtime_set_active(&card->dev);
+                if (err)
+                        goto remove;
 
-        /*
-         * Enable runtime PM for this card
-         */
-        pm_runtime_enable(&card->dev);
+                /*
+                 * Enable runtime PM for this card
+                 */
+                pm_runtime_enable(&card->dev);
+        }
 
         /*
          * The number of functions on the card is encoded inside
@@ -745,9 +763,10 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr)
                         goto remove;
 
                 /*
-                 * Enable Runtime PM for this func
+                 * Enable Runtime PM for this func (if supported)
                  */
-                pm_runtime_enable(&card->sdio_func[i]->dev);
+                if (host->caps & MMC_CAP_POWER_OFF_CARD)
+                        pm_runtime_enable(&card->sdio_func[i]->dev);
         }
 
         mmc_release_host(host);
diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index 2716c7ab6bb..203da443e33 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -17,6 +17,7 @@
 #include <linux/pm_runtime.h>
 
 #include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
 #include <linux/mmc/sdio_func.h>
 
 #include "sdio_cis.h"
@@ -132,9 +133,11 @@ static int sdio_bus_probe(struct device *dev)
          * it should call pm_runtime_put_noidle() in its probe routine and
          * pm_runtime_get_noresume() in its remove routine.
          */
-        ret = pm_runtime_get_sync(dev);
-        if (ret < 0)
-                goto out;
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD) {
+                ret = pm_runtime_get_sync(dev);
+                if (ret < 0)
+                        goto out;
+        }
 
         /* Set the default block size so the driver is sure it's something
          * sensible. */
@@ -151,7 +154,8 @@ static int sdio_bus_probe(struct device *dev)
         return 0;
 
 disable_runtimepm:
-        pm_runtime_put_noidle(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_put_noidle(dev);
 out:
         return ret;
 }
@@ -160,12 +164,14 @@ static int sdio_bus_remove(struct device *dev)
 {
         struct sdio_driver *drv = to_sdio_driver(dev->driver);
         struct sdio_func *func = dev_to_sdio_func(dev);
-        int ret;
+        int ret = 0;
 
         /* Make sure card is powered before invoking ->remove() */
-        ret = pm_runtime_get_sync(dev);
-        if (ret < 0)
-                goto out;
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD) {
+                ret = pm_runtime_get_sync(dev);
+                if (ret < 0)
+                        goto out;
+        }
 
         drv->remove(func);
 
@@ -178,10 +184,12 @@ static int sdio_bus_remove(struct device *dev)
         }
 
         /* First, undo the increment made directly above */
-        pm_runtime_put_noidle(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_put_noidle(dev);
 
         /* Then undo the runtime PM settings in sdio_bus_probe() */
-        pm_runtime_put_noidle(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_put_noidle(dev);
 
 out:
         return ret;
@@ -191,6 +199,8 @@ out:
 
 static int sdio_bus_pm_prepare(struct device *dev)
 {
+        struct sdio_func *func = dev_to_sdio_func(dev);
+
         /*
          * Resume an SDIO device which was suspended at run time at this
          * point, in order to allow standard SDIO suspend/resume paths
@@ -212,7 +222,8 @@ static int sdio_bus_pm_prepare(struct device *dev)
          * since there is little point in failing system suspend if a
          * device can't be resumed.
          */
-        pm_runtime_resume(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_resume(dev);
 
         return 0;
 }
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 82a1079bbdc..5d46021cbb5 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1002,7 +1002,7 @@ static inline void omap_hsmmc_reset_controller_fsm(struct omap_hsmmc_host *host,
          * Monitor a 0->1 transition first
          */
         if (mmc_slot(host).features & HSMMC_HAS_UPDATED_RESET) {
-                while ((!(OMAP_HSMMC_READ(host, SYSCTL) & bit))
+                while ((!(OMAP_HSMMC_READ(host->base, SYSCTL) & bit))
                                         && (i++ < limit))
                         cpu_relax();
         }
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 2e9cca19c90..9b82910b9db 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -17,6 +17,7 @@
 #include <linux/clk.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/sdhci-pltfm.h>
+#include <mach/hardware.h>
 #include "sdhci.h"
 #include "sdhci-pltfm.h"
 #include "sdhci-esdhc.h"
@@ -112,6 +113,13 @@ static int esdhc_pltfm_init(struct sdhci_host *host, struct sdhci_pltfm_data *pd
         clk_enable(clk);
         pltfm_host->clk = clk;
 
+        if (cpu_is_mx35() || cpu_is_mx51())
+                host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
+
+        /* Fix errata ENGcm07207 which is present on i.MX25 and i.MX35 */
+        if (cpu_is_mx25() || cpu_is_mx35())
+                host->quirks |= SDHCI_QUIRK_NO_MULTIBLOCK;
+
         return 0;
 }
 
