Merge branch 'linus' into core/ipi

245 files changed, 5654 insertions, 1123 deletions

diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index a603bbf9b1b7..66e012cd3271 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -582,18 +582,18 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(NVIDIA, 0x0abd), board_ahci },            /* MCP79 */
         { PCI_VDEVICE(NVIDIA, 0x0abe), board_ahci },            /* MCP79 */
         { PCI_VDEVICE(NVIDIA, 0x0abf), board_ahci },            /* MCP79 */
-        { PCI_VDEVICE(NVIDIA, 0x0bc8), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc9), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bca), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bcb), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bcc), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bcd), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bce), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bcf), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc4), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc5), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc6), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc7), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0d84), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d85), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d86), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d87), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d88), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d89), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8a), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8b), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8c), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8d), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8e), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8f), board_ahci },            /* MCP89 */
 
         /* SiS */
         { PCI_VDEVICE(SI, 0x1184), board_ahci },                /* SiS 966 */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 9fbf0595f3d4..060bcd601f57 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1322,14 +1322,16 @@ static u64 ata_id_n_sectors(const u16 *id)
 {
         if (ata_id_has_lba(id)) {
                 if (ata_id_has_lba48(id))
-                        return ata_id_u64(id, 100);
+                        return ata_id_u64(id, ATA_ID_LBA_CAPACITY_2);
                 else
-                        return ata_id_u32(id, 60);
+                        return ata_id_u32(id, ATA_ID_LBA_CAPACITY);
         } else {
                 if (ata_id_current_chs_valid(id))
-                        return ata_id_u32(id, 57);
+                        return id[ATA_ID_CUR_CYLS] * id[ATA_ID_CUR_HEADS] *
+                               id[ATA_ID_CUR_SECTORS];
                 else
-                        return id[1] * id[3] * id[6];
+                        return id[ATA_ID_CYLS] * id[ATA_ID_HEADS] *
+                               id[ATA_ID_SECTORS];
         }
 }
 
@@ -4612,7 +4614,7 @@ void ata_sg_clean(struct ata_queued_cmd *qc)
         VPRINTK("unmapping %u sg elements\n", qc->n_elem);
 
         if (qc->n_elem)
-                dma_unmap_sg(ap->dev, sg, qc->n_elem, dir);
+                dma_unmap_sg(ap->dev, sg, qc->orig_n_elem, dir);
 
         qc->flags &= ~ATA_QCFLAG_DMAMAP;
         qc->sg = NULL;
@@ -4727,7 +4729,7 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
                 return -1;
 
         DPRINTK("%d sg elements mapped\n", n_elem);
-
+        qc->orig_n_elem = qc->n_elem;
         qc->n_elem = n_elem;
         qc->flags |= ATA_QCFLAG_DMAMAP;
 
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index ce2ef0475339..ea890911d4fa 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2423,11 +2423,14 @@ int ata_eh_reset(struct ata_link *link, int classify,
                 }
 
                 /* prereset() might have cleared ATA_EH_RESET.  If so,
-                 * bang classes and return.
+                 * bang classes, thaw and return.
                  */
                 if (reset && !(ehc->i.action & ATA_EH_RESET)) {
                         ata_for_each_dev(dev, link, ALL)
                                 classes[dev->devno] = ATA_DEV_NONE;
+                        if ((ap->pflags & ATA_PFLAG_FROZEN) &&
+                            ata_is_host_link(link))
+                                ata_eh_thaw_port(ap);
                         rc = 0;
                         goto out;
                 }
@@ -2901,7 +2904,7 @@ static int atapi_eh_clear_ua(struct ata_device *dev)
         int i;
 
         for (i = 0; i < ATA_EH_UA_TRIES; i++) {
-                u8 sense_buffer[SCSI_SENSE_BUFFERSIZE];
+                u8 *sense_buffer = dev->link->ap->sector_buf;
                 u8 sense_key = 0;
                 unsigned int err_mask;
 
diff --git a/drivers/ata/pata_amd.c b/drivers/ata/pata_amd.c
index 63719ab9ea44..115b1cd6dcf5 100644
--- a/drivers/ata/pata_amd.c
+++ b/drivers/ata/pata_amd.c
@@ -24,7 +24,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME "pata_amd"
-#define DRV_VERSION "0.3.11"
+#define DRV_VERSION "0.4.1"
 
 /**
  *      timing_setup            -       shared timing computation and load
@@ -145,6 +145,13 @@ static int amd_pre_reset(struct ata_link *link, unsigned long deadline)
         return ata_sff_prereset(link, deadline);
 }
 
+/**
+ *      amd_cable_detect        -       report cable type
+ *      @ap: port
+ *
+ *      AMD controller/BIOS setups record the cable type in word 0x42
+ */
+
 static int amd_cable_detect(struct ata_port *ap)
 {
         static const u32 bitmask[2] = {0x03, 0x0C};
@@ -158,6 +165,40 @@ static int amd_cable_detect(struct ata_port *ap)
 }
 
 /**
+ *      amd_fifo_setup          -       set the PIO FIFO for ATA/ATAPI
+ *      @ap: ATA interface
+ *      @adev: ATA device
+ *
+ *      Set the PCI fifo for this device according to the devices present
+ *      on the bus at this point in time. We need to turn the post write buffer
+ *      off for ATAPI devices as we may need to issue a word sized write to the
+ *      device as the final I/O
+ */
+
+static void amd_fifo_setup(struct ata_port *ap)
+{
+        struct ata_device *adev;
+        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+        static const u8 fifobit[2] = { 0xC0, 0x30};
+        u8 fifo = fifobit[ap->port_no];
+        u8 r;
+
+
+        ata_for_each_dev(adev, &ap->link, ENABLED) {
+                if (adev->class == ATA_DEV_ATAPI)
+                        fifo = 0;
+        }
+        if (pdev->device == PCI_DEVICE_ID_AMD_VIPER_7411) /* FIFO is broken */
+                fifo = 0;
+
+        /* On the later chips the read prefetch bits become no-op bits */
+        pci_read_config_byte(pdev, 0x41, &r);
+        r &= ~fifobit[ap->port_no];
+        r |= fifo;
+        pci_write_config_byte(pdev, 0x41, r);
+}
+
+/**
  *      amd33_set_piomode       -       set initial PIO mode data
  *      @ap: ATA interface
  *      @adev: ATA device
@@ -167,21 +208,25 @@ static int amd_cable_detect(struct ata_port *ap)
 
 static void amd33_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
+        amd_fifo_setup(ap);
         timing_setup(ap, adev, 0x40, adev->pio_mode, 1);
 }
 
 static void amd66_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
+        amd_fifo_setup(ap);
         timing_setup(ap, adev, 0x40, adev->pio_mode, 2);
 }
 
 static void amd100_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
+        amd_fifo_setup(ap);
         timing_setup(ap, adev, 0x40, adev->pio_mode, 3);
 }
 
 static void amd133_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
+        amd_fifo_setup(ap);
         timing_setup(ap, adev, 0x40, adev->pio_mode, 4);
 }
 
@@ -397,6 +442,16 @@ static struct ata_port_operations nv133_port_ops = {
         .set_dmamode    = nv133_set_dmamode,
 };
 
+static void amd_clear_fifo(struct pci_dev *pdev)
+{
+        u8 fifo;
+        /* Disable the FIFO, the FIFO logic will re-enable it as
+           appropriate */
+        pci_read_config_byte(pdev, 0x41, &fifo);
+        fifo &= 0x0F;
+        pci_write_config_byte(pdev, 0x41, fifo);
+}
+
 static int amd_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         static const struct ata_port_info info[10] = {
@@ -503,14 +558,8 @@ static int amd_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         if (type < 3)
                 ata_pci_bmdma_clear_simplex(pdev);
-
-        /* Check for AMD7411 */
-        if (type == 3)
-                /* FIFO is broken */
-                pci_write_config_byte(pdev, 0x41, fifo & 0x0F);
-        else
-                pci_write_config_byte(pdev, 0x41, fifo | 0xF0);
-
+        if (pdev->vendor == PCI_VENDOR_ID_AMD)
+                amd_clear_fifo(pdev);
         /* Cable detection on Nvidia chips doesn't work too well,
          * cache BIOS programmed UDMA mode.
          */
@@ -536,18 +585,11 @@ static int amd_reinit_one(struct pci_dev *pdev)
                 return rc;
 
         if (pdev->vendor == PCI_VENDOR_ID_AMD) {
-                u8 fifo;
-                pci_read_config_byte(pdev, 0x41, &fifo);
-                if (pdev->device == PCI_DEVICE_ID_AMD_VIPER_7411)
-                        /* FIFO is broken */
-                        pci_write_config_byte(pdev, 0x41, fifo & 0x0F);
-                else
-                        pci_write_config_byte(pdev, 0x41, fifo | 0xF0);
+                amd_clear_fifo(pdev);
                 if (pdev->device == PCI_DEVICE_ID_AMD_VIPER_7409 ||
                     pdev->device == PCI_DEVICE_ID_AMD_COBRA_7401)
                         ata_pci_bmdma_clear_simplex(pdev);
         }
-
         ata_host_resume(host);
         return 0;
 }
diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
index f1bb2f9fecbf..b05b86a912c5 100644
--- a/drivers/ata/pata_it821x.c
+++ b/drivers/ata/pata_it821x.c
@@ -557,6 +557,9 @@ static unsigned int it821x_read_id(struct ata_device *adev,
                 id[83] |= 0x4400;       /* Word 83 is valid and LBA48 */
                 id[86] |= 0x0400;       /* LBA48 on */
                 id[ATA_ID_MAJOR_VER] |= 0x1F;
+                /* Clear the serial number because it's different each boot
+                   which breaks validation on resume */
+                memset(&id[ATA_ID_SERNO], 0x20, ATA_ID_SERNO_LEN);
         }
         return err_mask;
 }
diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
index 6c1d778b63a9..e3bc1b436284 100644
--- a/drivers/ata/pata_legacy.c
+++ b/drivers/ata/pata_legacy.c
@@ -283,9 +283,10 @@ static void pdc20230_set_piomode(struct ata_port *ap, struct ata_device *adev)
 static unsigned int pdc_data_xfer_vlb(struct ata_device *dev,
                         unsigned char *buf, unsigned int buflen, int rw)
 {
-        if (ata_id_has_dword_io(dev->id)) {
+        int slop = buflen & 3;
+        /* 32bit I/O capable *and* we need to write a whole number of dwords */
+        if (ata_id_has_dword_io(dev->id) && (slop == 0 || slop == 3)) {
                 struct ata_port *ap = dev->link->ap;
-                int slop = buflen & 3;
                 unsigned long flags;
 
                 local_irq_save(flags);
@@ -735,7 +736,7 @@ static unsigned int vlb32_data_xfer(struct ata_device *adev, unsigned char *buf,
         struct ata_port *ap = adev->link->ap;
         int slop = buflen & 3;
 
-        if (ata_id_has_dword_io(adev->id)) {
+        if (ata_id_has_dword_io(adev->id) && (slop == 0 || slop == 3)) {
                 if (rw == WRITE)
                         iowrite32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
                 else
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 4ae1a4138b47..7007edd2d451 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -3114,19 +3114,17 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
                 writelfl(0, hc_mmio + HC_IRQ_CAUSE_OFS);
         }
 
-        if (!IS_SOC(hpriv)) {
-                /* Clear any currently outstanding host interrupt conditions */
-                writelfl(0, mmio + hpriv->irq_cause_ofs);
+        /* Clear any currently outstanding host interrupt conditions */
+        writelfl(0, mmio + hpriv->irq_cause_ofs);
 
-                /* and unmask interrupt generation for host regs */
-                writelfl(hpriv->unmask_all_irqs, mmio + hpriv->irq_mask_ofs);
+        /* and unmask interrupt generation for host regs */
+        writelfl(hpriv->unmask_all_irqs, mmio + hpriv->irq_mask_ofs);
 
-                /*
-                 * enable only global host interrupts for now.
-                 * The per-port interrupts get done later as ports are set up.
-                 */
-                mv_set_main_irq_mask(host, 0, PCI_ERR);
-        }
+        /*
+         * enable only global host interrupts for now.
+         * The per-port interrupts get done later as ports are set up.
+         */
+        mv_set_main_irq_mask(host, 0, PCI_ERR);
 done:
         return rc;
 }
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 55a8eed3f3a3..f65b53785a8f 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -2523,7 +2523,7 @@ static void __exit nv_exit(void)
 module_init(nv_init);
 module_exit(nv_exit);
 module_param_named(adma, adma_enabled, bool, 0444);
-MODULE_PARM_DESC(adma, "Enable use of ADMA (Default: true)");
+MODULE_PARM_DESC(adma, "Enable use of ADMA (Default: false)");
 module_param_named(swncq, swncq_enabled, bool, 0444);
 MODULE_PARM_DESC(swncq, "Enable use of SWNCQ (Default: true)");
 
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 43fa90b837ee..f8f578a71b25 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -303,7 +303,7 @@ int unregister_mem_sect_under_nodes(struct memory_block *mem_blk)
         sect_start_pfn = section_nr_to_pfn(mem_blk->phys_index);
         sect_end_pfn = sect_start_pfn + PAGES_PER_SECTION - 1;
         for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) {
-                unsigned int nid;
+                int nid;
 
                 nid = get_nid_for_pfn(pfn);
                 if (nid < 0)
diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
index cc250577d405..eeea477d9601 100644
--- a/drivers/block/aoe/aoedev.c
+++ b/drivers/block/aoe/aoedev.c
@@ -173,7 +173,7 @@ skbfree(struct sk_buff *skb)
                 return;
         while (atomic_read(&skb_shinfo(skb)->dataref) != 1 && i-- > 0)
                 msleep(Sms);
-        if (i <= 0) {
+        if (i < 0) {
                 printk(KERN_ERR
                         "aoe: %s holds ref: %s\n",
                         skb->dev ? skb->dev->name : "netif",
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index d2cb67b61176..4f9b6d792017 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -3606,16 +3606,18 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
                 if (cciss_hard_reset_controller(pdev) || cciss_reset_msi(pdev))
                         return -ENODEV;
 
-                /* Some devices (notably the HP Smart Array 5i Controller)
-                   need a little pause here */
-                schedule_timeout_uninterruptible(30*HZ);
-
-                /* Now try to get the controller to respond to a no-op */
-                for (i=0; i<12; i++) {
+                /* Now try to get the controller to respond to a no-op. Some
+                   devices (notably the HP Smart Array 5i Controller) need
+                   up to 30 seconds to respond. */
+                for (i=0; i<30; i++) {
                         if (cciss_noop(pdev) == 0)
                                 break;
-                        else
-                                printk("cciss: no-op failed%s\n", (i < 11 ? "; re-trying" : ""));
+
+                        schedule_timeout_uninterruptible(HZ);
+                }
+                if (i == 30) {
+                        printk(KERN_ERR "cciss: controller seems dead\n");
+                        return -EBUSY;
                 }
         }
 
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index edbaac6c0573..bf0345577672 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -392,8 +392,7 @@ lo_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
         struct loop_device *lo = p->lo;
         struct page *page = buf->page;
         sector_t IV;
-        size_t size;
-        int ret;
+        int size, ret;
 
         ret = buf->ops->confirm(pipe, buf);
         if (unlikely(ret))
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 918ef725de41..8f905089b72b 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -40,6 +40,7 @@
 #include <linux/hdreg.h>
 #include <linux/cdrom.h>
 #include <linux/module.h>
+#include <linux/scatterlist.h>
 
 #include <xen/xenbus.h>
 #include <xen/grant_table.h>
@@ -82,6 +83,7 @@ struct blkfront_info
         enum blkif_state connected;
         int ring_ref;
         struct blkif_front_ring ring;
+        struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         unsigned int evtchn, irq;
         struct request_queue *rq;
         struct work_struct work;
@@ -204,12 +206,11 @@ static int blkif_queue_request(struct request *req)
         struct blkfront_info *info = req->rq_disk->private_data;
         unsigned long buffer_mfn;
         struct blkif_request *ring_req;
-        struct req_iterator iter;
-        struct bio_vec *bvec;
         unsigned long id;
         unsigned int fsect, lsect;
-        int ref;
+        int i, ref;
         grant_ref_t gref_head;
+        struct scatterlist *sg;
 
         if (unlikely(info->connected != BLKIF_STATE_CONNECTED))
                 return 1;
@@ -238,12 +239,13 @@ static int blkif_queue_request(struct request *req)
         if (blk_barrier_rq(req))
                 ring_req->operation = BLKIF_OP_WRITE_BARRIER;
 
-        ring_req->nr_segments = 0;
-        rq_for_each_segment(bvec, req, iter) {
-                BUG_ON(ring_req->nr_segments == BLKIF_MAX_SEGMENTS_PER_REQUEST);
-                buffer_mfn = pfn_to_mfn(page_to_pfn(bvec->bv_page));
-                fsect = bvec->bv_offset >> 9;
-                lsect = fsect + (bvec->bv_len >> 9) - 1;
+        ring_req->nr_segments = blk_rq_map_sg(req->q, req, info->sg);
+        BUG_ON(ring_req->nr_segments > BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
+        for_each_sg(info->sg, sg, ring_req->nr_segments, i) {
+                buffer_mfn = pfn_to_mfn(page_to_pfn(sg_page(sg)));
+                fsect = sg->offset >> 9;
+                lsect = fsect + (sg->length >> 9) - 1;
                 /* install a grant reference. */
                 ref = gnttab_claim_grant_reference(&gref_head);
                 BUG_ON(ref == -ENOSPC);
@@ -254,16 +256,12 @@ static int blkif_queue_request(struct request *req)
                                 buffer_mfn,
                                 rq_data_dir(req) );
 
-                info->shadow[id].frame[ring_req->nr_segments] =
-                                mfn_to_pfn(buffer_mfn);
-
-                ring_req->seg[ring_req->nr_segments] =
+                info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn);
+                ring_req->seg[i] =
                                 (struct blkif_request_segment) {
                                         .gref       = ref,
                                         .first_sect = fsect,
                                         .last_sect  = lsect };
-
-                ring_req->nr_segments++;
         }
 
         info->ring.req_prod_pvt++;
@@ -622,6 +620,8 @@ static int setup_blkring(struct xenbus_device *dev,
         SHARED_RING_INIT(sring);
         FRONT_RING_INIT(&info->ring, sring, PAGE_SIZE);
 
+        sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
         err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring));
         if (err < 0) {
                 free_page((unsigned long)sring);
@@ -977,6 +977,8 @@ static void backend_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateClosing:
+                if (info->gd == NULL)
+                        xenbus_dev_fatal(dev, -ENODEV, "gd is NULL");
                 bd = bdget_disk(info->gd, 0);
                 if (bd == NULL)
                         xenbus_dev_fatal(dev, -ENODEV, "bdget failed");
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 52f4361eb6e4..d765afda9c2a 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -271,15 +271,15 @@ static __devinit int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp,
         nb_order = (nb_order >> 1) & 7;
         pci_read_config_dword(nb, AMD64_GARTAPERTUREBASE, &nb_base);
         nb_aper = nb_base << 25;
-        if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order)) {
-                return 0;
-        }
 
         /* Northbridge seems to contain crap. Try the AGP bridge. */
 
         pci_read_config_word(agp, cap+0x14, &apsize);
-        if (apsize == 0xffff)
+        if (apsize == 0xffff) {
+                if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order))
+                        return 0;
                 return -1;
+        }
 
         apsize &= 0xfff;
         /* Some BIOS use weird encodings not in the AGPv3 table. */
@@ -301,6 +301,11 @@ static __devinit int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp,
                 order = nb_order;
         }
 
+        if (nb_order >= order) {
+                if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order))
+                        return 0;
+        }
+
         dev_info(&agp->dev, "aperture from AGP @ %Lx size %u MB\n",
                  aper, 32 << order);
         if (order < 0 || !agp_aperture_valid(aper, (32*1024*1024)<<order))
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index c7714185f831..4373adb2119a 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -633,13 +633,15 @@ static void intel_i830_init_gtt_entries(void)
                         break;
                 }
         }
-        if (gtt_entries > 0)
+        if (gtt_entries > 0) {
                 dev_info(&agp_bridge->dev->dev, "detected %dK %s memory\n",
                        gtt_entries / KB(1), local ? "local" : "stolen");
-        else
+                gtt_entries /= KB(4);
+        } else {
                 dev_info(&agp_bridge->dev->dev,
                        "no pre-allocated video memory detected\n");
-        gtt_entries /= KB(4);
+                gtt_entries = 0;
+        }
 
         intel_private.gtt_entries = gtt_entries;
 }
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 6e6eb445d374..c76bccf5354d 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -1139,15 +1139,6 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
         hvcsd->tty = tty;
         tty->driver_data = hvcsd;
 
-        /*
-         * Set this driver to low latency so that we actually have a chance at
-         * catching a throttled TTY after we flip_buffer_push.  Otherwise the
-         * flush_to_async may not execute until after the kernel_thread has
-         * yielded and resumed the next flip_buffer_push resulting in data
-         * loss.
-         */
-        tty->low_latency = 1;
-
         memset(&hvcsd->buffer[0], 0x00, HVCS_BUFF_LEN);
 
         /*
diff --git a/drivers/char/hvsi.c b/drivers/char/hvsi.c
index 406f8742a260..2989056a9e39 100644
--- a/drivers/char/hvsi.c
+++ b/drivers/char/hvsi.c
@@ -810,7 +810,6 @@ static int hvsi_open(struct tty_struct *tty, struct file *filp)
         hp = &hvsi_ports[line];
 
         tty->driver_data = hp;
-        tty->low_latency = 1; /* avoid throttle/tty_flip_buffer_push race */
 
         mb();
         if (hp->state == HVSI_FSP_DIED)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b55cb67435bd..d6daf3c507d3 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -754,11 +754,6 @@ static struct kobj_type ktype_cpufreq = {
         .release        = cpufreq_sysfs_release,
 };
 
-static struct kobj_type ktype_empty_cpufreq = {
-        .sysfs_ops      = &sysfs_ops,
-        .release        = cpufreq_sysfs_release,
-};
-
 
 /**
  * cpufreq_add_dev - add a CPU device
@@ -892,36 +887,26 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
         memcpy(&new_policy, policy, sizeof(struct cpufreq_policy));
 
         /* prepare interface data */
-        if (!cpufreq_driver->hide_interface) {
-                ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq,
-                                           &sys_dev->kobj, "cpufreq");
+        ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq, &sys_dev->kobj,
+                                   "cpufreq");
+        if (ret)
+                goto err_out_driver_exit;
+
+        /* set up files for this cpu device */
+        drv_attr = cpufreq_driver->attr;
+        while ((drv_attr) && (*drv_attr)) {
+                ret = sysfs_create_file(&policy->kobj, &((*drv_attr)->attr));
                 if (ret)
                         goto err_out_driver_exit;
-
-                /* set up files for this cpu device */
-                drv_attr = cpufreq_driver->attr;
-                while ((drv_attr) && (*drv_attr)) {
-                        ret = sysfs_create_file(&policy->kobj,
-                                                &((*drv_attr)->attr));
-                        if (ret)
-                                goto err_out_driver_exit;
-                        drv_attr++;
-                }
-                if (cpufreq_driver->get) {
-                        ret = sysfs_create_file(&policy->kobj,
-                                                &cpuinfo_cur_freq.attr);
-                        if (ret)
-                                goto err_out_driver_exit;
-                }
-                if (cpufreq_driver->target) {
-                        ret = sysfs_create_file(&policy->kobj,
-                                                &scaling_cur_freq.attr);
-                        if (ret)
-                                goto err_out_driver_exit;
-                }
-        } else {
-                ret = kobject_init_and_add(&policy->kobj, &ktype_empty_cpufreq,
-                                           &sys_dev->kobj, "cpufreq");
+                drv_attr++;
+        }
+        if (cpufreq_driver->get) {
+                ret = sysfs_create_file(&policy->kobj, &cpuinfo_cur_freq.attr);
+                if (ret)
+                        goto err_out_driver_exit;
+        }
+        if (cpufreq_driver->target) {
+                ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
                 if (ret)
                         goto err_out_driver_exit;
         }
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 2d637e0fbc03..d9e751be8c5f 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -457,10 +457,12 @@ static int init_ixp_crypto(void)
         if (!ctx_pool) {
                 goto err;
         }
-        ret = qmgr_request_queue(SEND_QID, NPE_QLEN_TOTAL, 0, 0);
+        ret = qmgr_request_queue(SEND_QID, NPE_QLEN_TOTAL, 0, 0,
+                                 "ixp_crypto:out", NULL);
         if (ret)
                 goto err;
-        ret = qmgr_request_queue(RECV_QID, NPE_QLEN, 0, 0);
+        ret = qmgr_request_queue(RECV_QID, NPE_QLEN, 0, 0,
+                                 "ixp_crypto:in", NULL);
         if (ret) {
                 qmgr_release_queue(SEND_QID);
                 goto err;
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 856b3cc25583..3f0fdd18255d 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -489,4 +489,4 @@ MODULE_DESCRIPTION("VIA PadLock AES algorithm support");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michal Ludvig");
 
-MODULE_ALIAS("aes");
+MODULE_ALIAS("aes-all");
diff --git a/drivers/crypto/padlock-sha.c b/drivers/crypto/padlock-sha.c
index a7fbadebf623..a2c8e8514b63 100644
--- a/drivers/crypto/padlock-sha.c
+++ b/drivers/crypto/padlock-sha.c
@@ -304,7 +304,7 @@ MODULE_DESCRIPTION("VIA PadLock SHA1/SHA256 algorithms support.");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michal Ludvig");
 
-MODULE_ALIAS("sha1");
-MODULE_ALIAS("sha256");
+MODULE_ALIAS("sha1-all");
+MODULE_ALIAS("sha256-all");
 MODULE_ALIAS("sha1-padlock");
 MODULE_ALIAS("sha256-padlock");
diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c
index 33bd75347518..25b743abfb59 100644
--- a/drivers/dca/dca-core.c
+++ b/drivers/dca/dca-core.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2007 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 732fa1ec36ab..e190d8b30700 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -430,13 +430,15 @@ late_initcall(dmatest_init);
 static void __exit dmatest_exit(void)
 {
         struct dmatest_chan *dtc, *_dtc;
+        struct dma_chan *chan;
 
         list_for_each_entry_safe(dtc, _dtc, &dmatest_channels, node) {
                 list_del(&dtc->node);
+                chan = dtc->chan;
                 dmatest_cleanup_channel(dtc);
                 pr_debug("dmatest: dropped channel %s\n",
-                         dma_chan_name(dtc->chan));
-                dma_release_channel(dtc->chan);
+                         dma_chan_name(chan));
+                dma_release_channel(chan);
         }
 }
 module_exit(dmatest_exit);
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 70126a606239..86d6da47f558 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -158,7 +158,8 @@ static void dma_start(struct fsl_dma_chan *fsl_chan)
 
 static void dma_halt(struct fsl_dma_chan *fsl_chan)
 {
-        int i = 0;
+        int i;
+
         DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
                 DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) | FSL_DMA_MR_CA,
                 32);
@@ -166,8 +167,11 @@ static void dma_halt(struct fsl_dma_chan *fsl_chan)
                 DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) & ~(FSL_DMA_MR_CS
                 | FSL_DMA_MR_EMS_EN | FSL_DMA_MR_CA), 32);
 
-        while (!dma_is_idle(fsl_chan) && (i++ < 100))
+        for (i = 0; i < 100; i++) {
+                if (dma_is_idle(fsl_chan))
+                        break;
                 udelay(10);
+        }
         if (i >= 100 && !dma_is_idle(fsl_chan))
                 dev_err(fsl_chan->dev, "DMA halt timeout!\n");
 }
diff --git a/drivers/dma/ioat.c b/drivers/dma/ioat.c
index 4105d6575b64..ed83dd9df192 100644
--- a/drivers/dma/ioat.c
+++ b/drivers/dma/ioat.c
@@ -1,6 +1,6 @@
 /*
  * Intel I/OAT DMA Linux driver
- * Copyright(c) 2007 Intel Corporation.
+ * Copyright(c) 2007 - 2009 Intel Corporation.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
diff --git a/drivers/dma/ioat_dca.c b/drivers/dma/ioat_dca.c
index 6cf622da0286..c012a1e15043 100644
--- a/drivers/dma/ioat_dca.c
+++ b/drivers/dma/ioat_dca.c
@@ -1,6 +1,6 @@
 /*
  * Intel I/OAT DMA Linux driver
- * Copyright(c) 2007 Intel Corporation.
+ * Copyright(c) 2007 - 2009 Intel Corporation.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -49,6 +49,23 @@
 
 #define DCA_TAG_MAP_MASK 0xDF
 
+/* expected tag map bytes for I/OAT ver.2 */
+#define DCA2_TAG_MAP_BYTE0 0x80
+#define DCA2_TAG_MAP_BYTE1 0x0
+#define DCA2_TAG_MAP_BYTE2 0x81
+#define DCA2_TAG_MAP_BYTE3 0x82
+#define DCA2_TAG_MAP_BYTE4 0x82
+
+/* verify if tag map matches expected values */
+static inline int dca2_tag_map_valid(u8 *tag_map)
+{
+        return ((tag_map[0] == DCA2_TAG_MAP_BYTE0) &&
+                (tag_map[1] == DCA2_TAG_MAP_BYTE1) &&
+                (tag_map[2] == DCA2_TAG_MAP_BYTE2) &&
+                (tag_map[3] == DCA2_TAG_MAP_BYTE3) &&
+                (tag_map[4] == DCA2_TAG_MAP_BYTE4));
+}
+
 /*
  * "Legacy" DCA systems do not implement the DCA register set in the
  * I/OAT device.  Software needs direct support for their tag mappings.
@@ -452,6 +469,13 @@ struct dca_provider *ioat2_dca_init(struct pci_dev *pdev, void __iomem *iobase)
                         ioatdca->tag_map[i] = 0;
         }
 
+        if (!dca2_tag_map_valid(ioatdca->tag_map)) {
+                dev_err(&pdev->dev, "APICID_TAG_MAP set incorrectly by BIOS, "
+                        "disabling DCA\n");
+                free_dca_provider(dca);
+                return NULL;
+        }
+
         err = register_dca_provider(dca, &pdev->dev);
         if (err) {
                 free_dca_provider(dca);
diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
index b3759c4b6536..5905cd36bcd2 100644
--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -1,6 +1,6 @@
 /*
  * Intel I/OAT DMA Linux driver
- * Copyright(c) 2004 - 2007 Intel Corporation.
+ * Copyright(c) 2004 - 2009 Intel Corporation.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -189,11 +189,13 @@ static int ioat_dma_enumerate_channels(struct ioatdma_device *device)
                 ioat_chan->xfercap = xfercap;
                 ioat_chan->desccount = 0;
                 INIT_DELAYED_WORK(&ioat_chan->work, ioat_dma_chan_reset_part2);
-                if (ioat_chan->device->version != IOAT_VER_1_2) {
-                        writel(IOAT_DCACTRL_CMPL_WRITE_ENABLE
-                                        | IOAT_DMA_DCA_ANY_CPU,
-                                ioat_chan->reg_base + IOAT_DCACTRL_OFFSET);
-                }
+                if (ioat_chan->device->version == IOAT_VER_2_0)
+                        writel(IOAT_DCACTRL_CMPL_WRITE_ENABLE |
+                               IOAT_DMA_DCA_ANY_CPU,
+                               ioat_chan->reg_base + IOAT_DCACTRL_OFFSET);
+                else if (ioat_chan->device->version == IOAT_VER_3_0)
+                        writel(IOAT_DMA_DCA_ANY_CPU,
+                               ioat_chan->reg_base + IOAT_DCACTRL_OFFSET);
                 spin_lock_init(&ioat_chan->cleanup_lock);
                 spin_lock_init(&ioat_chan->desc_lock);
                 INIT_LIST_HEAD(&ioat_chan->free_desc);
@@ -1169,9 +1171,8 @@ static void ioat_dma_memcpy_cleanup(struct ioat_dma_chan *ioat_chan)
                                  * up if the client is done with the descriptor
                                  */
                                 if (async_tx_test_ack(&desc->async_tx)) {
-                                        list_del(&desc->node);
-                                        list_add_tail(&desc->node,
-                                                      &ioat_chan->free_desc);
+                                        list_move_tail(&desc->node,
+                                                       &ioat_chan->free_desc);
                                 } else
                                         desc->async_tx.cookie = 0;
                         } else {
@@ -1362,6 +1363,7 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
         dma_cookie_t cookie;
         int err = 0;
         struct completion cmp;
+        unsigned long tmo;
 
         src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
         if (!src)
@@ -1413,9 +1415,10 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
         }
         device->common.device_issue_pending(dma_chan);
 
-        wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));
+        tmo = wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));
 
-        if (device->common.device_is_tx_complete(dma_chan, cookie, NULL, NULL)
+        if (tmo == 0 ||
+            device->common.device_is_tx_complete(dma_chan, cookie, NULL, NULL)
                                         != DMA_SUCCESS) {
                 dev_err(&device->pdev->dev,
                         "Self-test copy timed out, disabling\n");
@@ -1657,6 +1660,13 @@ struct ioatdma_device *ioat_dma_probe(struct pci_dev *pdev,
                 " %d channels, device version 0x%02x, driver version %s\n",
                 device->common.chancnt, device->version, IOAT_DMA_VERSION);
 
+        if (!device->common.chancnt) {
+                dev_err(&device->pdev->dev,
+                        "Intel(R) I/OAT DMA Engine problem found: "
+                        "zero channels detected\n");
+                goto err_setup_interrupts;
+        }
+
         err = ioat_dma_setup_interrupts(device);
         if (err)
                 goto err_setup_interrupts;
@@ -1696,6 +1706,9 @@ void ioat_dma_remove(struct ioatdma_device *device)
         struct dma_chan *chan, *_chan;
         struct ioat_dma_chan *ioat_chan;
 
+        if (device->version != IOAT_VER_3_0)
+                cancel_delayed_work(&device->work);
+
         ioat_dma_remove_interrupts(device);
 
         dma_async_device_unregister(&device->common);
@@ -1707,10 +1720,6 @@ void ioat_dma_remove(struct ioatdma_device *device)
         pci_release_regions(device->pdev);
         pci_disable_device(device->pdev);
 
-        if (device->version != IOAT_VER_3_0) {
-                cancel_delayed_work(&device->work);
-        }
-
         list_for_each_entry_safe(chan, _chan,
                                  &device->common.channels, device_node) {
                 ioat_chan = to_ioat_chan(chan);
diff --git a/drivers/dma/ioatdma.h b/drivers/dma/ioatdma.h
index a3306d0e1372..a52ff4bd4601 100644
--- a/drivers/dma/ioatdma.h
+++ b/drivers/dma/ioatdma.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2004 - 2007 Intel Corporation. All rights reserved.
+ * Copyright(c) 2004 - 2009 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
@@ -29,7 +29,7 @@
 #include <linux/pci_ids.h>
 #include <net/tcp.h>
 
-#define IOAT_DMA_VERSION  "3.30"
+#define IOAT_DMA_VERSION  "3.64"
 
 enum ioat_interrupt {
         none = 0,
@@ -135,12 +135,14 @@ static inline void ioat_set_tcp_copy_break(struct ioatdma_device *dev)
         #ifdef CONFIG_NET_DMA
         switch (dev->version) {
         case IOAT_VER_1_2:
-        case IOAT_VER_3_0:
                 sysctl_tcp_dma_copybreak = 4096;
                 break;
         case IOAT_VER_2_0:
                 sysctl_tcp_dma_copybreak = 2048;
                 break;
+        case IOAT_VER_3_0:
+                sysctl_tcp_dma_copybreak = 262144;
+                break;
         }
         #endif
 }
diff --git a/drivers/dma/ioatdma_hw.h b/drivers/dma/ioatdma_hw.h
index f1ae2c776f74..afa57eef86c9 100644
--- a/drivers/dma/ioatdma_hw.h
+++ b/drivers/dma/ioatdma_hw.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2004 - 2007 Intel Corporation. All rights reserved.
+ * Copyright(c) 2004 - 2009 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
diff --git a/drivers/dma/ioatdma_registers.h b/drivers/dma/ioatdma_registers.h
index 827cb503cac6..49bc277424f8 100644
--- a/drivers/dma/ioatdma_registers.h
+++ b/drivers/dma/ioatdma_registers.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2004 - 2007 Intel Corporation. All rights reserved.
+ * Copyright(c) 2004 - 2009 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
index ea5440dd10dc..16adbe61cfb2 100644
--- a/drivers/dma/iop-adma.c
+++ b/drivers/dma/iop-adma.c
@@ -928,19 +928,19 @@ iop_adma_xor_zero_sum_self_test(struct iop_adma_device *device)
 
         for (src_idx = 0; src_idx < IOP_ADMA_NUM_SRC_TEST; src_idx++) {
                 xor_srcs[src_idx] = alloc_page(GFP_KERNEL);
-                if (!xor_srcs[src_idx])
-                        while (src_idx--) {
+                if (!xor_srcs[src_idx]) {
+                        while (src_idx--)
                                 __free_page(xor_srcs[src_idx]);
-                                return -ENOMEM;
-                        }
+                        return -ENOMEM;
+                }
         }
 
         dest = alloc_page(GFP_KERNEL);
-        if (!dest)
-                while (src_idx--) {
+        if (!dest) {
+                while (src_idx--)
                         __free_page(xor_srcs[src_idx]);
-                        return -ENOMEM;
-                }
+                return -ENOMEM;
+        }
 
         /* Fill in src buffers */
         for (src_idx = 0; src_idx < IOP_ADMA_NUM_SRC_TEST; src_idx++) {
@@ -1401,7 +1401,7 @@ MODULE_ALIAS("platform:iop-adma");
 
 static struct platform_driver iop_adma_driver = {
         .probe          = iop_adma_probe,
-        .remove         = iop_adma_remove,
+        .remove         = __devexit_p(iop_adma_remove),
         .driver         = {
                 .owner  = THIS_MODULE,
                 .name   = "iop-adma",
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index 1f154d08e98f..ae50a9d1a4e6 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -729,7 +729,7 @@ static int ipu_init_channel_buffer(struct idmac_channel *ichan,
 
         ichan->status = IPU_CHANNEL_READY;
 