@@ -133,10 +141,8 @@ static struct sdhci_ops sdhci_esdhc_ops = {
 };
 
 struct sdhci_pltfm_data sdhci_esdhc_imx_pdata = {
-        .quirks = ESDHC_DEFAULT_QUIRKS | SDHCI_QUIRK_NO_MULTIBLOCK
-                        | SDHCI_QUIRK_BROKEN_ADMA,
+        .quirks = ESDHC_DEFAULT_QUIRKS | SDHCI_QUIRK_BROKEN_ADMA,
         /* ADMA has issues. Might be fixable */
-        /* NO_MULTIBLOCK might be MX35 only (Errata: ENGcm07207) */
         .ops = &sdhci_esdhc_ops,
         .init = esdhc_pltfm_init,
         .exit = esdhc_pltfm_exit,
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 55746bac2f4..3d9c2460d43 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -149,11 +149,11 @@ static const struct sdhci_pci_fixes sdhci_cafe = {
  * ADMA operation is disabled for Moorestown platform due to
  * hardware bugs.
  */
-static int mrst_hc1_probe(struct sdhci_pci_chip *chip)
+static int mrst_hc_probe(struct sdhci_pci_chip *chip)
 {
         /*
-         * slots number is fixed here for MRST as SDIO3 is never used and has
-         * hardware bugs.
+         * slots number is fixed here for MRST as SDIO3/5 are never used and
+         * have hardware bugs.
          */
         chip->num_slots = 1;
         return 0;
@@ -163,9 +163,9 @@ static const struct sdhci_pci_fixes sdhci_intel_mrst_hc0 = {
         .quirks         = SDHCI_QUIRK_BROKEN_ADMA | SDHCI_QUIRK_NO_HISPD_BIT,
 };
 
-static const struct sdhci_pci_fixes sdhci_intel_mrst_hc1 = {
+static const struct sdhci_pci_fixes sdhci_intel_mrst_hc1_hc2 = {
         .quirks         = SDHCI_QUIRK_BROKEN_ADMA | SDHCI_QUIRK_NO_HISPD_BIT,
-        .probe          = mrst_hc1_probe,
+        .probe          = mrst_hc_probe,
 };
 
 static const struct sdhci_pci_fixes sdhci_intel_mfd_sd = {
@@ -538,7 +538,15 @@ static const struct pci_device_id pci_ids[] __devinitdata = {
                 .device         = PCI_DEVICE_ID_INTEL_MRST_SD1,
                 .subvendor      = PCI_ANY_ID,
                 .subdevice      = PCI_ANY_ID,
-                .driver_data    = (kernel_ulong_t)&sdhci_intel_mrst_hc1,
+                .driver_data    = (kernel_ulong_t)&sdhci_intel_mrst_hc1_hc2,
+        },
+
+        {
+                .vendor         = PCI_VENDOR_ID_INTEL,
+                .device         = PCI_DEVICE_ID_INTEL_MRST_SD2,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .driver_data    = (kernel_ulong_t)&sdhci_intel_mrst_hc1_hc2,
         },
 
         {
@@ -637,6 +645,7 @@ static int sdhci_pci_suspend (struct pci_dev *pdev, pm_message_t state)
 {
         struct sdhci_pci_chip *chip;
         struct sdhci_pci_slot *slot;
+        mmc_pm_flag_t slot_pm_flags;
         mmc_pm_flag_t pm_flags = 0;
         int i, ret;
 
@@ -657,7 +666,11 @@ static int sdhci_pci_suspend (struct pci_dev *pdev, pm_message_t state)
                         return ret;
                 }
 
-                pm_flags |= slot->host->mmc->pm_flags;
+                slot_pm_flags = slot->host->mmc->pm_flags;
+                if (slot_pm_flags & MMC_PM_WAKE_SDIO_IRQ)
+                        sdhci_enable_irq_wakeups(slot->host);
+
+                pm_flags |= slot_pm_flags;
         }
 
         if (chip->fixes && chip->fixes->suspend) {
@@ -671,8 +684,10 @@ static int sdhci_pci_suspend (struct pci_dev *pdev, pm_message_t state)
 
         pci_save_state(pdev);
         if (pm_flags & MMC_PM_KEEP_POWER) {
-                if (pm_flags & MMC_PM_WAKE_SDIO_IRQ)
+                if (pm_flags & MMC_PM_WAKE_SDIO_IRQ) {
+                        pci_pme_active(pdev, true);
                         pci_enable_wake(pdev, PCI_D3hot, 1);
+                }
                 pci_set_power_state(pdev, PCI_D3hot);
         } else {
                 pci_enable_wake(pdev, pci_choose_state(pdev, state), 0);
diff --git a/drivers/mmc/host/sdhci-pxa.c b/drivers/mmc/host/sdhci-pxa.c
index fc406ac5d19..5a61208cbc6 100644
--- a/drivers/mmc/host/sdhci-pxa.c
+++ b/drivers/mmc/host/sdhci-pxa.c
@@ -141,6 +141,10 @@ static int __devinit sdhci_pxa_probe(struct platform_device *pdev)
         if (pdata->quirks)
                 host->quirks |= pdata->quirks;
 
+        /* If slot design supports 8 bit data, indicate this to MMC. */
+        if (pdata->flags & PXA_FLAG_SD_8_BIT_CAPABLE_SLOT)
+                host->mmc->caps |= MMC_CAP_8_BIT_DATA;
+
         ret = sdhci_add_host(host);
         if (ret) {
                 dev_err(&pdev->dev, "failed to add host\n");
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 782c0ee3c92..a25db426c91 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1185,17 +1185,31 @@ static void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         if (host->ops->platform_send_init_74_clocks)
                 host->ops->platform_send_init_74_clocks(host, ios->power_mode);
 
-        ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
-
-        if (ios->bus_width == MMC_BUS_WIDTH_8)
-                ctrl |= SDHCI_CTRL_8BITBUS;
-        else
-                ctrl &= ~SDHCI_CTRL_8BITBUS;
+        /*
+         * If your platform has 8-bit width support but is not a v3 controller,
+         * or if it requires special setup code, you should implement that in
+         * platform_8bit_width().
+         */
+        if (host->ops->platform_8bit_width)
+                host->ops->platform_8bit_width(host, ios->bus_width);
+        else {
+                ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
+                if (ios->bus_width == MMC_BUS_WIDTH_8) {
+                        ctrl &= ~SDHCI_CTRL_4BITBUS;
+                        if (host->version >= SDHCI_SPEC_300)
+                                ctrl |= SDHCI_CTRL_8BITBUS;
+                } else {
+                        if (host->version >= SDHCI_SPEC_300)
+                                ctrl &= ~SDHCI_CTRL_8BITBUS;
+                        if (ios->bus_width == MMC_BUS_WIDTH_4)
+                                ctrl |= SDHCI_CTRL_4BITBUS;
+                        else
+                                ctrl &= ~SDHCI_CTRL_4BITBUS;
+                }
+                sdhci_writeb(host, ctrl, SDHCI_HOST_CONTROL);
+        }
 
-        if (ios->bus_width == MMC_BUS_WIDTH_4)
-                ctrl |= SDHCI_CTRL_4BITBUS;
-        else
-                ctrl &= ~SDHCI_CTRL_4BITBUS;
+        ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
 
         if ((ios->timing == MMC_TIMING_SD_HS ||
              ios->timing == MMC_TIMING_MMC_HS)
@@ -1681,6 +1695,16 @@ int sdhci_resume_host(struct sdhci_host *host)
 
 EXPORT_SYMBOL_GPL(sdhci_resume_host);
 
+void sdhci_enable_irq_wakeups(struct sdhci_host *host)
+{
+        u8 val;
+        val = sdhci_readb(host, SDHCI_WAKE_UP_CONTROL);
+        val |= SDHCI_WAKE_ON_INT;
+        sdhci_writeb(host, val, SDHCI_WAKE_UP_CONTROL);
+}
+
+EXPORT_SYMBOL_GPL(sdhci_enable_irq_wakeups);
+
 #endif /* CONFIG_PM */
 
 /*****************************************************************************\
@@ -1845,11 +1869,19 @@ int sdhci_add_host(struct sdhci_host *host)
                 mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
         else
                 mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
+
         mmc->f_max = host->max_clk;
         mmc->caps |= MMC_CAP_SDIO_IRQ;
 
+        /*
+         * A controller may support 8-bit width, but the board itself
+         * might not have the pins brought out.  Boards that support
+         * 8-bit width must set "mmc->caps |= MMC_CAP_8_BIT_DATA;" in
+         * their platform code before calling sdhci_add_host(), and we
+         * won't assume 8-bit width for hosts without that CAP.
+         */
         if (!(host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA))
-                mmc->caps |= MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA;
+                mmc->caps |= MMC_CAP_4_BIT_DATA;
 
         if (caps & SDHCI_CAN_DO_HISPD)
                 mmc->caps |= MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED;
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index b7b8a3b28b0..e42d7f00c06 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -76,7 +76,7 @@
 #define   SDHCI_CTRL_ADMA1      0x08
 #define   SDHCI_CTRL_ADMA32     0x10
 #define   SDHCI_CTRL_ADMA64     0x18
-#define  SDHCI_CTRL_8BITBUS     0x20
+#define   SDHCI_CTRL_8BITBUS    0x20
 
 #define SDHCI_POWER_CONTROL     0x29
 #define  SDHCI_POWER_ON         0x01
@@ -87,6 +87,9 @@
 #define SDHCI_BLOCK_GAP_CONTROL 0x2A
 
 #define SDHCI_WAKE_UP_CONTROL   0x2B
+#define  SDHCI_WAKE_ON_INT      0x01
+#define  SDHCI_WAKE_ON_INSERT   0x02
+#define  SDHCI_WAKE_ON_REMOVE   0x04
 
 #define SDHCI_CLOCK_CONTROL     0x2C
 #define  SDHCI_DIVIDER_SHIFT    8
@@ -152,6 +155,7 @@
 #define  SDHCI_CLOCK_BASE_SHIFT 8
 #define  SDHCI_MAX_BLOCK_MASK   0x00030000
 #define  SDHCI_MAX_BLOCK_SHIFT  16
+#define  SDHCI_CAN_DO_8BIT      0x00040000
 #define  SDHCI_CAN_DO_ADMA2     0x00080000
 #define  SDHCI_CAN_DO_ADMA1     0x00100000
 #define  SDHCI_CAN_DO_HISPD     0x00200000
@@ -212,6 +216,8 @@ struct sdhci_ops {
         unsigned int    (*get_max_clock)(struct sdhci_host *host);
         unsigned int    (*get_min_clock)(struct sdhci_host *host);
         unsigned int    (*get_timeout_clock)(struct sdhci_host *host);
+        int             (*platform_8bit_width)(struct sdhci_host *host,
+                                               int width);
         void (*platform_send_init_74_clocks)(struct sdhci_host *host,
                                              u8 power_mode);
         unsigned int    (*get_ro)(struct sdhci_host *host);
@@ -317,6 +323,7 @@ extern void sdhci_remove_host(struct sdhci_host *host, int dead);
 #ifdef CONFIG_PM
 extern int sdhci_suspend_host(struct sdhci_host *host, pm_message_t state);
 extern int sdhci_resume_host(struct sdhci_host *host);
+extern void sdhci_enable_irq_wakeups(struct sdhci_host *host);
 #endif
 