-        spin_unlock_irqrestore(ipu->lock, flags);
+        spin_unlock_irqrestore(&ipu->lock, flags);
 
         return 0;
 }
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index d35cbd1ff0b3..cb7f26fb9f18 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1019,19 +1019,19 @@ mv_xor_xor_self_test(struct mv_xor_device *device)
 
         for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
                 xor_srcs[src_idx] = alloc_page(GFP_KERNEL);
-                if (!xor_srcs[src_idx])
-                        while (src_idx--) {
+                if (!xor_srcs[src_idx]) {
+                        while (src_idx--)
                                 __free_page(xor_srcs[src_idx]);
-                                return -ENOMEM;
-                        }
+                        return -ENOMEM;
+                }
         }
 
         dest = alloc_page(GFP_KERNEL);
-        if (!dest)
-                while (src_idx--) {
+        if (!dest) {
+                while (src_idx--)
                         __free_page(xor_srcs[src_idx]);
-                        return -ENOMEM;
-                }
+                return -ENOMEM;
+        }
 
         /* Fill in src buffers */
         for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
@@ -1287,7 +1287,7 @@ mv_xor_conf_mbus_windows(struct mv_xor_shared_private *msp,
 
 static struct platform_driver mv_xor_driver = {
         .probe          = mv_xor_probe,
-        .remove         = mv_xor_remove,
+        .remove         = __devexit_p(mv_xor_remove),
         .driver         = {
                 .owner  = THIS_MODULE,
                 .name   = MV_XOR_NAME,
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index 72c667f9bee1..12715d3c078d 100644
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -420,7 +420,7 @@ int drm_rmmap_locked(struct drm_device *dev, drm_local_map_t *map)
                                 dev->sigdata.lock = NULL;
                         master->lock.hw_lock = NULL;   /* SHM removed */
                         master->lock.file_priv = NULL;
-                        wake_up_interruptible(&master->lock.lock_queue);
+                        wake_up_interruptible_all(&master->lock.lock_queue);
                 }
                 break;
         case _DRM_AGP:
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 733028b4d45e..1c3a8c557140 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -452,6 +452,59 @@ static void drm_setup_crtcs(struct drm_device *dev)
         kfree(modes);
         kfree(enabled);
 }
+
+/**
+ * drm_encoder_crtc_ok - can a given crtc drive a given encoder?
+ * @encoder: encoder to test
+ * @crtc: crtc to test
+ *
+ * Return false if @encoder can't be driven by @crtc, true otherwise.
+ */
+static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
+                                struct drm_crtc *crtc)
+{
+        struct drm_device *dev;
+        struct drm_crtc *tmp;
+        int crtc_mask = 1;
+
+        WARN(!crtc, "checking null crtc?");
+
+        dev = crtc->dev;
+
+        list_for_each_entry(tmp, &dev->mode_config.crtc_list, head) {
+                if (tmp == crtc)
+                        break;
+                crtc_mask <<= 1;
+        }
+
+        if (encoder->possible_crtcs & crtc_mask)
+                return true;
+        return false;
+}
+
+/*
+ * Check the CRTC we're going to map each output to vs. its current
+ * CRTC.  If they don't match, we have to disable the output and the CRTC
+ * since the driver will have to re-route things.
+ */
+static void
+drm_crtc_prepare_encoders(struct drm_device *dev)
+{
+        struct drm_encoder_helper_funcs *encoder_funcs;
+        struct drm_encoder *encoder;
+
+        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+                encoder_funcs = encoder->helper_private;
+                /* Disable unused encoders */
+                if (encoder->crtc == NULL)
+                        (*encoder_funcs->dpms)(encoder, DRM_MODE_DPMS_OFF);
+                /* Disable encoders whose CRTC is about to change */
+                if (encoder_funcs->get_crtc &&
+                    encoder->crtc != (*encoder_funcs->get_crtc)(encoder))
+                        (*encoder_funcs->dpms)(encoder, DRM_MODE_DPMS_OFF);
+        }
+}
+
 /**
  * drm_crtc_set_mode - set a mode
  * @crtc: CRTC to program
@@ -547,6 +600,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
                 encoder_funcs->prepare(encoder);
         }
 
+        drm_crtc_prepare_encoders(dev);
+
         crtc_funcs->prepare(crtc);
 
         /* Set up the DPLL and any encoders state that needs to adjust or depend
@@ -617,7 +672,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
         struct drm_device *dev;
         struct drm_crtc **save_crtcs, *new_crtc;
         struct drm_encoder **save_encoders, *new_encoder;
-        struct drm_framebuffer *old_fb;
+        struct drm_framebuffer *old_fb = NULL;
         bool save_enabled;
         bool mode_changed = false;
         bool fb_changed = false;
@@ -668,9 +723,10 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
          * and then just flip_or_move it */
         if (set->crtc->fb != set->fb) {
                 /* If we have no fb then treat it as a full mode set */
-                if (set->crtc->fb == NULL)
+                if (set->crtc->fb == NULL) {
+                        DRM_DEBUG("crtc has no fb, full mode set\n");
                         mode_changed = true;
-                else if ((set->fb->bits_per_pixel !=
+                } else if ((set->fb->bits_per_pixel !=
                          set->crtc->fb->bits_per_pixel) ||
                          set->fb->depth != set->crtc->fb->depth)
                         fb_changed = true;
@@ -682,7 +738,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 fb_changed = true;
 
         if (set->mode && !drm_mode_equal(set->mode, &set->crtc->mode)) {
-                DRM_DEBUG("modes are different\n");
+                DRM_DEBUG("modes are different, full mode set\n");
                 drm_mode_debug_printmodeline(&set->crtc->mode);
                 drm_mode_debug_printmodeline(set->mode);
                 mode_changed = true;
@@ -708,6 +764,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 }
 
                 if (new_encoder != connector->encoder) {
+                        DRM_DEBUG("encoder changed, full mode switch\n");
                         mode_changed = true;
                         connector->encoder = new_encoder;
                 }
@@ -734,10 +791,20 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                         if (set->connectors[ro] == connector)
                                 new_crtc = set->crtc;
                 }
+
+                /* Make sure the new CRTC will work with the encoder */
+                if (new_crtc &&
+                    !drm_encoder_crtc_ok(connector->encoder, new_crtc)) {
+                        ret = -EINVAL;
+                        goto fail_set_mode;
+                }
                 if (new_crtc != connector->encoder->crtc) {
+                        DRM_DEBUG("crtc changed, full mode switch\n");
                         mode_changed = true;
                         connector->encoder->crtc = new_crtc;
                 }
+                DRM_DEBUG("setting connector %d crtc to %p\n",
+                          connector->base.id, new_crtc);
         }
 
         /* mode_set_base is not a required function */
@@ -781,6 +848,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
 
 fail_set_mode:
         set->crtc->enabled = save_enabled;
+        set->crtc->fb = old_fb;
         count = 0;
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 if (!connector->encoder)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 5a4d3244758a..a839a28d8ee6 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -125,7 +125,7 @@ static bool edid_is_valid(struct edid *edid)
                 DRM_ERROR("EDID has major version %d, instead of 1\n", edid->version);
                 goto bad;
         }
-        if (edid->revision <= 0 || edid->revision > 3) {
+        if (edid->revision > 3) {
                 DRM_ERROR("EDID has minor version %d, which is not between 0-3\n", edid->revision);
                 goto bad;
         }
@@ -320,10 +320,10 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
         mode->htotal = mode->hdisplay + ((pt->hblank_hi << 8) | pt->hblank_lo);
 
         mode->vdisplay = (pt->vactive_hi << 8) | pt->vactive_lo;
-        mode->vsync_start = mode->vdisplay + ((pt->vsync_offset_hi << 8) |
+        mode->vsync_start = mode->vdisplay + ((pt->vsync_offset_hi << 4) |
                                               pt->vsync_offset_lo);
         mode->vsync_end = mode->vsync_start +
-                ((pt->vsync_pulse_width_hi << 8) |
+                ((pt->vsync_pulse_width_hi << 4) |
                  pt->vsync_pulse_width_lo);
         mode->vtotal = mode->vdisplay + ((pt->vblank_hi << 8) | pt->vblank_lo);
 
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index 6c020fe5431c..f52663ebe016 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -484,6 +484,7 @@ int drm_release(struct inode *inode, struct file *filp)
         mutex_lock(&dev->struct_mutex);
 
         if (file_priv->is_master) {
+                struct drm_master *master = file_priv->master;
                 struct drm_file *temp;
                 list_for_each_entry(temp, &dev->filelist, lhead) {
                         if ((temp->master == file_priv->master) &&
@@ -491,6 +492,19 @@ int drm_release(struct inode *inode, struct file *filp)
                                 temp->authenticated = 0;
                 }
 
+                /**
+                 * Since the master is disappearing, so is the
+                 * possibility to lock.
+                 */
+
+                if (master->lock.hw_lock) {
+                        if (dev->sigdata.lock == master->lock.hw_lock)
+                                dev->sigdata.lock = NULL;
+                        master->lock.hw_lock = NULL;
+                        master->lock.file_priv = NULL;
+                        wake_up_interruptible_all(&master->lock.lock_queue);
+                }
+
                 if (file_priv->minor->master == file_priv->master) {
                         /* drop the reference held my the minor */
                         drm_master_put(&file_priv->minor->master);
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 3795dbc0f50c..93e677a481f5 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -435,6 +435,8 @@ EXPORT_SYMBOL(drm_vblank_get);
  */
 void drm_vblank_put(struct drm_device *dev, int crtc)
 {
+        BUG_ON (atomic_read (&dev->vblank_refcount[crtc]) == 0);
+
         /* Last user schedules interrupt disable */
         if (atomic_dec_and_test(&dev->vblank_refcount[crtc]))
                 mod_timer(&dev->vblank_disable_timer, jiffies + 5*DRM_HZ);
@@ -460,8 +462,9 @@ void drm_vblank_pre_modeset(struct drm_device *dev, int crtc)
          * so that interrupts remain enabled in the interim.
          */
         if (!dev->vblank_inmodeset[crtc]) {
-                dev->vblank_inmodeset[crtc] = 1;
-                drm_vblank_get(dev, crtc);
+                dev->vblank_inmodeset[crtc] = 0x1;
+                if (drm_vblank_get(dev, crtc) == 0)
+                        dev->vblank_inmodeset[crtc] |= 0x2;
         }
 }
 EXPORT_SYMBOL(drm_vblank_pre_modeset);
@@ -473,9 +476,12 @@ void drm_vblank_post_modeset(struct drm_device *dev, int crtc)
         if (dev->vblank_inmodeset[crtc]) {
                 spin_lock_irqsave(&dev->vbl_lock, irqflags);
                 dev->vblank_disable_allowed = 1;
-                dev->vblank_inmodeset[crtc] = 0;
                 spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
-                drm_vblank_put(dev, crtc);
+
+                if (dev->vblank_inmodeset[crtc] & 0x2)
+                        drm_vblank_put(dev, crtc);
+
+                dev->vblank_inmodeset[crtc] = 0;
         }
 }
 EXPORT_SYMBOL(drm_vblank_post_modeset);
diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
index 46e7b28f0707..e2f70a516c34 100644
--- a/drivers/gpu/drm/drm_lock.c
+++ b/drivers/gpu/drm/drm_lock.c
@@ -80,6 +80,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
                 __set_current_state(TASK_INTERRUPTIBLE);
                 if (!master->lock.hw_lock) {
                         /* Device has been unregistered */
+                        send_sig(SIGTERM, current, 0);
                         ret = -EINTR;
                         break;
                 }
@@ -93,7 +94,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
                 /* Contention */
                 schedule();
                 if (signal_pending(current)) {
-                        ret = -ERESTARTSYS;
+                        ret = -EINTR;
                         break;
                 }
         }
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index 46bb923b097c..7c8b15b22bf2 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -146,14 +146,6 @@ static void drm_master_destroy(struct kref *kref)
 
         drm_ht_remove(&master->magiclist);
 
-        if (master->lock.hw_lock) {
-                if (dev->sigdata.lock == master->lock.hw_lock)
-                        dev->sigdata.lock = NULL;
-                master->lock.hw_lock = NULL;
-                master->lock.file_priv = NULL;
-                wake_up_interruptible(&master->lock.lock_queue);
-        }
-
         drm_free(master, sizeof(*master), DRM_MEM_DRIVER);
 }
 
@@ -176,7 +168,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
             file_priv->minor->master != file_priv->master) {
                 mutex_lock(&dev->struct_mutex);
                 file_priv->minor->master = drm_master_get(file_priv->master);
-                mutex_lock(&dev->struct_mutex);
+                mutex_unlock(&dev->struct_mutex);
         }
 
         return 0;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 2d797ffe8137..6d21b9e48b89 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -811,7 +811,7 @@ static int i915_set_status_page(struct drm_device *dev, void *data,
         dev_priv->hws_map.flags = 0;
         dev_priv->hws_map.mtrr = 0;
 
-        drm_core_ioremap(&dev_priv->hws_map, dev);
+        drm_core_ioremap_wc(&dev_priv->hws_map, dev);
         if (dev_priv->hws_map.handle == NULL) {
                 i915_dma_cleanup(dev);
                 dev_priv->status_gfx_addr = 0;
@@ -1090,6 +1090,11 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         dev_priv->mm.gtt_mapping =
                 io_mapping_create_wc(dev->agp->base,
                                      dev->agp->agp_info.aper_size * 1024*1024);
+        if (dev_priv->mm.gtt_mapping == NULL) {
+                ret = -EIO;
+                goto out_rmmap;
+        }
+
         /* Set up a WC MTRR for non-PAT systems.  This is more common than
          * one would think, because the kernel disables PAT on first
          * generation Core chips because WC PAT gets overridden by a UC
@@ -1100,7 +1105,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                                          1024 * 1024,
                                          MTRR_TYPE_WRCOMB, 1);
         if (dev_priv->mm.gtt_mtrr < 0) {
-                DRM_INFO("MTRR allocation failed\n.  Graphics "
+                DRM_INFO("MTRR allocation failed.  Graphics "
                          "performance may suffer.\n");
         }
 
@@ -1122,7 +1127,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         if (!I915_NEED_GFX_HWS(dev)) {
                 ret = i915_init_phys_hws(dev);
                 if (ret != 0)
-                        goto out_rmmap;
+                        goto out_iomapfree;
         }
 
         /* On the 945G/GM, the chipset reports the MSI capability on the
@@ -1161,6 +1166,8 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
 
         return 0;
 
+out_iomapfree:
+        io_mapping_free(dev_priv->mm.gtt_mapping);
 out_rmmap:
         iounmap(dev_priv->regs);
 free_priv:
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 17fa40858d26..d6cc9861e0a1 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -279,7 +279,6 @@ typedef struct drm_i915_private {
         u8 saveAR_INDEX;
         u8 saveAR[21];
         u8 saveDACMASK;
-        u8 saveDACDATA[256*3]; /* 256 3-byte colors */
         u8 saveCR[37];
 
         struct {
@@ -457,6 +456,12 @@ struct drm_i915_gem_object {
 
         /** for phy allocated objects */
         struct drm_i915_gem_phys_object *phys_obj;
+
+        /**
+         * Used for checking the object doesn't appear more than once
+         * in an execbuffer object list.
+         */
+        int in_execbuffer;
 };
 
 /**
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 28b726d07a0c..37427e4016cb 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1476,7 +1476,7 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         int regnum = obj_priv->fence_reg;
         int tile_width;
-        uint32_t val;
+        uint32_t fence_reg, val;
         uint32_t pitch_val;
 
         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
@@ -1503,7 +1503,11 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
         val |= pitch_val << I830_FENCE_PITCH_SHIFT;
         val |= I830_FENCE_REG_VALID;
 
-        I915_WRITE(FENCE_REG_830_0 + (regnum * 4), val);
+        if (regnum < 8)
+                fence_reg = FENCE_REG_830_0 + (regnum * 4);
+        else
+                fence_reg = FENCE_REG_945_8 + ((regnum - 8) * 4);
+        I915_WRITE(fence_reg, val);
 }
 
 static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
@@ -1557,7 +1561,8 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         struct drm_i915_fence_reg *reg = NULL;
-        int i, ret;
+        struct drm_i915_gem_object *old_obj_priv = NULL;
+        int i, ret, avail;
 
         switch (obj_priv->tiling_mode) {
         case I915_TILING_NONE:
@@ -1580,25 +1585,46 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write)
         }
 
         /* First try to find a free reg */
+try_again:
+        avail = 0;
         for (i = dev_priv->fence_reg_start; i < dev_priv->num_fence_regs; i++) {
                 reg = &dev_priv->fence_regs[i];
                 if (!reg->obj)
                         break;
+
+                old_obj_priv = reg->obj->driver_private;
+                if (!old_obj_priv->pin_count)
+                    avail++;
         }
 
         /* None available, try to steal one or wait for a user to finish */
         if (i == dev_priv->num_fence_regs) {
-                struct drm_i915_gem_object *old_obj_priv = NULL;
+                uint32_t seqno = dev_priv->mm.next_gem_seqno;
                 loff_t offset;
 
-try_again:
-                /* Could try to use LRU here instead... */
+                if (avail == 0)
+                        return -ENOMEM;
+
                 for (i = dev_priv->fence_reg_start;
                      i < dev_priv->num_fence_regs; i++) {
+                        uint32_t this_seqno;
+
                         reg = &dev_priv->fence_regs[i];
                         old_obj_priv = reg->obj->driver_private;
-                        if (!old_obj_priv->pin_count)
+
+                        if (old_obj_priv->pin_count)
+                                continue;
+
+                        /* i915 uses fences for GPU access to tiled buffers */
+                        if (IS_I965G(dev) || !old_obj_priv->active)
                                 break;
+
+                        /* find the seqno of the first available fence */
+                        this_seqno = old_obj_priv->last_rendering_seqno;
+                        if (this_seqno != 0 &&
+                            reg->obj->write_domain == 0 &&
+                            i915_seqno_passed(seqno, this_seqno))
+                                seqno = this_seqno;
                 }
 
                 /*
@@ -1606,15 +1632,25 @@ try_again:
                  * objects to finish before trying again.
                  */
                 if (i == dev_priv->num_fence_regs) {
-                        ret = i915_gem_object_set_to_gtt_domain(reg->obj, 0);
-                        if (ret) {
-                                WARN(ret != -ERESTARTSYS,
-                                     "switch to GTT domain failed: %d\n", ret);
-                                return ret;
+                        if (seqno == dev_priv->mm.next_gem_seqno) {
+                                i915_gem_flush(dev,
+                                               I915_GEM_GPU_DOMAINS,
+                                               I915_GEM_GPU_DOMAINS);
+                                seqno = i915_add_request(dev,
+                                                         I915_GEM_GPU_DOMAINS);
+                                if (seqno == 0)
+                                        return -ENOMEM;
                         }
+
+                        ret = i915_wait_request(dev, seqno);
+                        if (ret)
+                                return ret;
                         goto try_again;
                 }
 
+                BUG_ON(old_obj_priv->active ||
+                       (reg->obj->write_domain & I915_GEM_GPU_DOMAINS));
+
                 /*
                  * Zap this virtual mapping so we can set up a fence again
                  * for this object next time we need it.
@@ -1655,8 +1691,17 @@ i915_gem_clear_fence_reg(struct drm_gem_object *obj)
 
         if (IS_I965G(dev))
                 I915_WRITE64(FENCE_REG_965_0 + (obj_priv->fence_reg * 8), 0);
-        else
-                I915_WRITE(FENCE_REG_830_0 + (obj_priv->fence_reg * 4), 0);
+        else {
+                uint32_t fence_reg;
+
+                if (obj_priv->fence_reg < 8)
+                        fence_reg = FENCE_REG_830_0 + obj_priv->fence_reg * 4;
+                else
+                        fence_reg = FENCE_REG_945_8 + (obj_priv->fence_reg -
+                                                       8) * 4;
+
+                I915_WRITE(fence_reg, 0);
+        }
 
         dev_priv->fence_regs[obj_priv->fence_reg].obj = NULL;
         obj_priv->fence_reg = I915_FENCE_REG_NONE;
@@ -2469,6 +2514,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
         struct drm_i915_gem_exec_object *exec_list = NULL;
         struct drm_gem_object **object_list = NULL;
         struct drm_gem_object *batch_obj;
+        struct drm_i915_gem_object *obj_priv;
         int ret, i, pinned = 0;
         uint64_t exec_offset;
         uint32_t seqno, flush_domains;
@@ -2533,6 +2579,15 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
                         ret = -EBADF;
                         goto err;
                 }
+
+                obj_priv = object_list[i]->driver_private;
+                if (obj_priv->in_execbuffer) {
+                        DRM_ERROR("Object %p appears more than once in object list\n",
+                                   object_list[i]);
+                        ret = -EBADF;
+                        goto err;
+                }
+                obj_priv->in_execbuffer = true;
         }
 
         /* Pin and relocate */
@@ -2674,8 +2729,13 @@ err:
         for (i = 0; i < pinned; i++)
                 i915_gem_object_unpin(object_list[i]);
 
-        for (i = 0; i < args->buffer_count; i++)
+        for (i = 0; i < args->buffer_count; i++) {
+                if (object_list[i]) {
+                        obj_priv = object_list[i]->driver_private;
+                        obj_priv->in_execbuffer = false;
+                }
                 drm_gem_object_unreference(object_list[i]);
+        }
 
         mutex_unlock(&dev->struct_mutex);
 
@@ -2712,17 +2772,24 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
                 ret = i915_gem_object_bind_to_gtt(obj, alignment);
                 if (ret != 0) {
                         if (ret != -EBUSY && ret != -ERESTARTSYS)
-                                DRM_ERROR("Failure to bind: %d", ret);
+                                DRM_ERROR("Failure to bind: %d\n", ret);
+                        return ret;
+                }
+        }
+        /*
+         * Pre-965 chips need a fence register set up in order to
+         * properly handle tiled surfaces.
+         */
+        if (!IS_I965G(dev) &&
+            obj_priv->fence_reg == I915_FENCE_REG_NONE &&
+            obj_priv->tiling_mode != I915_TILING_NONE) {
+                ret = i915_gem_object_get_fence_reg(obj, true);
+                if (ret != 0) {
+                        if (ret != -EBUSY && ret != -ERESTARTSYS)
+                                DRM_ERROR("Failure to install fence: %d\n",
+                                          ret);
                         return ret;
                 }
-                /*
-                 * Pre-965 chips need a fence register set up in order to
-                 * properly handle tiled surfaces.
-                 */
-                if (!IS_I965G(dev) &&
-                    obj_priv->fence_reg == I915_FENCE_REG_NONE &&
-                    obj_priv->tiling_mode != I915_TILING_NONE)
-                        i915_gem_object_get_fence_reg(obj, true);
         }
         obj_priv->pin_count++;
 
@@ -3548,7 +3615,7 @@ i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
         user_data = (char __user *) (uintptr_t) args->data_ptr;
         obj_addr = obj_priv->phys_obj->handle->vaddr + args->offset;
 
-        DRM_ERROR("obj_addr %p, %lld\n", obj_addr, args->size);
+        DRM_DEBUG("obj_addr %p, %lld\n", obj_addr, args->size);
         ret = copy_from_user(obj_addr, user_data, args->size);
         if (ret)
                 return -EFAULT;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 548ff2c66431..87b6b603469e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -383,12 +383,13 @@ int i915_irq_emit(struct drm_device *dev, void *data,
         drm_i915_irq_emit_t *emit = data;
         int result;
 
-        RING_LOCK_TEST_WITH_RETURN(dev, file_priv);
-
         if (!dev_priv) {
                 DRM_ERROR("called with no initialization\n");
                 return -EINVAL;
         }
+
+        RING_LOCK_TEST_WITH_RETURN(dev, file_priv);
+
         mutex_lock(&dev->struct_mutex);
         result = i915_emit_irq(dev);
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 9d6539a868b3..90600d899413 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -184,6 +184,7 @@
  * Fence registers
  */
 #define FENCE_REG_830_0                 0x2000
+#define FENCE_REG_945_8                 0x3000
 #define   I830_FENCE_START_MASK         0x07f80000
 #define   I830_FENCE_TILING_Y_SHIFT     12
 #define   I830_FENCE_SIZE_BITS(size)    ((ffs((size) >> 19) - 1) << 8)
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 5d84027ee8f3..d669cc2b42c0 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -119,11 +119,6 @@ static void i915_save_vga(struct drm_device *dev)
 
         /* VGA color palette registers */
         dev_priv->saveDACMASK = I915_READ8(VGA_DACMASK);
-        /* DACCRX automatically increments during read */
-        I915_WRITE8(VGA_DACRX, 0);
-        /* Read 3 bytes of color data from each index */
-        for (i = 0; i < 256 * 3; i++)
-                dev_priv->saveDACDATA[i] = I915_READ8(VGA_DACDATA);
 
         /* MSR bits */
         dev_priv->saveMSR = I915_READ8(VGA_MSR_READ);
@@ -225,12 +220,6 @@ static void i915_restore_vga(struct drm_device *dev)
 
         /* VGA color palette registers */
         I915_WRITE8(VGA_DACMASK, dev_priv->saveDACMASK);
-        /* DACCRX automatically increments during read */
-        I915_WRITE8(VGA_DACWX, 0);
-        /* Read 3 bytes of color data from each index */
-        for (i = 0; i < 256 * 3; i++)
-                I915_WRITE8(VGA_DACDATA, dev_priv->saveDACDATA[i]);
-
 }
 
 int i915_save_state(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 65be30dccc77..fc28e2bbd542 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -111,6 +111,12 @@ parse_panel_data(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
         panel_fixed_mode->clock = dvo_timing->clock * 10;
         panel_fixed_mode->type = DRM_MODE_TYPE_PREFERRED;
 
+        /* Some VBTs have bogus h/vtotal values */
+        if (panel_fixed_mode->hsync_end > panel_fixed_mode->htotal)
+                panel_fixed_mode->htotal = panel_fixed_mode->hsync_end + 1;
+        if (panel_fixed_mode->vsync_end > panel_fixed_mode->vtotal)
+                panel_fixed_mode->vtotal = panel_fixed_mode->vsync_end + 1;
+
         drm_mode_set_name(panel_fixed_mode);
 
         dev_priv->vbt_mode = panel_fixed_mode;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 65b635ce28c8..a2834276cb38 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -217,7 +217,7 @@ bool intel_pipe_has_type (struct drm_crtc *crtc, int type)
     return false;
 }
 
-#define INTELPllInvalid(s)   do { DRM_DEBUG(s); return false; } while (0)
+#define INTELPllInvalid(s)   do { /* DRM_DEBUG(s); */ return false; } while (0)
 /**
  * Returns whether the given set of divisors are valid for a given refclk with
  * the given connectors.
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index b84bf066879b..b4eea0292c1a 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -543,8 +543,8 @@ config SENSORS_LM90
         help
           If you say yes here you get support for National Semiconductor LM90,
           LM86, LM89 and LM99, Analog Devices ADM1032 and ADT7461, and Maxim
-          MAX6646, MAX6647, MAX6649, MAX6657, MAX6658, MAX6659, MAX6680 and
-          MAX6681 sensor chips.
+          MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
+          MAX6680, MAX6681 and MAX6692 sensor chips.
 
           This driver can also be built as a module.  If so, the module
           will be called lm90.
diff --git a/drivers/hwmon/abituguru3.c b/drivers/hwmon/abituguru3.c
index e52b38806d03..ad2b3431b725 100644
--- a/drivers/hwmon/abituguru3.c
+++ b/drivers/hwmon/abituguru3.c
@@ -760,8 +760,11 @@ static int abituguru3_read_increment_offset(struct abituguru3_data *data,
 
         for (i = 0; i < offset_count; i++)
                 if ((x = abituguru3_read(data, bank, offset + i, count,
-                                buf + i * count)) != count)
-                        return i * count + (i && (x < 0)) ? 0 : x;
+                                buf + i * count)) != count) {
+                        if (x < 0)
+                                return x;
+                        return i * count + x;
+                }
 
         return i * count;
 }
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index 1692de369969..18a1ba888165 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -617,7 +617,7 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
 static int f75375_probe(struct i2c_client *client,
                 const struct i2c_device_id *id)
 {
-        struct f75375_data *data = i2c_get_clientdata(client);
+        struct f75375_data *data;
         struct f75375s_platform_data *f75375s_pdata = client->dev.platform_data;
         int err;
 
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 95a99c590da2..9157247fed8e 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -213,7 +213,7 @@ static inline u16 FAN16_TO_REG(long rpm)
 
 #define TEMP_TO_REG(val) (SENSORS_LIMIT(((val)<0?(((val)-500)/1000):\
                                         ((val)+500)/1000),-128,127))
-#define TEMP_FROM_REG(val) (((val)>0x80?(val)-0x100:(val))*1000)
+#define TEMP_FROM_REG(val) ((val) * 1000)
 
 #define PWM_TO_REG(val)   ((val) >> 1)
 #define PWM_FROM_REG(val) (((val)&0x7f) << 1)
@@ -267,9 +267,9 @@ struct it87_data {
         u8 has_fan;             /* Bitfield, fans enabled */
         u16 fan[5];             /* Register values, possibly combined */
         u16 fan_min[5];         /* Register values, possibly combined */
-        u8 temp[3];             /* Register value */
-        u8 temp_high[3];        /* Register value */
-        u8 temp_low[3];         /* Register value */
+        s8 temp[3];             /* Register value */
+        s8 temp_high[3];        /* Register value */
+        s8 temp_low[3];         /* Register value */
         u8 sensor;              /* Register value */
         u8 fan_div[3];          /* Register encoding, shifted right */
         u8 vid;                 /* Register encoding, combined */
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index cfc1ee90f5a3..b251d8674b41 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -72,6 +72,7 @@ I2C_CLIENT_INSMOD_7(lm85b, lm85c, adm1027, adt7463, adt7468, emc6d100,
 #define LM85_COMPANY_SMSC               0x5c
 #define LM85_VERSTEP_VMASK              0xf0
 #define LM85_VERSTEP_GENERIC            0x60
+#define LM85_VERSTEP_GENERIC2           0x70
 #define LM85_VERSTEP_LM85C              0x60
 #define LM85_VERSTEP_LM85B              0x62
 #define LM85_VERSTEP_ADM1027            0x60
@@ -334,6 +335,7 @@ static struct lm85_data *lm85_update_device(struct device *dev);
 static const struct i2c_device_id lm85_id[] = {
         { "adm1027", adm1027 },
         { "adt7463", adt7463 },
+        { "adt7468", adt7468 },
         { "lm85", any_chip },
         { "lm85b", lm85b },
         { "lm85c", lm85c },
@@ -408,7 +410,8 @@ static ssize_t show_vid_reg(struct device *dev, struct device_attribute *attr,
         struct lm85_data *data = lm85_update_device(dev);
         int vid;
 
-        if (data->type == adt7463 && (data->vid & 0x80)) {
+        if ((data->type == adt7463 || data->type == adt7468) &&
+            (data->vid & 0x80)) {
                 /* 6-pin VID (VRM 10) */
                 vid = vid_from_reg(data->vid & 0x3f, data->vrm);
         } else {
@@ -1153,7 +1156,8 @@ static int lm85_detect(struct i2c_client *client, int kind,
                         address, company, verstep);
 
                 /* All supported chips have the version in common */
-                if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC) {
+                if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC &&
+                    (verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC2) {
                         dev_dbg(&adapter->dev, "Autodetection failed: "
                                 "unsupported version\n");
                         return -ENODEV;
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index 96a701866726..1aff7575799d 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -32,10 +32,10 @@
  * supported by this driver. These chips lack the remote temperature
  * offset feature.
  *
- * This driver also supports the MAX6646, MAX6647 and MAX6649 chips
- * made by Maxim.  These are again similar to the LM86, but they use
- * unsigned temperature values and can report temperatures from 0 to
- * 145 degrees.
+ * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and
+ * MAX6692 chips made by Maxim.  These are again similar to the LM86,
+ * but they use unsigned temperature values and can report temperatures
+ * from 0 to 145 degrees.
  *
  * This driver also supports the MAX6680 and MAX6681, two other sensor
  * chips made by Maxim. These are quite similar to the other Maxim
diff --git a/drivers/i2c/busses/i2c-acorn.c b/drivers/i2c/busses/i2c-acorn.c
index 9fee3ca17344..9aefb5e5864d 100644
--- a/drivers/i2c/busses/i2c-acorn.c
+++ b/drivers/i2c/busses/i2c-acorn.c
@@ -79,10 +79,11 @@ static struct i2c_algo_bit_data ioc_data = {
         .getsda         = ioc_getsda,
         .getscl         = ioc_getscl,
         .udelay         = 80,
-        .timeout        = 100
+        .timeout        = HZ,
 };
 
 static struct i2c_adapter ioc_ops = {
+        .nr                     = 0,
         .algo_data              = &ioc_data,
 };
 
@@ -90,7 +91,7 @@ static int __init i2c_ioc_init(void)
 {
         force_ones = FORCE_ONES | SCL | SDA;
 
-        return i2c_bit_add_bus(&ioc_ops);
+        return i2c_bit_add_numbered_bus(&ioc_ops);
 }
 
 module_init(i2c_ioc_init);
diff --git a/drivers/i2c/busses/i2c-amd8111.c b/drivers/i2c/busses/i2c-amd8111.c
index edab51973bf5..a7c59908c457 100644
--- a/drivers/i2c/busses/i2c-amd8111.c
+++ b/drivers/i2c/busses/i2c-amd8111.c
@@ -72,7 +72,7 @@ static unsigned int amd_ec_wait_write(struct amd_smbus *smbus)
 {
         int timeout = 500;
 
-        while (timeout-- && (inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_IBF))
+        while ((inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_IBF) && --timeout)
                 udelay(1);
 
         if (!timeout) {
@@ -88,7 +88,7 @@ static unsigned int amd_ec_wait_read(struct amd_smbus *smbus)
 {
         int timeout = 500;
 
-        while (timeout-- && (~inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_OBF))
+        while ((~inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_OBF) && --timeout)
                 udelay(1);
 
         if (!timeout) {
diff --git a/drivers/i2c/busses/i2c-ixp2000.c b/drivers/i2c/busses/i2c-ixp2000.c
index 8e8467970481..c016f7a2c5fc 100644
--- a/drivers/i2c/busses/i2c-ixp2000.c
+++ b/drivers/i2c/busses/i2c-ixp2000.c
@@ -114,7 +114,7 @@ static int ixp2000_i2c_probe(struct platform_device *plat_dev)
         drv_data->algo_data.getsda = ixp2000_bit_getsda;
         drv_data->algo_data.getscl = ixp2000_bit_getscl;
         drv_data->algo_data.udelay = 6;
-        drv_data->algo_data.timeout = 100;
+        drv_data->algo_data.timeout = HZ;
 
         strlcpy(drv_data->adapter.name, plat_dev->dev.driver->name,
                 sizeof(drv_data->adapter.name));
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index eeda276f8f16..7f186bbcb99d 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -482,7 +482,7 @@ mv64xxx_i2c_map_regs(struct platform_device *pd,
         return 0;
 }
 
-static void __devexit
+static void
 mv64xxx_i2c_unmap_regs(struct mv64xxx_i2c_data *drv_data)
 {
         if (drv_data->reg_base) {
@@ -577,7 +577,7 @@ mv64xxx_i2c_remove(struct platform_device *dev)
 
 static struct platform_driver mv64xxx_i2c_driver = {
         .probe  = mv64xxx_i2c_probe,
-        .remove = mv64xxx_i2c_remove,
+        .remove = __devexit_p(mv64xxx_i2c_remove),
         .driver = {
                 .owner  = THIS_MODULE,
                 .name   = MV64XXX_I2C_CTLR_NAME,
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 6af68146c342..bdb1f7510e91 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -644,7 +644,7 @@ static int i2c_pxa_do_pio_xfer(struct pxa_i2c *i2c,
 
         i2c_pxa_start_message(i2c);
 
-        while (timeout-- && i2c->msg_num > 0) {
+        while (i2c->msg_num > 0 && --timeout) {
                 i2c_pxa_handler(0, i2c);
                 udelay(10);
         }
diff --git a/drivers/i2c/busses/scx200_i2c.c b/drivers/i2c/busses/scx200_i2c.c
index 162b74a04886..42df0eca43d5 100644
--- a/drivers/i2c/busses/scx200_i2c.c
+++ b/drivers/i2c/busses/scx200_i2c.c
@@ -76,7 +76,7 @@ static struct i2c_algo_bit_data scx200_i2c_data = {
         .getsda         = scx200_i2c_getsda,
         .getscl         = scx200_i2c_getscl,
         .udelay         = 10,
-        .timeout        = 100,
+        .timeout        = HZ,
 };
 
 static struct i2c_adapter scx200_i2c_ops = {
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index b1c9abe24c7b..e7d984866de0 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1831,7 +1831,8 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter * adapter, u16 addr,
         case I2C_SMBUS_QUICK:
                 msg[0].len = 0;
                 /* Special case: The read/write field is used as data */
-                msg[0].flags = flags | (read_write==I2C_SMBUS_READ)?I2C_M_RD:0;
+                msg[0].flags = flags | (read_write == I2C_SMBUS_READ ?
+                                        I2C_M_RD : 0);
                 num = 1;
                 break;
         case I2C_SMBUS_BYTE:
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index c171988a9f51..7e13d2df9af3 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -35,6 +35,7 @@
 #include <linux/i2c.h>
 #include <linux/i2c-dev.h>
 #include <linux/smp_lock.h>
+#include <linux/jiffies.h>
 #include <asm/uaccess.h>
 
 static struct i2c_driver i2cdev_driver;
@@ -422,7 +423,10 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 client->adapter->retries = arg;
                 break;
         case I2C_TIMEOUT:
-                client->adapter->timeout = arg;
+                /* For historical reasons, user-space sets the timeout
+                 * value in units of 10 ms.
+                 */
+                client->adapter->timeout = msecs_to_jiffies(arg * 10);
                 break;
         default:
                 /* NOTE:  returning a fault code here could cause trouble
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 3dad2299d9c5..5ea3bfad172a 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -46,7 +46,7 @@ menuconfig IDE
           SMART parameters from disk drives.
 