 #endif /* __SDHCI_HW_H */
diff --git a/drivers/mmc/host/ushc.c b/drivers/mmc/host/ushc.c
index b4ead4a13c9..f8f65df9b01 100644
--- a/drivers/mmc/host/ushc.c
+++ b/drivers/mmc/host/ushc.c
@@ -425,7 +425,7 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
         struct usb_device *usb_dev = interface_to_usbdev(intf);
         struct mmc_host *mmc;
         struct ushc_data *ushc;
-        int ret = -ENOMEM;
+        int ret;
 
         mmc = mmc_alloc_host(sizeof(struct ushc_data), &intf->dev);
         if (mmc == NULL)
@@ -462,11 +462,15 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
         mmc->max_blk_count = 511;
 
         ushc->int_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (ushc->int_urb == NULL)
+        if (ushc->int_urb == NULL) {
+                ret = -ENOMEM;
                 goto err;
+        }
         ushc->int_data = kzalloc(sizeof(struct ushc_int_data), GFP_KERNEL);
-        if (ushc->int_data == NULL)
+        if (ushc->int_data == NULL) {
+                ret = -ENOMEM;
                 goto err;
+        }
         usb_fill_int_urb(ushc->int_urb, ushc->usb_dev,
                          usb_rcvintpipe(usb_dev,
                                         intf->cur_altsetting->endpoint[0].desc.bEndpointAddress),
@@ -475,11 +479,15 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
                          intf->cur_altsetting->endpoint[0].desc.bInterval);
 
         ushc->cbw_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (ushc->cbw_urb == NULL)
+        if (ushc->cbw_urb == NULL) {
+                ret = -ENOMEM;
                 goto err;
+        }
         ushc->cbw = kzalloc(sizeof(struct ushc_cbw), GFP_KERNEL);
-        if (ushc->cbw == NULL)
+        if (ushc->cbw == NULL) {
+                ret = -ENOMEM;
                 goto err;
+        }
         ushc->cbw->signature = USHC_CBW_SIGNATURE;
 
         usb_fill_bulk_urb(ushc->cbw_urb, ushc->usb_dev, usb_sndbulkpipe(usb_dev, 2),
@@ -487,15 +495,21 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
                           cbw_callback, ushc);
 
         ushc->data_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (ushc->data_urb == NULL)
+        if (ushc->data_urb == NULL) {
+                ret = -ENOMEM;
                 goto err;
+        }
 
         ushc->csw_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (ushc->csw_urb == NULL)
+        if (ushc->csw_urb == NULL) {
+                ret = -ENOMEM;
                 goto err;
+        }
         ushc->csw = kzalloc(sizeof(struct ushc_cbw), GFP_KERNEL);
-        if (ushc->csw == NULL)
+        if (ushc->csw == NULL) {
+                ret = -ENOMEM;
                 goto err;
+        }
         usb_fill_bulk_urb(ushc->csw_urb, ushc->usb_dev, usb_rcvbulkpipe(usb_dev, 6),
                           ushc->csw, sizeof(struct ushc_csw),
                           csw_callback, ushc);
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index 3c631863bf4..204345be8e6 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -787,16 +787,15 @@ static int check_corruption(struct ubi_device *ubi, struct ubi_vid_hdr *vid_hdr,
                  * erased, so it became unstable and corrupted, and should be
                  * erased.
                  */
-                return 0;
+                err = 0;
+                goto out_unlock;
         }
 
         if (err)
-                return err;
+                goto out_unlock;
 
-        if (ubi_check_pattern(ubi->peb_buf1, 0xFF, ubi->leb_size)) {
-                mutex_unlock(&ubi->buf_mutex);
-                return 0;
-        }
+        if (ubi_check_pattern(ubi->peb_buf1, 0xFF, ubi->leb_size))
+                goto out_unlock;
 
         ubi_err("PEB %d contains corrupted VID header, and the data does not "
                 "contain all 0xFF, this may be a non-UBI PEB or a severe VID "
@@ -806,8 +805,11 @@ static int check_corruption(struct ubi_device *ubi, struct ubi_vid_hdr *vid_hdr,
                 pnum, ubi->leb_start, ubi->leb_size);
         ubi_dbg_print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
                                ubi->peb_buf1, ubi->leb_size, 1);
+        err = 1;
+
+out_unlock:
         mutex_unlock(&ubi->buf_mutex);
-        return 1;
+        return err;
 }
 
 /**
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 43db398437b..4f1755bddf6 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2543,10 +2543,10 @@ config PCH_GBE
         depends on PCI
         select MII
         ---help---
-          This is a gigabit ethernet driver for Topcliff PCH.
-          Topcliff PCH is the platform controller hub that is used in Intel's
+          This is a gigabit ethernet driver for EG20T PCH.
+          EG20T PCH is the platform controller hub that is used in Intel's
           general embedded platform.
-          Topcliff PCH has Gigabit Ethernet interface.
+          EG20T PCH has Gigabit Ethernet interface.
           Using this interface, it is able to access system devices connected
           to Gigabit Ethernet.
           This driver enables Gigabit Ethernet function.
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index 43489f89c14..53eff9ba6e9 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -155,10 +155,10 @@ static void au1000_enable_mac(struct net_device *dev, int force_reset)
         spin_lock_irqsave(&aup->lock, flags);
 
         if (force_reset || (!aup->mac_enabled)) {
-                writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
+                writel(MAC_EN_CLOCK_ENABLE, aup->enable);
                 au_sync_delay(2);
                 writel((MAC_EN_RESET0 | MAC_EN_RESET1 | MAC_EN_RESET2
-                                | MAC_EN_CLOCK_ENABLE), &aup->enable);
+                                | MAC_EN_CLOCK_ENABLE), aup->enable);
                 au_sync_delay(2);
 
                 aup->mac_enabled = 1;
@@ -503,9 +503,9 @@ static void au1000_reset_mac_unlocked(struct net_device *dev)
 
         au1000_hard_stop(dev);
 
-        writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
+        writel(MAC_EN_CLOCK_ENABLE, aup->enable);
         au_sync_delay(2);
-        writel(0, &aup->enable);
+        writel(0, aup->enable);
         au_sync_delay(2);
 
         aup->tx_full = 0;
@@ -1119,7 +1119,7 @@ static int __devinit au1000_probe(struct platform_device *pdev)
         /* set a random MAC now in case platform_data doesn't provide one */
         random_ether_addr(dev->dev_addr);
 
-        writel(0, &aup->enable);
+        writel(0, aup->enable);
         aup->mac_enabled = 0;
 
         pd = pdev->dev.platform_data;
diff --git a/drivers/net/cxgb4vf/cxgb4vf_main.c b/drivers/net/cxgb4vf/cxgb4vf_main.c
index c3449bbc585..d887a76cd39 100644
--- a/drivers/net/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/cxgb4vf/cxgb4vf_main.c
@@ -816,40 +816,48 @@ static struct net_device_stats *cxgb4vf_get_stats(struct net_device *dev)
 }
 
 /*
- * Collect up to maxaddrs worth of a netdevice's unicast addresses into an
- * array of addrss pointers and return the number collected.
+ * Collect up to maxaddrs worth of a netdevice's unicast addresses, starting
+ * at a specified offset within the list, into an array of addrss pointers and
+ * return the number collected.
  */
-static inline int collect_netdev_uc_list_addrs(const struct net_device *dev,
-                                               const u8 **addr,
-                                               unsigned int maxaddrs)
+static inline unsigned int collect_netdev_uc_list_addrs(const struct net_device *dev,
+                                                        const u8 **addr,
+                                                        unsigned int offset,
+                                                        unsigned int maxaddrs)
 {
+        unsigned int index = 0;
         unsigned int naddr = 0;
         const struct netdev_hw_addr *ha;
 
-        for_each_dev_addr(dev, ha) {
-                addr[naddr++] = ha->addr;
-                if (naddr >= maxaddrs)
-                        break;
-        }
+        for_each_dev_addr(dev, ha)
+                if (index++ >= offset) {
+                        addr[naddr++] = ha->addr;
+                        if (naddr >= maxaddrs)
+                                break;
+                }
         return naddr;
 }
 
 /*
- * Collect up to maxaddrs worth of a netdevice's multicast addresses into an
- * array of addrss pointers and return the number collected.
+ * Collect up to maxaddrs worth of a netdevice's multicast addresses, starting
+ * at a specified offset within the list, into an array of addrss pointers and
+ * return the number collected.
  */
-static inline int collect_netdev_mc_list_addrs(const struct net_device *dev,
-                                               const u8 **addr,
-                                               unsigned int maxaddrs)
+static inline unsigned int collect_netdev_mc_list_addrs(const struct net_device *dev,
+                                                        const u8 **addr,
+                                                        unsigned int offset,
+                                                        unsigned int maxaddrs)
 {
+        unsigned int index = 0;
         unsigned int naddr = 0;
         const struct netdev_hw_addr *ha;
 
-        netdev_for_each_mc_addr(ha, dev) {
-                addr[naddr++] = ha->addr;
-                if (naddr >= maxaddrs)
-                        break;
-        }
+        netdev_for_each_mc_addr(ha, dev)
+                if (index++ >= offset) {
+                        addr[naddr++] = ha->addr;
+                        if (naddr >= maxaddrs)
+                                break;
+                }
         return naddr;
 }
 
@@ -862,16 +870,20 @@ static int set_addr_filters(const struct net_device *dev, bool sleep)
         u64 mhash = 0;
         u64 uhash = 0;
         bool free = true;
-        u16 filt_idx[7];
+        unsigned int offset, naddr;
         const u8 *addr[7];
-        int ret, naddr = 0;
+        int ret;
         const struct port_info *pi = netdev_priv(dev);
 
         /* first do the secondary unicast addresses */
-        naddr = collect_netdev_uc_list_addrs(dev, addr, ARRAY_SIZE(addr));
-        if (naddr > 0) {
+        for (offset = 0; ; offset += naddr) {
+                naddr = collect_netdev_uc_list_addrs(dev, addr, offset,
+                                                     ARRAY_SIZE(addr));
+                if (naddr == 0)
+                        break;
+
                 ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
-                                          naddr, addr, filt_idx, &uhash, sleep);
+                                          naddr, addr, NULL, &uhash, sleep);
                 if (ret < 0)
                         return ret;
 
@@ -879,12 +891,17 @@ static int set_addr_filters(const struct net_device *dev, bool sleep)
         }
 