           To compile this driver as a module, choose M here: the
-          module will be called ide.
+          module will be called ide-core.ko.
 
           For further information, please read <file:Documentation/ide/ide.txt>.
 
@@ -721,6 +721,11 @@ config BLK_DEV_IDE_TX4939
         depends on SOC_TX4939
         select BLK_DEV_IDEDMA_SFF
 
+config BLK_DEV_IDE_AT91
+        tristate "Atmel AT91 (SAM9, CAP9, AT572D940HF) IDE support"
+        depends on ARM && ARCH_AT91 && !ARCH_AT91RM9200 && !ARCH_AT91X40
+        select IDE_TIMINGS
+
 config IDE_ARM
         tristate "ARM IDE support"
         depends on ARM && (ARCH_RPC || ARCH_SHARK)
diff --git a/drivers/ide/Makefile b/drivers/ide/Makefile
index d0e3d7d5b467..1c326d94aa6d 100644
--- a/drivers/ide/Makefile
+++ b/drivers/ide/Makefile
@@ -116,3 +116,4 @@ obj-$(CONFIG_BLK_DEV_IDE_AU1XXX)	+= au1xxx-ide.o
 
 obj-$(CONFIG_BLK_DEV_IDE_TX4938)        += tx4938ide.o
 obj-$(CONFIG_BLK_DEV_IDE_TX4939)        += tx4939ide.o
+obj-$(CONFIG_BLK_DEV_IDE_AT91)          += at91_ide.o
diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
index 69660a431cd9..77267c859965 100644
--- a/drivers/ide/amd74xx.c
+++ b/drivers/ide/amd74xx.c
@@ -166,7 +166,7 @@ static unsigned int init_chipset_amd74xx(struct pci_dev *dev)
          * Check for broken FIFO support.
          */
         if (dev->vendor == PCI_VENDOR_ID_AMD &&
-            dev->vendor == PCI_DEVICE_ID_AMD_VIPER_7411)
+            dev->device == PCI_DEVICE_ID_AMD_VIPER_7411)
                 t &= 0x0f;
         else
                 t |= 0xf0;
diff --git a/drivers/ide/at91_ide.c b/drivers/ide/at91_ide.c
new file mode 100644
index 000000000000..1bb50f46388d
--- /dev/null
+++ b/drivers/ide/at91_ide.c
@@ -0,0 +1,467 @@
+/*
+ * IDE host driver for AT91 (SAM9, CAP9, AT572D940HF) Static Memory Controller
+ * with Compact Flash True IDE logic
+ *
+ * Copyright (c) 2008, 2009 Kelvatek Ltd.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+#include <linux/version.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/ide.h>
+#include <linux/platform_device.h>
+
+#include <mach/board.h>
+#include <mach/gpio.h>
+#include <mach/at91sam9263.h>
+#include <mach/at91sam9_smc.h>
+#include <mach/at91sam9263_matrix.h>
+
+#define DRV_NAME "at91_ide"
+
+#define perr(fmt, args...) pr_err(DRV_NAME ": " fmt, ##args)
+#define pdbg(fmt, args...) pr_debug("%s " fmt, __func__, ##args)
+
+/*
+ * Access to IDE device is possible through EBI Static Memory Controller
+ * with Compact Flash logic. For details see EBI and SMC datasheet sections
+ * of any microcontroller from AT91SAM9 family.
+ *
+ * Within SMC chip select address space, lines A[23:21] distinguish Compact
+ * Flash modes (I/O, common memory, attribute memory, True IDE). IDE modes are:
+ *   0x00c0000 - True IDE
+ *   0x00e0000 - Alternate True IDE (Alt Status Register)
+ *
+ * On True IDE mode Task File and Data Register are mapped at the same address.
+ * To distinguish access between these two different bus data width is used:
+ * 8Bit for Task File, 16Bit for Data I/O.
+ *
+ * After initialization we do 8/16 bit flipping (changes in SMC MODE register)
+ * only inside IDE callback routines which are serialized by IDE layer,
+ * so no additional locking needed.
+ */
+
+#define TASK_FILE       0x00c00000
+#define ALT_MODE        0x00e00000
+#define REGS_SIZE       8
+
+#define enter_16bit(cs, mode) do {                                      \
+        mode = at91_sys_read(AT91_SMC_MODE(cs));                        \
+        at91_sys_write(AT91_SMC_MODE(cs), mode | AT91_SMC_DBW_16);      \
+} while (0)
+
+#define leave_16bit(cs, mode) at91_sys_write(AT91_SMC_MODE(cs), mode);
+
+static void set_smc_timings(const u8 chipselect, const u16 cycle,
+                            const u16 setup, const u16 pulse,
+                            const u16 data_float, int use_iordy)
+{
+        unsigned long mode = AT91_SMC_READMODE | AT91_SMC_WRITEMODE |
+                             AT91_SMC_BAT_SELECT;
+
+        /* disable or enable waiting for IORDY signal */
+        if (use_iordy)
+                mode |= AT91_SMC_EXNWMODE_READY;
+
+        /* add data float cycles if needed */
+        if (data_float)
+                mode |= AT91_SMC_TDF_(data_float);
+
+        at91_sys_write(AT91_SMC_MODE(chipselect), mode);
+
+        /* setup timings in SMC */
+        at91_sys_write(AT91_SMC_SETUP(chipselect), AT91_SMC_NWESETUP_(setup) |
+                                                   AT91_SMC_NCS_WRSETUP_(0) |
+                                                   AT91_SMC_NRDSETUP_(setup) |
+                                                   AT91_SMC_NCS_RDSETUP_(0));
+        at91_sys_write(AT91_SMC_PULSE(chipselect), AT91_SMC_NWEPULSE_(pulse) |
+                                                   AT91_SMC_NCS_WRPULSE_(cycle) |
+                                                   AT91_SMC_NRDPULSE_(pulse) |
+                                                   AT91_SMC_NCS_RDPULSE_(cycle));
+        at91_sys_write(AT91_SMC_CYCLE(chipselect), AT91_SMC_NWECYCLE_(cycle) |
+                                                   AT91_SMC_NRDCYCLE_(cycle));
+}
+
+static unsigned int calc_mck_cycles(unsigned int ns, unsigned int mck_hz)
+{
+        u64 tmp = ns;
+
+        tmp *= mck_hz;
+        tmp += 1000*1000*1000 - 1; /* round up */
+        do_div(tmp, 1000*1000*1000);
+        return (unsigned int) tmp;
+}
+
+static void apply_timings(const u8 chipselect, const u8 pio,
+                          const struct ide_timing *timing, int use_iordy)
+{
+        unsigned int t0, t1, t2, t6z;
+        unsigned int cycle, setup, pulse, data_float;
+        unsigned int mck_hz;
+        struct clk *mck;
+
+        /* see table 22 of Compact Flash standard 4.1 for the meaning,
+         * we do not stretch active (t2) time, so setup (t1) + hold time (th)
+         * assure at least minimal recovery (t2i) time */
+        t0 = timing->cyc8b;
+        t1 = timing->setup;
+        t2 = timing->act8b;
+        t6z = (pio < 5) ? 30 : 20;
+
+        pdbg("t0=%u t1=%u t2=%u t6z=%u\n", t0, t1, t2, t6z);
+
+        mck = clk_get(NULL, "mck");
+        BUG_ON(IS_ERR(mck));
+        mck_hz = clk_get_rate(mck);
+        pdbg("mck_hz=%u\n", mck_hz);
+
+        cycle = calc_mck_cycles(t0, mck_hz);
+        setup = calc_mck_cycles(t1, mck_hz);
+        pulse = calc_mck_cycles(t2, mck_hz);
+        data_float = calc_mck_cycles(t6z, mck_hz);
+
+        pdbg("cycle=%u setup=%u pulse=%u data_float=%u\n",
+             cycle, setup, pulse, data_float);
+
+        set_smc_timings(chipselect, cycle, setup, pulse, data_float, use_iordy);
+}
+
+static void at91_ide_input_data(ide_drive_t *drive, struct request *rq,
+                                void *buf, unsigned int len)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct ide_io_ports *io_ports = &hwif->io_ports;
+        u8 chipselect = hwif->select_data;
+        unsigned long mode;
+
+        pdbg("cs %u buf %p len %d\n", chipselect, buf, len);
+
+        len++;
+
+        enter_16bit(chipselect, mode);
+        __ide_mm_insw((void __iomem *) io_ports->data_addr, buf, len / 2);
+        leave_16bit(chipselect, mode);
+}
+
+static void at91_ide_output_data(ide_drive_t *drive, struct request *rq,
+                                 void *buf, unsigned int len)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct ide_io_ports *io_ports = &hwif->io_ports;
+        u8 chipselect = hwif->select_data;
+        unsigned long mode;
+
+        pdbg("cs %u buf %p len %d\n", chipselect,  buf, len);
+
+        enter_16bit(chipselect, mode);
+        __ide_mm_outsw((void __iomem *) io_ports->data_addr, buf, len / 2);
+        leave_16bit(chipselect, mode);
+}
+
+static u8 ide_mm_inb(unsigned long port)
+{
+        return readb((void __iomem *) port);
+}
+
+static void ide_mm_outb(u8 value, unsigned long port)
+{
+        writeb(value, (void __iomem *) port);
+}
+
+static void at91_ide_tf_load(ide_drive_t *drive, ide_task_t *task)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct ide_io_ports *io_ports = &hwif->io_ports;
+        struct ide_taskfile *tf = &task->tf;
+        u8 HIHI = (task->tf_flags & IDE_TFLAG_LBA48) ? 0xE0 : 0xEF;
+
+        if (task->tf_flags & IDE_TFLAG_FLAGGED)
+                HIHI = 0xFF;
+
+        if (task->tf_flags & IDE_TFLAG_OUT_DATA) {
+                u16 data = (tf->hob_data << 8) | tf->data;
+
+                at91_ide_output_data(drive, NULL, &data, 2);
+        }
+
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_FEATURE)
+                ide_mm_outb(tf->hob_feature, io_ports->feature_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_NSECT)
+                ide_mm_outb(tf->hob_nsect, io_ports->nsect_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_LBAL)
+                ide_mm_outb(tf->hob_lbal, io_ports->lbal_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_LBAM)
+                ide_mm_outb(tf->hob_lbam, io_ports->lbam_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_LBAH)
+                ide_mm_outb(tf->hob_lbah, io_ports->lbah_addr);
+
+        if (task->tf_flags & IDE_TFLAG_OUT_FEATURE)
+                ide_mm_outb(tf->feature, io_ports->feature_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_NSECT)
+                ide_mm_outb(tf->nsect, io_ports->nsect_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_LBAL)
+                ide_mm_outb(tf->lbal, io_ports->lbal_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_LBAM)
+                ide_mm_outb(tf->lbam, io_ports->lbam_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_LBAH)
+                ide_mm_outb(tf->lbah, io_ports->lbah_addr);
+
+        if (task->tf_flags & IDE_TFLAG_OUT_DEVICE)
+                ide_mm_outb((tf->device & HIHI) | drive->select, io_ports->device_addr);
+}
+
+static void at91_ide_tf_read(ide_drive_t *drive, ide_task_t *task)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct ide_io_ports *io_ports = &hwif->io_ports;
+        struct ide_taskfile *tf = &task->tf;
+
+        if (task->tf_flags & IDE_TFLAG_IN_DATA) {
+                u16 data;
+
+                at91_ide_input_data(drive, NULL, &data, 2);
+                tf->data = data & 0xff;
+                tf->hob_data = (data >> 8) & 0xff;
+        }
+
+        /* be sure we're looking at the low order bits */
+        ide_mm_outb(ATA_DEVCTL_OBS & ~0x80, io_ports->ctl_addr);
+
+        if (task->tf_flags & IDE_TFLAG_IN_FEATURE)
+                tf->feature = ide_mm_inb(io_ports->feature_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_NSECT)
+                tf->nsect  = ide_mm_inb(io_ports->nsect_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_LBAL)
+                tf->lbal   = ide_mm_inb(io_ports->lbal_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_LBAM)
+                tf->lbam   = ide_mm_inb(io_ports->lbam_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_LBAH)
+                tf->lbah   = ide_mm_inb(io_ports->lbah_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_DEVICE)
+                tf->device = ide_mm_inb(io_ports->device_addr);
+
+        if (task->tf_flags & IDE_TFLAG_LBA48) {
+                ide_mm_outb(ATA_DEVCTL_OBS | 0x80, io_ports->ctl_addr);
+
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_FEATURE)
+                        tf->hob_feature = ide_mm_inb(io_ports->feature_addr);
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_NSECT)
+                        tf->hob_nsect   = ide_mm_inb(io_ports->nsect_addr);
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_LBAL)
+                        tf->hob_lbal    = ide_mm_inb(io_ports->lbal_addr);
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_LBAM)
+                        tf->hob_lbam    = ide_mm_inb(io_ports->lbam_addr);
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_LBAH)
+                        tf->hob_lbah    = ide_mm_inb(io_ports->lbah_addr);
+        }
+}
+
+static void at91_ide_set_pio_mode(ide_drive_t *drive, const u8 pio)
+{
+        struct ide_timing *timing;
+        u8 chipselect = drive->hwif->select_data;
+        int use_iordy = 0;
+
+        pdbg("chipselect %u pio %u\n", chipselect, pio);
+
+        timing = ide_timing_find_mode(XFER_PIO_0 + pio);
+        BUG_ON(!timing);
+
+        if ((pio > 2 || ata_id_has_iordy(drive->id)) &&
+            !(ata_id_is_cfa(drive->id) && pio > 4))
+                use_iordy = 1;
+
+        apply_timings(chipselect, pio, timing, use_iordy);
+}
+
+static const struct ide_tp_ops at91_ide_tp_ops = {
+        .exec_command   = ide_exec_command,
+        .read_status    = ide_read_status,
+        .read_altstatus = ide_read_altstatus,
+        .set_irq        = ide_set_irq,
+
+        .tf_load        = at91_ide_tf_load,
+        .tf_read        = at91_ide_tf_read,
+
+        .input_data     = at91_ide_input_data,
+        .output_data    = at91_ide_output_data,
+};
+
+static const struct ide_port_ops at91_ide_port_ops = {
+        .set_pio_mode   = at91_ide_set_pio_mode,
+};
+
+static const struct ide_port_info at91_ide_port_info __initdata = {
+        .port_ops       = &at91_ide_port_ops,
+        .tp_ops         = &at91_ide_tp_ops,
+        .host_flags     = IDE_HFLAG_MMIO | IDE_HFLAG_NO_DMA | IDE_HFLAG_SINGLE |
+                          IDE_HFLAG_NO_IO_32BIT | IDE_HFLAG_UNMASK_IRQS,
+        .pio_mask       = ATA_PIO5,
+};
+
+/*
+ * If interrupt is delivered through GPIO, IRQ are triggered on falling
+ * and rising edge of signal. Whereas IDE device request interrupt on high
+ * level (rising edge in our case). This mean we have fake interrupts, so
+ * we need to check interrupt pin and exit instantly from ISR when line
+ * is on low level.
+ */
+
+irqreturn_t at91_irq_handler(int irq, void *dev_id)
+{
+        int ntries = 8;
+        int pin_val1, pin_val2;
+
+        /* additional deglitch, line can be noisy in badly designed PCB */
+        do {
+                pin_val1 = at91_get_gpio_value(irq);
+                pin_val2 = at91_get_gpio_value(irq);
+        } while (pin_val1 != pin_val2 && --ntries > 0);
+
+        if (pin_val1 == 0 || ntries <= 0)
+                return IRQ_HANDLED;
+
+        return ide_intr(irq, dev_id);
+}
+
+static int __init at91_ide_probe(struct platform_device *pdev)
+{
+        int ret;
+        hw_regs_t hw;
+        hw_regs_t *hws[] = { &hw, NULL, NULL, NULL };
+        struct ide_host *host;
+        struct resource *res;
+        unsigned long tf_base = 0, ctl_base = 0;
+        struct at91_cf_data *board = pdev->dev.platform_data;
+
+        if (!board)
+                return -ENODEV;
+
+        if (board->det_pin && at91_get_gpio_value(board->det_pin) != 0) {
+                perr("no device detected\n");
+                return -ENODEV;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                perr("can't get memory resource\n");
+                return -ENODEV;
+        }
+
+        if (!devm_request_mem_region(&pdev->dev, res->start + TASK_FILE,
+                                     REGS_SIZE, "ide") ||
+            !devm_request_mem_region(&pdev->dev, res->start + ALT_MODE,
+                                     REGS_SIZE, "alt")) {
+                perr("memory resources in use\n");
+                return -EBUSY;
+        }
+
+        pdbg("chipselect %u irq %u res %08lx\n", board->chipselect,
+             board->irq_pin, (unsigned long) res->start);
+
+        tf_base = (unsigned long) devm_ioremap(&pdev->dev, res->start + TASK_FILE,
+                                               REGS_SIZE);
+        ctl_base = (unsigned long) devm_ioremap(&pdev->dev, res->start + ALT_MODE,
+                                                REGS_SIZE);
+        if (!tf_base || !ctl_base) {
+                perr("can't map memory regions\n");
+                return -EBUSY;
+        }
+
+        memset(&hw, 0, sizeof(hw));
+
+        if (board->flags & AT91_IDE_SWAP_A0_A2) {
+                /* workaround for stupid hardware bug */
+                hw.io_ports.data_addr   = tf_base + 0;
+                hw.io_ports.error_addr  = tf_base + 4;
+                hw.io_ports.nsect_addr  = tf_base + 2;
+                hw.io_ports.lbal_addr   = tf_base + 6;
+                hw.io_ports.lbam_addr   = tf_base + 1;
+                hw.io_ports.lbah_addr   = tf_base + 5;
+                hw.io_ports.device_addr = tf_base + 3;
+                hw.io_ports.command_addr = tf_base + 7;
+                hw.io_ports.ctl_addr    = ctl_base + 3;
+        } else
+                ide_std_init_ports(&hw, tf_base, ctl_base + 6);
+
+        hw.irq = board->irq_pin;
+        hw.chipset = ide_generic;
+        hw.dev = &pdev->dev;
+
+        host = ide_host_alloc(&at91_ide_port_info, hws);
+        if (!host) {
+                perr("failed to allocate ide host\n");
+                return -ENOMEM;
+        }
+
+        /* setup Static Memory Controller - PIO 0 as default */
+        apply_timings(board->chipselect, 0, ide_timing_find_mode(XFER_PIO_0), 0);
+
+        /* with GPIO interrupt we have to do quirks in handler */
+        if (board->irq_pin >= PIN_BASE)
+                host->irq_handler = at91_irq_handler;
+
+        host->ports[0]->select_data = board->chipselect;
+
+        ret = ide_host_register(host, &at91_ide_port_info, hws);
+        if (ret) {
+                perr("failed to register ide host\n");
+                goto err_free_host;
+        }
+        platform_set_drvdata(pdev, host);
+        return 0;
+
+err_free_host:
+        ide_host_free(host);
+        return ret;
+}
+
+static int __exit at91_ide_remove(struct platform_device *pdev)
+{
+        struct ide_host *host = platform_get_drvdata(pdev);
+
+        ide_host_remove(host);
+        return 0;
+}
+
+static struct platform_driver at91_ide_driver = {
+        .driver = {
+                .name = DRV_NAME,
+                .owner = THIS_MODULE,
+        },
+        .remove = __exit_p(at91_ide_remove),
+};
+
+static int __init at91_ide_init(void)
+{
+        return platform_driver_probe(&at91_ide_driver, at91_ide_probe);
+}
+
+static void __exit at91_ide_exit(void)
+{
+        platform_driver_unregister(&at91_ide_driver);
+}
+
+module_init(at91_ide_init);
+module_exit(at91_ide_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Stanislaw Gruszka <stf_xl@wp.pl>");
+
diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
index b2735d28f5cc..ecd1e62ca91a 100644
--- a/drivers/ide/atiixp.c
+++ b/drivers/ide/atiixp.c
@@ -52,7 +52,7 @@ static void atiixp_set_pio_mode(ide_drive_t *drive, const u8 pio)
 {
         struct pci_dev *dev = to_pci_dev(drive->hwif->dev);
         unsigned long flags;
-        int timing_shift = (drive->dn & 2) ? 16 : 0 + (drive->dn & 1) ? 0 : 8;
+        int timing_shift = (drive->dn ^ 1) * 8;
         u32 pio_timing_data;
         u16 pio_mode_data;
 
@@ -85,7 +85,7 @@ static void atiixp_set_dma_mode(ide_drive_t *drive, const u8 speed)
 {
         struct pci_dev *dev = to_pci_dev(drive->hwif->dev);
         unsigned long flags;
-        int timing_shift = (drive->dn & 2) ? 16 : 0 + (drive->dn & 1) ? 0 : 8;
+        int timing_shift = (drive->dn ^ 1) * 8;
         u32 tmp32;
         u16 tmp16;
         u16 udma_ctl = 0;
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 0bfeb0c79d6e..ddfbea41d296 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -55,7 +55,7 @@
 
 static DEFINE_MUTEX(idecd_ref_mutex);
 
-static void ide_cd_release(struct kref *);
+static void ide_cd_release(struct device *);
 
 static struct cdrom_info *ide_cd_get(struct gendisk *disk)
 {
@@ -67,7 +67,7 @@ static struct cdrom_info *ide_cd_get(struct gendisk *disk)
                 if (ide_device_get(cd->drive))
                         cd = NULL;
                 else
-                        kref_get(&cd->kref);
+                        get_device(&cd->dev);
 
         }
         mutex_unlock(&idecd_ref_mutex);
@@ -79,7 +79,7 @@ static void ide_cd_put(struct cdrom_info *cd)
         ide_drive_t *drive = cd->drive;
 
         mutex_lock(&idecd_ref_mutex);
-        kref_put(&cd->kref, ide_cd_release);
+        put_device(&cd->dev);
         ide_device_put(drive);
         mutex_unlock(&idecd_ref_mutex);
 }
@@ -194,6 +194,14 @@ static void cdrom_analyze_sense_data(ide_drive_t *drive,
                         bio_sectors = max(bio_sectors(failed_command->bio), 4U);
                         sector &= ~(bio_sectors - 1);
 
+                        /*
+                         * The SCSI specification allows for the value
+                         * returned by READ CAPACITY to be up to 75 2K
+                         * sectors past the last readable block.
+                         * Therefore, if we hit a medium error within the
+                         * last 75 2K sectors, we decrease the saved size
+                         * value.
+                         */
                         if (sector < get_capacity(info->disk) &&
                             drive->probed_capacity - sector < 4 * 75)
                                 set_capacity(info->disk, sector);
@@ -1790,15 +1798,17 @@ static void ide_cd_remove(ide_drive_t *drive)
         ide_debug_log(IDE_DBG_FUNC, "Call %s\n", __func__);
 
         ide_proc_unregister_driver(drive, info->driver);
-
+        device_del(&info->dev);
         del_gendisk(info->disk);
 
-        ide_cd_put(info);
+        mutex_lock(&idecd_ref_mutex);
+        put_device(&info->dev);
+        mutex_unlock(&idecd_ref_mutex);
 }
 
-static void ide_cd_release(struct kref *kref)
+static void ide_cd_release(struct device *dev)
 {
-        struct cdrom_info *info = to_ide_drv(kref, cdrom_info);
+        struct cdrom_info *info = to_ide_drv(dev, cdrom_info);
         struct cdrom_device_info *devinfo = &info->devinfo;
         ide_drive_t *drive = info->drive;
         struct gendisk *g = info->disk;
@@ -1997,7 +2007,12 @@ static int ide_cd_probe(ide_drive_t *drive)
 
         ide_init_disk(g, drive);
 
-        kref_init(&info->kref);
+        info->dev.parent = &drive->gendev;
+        info->dev.release = ide_cd_release;
+        dev_set_name(&info->dev, dev_name(&drive->gendev));
+
+        if (device_register(&info->dev))
+                goto out_free_disk;
 
         info->drive = drive;
         info->driver = &ide_cdrom_driver;
@@ -2011,7 +2026,7 @@ static int ide_cd_probe(ide_drive_t *drive)
         g->driverfs_dev = &drive->gendev;
         g->flags = GENHD_FL_CD | GENHD_FL_REMOVABLE;
         if (ide_cdrom_setup(drive)) {
-                ide_cd_release(&info->kref);
+                put_device(&info->dev);
                 goto failed;
         }
 
@@ -2021,6 +2036,8 @@ static int ide_cd_probe(ide_drive_t *drive)
         add_disk(g);
         return 0;
 
+out_free_disk:
+        put_disk(g);
 out_free_cd:
         kfree(info);
 failed:
diff --git a/drivers/ide/ide-cd.h b/drivers/ide/ide-cd.h
index ac40d6cb90a2..c878bfcf1116 100644
--- a/drivers/ide/ide-cd.h
+++ b/drivers/ide/ide-cd.h
@@ -80,7 +80,7 @@ struct cdrom_info {
         ide_drive_t             *drive;
         struct ide_driver       *driver;
         struct gendisk          *disk;
-        struct kref             kref;
+        struct device           dev;
 
         /* Buffer for table of contents.  NULL if we haven't allocated
            a TOC buffer for this device yet. */
diff --git a/drivers/ide/ide-disk_proc.c b/drivers/ide/ide-disk_proc.c
index 1146f4204c6e..1f86dcbd2b1c 100644
--- a/drivers/ide/ide-disk_proc.c
+++ b/drivers/ide/ide-disk_proc.c
@@ -125,5 +125,5 @@ const struct ide_proc_devset ide_disk_settings[] = {
         IDE_PROC_DEVSET(multcount,      0,    16),
         IDE_PROC_DEVSET(nowerr,         0,     1),
         IDE_PROC_DEVSET(wcache,         0,     1),
-        { 0 },
+        { NULL },
 };
diff --git a/drivers/ide/ide-floppy_proc.c b/drivers/ide/ide-floppy_proc.c
index 3ec762cb60ab..fcd4d8153df5 100644
--- a/drivers/ide/ide-floppy_proc.c
+++ b/drivers/ide/ide-floppy_proc.c
@@ -29,5 +29,5 @@ const struct ide_proc_devset ide_floppy_settings[] = {
         IDE_PROC_DEVSET(bios_head, 0,  255),
         IDE_PROC_DEVSET(bios_sect, 0,   63),
         IDE_PROC_DEVSET(ticks,     0,  255),
-        { 0 },
+        { NULL },
 };
diff --git a/drivers/ide/ide-gd.c b/drivers/ide/ide-gd.c
index 7857b209c6df..047109419902 100644
--- a/drivers/ide/ide-gd.c
+++ b/drivers/ide/ide-gd.c
@@ -25,7 +25,7 @@ module_param(debug_mask, ulong, 0644);
 
 static DEFINE_MUTEX(ide_disk_ref_mutex);
 
-static void ide_disk_release(struct kref *);
+static void ide_disk_release(struct device *);
 
 static struct ide_disk_obj *ide_disk_get(struct gendisk *disk)
 {
@@ -37,7 +37,7 @@ static struct ide_disk_obj *ide_disk_get(struct gendisk *disk)
                 if (ide_device_get(idkp->drive))
                         idkp = NULL;
                 else
-                        kref_get(&idkp->kref);
+                        get_device(&idkp->dev);
         }
         mutex_unlock(&ide_disk_ref_mutex);
         return idkp;
@@ -48,7 +48,7 @@ static void ide_disk_put(struct ide_disk_obj *idkp)
         ide_drive_t *drive = idkp->drive;
 
         mutex_lock(&ide_disk_ref_mutex);
-        kref_put(&idkp->kref, ide_disk_release);
+        put_device(&idkp->dev);
         ide_device_put(drive);
         mutex_unlock(&ide_disk_ref_mutex);
 }
@@ -66,17 +66,18 @@ static void ide_gd_remove(ide_drive_t *drive)
         struct gendisk *g = idkp->disk;
 
         ide_proc_unregister_driver(drive, idkp->driver);
-
+        device_del(&idkp->dev);
         del_gendisk(g);
-
         drive->disk_ops->flush(drive);
 
-        ide_disk_put(idkp);
+        mutex_lock(&ide_disk_ref_mutex);
+        put_device(&idkp->dev);
+        mutex_unlock(&ide_disk_ref_mutex);
 }
 
-static void ide_disk_release(struct kref *kref)
+static void ide_disk_release(struct device *dev)
 {
-        struct ide_disk_obj *idkp = to_ide_drv(kref, ide_disk_obj);
+        struct ide_disk_obj *idkp = to_ide_drv(dev, ide_disk_obj);
         ide_drive_t *drive = idkp->drive;
         struct gendisk *g = idkp->disk;
 
@@ -348,7 +349,12 @@ static int ide_gd_probe(ide_drive_t *drive)
 
         ide_init_disk(g, drive);
 
-        kref_init(&idkp->kref);
+        idkp->dev.parent = &drive->gendev;
+        idkp->dev.release = ide_disk_release;
+        dev_set_name(&idkp->dev, dev_name(&drive->gendev));
+
+        if (device_register(&idkp->dev))
+                goto out_free_disk;
 
         idkp->drive = drive;
         idkp->driver = &ide_gd_driver;
@@ -373,6 +379,8 @@ static int ide_gd_probe(ide_drive_t *drive)
         add_disk(g);
         return 0;
 
+out_free_disk:
+        put_disk(g);
 out_free_idkp:
         kfree(idkp);
 failed:
diff --git a/drivers/ide/ide-gd.h b/drivers/ide/ide-gd.h
index a86779f0756b..b604bdd318a1 100644
--- a/drivers/ide/ide-gd.h
+++ b/drivers/ide/ide-gd.h
@@ -17,7 +17,7 @@ struct ide_disk_obj {
         ide_drive_t             *drive;
         struct ide_driver       *driver;
         struct gendisk          *disk;
-        struct kref             kref;
+        struct device           dev;
         unsigned int            openers;        /* protected by BKL for now */
 
         /* Last failed packet command */
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 9ee51adf567f..a9a6c208288a 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -908,7 +908,7 @@ void ide_timer_expiry (unsigned long data)
         ide_drive_t     *uninitialized_var(drive);
         ide_handler_t   *handler;
         unsigned long   flags;
-        unsigned long   wait = -1;
+        int             wait = -1;
         int             plug_device = 0;
 
         spin_lock_irqsave(&hwif->lock, flags);
@@ -1162,6 +1162,7 @@ out_early:
 
         return irq_ret;
 }
+EXPORT_SYMBOL_GPL(ide_intr);
 
 /**
  *      ide_do_drive_cmd        -       issue IDE special command
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index 753b92ebe0ae..b1892bd95c6f 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -315,6 +315,8 @@ void ide_output_data(ide_drive_t *drive, struct request *rq, void *buf,
         u8 io_32bit = drive->io_32bit;
         u8 mmio = (hwif->host_flags & IDE_HFLAG_MMIO) ? 1 : 0;
 
+        len++;
+
         if (io_32bit) {
                 unsigned long uninitialized_var(flags);
 
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index ce0818a993f6..ee8e3e7cad51 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -950,6 +950,7 @@ static int ide_port_setup_devices(ide_hwif_t *hwif)
 static int init_irq (ide_hwif_t *hwif)
 {
         struct ide_io_ports *io_ports = &hwif->io_ports;
+        irq_handler_t irq_handler;
         int sa = 0;
 
         mutex_lock(&ide_cfg_mtx);
@@ -959,6 +960,10 @@ static int init_irq (ide_hwif_t *hwif)
         hwif->timer.function = &ide_timer_expiry;
         hwif->timer.data = (unsigned long)hwif;
 
+        irq_handler = hwif->host->irq_handler;
+        if (irq_handler == NULL)
+                irq_handler = ide_intr;
+
 #if defined(__mc68000__)
         sa = IRQF_SHARED;
 #endif /* __mc68000__ */
@@ -969,7 +974,7 @@ static int init_irq (ide_hwif_t *hwif)
         if (io_ports->ctl_addr)
                 hwif->tp_ops->set_irq(hwif, 1);
 
-        if (request_irq(hwif->irq, &ide_intr, sa, hwif->name, hwif))
+        if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
                 goto out_up;
 
         if (!hwif->rqsize) {
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 1d8978b3314a..a7b9287ee0d4 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -231,7 +231,7 @@ static const struct ide_proc_devset ide_generic_settings[] = {
         IDE_PROC_DEVSET(pio_mode, 0, 255),
         IDE_PROC_DEVSET(unmaskirq, 0, 1),
         IDE_PROC_DEVSET(using_dma, 0, 1),
-        { 0 },
+        { NULL },
 };
 
 static void proc_ide_settings_warn(void)
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index d7ecd3c79757..4e6181c7bbda 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -169,7 +169,7 @@ typedef struct ide_tape_obj {
         ide_drive_t             *drive;
         struct ide_driver       *driver;
         struct gendisk          *disk;
-        struct kref             kref;
+        struct device           dev;
 
         /*
          *      failed_pc points to the last failed packet command, or contains
@@ -267,7 +267,7 @@ static DEFINE_MUTEX(idetape_ref_mutex);
 
 static struct class *idetape_sysfs_class;
 
-static void ide_tape_release(struct kref *);
+static void ide_tape_release(struct device *);
 
 static struct ide_tape_obj *ide_tape_get(struct gendisk *disk)
 {
@@ -279,7 +279,7 @@ static struct ide_tape_obj *ide_tape_get(struct gendisk *disk)
                 if (ide_device_get(tape->drive))
                         tape = NULL;
                 else
-                        kref_get(&tape->kref);
+                        get_device(&tape->dev);
         }
         mutex_unlock(&idetape_ref_mutex);
         return tape;
@@ -290,7 +290,7 @@ static void ide_tape_put(struct ide_tape_obj *tape)
         ide_drive_t *drive = tape->drive;
 
         mutex_lock(&idetape_ref_mutex);
-        kref_put(&tape->kref, ide_tape_release);
+        put_device(&tape->dev);
         ide_device_put(drive);
         mutex_unlock(&idetape_ref_mutex);
 }
@@ -308,7 +308,7 @@ static struct ide_tape_obj *ide_tape_chrdev_get(unsigned int i)
         mutex_lock(&idetape_ref_mutex);
         tape = idetape_devs[i];
         if (tape)
-                kref_get(&tape->kref);
+                get_device(&tape->dev);
         mutex_unlock(&idetape_ref_mutex);
         return tape;
 }
@@ -2166,7 +2166,7 @@ static const struct ide_proc_devset idetape_settings[] = {
         __IDE_PROC_DEVSET(speed,        0, 0xffff, NULL, NULL),
         __IDE_PROC_DEVSET(tdsc,         IDETAPE_DSC_RW_MIN, IDETAPE_DSC_RW_MAX,
                                         mulf_tdsc, divf_tdsc),
-        { 0 },
+        { NULL },
 };
 #endif
 
@@ -2256,15 +2256,17 @@ static void ide_tape_remove(ide_drive_t *drive)
         idetape_tape_t *tape = drive->driver_data;
 
         ide_proc_unregister_driver(drive, tape->driver);
-
+        device_del(&tape->dev);
         ide_unregister_region(tape->disk);
 
-        ide_tape_put(tape);
+        mutex_lock(&idetape_ref_mutex);
+        put_device(&tape->dev);
+        mutex_unlock(&idetape_ref_mutex);
 }
 
-static void ide_tape_release(struct kref *kref)
+static void ide_tape_release(struct device *dev)
 {
-        struct ide_tape_obj *tape = to_ide_drv(kref, ide_tape_obj);
+        struct ide_tape_obj *tape = to_ide_drv(dev, ide_tape_obj);
         ide_drive_t *drive = tape->drive;
         struct gendisk *g = tape->disk;
 
@@ -2407,7 +2409,12 @@ static int ide_tape_probe(ide_drive_t *drive)
 
         ide_init_disk(g, drive);
 
-        kref_init(&tape->kref);
+        tape->dev.parent = &drive->gendev;
+        tape->dev.release = ide_tape_release;
+        dev_set_name(&tape->dev, dev_name(&drive->gendev));
+
+        if (device_register(&tape->dev))
+                goto out_free_disk;
 
         tape->drive = drive;
         tape->driver = &idetape_driver;
@@ -2436,6 +2443,8 @@ static int ide_tape_probe(ide_drive_t *drive)
 
         return 0;
 
+out_free_disk:
+        put_disk(g);
 out_free_tape:
         kfree(tape);
 failed:
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index 258805da15c3..0920e3b0c962 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -337,6 +337,7 @@ static int ide_set_dev_param_mask(const char *s, struct kernel_param *kp)
         int a, b, i, j = 1;
         unsigned int *dev_param_mask = (unsigned int *)kp->arg;
 
+        /* controller . device (0 or 1) [ : 1 (set) | 0 (clear) ] */
         if (sscanf(s, "%d.%d:%d", &a, &b, &j) != 3 &&
             sscanf(s, "%d.%d", &a, &b) != 2)
                 return -EINVAL;
@@ -349,7 +350,7 @@ static int ide_set_dev_param_mask(const char *s, struct kernel_param *kp)
         if (j)
                 *dev_param_mask |= (1 << i);
         else
-                *dev_param_mask &= (1 << i);
+                *dev_param_mask &= ~(1 << i);
 
         return 0;
 }
@@ -392,6 +393,8 @@ static int ide_set_disk_chs(const char *str, struct kernel_param *kp)
 {
         int a, b, c = 0, h = 0, s = 0, i, j = 1;
 