         /* next set up the multicast addresses */
-        naddr = collect_netdev_mc_list_addrs(dev, addr, ARRAY_SIZE(addr));
-        if (naddr > 0) {
+        for (offset = 0; ; offset += naddr) {
+                naddr = collect_netdev_mc_list_addrs(dev, addr, offset,
+                                                     ARRAY_SIZE(addr));
+                if (naddr == 0)
+                        break;
+
                 ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
-                                          naddr, addr, filt_idx, &mhash, sleep);
+                                          naddr, addr, NULL, &mhash, sleep);
                 if (ret < 0)
                         return ret;
+                free = false;
         }
 
         return t4vf_set_addr_hash(pi->adapter, pi->viid, uhash != 0,
diff --git a/drivers/net/cxgb4vf/t4vf_hw.c b/drivers/net/cxgb4vf/t4vf_hw.c
index e306c20dfae..19520afe1a1 100644
--- a/drivers/net/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/cxgb4vf/t4vf_hw.c
@@ -1014,48 +1014,72 @@ int t4vf_alloc_mac_filt(struct adapter *adapter, unsigned int viid, bool free,
                         unsigned int naddr, const u8 **addr, u16 *idx,
                         u64 *hash, bool sleep_ok)
 {
-        int i, ret;
+        int offset, ret = 0;
+        unsigned nfilters = 0;
+        unsigned int rem = naddr;
         struct fw_vi_mac_cmd cmd, rpl;
-        struct fw_vi_mac_exact *p;
-        size_t len16;
 
-        if (naddr > ARRAY_SIZE(cmd.u.exact))
+        if (naddr > FW_CLS_TCAM_NUM_ENTRIES)
                 return -EINVAL;
-        len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
-                                      u.exact[naddr]), 16);
 
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
-                                     FW_CMD_REQUEST |
-                                     FW_CMD_WRITE |
-                                     (free ? FW_CMD_EXEC : 0) |
-                                     FW_VI_MAC_CMD_VIID(viid));
-        cmd.freemacs_to_len16 = cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
-                                            FW_CMD_LEN16(len16));
+        for (offset = 0; offset < naddr; /**/) {
+                unsigned int fw_naddr = (rem < ARRAY_SIZE(cmd.u.exact)
+                                         ? rem
+                                         : ARRAY_SIZE(cmd.u.exact));
+                size_t len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
+                                                     u.exact[fw_naddr]), 16);
+                struct fw_vi_mac_exact *p;
+                int i;
 
-        for (i = 0, p = cmd.u.exact; i < naddr; i++, p++) {
-                p->valid_to_idx =
-                        cpu_to_be16(FW_VI_MAC_CMD_VALID |
-                                    FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
-                memcpy(p->macaddr, addr[i], sizeof(p->macaddr));
-        }
+                memset(&cmd, 0, sizeof(cmd));
+                cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
+                                             FW_CMD_REQUEST |
+                                             FW_CMD_WRITE |
+                                             (free ? FW_CMD_EXEC : 0) |
+                                             FW_VI_MAC_CMD_VIID(viid));
+                cmd.freemacs_to_len16 =
+                        cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
+                                    FW_CMD_LEN16(len16));
+
+                for (i = 0, p = cmd.u.exact; i < fw_naddr; i++, p++) {
+                        p->valid_to_idx = cpu_to_be16(
+                                FW_VI_MAC_CMD_VALID |
+                                FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
+                        memcpy(p->macaddr, addr[offset+i], sizeof(p->macaddr));
+                }
+
+
+                ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl,
+                                        sleep_ok);
+                if (ret && ret != -ENOMEM)
+                        break;
 
-        ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl, sleep_ok);
-        if (ret)
-                return ret;
-
-        for (i = 0, p = rpl.u.exact; i < naddr; i++, p++) {
-                u16 index = FW_VI_MAC_CMD_IDX_GET(be16_to_cpu(p->valid_to_idx));
-
-                if (idx)
-                        idx[i] = (index >= FW_CLS_TCAM_NUM_ENTRIES
-                                  ? 0xffff
-                                  : index);
-                if (index < FW_CLS_TCAM_NUM_ENTRIES)
-                        ret++;
-                else if (hash)
-                        *hash |= (1 << hash_mac_addr(addr[i]));
+                for (i = 0, p = rpl.u.exact; i < fw_naddr; i++, p++) {
+                        u16 index = FW_VI_MAC_CMD_IDX_GET(
+                                be16_to_cpu(p->valid_to_idx));
+
+                        if (idx)
+                                idx[offset+i] =
+                                        (index >= FW_CLS_TCAM_NUM_ENTRIES
+                                         ? 0xffff
+                                         : index);
+                        if (index < FW_CLS_TCAM_NUM_ENTRIES)
+                                nfilters++;
+                        else if (hash)
+                                *hash |= (1ULL << hash_mac_addr(addr[offset+i]));
+                }
+
+                free = false;
+                offset += fw_naddr;
+                rem -= fw_naddr;
         }
+
+        /*
+         * If there were no errors or we merely ran out of room in our MAC
+         * address arena, return the number of filters actually written.
+         */
+        if (ret == 0 || ret == -ENOMEM)
+                ret = nfilters;
         return ret;
 }
 
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 182b2a7be8d..3d0af08483a 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -400,6 +400,7 @@ static void ehea_refill_rq1(struct ehea_port_res *pr, int index, int nr_of_wqes)
                         skb_arr_rq1[index] = netdev_alloc_skb(dev,
                                                               EHEA_L_PKT_SIZE);
                         if (!skb_arr_rq1[index]) {
+                                ehea_info("Unable to allocate enough skb in the array\n");
                                 pr->rq1_skba.os_skbs = fill_wqes - i;
                                 break;
                         }
@@ -422,13 +423,20 @@ static void ehea_init_fill_rq1(struct ehea_port_res *pr, int nr_rq1a)
         struct net_device *dev = pr->port->netdev;
         int i;
 