+        /* controller . device (0 or 1) : Cylinders , Heads , Sectors */
+        /* controller . device (0 or 1) : 1 (use CHS) | 0 (ignore CHS) */
         if (sscanf(str, "%d.%d:%d,%d,%d", &a, &b, &c, &h, &s) != 5 &&
             sscanf(str, "%d.%d:%d", &a, &b, &j) != 3)
                 return -EINVAL;
@@ -407,7 +410,7 @@ static int ide_set_disk_chs(const char *str, struct kernel_param *kp)
         if (j)
                 ide_disks |= (1 << i);
         else
-                ide_disks &= (1 << i);
+                ide_disks &= ~(1 << i);
 
         ide_disks_chs[i].cyl  = c;
         ide_disks_chs[i].head = h;
@@ -469,6 +472,8 @@ static int ide_set_ignore_cable(const char *s, struct kernel_param *kp)
 {
         int i, j = 1;
 
+        /* controller (ignore) */
+        /* controller : 1 (ignore) | 0 (use) */
         if (sscanf(s, "%d:%d", &i, &j) != 2 && sscanf(s, "%d", &i) != 1)
                 return -EINVAL;
 
@@ -478,7 +483,7 @@ static int ide_set_ignore_cable(const char *s, struct kernel_param *kp)
         if (j)
                 ide_ignore_cable |= (1 << i);
         else
-                ide_ignore_cable &= (1 << i);
+                ide_ignore_cable &= ~(1 << i);
 
         return 0;
 }
diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
index e1c4f5437396..13b8153112ed 100644
--- a/drivers/ide/it821x.c
+++ b/drivers/ide/it821x.c
@@ -5,9 +5,8 @@
  *  May be copied or modified under the terms of the GNU General Public License
  *  Based in part on the ITE vendor provided SCSI driver.
  *
- *  Documentation available from
- *      http://www.ite.com.tw/pc/IT8212F_V04.pdf
- *  Some other documents are NDA.
+ *  Documentation:
+ *      Datasheet is freely available, some other documents under NDA.
  *
  *  The ITE8212 isn't exactly a standard IDE controller. It has two
  *  modes. In pass through mode then it is an IDE controller. In its smart
diff --git a/drivers/ieee1394/dma.h b/drivers/ieee1394/dma.h
index 2727bcd24194..467373cab8e5 100644
--- a/drivers/ieee1394/dma.h
+++ b/drivers/ieee1394/dma.h
@@ -12,6 +12,7 @@
 
 #include <asm/types.h>
 
+struct file;
 struct pci_dev;
 struct scatterlist;
 struct vm_area_struct;
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index 2beb8d94f7bd..872338003721 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -1275,7 +1275,7 @@ static void __exit ieee1394_cleanup(void)
         unregister_chrdev_region(IEEE1394_CORE_DEV, 256);
 }
 
-module_init(ieee1394_init);
+fs_initcall(ieee1394_init);
 module_exit(ieee1394_cleanup);
 
 /* Exported symbols */
@@ -1314,6 +1314,7 @@ EXPORT_SYMBOL(hpsb_make_lock64packet);
 EXPORT_SYMBOL(hpsb_make_phypacket);
 EXPORT_SYMBOL(hpsb_read);
 EXPORT_SYMBOL(hpsb_write);
+EXPORT_SYMBOL(hpsb_lock);
 EXPORT_SYMBOL(hpsb_packet_success);
 
 /** highlevel.c **/
diff --git a/drivers/ieee1394/ieee1394_transactions.c b/drivers/ieee1394/ieee1394_transactions.c
index 10c3d9f8c038..675b3135d5f1 100644
--- a/drivers/ieee1394/ieee1394_transactions.c
+++ b/drivers/ieee1394/ieee1394_transactions.c
@@ -501,8 +501,6 @@ int hpsb_read(struct hpsb_host *host, nodeid_t node, unsigned int generation,
         if (length == 0)
                 return -EINVAL;
 
-        BUG_ON(in_interrupt()); // We can't be called in an interrupt, yet
-
         packet = hpsb_make_readpacket(host, node, addr, length);
 
         if (!packet) {
@@ -550,8 +548,6 @@ int hpsb_write(struct hpsb_host *host, nodeid_t node, unsigned int generation,
         if (length == 0)
                 return -EINVAL;
 
-        BUG_ON(in_interrupt()); // We can't be called in an interrupt, yet
-
         packet = hpsb_make_writepacket(host, node, addr, buffer, length);
 
         if (!packet)
@@ -570,3 +566,30 @@ int hpsb_write(struct hpsb_host *host, nodeid_t node, unsigned int generation,
 
         return retval;
 }
+
+int hpsb_lock(struct hpsb_host *host, nodeid_t node, unsigned int generation,
+              u64 addr, int extcode, quadlet_t *data, quadlet_t arg)
+{
+        struct hpsb_packet *packet;
+        int retval = 0;
+
+        packet = hpsb_make_lockpacket(host, node, addr, extcode, data, arg);
+        if (!packet)
+                return -ENOMEM;
+
+        packet->generation = generation;
+        retval = hpsb_send_packet_and_wait(packet);
+        if (retval < 0)
+                goto hpsb_lock_fail;
+
+        retval = hpsb_packet_success(packet);
+
+        if (retval == 0)
+                *data = packet->data[0];
+
+hpsb_lock_fail:
+        hpsb_free_tlabel(packet);
+        hpsb_free_packet(packet);
+
+        return retval;
+}
diff --git a/drivers/ieee1394/ieee1394_transactions.h b/drivers/ieee1394/ieee1394_transactions.h
index d2d5bc3546d7..20b693be14b2 100644
--- a/drivers/ieee1394/ieee1394_transactions.h
+++ b/drivers/ieee1394/ieee1394_transactions.h
@@ -30,6 +30,8 @@ int hpsb_read(struct hpsb_host *host, nodeid_t node, unsigned int generation,
               u64 addr, quadlet_t *buffer, size_t length);
 int hpsb_write(struct hpsb_host *host, nodeid_t node, unsigned int generation,
                u64 addr, quadlet_t *buffer, size_t length);
+int hpsb_lock(struct hpsb_host *host, nodeid_t node, unsigned int generation,
+              u64 addr, int extcode, quadlet_t *data, quadlet_t arg);
 
 #ifdef HPSB_DEBUG_TLABELS
 extern spinlock_t hpsb_tlabel_lock;
diff --git a/drivers/ieee1394/iso.h b/drivers/ieee1394/iso.h
index b5de5f21ef78..c2089c093aa7 100644
--- a/drivers/ieee1394/iso.h
+++ b/drivers/ieee1394/iso.h
@@ -13,6 +13,7 @@
 #define IEEE1394_ISO_H
 
 #include <linux/spinlock_types.h>
+#include <linux/wait.h>
 #include <asm/atomic.h>
 #include <asm/types.h>
 
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index 906c5a98d814..53aada5bbe1e 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -971,6 +971,9 @@ static struct unit_directory *nodemgr_process_unit_directory
         ud->ud_kv = ud_kv;
         ud->id = (*id)++;
 
+        /* inherit vendor_id from root directory if none exists in unit dir */
+        ud->vendor_id = ne->vendor_id;
+
         csr1212_for_each_dir_entry(ne->csr, kv, ud_kv, dentry) {
                 switch (kv->key.id) {
                 case CSR1212_KV_ID_VENDOR:
@@ -1265,7 +1268,8 @@ static void nodemgr_update_node(struct node_entry *ne, struct csr1212_csr *csr,
                 csr1212_destroy_csr(csr);
         }
 
-        /* Mark the node current */
+        /* Finally, mark the node current */
+        smp_wmb();
         ne->generation = generation;
 
         if (ne->in_limbo) {
@@ -1798,7 +1802,7 @@ void hpsb_node_fill_packet(struct node_entry *ne, struct hpsb_packet *packet)
 {
         packet->host = ne->host;
         packet->generation = ne->generation;
-        barrier();
+        smp_rmb();
         packet->node_id = ne->nodeid;
 }
 
@@ -1807,7 +1811,7 @@ int hpsb_node_write(struct node_entry *ne, u64 addr,
 {
         unsigned int generation = ne->generation;
 
-        barrier();
+        smp_rmb();
         return hpsb_write(ne->host, ne->nodeid, generation,
                           addr, buffer, length);
 }
diff --git a/drivers/ieee1394/nodemgr.h b/drivers/ieee1394/nodemgr.h
index 15ea09733e84..ee5acdbd114a 100644
--- a/drivers/ieee1394/nodemgr.h
+++ b/drivers/ieee1394/nodemgr.h
@@ -21,9 +21,11 @@
 #define _IEEE1394_NODEMGR_H
 
 #include <linux/device.h>
+#include <asm/system.h>
 #include <asm/types.h>
 
 #include "ieee1394_core.h"
+#include "ieee1394_transactions.h"
 #include "ieee1394_types.h"
 
 struct csr1212_csr;
@@ -154,6 +156,22 @@ static inline int hpsb_node_entry_valid(struct node_entry *ne)
 void hpsb_node_fill_packet(struct node_entry *ne, struct hpsb_packet *packet);
 int hpsb_node_write(struct node_entry *ne, u64 addr,
                     quadlet_t *buffer, size_t length);
+static inline int hpsb_node_read(struct node_entry *ne, u64 addr,
+                                 quadlet_t *buffer, size_t length)
+{
+        unsigned int g = ne->generation;
+
+        smp_rmb();
+        return hpsb_read(ne->host, ne->nodeid, g, addr, buffer, length);
+}
+static inline int hpsb_node_lock(struct node_entry *ne, u64 addr, int extcode,
+                                 quadlet_t *buffer, quadlet_t arg)
+{
+        unsigned int g = ne->generation;
+
+        smp_rmb();
+        return hpsb_lock(ne->host, ne->nodeid, g, addr, extcode, buffer, arg);
+}
 int nodemgr_for_each_host(void *data, int (*cb)(struct hpsb_host *, void *));
 
 int init_ieee1394_nodemgr(void);
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index a01b4488208b..4a65b96db2c8 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -2490,12 +2490,14 @@ static int nes_disconnect(struct nes_qp *nesqp, int abrupt)
         int ret = 0;
         struct nes_vnic *nesvnic;
         struct nes_device *nesdev;
+        struct nes_ib_device *nesibdev;
 
         nesvnic = to_nesvnic(nesqp->ibqp.device);
         if (!nesvnic)
                 return -EINVAL;
 
         nesdev = nesvnic->nesdev;
+        nesibdev = nesvnic->nesibdev;
 
         nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
                         atomic_read(&nesvnic->netdev->refcnt));
@@ -2507,6 +2509,8 @@ static int nes_disconnect(struct nes_qp *nesqp, int abrupt)
         } else {
                 /* Need to free the Last Streaming Mode Message */
                 if (nesqp->ietf_frame) {
+                        if (nesqp->lsmm_mr)
+                                nesibdev->ibdev.dereg_mr(nesqp->lsmm_mr);
                         pci_free_consistent(nesdev->pcidev,
                                         nesqp->private_data_len+sizeof(struct ietf_mpa_frame),
                                         nesqp->ietf_frame, nesqp->ietf_frame_pbase);
@@ -2543,6 +2547,12 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         u32 crc_value;
         int ret;
         int passive_state;
+        struct nes_ib_device *nesibdev;
+        struct ib_mr *ibmr = NULL;
+        struct ib_phys_buf ibphysbuf;
+        struct nes_pd *nespd;
+
+
 
         ibqp = nes_get_qp(cm_id->device, conn_param->qpn);
         if (!ibqp)
@@ -2601,6 +2611,26 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         if (cm_id->remote_addr.sin_addr.s_addr !=
                         cm_id->local_addr.sin_addr.s_addr) {
                 u64temp = (unsigned long)nesqp;
+                nesibdev = nesvnic->nesibdev;
+                nespd = nesqp->nespd;
+                ibphysbuf.addr = nesqp->ietf_frame_pbase;
+                ibphysbuf.size = conn_param->private_data_len +
+                                        sizeof(struct ietf_mpa_frame);
+                ibmr = nesibdev->ibdev.reg_phys_mr((struct ib_pd *)nespd,
+                                                &ibphysbuf, 1,
+                                                IB_ACCESS_LOCAL_WRITE,
+                                                (u64 *)&nesqp->ietf_frame);
+                if (!ibmr) {
+                        nes_debug(NES_DBG_CM, "Unable to register memory region"
+                                        "for lSMM for cm_node = %p \n",
+                                        cm_node);
+                        return -ENOMEM;
+                }
+
+                ibmr->pd = &nespd->ibpd;
+                ibmr->device = nespd->ibpd.device;
+                nesqp->lsmm_mr = ibmr;
+
                 u64temp |= NES_SW_CONTEXT_ALIGN>>1;
                 set_wqe_64bit_value(wqe->wqe_words,
                         NES_IWARP_SQ_WQE_COMP_CTX_LOW_IDX,
@@ -2611,14 +2641,13 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                 wqe->wqe_words[NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX] =
                         cpu_to_le32(conn_param->private_data_len +
                         sizeof(struct ietf_mpa_frame));
-                wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_LOW_IDX] =
-                        cpu_to_le32((u32)nesqp->ietf_frame_pbase);
-                wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_HIGH_IDX] =
-                        cpu_to_le32((u32)((u64)nesqp->ietf_frame_pbase >> 32));
+                set_wqe_64bit_value(wqe->wqe_words,
+                                        NES_IWARP_SQ_WQE_FRAG0_LOW_IDX,
+                                        (u64)nesqp->ietf_frame);
                 wqe->wqe_words[NES_IWARP_SQ_WQE_LENGTH0_IDX] =
                         cpu_to_le32(conn_param->private_data_len +
                         sizeof(struct ietf_mpa_frame));
-                wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = 0;
+                wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = ibmr->lkey;
 
                 nesqp->nesqp_context->ird_ord_sizes |=
                         cpu_to_le32(NES_QPCONTEXT_ORDIRD_LSMM_PRESENT |
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 4fdb72454f94..d93a6562817c 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -1360,8 +1360,10 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
                                         NES_QPCONTEXT_MISC_RQ_SIZE_SHIFT);
                         nesqp->nesqp_context->misc |= cpu_to_le32((u32)nesqp->hwqp.sq_encoded_size <<
                                         NES_QPCONTEXT_MISC_SQ_SIZE_SHIFT);
+                        if (!udata) {
                                 nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_PRIV_EN);
                                 nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_FAST_REGISTER_EN);
+                        }
                         nesqp->nesqp_context->cqs = cpu_to_le32(nesqp->nesscq->hw_cq.cq_number +
                                         ((u32)nesqp->nesrcq->hw_cq.cq_number << 16));
                         u64temp = (u64)nesqp->hwqp.sq_pbase;
diff --git a/drivers/infiniband/hw/nes/nes_verbs.h b/drivers/infiniband/hw/nes/nes_verbs.h
index 6c6b4da5184f..ae0ca9bc83bd 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.h
+++ b/drivers/infiniband/hw/nes/nes_verbs.h
@@ -134,6 +134,7 @@ struct nes_qp {
         struct ietf_mpa_frame *ietf_frame;
         dma_addr_t            ietf_frame_pbase;
         wait_queue_head_t     state_waitq;
+        struct ib_mr          *lsmm_mr;
         unsigned long         socket;
         struct nes_hw_qp      hwqp;
         struct work_struct    work;
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index c3c8b9bc40ae..45470f18d7e9 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -839,7 +839,7 @@ static void atkbd_disconnect(struct serio *serio)
  */
 static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
 {
-        const unsigned int forced_release_keys[] = {
+        static const unsigned int forced_release_keys[] = {
                 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93,
         };
         int i;
@@ -856,7 +856,7 @@ static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
  */
 static void atkbd_hp_keymap_fixup(struct atkbd *atkbd)
 {
-        const unsigned int forced_release_keys[] = {
+        static const unsigned int forced_release_keys[] = {
                 0x94,
         };
         int i;
diff --git a/drivers/input/keyboard/bf54x-keys.c b/drivers/input/keyboard/bf54x-keys.c
index 19284016e0f4..ee855c5202e8 100644
--- a/drivers/input/keyboard/bf54x-keys.c
+++ b/drivers/input/keyboard/bf54x-keys.c
@@ -209,8 +209,8 @@ static int __devinit bfin_kpad_probe(struct platform_device *pdev)
                 goto out;
         }
 
-        if (!pdata->debounce_time || !pdata->debounce_time > MAX_MULT ||
-            !pdata->coldrive_time || !pdata->coldrive_time > MAX_MULT) {
+        if (!pdata->debounce_time || pdata->debounce_time > MAX_MULT ||
+            !pdata->coldrive_time || pdata->coldrive_time > MAX_MULT) {
                 printk(KERN_ERR DRV_NAME
                         ": Invalid Debounce/Columdrive Time from pdata\n");
                 bfin_write_KPAD_MSEL(0xFF0);    /* Default MSEL */
diff --git a/drivers/input/keyboard/corgikbd.c b/drivers/input/keyboard/corgikbd.c
index c8ed065ea0cb..abb04c82c622 100644
--- a/drivers/input/keyboard/corgikbd.c
+++ b/drivers/input/keyboard/corgikbd.c
@@ -288,7 +288,7 @@ static int corgikbd_resume(struct platform_device *dev)
 #define corgikbd_resume         NULL
 #endif
 
-static int __init corgikbd_probe(struct platform_device *pdev)
+static int __devinit corgikbd_probe(struct platform_device *pdev)
 {
         struct corgikbd *corgikbd;
         struct input_dev *input_dev;
@@ -368,7 +368,7 @@ static int __init corgikbd_probe(struct platform_device *pdev)
         return err;
 }
 
-static int corgikbd_remove(struct platform_device *pdev)
+static int __devexit corgikbd_remove(struct platform_device *pdev)
 {
         int i;
         struct corgikbd *corgikbd = platform_get_drvdata(pdev);
@@ -388,7 +388,7 @@ static int corgikbd_remove(struct platform_device *pdev)
 
 static struct platform_driver corgikbd_driver = {
         .probe          = corgikbd_probe,
-        .remove         = corgikbd_remove,
+        .remove         = __devexit_p(corgikbd_remove),
         .suspend        = corgikbd_suspend,
         .resume         = corgikbd_resume,
         .driver         = {
@@ -397,7 +397,7 @@ static struct platform_driver corgikbd_driver = {
         },
 };
 
-static int __devinit corgikbd_init(void)
+static int __init corgikbd_init(void)
 {
         return platform_driver_register(&corgikbd_driver);
 }
diff --git a/drivers/input/keyboard/omap-keypad.c b/drivers/input/keyboard/omap-keypad.c
index 3f3d1198cdb1..058fa8b02c21 100644
--- a/drivers/input/keyboard/omap-keypad.c
+++ b/drivers/input/keyboard/omap-keypad.c
@@ -279,7 +279,7 @@ static int omap_kp_resume(struct platform_device *dev)
 #define omap_kp_resume  NULL
 #endif
 
-static int __init omap_kp_probe(struct platform_device *pdev)
+static int __devinit omap_kp_probe(struct platform_device *pdev)
 {
         struct omap_kp *omap_kp;
         struct input_dev *input_dev;
@@ -422,7 +422,7 @@ err1:
         return -EINVAL;
 }
 
-static int omap_kp_remove(struct platform_device *pdev)
+static int __devexit omap_kp_remove(struct platform_device *pdev)
 {
         struct omap_kp *omap_kp = platform_get_drvdata(pdev);
 
@@ -454,7 +454,7 @@ static int omap_kp_remove(struct platform_device *pdev)
 
 static struct platform_driver omap_kp_driver = {
         .probe          = omap_kp_probe,
-        .remove         = omap_kp_remove,
+        .remove         = __devexit_p(omap_kp_remove),
         .suspend        = omap_kp_suspend,
         .resume         = omap_kp_resume,
         .driver         = {
@@ -463,7 +463,7 @@ static struct platform_driver omap_kp_driver = {
         },
 };
 
-static int __devinit omap_kp_init(void)
+static int __init omap_kp_init(void)
 {
         printk(KERN_INFO "OMAP Keypad Driver\n");
         return platform_driver_register(&omap_kp_driver);
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
index c48b76a46a58..9d1781a618e9 100644
--- a/drivers/input/keyboard/spitzkbd.c
+++ b/drivers/input/keyboard/spitzkbd.c
@@ -343,7 +343,7 @@ static int spitzkbd_resume(struct platform_device *dev)
 #define spitzkbd_resume         NULL
 #endif
 
-static int __init spitzkbd_probe(struct platform_device *dev)
+static int __devinit spitzkbd_probe(struct platform_device *dev)
 {
         struct spitzkbd *spitzkbd;
         struct input_dev *input_dev;
@@ -444,7 +444,7 @@ static int __init spitzkbd_probe(struct platform_device *dev)
         return err;
 }
 
-static int spitzkbd_remove(struct platform_device *dev)
+static int __devexit spitzkbd_remove(struct platform_device *dev)
 {
         int i;
         struct spitzkbd *spitzkbd = platform_get_drvdata(dev);
@@ -470,7 +470,7 @@ static int spitzkbd_remove(struct platform_device *dev)
 
 static struct platform_driver spitzkbd_driver = {
         .probe          = spitzkbd_probe,
-        .remove         = spitzkbd_remove,
+        .remove         = __devexit_p(spitzkbd_remove),
         .suspend        = spitzkbd_suspend,
         .resume         = spitzkbd_resume,
         .driver         = {
@@ -479,7 +479,7 @@ static struct platform_driver spitzkbd_driver = {
         },
 };
 
-static int __devinit spitzkbd_init(void)
+static int __init spitzkbd_init(void)
 {
         return platform_driver_register(&spitzkbd_driver);
 }
diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
index 093c8c1bca74..9705f3a00a3d 100644
--- a/drivers/input/mouse/Kconfig
+++ b/drivers/input/mouse/Kconfig
@@ -70,7 +70,7 @@ config MOUSE_PS2_SYNAPTICS
 config MOUSE_PS2_LIFEBOOK
         bool "Fujitsu Lifebook PS/2 mouse protocol extension" if EMBEDDED
         default y
-        depends on MOUSE_PS2
+        depends on MOUSE_PS2 && X86
         help
           Say Y here if you have a Fujitsu B-series Lifebook PS/2
           TouchScreen connected to your system.
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index b9a25d57bc5e..6ab0eb1ada1c 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -542,7 +542,7 @@ int elantech_detect(struct psmouse *psmouse, int set_properties)
             ps2_command(ps2dev,  NULL, PSMOUSE_CMD_SETSCALE11) ||
             ps2_command(ps2dev,  NULL, PSMOUSE_CMD_SETSCALE11) ||
             ps2_command(ps2dev, param, PSMOUSE_CMD_GETINFO)) {
-                pr_err("elantech.c: sending Elantech magic knock failed.\n");
+                pr_debug("elantech.c: sending Elantech magic knock failed.\n");
                 return -1;
         }
 
@@ -551,8 +551,27 @@ int elantech_detect(struct psmouse *psmouse, int set_properties)
          * set of magic numbers
          */
         if (param[0] != 0x3c || param[1] != 0x03 || param[2] != 0xc8) {
-                pr_info("elantech.c: unexpected magic knock result 0x%02x, 0x%02x, 0x%02x.\n",
-                        param[0], param[1], param[2]);
+                pr_debug("elantech.c: "
+                         "unexpected magic knock result 0x%02x, 0x%02x, 0x%02x.\n",
+                         param[0], param[1], param[2]);
+                return -1;
+        }
+
+        /*
+         * Query touchpad's firmware version and see if it reports known
+         * value to avoid mis-detection. Logitech mice are known to respond
+         * to Elantech magic knock and there might be more.
+         */
+        if (synaptics_send_cmd(psmouse, ETP_FW_VERSION_QUERY, param)) {
+                pr_debug("elantech.c: failed to query firmware version.\n");
+                return -1;
+        }
+
+        pr_debug("elantech.c: Elantech version query result 0x%02x, 0x%02x, 0x%02x.\n",
+                 param[0], param[1], param[2]);
+
+        if (param[0] == 0 || param[1] != 0) {
+                pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
                 return -1;
         }
 
@@ -600,8 +619,7 @@ int elantech_init(struct psmouse *psmouse)
         int i, error;
         unsigned char param[3];
 
-        etd = kzalloc(sizeof(struct elantech_data), GFP_KERNEL);
-        psmouse->private = etd;
+        psmouse->private = etd = kzalloc(sizeof(struct elantech_data), GFP_KERNEL);
         if (!etd)
                 return -1;
 
@@ -610,14 +628,12 @@ int elantech_init(struct psmouse *psmouse)
                 etd->parity[i] = etd->parity[i & (i - 1)] ^ 1;
 
         /*
-         * Find out what version hardware this is
+         * Do the version query again so we can store the result
          */
         if (synaptics_send_cmd(psmouse, ETP_FW_VERSION_QUERY, param)) {
                 pr_err("elantech.c: failed to query firmware version.\n");
                 goto init_fail;
         }
-        pr_info("elantech.c: Elantech version query result 0x%02x, 0x%02x, 0x%02x.\n",
-                param[0], param[1], param[2]);
         etd->fw_version_maj = param[0];
         etd->fw_version_min = param[2];
 
diff --git a/drivers/input/mouse/pxa930_trkball.c b/drivers/input/mouse/pxa930_trkball.c
index d297accf9a7f..1e827ad0afbe 100644
--- a/drivers/input/mouse/pxa930_trkball.c
+++ b/drivers/input/mouse/pxa930_trkball.c
@@ -83,7 +83,7 @@ static int write_tbcr(struct pxa930_trkball *trkball, int v)
 
         __raw_writel(v, trkball->mmio_base + TBCR);
 
-        while (i--) {
+        while (--i) {
                 if (__raw_readl(trkball->mmio_base + TBCR) == v)
                         break;
                 msleep(1);
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 865fc69e9bc3..f3e4f7b0240d 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -182,11 +182,6 @@ static int synaptics_identify(struct psmouse *psmouse)
 
 static int synaptics_query_hardware(struct psmouse *psmouse)
 {
-        int retries = 0;
-
-        while ((retries++ < 3) && psmouse_reset(psmouse))
-                /* empty */;
-
         if (synaptics_identify(psmouse))
                 return -1;
         if (synaptics_model_id(psmouse))
@@ -582,6 +577,8 @@ static int synaptics_reconnect(struct psmouse *psmouse)
         struct synaptics_data *priv = psmouse->private;
         struct synaptics_data old_priv = *priv;
 
+        psmouse_reset(psmouse);
+
         if (synaptics_detect(psmouse, 0))
                 return -1;
 
@@ -640,6 +637,8 @@ int synaptics_init(struct psmouse *psmouse)
         if (!priv)
                 return -1;
 
+        psmouse_reset(psmouse);
+
         if (synaptics_query_hardware(psmouse)) {
                 printk(KERN_ERR "Unable to query Synaptics hardware.\n");
                 goto init_fail;
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index b10ffae7c39b..e29cdc13a199 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -57,7 +57,7 @@ static int amba_kmi_write(struct serio *io, unsigned char val)
         struct amba_kmi_port *kmi = io->port_data;
         unsigned int timeleft = 10000; /* timeout in 100ms */
 
-        while ((readb(KMISTAT) & KMISTAT_TXEMPTY) == 0 && timeleft--)
+        while ((readb(KMISTAT) & KMISTAT_TXEMPTY) == 0 && --timeleft)
                 udelay(10);
 
         if (timeleft)
@@ -129,8 +129,8 @@ static int amba_kmi_probe(struct amba_device *dev, void *id)
         io->write       = amba_kmi_write;
         io->open        = amba_kmi_open;
         io->close       = amba_kmi_close;
-        strlcpy(io->name, dev->dev.bus_id, sizeof(io->name));
-        strlcpy(io->phys, dev->dev.bus_id, sizeof(io->phys));
+        strlcpy(io->name, dev_name(&dev->dev), sizeof(io->name));
+        strlcpy(io->phys, dev_name(&dev->dev), sizeof(io->phys));
         io->port_data   = kmi;
         io->dev.parent  = &dev->dev;
 
diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
index adc3bd6e7f7b..bd0f92d9f40f 100644
--- a/drivers/input/serio/gscps2.c
+++ b/drivers/input/serio/gscps2.c
@@ -359,7 +359,7 @@ static int __init gscps2_probe(struct parisc_device *dev)
 
         snprintf(serio->name, sizeof(serio->name), "GSC PS/2 %s",
                  (ps2port->id == GSC_ID_KEYBOARD) ? "keyboard" : "mouse");
-        strlcpy(serio->phys, dev->dev.bus_id, sizeof(serio->phys));
+        strlcpy(serio->phys, dev_name(&dev->dev), sizeof(serio->phys));
         serio->id.type          = SERIO_8042;
         serio->write            = gscps2_write;
         serio->open             = gscps2_open;
diff --git a/drivers/input/serio/sa1111ps2.c b/drivers/input/serio/sa1111ps2.c
index 2ad88780a170..57953c0eb82f 100644
--- a/drivers/input/serio/sa1111ps2.c
+++ b/drivers/input/serio/sa1111ps2.c
@@ -246,8 +246,8 @@ static int __devinit ps2_probe(struct sa1111_dev *dev)
         serio->write            = ps2_write;
         serio->open             = ps2_open;
         serio->close            = ps2_close;
-        strlcpy(serio->name, dev->dev.bus_id, sizeof(serio->name));
-        strlcpy(serio->phys, dev->dev.bus_id, sizeof(serio->phys));
+        strlcpy(serio->name, dev_name(&dev->dev), sizeof(serio->name));
+        strlcpy(serio->phys, dev_name(&dev->dev), sizeof(serio->phys));
         serio->port_data        = ps2if;
         serio->dev.parent       = &dev->dev;
         ps2if->io               = serio;
diff --git a/drivers/input/touchscreen/atmel_tsadcc.c b/drivers/input/touchscreen/atmel_tsadcc.c
index a89a6a8f05e6..055969e8be13 100644
--- a/drivers/input/touchscreen/atmel_tsadcc.c
+++ b/drivers/input/touchscreen/atmel_tsadcc.c
@@ -236,7 +236,7 @@ static int __devinit atmel_tsadcc_probe(struct platform_device *pdev)
         ts_dev->bufferedmeasure = 0;
 
         snprintf(ts_dev->phys, sizeof(ts_dev->phys),
-                 "%s/input0", pdev->dev.bus_id);
+                 "%s/input0", dev_name(&pdev->dev));
 
         input_dev->name = "atmel touch screen controller";
         input_dev->phys = ts_dev->phys;
diff --git a/drivers/input/touchscreen/corgi_ts.c b/drivers/input/touchscreen/corgi_ts.c
index 65202c9f63ff..3fb51b54fe61 100644
--- a/drivers/input/touchscreen/corgi_ts.c
+++ b/drivers/input/touchscreen/corgi_ts.c
@@ -268,7 +268,7 @@ static int corgits_resume(struct platform_device *dev)
 #define corgits_resume          NULL
 #endif
 
-static int __init corgits_probe(struct platform_device *pdev)
+static int __devinit corgits_probe(struct platform_device *pdev)
 {
         struct corgi_ts *corgi_ts;
         struct input_dev *input_dev;
@@ -343,7 +343,7 @@ static int __init corgits_probe(struct platform_device *pdev)
         return err;
 }
 
-static int corgits_remove(struct platform_device *pdev)
+static int __devexit corgits_remove(struct platform_device *pdev)
 {
         struct corgi_ts *corgi_ts = platform_get_drvdata(pdev);
 
@@ -352,12 +352,13 @@ static int corgits_remove(struct platform_device *pdev)
         corgi_ts->machinfo->put_hsync();
         input_unregister_device(corgi_ts->input);
         kfree(corgi_ts);
+
         return 0;
 }
 
 static struct platform_driver corgits_driver = {
         .probe          = corgits_probe,
-        .remove         = corgits_remove,
+        .remove         = __devexit_p(corgits_remove),
         .suspend        = corgits_suspend,
         .resume         = corgits_resume,
         .driver         = {
@@ -366,7 +367,7 @@ static struct platform_driver corgits_driver = {
         },
 };
 
-static int __devinit corgits_init(void)
+static int __init corgits_init(void)
 {
         return platform_driver_register(&corgits_driver);
 }
diff --git a/drivers/input/touchscreen/tsc2007.c b/drivers/input/touchscreen/tsc2007.c
index b75dc2990574..4ab070246892 100644
--- a/drivers/input/touchscreen/tsc2007.c
+++ b/drivers/input/touchscreen/tsc2007.c
@@ -289,7 +289,8 @@ static int tsc2007_probe(struct i2c_client *client,
 
         pdata->init_platform_hw();
 
-        snprintf(ts->phys, sizeof(ts->phys), "%s/input0", client->dev.bus_id);
+        snprintf(ts->phys, sizeof(ts->phys),
+                 "%s/input0", dev_name(&client->dev));
 
         input_dev->name = "TSC2007 Touchscreen";
         input_dev->phys = ts->phys;
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 5080b26ba160..fb7cb9bdfbd5 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -60,6 +60,10 @@ static int swap_xy;
 module_param(swap_xy, bool, 0644);
 MODULE_PARM_DESC(swap_xy, "If set X and Y axes are swapped.");
 
+static int hwcalib_xy;
+module_param(hwcalib_xy, bool, 0644);
+MODULE_PARM_DESC(hwcalib_xy, "If set hw-calibrated X/Y are used if available");
+
 /* device specifc data/functions */
 struct usbtouch_usb;
 struct usbtouch_device_info {
@@ -118,6 +122,7 @@ enum {
 
 #define USB_DEVICE_HID_CLASS(vend, prod) \
         .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS \
+                | USB_DEVICE_ID_MATCH_INT_PROTOCOL \
                 | USB_DEVICE_ID_MATCH_DEVICE, \
         .idVendor = (vend), \
         .idProduct = (prod), \
@@ -260,8 +265,13 @@ static int panjit_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 
 static int mtouch_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 {
-        dev->x = (pkt[8] << 8) | pkt[7];
-        dev->y = (pkt[10] << 8) | pkt[9];
+        if (hwcalib_xy) {
+                dev->x = (pkt[4] << 8) | pkt[3];
+                dev->y = 0xffff - ((pkt[6] << 8) | pkt[5]);
+        } else {
+                dev->x = (pkt[8] << 8) | pkt[7];
+                dev->y = (pkt[10] << 8) | pkt[9];
+        }
         dev->touch = (pkt[2] & 0x40) ? 1 : 0;
 
         return 1;
@@ -294,6 +304,12 @@ static int mtouch_init(struct usbtouch_usb *usbtouch)
                         return ret;
         }
 
+        /* Default min/max xy are the raw values, override if using hw-calib */
+        if (hwcalib_xy) {
+                input_set_abs_params(usbtouch->input, ABS_X, 0, 0xffff, 0, 0);
+                input_set_abs_params(usbtouch->input, ABS_Y, 0, 0xffff, 0, 0);
+        }
+
         return 0;
 }
 #endif
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index b4d44e571d76..8132533d71f9 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -212,6 +212,9 @@ static void lg_notify(struct virtqueue *vq)
         hcall(LHCALL_NOTIFY, lvq->config.pfn << PAGE_SHIFT, 0, 0);
 }
 
+/* An extern declaration inside a C file is bad form.  Don't do it. */
+extern void lguest_setup_irq(unsigned int irq);
+
 /* This routine finds the first virtqueue described in the configuration of
  * this device and sets it up.
  *
@@ -266,6 +269,9 @@ static struct virtqueue *lg_find_vq(struct virtio_device *vdev,
                 goto unmap;
         }
 
+        /* Make sure the interrupt is allocated. */
+        lguest_setup_irq(lvq->config.irq);
+
         /* Tell the interrupt for this virtqueue to go to the virtio_ring
          * interrupt handler. */
         /* FIXME: We used to have a flag for the Host to tell us we could use
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 03b4cd0a6344..a307f87eb90e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -214,12 +214,7 @@ static inline mddev_t *mddev_get(mddev_t *mddev)
         return mddev;
 }
 
-static void mddev_delayed_delete(struct work_struct *ws)
-{
-        mddev_t *mddev = container_of(ws, mddev_t, del_work);
-        kobject_del(&mddev->kobj);
-        kobject_put(&mddev->kobj);
-}
+static void mddev_delayed_delete(struct work_struct *ws);
 
 static void mddev_put(mddev_t *mddev)
 {
@@ -3542,6 +3537,21 @@ static struct kobj_type md_ktype = {
 
 int mdp_major = 0;
 
+static void mddev_delayed_delete(struct work_struct *ws)
+{
+        mddev_t *mddev = container_of(ws, mddev_t, del_work);
+
+        if (mddev->private == &md_redundancy_group) {
+                sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
+                if (mddev->sysfs_action)
+                        sysfs_put(mddev->sysfs_action);
+                mddev->sysfs_action = NULL;
+                mddev->private = NULL;
+        }
+        kobject_del(&mddev->kobj);
+        kobject_put(&mddev->kobj);
+}
+
 static int md_alloc(dev_t dev, char *name)
 {
         static DEFINE_MUTEX(disks_mutex);
@@ -4033,13 +4043,9 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                         mddev->queue->merge_bvec_fn = NULL;
                         mddev->queue->unplug_fn = NULL;
                         mddev->queue->backing_dev_info.congested_fn = NULL;
-                        if (mddev->pers->sync_request) {
-                                sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
-                                if (mddev->sysfs_action)
-                                        sysfs_put(mddev->sysfs_action);
-                                mddev->sysfs_action = NULL;
-                        }
                         module_put(mddev->pers->owner);
+                        if (mddev->pers->sync_request)
+                                mddev->private = &md_redundancy_group;
                         mddev->pers = NULL;
                         /* tell userspace to handle 'inactive' */
                         sysfs_notify_dirent(mddev->sysfs_state);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 01e3cffd03b8..e2466425d9ca 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1237,8 +1237,9 @@ static void end_sync_write(struct bio *bio, int error)
         update_head_pos(mirror, r1_bio);
 
         if (atomic_dec_and_test(&r1_bio->remaining)) {
-                md_done_sync(mddev, r1_bio->sectors, uptodate);
+                sector_t s = r1_bio->sectors;
                 put_buf(r1_bio);
+                md_done_sync(mddev, s, uptodate);
         }
 }
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 6736d6dff981..7301631abe04 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1236,6 +1236,7 @@ static void end_sync_read(struct bio *bio, int error)
         /* for reconstruct, we always reschedule after a read.
          * for resync, only after all reads
          */
+        rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev);
         if (test_bit(R10BIO_IsRecover, &r10_bio->state) ||
             atomic_dec_and_test(&r10_bio->remaining)) {
                 /* we have read all the blocks,
@@ -1243,7 +1244,6 @@ static void end_sync_read(struct bio *bio, int error)
                  */
                 reschedule_retry(r10_bio);
         }
-        rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev);
 }
 
 static void end_sync_write(struct bio *bio, int error)
@@ -1264,11 +1264,13 @@ static void end_sync_write(struct bio *bio, int error)
 
         update_head_pos(i, r10_bio);
 
+        rdev_dec_pending(conf->mirrors[d].rdev, mddev);
         while (atomic_dec_and_test(&r10_bio->remaining)) {
                 if (r10_bio->master_bio == NULL) {
                         /* the primary of several recovery bios */
-                        md_done_sync(mddev, r10_bio->sectors, 1);
+                        sector_t s = r10_bio->sectors;
                         put_buf(r10_bio);
+                        md_done_sync(mddev, s, 1);
                         break;
                 } else {
                         r10bio_t *r10_bio2 = (r10bio_t *)r10_bio->master_bio;
@@ -1276,7 +1278,6 @@ static void end_sync_write(struct bio *bio, int error)
                         r10_bio = r10_bio2;
                 }
         }
-        rdev_dec_pending(conf->mirrors[d].rdev, mddev);
 }
 
 /*
@@ -1749,8 +1750,6 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
         if (!go_faster && conf->nr_waiting)
                 msleep_interruptible(1000);
 
-        bitmap_cond_end_sync(mddev->bitmap, sector_nr);
-
         /* Again, very different code for resync and recovery.
          * Both must result in an r10bio with a list of bios that
          * have bi_end_io, bi_sector, bi_bdev set,
@@ -1886,6 +1885,8 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                 /* resync. Schedule a read for every block at this virt offset */
                 int count = 0;
 
+                bitmap_cond_end_sync(mddev->bitmap, sector_nr);
+
                 if (!bitmap_start_sync(mddev->bitmap, sector_nr,
                                        &sync_blocks, mddev->degraded) &&
                     !conf->fullsync && !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
@@ -2010,13 +2011,13 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
         /* There is nowhere to write, so all non-sync
          * drives must be failed, so try the next chunk...
          */
-        {
-        sector_t sec = max_sector - sector_nr;
-        sectors_skipped += sec;
+        if (sector_nr + max_sync < max_sector)
+                max_sector = sector_nr + max_sync;
+
+        sectors_skipped += (max_sector - sector_nr);
         chunks_skipped ++;
         sector_nr = max_sector;
         goto skipped;
-        }
 }
 
 static int run(mddev_t *mddev)
diff --git a/drivers/media/dvb/Kconfig b/drivers/media/dvb/Kconfig
index 40ebde53b3ce..b0198691892a 100644
--- a/drivers/media/dvb/Kconfig
+++ b/drivers/media/dvb/Kconfig
@@ -51,6 +51,10 @@ comment "Supported SDMC DM1105 Adapters"
         depends on DVB_CORE && PCI && I2C
 source "drivers/media/dvb/dm1105/Kconfig"
 
+comment "Supported FireWire (IEEE 1394) Adapters"
+        depends on DVB_CORE && IEEE1394
+source "drivers/media/dvb/firewire/Kconfig"
+
 comment "Supported DVB Frontends"
         depends on DVB_CORE
 source "drivers/media/dvb/frontends/Kconfig"
diff --git a/drivers/media/dvb/Makefile b/drivers/media/dvb/Makefile
index f91e9eb15e52..6092a5bb5a7d 100644
--- a/drivers/media/dvb/Makefile
+++ b/drivers/media/dvb/Makefile
@@ -3,3 +3,5 @@
 #
 
 obj-y        := dvb-core/ frontends/ ttpci/ ttusb-dec/ ttusb-budget/ b2c2/ bt8xx/ dvb-usb/ pluto2/ siano/ dm1105/
+
+obj-$(CONFIG_DVB_FIREDTV)       += firewire/
diff --git a/drivers/media/dvb/b2c2/flexcop-hw-filter.c b/drivers/media/dvb/b2c2/flexcop-hw-filter.c
index b386cc66c6b3..451974ba32f3 100644
--- a/drivers/media/dvb/b2c2/flexcop-hw-filter.c
+++ b/drivers/media/dvb/b2c2/flexcop-hw-filter.c
@@ -192,6 +192,7 @@ int flexcop_pid_feed_control(struct flexcop_device *fc, struct dvb_demux_feed *d
 
         return 0;
 }
+EXPORT_SYMBOL(flexcop_pid_feed_control);
 
 void flexcop_hw_filter_init(struct flexcop_device *fc)
 {
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
index 5b30dfc7846b..76e37fd96bb6 100644
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -13,9 +13,9 @@ static int enable_pid_filtering = 1;
 module_param(enable_pid_filtering, int, 0444);
 MODULE_PARM_DESC(enable_pid_filtering, "enable hardware pid filtering: supported values: 0 (fullts), 1");
 
-static int irq_chk_intv;
+static int irq_chk_intv = 100;
 module_param(irq_chk_intv, int, 0644);
-MODULE_PARM_DESC(irq_chk_intv, "set the interval for IRQ watchdog (currently just debugging).");
+MODULE_PARM_DESC(irq_chk_intv, "set the interval for IRQ streaming watchdog.");
 
 #ifdef CONFIG_DVB_B2C2_FLEXCOP_DEBUG
 #define dprintk(level,args...) \
@@ -34,7 +34,9 @@ MODULE_PARM_DESC(irq_chk_intv, "set the interval for IRQ watchdog (currently jus
 
 static int debug;
 module_param(debug, int, 0644);
-MODULE_PARM_DESC(debug, "set debug level (1=info,2=regs,4=TS,8=irqdma (|-able))." DEBSTATUS);
+MODULE_PARM_DESC(debug,
+        "set debug level (1=info,2=regs,4=TS,8=irqdma,16=check (|-able))."
+         DEBSTATUS);
 
 #define DRIVER_VERSION "0.1"
 #define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
@@ -58,6 +60,8 @@ struct flexcop_pci {
         int active_dma1_addr; /* 0 = addr0 of dma1; 1 = addr1 of dma1 */
         u32 last_dma1_cur_pos; /* position of the pointer last time the timer/packet irq occured */
         int count;
+        int count_prev;
+        int stream_problem;
 
         spinlock_t irq_lock;
 
@@ -103,18 +107,32 @@ static void flexcop_pci_irq_check_work(struct work_struct *work)
                 container_of(work, struct flexcop_pci, irq_check_work.work);
         struct flexcop_device *fc = fc_pci->fc_dev;
 
-        flexcop_ibi_value v = fc->read_ibi_reg(fc,sram_dest_reg_714);
-
-        flexcop_dump_reg(fc_pci->fc_dev,dma1_000,4);
-
-        if (v.sram_dest_reg_714.net_ovflow_error)
-                deb_chk("sram net_ovflow_error\n");
-        if (v.sram_dest_reg_714.media_ovflow_error)
-                deb_chk("sram media_ovflow_error\n");
-        if (v.sram_dest_reg_714.cai_ovflow_error)
-                deb_chk("sram cai_ovflow_error\n");
-        if (v.sram_dest_reg_714.cai_ovflow_error)
-                deb_chk("sram cai_ovflow_error\n");
+        if (fc->feedcount) {
+
+                if (fc_pci->count == fc_pci->count_prev) {
+                        deb_chk("no IRQ since the last check\n");
+                        if (fc_pci->stream_problem++ == 3) {
+                                struct dvb_demux_feed *feed;
+
+                                spin_lock_irq(&fc->demux.lock);
+                                list_for_each_entry(feed, &fc->demux.feed_list,
+                                        list_head) {
+                                        flexcop_pid_feed_control(fc, feed, 0);
+                                }
+
+                                list_for_each_entry(feed, &fc->demux.feed_list,
+                                        list_head) {
+                                        flexcop_pid_feed_control(fc, feed, 1);
+                                }
+                                spin_unlock_irq(&fc->demux.lock);
+
+                                fc_pci->stream_problem = 0;
+                        }
+                } else {
+                        fc_pci->stream_problem = 0;
+                        fc_pci->count_prev = fc_pci->count;
+                }
+        }
 
         schedule_delayed_work(&fc_pci->irq_check_work,
                         msecs_to_jiffies(irq_chk_intv < 100 ? 100 : irq_chk_intv));
@@ -216,16 +234,12 @@ static int flexcop_pci_stream_control(struct flexcop_device *fc, int onoff)
                 flexcop_dma_control_timer_irq(fc,FC_DMA_1,1);
                 deb_irq("IRQ enabled\n");
 
+                fc_pci->count_prev = fc_pci->count;
+
 //              fc_pci->active_dma1_addr = 0;
 //              flexcop_dma_control_size_irq(fc,FC_DMA_1,1);
 
-                if (irq_chk_intv > 0)
-                        schedule_delayed_work(&fc_pci->irq_check_work,
-                                        msecs_to_jiffies(irq_chk_intv < 100 ? 100 : irq_chk_intv));
         } else {
-                if (irq_chk_intv > 0)
-                        cancel_delayed_work(&fc_pci->irq_check_work);
-
                 flexcop_dma_control_timer_irq(fc,FC_DMA_1,0);
                 deb_irq("IRQ disabled\n");
 
@@ -299,8 +313,6 @@ static int flexcop_pci_init(struct flexcop_pci *fc_pci)
                                         IRQF_SHARED, DRIVER_NAME, fc_pci)) != 0)
                 goto err_pci_iounmap;
 
-
-
         fc_pci->init_state |= FC_PCI_INIT;
         return ret;
 
@@ -375,6 +387,10 @@ static int flexcop_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 
         INIT_DELAYED_WORK(&fc_pci->irq_check_work, flexcop_pci_irq_check_work);
 
+                if (irq_chk_intv > 0)
+                        schedule_delayed_work(&fc_pci->irq_check_work,
+                msecs_to_jiffies(irq_chk_intv < 100 ? 100 : irq_chk_intv));
+
         return ret;
 
 err_fc_exit:
@@ -393,6 +409,9 @@ static void flexcop_pci_remove(struct pci_dev *pdev)
 {
         struct flexcop_pci *fc_pci = pci_get_drvdata(pdev);
 
+        if (irq_chk_intv > 0)
+                cancel_delayed_work(&fc_pci->irq_check_work);
+
         flexcop_pci_dma_exit(fc_pci);
         flexcop_device_exit(fc_pci->fc_dev);
         flexcop_pci_exit(fc_pci);
diff --git a/drivers/media/dvb/b2c2/flexcop.c b/drivers/media/dvb/b2c2/flexcop.c
index 676413a915b4..91068952b502 100644
--- a/drivers/media/dvb/b2c2/flexcop.c
+++ b/drivers/media/dvb/b2c2/flexcop.c
@@ -212,8 +212,7 @@ void flexcop_reset_block_300(struct flexcop_device *fc)
         v210.sw_reset_210.Block_reset_enable = 0xb2;
 
         fc->write_ibi_reg(fc,sw_reset_210,v210);
-        msleep(1);
-
+        udelay(1000);
         fc->write_ibi_reg(fc,ctrl_208,v208_save);
 }
 