-        for (i = 0; i < pr->rq1_skba.len; i++) {
+        if (nr_rq1a > pr->rq1_skba.len) {
+                ehea_error("NR_RQ1A bigger than skb array len\n");
+                return;
+        }
+
+        for (i = 0; i < nr_rq1a; i++) {
                 skb_arr_rq1[i] = netdev_alloc_skb(dev, EHEA_L_PKT_SIZE);
-                if (!skb_arr_rq1[i])
+                if (!skb_arr_rq1[i]) {
+                        ehea_info("No enough memory to allocate skb array\n");
                         break;
+                }
         }
         /* Ring doorbell */
-        ehea_update_rq1a(pr->qp, nr_rq1a);
+        ehea_update_rq1a(pr->qp, i);
 }
 
 static int ehea_refill_rq_def(struct ehea_port_res *pr,
@@ -735,8 +743,10 @@ static int ehea_proc_rwqes(struct net_device *dev,
 
                                         skb = netdev_alloc_skb(dev,
                                                                EHEA_L_PKT_SIZE);
-                                        if (!skb)
+                                        if (!skb) {
+                                                ehea_info("Not enough memory to allocate skb\n");
                                                 break;
+                                        }
                                 }
                                 skb_copy_to_linear_data(skb, ((char *)cqe) + 64,
                                                  cqe->num_bytes_transfered - 4);
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index 472056b4744..03a1d280105 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 1999 - 2010 Intel Corporation.
- * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR CO., LTD.
  *
  * This code was derived from the Intel e1000e Linux driver.
  *
@@ -2464,8 +2464,8 @@ static void __exit pch_gbe_exit_module(void)
 module_init(pch_gbe_init_module);
 module_exit(pch_gbe_exit_module);
 
-MODULE_DESCRIPTION("OKI semiconductor PCH Gigabit ethernet Driver");
-MODULE_AUTHOR("OKI semiconductor, <masa-korg@dsn.okisemi.com>");
+MODULE_DESCRIPTION("EG20T PCH Gigabit ethernet Driver");
+MODULE_AUTHOR("OKI SEMICONDUCTOR, <toshiharu-linux@dsn.okisemi.com>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 MODULE_DEVICE_TABLE(pci, pch_gbe_pcidev_id);
diff --git a/drivers/net/pch_gbe/pch_gbe_param.c b/drivers/net/pch_gbe/pch_gbe_param.c
index 2510146fc56..ef0996a0eaa 100644
--- a/drivers/net/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/pch_gbe/pch_gbe_param.c
@@ -434,8 +434,8 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                         .err  = "using default of "
                                 __MODULE_STRING(PCH_GBE_DEFAULT_TXD),
                         .def  = PCH_GBE_DEFAULT_TXD,
-                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD } },
-                        .arg  = { .r = { .max = PCH_GBE_MAX_TXD } }
+                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD,
+                                         .max = PCH_GBE_MAX_TXD } }
                 };
                 struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
                 tx_ring->count = TxDescriptors;
@@ -450,8 +450,8 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                         .err  = "using default of "
                                 __MODULE_STRING(PCH_GBE_DEFAULT_RXD),
                         .def  = PCH_GBE_DEFAULT_RXD,
-                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD } },
-                        .arg  = { .r = { .max = PCH_GBE_MAX_RXD } }
+                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD,
+                                         .max = PCH_GBE_MAX_RXD } }
                 };
                 struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
                 rx_ring->count = RxDescriptors;
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 09cf56d0416..39659976a1a 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -2584,16 +2584,16 @@ ppp_create_interface(struct net *net, int unit, int *retp)
          */
         dev_net_set(dev, net);
 
-        ret = -EEXIST;
         mutex_lock(&pn->all_ppp_mutex);
 
         if (unit < 0) {
                 unit = unit_get(&pn->units_idr, ppp);
                 if (unit < 0) {
-                        *retp = unit;
+                        ret = unit;
                         goto out2;
                 }
         } else {
+                ret = -EEXIST;
                 if (unit_find(&pn->units_idr, unit))
                         goto out2; /* unit already exists */
                 /*
@@ -2668,10 +2668,10 @@ static void ppp_shutdown_interface(struct ppp *ppp)
                 ppp->closing = 1;
                 ppp_unlock(ppp);
                 unregister_netdev(ppp->dev);
+                unit_put(&pn->units_idr, ppp->file.index);
         } else
                 ppp_unlock(ppp);
 
-        unit_put(&pn->units_idr, ppp->file.index);
         ppp->file.dead = 1;
         ppp->owner = NULL;
         wake_up_interruptible(&ppp->file.rwait);
@@ -2859,8 +2859,7 @@ static void __exit ppp_cleanup(void)
  * by holding all_ppp_mutex
  */
 
-/* associate pointer with specified number */
-static int unit_set(struct idr *p, void *ptr, int n)
+static int __unit_alloc(struct idr *p, void *ptr, int n)
 {
         int unit, err;
 
@@ -2871,10 +2870,24 @@ again:
         }
 
         err = idr_get_new_above(p, ptr, n, &unit);
-        if (err == -EAGAIN)
-                goto again;
+        if (err < 0) {
+                if (err == -EAGAIN)
+                        goto again;
+                return err;
+        }
+
+        return unit;
+}
+
+/* associate pointer with specified number */
+static int unit_set(struct idr *p, void *ptr, int n)
+{
+        int unit;
 
-        if (unit != n) {
+        unit = __unit_alloc(p, ptr, n);
+        if (unit < 0)
+                return unit;
+        else if (unit != n) {
                 idr_remove(p, unit);
                 return -EINVAL;
         }
@@ -2885,19 +2898,7 @@ again:
 /* get new free unit number and associate pointer with it */
 static int unit_get(struct idr *p, void *ptr)
 {
-        int unit, err;
-
-again:
-        if (!idr_pre_get(p, GFP_KERNEL)) {
-                printk(KERN_ERR "PPP: No free memory for idr\n");
-                return -ENOMEM;
-        }
-
-        err = idr_get_new_above(p, ptr, 0, &unit);
-        if (err == -EAGAIN)
-                goto again;
-
-        return unit;
+        return __unit_alloc(p, ptr, 0);
 }
 
 /* put unit number back to a pool */
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index 05a95586f3c..055b87ab4f0 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -899,7 +899,8 @@ struct ucc_geth_hardware_statistics {
 #define UCC_GETH_UTFS_INIT                      512     /* Tx virtual FIFO size
                                                          */
 #define UCC_GETH_UTFET_INIT                     256     /* 1/2 utfs */
-#define UCC_GETH_UTFTT_INIT                     512
+#define UCC_GETH_UTFTT_INIT                     256     /* 1/2 utfs
+                                                           due to errata */
 /* Gigabit Ethernet (1000 Mbps) */
 #define UCC_GETH_URFS_GIGA_INIT                 4096/*2048*/    /* Rx virtual
                                                                    FIFO size */
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index b154a94de03..62e9e8dc819 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2994,12 +2994,14 @@ static int hso_probe(struct usb_interface *interface,
 
         case HSO_INTF_BULK:
                 /* It's a regular bulk interface */
-                if (((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) &&
-                    !disable_net)
-                        hso_dev = hso_create_net_device(interface, port_spec);
-                else
+                if ((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) {
+                        if (!disable_net)
+                                hso_dev =
+                                    hso_create_net_device(interface, port_spec);
+                } else {
                         hso_dev =
                             hso_create_bulk_serial_device(interface, port_spec);
+                }
                 if (!hso_dev)
                         goto exit;
                 break;
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index d81ad839788..cf05504d951 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -498,7 +498,6 @@ norbuff:
 static int x25_asy_close(struct net_device *dev)
 {
         struct x25_asy *sl = netdev_priv(dev);
-        int err;
 
         spin_lock(&sl->lock);
         if (sl->tty)
@@ -507,10 +506,6 @@ static int x25_asy_close(struct net_device *dev)
         netif_stop_queue(dev);
         sl->rcount = 0;
         sl->xleft  = 0;
-        err = lapb_unregister(dev);
-        if (err != LAPB_OK)
-                printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
-                        err);
         spin_unlock(&sl->lock);
         return 0;
 }
@@ -595,6 +590,7 @@ static int x25_asy_open_tty(struct tty_struct *tty)
 static void x25_asy_close_tty(struct tty_struct *tty)
 {
         struct x25_asy *sl = tty->disc_data;
+        int err;
 
         /* First make sure we're connected. */
         if (!sl || sl->magic != X25_ASY_MAGIC)
@@ -605,6 +601,11 @@ static void x25_asy_close_tty(struct tty_struct *tty)
                 dev_close(sl->dev);
         rtnl_unlock();
 
+        err = lapb_unregister(sl->dev);
+        if (err != LAPB_OK)
+                printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
+                        err);
+
         tty->disc_data = NULL;
         sl->tty = NULL;
         x25_asy_free(sl);
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index c76ea53c20c..1a62e351ec7 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -518,7 +518,7 @@ bool ath_stoprecv(struct ath_softc *sc)
         bool stopped;
 
         spin_lock_bh(&sc->rx.rxbuflock);
-        ath9k_hw_stoppcurecv(ah);
+        ath9k_hw_abortpcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
         stopped = ath9k_hw_stopdmarecv(ah);
 
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 980ae70ea42..a314c2c2bfb 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -647,7 +647,7 @@ init:
         }
 
 unlock:
-        if (err && (vif_id != -1)) {
+        if (err && (vif_id >= 0)) {
                 vif_priv->active = false;
                 bitmap_release_region(&ar->vif_bitmap, vif_id, 0);
                 ar->vifs--;
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index 9a55338d957..09e2dfd7b17 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_func *func,
 err_free_ssb:
         kfree(sdio);
 err_disable_func:
+        sdio_claim_host(func);
         sdio_disable_func(func);
 err_release_host:
         sdio_release_host(func);
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index 752dbee06af..5d9c66627b6 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -292,8 +292,8 @@ void qdio_shutdown_thinint(struct qdio_irq *irq_ptr)
                 return;
 
         /* reset adapter interrupt indicators */
-        put_indicator(irq_ptr->dsci);
         set_subchannel_ind(irq_ptr, 1);
+        put_indicator(irq_ptr->dsci);
 }
 
 void __exit tiqdio_unregister_thinints(void)
diff --git a/drivers/ssb/b43_pci_bridge.c b/drivers/ssb/b43_pci_bridge.c
index ef9c6a04ad8..744d3f6e470 100644
--- a/drivers/ssb/b43_pci_bridge.c
+++ b/drivers/ssb/b43_pci_bridge.c
@@ -24,6 +24,7 @@ static const struct pci_device_id b43_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4312) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4315) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4318) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BCM_GVC,  0x4318) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) },
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 4b4da5b86ff..f442668a1e5 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -129,8 +129,9 @@ static void handle_tx(struct vhost_net *net)
         size_t hdr_size;
         struct socket *sock;
 
-        sock = rcu_dereference_check(vq->private_data,
-                                     lockdep_is_held(&vq->mutex));
+        /* TODO: check that we are running from vhost_worker?
+         * Not sure it's worth it, it's straight-forward enough. */
+        sock = rcu_dereference_check(vq->private_data, 1);
         if (!sock)
                 return;