diff --git a/drivers/media/dvb/firewire/Kconfig b/drivers/media/dvb/firewire/Kconfig
new file mode 100644
index 000000000000..69028253e984
--- /dev/null
+++ b/drivers/media/dvb/firewire/Kconfig
@@ -0,0 +1,22 @@
+config DVB_FIREDTV
+        tristate "FireDTV and FloppyDTV"
+        depends on DVB_CORE && IEEE1394
+        help
+          Support for DVB receivers from Digital Everywhere
+          which are connected via IEEE 1394 (FireWire).
+
+          These devices don't have an MPEG decoder built in,
+          so you need an external software decoder to watch TV.
+
+          To compile this driver as a module, say M here:
+          the module will be called firedtv.
+
+if DVB_FIREDTV
+
+config DVB_FIREDTV_IEEE1394
+        def_bool IEEE1394
+
+config DVB_FIREDTV_INPUT
+        def_bool INPUT = y || (INPUT = m && DVB_FIREDTV = m)
+
+endif # DVB_FIREDTV
diff --git a/drivers/media/dvb/firewire/Makefile b/drivers/media/dvb/firewire/Makefile
new file mode 100644
index 000000000000..2034695ba194
--- /dev/null
+++ b/drivers/media/dvb/firewire/Makefile
@@ -0,0 +1,8 @@
+obj-$(CONFIG_DVB_FIREDTV) += firedtv.o
+
+firedtv-y := firedtv-avc.o firedtv-ci.o firedtv-dvb.o firedtv-fe.o
+firedtv-$(CONFIG_DVB_FIREDTV_IEEE1394) += firedtv-1394.o
+firedtv-$(CONFIG_DVB_FIREDTV_INPUT)    += firedtv-rc.o
+
+ccflags-y += -Idrivers/media/dvb/dvb-core
+ccflags-$(CONFIG_DVB_FIREDTV_IEEE1394) += -Idrivers/ieee1394
diff --git a/drivers/media/dvb/firewire/firedtv-1394.c b/drivers/media/dvb/firewire/firedtv-1394.c
new file mode 100644
index 000000000000..4e207658c5d9
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-1394.c
@@ -0,0 +1,285 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2007-2008 Ben Backx <ben@bbackx.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/types.h>
+
+#include <dma.h>
+#include <csr1212.h>
+#include <highlevel.h>
+#include <hosts.h>
+#include <ieee1394.h>
+#include <iso.h>
+#include <nodemgr.h>
+
+#include "firedtv.h"
+
+static LIST_HEAD(node_list);
+static DEFINE_SPINLOCK(node_list_lock);
+
+#define FIREWIRE_HEADER_SIZE    4
+#define CIP_HEADER_SIZE         8
+
+static void rawiso_activity_cb(struct hpsb_iso *iso)
+{
+        struct firedtv *f, *fdtv = NULL;
+        unsigned int i, num, packet;
+        unsigned char *buf;
+        unsigned long flags;
+        int count;
+
+        spin_lock_irqsave(&node_list_lock, flags);
+        list_for_each_entry(f, &node_list, list)
+                if (f->backend_data == iso) {
+                        fdtv = f;
+                        break;
+                }
+        spin_unlock_irqrestore(&node_list_lock, flags);
+
+        packet = iso->first_packet;
+        num = hpsb_iso_n_ready(iso);
+
+        if (!fdtv) {
+                dev_err(fdtv->device, "received at unknown iso channel\n");
+                goto out;
+        }
+
+        for (i = 0; i < num; i++, packet = (packet + 1) % iso->buf_packets) {
+                buf = dma_region_i(&iso->data_buf, unsigned char,
+                        iso->infos[packet].offset + CIP_HEADER_SIZE);
+                count = (iso->infos[packet].len - CIP_HEADER_SIZE) /
+                        (188 + FIREWIRE_HEADER_SIZE);
+
+                /* ignore empty packet */
+                if (iso->infos[packet].len <= CIP_HEADER_SIZE)
+                        continue;
+
+                while (count--) {
+                        if (buf[FIREWIRE_HEADER_SIZE] == 0x47)
+                                dvb_dmx_swfilter_packets(&fdtv->demux,
+                                                &buf[FIREWIRE_HEADER_SIZE], 1);
+                        else
+                                dev_err(fdtv->device,
+                                        "skipping invalid packet\n");
+                        buf += 188 + FIREWIRE_HEADER_SIZE;
+                }
+        }
+out:
+        hpsb_iso_recv_release_packets(iso, num);
+}
+
+static inline struct node_entry *node_of(struct firedtv *fdtv)
+{
+        return container_of(fdtv->device, struct unit_directory, device)->ne;
+}
+
+static int node_lock(struct firedtv *fdtv, u64 addr, void *data, __be32 arg)
+{
+        return hpsb_node_lock(node_of(fdtv), addr, EXTCODE_COMPARE_SWAP, data,
+                              (__force quadlet_t)arg);
+}
+
+static int node_read(struct firedtv *fdtv, u64 addr, void *data, size_t len)
+{
+        return hpsb_node_read(node_of(fdtv), addr, data, len);
+}
+
+static int node_write(struct firedtv *fdtv, u64 addr, void *data, size_t len)
+{
+        return hpsb_node_write(node_of(fdtv), addr, data, len);
+}
+
+#define FDTV_ISO_BUFFER_PACKETS 256
+#define FDTV_ISO_BUFFER_SIZE (FDTV_ISO_BUFFER_PACKETS * 200)
+
+static int start_iso(struct firedtv *fdtv)
+{
+        struct hpsb_iso *iso_handle;
+        int ret;
+
+        iso_handle = hpsb_iso_recv_init(node_of(fdtv)->host,
+                                FDTV_ISO_BUFFER_SIZE, FDTV_ISO_BUFFER_PACKETS,
+                                fdtv->isochannel, HPSB_ISO_DMA_DEFAULT,
+                                -1, /* stat.config.irq_interval */
+                                rawiso_activity_cb);
+        if (iso_handle == NULL) {
+                dev_err(fdtv->device, "cannot initialize iso receive\n");
+                return -ENOMEM;
+        }
+        fdtv->backend_data = iso_handle;
+
+        ret = hpsb_iso_recv_start(iso_handle, -1, -1, 0);
+        if (ret != 0) {
+                dev_err(fdtv->device, "cannot start iso receive\n");
+                hpsb_iso_shutdown(iso_handle);
+                fdtv->backend_data = NULL;
+        }
+        return ret;
+}
+
+static void stop_iso(struct firedtv *fdtv)
+{
+        struct hpsb_iso *iso_handle = fdtv->backend_data;
+
+        if (iso_handle != NULL) {
+                hpsb_iso_stop(iso_handle);
+                hpsb_iso_shutdown(iso_handle);
+        }
+        fdtv->backend_data = NULL;
+}
+
+static const struct firedtv_backend fdtv_1394_backend = {
+        .lock           = node_lock,
+        .read           = node_read,
+        .write          = node_write,
+        .start_iso      = start_iso,
+        .stop_iso       = stop_iso,
+};
+
+static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
+                        int cts, u8 *data, size_t length)
+{
+        struct firedtv *f, *fdtv = NULL;
+        unsigned long flags;
+        int su;
+
+        if (length == 0 || (data[0] & 0xf0) != 0)
+                return;
+
+        su = data[1] & 0x7;
+
+        spin_lock_irqsave(&node_list_lock, flags);
+        list_for_each_entry(f, &node_list, list)
+                if (node_of(f)->host == host &&
+                    node_of(f)->nodeid == nodeid &&
+                    (f->subunit == su || (f->subunit == 0 && su == 0x7))) {
+                        fdtv = f;
+                        break;
+                }
+        spin_unlock_irqrestore(&node_list_lock, flags);
+
+        if (fdtv)
+                avc_recv(fdtv, data, length);
+}
+
+static int node_probe(struct device *dev)
+{
+        struct unit_directory *ud =
+                        container_of(dev, struct unit_directory, device);
+        struct firedtv *fdtv;
+        int kv_len, err;
+        void *kv_str;
+
+        kv_len = (ud->model_name_kv->value.leaf.len - 2) * sizeof(quadlet_t);
+        kv_str = CSR1212_TEXTUAL_DESCRIPTOR_LEAF_DATA(ud->model_name_kv);
+
+        fdtv = fdtv_alloc(dev, &fdtv_1394_backend, kv_str, kv_len);
+        if (!fdtv)
+                return -ENOMEM;
+
+        /*
+         * Work around a bug in udev's path_id script:  Use the fw-host's dev
+         * instead of the unit directory's dev as parent of the input device.
+         */
+        err = fdtv_register_rc(fdtv, dev->parent->parent);
+        if (err)
+                goto fail_free;
+
+        spin_lock_irq(&node_list_lock);
+        list_add_tail(&fdtv->list, &node_list);
+        spin_unlock_irq(&node_list_lock);
+
+        err = avc_identify_subunit(fdtv);
+        if (err)
+                goto fail;
+
+        err = fdtv_dvb_register(fdtv);
+        if (err)
+                goto fail;
+
+        avc_register_remote_control(fdtv);
+        return 0;
+fail:
+        spin_lock_irq(&node_list_lock);
+        list_del(&fdtv->list);
+        spin_unlock_irq(&node_list_lock);
+        fdtv_unregister_rc(fdtv);
+fail_free:
+        kfree(fdtv);
+        return err;
+}
+
+static int node_remove(struct device *dev)
+{
+        struct firedtv *fdtv = dev->driver_data;
+
+        fdtv_dvb_unregister(fdtv);
+
+        spin_lock_irq(&node_list_lock);
+        list_del(&fdtv->list);
+        spin_unlock_irq(&node_list_lock);
+
+        cancel_work_sync(&fdtv->remote_ctrl_work);
+        fdtv_unregister_rc(fdtv);
+
+        kfree(fdtv);
+        return 0;
+}
+
+static int node_update(struct unit_directory *ud)
+{
+        struct firedtv *fdtv = ud->device.driver_data;
+
+        if (fdtv->isochannel >= 0)
+                cmp_establish_pp_connection(fdtv, fdtv->subunit,
+                                            fdtv->isochannel);
+        return 0;
+}
+
+static struct hpsb_protocol_driver fdtv_driver = {
+        .name           = "firedtv",
+        .update         = node_update,
+        .driver         = {
+                .probe  = node_probe,
+                .remove = node_remove,
+        },
+};
+
+static struct hpsb_highlevel fdtv_highlevel = {
+        .name           = "firedtv",
+        .fcp_request    = fcp_request,
+};
+
+int __init fdtv_1394_init(struct ieee1394_device_id id_table[])
+{
+        int ret;
+
+        hpsb_register_highlevel(&fdtv_highlevel);
+        fdtv_driver.id_table = id_table;
+        ret = hpsb_register_protocol(&fdtv_driver);
+        if (ret) {
+                printk(KERN_ERR "firedtv: failed to register protocol\n");
+                hpsb_unregister_highlevel(&fdtv_highlevel);
+        }
+        return ret;
+}
+
+void __exit fdtv_1394_exit(void)
+{
+        hpsb_unregister_protocol(&fdtv_driver);
+        hpsb_unregister_highlevel(&fdtv_highlevel);
+}
diff --git a/drivers/media/dvb/firewire/firedtv-avc.c b/drivers/media/dvb/firewire/firedtv-avc.c
new file mode 100644
index 000000000000..b55d9ccaf33e
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-avc.c
@@ -0,0 +1,1315 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Ben Backx <ben@bbackx.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/bug.h>
+#include <linux/crc32.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/moduleparam.h>
+#include <linux/mutex.h>
+#include <linux/string.h>
+#include <linux/stringify.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+
+#include "firedtv.h"
+
+#define FCP_COMMAND_REGISTER            0xfffff0000b00ULL
+
+#define AVC_CTYPE_CONTROL               0x0
+#define AVC_CTYPE_STATUS                0x1
+#define AVC_CTYPE_NOTIFY                0x3
+
+#define AVC_RESPONSE_ACCEPTED           0x9
+#define AVC_RESPONSE_STABLE             0xc
+#define AVC_RESPONSE_CHANGED            0xd
+#define AVC_RESPONSE_INTERIM            0xf
+
+#define AVC_SUBUNIT_TYPE_TUNER          (0x05 << 3)
+#define AVC_SUBUNIT_TYPE_UNIT           (0x1f << 3)
+
+#define AVC_OPCODE_VENDOR               0x00
+#define AVC_OPCODE_READ_DESCRIPTOR      0x09
+#define AVC_OPCODE_DSIT                 0xc8
+#define AVC_OPCODE_DSD                  0xcb
+
+#define DESCRIPTOR_TUNER_STATUS         0x80
+#define DESCRIPTOR_SUBUNIT_IDENTIFIER   0x00
+
+#define SFE_VENDOR_DE_COMPANYID_0       0x00 /* OUI of Digital Everywhere */
+#define SFE_VENDOR_DE_COMPANYID_1       0x12
+#define SFE_VENDOR_DE_COMPANYID_2       0x87
+
+#define SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL 0x0a
+#define SFE_VENDOR_OPCODE_LNB_CONTROL           0x52
+#define SFE_VENDOR_OPCODE_TUNE_QPSK             0x58 /* for DVB-S */
+
+#define SFE_VENDOR_OPCODE_GET_FIRMWARE_VERSION  0x00
+#define SFE_VENDOR_OPCODE_HOST2CA               0x56
+#define SFE_VENDOR_OPCODE_CA2HOST               0x57
+#define SFE_VENDOR_OPCODE_CISTATUS              0x59
+#define SFE_VENDOR_OPCODE_TUNE_QPSK2            0x60 /* for DVB-S2 */
+
+#define SFE_VENDOR_TAG_CA_RESET                 0x00
+#define SFE_VENDOR_TAG_CA_APPLICATION_INFO      0x01
+#define SFE_VENDOR_TAG_CA_PMT                   0x02
+#define SFE_VENDOR_TAG_CA_DATE_TIME             0x04
+#define SFE_VENDOR_TAG_CA_MMI                   0x05
+#define SFE_VENDOR_TAG_CA_ENTER_MENU            0x07
+
+#define EN50221_LIST_MANAGEMENT_ONLY    0x03
+#define EN50221_TAG_APP_INFO            0x9f8021
+#define EN50221_TAG_CA_INFO             0x9f8031
+
+struct avc_command_frame {
+        int length;
+        u8 ctype;
+        u8 subunit;
+        u8 opcode;
+        u8 operand[509];
+};
+
+struct avc_response_frame {
+        int length;
+        u8 response;
+        u8 subunit;
+        u8 opcode;
+        u8 operand[509];
+};
+
+#define AVC_DEBUG_FCP_SUBACTIONS        1
+#define AVC_DEBUG_FCP_PAYLOADS          2
+
+static int avc_debug;
+module_param_named(debug, avc_debug, int, 0644);
+MODULE_PARM_DESC(debug, "Verbose logging (default = 0"
+        ", FCP subactions = "   __stringify(AVC_DEBUG_FCP_SUBACTIONS)
+        ", FCP payloads = "     __stringify(AVC_DEBUG_FCP_PAYLOADS)
+        ", or all = -1)");
+
+static const char *debug_fcp_ctype(unsigned int ctype)
+{
+        static const char *ctypes[] = {
+                [0x0] = "CONTROL",              [0x1] = "STATUS",
+                [0x2] = "SPECIFIC INQUIRY",     [0x3] = "NOTIFY",
+                [0x4] = "GENERAL INQUIRY",      [0x8] = "NOT IMPLEMENTED",
+                [0x9] = "ACCEPTED",             [0xa] = "REJECTED",
+                [0xb] = "IN TRANSITION",        [0xc] = "IMPLEMENTED/STABLE",
+                [0xd] = "CHANGED",              [0xf] = "INTERIM",
+        };
+        const char *ret = ctype < ARRAY_SIZE(ctypes) ? ctypes[ctype] : NULL;
+
+        return ret ? ret : "?";
+}
+
+static const char *debug_fcp_opcode(unsigned int opcode,
+                                    const u8 *data, size_t length)
+{
+        switch (opcode) {
+        case AVC_OPCODE_VENDOR:                 break;
+        case AVC_OPCODE_READ_DESCRIPTOR:        return "ReadDescriptor";
+        case AVC_OPCODE_DSIT:                   return "DirectSelectInfo.Type";
+        case AVC_OPCODE_DSD:                    return "DirectSelectData";
+        default:                                return "?";
+        }
+
+        if (length < 7 ||
+            data[3] != SFE_VENDOR_DE_COMPANYID_0 ||
+            data[4] != SFE_VENDOR_DE_COMPANYID_1 ||
+            data[5] != SFE_VENDOR_DE_COMPANYID_2)
+                return "Vendor";
+
+        switch (data[6]) {
+        case SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL: return "RegisterRC";
+        case SFE_VENDOR_OPCODE_LNB_CONTROL:             return "LNBControl";
+        case SFE_VENDOR_OPCODE_TUNE_QPSK:               return "TuneQPSK";
+        case SFE_VENDOR_OPCODE_HOST2CA:                 return "Host2CA";
+        case SFE_VENDOR_OPCODE_CA2HOST:                 return "CA2Host";
+        }
+        return "Vendor";
+}
+
+static void debug_fcp(const u8 *data, size_t length)
+{
+        unsigned int subunit_type, subunit_id, op;
+        const char *prefix = data[0] > 7 ? "FCP <- " : "FCP -> ";
+
+        if (avc_debug & AVC_DEBUG_FCP_SUBACTIONS) {
+                subunit_type = data[1] >> 3;
+                subunit_id = data[1] & 7;
+                op = subunit_type == 0x1e || subunit_id == 5 ? ~0 : data[2];
+                printk(KERN_INFO "%ssu=%x.%x l=%d: %-8s - %s\n",
+                       prefix, subunit_type, subunit_id, length,
+                       debug_fcp_ctype(data[0]),
+                       debug_fcp_opcode(op, data, length));
+        }
+
+        if (avc_debug & AVC_DEBUG_FCP_PAYLOADS)
+                print_hex_dump(KERN_INFO, prefix, DUMP_PREFIX_NONE, 16, 1,
+                               data, length, false);
+}
+
+static int __avc_write(struct firedtv *fdtv,
+                const struct avc_command_frame *c, struct avc_response_frame *r)
+{
+        int err, retry;
+
+        if (r)
+                fdtv->avc_reply_received = false;
+
+        for (retry = 0; retry < 6; retry++) {
+                if (unlikely(avc_debug))
+                        debug_fcp(&c->ctype, c->length);
+
+                err = fdtv->backend->write(fdtv, FCP_COMMAND_REGISTER,
+                                           (void *)&c->ctype, c->length);
+                if (err) {
+                        fdtv->avc_reply_received = true;
+                        dev_err(fdtv->device, "FCP command write failed\n");
+                        return err;
+                }
+
+                if (!r)
+                        return 0;
+
+                /*
+                 * AV/C specs say that answers should be sent within 150 ms.
+                 * Time out after 200 ms.
+                 */
+                if (wait_event_timeout(fdtv->avc_wait,
+                                       fdtv->avc_reply_received,
+                                       msecs_to_jiffies(200)) != 0) {
+                        r->length = fdtv->response_length;
+                        memcpy(&r->response, fdtv->response, r->length);
+
+                        return 0;
+                }
+        }
+        dev_err(fdtv->device, "FCP response timed out\n");
+        return -ETIMEDOUT;
+}
+
+static int avc_write(struct firedtv *fdtv,
+                const struct avc_command_frame *c, struct avc_response_frame *r)
+{
+        int ret;
+
+        if (mutex_lock_interruptible(&fdtv->avc_mutex))
+                return -EINTR;
+
+        ret = __avc_write(fdtv, c, r);
+
+        mutex_unlock(&fdtv->avc_mutex);
+        return ret;
+}
+
+int avc_recv(struct firedtv *fdtv, void *data, size_t length)
+{
+        struct avc_response_frame *r =
+                        data - offsetof(struct avc_response_frame, response);
+
+        if (unlikely(avc_debug))
+                debug_fcp(data, length);
+
+        if (length >= 8 &&
+            r->operand[0] == SFE_VENDOR_DE_COMPANYID_0 &&
+            r->operand[1] == SFE_VENDOR_DE_COMPANYID_1 &&
+            r->operand[2] == SFE_VENDOR_DE_COMPANYID_2 &&
+            r->operand[3] == SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL) {
+                if (r->response == AVC_RESPONSE_CHANGED) {
+                        fdtv_handle_rc(fdtv,
+                            r->operand[4] << 8 | r->operand[5]);
+                        schedule_work(&fdtv->remote_ctrl_work);
+                } else if (r->response != AVC_RESPONSE_INTERIM) {
+                        dev_info(fdtv->device,
+                                 "remote control result = %d\n", r->response);
+                }
+                return 0;
+        }
+
+        if (fdtv->avc_reply_received) {
+                dev_err(fdtv->device, "out-of-order AVC response, ignored\n");
+                return -EIO;
+        }
+
+        memcpy(fdtv->response, data, length);
+        fdtv->response_length = length;
+
+        fdtv->avc_reply_received = true;
+        wake_up(&fdtv->avc_wait);
+
+        return 0;
+}
+
+/*
+ * tuning command for setting the relative LNB frequency
+ * (not supported by the AVC standard)
+ */
+static void avc_tuner_tuneqpsk(struct firedtv *fdtv,
+                               struct dvb_frontend_parameters *params,
+                               struct avc_command_frame *c)
+{
+        c->opcode = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
+
+        c->operand[4] = (params->frequency >> 24) & 0xff;
+        c->operand[5] = (params->frequency >> 16) & 0xff;
+        c->operand[6] = (params->frequency >> 8) & 0xff;
+        c->operand[7] = params->frequency & 0xff;
+
+        c->operand[8] = ((params->u.qpsk.symbol_rate / 1000) >> 8) & 0xff;
+        c->operand[9] = (params->u.qpsk.symbol_rate / 1000) & 0xff;
+
+        switch (params->u.qpsk.fec_inner) {
+        case FEC_1_2:   c->operand[10] = 0x1; break;
+        case FEC_2_3:   c->operand[10] = 0x2; break;
+        case FEC_3_4:   c->operand[10] = 0x3; break;
+        case FEC_5_6:   c->operand[10] = 0x4; break;
+        case FEC_7_8:   c->operand[10] = 0x5; break;
+        case FEC_4_5:
+        case FEC_8_9:
+        case FEC_AUTO:
+        default:        c->operand[10] = 0x0;
+        }
+
+        if (fdtv->voltage == 0xff)
+                c->operand[11] = 0xff;
+        else if (fdtv->voltage == SEC_VOLTAGE_18) /* polarisation */
+                c->operand[11] = 0;
+        else
+                c->operand[11] = 1;
+
+        if (fdtv->tone == 0xff)
+                c->operand[12] = 0xff;
+        else if (fdtv->tone == SEC_TONE_ON) /* band */
+                c->operand[12] = 1;
+        else
+                c->operand[12] = 0;
+
+        if (fdtv->type == FIREDTV_DVB_S2) {
+                c->operand[13] = 0x1;
+                c->operand[14] = 0xff;
+                c->operand[15] = 0xff;
+                c->length = 20;
+        } else {
+                c->length = 16;
+        }
+}
+
+static void avc_tuner_dsd_dvb_c(struct dvb_frontend_parameters *params,
+                                struct avc_command_frame *c)
+{
+        c->opcode = AVC_OPCODE_DSD;
+
+        c->operand[0] = 0;    /* source plug */
+        c->operand[1] = 0xd2; /* subfunction replace */
+        c->operand[2] = 0x20; /* system id = DVB */
+        c->operand[3] = 0x00; /* antenna number */
+        c->operand[4] = 0x11; /* system_specific_multiplex selection_length */
+
+        /* multiplex_valid_flags, high byte */
+        c->operand[5] =   0 << 7 /* reserved */
+                        | 0 << 6 /* Polarisation */
+                        | 0 << 5 /* Orbital_Pos */
+                        | 1 << 4 /* Frequency */
+                        | 1 << 3 /* Symbol_Rate */
+                        | 0 << 2 /* FEC_outer */
+                        | (params->u.qam.fec_inner  != FEC_AUTO ? 1 << 1 : 0)
+                        | (params->u.qam.modulation != QAM_AUTO ? 1 << 0 : 0);
+
+        /* multiplex_valid_flags, low byte */
+        c->operand[6] =   0 << 7 /* NetworkID */
+                        | 0 << 0 /* reserved */ ;
+
+        c->operand[7]  = 0x00;
+        c->operand[8]  = 0x00;
+        c->operand[9]  = 0x00;
+        c->operand[10] = 0x00;
+
+        c->operand[11] = (((params->frequency / 4000) >> 16) & 0xff) | (2 << 6);
+        c->operand[12] = ((params->frequency / 4000) >> 8) & 0xff;
+        c->operand[13] = (params->frequency / 4000) & 0xff;
+        c->operand[14] = ((params->u.qpsk.symbol_rate / 1000) >> 12) & 0xff;
+        c->operand[15] = ((params->u.qpsk.symbol_rate / 1000) >> 4) & 0xff;
+        c->operand[16] = ((params->u.qpsk.symbol_rate / 1000) << 4) & 0xf0;
+        c->operand[17] = 0x00;
+
+        switch (params->u.qpsk.fec_inner) {
+        case FEC_1_2:   c->operand[18] = 0x1; break;
+        case FEC_2_3:   c->operand[18] = 0x2; break;
+        case FEC_3_4:   c->operand[18] = 0x3; break;
+        case FEC_5_6:   c->operand[18] = 0x4; break;
+        case FEC_7_8:   c->operand[18] = 0x5; break;
+        case FEC_8_9:   c->operand[18] = 0x6; break;
+        case FEC_4_5:   c->operand[18] = 0x8; break;
+        case FEC_AUTO:
+        default:        c->operand[18] = 0x0;
+        }
+
+        switch (params->u.qam.modulation) {
+        case QAM_16:    c->operand[19] = 0x08; break;
+        case QAM_32:    c->operand[19] = 0x10; break;
+        case QAM_64:    c->operand[19] = 0x18; break;
+        case QAM_128:   c->operand[19] = 0x20; break;
+        case QAM_256:   c->operand[19] = 0x28; break;
+        case QAM_AUTO:
+        default:        c->operand[19] = 0x00;
+        }
+
+        c->operand[20] = 0x00;
+        c->operand[21] = 0x00;
+        /* Nr_of_dsd_sel_specs = 0 -> no PIDs are transmitted */
+        c->operand[22] = 0x00;
+
+        c->length = 28;
+}
+
+static void avc_tuner_dsd_dvb_t(struct dvb_frontend_parameters *params,
+                                struct avc_command_frame *c)
+{
+        struct dvb_ofdm_parameters *ofdm = &params->u.ofdm;
+
+        c->opcode = AVC_OPCODE_DSD;
+
+        c->operand[0] = 0;    /* source plug */
+        c->operand[1] = 0xd2; /* subfunction replace */
+        c->operand[2] = 0x20; /* system id = DVB */
+        c->operand[3] = 0x00; /* antenna number */
+        c->operand[4] = 0x0c; /* system_specific_multiplex selection_length */
+
+        /* multiplex_valid_flags, high byte */
+        c->operand[5] =
+              0 << 7 /* reserved */
+            | 1 << 6 /* CenterFrequency */
+            | (ofdm->bandwidth      != BANDWIDTH_AUTO        ? 1 << 5 : 0)
+            | (ofdm->constellation  != QAM_AUTO              ? 1 << 4 : 0)
+            | (ofdm->hierarchy_information != HIERARCHY_AUTO ? 1 << 3 : 0)
+            | (ofdm->code_rate_HP   != FEC_AUTO              ? 1 << 2 : 0)
+            | (ofdm->code_rate_LP   != FEC_AUTO              ? 1 << 1 : 0)
+            | (ofdm->guard_interval != GUARD_INTERVAL_AUTO   ? 1 << 0 : 0);
+
+        /* multiplex_valid_flags, low byte */
+        c->operand[6] =
+              0 << 7 /* NetworkID */
+            | (ofdm->transmission_mode != TRANSMISSION_MODE_AUTO ? 1 << 6 : 0)
+            | 0 << 5 /* OtherFrequencyFlag */
+            | 0 << 0 /* reserved */ ;
+
+        c->operand[7]  = 0x0;
+        c->operand[8]  = (params->frequency / 10) >> 24;
+        c->operand[9]  = ((params->frequency / 10) >> 16) & 0xff;
+        c->operand[10] = ((params->frequency / 10) >>  8) & 0xff;
+        c->operand[11] = (params->frequency / 10) & 0xff;
+
+        switch (ofdm->bandwidth) {
+        case BANDWIDTH_7_MHZ:   c->operand[12] = 0x20; break;
+        case BANDWIDTH_8_MHZ:
+        case BANDWIDTH_6_MHZ:   /* not defined by AVC spec */
+        case BANDWIDTH_AUTO:
+        default:                c->operand[12] = 0x00;
+        }
+
+        switch (ofdm->constellation) {
+        case QAM_16:    c->operand[13] = 1 << 6; break;
+        case QAM_64:    c->operand[13] = 2 << 6; break;
+        case QPSK:
+        default:        c->operand[13] = 0x00;
+        }
+
+        switch (ofdm->hierarchy_information) {
+        case HIERARCHY_1:       c->operand[13] |= 1 << 3; break;
+        case HIERARCHY_2:       c->operand[13] |= 2 << 3; break;
+        case HIERARCHY_4:       c->operand[13] |= 3 << 3; break;
+        case HIERARCHY_AUTO:
+        case HIERARCHY_NONE:
+        default:                break;
+        }
+
+        switch (ofdm->code_rate_HP) {
+        case FEC_2_3:   c->operand[13] |= 1; break;
+        case FEC_3_4:   c->operand[13] |= 2; break;
+        case FEC_5_6:   c->operand[13] |= 3; break;
+        case FEC_7_8:   c->operand[13] |= 4; break;
+        case FEC_1_2:
+        default:        break;
+        }
+
+        switch (ofdm->code_rate_LP) {
+        case FEC_2_3:   c->operand[14] = 1 << 5; break;
+        case FEC_3_4:   c->operand[14] = 2 << 5; break;
+        case FEC_5_6:   c->operand[14] = 3 << 5; break;
+        case FEC_7_8:   c->operand[14] = 4 << 5; break;
+        case FEC_1_2:
+        default:        c->operand[14] = 0x00; break;
+        }
+
+        switch (ofdm->guard_interval) {
+        case GUARD_INTERVAL_1_16:       c->operand[14] |= 1 << 3; break;
+        case GUARD_INTERVAL_1_8:        c->operand[14] |= 2 << 3; break;
+        case GUARD_INTERVAL_1_4:        c->operand[14] |= 3 << 3; break;
+        case GUARD_INTERVAL_1_32:
+        case GUARD_INTERVAL_AUTO:
+        default:                        break;
+        }
+
+        switch (ofdm->transmission_mode) {
+        case TRANSMISSION_MODE_8K:      c->operand[14] |= 1 << 1; break;
+        case TRANSMISSION_MODE_2K:
+        case TRANSMISSION_MODE_AUTO:
+        default:                        break;
+        }
+
+        c->operand[15] = 0x00; /* network_ID[0] */
+        c->operand[16] = 0x00; /* network_ID[1] */
+        /* Nr_of_dsd_sel_specs = 0 -> no PIDs are transmitted */
+        c->operand[17] = 0x00;
+
+        c->length = 24;
+}
+
+int avc_tuner_dsd(struct firedtv *fdtv,
+                  struct dvb_frontend_parameters *params)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+
+        switch (fdtv->type) {
+        case FIREDTV_DVB_S:
+        case FIREDTV_DVB_S2: avc_tuner_tuneqpsk(fdtv, params, c); break;
+        case FIREDTV_DVB_C: avc_tuner_dsd_dvb_c(params, c); break;
+        case FIREDTV_DVB_T: avc_tuner_dsd_dvb_t(params, c); break;
+        default:
+                BUG();
+        }
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        msleep(500);
+#if 0
+        /* FIXME: */
+        /* u8 *status was an out-parameter of avc_tuner_dsd, unused by caller */
+        if (status)
+                *status = r->operand[2];
+#endif
+        return 0;
+}
+
+int avc_tuner_set_pids(struct firedtv *fdtv, unsigned char pidc, u16 pid[])
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+        int pos, k;
+
+        if (pidc > 16 && pidc != 0xff)
+                return -EINVAL;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_DSD;
+
+        c->operand[0] = 0;      /* source plug */
+        c->operand[1] = 0xd2;   /* subfunction replace */
+        c->operand[2] = 0x20;   /* system id = DVB */
+        c->operand[3] = 0x00;   /* antenna number */
+        c->operand[4] = 0x00;   /* system_specific_multiplex selection_length */
+        c->operand[5] = pidc;   /* Nr_of_dsd_sel_specs */
+
+        pos = 6;
+        if (pidc != 0xff)
+                for (k = 0; k < pidc; k++) {
+                        c->operand[pos++] = 0x13; /* flowfunction relay */
+                        c->operand[pos++] = 0x80; /* dsd_sel_spec_valid_flags -> PID */
+                        c->operand[pos++] = (pid[k] >> 8) & 0x1f;
+                        c->operand[pos++] = pid[k] & 0xff;
+                        c->operand[pos++] = 0x00; /* tableID */
+                        c->operand[pos++] = 0x00; /* filter_length */
+                }
+
+        c->length = ALIGN(3 + pos, 4);
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        msleep(50);
+        return 0;
+}
+
+int avc_tuner_get_ts(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+        int sl;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_DSIT;
+
+        sl = fdtv->type == FIREDTV_DVB_T ? 0x0c : 0x11;
+
+        c->operand[0] = 0;      /* source plug */
+        c->operand[1] = 0xd2;   /* subfunction replace */
+        c->operand[2] = 0xff;   /* status */
+        c->operand[3] = 0x20;   /* system id = DVB */
+        c->operand[4] = 0x00;   /* antenna number */
+        c->operand[5] = 0x0;    /* system_specific_search_flags */
+        c->operand[6] = sl;     /* system_specific_multiplex selection_length */
+        c->operand[7] = 0x00;   /* valid_flags [0] */
+        c->operand[8] = 0x00;   /* valid_flags [1] */
+        c->operand[7 + sl] = 0x00; /* nr_of_dsit_sel_specs (always 0) */
+
+        c->length = fdtv->type == FIREDTV_DVB_T ? 24 : 28;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        msleep(250);
+        return 0;
+}
+
+int avc_identify_subunit(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_READ_DESCRIPTOR;
+
+        c->operand[0] = DESCRIPTOR_SUBUNIT_IDENTIFIER;
+        c->operand[1] = 0xff;
+        c->operand[2] = 0x00;
+        c->operand[3] = 0x00; /* length highbyte */
+        c->operand[4] = 0x08; /* length lowbyte  */
+        c->operand[5] = 0x00; /* offset highbyte */
+        c->operand[6] = 0x0d; /* offset lowbyte  */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        if ((r->response != AVC_RESPONSE_STABLE &&
+             r->response != AVC_RESPONSE_ACCEPTED) ||
+            (r->operand[3] << 8) + r->operand[4] != 8) {
+                dev_err(fdtv->device, "cannot read subunit identifier\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
+#define SIZEOF_ANTENNA_INPUT_INFO 22
+
+int avc_tuner_status(struct firedtv *fdtv, struct firedtv_tuner_status *stat)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int length;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_READ_DESCRIPTOR;
+
+        c->operand[0] = DESCRIPTOR_TUNER_STATUS;
+        c->operand[1] = 0xff;   /* read_result_status */
+        c->operand[2] = 0x00;   /* reserved */
+        c->operand[3] = 0;      /* SIZEOF_ANTENNA_INPUT_INFO >> 8; */
+        c->operand[4] = 0;      /* SIZEOF_ANTENNA_INPUT_INFO & 0xff; */
+        c->operand[5] = 0x00;
+        c->operand[6] = 0x00;
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        if (r->response != AVC_RESPONSE_STABLE &&
+            r->response != AVC_RESPONSE_ACCEPTED) {
+                dev_err(fdtv->device, "cannot read tuner status\n");
+                return -EINVAL;
+        }
+
+        length = r->operand[9];
+        if (r->operand[1] != 0x10 || length != SIZEOF_ANTENNA_INPUT_INFO) {
+                dev_err(fdtv->device, "got invalid tuner status\n");
+                return -EINVAL;
+        }
+
+        stat->active_system             = r->operand[10];
+        stat->searching                 = r->operand[11] >> 7 & 1;
+        stat->moving                    = r->operand[11] >> 6 & 1;
+        stat->no_rf                     = r->operand[11] >> 5 & 1;
+        stat->input                     = r->operand[12] >> 7 & 1;
+        stat->selected_antenna          = r->operand[12] & 0x7f;
+        stat->ber                       = r->operand[13] << 24 |
+                                          r->operand[14] << 16 |
+                                          r->operand[15] << 8 |
+                                          r->operand[16];
+        stat->signal_strength           = r->operand[17];
+        stat->raster_frequency          = r->operand[18] >> 6 & 2;
+        stat->rf_frequency              = (r->operand[18] & 0x3f) << 16 |
+                                          r->operand[19] << 8 |
+                                          r->operand[20];
+        stat->man_dep_info_length       = r->operand[21];
+        stat->front_end_error           = r->operand[22] >> 4 & 1;
+        stat->antenna_error             = r->operand[22] >> 3 & 1;
+        stat->front_end_power_status    = r->operand[22] >> 1 & 1;
+        stat->power_supply              = r->operand[22] & 1;
+        stat->carrier_noise_ratio       = r->operand[23] << 8 |
+                                          r->operand[24];
+        stat->power_supply_voltage      = r->operand[27];
+        stat->antenna_voltage           = r->operand[28];
+        stat->firewire_bus_voltage      = r->operand[29];
+        stat->ca_mmi                    = r->operand[30] & 1;
+        stat->ca_pmt_reply              = r->operand[31] >> 7 & 1;
+        stat->ca_date_time_request      = r->operand[31] >> 6 & 1;
+        stat->ca_application_info       = r->operand[31] >> 5 & 1;
+        stat->ca_module_present_status  = r->operand[31] >> 4 & 1;
+        stat->ca_dvb_flag               = r->operand[31] >> 3 & 1;
+        stat->ca_error_flag             = r->operand[31] >> 2 & 1;
+        stat->ca_initialization_status  = r->operand[31] >> 1 & 1;
+
+        return 0;
+}
+
+int avc_lnb_control(struct firedtv *fdtv, char voltage, char burst,
+                    char conttone, char nrdiseq,
+                    struct dvb_diseqc_master_cmd *diseqcmd)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int i, j, k;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_LNB_CONTROL;
+
+        c->operand[4] = voltage;
+        c->operand[5] = nrdiseq;
+
+        i = 6;
+
+        for (j = 0; j < nrdiseq; j++) {
+                c->operand[i++] = diseqcmd[j].msg_len;
+
+                for (k = 0; k < diseqcmd[j].msg_len; k++)
+                        c->operand[i++] = diseqcmd[j].msg[k];
+        }
+
+        c->operand[i++] = burst;
+        c->operand[i++] = conttone;
+
+        c->length = ALIGN(3 + i, 4);
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        if (r->response != AVC_RESPONSE_ACCEPTED) {
+                dev_err(fdtv->device, "LNB control failed\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+int avc_register_remote_control(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_NOTIFY;
+        c->subunit = AVC_SUBUNIT_TYPE_UNIT | 7;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL;
+
+        c->length = 8;
+
+        return avc_write(fdtv, c, NULL);
+}
+
+void avc_remote_ctrl_work(struct work_struct *work)
+{
+        struct firedtv *fdtv =
+                        container_of(work, struct firedtv, remote_ctrl_work);
+
+        /* Should it be rescheduled in failure cases? */
+        avc_register_remote_control(fdtv);
+}
+
+#if 0 /* FIXME: unused */
+int avc_tuner_host2ca(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; /* ca tag */
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 0; /* length */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        return 0;
+}
+#endif
+
+static int get_ca_object_pos(struct avc_response_frame *r)
+{
+        int length = 1;
+
+        /* Check length of length field */
+        if (r->operand[7] & 0x80)
+                length = (r->operand[7] & 0x7f) + 1;
+        return length + 7;
+}
+
+static int get_ca_object_length(struct avc_response_frame *r)
+{
+#if 0 /* FIXME: unused */
+        int size = 0;
+        int i;
+
+        if (r->operand[7] & 0x80)
+                for (i = 0; i < (r->operand[7] & 0x7f); i++) {
+                        size <<= 8;
+                        size += r->operand[8 + i];
+                }
+#endif
+        return r->operand[7];
+}
+
+int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int pos;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; /* ca tag */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        /* FIXME: check response code and validate response data */
+
+        pos = get_ca_object_pos(r);
+        app_info[0] = (EN50221_TAG_APP_INFO >> 16) & 0xff;
+        app_info[1] = (EN50221_TAG_APP_INFO >>  8) & 0xff;
+        app_info[2] = (EN50221_TAG_APP_INFO >>  0) & 0xff;
+        app_info[3] = 6 + r->operand[pos + 4];
+        app_info[4] = 0x01;
+        memcpy(&app_info[5], &r->operand[pos], 5 + r->operand[pos + 4]);
+        *len = app_info[3] + 4;
+
+        return 0;
+}
+
+int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int pos;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; /* ca tag */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        pos = get_ca_object_pos(r);
+        app_info[0] = (EN50221_TAG_CA_INFO >> 16) & 0xff;
+        app_info[1] = (EN50221_TAG_CA_INFO >>  8) & 0xff;
+        app_info[2] = (EN50221_TAG_CA_INFO >>  0) & 0xff;
+        app_info[3] = 2;
+        app_info[4] = r->operand[pos + 0];
+        app_info[5] = r->operand[pos + 1];
+        *len = app_info[3] + 4;
+
+        return 0;
+}
+
+int avc_ca_reset(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_RESET; /* ca tag */
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 1; /* length */
+        c->operand[8] = 0; /* force hardware reset */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        return 0;
+}
+
+int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int list_management;
+        int program_info_length;
+        int pmt_cmd_id;
+        int read_pos;
+        int write_pos;
+        int es_info_length;
+        int crc32_csum;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        if (msg[0] != EN50221_LIST_MANAGEMENT_ONLY) {
+                dev_info(fdtv->device, "forcing list_management to ONLY\n");
+                msg[0] = EN50221_LIST_MANAGEMENT_ONLY;
+        }
+        /* We take the cmd_id from the programme level only! */
+        list_management = msg[0];
+        program_info_length = ((msg[4] & 0x0f) << 8) + msg[5];
+        if (program_info_length > 0)
+                program_info_length--; /* Remove pmt_cmd_id */
+        pmt_cmd_id = msg[6];
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_PMT; /* ca tag */
+        c->operand[6] = 0; /* more/last */
+        /* c->operand[7] = XXXprogram_info_length + 17; */ /* length */
+        c->operand[8] = list_management;
+        c->operand[9] = 0x01; /* pmt_cmd=OK_descramble */
+
+        /* TS program map table */
+
+        c->operand[10] = 0x02; /* Table id=2 */
+        c->operand[11] = 0x80; /* Section syntax + length */
+        /* c->operand[12] = XXXprogram_info_length + 12; */
+        c->operand[13] = msg[1]; /* Program number */
+        c->operand[14] = msg[2];
+        c->operand[15] = 0x01; /* Version number=0 + current/next=1 */
+        c->operand[16] = 0x00; /* Section number=0 */
+        c->operand[17] = 0x00; /* Last section number=0 */
+        c->operand[18] = 0x1f; /* PCR_PID=1FFF */
+        c->operand[19] = 0xff;
+        c->operand[20] = (program_info_length >> 8); /* Program info length */
+        c->operand[21] = (program_info_length & 0xff);
+
+        /* CA descriptors at programme level */
+        read_pos = 6;
+        write_pos = 22;
+        if (program_info_length > 0) {
+                pmt_cmd_id = msg[read_pos++];
+                if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+                        dev_err(fdtv->device,
+                                "invalid pmt_cmd_id %d\n", pmt_cmd_id);
+
+                memcpy(&c->operand[write_pos], &msg[read_pos],
+                       program_info_length);
+                read_pos += program_info_length;
+                write_pos += program_info_length;
+        }
+        while (read_pos < length) {
+                c->operand[write_pos++] = msg[read_pos++];
+                c->operand[write_pos++] = msg[read_pos++];
+                c->operand[write_pos++] = msg[read_pos++];
+                es_info_length =
+                        ((msg[read_pos] & 0x0f) << 8) + msg[read_pos + 1];
+                read_pos += 2;
+                if (es_info_length > 0)
+                        es_info_length--; /* Remove pmt_cmd_id */
+                c->operand[write_pos++] = es_info_length >> 8;
+                c->operand[write_pos++] = es_info_length & 0xff;
+                if (es_info_length > 0) {
+                        pmt_cmd_id = msg[read_pos++];
+                        if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+                                dev_err(fdtv->device, "invalid pmt_cmd_id %d "
+                                        "at stream level\n", pmt_cmd_id);
+
+                        memcpy(&c->operand[write_pos], &msg[read_pos],
+                               es_info_length);
+                        read_pos += es_info_length;
+                        write_pos += es_info_length;
+                }
+        }
+
+        /* CRC */
+        c->operand[write_pos++] = 0x00;
+        c->operand[write_pos++] = 0x00;
+        c->operand[write_pos++] = 0x00;
+        c->operand[write_pos++] = 0x00;
+
+        c->operand[7] = write_pos - 8;
+        c->operand[12] = write_pos - 13;
+
+        crc32_csum = crc32_be(0, &c->operand[10], c->operand[12] - 1);
+        c->operand[write_pos - 4] = (crc32_csum >> 24) & 0xff;
+        c->operand[write_pos - 3] = (crc32_csum >> 16) & 0xff;
+        c->operand[write_pos - 2] = (crc32_csum >>  8) & 0xff;
+        c->operand[write_pos - 1] = (crc32_csum >>  0) & 0xff;
+
+        c->length = ALIGN(3 + write_pos, 4);
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        if (r->response != AVC_RESPONSE_ACCEPTED) {
+                dev_err(fdtv->device,
+                        "CA PMT failed with response 0x%x\n", r->response);
+                return -EFAULT;
+        }
+
+        return 0;
+}
+
+int avc_ca_get_time_date(struct firedtv *fdtv, int *interval)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_DATE_TIME; /* ca tag */
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 0; /* length */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        /* FIXME: check response code and validate response data */
+
+        *interval = r->operand[get_ca_object_pos(r)];
+
+        return 0;
+}
+
+int avc_ca_enter_menu(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_ENTER_MENU;
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 0; /* length */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        return 0;
+}
+
+int avc_ca_get_mmi(struct firedtv *fdtv, char *mmi_object, unsigned int *len)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_MMI;
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 0; /* length */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        /* FIXME: check response code and validate response data */
+
+        *len = get_ca_object_length(r);
+        memcpy(mmi_object, &r->operand[get_ca_object_pos(r)], *len);
+
+        return 0;
+}
+
+#define CMP_OUTPUT_PLUG_CONTROL_REG_0   0xfffff0000904ULL
+
+static int cmp_read(struct firedtv *fdtv, void *buf, u64 addr, size_t len)
+{
+        int ret;
+
+        if (mutex_lock_interruptible(&fdtv->avc_mutex))
+                return -EINTR;
+
+        ret = fdtv->backend->read(fdtv, addr, buf, len);
+        if (ret < 0)
+                dev_err(fdtv->device, "CMP: read I/O error\n");
+
+        mutex_unlock(&fdtv->avc_mutex);
+        return ret;
+}
+
+static int cmp_lock(struct firedtv *fdtv, void *data, u64 addr, __be32 arg)
+{
+        int ret;
+
+        if (mutex_lock_interruptible(&fdtv->avc_mutex))
+                return -EINTR;
+
+        ret = fdtv->backend->lock(fdtv, addr, data, arg);
+        if (ret < 0)
+                dev_err(fdtv->device, "CMP: lock I/O error\n");
+
+        mutex_unlock(&fdtv->avc_mutex);
+        return ret;
+}
+
+static inline u32 get_opcr(__be32 opcr, u32 mask, u32 shift)
+{
+        return (be32_to_cpu(opcr) >> shift) & mask;
+}
+
+static inline void set_opcr(__be32 *opcr, u32 value, u32 mask, u32 shift)
+{
+        *opcr &= ~cpu_to_be32(mask << shift);
+        *opcr |= cpu_to_be32((value & mask) << shift);
+}
+
+#define get_opcr_online(v)              get_opcr((v), 0x1, 31)
+#define get_opcr_p2p_connections(v)     get_opcr((v), 0x3f, 24)
+#define get_opcr_channel(v)             get_opcr((v), 0x3f, 16)
+
+#define set_opcr_p2p_connections(p, v)  set_opcr((p), (v), 0x3f, 24)
+#define set_opcr_channel(p, v)          set_opcr((p), (v), 0x3f, 16)
+#define set_opcr_data_rate(p, v)        set_opcr((p), (v), 0x3, 14)
+#define set_opcr_overhead_id(p, v)      set_opcr((p), (v), 0xf, 10)
+
+int cmp_establish_pp_connection(struct firedtv *fdtv, int plug, int channel)
+{
+        __be32 old_opcr, opcr;
+        u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
+        int attempts = 0;
+        int ret;
+
+        ret = cmp_read(fdtv, &opcr, opcr_address, 4);
+        if (ret < 0)
+                return ret;
+
+repeat:
+        if (!get_opcr_online(opcr)) {
+                dev_err(fdtv->device, "CMP: output offline\n");
+                return -EBUSY;
+        }
+
+        old_opcr = opcr;
+
+        if (get_opcr_p2p_connections(opcr)) {
+                if (get_opcr_channel(opcr) != channel) {
+                        dev_err(fdtv->device, "CMP: cannot change channel\n");
+                        return -EBUSY;
+                }
+                dev_info(fdtv->device, "CMP: overlaying connection\n");
+
+                /* We don't allocate isochronous resources. */
+        } else {
+                set_opcr_channel(&opcr, channel);
+                set_opcr_data_rate(&opcr, 2); /* S400 */
+
+                /* FIXME: this is for the worst case - optimize */
+                set_opcr_overhead_id(&opcr, 0);
+
+                /*
+                 * FIXME: allocate isochronous channel and bandwidth at IRM
+                 * fdtv->backend->alloc_resources(fdtv, channels_mask, bw);
+                 */
+        }
+
+        set_opcr_p2p_connections(&opcr, get_opcr_p2p_connections(opcr) + 1);
+
+        ret = cmp_lock(fdtv, &opcr, opcr_address, old_opcr);
+        if (ret < 0)
+                return ret;
+
+        if (old_opcr != opcr) {
+                /*
+                 * FIXME: if old_opcr.P2P_Connections > 0,
+                 * deallocate isochronous channel and bandwidth at IRM
+                 * if (...)
+                 *      fdtv->backend->dealloc_resources(fdtv, channel, bw);
+                 */
+
+                if (++attempts < 6) /* arbitrary limit */
+                        goto repeat;
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
+void cmp_break_pp_connection(struct firedtv *fdtv, int plug, int channel)
+{
+        __be32 old_opcr, opcr;
+        u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
+        int attempts = 0;
+
+        if (cmp_read(fdtv, &opcr, opcr_address, 4) < 0)
+                return;
+
+repeat:
+        if (!get_opcr_online(opcr) || !get_opcr_p2p_connections(opcr) ||
+            get_opcr_channel(opcr) != channel) {
+                dev_err(fdtv->device, "CMP: no connection to break\n");
+                return;
+        }
+
+        old_opcr = opcr;
+        set_opcr_p2p_connections(&opcr, get_opcr_p2p_connections(opcr) - 1);
+
+        if (cmp_lock(fdtv, &opcr, opcr_address, old_opcr) < 0)
+                return;
+
+        if (old_opcr != opcr) {
+                /*
+                 * FIXME: if old_opcr.P2P_Connections == 1, i.e. we were last
+                 * owner, deallocate isochronous channel and bandwidth at IRM
+                 * if (...)
+                 *      fdtv->backend->dealloc_resources(fdtv, channel, bw);
+                 */
+
+                if (++attempts < 6) /* arbitrary limit */
+                        goto repeat;
+        }
+}
diff --git a/drivers/media/dvb/firewire/firedtv-ci.c b/drivers/media/dvb/firewire/firedtv-ci.c
new file mode 100644
index 000000000000..eeb80d0ea3ff
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-ci.c
@@ -0,0 +1,260 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/device.h>
+#include <linux/dvb/ca.h>
+#include <linux/fs.h>
+#include <linux/module.h>
+
+#include <dvbdev.h>
+
+#include "firedtv.h"
+
+#define EN50221_TAG_APP_INFO_ENQUIRY    0x9f8020
+#define EN50221_TAG_CA_INFO_ENQUIRY     0x9f8030
+#define EN50221_TAG_CA_PMT              0x9f8032
+#define EN50221_TAG_ENTER_MENU          0x9f8022
+
+static int fdtv_ca_ready(struct firedtv_tuner_status *stat)
+{
+        return stat->ca_initialization_status   == 1 &&
+               stat->ca_error_flag              == 0 &&
+               stat->ca_dvb_flag                == 1 &&
+               stat->ca_module_present_status   == 1;
+}
+
+static int fdtv_get_ca_flags(struct firedtv_tuner_status *stat)
+{
+        int flags = 0;
+
+        if (stat->ca_module_present_status == 1)
+                flags |= CA_CI_MODULE_PRESENT;
+        if (stat->ca_initialization_status == 1 &&
+            stat->ca_error_flag            == 0 &&
+            stat->ca_dvb_flag              == 1)
+                flags |= CA_CI_MODULE_READY;
+        return flags;
+}
+
+static int fdtv_ca_reset(struct firedtv *fdtv)
+{
+        return avc_ca_reset(fdtv) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_get_caps(void *arg)
+{
+        struct ca_caps *cap = arg;
+
+        cap->slot_num = 1;
+        cap->slot_type = CA_CI;
+        cap->descr_num = 1;
+        cap->descr_type = CA_ECD;
+        return 0;
+}
+
+static int fdtv_ca_get_slot_info(struct firedtv *fdtv, void *arg)
+{
+        struct firedtv_tuner_status stat;
+        struct ca_slot_info *slot = arg;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EFAULT;
+
+        if (slot->num != 0)
+                return -EFAULT;
+
+        slot->type = CA_CI;
+        slot->flags = fdtv_get_ca_flags(&stat);
+        return 0;
+}
+
+static int fdtv_ca_app_info(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *reply = arg;
+
+        return avc_ca_app_info(fdtv, reply->msg, &reply->length) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_info(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *reply = arg;
+
+        return avc_ca_info(fdtv, reply->msg, &reply->length) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_get_mmi(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *reply = arg;
+
+        return avc_ca_get_mmi(fdtv, reply->msg, &reply->length) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_get_msg(struct firedtv *fdtv, void *arg)
+{
+        struct firedtv_tuner_status stat;
+        int err;
+
+        switch (fdtv->ca_last_command) {
+        case EN50221_TAG_APP_INFO_ENQUIRY:
+                err = fdtv_ca_app_info(fdtv, arg);
+                break;
+        case EN50221_TAG_CA_INFO_ENQUIRY:
+                err = fdtv_ca_info(fdtv, arg);
+                break;
+        default:
+                if (avc_tuner_status(fdtv, &stat))
+                        err = -EFAULT;
+                else if (stat.ca_mmi == 1)
+                        err = fdtv_ca_get_mmi(fdtv, arg);
+                else {
+                        dev_info(fdtv->device, "unhandled CA message 0x%08x\n",
+                                 fdtv->ca_last_command);
+                        err = -EFAULT;
+                }
+        }
+        fdtv->ca_last_command = 0;
+        return err;
+}
+
+static int fdtv_ca_pmt(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *msg = arg;
+        int data_pos;
+        int data_length;
+        int i;
+
+        data_pos = 4;
+        if (msg->msg[3] & 0x80) {
+                data_length = 0;
+                for (i = 0; i < (msg->msg[3] & 0x7f); i++)
+                        data_length = (data_length << 8) + msg->msg[data_pos++];
+        } else {
+                data_length = msg->msg[3];
+        }
+
+        return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_send_msg(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *msg = arg;
+        int err;
+
+        /* Do we need a semaphore for this? */
+        fdtv->ca_last_command =
+                (msg->msg[0] << 16) + (msg->msg[1] << 8) + msg->msg[2];
+        switch (fdtv->ca_last_command) {
+        case EN50221_TAG_CA_PMT:
+                err = fdtv_ca_pmt(fdtv, arg);
+                break;
+        case EN50221_TAG_APP_INFO_ENQUIRY:
+                /* handled in ca_get_msg */
+                err = 0;
+                break;
+        case EN50221_TAG_CA_INFO_ENQUIRY:
+                /* handled in ca_get_msg */
+                err = 0;
+                break;
+        case EN50221_TAG_ENTER_MENU:
+                err = avc_ca_enter_menu(fdtv);
+                break;
+        default:
+                dev_err(fdtv->device, "unhandled CA message 0x%08x\n",
+                        fdtv->ca_last_command);
+                err = -EFAULT;
+        }
+        return err;
+}
+
+static int fdtv_ca_ioctl(struct inode *inode, struct file *file,
+                            unsigned int cmd, void *arg)
+{
+        struct dvb_device *dvbdev = file->private_data;
+        struct firedtv *fdtv = dvbdev->priv;
+        struct firedtv_tuner_status stat;
+        int err;
+
+        switch (cmd) {
+        case CA_RESET:
+                err = fdtv_ca_reset(fdtv);
+                break;
+        case CA_GET_CAP:
+                err = fdtv_ca_get_caps(arg);
+                break;
+        case CA_GET_SLOT_INFO:
+                err = fdtv_ca_get_slot_info(fdtv, arg);
+                break;
+        case CA_GET_MSG:
+                err = fdtv_ca_get_msg(fdtv, arg);
+                break;
+        case CA_SEND_MSG:
+                err = fdtv_ca_send_msg(fdtv, arg);
+                break;
+        default:
+                dev_info(fdtv->device, "unhandled CA ioctl %u\n", cmd);
+                err = -EOPNOTSUPP;
+        }
+
+        /* FIXME Is this necessary? */
+        avc_tuner_status(fdtv, &stat);
+
+        return err;
+}
+
+static unsigned int fdtv_ca_io_poll(struct file *file, poll_table *wait)
+{
+        return POLLIN;
+}
+
+static struct file_operations fdtv_ca_fops = {
+        .owner          = THIS_MODULE,
+        .ioctl          = dvb_generic_ioctl,
+        .open           = dvb_generic_open,
+        .release        = dvb_generic_release,
+        .poll           = fdtv_ca_io_poll,
+};
+
+static struct dvb_device fdtv_ca = {
+        .users          = 1,
+        .readers        = 1,
+        .writers        = 1,
+        .fops           = &fdtv_ca_fops,
+        .kernel_ioctl   = fdtv_ca_ioctl,
+};
+
+int fdtv_ca_register(struct firedtv *fdtv)
+{
+        struct firedtv_tuner_status stat;
+        int err;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        if (!fdtv_ca_ready(&stat))
+                return -EFAULT;
+
+        err = dvb_register_device(&fdtv->adapter, &fdtv->cadev,
+                                  &fdtv_ca, fdtv, DVB_DEVICE_CA);
+
+        if (stat.ca_application_info == 0)
+                dev_err(fdtv->device, "CaApplicationInfo is not set\n");
+        if (stat.ca_date_time_request == 1)
+                avc_ca_get_time_date(fdtv, &fdtv->ca_time_interval);
+
+        return err;
+}
+
+void fdtv_ca_release(struct firedtv *fdtv)
+{
+        if (fdtv->cadev)
+                dvb_unregister_device(fdtv->cadev);
+}
diff --git a/drivers/media/dvb/firewire/firedtv-dvb.c b/drivers/media/dvb/firewire/firedtv-dvb.c
new file mode 100644
index 000000000000..9d308dd32a5c
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-dvb.c
@@ -0,0 +1,364 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/bitops.h>
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+
+#include <dmxdev.h>
+#include <dvb_demux.h>
+#include <dvbdev.h>
+#include <dvb_frontend.h>
+
+#include "firedtv.h"
+
+static int alloc_channel(struct firedtv *fdtv)
+{
+        int i;
+
+        for (i = 0; i < 16; i++)
+                if (!__test_and_set_bit(i, &fdtv->channel_active))
+                        break;
+        return i;
+}
+
+static void collect_channels(struct firedtv *fdtv, int *pidc, u16 pid[])
+{
+        int i, n;
+
+        for (i = 0, n = 0; i < 16; i++)
+                if (test_bit(i, &fdtv->channel_active))
+                        pid[n++] = fdtv->channel_pid[i];
+        *pidc = n;
+}
+
+static inline void dealloc_channel(struct firedtv *fdtv, int i)
+{
+        __clear_bit(i, &fdtv->channel_active);
+}
+
+int fdtv_start_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+        struct firedtv *fdtv = dvbdmxfeed->demux->priv;
+        int pidc, c, ret;
+        u16 pids[16];
+
+        switch (dvbdmxfeed->type) {
+        case DMX_TYPE_TS:
+        case DMX_TYPE_SEC:
+                break;
+        default:
+                dev_err(fdtv->device, "can't start dmx feed: invalid type %u\n",
+                        dvbdmxfeed->type);
+                return -EINVAL;
+        }
+
+        if (mutex_lock_interruptible(&fdtv->demux_mutex))
+                return -EINTR;
+
+        if (dvbdmxfeed->type == DMX_TYPE_TS) {
+                switch (dvbdmxfeed->pes_type) {
+                case DMX_TS_PES_VIDEO:
+                case DMX_TS_PES_AUDIO:
+                case DMX_TS_PES_TELETEXT:
+                case DMX_TS_PES_PCR:
+                case DMX_TS_PES_OTHER:
+                        c = alloc_channel(fdtv);
+                        break;
+                default:
+                        dev_err(fdtv->device,
+                                "can't start dmx feed: invalid pes type %u\n",
+                                dvbdmxfeed->pes_type);
+                        ret = -EINVAL;
+                        goto out;
+                }
+        } else {
+                c = alloc_channel(fdtv);
+        }
+
+        if (c > 15) {
+                dev_err(fdtv->device, "can't start dmx feed: busy\n");
+                ret = -EBUSY;
+                goto out;
+        }
+
+        dvbdmxfeed->priv = (typeof(dvbdmxfeed->priv))(unsigned long)c;
+        fdtv->channel_pid[c] = dvbdmxfeed->pid;
+        collect_channels(fdtv, &pidc, pids);
+
+        if (dvbdmxfeed->pid == 8192) {
+                ret = avc_tuner_get_ts(fdtv);
+                if (ret) {
+                        dealloc_channel(fdtv, c);
+                        dev_err(fdtv->device, "can't get TS\n");
+                        goto out;
+                }
+        } else {
+                ret = avc_tuner_set_pids(fdtv, pidc, pids);
+                if (ret) {
+                        dealloc_channel(fdtv, c);
+                        dev_err(fdtv->device, "can't set PIDs\n");
+                        goto out;
+                }
+        }
+out:
+        mutex_unlock(&fdtv->demux_mutex);
+
+        return ret;
+}
+
+int fdtv_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+        struct dvb_demux *demux = dvbdmxfeed->demux;
+        struct firedtv *fdtv = demux->priv;
+        int pidc, c, ret;
+        u16 pids[16];
+
+        if (dvbdmxfeed->type == DMX_TYPE_TS &&
+            !((dvbdmxfeed->ts_type & TS_PACKET) &&
+              (demux->dmx.frontend->source != DMX_MEMORY_FE))) {
+
+                if (dvbdmxfeed->ts_type & TS_DECODER) {
+                        if (dvbdmxfeed->pes_type >= DMX_TS_PES_OTHER ||
+                            !demux->pesfilter[dvbdmxfeed->pes_type])
+                                return -EINVAL;
+
+                        demux->pids[dvbdmxfeed->pes_type] |= 0x8000;
+                        demux->pesfilter[dvbdmxfeed->pes_type] = NULL;
+                }
+
+                if (!(dvbdmxfeed->ts_type & TS_DECODER &&
+                      dvbdmxfeed->pes_type < DMX_TS_PES_OTHER))
+                        return 0;
+        }
+
+        if (mutex_lock_interruptible(&fdtv->demux_mutex))
+                return -EINTR;
+
+        c = (unsigned long)dvbdmxfeed->priv;
+        dealloc_channel(fdtv, c);
+        collect_channels(fdtv, &pidc, pids);
+
+        ret = avc_tuner_set_pids(fdtv, pidc, pids);
+
+        mutex_unlock(&fdtv->demux_mutex);
+
+        return ret;
+}
+
+DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+
+int fdtv_dvb_register(struct firedtv *fdtv)
+{
+        int err;
+
+        err = dvb_register_adapter(&fdtv->adapter, fdtv_model_names[fdtv->type],
+                                   THIS_MODULE, fdtv->device, adapter_nr);
+        if (err < 0)
+                goto fail_log;
+
+        /*DMX_TS_FILTERING | DMX_SECTION_FILTERING*/
+        fdtv->demux.dmx.capabilities = 0;
+
+        fdtv->demux.priv        = fdtv;
+        fdtv->demux.filternum   = 16;
+        fdtv->demux.feednum     = 16;
+        fdtv->demux.start_feed  = fdtv_start_feed;
+        fdtv->demux.stop_feed   = fdtv_stop_feed;
+        fdtv->demux.write_to_decoder = NULL;
+
+        err = dvb_dmx_init(&fdtv->demux);
+        if (err)
+                goto fail_unreg_adapter;
+
+        fdtv->dmxdev.filternum    = 16;
+        fdtv->dmxdev.demux        = &fdtv->demux.dmx;
+        fdtv->dmxdev.capabilities = 0;
+
+        err = dvb_dmxdev_init(&fdtv->dmxdev, &fdtv->adapter);
+        if (err)
+                goto fail_dmx_release;
+
+        fdtv->frontend.source = DMX_FRONTEND_0;
+
+        err = fdtv->demux.dmx.add_frontend(&fdtv->demux.dmx, &fdtv->frontend);
+        if (err)
+                goto fail_dmxdev_release;
+
+        err = fdtv->demux.dmx.connect_frontend(&fdtv->demux.dmx,
+                                               &fdtv->frontend);
+        if (err)
+                goto fail_rem_frontend;
+
+        dvb_net_init(&fdtv->adapter, &fdtv->dvbnet, &fdtv->demux.dmx);
+
+        fdtv_frontend_init(fdtv);
+        err = dvb_register_frontend(&fdtv->adapter, &fdtv->fe);
+        if (err)
+                goto fail_net_release;
+
+        err = fdtv_ca_register(fdtv);
+        if (err)
+                dev_info(fdtv->device,
+                         "Conditional Access Module not enabled\n");
+        return 0;
+
+fail_net_release:
+        dvb_net_release(&fdtv->dvbnet);
+        fdtv->demux.dmx.close(&fdtv->demux.dmx);
+fail_rem_frontend:
+        fdtv->demux.dmx.remove_frontend(&fdtv->demux.dmx, &fdtv->frontend);
+fail_dmxdev_release:
+        dvb_dmxdev_release(&fdtv->dmxdev);
+fail_dmx_release:
+        dvb_dmx_release(&fdtv->demux);
+fail_unreg_adapter:
+        dvb_unregister_adapter(&fdtv->adapter);
+fail_log:
+        dev_err(fdtv->device, "DVB initialization failed\n");
+        return err;
+}
+
+void fdtv_dvb_unregister(struct firedtv *fdtv)
+{
+        fdtv_ca_release(fdtv);
+        dvb_unregister_frontend(&fdtv->fe);
+        dvb_net_release(&fdtv->dvbnet);
+        fdtv->demux.dmx.close(&fdtv->demux.dmx);
+        fdtv->demux.dmx.remove_frontend(&fdtv->demux.dmx, &fdtv->frontend);
+        dvb_dmxdev_release(&fdtv->dmxdev);
+        dvb_dmx_release(&fdtv->demux);
+        dvb_unregister_adapter(&fdtv->adapter);
+}
+
+const char *fdtv_model_names[] = {
+        [FIREDTV_UNKNOWN] = "unknown type",
+        [FIREDTV_DVB_S]   = "FireDTV S/CI",
+        [FIREDTV_DVB_C]   = "FireDTV C/CI",
+        [FIREDTV_DVB_T]   = "FireDTV T/CI",
+        [FIREDTV_DVB_S2]  = "FireDTV S2  ",
+};
+
+struct firedtv *fdtv_alloc(struct device *dev,
+                           const struct firedtv_backend *backend,
+                           const char *name, size_t name_len)
+{
+        struct firedtv *fdtv;
+        int i;
+
+        fdtv = kzalloc(sizeof(*fdtv), GFP_KERNEL);
+        if (!fdtv)
+                return NULL;
+
+        dev->driver_data        = fdtv;
+        fdtv->device            = dev;
+        fdtv->isochannel        = -1;
+        fdtv->voltage           = 0xff;
+        fdtv->tone              = 0xff;
+        fdtv->backend           = backend;
+
+        mutex_init(&fdtv->avc_mutex);
+        init_waitqueue_head(&fdtv->avc_wait);
+        fdtv->avc_reply_received = true;
+        mutex_init(&fdtv->demux_mutex);
+        INIT_WORK(&fdtv->remote_ctrl_work, avc_remote_ctrl_work);
+
+        for (i = ARRAY_SIZE(fdtv_model_names); --i; )
+                if (strlen(fdtv_model_names[i]) <= name_len &&
+                    strncmp(name, fdtv_model_names[i], name_len) == 0)
+                        break;
+        fdtv->type = i;
+
+        return fdtv;
+}
+
+#define MATCH_FLAGS (IEEE1394_MATCH_VENDOR_ID | IEEE1394_MATCH_MODEL_ID | \
+                     IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION)
+
+#define DIGITAL_EVERYWHERE_OUI  0x001287
+#define AVC_UNIT_SPEC_ID_ENTRY  0x00a02d
+#define AVC_SW_VERSION_ENTRY    0x010001
+
+static struct ieee1394_device_id fdtv_id_table[] = {
+        {
+                /* FloppyDTV S/CI and FloppyDTV S2 */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000024,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FloppyDTV T/CI */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000025,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FloppyDTV C/CI */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000026,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FireDTV S/CI and FloppyDTV S2 */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000034,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FireDTV T/CI */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000035,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FireDTV C/CI */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000036,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {}
+};
+MODULE_DEVICE_TABLE(ieee1394, fdtv_id_table);
+
+static int __init fdtv_init(void)
+{
+        return fdtv_1394_init(fdtv_id_table);
+}
+
+static void __exit fdtv_exit(void)
+{
+        fdtv_1394_exit();
+}
+
+module_init(fdtv_init);
+module_exit(fdtv_exit);
+
+MODULE_AUTHOR("Andreas Monitzer <andy@monitzer.com>");
+MODULE_AUTHOR("Ben Backx <ben@bbackx.com>");
+MODULE_DESCRIPTION("FireDTV DVB Driver");
+MODULE_LICENSE("GPL");
+MODULE_SUPPORTED_DEVICE("FireDTV DVB");
diff --git a/drivers/media/dvb/firewire/firedtv-fe.c b/drivers/media/dvb/firewire/firedtv-fe.c
new file mode 100644
index 000000000000..7ba43630a25d
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-fe.c
@@ -0,0 +1,247 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/types.h>
+
+#include <dvb_frontend.h>
+
+#include "firedtv.h"
+
+static int fdtv_dvb_init(struct dvb_frontend *fe)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        int err;
+
+        /* FIXME - allocate free channel at IRM */
+        fdtv->isochannel = fdtv->adapter.num;
+
+        err = cmp_establish_pp_connection(fdtv, fdtv->subunit,
+                                          fdtv->isochannel);
+        if (err) {
+                dev_err(fdtv->device,
+                        "could not establish point to point connection\n");
+                return err;
+        }
+
+        return fdtv->backend->start_iso(fdtv);
+}
+
+static int fdtv_sleep(struct dvb_frontend *fe)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        fdtv->backend->stop_iso(fdtv);
+        cmp_break_pp_connection(fdtv, fdtv->subunit, fdtv->isochannel);
+        fdtv->isochannel = -1;
+        return 0;
+}
+
+#define LNBCONTROL_DONTCARE 0xff
+
+static int fdtv_diseqc_send_master_cmd(struct dvb_frontend *fe,
+                                       struct dvb_diseqc_master_cmd *cmd)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        return avc_lnb_control(fdtv, LNBCONTROL_DONTCARE, LNBCONTROL_DONTCARE,
+                               LNBCONTROL_DONTCARE, 1, cmd);
+}
+
+static int fdtv_diseqc_send_burst(struct dvb_frontend *fe,
+                                  fe_sec_mini_cmd_t minicmd)
+{
+        return 0;
+}
+
+static int fdtv_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        fdtv->tone = tone;
+        return 0;
+}
+
+static int fdtv_set_voltage(struct dvb_frontend *fe,
+                            fe_sec_voltage_t voltage)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        fdtv->voltage = voltage;
+        return 0;
+}
+
+static int fdtv_read_status(struct dvb_frontend *fe, fe_status_t *status)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        struct firedtv_tuner_status stat;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        if (stat.no_rf)
+                *status = 0;
+        else
+                *status = FE_HAS_SIGNAL | FE_HAS_VITERBI | FE_HAS_SYNC |
+                          FE_HAS_CARRIER | FE_HAS_LOCK;
+        return 0;
+}
+
+static int fdtv_read_ber(struct dvb_frontend *fe, u32 *ber)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        struct firedtv_tuner_status stat;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        *ber = stat.ber;
+        return 0;
+}
+
+static int fdtv_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        struct firedtv_tuner_status stat;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        *strength = stat.signal_strength << 8;
+        return 0;
+}
+
+static int fdtv_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        struct firedtv_tuner_status stat;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        /* C/N[dB] = -10 * log10(snr / 65535) */
+        *snr = stat.carrier_noise_ratio * 257;
+        return 0;
+}
+
+static int fdtv_read_uncorrected_blocks(struct dvb_frontend *fe, u32 *ucblocks)
+{
+        return -EOPNOTSUPP;
+}
+
+#define ACCEPTED 0x9
+
+static int fdtv_set_frontend(struct dvb_frontend *fe,
+                             struct dvb_frontend_parameters *params)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        /* FIXME: avc_tuner_dsd never returns ACCEPTED. Check status? */
+        if (avc_tuner_dsd(fdtv, params) != ACCEPTED)
+                return -EINVAL;
+        else
+                return 0; /* not sure of this... */
+}
+
+static int fdtv_get_frontend(struct dvb_frontend *fe,
+                             struct dvb_frontend_parameters *params)
+{
+        return -EOPNOTSUPP;
+}
+
+void fdtv_frontend_init(struct firedtv *fdtv)
+{
+        struct dvb_frontend_ops *ops = &fdtv->fe.ops;
+        struct dvb_frontend_info *fi = &ops->info;
+
+        ops->init                       = fdtv_dvb_init;
+        ops->sleep                      = fdtv_sleep;
+
+        ops->set_frontend               = fdtv_set_frontend;
+        ops->get_frontend               = fdtv_get_frontend;
+
+        ops->read_status                = fdtv_read_status;
+        ops->read_ber                   = fdtv_read_ber;
+        ops->read_signal_strength       = fdtv_read_signal_strength;
+        ops->read_snr                   = fdtv_read_snr;
+        ops->read_ucblocks              = fdtv_read_uncorrected_blocks;
+
+        ops->diseqc_send_master_cmd     = fdtv_diseqc_send_master_cmd;
+        ops->diseqc_send_burst          = fdtv_diseqc_send_burst;
+        ops->set_tone                   = fdtv_set_tone;
+        ops->set_voltage                = fdtv_set_voltage;
+
+        switch (fdtv->type) {
+        case FIREDTV_DVB_S:
+        case FIREDTV_DVB_S2:
+                fi->type                = FE_QPSK;
+
+                fi->frequency_min       = 950000;
+                fi->frequency_max       = 2150000;
+                fi->frequency_stepsize  = 125;
+                fi->symbol_rate_min     = 1000000;
+                fi->symbol_rate_max     = 40000000;
+
+                fi->caps                = FE_CAN_INVERSION_AUTO |
+                                          FE_CAN_FEC_1_2        |
+                                          FE_CAN_FEC_2_3        |
+                                          FE_CAN_FEC_3_4        |
+                                          FE_CAN_FEC_5_6        |
+                                          FE_CAN_FEC_7_8        |
+                                          FE_CAN_FEC_AUTO       |
+                                          FE_CAN_QPSK;
+                break;
+
+        case FIREDTV_DVB_C:
+                fi->type                = FE_QAM;
+
+                fi->frequency_min       = 47000000;
+                fi->frequency_max       = 866000000;
+                fi->frequency_stepsize  = 62500;
+                fi->symbol_rate_min     = 870000;
+                fi->symbol_rate_max     = 6900000;
+
+                fi->caps                = FE_CAN_INVERSION_AUTO |
+                                          FE_CAN_QAM_16         |
+                                          FE_CAN_QAM_32         |
+                                          FE_CAN_QAM_64         |
+                                          FE_CAN_QAM_128        |
+                                          FE_CAN_QAM_256        |
+                                          FE_CAN_QAM_AUTO;
+                break;
+
+        case FIREDTV_DVB_T:
+                fi->type                = FE_OFDM;
+
+                fi->frequency_min       = 49000000;
+                fi->frequency_max       = 861000000;
+                fi->frequency_stepsize  = 62500;
+
+                fi->caps                = FE_CAN_INVERSION_AUTO         |
+                                          FE_CAN_FEC_2_3                |
+                                          FE_CAN_TRANSMISSION_MODE_AUTO |
+                                          FE_CAN_GUARD_INTERVAL_AUTO    |
+                                          FE_CAN_HIERARCHY_AUTO;
+                break;
+
+        default:
+                dev_err(fdtv->device, "no frontend for model type %d\n",
+                        fdtv->type);
+        }
+        strcpy(fi->name, fdtv_model_names[fdtv->type]);
+
+        fdtv->fe.dvb = &fdtv->adapter;
+        fdtv->fe.sec_priv = fdtv;
+}
diff --git a/drivers/media/dvb/firewire/firedtv-rc.c b/drivers/media/dvb/firewire/firedtv-rc.c
new file mode 100644
index 000000000000..46a6324d7b73
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-rc.c
@@ -0,0 +1,190 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/bitops.h>
+#include <linux/input.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/types.h>
+
+#include "firedtv.h"
+
+/* fixed table with older keycodes, geared towards MythTV */
+const static u16 oldtable[] = {
+
+        /* code from device: 0x4501...0x451f */
+
+        KEY_ESC,
+        KEY_F9,
+        KEY_1,
+        KEY_2,
+        KEY_3,
+        KEY_4,
+        KEY_5,
+        KEY_6,
+        KEY_7,
+        KEY_8,
+        KEY_9,
+        KEY_I,
+        KEY_0,
+        KEY_ENTER,
+        KEY_RED,
+        KEY_UP,
+        KEY_GREEN,
+        KEY_F10,
+        KEY_SPACE,
+        KEY_F11,
+        KEY_YELLOW,
+        KEY_DOWN,
+        KEY_BLUE,
+        KEY_Z,
+        KEY_P,
+        KEY_PAGEDOWN,
+        KEY_LEFT,
+        KEY_W,
+        KEY_RIGHT,
+        KEY_P,
+        KEY_M,
+
+        /* code from device: 0x4540...0x4542 */
+
+        KEY_R,
+        KEY_V,
+        KEY_C,
+};
+
+/* user-modifiable table for a remote as sold in 2008 */
+const static u16 keytable[] = {
+
+        /* code from device: 0x0300...0x031f */
+
+        [0x00] = KEY_POWER,
+        [0x01] = KEY_SLEEP,
+        [0x02] = KEY_STOP,
+        [0x03] = KEY_OK,
+        [0x04] = KEY_RIGHT,
+        [0x05] = KEY_1,
+        [0x06] = KEY_2,
+        [0x07] = KEY_3,
+        [0x08] = KEY_LEFT,
+        [0x09] = KEY_4,
+        [0x0a] = KEY_5,
+        [0x0b] = KEY_6,
+        [0x0c] = KEY_UP,
+        [0x0d] = KEY_7,
+        [0x0e] = KEY_8,
+        [0x0f] = KEY_9,
+        [0x10] = KEY_DOWN,
+        [0x11] = KEY_TITLE,     /* "OSD" - fixme */
+        [0x12] = KEY_0,
+        [0x13] = KEY_F20,       /* "16:9" - fixme */
+        [0x14] = KEY_SCREEN,    /* "FULL" - fixme */
+        [0x15] = KEY_MUTE,
+        [0x16] = KEY_SUBTITLE,
+        [0x17] = KEY_RECORD,
+        [0x18] = KEY_TEXT,
+        [0x19] = KEY_AUDIO,
+        [0x1a] = KEY_RED,
+        [0x1b] = KEY_PREVIOUS,
+        [0x1c] = KEY_REWIND,
+        [0x1d] = KEY_PLAYPAUSE,
+        [0x1e] = KEY_NEXT,
+        [0x1f] = KEY_VOLUMEUP,
+
+        /* code from device: 0x0340...0x0354 */
+
+        [0x20] = KEY_CHANNELUP,
+        [0x21] = KEY_F21,       /* "4:3" - fixme */
+        [0x22] = KEY_TV,
+        [0x23] = KEY_DVD,
+        [0x24] = KEY_VCR,
+        [0x25] = KEY_AUX,
+        [0x26] = KEY_GREEN,
+        [0x27] = KEY_YELLOW,
+        [0x28] = KEY_BLUE,
+        [0x29] = KEY_CHANNEL,   /* "CH.LIST" */
+        [0x2a] = KEY_VENDOR,    /* "CI" - fixme */
+        [0x2b] = KEY_VOLUMEDOWN,
+        [0x2c] = KEY_CHANNELDOWN,
+        [0x2d] = KEY_LAST,
+        [0x2e] = KEY_INFO,
+        [0x2f] = KEY_FORWARD,
+        [0x30] = KEY_LIST,
+        [0x31] = KEY_FAVORITES,
+        [0x32] = KEY_MENU,
+        [0x33] = KEY_EPG,
+        [0x34] = KEY_EXIT,
+};
+
+int fdtv_register_rc(struct firedtv *fdtv, struct device *dev)
+{
+        struct input_dev *idev;
+        int i, err;
+
+        idev = input_allocate_device();
+        if (!idev)
+                return -ENOMEM;
+
+        fdtv->remote_ctrl_dev = idev;
+        idev->name = "FireDTV remote control";
+        idev->dev.parent = dev;
+        idev->evbit[0] = BIT_MASK(EV_KEY);
+        idev->keycode = kmemdup(keytable, sizeof(keytable), GFP_KERNEL);
+        if (!idev->keycode) {
+                err = -ENOMEM;
+                goto fail;
+        }
+        idev->keycodesize = sizeof(keytable[0]);
+        idev->keycodemax = ARRAY_SIZE(keytable);
+
+        for (i = 0; i < ARRAY_SIZE(keytable); i++)
+                set_bit(keytable[i], idev->keybit);
+
+        err = input_register_device(idev);
+        if (err)
+                goto fail_free_keymap;
+
+        return 0;
+
+fail_free_keymap:
+        kfree(idev->keycode);
+fail:
+        input_free_device(idev);
+        return err;
+}
+
+void fdtv_unregister_rc(struct firedtv *fdtv)
+{
+        kfree(fdtv->remote_ctrl_dev->keycode);
+        input_unregister_device(fdtv->remote_ctrl_dev);
+}
+
+void fdtv_handle_rc(struct firedtv *fdtv, unsigned int code)
+{
+        u16 *keycode = fdtv->remote_ctrl_dev->keycode;
+
+        if (code >= 0x0300 && code <= 0x031f)
+                code = keycode[code - 0x0300];
+        else if (code >= 0x0340 && code <= 0x0354)
+                code = keycode[code - 0x0320];
+        else if (code >= 0x4501 && code <= 0x451f)
+                code = oldtable[code - 0x4501];
+        else if (code >= 0x4540 && code <= 0x4542)
+                code = oldtable[code - 0x4521];
+        else {
+                printk(KERN_DEBUG "firedtv: invalid key code 0x%04x "
+                       "from remote control\n", code);
+                return;
+        }
+
+        input_report_key(fdtv->remote_ctrl_dev, code, 1);
+        input_report_key(fdtv->remote_ctrl_dev, code, 0);
+}
diff --git a/drivers/media/dvb/firewire/firedtv.h b/drivers/media/dvb/firewire/firedtv.h
new file mode 100644
index 000000000000..d48530b81e61
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv.h
@@ -0,0 +1,182 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#ifndef _FIREDTV_H
+#define _FIREDTV_H
+
+#include <linux/dvb/dmx.h>
+#include <linux/dvb/frontend.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/spinlock_types.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+
+#include <demux.h>
+#include <dmxdev.h>
+#include <dvb_demux.h>
+#include <dvb_frontend.h>
+#include <dvb_net.h>
+#include <dvbdev.h>
+
+struct firedtv_tuner_status {
+        unsigned active_system:8;
+        unsigned searching:1;
+        unsigned moving:1;
+        unsigned no_rf:1;
+        unsigned input:1;
+        unsigned selected_antenna:7;
+        unsigned ber:32;
+        unsigned signal_strength:8;
+        unsigned raster_frequency:2;
+        unsigned rf_frequency:22;
+        unsigned man_dep_info_length:8;
+        unsigned front_end_error:1;
+        unsigned antenna_error:1;
+        unsigned front_end_power_status:1;
+        unsigned power_supply:1;
+        unsigned carrier_noise_ratio:16;
+        unsigned power_supply_voltage:8;
+        unsigned antenna_voltage:8;
+        unsigned firewire_bus_voltage:8;
+        unsigned ca_mmi:1;
+        unsigned ca_pmt_reply:1;
+        unsigned ca_date_time_request:1;
+        unsigned ca_application_info:1;
+        unsigned ca_module_present_status:1;
+        unsigned ca_dvb_flag:1;
+        unsigned ca_error_flag:1;
+        unsigned ca_initialization_status:1;
+};
+
+enum model_type {
+        FIREDTV_UNKNOWN = 0,
+        FIREDTV_DVB_S   = 1,
+        FIREDTV_DVB_C   = 2,
+        FIREDTV_DVB_T   = 3,
+        FIREDTV_DVB_S2  = 4,
+};
+
+struct device;
+struct input_dev;
+struct firedtv;
+
+struct firedtv_backend {
+        int (*lock)(struct firedtv *fdtv, u64 addr, void *data, __be32 arg);
+        int (*read)(struct firedtv *fdtv, u64 addr, void *data, size_t len);
+        int (*write)(struct firedtv *fdtv, u64 addr, void *data, size_t len);
+        int (*start_iso)(struct firedtv *fdtv);
+        void (*stop_iso)(struct firedtv *fdtv);
+};
+
+struct firedtv {
+        struct device *device;
+        struct list_head list;
+
+        struct dvb_adapter      adapter;
+        struct dmxdev           dmxdev;
+        struct dvb_demux        demux;
+        struct dmx_frontend     frontend;
+        struct dvb_net          dvbnet;
+        struct dvb_frontend     fe;
+
+        struct dvb_device       *cadev;
+        int                     ca_last_command;
+        int                     ca_time_interval;
+
+        struct mutex            avc_mutex;
+        wait_queue_head_t       avc_wait;
+        bool                    avc_reply_received;
+        struct work_struct      remote_ctrl_work;
+        struct input_dev        *remote_ctrl_dev;
+
+        enum model_type         type;
+        char                    subunit;
+        char                    isochannel;
+        fe_sec_voltage_t        voltage;
+        fe_sec_tone_mode_t      tone;
+
+        const struct firedtv_backend *backend;
+        void                    *backend_data;
+
+        struct mutex            demux_mutex;
+        unsigned long           channel_active;
+        u16                     channel_pid[16];
+
+        size_t                  response_length;
+        u8                      response[512];
+};
+
+/* firedtv-1394.c */
+#ifdef CONFIG_DVB_FIREDTV_IEEE1394
+int fdtv_1394_init(struct ieee1394_device_id id_table[]);
+void fdtv_1394_exit(void);
+#else
+static inline int fdtv_1394_init(struct ieee1394_device_id it[]) { return 0; }
+static inline void fdtv_1394_exit(void) {}
+#endif
+
+/* firedtv-avc.c */
+int avc_recv(struct firedtv *fdtv, void *data, size_t length);
+int avc_tuner_status(struct firedtv *fdtv, struct firedtv_tuner_status *stat);
+struct dvb_frontend_parameters;
+int avc_tuner_dsd(struct firedtv *fdtv, struct dvb_frontend_parameters *params);
+int avc_tuner_set_pids(struct firedtv *fdtv, unsigned char pidc, u16 pid[]);
+int avc_tuner_get_ts(struct firedtv *fdtv);
+int avc_identify_subunit(struct firedtv *fdtv);
+struct dvb_diseqc_master_cmd;
+int avc_lnb_control(struct firedtv *fdtv, char voltage, char burst,
+                    char conttone, char nrdiseq,
+                    struct dvb_diseqc_master_cmd *diseqcmd);
+void avc_remote_ctrl_work(struct work_struct *work);
+int avc_register_remote_control(struct firedtv *fdtv);
+int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len);
+int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len);
+int avc_ca_reset(struct firedtv *fdtv);
+int avc_ca_pmt(struct firedtv *fdtv, char *app_info, int length);
+int avc_ca_get_time_date(struct firedtv *fdtv, int *interval);
+int avc_ca_enter_menu(struct firedtv *fdtv);
+int avc_ca_get_mmi(struct firedtv *fdtv, char *mmi_object, unsigned int *len);
+int cmp_establish_pp_connection(struct firedtv *fdtv, int plug, int channel);
+void cmp_break_pp_connection(struct firedtv *fdtv, int plug, int channel);
+
+/* firedtv-ci.c */
+int fdtv_ca_register(struct firedtv *fdtv);
+void fdtv_ca_release(struct firedtv *fdtv);
+
+/* firedtv-dvb.c */
+int fdtv_start_feed(struct dvb_demux_feed *dvbdmxfeed);
+int fdtv_stop_feed(struct dvb_demux_feed *dvbdmxfeed);
+int fdtv_dvb_register(struct firedtv *fdtv);
+void fdtv_dvb_unregister(struct firedtv *fdtv);
+struct firedtv *fdtv_alloc(struct device *dev,
+                           const struct firedtv_backend *backend,
+                           const char *name, size_t name_len);
+extern const char *fdtv_model_names[];
+
+/* firedtv-fe.c */
+void fdtv_frontend_init(struct firedtv *fdtv);
+
+/* firedtv-rc.c */
+#ifdef CONFIG_DVB_FIREDTV_INPUT
+int fdtv_register_rc(struct firedtv *fdtv, struct device *dev);
+void fdtv_unregister_rc(struct firedtv *fdtv);
+void fdtv_handle_rc(struct firedtv *fdtv, unsigned int code);
+#else
+static inline int fdtv_register_rc(struct firedtv *fdtv,
+                                   struct device *dev) { return 0; }
+static inline void fdtv_unregister_rc(struct firedtv *fdtv) {}
+static inline void fdtv_handle_rc(struct firedtv *fdtv, unsigned int code) {}
+#endif
+
+#endif /* _FIREDTV_H */
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 5d882a44e3ee..2ac738fa6a07 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -463,6 +463,8 @@ static int em28xx_audio_init(struct em28xx *dev)
         pcm->info_flags = 0;
         pcm->private_data = dev;
         strcpy(pcm->name, "Empia 28xx Capture");
+
+        snd_card_set_dev(card, &dev->udev->dev);
         strcpy(card->driver, "Empia Em28xx Audio");
         strcpy(card->shortname, "Em28xx Audio");
         strcpy(card->longname, "Empia Em28xx Audio");
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index a1d6008efcbb..07c334f25aae 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -1155,23 +1155,23 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
 {
         struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
         struct pxa_camera_dev *pcdev = ici->priv;
-        const struct soc_camera_data_format *host_fmt, *cam_fmt = NULL;
-        const struct soc_camera_format_xlate *xlate;
+        const struct soc_camera_data_format *cam_fmt = NULL;
+        const struct soc_camera_format_xlate *xlate = NULL;
         struct soc_camera_sense sense = {
                 .master_clock = pcdev->mclk,
                 .pixel_clock_max = pcdev->ciclk / 4,
         };
-        int ret, buswidth;
+        int ret;
 
-        xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
-        if (!xlate) {
-                dev_warn(&ici->dev, "Format %x not found\n", pixfmt);
-                return -EINVAL;
-        }
+        if (pixfmt) {
+                xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
+                if (!xlate) {
+                        dev_warn(&ici->dev, "Format %x not found\n", pixfmt);
+                        return -EINVAL;
+                }
 
-        buswidth = xlate->buswidth;
-        host_fmt = xlate->host_fmt;
-        cam_fmt = xlate->cam_fmt;
+                cam_fmt = xlate->cam_fmt;
+        }
 
         /* If PCLK is used to latch data from the sensor, check sense */
         if (pcdev->platform_flags & PXA_CAMERA_PCLK_EN)
@@ -1201,8 +1201,8 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
         }
 
         if (pixfmt && !ret) {
-                icd->buswidth = buswidth;
-                icd->current_fmt = host_fmt;
+                icd->buswidth = xlate->buswidth;
+                icd->current_fmt = xlate->host_fmt;
         }
 
         return ret;
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 9a2586b07a05..ddcb81d0b81a 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -603,21 +603,18 @@ static int sh_mobile_ceu_set_fmt(struct soc_camera_device *icd,
         const struct soc_camera_format_xlate *xlate;
         int ret;
 
+        if (!pixfmt)
+                return icd->ops->set_fmt(icd, pixfmt, rect);
+
         xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
         if (!xlate) {
                 dev_warn(&ici->dev, "Format %x not found\n", pixfmt);
                 return -EINVAL;
         }
 
-        switch (pixfmt) {
-        case 0:                         /* Only geometry change */
-                ret = icd->ops->set_fmt(icd, pixfmt, rect);
-                break;
-        default:
-                ret = icd->ops->set_fmt(icd, xlate->cam_fmt->fourcc, rect);
-        }
+        ret = icd->ops->set_fmt(icd, xlate->cam_fmt->fourcc, rect);
 
-        if (pixfmt && !ret) {
+        if (!ret) {
                 icd->buswidth = xlate->buswidth;
                 icd->current_fmt = xlate->host_fmt;
                 pcdev->camera_fmt = xlate->cam_fmt;
diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
index c1e4ae27c613..c705f248da88 100644
--- a/drivers/media/video/uvc/uvc_status.c
+++ b/drivers/media/video/uvc/uvc_status.c
@@ -46,8 +46,8 @@ static int uvc_input_init(struct uvc_device *dev)
         usb_to_input_id(udev, &input->id);
         input->dev.parent = &dev->intf->dev;
 
-        set_bit(EV_KEY, input->evbit);
-        set_bit(BTN_0, input->keybit);
+        __set_bit(EV_KEY, input->evbit);
+        __set_bit(KEY_CAMERA, input->keybit);
 
         if ((ret = input_register_device(input)) < 0)
                 goto error;
@@ -70,8 +70,10 @@ static void uvc_input_cleanup(struct uvc_device *dev)
 static void uvc_input_report_key(struct uvc_device *dev, unsigned int code,
         int value)
 {
-        if (dev->input)
+        if (dev->input) {
                 input_report_key(dev->input, code, value);
+                input_sync(dev->input);
+        }
 }
 
 #else
@@ -96,7 +98,7 @@ static void uvc_event_streaming(struct uvc_device *dev, __u8 *data, int len)
                         return;
                 uvc_trace(UVC_TRACE_STATUS, "Button (intf %u) %s len %d\n",
                         data[1], data[3] ? "pressed" : "released", len);
-                uvc_input_report_key(dev, BTN_0, data[3]);
+                uvc_input_report_key(dev, KEY_CAMERA, data[3]);
         } else {
                 uvc_trace(UVC_TRACE_STATUS, "Stream %u error event %02x %02x "
                         "len %d.\n", data[1], data[2], data[3], len);
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 96ac88317b8e..ea3aafbbda44 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -91,9 +91,9 @@ MODULE_PARM_DESC(mpt_msi_enable_fc, " Enable MSI Support for FC \
                 controllers (default=0)");
 
 static int mpt_msi_enable_sas;
-module_param(mpt_msi_enable_sas, int, 1);
+module_param(mpt_msi_enable_sas, int, 0);
 MODULE_PARM_DESC(mpt_msi_enable_sas, " Enable MSI Support for SAS \
-                controllers (default=1)");
+                controllers (default=0)");
 
 
 static int mpt_channel_mapping;
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index 84d5ea1ec171..b457a05b28d9 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -1383,6 +1383,11 @@ int wm8350_device_init(struct wm8350 *wm8350, int irq,
                         wm8350->power.rev_g_coeff = 1;
                         break;
 
+                case 1:
+                        dev_info(wm8350->dev, "WM8351 Rev B\n");
+                        wm8350->power.rev_g_coeff = 1;
+                        break;
+
                 default:
                         dev_err(wm8350->dev, "Unknown WM8351 CHIP_REV\n");
                         ret = -ENODEV;
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index f26667a7abf7..cf991850f01b 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -710,6 +710,7 @@ out:
 
 static struct pci_device_id ilo_devices[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_COMPAQ, 0xB204) },
+        { PCI_DEVICE(PCI_VENDOR_ID_HP, 0x3307) },
         { }
 };
 MODULE_DEVICE_TABLE(pci, ilo_devices);
@@ -758,7 +759,7 @@ static void __exit ilo_exit(void)
         class_destroy(ilo_class);
 }
 
-MODULE_VERSION("0.06");
+MODULE_VERSION("1.0");
 MODULE_ALIAS(ILO_NAME);
 MODULE_DESCRIPTION(ILO_NAME);
 MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index 9c50e6f1c236..34ce2703d29a 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -248,12 +248,15 @@ mmc_send_cxd_data(struct mmc_card *card, struct mmc_host *host,
 
         sg_init_one(&sg, data_buf, len);
 
-        /*
-         * The spec states that CSR and CID accesses have a timeout
-         * of 64 clock cycles.
-         */
-        data.timeout_ns = 0;
-        data.timeout_clks = 64;
+        if (opcode == MMC_SEND_CSD || opcode == MMC_SEND_CID) {
+                /*
+                 * The spec states that CSR and CID accesses have a timeout
+                 * of 64 clock cycles.
+                 */
+                data.timeout_ns = 0;
+                data.timeout_clks = 64;
+        } else
+                mmc_set_data_timeout(&data, card);
 
         mmc_wait_for_req(host, &mrq);
 
diff --git a/drivers/mmc/host/s3cmci.c b/drivers/mmc/host/s3cmci.c
index f4a67c65d301..2db166b7096f 100644
--- a/drivers/mmc/host/s3cmci.c
+++ b/drivers/mmc/host/s3cmci.c
@@ -793,8 +793,7 @@ static void s3cmci_dma_setup(struct s3cmci_host *host,
                               host->mem->start + host->sdidata);
 
         if (!setup_ok) {
-                s3c2410_dma_config(host->dma, 4,
-                        (S3C2410_DCON_HWTRIG | S3C2410_DCON_CH0_SDI));
+                s3c2410_dma_config(host->dma, 4, 0);
                 s3c2410_dma_set_buffdone_fn(host->dma,
                                             s3cmci_dma_done_callback);
                 s3c2410_dma_setflags(host->dma, S3C2410_DMAF_AUTOSTART);
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 8cff5f5e7f86..406da9a8d453 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -107,6 +107,7 @@ static const struct sdhci_pci_fixes sdhci_ene_714 = {
 
 static const struct sdhci_pci_fixes sdhci_cafe = {
         .quirks         = SDHCI_QUIRK_NO_SIMULT_VDD_AND_POWER |
+                          SDHCI_QUIRK_NO_BUSY_IRQ |
                           SDHCI_QUIRK_BROKEN_TIMEOUT_VAL,
 };
 
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index f52f3053ed92..accb592764ed 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1291,8 +1291,11 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
                 if (host->cmd->data)
                         DBG("Cannot wait for busy signal when also "
                                 "doing a data transfer");
-                else
+                else if (!(host->quirks & SDHCI_QUIRK_NO_BUSY_IRQ))
                         return;
+
+                /* The controller does not support the end-of-busy IRQ,
+                 * fall through and take the SDHCI_INT_RESPONSE */
         }
 
         if (intmask & SDHCI_INT_RESPONSE)
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index ebb83657e27a..43c37c68d07a 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -208,6 +208,8 @@ struct sdhci_host {
 #define SDHCI_QUIRK_BROKEN_TIMEOUT_VAL                  (1<<12)
 /* Controller has an issue with buffer bits for small transfers */
 #define SDHCI_QUIRK_BROKEN_SMALL_PIO                    (1<<13)
+/* Controller does not provide transfer-complete interrupt when not busy */
+#define SDHCI_QUIRK_NO_BUSY_IRQ                         (1<<14)
 
         int                     irq;            /* Device IRQ */
         void __iomem *          ioaddr;         /* Mapped address */
diff --git a/drivers/mtd/chips/map_rom.c b/drivers/mtd/chips/map_rom.c
index 821d0ed6bae3..c76d6e5f47ee 100644
--- a/drivers/mtd/chips/map_rom.c
+++ b/drivers/mtd/chips/map_rom.c
@@ -19,6 +19,7 @@ static int maprom_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int maprom_write (struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
 static void maprom_nop (struct mtd_info *);
 static struct mtd_info *map_rom_probe(struct map_info *map);
+static int maprom_erase (struct mtd_info *mtd, struct erase_info *info);
 
 static struct mtd_chip_driver maprom_chipdrv = {
         .probe  = map_rom_probe,
@@ -42,6 +43,7 @@ static struct mtd_info *map_rom_probe(struct map_info *map)
         mtd->read = maprom_read;
         mtd->write = maprom_write;
         mtd->sync = maprom_nop;
+        mtd->erase = maprom_erase;
         mtd->flags = MTD_CAP_ROM;
         mtd->erasesize = map->size;
         mtd->writesize = 1;
@@ -71,6 +73,12 @@ static int maprom_write (struct mtd_info *mtd, loff_t to, size_t len, size_t *re
         return -EIO;
 }
 
+static int maprom_erase (struct mtd_info *mtd, struct erase_info *info)
+{
+        /* We do our best 8) */
+        return -EROFS;
+}
+
 static int __init map_rom_init(void)
 {
         register_mtd_chip_driver(&maprom_chipdrv);
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index d44f741ae229..6d9f810565c8 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -821,7 +821,8 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
                                         if (!(info->flags & IS_POW2PS))
                                                 return info;
                                 }
-                        }
+                        } else
+                                return info;
                 }
         }
 
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index a425d09f35a0..00248e81ecd5 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -267,22 +267,28 @@ static int parse_cmdline(char *devname, char *szstart, char *szlength)
         if (*(szlength) != '+') {
                 devlength = simple_strtoul(szlength, &buffer, 0);
                 devlength = handle_unit(devlength, buffer) - devstart;
+                if (devlength < devstart)
+                        goto err_out;
+
+                devlength -= devstart;
         } else {
                 devlength = simple_strtoul(szlength + 1, &buffer, 0);
                 devlength = handle_unit(devlength, buffer);
         }
         T("slram: devname=%s, devstart=0x%lx, devlength=0x%lx\n",
                         devname, devstart, devlength);
-        if ((devstart < 0) || (devlength < 0) || (devlength % SLRAM_BLK_SZ != 0)) {
-                E("slram: Illegal start / length parameter.\n");
-                return(-EINVAL);
-        }
+        if (devlength % SLRAM_BLK_SZ != 0)
+                goto err_out;
 
         if ((devstart = register_device(devname, devstart, devlength))){
                 unregister_devices();
                 return((int)devstart);
         }
         return(0);
+
+err_out:
+        E("slram: Illegal length parameter.\n");
+        return(-EINVAL);
 }
 
 #ifndef MODULE
diff --git a/drivers/mtd/lpddr/Kconfig b/drivers/mtd/lpddr/Kconfig
index acd4ea9b2278..5a401d8047ab 100644
--- a/drivers/mtd/lpddr/Kconfig
+++ b/drivers/mtd/lpddr/Kconfig
@@ -12,6 +12,7 @@ config MTD_LPDDR
           DDR memories, intended for battery-operated systems.
 
 config MTD_QINFO_PROBE
+        depends on MTD_LPDDR
         tristate "Detect flash chips by QINFO probe"
         help
             Device Information for LPDDR chips is offered through the Overlay
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 0225cbbf22de..043d50fb6ef6 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -491,7 +491,7 @@ config MTD_PCMCIA_ANONYMOUS
 
 config MTD_BFIN_ASYNC
         tristate "Blackfin BF533-STAMP Flash Chip Support"
-        depends on BFIN533_STAMP && MTD_CFI
+        depends on BFIN533_STAMP && MTD_CFI && MTD_COMPLEX_MAPPINGS
         select MTD_PARTITIONS
         default y
         help
diff --git a/drivers/mtd/maps/bfin-async-flash.c b/drivers/mtd/maps/bfin-async-flash.c
index 6fec86aaed7e..576611f605db 100644
--- a/drivers/mtd/maps/bfin-async-flash.c
+++ b/drivers/mtd/maps/bfin-async-flash.c
@@ -152,14 +152,18 @@ static int __devinit bfin_flash_probe(struct platform_device *pdev)
 
         if (gpio_request(state->enet_flash_pin, DRIVER_NAME)) {
                 pr_devinit(KERN_ERR DRIVER_NAME ": Failed to request gpio %d\n", state->enet_flash_pin);
+                kfree(state);
                 return -EBUSY;
         }
         gpio_direction_output(state->enet_flash_pin, 1);
 
         pr_devinit(KERN_NOTICE DRIVER_NAME ": probing %d-bit flash bus\n", state->map.bankwidth * 8);
         state->mtd = do_map_probe(memory->name, &state->map);
-        if (!state->mtd)
+        if (!state->mtd) {
+                gpio_free(state->enet_flash_pin);
+                kfree(state);
                 return -ENXIO;
+        }
 
 #ifdef CONFIG_MTD_PARTITIONS
         ret = parse_mtd_partitions(state->mtd, part_probe_types, &pdata->parts, 0);
diff --git a/drivers/mtd/maps/ck804xrom.c b/drivers/mtd/maps/ck804xrom.c
index 5f7a245ed132..424f17d6ffd1 100644
--- a/drivers/mtd/maps/ck804xrom.c
+++ b/drivers/mtd/maps/ck804xrom.c
@@ -342,9 +342,9 @@ static struct pci_device_id ck804xrom_pci_tbl[] = {
         { 0, }
 };
 
+#if 0
 MODULE_DEVICE_TABLE(pci, ck804xrom_pci_tbl);
 
-#if 0
 static struct pci_driver ck804xrom_driver = {
         .name =         MOD_NAME,
         .id_table =     ck804xrom_pci_tbl,
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 87743661d48e..229718222db7 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -29,6 +29,7 @@ struct physmap_flash_info {
         struct map_info         map[MAX_RESOURCES];
 #ifdef CONFIG_MTD_PARTITIONS
         int                     nr_parts;
+        struct mtd_partition    *parts;
 #endif
 };
 
@@ -45,25 +46,29 @@ static int physmap_flash_remove(struct platform_device *dev)
 
         physmap_data = dev->dev.platform_data;
 
-#ifdef CONFIG_MTD_CONCAT
-        if (info->cmtd != info->mtd[0]) {
+        if (info->cmtd) {
+#ifdef CONFIG_MTD_PARTITIONS
+                if (info->nr_parts || physmap_data->nr_parts)
+                        del_mtd_partitions(info->cmtd);
+                else
+                        del_mtd_device(info->cmtd);
+#else
                 del_mtd_device(info->cmtd);
-                mtd_concat_destroy(info->cmtd);
+#endif
         }
+#ifdef CONFIG_MTD_PARTITIONS
+        if (info->nr_parts)
+                kfree(info->parts);
 #endif
 
-        for (i = 0; i < MAX_RESOURCES; i++) {
-                if (info->mtd[i] != NULL) {
-#ifdef CONFIG_MTD_PARTITIONS
-                        if (info->nr_parts || physmap_data->nr_parts)
-                                del_mtd_partitions(info->mtd[i]);
-                        else
-                                del_mtd_device(info->mtd[i]);
-#else
-                        del_mtd_device(info->mtd[i]);
+#ifdef CONFIG_MTD_CONCAT
+        if (info->cmtd != info->mtd[0])
+                mtd_concat_destroy(info->cmtd);
 #endif
+
+        for (i = 0; i < MAX_RESOURCES; i++) {
+                if (info->mtd[i] != NULL)
                         map_destroy(info->mtd[i]);
-                }
         }
         return 0;
 }
@@ -86,9 +91,6 @@ static int physmap_flash_probe(struct platform_device *dev)
         int err = 0;
         int i;
         int devices_found = 0;
-#ifdef CONFIG_MTD_PARTITIONS
-        struct mtd_partition *parts;
-#endif
 
         physmap_data = dev->dev.platform_data;
         if (physmap_data == NULL)
@@ -167,10 +169,11 @@ static int physmap_flash_probe(struct platform_device *dev)
                 goto err_out;
 
 #ifdef CONFIG_MTD_PARTITIONS
-        err = parse_mtd_partitions(info->cmtd, part_probe_types, &parts, 0);
+        err = parse_mtd_partitions(info->cmtd, part_probe_types,
+                                &info->parts, 0);
         if (err > 0) {
-                add_mtd_partitions(info->cmtd, parts, err);
-                kfree(parts);
+                add_mtd_partitions(info->cmtd, info->parts, err);
+                info->nr_parts = err;
                 return 0;
         }
 
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index 917cf8d3ae95..c2dfd3ea353d 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -149,7 +149,7 @@ static int __devexit orion_nand_remove(struct platform_device *pdev)
 
 static struct platform_driver orion_nand_driver = {
         .probe          = orion_nand_probe,
-        .remove         = orion_nand_remove,
+        .remove         = __devexit_p(orion_nand_remove),
         .driver         = {
                 .name   = "orion_nand",
                 .owner  = THIS_MODULE,
diff --git a/drivers/net/arm/Makefile b/drivers/net/arm/Makefile
index c69c0cdba4a2..811a3ccd14c1 100644
--- a/drivers/net/arm/Makefile
+++ b/drivers/net/arm/Makefile
@@ -4,7 +4,7 @@
 #
 
 obj-$(CONFIG_ARM_AM79C961A)     += am79c961a.o
-obj-$(CONFIG_ARM_ETHERH)        += etherh.o ../8390.o
+obj-$(CONFIG_ARM_ETHERH)        += etherh.o
 obj-$(CONFIG_ARM_ETHER3)        += ether3.o
 obj-$(CONFIG_ARM_ETHER1)        += ether1.o
 obj-$(CONFIG_ARM_AT91_ETHER)    += at91_ether.o
diff --git a/drivers/net/arm/etherh.c b/drivers/net/arm/etherh.c
index 54b52e5b1821..f52f668c49bf 100644
--- a/drivers/net/arm/etherh.c
+++ b/drivers/net/arm/etherh.c
@@ -641,15 +641,15 @@ static const struct net_device_ops etherh_netdev_ops = {
         .ndo_open               = etherh_open,
         .ndo_stop               = etherh_close,
         .ndo_set_config         = etherh_set_config,
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
diff --git a/drivers/net/arm/ks8695net.c b/drivers/net/arm/ks8695net.c
index 1cf2f949c0b4..f3a127434897 100644
--- a/drivers/net/arm/ks8695net.c
+++ b/drivers/net/arm/ks8695net.c
@@ -560,7 +560,7 @@ ks8695_reset(struct ks8695_priv *ksp)
                 msleep(1);
         }
 
-        if (reset_timeout == 0) {
+        if (reset_timeout < 0) {
                 dev_crit(ksp->dev,
                          "Timeout waiting for DMA engines to reset\n");
                 /* And blithely carry on */
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index c38512ebcea6..dc5f051005fa 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -1264,8 +1264,14 @@ static void b44_clear_stats(struct b44 *bp)
 static void b44_chip_reset(struct b44 *bp, int reset_kind)
 {
         struct ssb_device *sdev = bp->sdev;
+        bool was_enabled;
 
-        if (ssb_device_is_enabled(bp->sdev)) {
+        was_enabled = ssb_device_is_enabled(bp->sdev);
+
+        ssb_device_enable(bp->sdev, 0);
+        ssb_pcicore_dev_irqvecs_enable(&sdev->bus->pcicore, sdev);
+
+        if (was_enabled) {
                 bw32(bp, B44_RCV_LAZY, 0);
                 bw32(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE);
                 b44_wait_bit(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE, 200, 1);
@@ -1277,10 +1283,8 @@ static void b44_chip_reset(struct b44 *bp, int reset_kind)
                 }
                 bw32(bp, B44_DMARX_CTRL, 0);
                 bp->rx_prod = bp->rx_cons = 0;
-        } else
-                ssb_pcicore_dev_irqvecs_enable(&sdev->bus->pcicore, sdev);
+        }
 
-        ssb_device_enable(bp->sdev, 0);
         b44_clear_stats(bp);
 
         /*
@@ -2236,6 +2240,7 @@ static void __devexit b44_remove_one(struct ssb_device *sdev)
         struct net_device *dev = ssb_get_drvdata(sdev);
 
         unregister_netdev(dev);
+        ssb_device_disable(sdev, 0);
         ssb_bus_may_powerdown(sdev->bus);
         free_netdev(dev);
         ssb_pcihost_set_power_state(sdev, PCI_D3hot);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9fb388388fb7..e0578fe8c0db 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4113,7 +4113,7 @@ static int bond_neigh_setup(struct net_device *dev, struct neigh_parms *parms)
                 const struct net_device_ops *slave_ops
                         = slave->dev->netdev_ops;
                 if (slave_ops->ndo_neigh_setup)
-                        return slave_ops->ndo_neigh_setup(dev, parms);
+                        return slave_ops->ndo_neigh_setup(slave->dev, parms);
         }
         return 0;
 }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 9b12a13a640f..9831b3f408aa 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1284,7 +1284,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         spin_lock_irqsave(&priv->txlock, flags);
 
         /* check if there is space to queue this packet */
-        if (nr_frags > priv->num_txbdfree) {
+        if ((nr_frags+1) > priv->num_txbdfree) {
                 /* no space, stop the queue */
                 netif_stop_queue(dev);
                 dev->stats.tx_fifo_errors++;
diff --git a/drivers/net/hp-plus.c b/drivers/net/hp-plus.c
index 5e070f446635..0486cbe01adb 100644
--- a/drivers/net/hp-plus.c
+++ b/drivers/net/hp-plus.c
@@ -467,7 +467,7 @@ init_module(void)
                         if (this_dev != 0) break; /* only autoprobe 1st one */
                         printk(KERN_NOTICE "hp-plus.c: Presently autoprobing (not recommended) for a single card.\n");
                 }
-                dev = alloc_ei_netdev();
+                dev = alloc_eip_netdev();
                 if (!dev)
                         break;
                 dev->irq = irq[this_dev];
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index 08b34051c646..a6e1a35a13cb 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -957,13 +957,14 @@ jme_process_receive(struct jme_adapter *jme, int limit)
                 goto out_inc;
 
         i = atomic_read(&rxring->next_to_clean);
-        while (limit-- > 0) {
+        while (limit > 0) {
                 rxdesc = rxring->desc;
                 rxdesc += i;
 
                 if ((rxdesc->descwb.flags & cpu_to_le16(RXWBFLAG_OWN)) ||
                 !(rxdesc->descwb.desccnt & RXWBDCNT_WBCPL))
                         goto out;
+                --limit;
 
                 desccnt = rxdesc->descwb.desccnt & RXWBDCNT_DCNT;
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 9f33e442f403..13087782ac40 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -588,7 +588,12 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 adapter->pci_mem_read = netxen_nic_pci_mem_read_2M;
                 adapter->pci_mem_write = netxen_nic_pci_mem_write_2M;
 
-                mem_ptr0 = ioremap(mem_base, mem_len);
+                mem_ptr0 = pci_ioremap_bar(pdev, 0);
+                if (mem_ptr0 == NULL) {
+                        dev_err(&pdev->dev, "failed to map PCI bar 0\n");
+                        return -EIO;
+                }
+
                 pci_len0 = mem_len;
                 first_page_group_start = 0;
                 first_page_group_end   = 0;
@@ -795,9 +800,12 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * See if the firmware gave us a virtual-physical port mapping.
          */
         adapter->physical_port = adapter->portnum;
-        i = adapter->pci_read_normalize(adapter, CRB_V2P(adapter->portnum));
-        if (i != 0x55555555)
-                adapter->physical_port = i;
+        if (adapter->fw_major < 4) {
+                i = adapter->pci_read_normalize(adapter,
+                                CRB_V2P(adapter->portnum));
+                if (i != 0x55555555)
+                        adapter->physical_port = i;
+        }
 
         adapter->flags &= ~(NETXEN_NIC_MSI_ENABLED | NETXEN_NIC_MSIX_ENABLED);
 
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index e5cb6b1f0ebd..2404a838b1fe 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -1035,7 +1035,8 @@ static int el3_rx(struct net_device *dev, int worklimit)
         DEBUG(3, "%s: in rx_packet(), status %4.4x, rx_status %4.4x.\n",
                   dev->name, inw(ioaddr+EL3_STATUS), inw(ioaddr+RxStatus));
         while (!((rx_status = inw(ioaddr + RxStatus)) & 0x8000) &&
-                   (--worklimit >= 0)) {
+                        worklimit > 0) {
+                worklimit--;
                 if (rx_status & 0x4000) { /* Error, update stats. */
                         short error = rx_status & 0x3800;
                         dev->stats.rx_errors++;
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 73ecc657999d..1e01b8a6dbf3 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -857,7 +857,8 @@ static int el3_rx(struct net_device *dev)
     DEBUG(3, "%s: in rx_packet(), status %4.4x, rx_status %4.4x.\n",
           dev->name, inw(ioaddr+EL3_STATUS), inw(ioaddr+RX_STATUS));
     while (!((rx_status = inw(ioaddr + RX_STATUS)) & 0x8000) &&
-           (--worklimit >= 0)) {
+                    worklimit > 0) {
+        worklimit--;
         if (rx_status & 0x4000) { /* Error, update stats. */
             short error = rx_status & 0x3800;
             dev->stats.rx_errors++;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 0771eb6fc6eb..b3473401c83a 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -81,9 +81,9 @@ static const int multicast_filter_limit = 32;
 #define RTL8169_TX_TIMEOUT      (6*HZ)
 #define RTL8169_PHY_TIMEOUT     (10*HZ)
 
-#define RTL_EEPROM_SIG          cpu_to_le32(0x8129)
-#define RTL_EEPROM_SIG_MASK     cpu_to_le32(0xffff)
+#define RTL_EEPROM_SIG          0x8129
 #define RTL_EEPROM_SIG_ADDR     0x0000
+#define RTL_EEPROM_MAC_ADDR     0x0007
 
 /* write/read MMIO register */
 #define RTL_W8(reg, val8)       writeb ((val8), ioaddr + (reg))
@@ -293,6 +293,11 @@ enum rtl_register_content {
         /* Cfg9346Bits */
         Cfg9346_Lock    = 0x00,
         Cfg9346_Unlock  = 0xc0,
+        Cfg9346_Program = 0x80,         /* Programming mode */
+        Cfg9346_EECS    = 0x08,         /* Chip select */
+        Cfg9346_EESK    = 0x04,         /* Serial data clock */
+        Cfg9346_EEDI    = 0x02,         /* Data input */
+        Cfg9346_EEDO    = 0x01,         /* Data output */
 
         /* rx_mode_bits */
         AcceptErr       = 0x20,
@@ -305,6 +310,7 @@ enum rtl_register_content {
         /* RxConfigBits */
         RxCfgFIFOShift  = 13,
         RxCfgDMAShift   =  8,
+        RxCfg9356SEL    =  6,           /* EEPROM type: 0 = 9346, 1 = 9356 */
 
         /* TxConfigBits */
         TxInterFrameGapShift = 24,
@@ -1963,6 +1969,108 @@ static const struct net_device_ops rtl8169_netdev_ops = {
 
 };
 
+/* Delay between EEPROM clock transitions. Force out buffered PCI writes. */
+#define RTL_EEPROM_DELAY()      RTL_R8(Cfg9346)
+#define RTL_EEPROM_READ_CMD     6
+
+/* read 16bit word stored in EEPROM. EEPROM is addressed by words. */
+static u16 rtl_eeprom_read(void __iomem *ioaddr, int addr)
+{
+        u16 result = 0;
+        int cmd, cmd_len, i;
+
+        /* check for EEPROM address size (in bits) */
+        if (RTL_R32(RxConfig) & (1 << RxCfg9356SEL)) {
+                /* EEPROM is 93C56 */
+                cmd_len = 3 + 8; /* 3 bits for command id and 8 for address */
+                cmd = (RTL_EEPROM_READ_CMD << 8) | (addr & 0xff);
+        } else {
+                /* EEPROM is 93C46 */
+                cmd_len = 3 + 6; /* 3 bits for command id and 6 for address */
+                cmd = (RTL_EEPROM_READ_CMD << 6) | (addr & 0x3f);
+        }
+
+        /* enter programming mode */
+        RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS);
+        RTL_EEPROM_DELAY();
+
+        /* write command and requested address */
+        while (cmd_len--) {
+                u8 x = Cfg9346_Program | Cfg9346_EECS;
+
+                x |= (cmd & (1 << cmd_len)) ? Cfg9346_EEDI : 0;
+
+                /* write a bit */
+                RTL_W8(Cfg9346, x);
+                RTL_EEPROM_DELAY();
+
+                /* raise clock */
+                RTL_W8(Cfg9346, x | Cfg9346_EESK);
+                RTL_EEPROM_DELAY();
+        }
+
+        /* lower clock */
+        RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS);
+        RTL_EEPROM_DELAY();
+
+        /* read back 16bit value */
+        for (i = 16; i > 0; i--) {
+                /* raise clock */
+                RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS | Cfg9346_EESK);
+                RTL_EEPROM_DELAY();
+
+                result <<= 1;
+                result |= (RTL_R8(Cfg9346) & Cfg9346_EEDO) ? 1 : 0;
+
+                /* lower clock */
+                RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS);
+                RTL_EEPROM_DELAY();
+        }
+
+        RTL_W8(Cfg9346, Cfg9346_Program);
+        /* leave programming mode */
+        RTL_W8(Cfg9346, Cfg9346_Lock);
+
+        return result;
+}
+
+static void rtl_init_mac_address(struct rtl8169_private *tp,
+                                 void __iomem *ioaddr)
+{
+        struct pci_dev *pdev = tp->pci_dev;
+        u16 x;
+        u8 mac[8];
+
+        /* read EEPROM signature */
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_SIG_ADDR);
+
+        if (x != RTL_EEPROM_SIG) {
+                dev_info(&pdev->dev, "Missing EEPROM signature: %04x\n", x);
+                return;
+        }
+
+        /* read MAC address */
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_MAC_ADDR);
+        mac[0] = x & 0xff;
+        mac[1] = x >> 8;
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_MAC_ADDR + 1);
+        mac[2] = x & 0xff;
+        mac[3] = x >> 8;
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_MAC_ADDR + 2);
+        mac[4] = x & 0xff;
+        mac[5] = x >> 8;
+
+        if (netif_msg_probe(tp)) {
+                DECLARE_MAC_BUF(buf);
+
+                dev_info(&pdev->dev, "MAC address found in EEPROM: %s\n",
+                         print_mac(buf, mac));
+        }
+
+        if (is_valid_ether_addr(mac))
+                rtl_rar_set(tp, mac);
+}
+
 static int __devinit
 rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
@@ -2141,6 +2249,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         tp->mmio_addr = ioaddr;
 
+        rtl_init_mac_address(tp, ioaddr);
+
         /* Get MAC address */
         for (i = 0; i < MAC_ADDR_LEN; i++)
                 dev->dev_addr[i] = RTL_R8(MAC0 + i);
diff --git a/drivers/net/smc911x.h b/drivers/net/smc911x.h
index 870b4c33f108..a45952e72018 100644
--- a/drivers/net/smc911x.h
+++ b/drivers/net/smc911x.h
@@ -42,6 +42,16 @@
   #define SMC_USE_16BIT         0
   #define SMC_USE_32BIT         1
   #define SMC_IRQ_SENSE         IRQF_TRIGGER_LOW
+#elif defined(CONFIG_ARCH_OMAP34XX)
+  #define SMC_USE_16BIT         0
+  #define SMC_USE_32BIT         1
+  #define SMC_IRQ_SENSE         IRQF_TRIGGER_LOW
+  #define SMC_MEM_RESERVED      1
+#elif defined(CONFIG_ARCH_OMAP24XX)
+  #define SMC_USE_16BIT         0
+  #define SMC_USE_32BIT         1
+  #define SMC_IRQ_SENSE         IRQF_TRIGGER_LOW
+  #define SMC_MEM_RESERVED      1
 #else
 /*
  * Default configuration
@@ -675,6 +685,7 @@ smc_pxa_dma_outsl(struct smc911x_local *lp, u_long physaddr,
 #define CHIP_9116       0x0116
 #define CHIP_9117       0x0117
 #define CHIP_9118       0x0118
+#define CHIP_9211       0x9211
 #define CHIP_9215       0x115A
 #define CHIP_9217       0x117A
 #define CHIP_9218       0x118A
@@ -689,6 +700,7 @@ static const struct chip_id chip_ids[] =  {
         { CHIP_9116, "LAN9116" },
         { CHIP_9117, "LAN9117" },
         { CHIP_9118, "LAN9118" },
+        { CHIP_9211, "LAN9211" },
         { CHIP_9215, "LAN9215" },
         { CHIP_9217, "LAN9217" },
         { CHIP_9218, "LAN9218" },
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 8d64b1da0465..0fcb7503363d 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -1229,7 +1229,7 @@ static void gem_reset(struct gem *gp)
                         break;
         } while (val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST));
 
-        if (limit <= 0)
+        if (limit < 0)
                 printk(KERN_ERR "%s: SW reset is ghetto.\n", gp->dev->name);
 
         if (gp->phy_type == phy_serialink || gp->phy_type == phy_serdes)
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index d4fb4acdbebd..4e9bd380a5c2 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -2649,8 +2649,6 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
         int err = -ENODEV;
 
         sbus_dp = to_of_device(op->dev.parent)->node;
-        if (is_qfe)
-                sbus_dp = to_of_device(op->dev.parent->parent)->node;
 
         /* We can match PCI devices too, do not accept those here. */
         if (strcmp(sbus_dp->name, "sbus"))
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index b080f9493d83..dabdf59f8016 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -1473,7 +1473,8 @@ static void tg3_phy_toggle_apd(struct tg3 *tp, bool enable)
 {
         u32 reg;
 
-        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS))
+        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS) ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
                 return;
 
         reg = MII_TG3_MISC_SHDW_WREN |
diff --git a/drivers/net/tokenring/tmspci.c b/drivers/net/tokenring/tmspci.c
index 5f601773c260..e2150b3c83d9 100644
--- a/drivers/net/tokenring/tmspci.c
+++ b/drivers/net/tokenring/tmspci.c
@@ -121,11 +121,6 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
                 goto err_out_trdev;
         }
 
-        ret = request_irq(pdev->irq, tms380tr_interrupt, IRQF_SHARED,
-                          dev->name, dev);
-        if (ret)
-                goto err_out_region;
-
         dev->base_addr  = pci_ioaddr;
         dev->irq        = pci_irq_line;
         dev->dma        = 0;
@@ -142,7 +137,7 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
         ret = tmsdev_init(dev, &pdev->dev);
         if (ret) {
                 printk("%s: unable to get memory for dev->priv.\n", dev->name);
-                goto err_out_irq;
+                goto err_out_region;
         }
 
         tp = netdev_priv(dev);
@@ -157,6 +152,11 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
 
         tp->tmspriv = cardinfo;
 
+        ret = request_irq(pdev->irq, tms380tr_interrupt, IRQF_SHARED,
+                          dev->name, dev);
+        if (ret)
+                goto err_out_tmsdev;
+
         dev->open = tms380tr_open;
         dev->stop = tms380tr_close;
         pci_set_drvdata(pdev, dev);
@@ -164,15 +164,15 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
 
         ret = register_netdev(dev);
         if (ret)
-                goto err_out_tmsdev;
+                goto err_out_irq;
         
         return 0;
 
+err_out_irq:
+        free_irq(pdev->irq, dev);
 err_out_tmsdev:
         pci_set_drvdata(pdev, NULL);
         tmsdev_term(dev);
-err_out_irq:
-        free_irq(pdev->irq, dev);
 err_out_region:
         release_region(pci_ioaddr, TMS_PCI_IO_EXTENT);
 err_out_trdev:
diff --git a/drivers/net/ucc_geth_mii.c b/drivers/net/ucc_geth_mii.c
index 54635911305c..0ada4edd56eb 100644
--- a/drivers/net/ucc_geth_mii.c
+++ b/drivers/net/ucc_geth_mii.c
@@ -107,7 +107,7 @@ int uec_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 static int uec_mdio_reset(struct mii_bus *bus)
 {
         struct ucc_mii_mng __iomem *regs = (void __iomem *)bus->priv;
-        unsigned int timeout = PHY_INIT_TIMEOUT;
+        int timeout = PHY_INIT_TIMEOUT;
 
         mutex_lock(&bus->mdio_lock);
 
@@ -123,7 +123,7 @@ static int uec_mdio_reset(struct mii_bus *bus)
 
         mutex_unlock(&bus->mdio_lock);
 
-        if (timeout <= 0) {
+        if (timeout < 0) {
                 printk(KERN_ERR "%s: The MII Bus is stuck!\n", bus->name);
                 return -EBUSY;
         }
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index e009481c606c..396f821b5ff0 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1451,6 +1451,14 @@ static const struct usb_device_id	products [] = {
         // Cables-to-Go USB Ethernet Adapter
         USB_DEVICE(0x0b95, 0x772a),
         .driver_info = (unsigned long) &ax88772_info,
+}, {
+        // ABOCOM for pci
+        USB_DEVICE(0x14ea, 0xab11),
+        .driver_info = (unsigned long) &ax88178_info,
+}, {
+        // ASIX 88772a
+        USB_DEVICE(0x0db0, 0xa877),
+        .driver_info = (unsigned long) &ax88772_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 0e061dfea78d..55e8ecc3a9e5 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -559,6 +559,11 @@ static const struct usb_device_id	products [] = {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
+}, {
+        /* Ericsson F3507g */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1900, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 5b67bbf1987e..81682c6defa0 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -635,6 +635,10 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0a47, 0x9601),     /* Hirose USB-100 */
         .driver_info = (unsigned long)&dm9601_info,
          },
+        {
+        USB_DEVICE(0x0fe6, 0x8101),     /* DM9601 USB to Fast Ethernet Adapter */
+        .driver_info = (unsigned long)&dm9601_info,
+         },
         {},                     // END
 };
 
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index aa3149078888..c32284ff3f54 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -723,8 +723,8 @@ u32 usbnet_get_link (struct net_device *net)
         if (dev->mii.mdio_read)
                 return mii_link_ok(&dev->mii);
 
-        /* Otherwise, say we're up (to avoid breaking scripts) */
-        return 1;
+        /* Otherwise, dtrt for drivers calling netif_carrier_{on,off} */
+        return ethtool_op_get_link(net);
 }
 EXPORT_SYMBOL_GPL(usbnet_get_link);
 
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index e24f7b3ace4b..04882c8f9bf1 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -341,6 +341,11 @@ static const struct usb_device_id	products [] = {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &bogus_mdlm_info,
+}, {
+        /* Motorola MOTOMAGX phones */
+        USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x6425, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
 },
 
 /* Olympus has some models with a Zaurus-compatible option.
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 108bbbeacfb6..124fe75b8a8a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -239,6 +239,16 @@ static int veth_open(struct net_device *dev)
         return 0;
 }
 
+static int veth_close(struct net_device *dev)
+{
+        struct veth_priv *priv = netdev_priv(dev);
+
+        netif_carrier_off(dev);
+        netif_carrier_off(priv->peer);
+
+        return 0;
+}
+
 static int veth_dev_init(struct net_device *dev)
 {
         struct veth_net_stats *stats;
@@ -265,6 +275,7 @@ static void veth_dev_free(struct net_device *dev)
 static const struct net_device_ops veth_netdev_ops = {
         .ndo_init            = veth_dev_init,
         .ndo_open            = veth_open,
+        .ndo_stop            = veth_close,
         .ndo_start_xmit      = veth_xmit,
         .ndo_get_stats       = veth_get_stats,
         .ndo_set_mac_address = eth_mac_addr,
@@ -280,44 +291,6 @@ static void veth_setup(struct net_device *dev)
         dev->destructor = veth_dev_free;
 }
 
-static void veth_change_state(struct net_device *dev)
-{
-        struct net_device *peer;
-        struct veth_priv *priv;
-
-        priv = netdev_priv(dev);
-        peer = priv->peer;
-
-        if (netif_carrier_ok(peer)) {
-                if (!netif_carrier_ok(dev))
-                        netif_carrier_on(dev);
-        } else {
-                if (netif_carrier_ok(dev))
-                        netif_carrier_off(dev);
-        }
-}
-
-static int veth_device_event(struct notifier_block *unused,
-                             unsigned long event, void *ptr)
-{
-        struct net_device *dev = ptr;
-
-        if (dev->netdev_ops->ndo_open != veth_open)
-                goto out;
-
-        switch (event) {
-        case NETDEV_CHANGE:
-                veth_change_state(dev);
-                break;
-        }
-out:
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block veth_notifier_block __read_mostly = {
-        .notifier_call  = veth_device_event,
-};
-
 /*
  * netlink interface
  */
@@ -468,14 +441,12 @@ static struct rtnl_link_ops veth_link_ops = {
 
 static __init int veth_init(void)
 {
-        register_netdevice_notifier(&veth_notifier_block);
         return rtnl_link_register(&veth_link_ops);
 }
 
 static __exit void veth_exit(void)
 {
         rtnl_link_unregister(&veth_link_ops);
-        unregister_netdevice_notifier(&veth_notifier_block);
 }
 
 module_init(veth_init);
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 727f067aca4f..0e80990d8e84 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -1538,6 +1538,7 @@ bad2:
 bad:
         if (ah)
                 ath9k_hw_detach(ah);
+        ath9k_exit_debug(sc);
 
         return error;
 }
@@ -1545,7 +1546,7 @@ bad:
 static int ath_attach(u16 devid, struct ath_softc *sc)
 {
         struct ieee80211_hw *hw = sc->hw;
-        int error = 0;
+        int error = 0, i;
 
         DPRINTF(sc, ATH_DBG_CONFIG, "Attach ATH hw\n");
 
@@ -1589,11 +1590,11 @@ static int ath_attach(u16 devid, struct ath_softc *sc)
         /* initialize tx/rx engine */
         error = ath_tx_init(sc, ATH_TXBUF);
         if (error != 0)
-                goto detach;
+                goto error_attach;
 
         error = ath_rx_init(sc, ATH_RXBUF);
         if (error != 0)
-                goto detach;
+                goto error_attach;
 
 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
         /* Initialze h/w Rfkill */
@@ -1601,8 +1602,9 @@ static int ath_attach(u16 devid, struct ath_softc *sc)
                 INIT_DELAYED_WORK(&sc->rf_kill.rfkill_poll, ath_rfkill_poll);
 
         /* Initialize s/w rfkill */
-        if (ath_init_sw_rfkill(sc))
-                goto detach;
+        error = ath_init_sw_rfkill(sc);
+        if (error)
+                goto error_attach;
 #endif
 
         error = ieee80211_register_hw(hw);
@@ -1611,8 +1613,16 @@ static int ath_attach(u16 devid, struct ath_softc *sc)
         ath_init_leds(sc);
 
         return 0;
-detach:
-        ath_detach(sc);
+
+error_attach:
+        /* cleanup tx queues */
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+                if (ATH_TXQ_SETUP(sc, i))
+                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
+
+        ath9k_hw_detach(sc->sc_ah);
+        ath9k_exit_debug(sc);
+
         return error;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 36bafeb353ce..129e2d330abb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3868,7 +3868,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
         err = iwl_eeprom_check_version(priv);
         if (err)
-                goto out_iounmap;
+                goto out_free_eeprom;
 
         /* extract MAC Address */
         iwl_eeprom_get_mac(priv, priv->mac_addr);
@@ -3945,6 +3945,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
  out_remove_sysfs:
+        destroy_workqueue(priv->workqueue);
+        priv->workqueue = NULL;
         sysfs_remove_group(&pdev->dev.kobj, &iwl_attribute_group);
  out_uninit_drv:
         iwl_uninit_drv(priv);
@@ -3953,8 +3955,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
  out_iounmap:
         pci_iounmap(pdev, priv->hw_base);
  out_pci_release_regions:
-        pci_release_regions(pdev);
         pci_set_drvdata(pdev, NULL);
+        pci_release_regions(pdev);
  out_pci_disable_device:
         pci_disable_device(pdev);
  out_ieee80211_free_hw:
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index b0ee86c62685..ab13ff22a8c0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -148,7 +148,7 @@ static void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
                 pci_unmap_single(dev,
                                 pci_unmap_addr(&txq->cmd[index]->meta, mapping),
                                 pci_unmap_len(&txq->cmd[index]->meta, len),
-                                PCI_DMA_TODEVICE);
+                                PCI_DMA_BIDIRECTIONAL);
 
         /* Unmap chunks, if any. */
         for (i = 1; i < num_tbs; i++) {
@@ -964,7 +964,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
          * within command buffer array. */
         txcmd_phys = pci_map_single(priv->pci_dev,
                                     out_cmd, sizeof(struct iwl_cmd),
-                                    PCI_DMA_TODEVICE);
+                                    PCI_DMA_BIDIRECTIONAL);
         pci_unmap_addr_set(&out_cmd->meta, mapping, txcmd_phys);
         pci_unmap_len_set(&out_cmd->meta, len, sizeof(struct iwl_cmd));
         /* Add buffer containing Tx command and MAC(!) header to TFD's
@@ -1115,7 +1115,7 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                         IWL_MAX_SCAN_SIZE : sizeof(struct iwl_cmd);
 
         phys_addr = pci_map_single(priv->pci_dev, out_cmd,
-                                   len, PCI_DMA_TODEVICE);
+                                   len, PCI_DMA_BIDIRECTIONAL);
         pci_unmap_addr_set(&out_cmd->meta, mapping, phys_addr);
         pci_unmap_len_set(&out_cmd->meta, len, len);
         phys_addr += offsetof(struct iwl_cmd, hdr);
@@ -1212,7 +1212,7 @@ static void iwl_hcmd_queue_reclaim(struct iwl_priv *priv, int txq_id,
         pci_unmap_single(priv->pci_dev,
                 pci_unmap_addr(&txq->cmd[cmd_idx]->meta, mapping),
                 pci_unmap_len(&txq->cmd[cmd_idx]->meta, len),
-                PCI_DMA_TODEVICE);
+                PCI_DMA_BIDIRECTIONAL);
 
         for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 93be74a1f139..57dd34e256d8 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -7911,7 +7911,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                                 CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
         if (err < 0) {
                 IWL_DEBUG_INFO("Failed to init the card\n");
-                goto out_remove_sysfs;
+                goto out_iounmap;
         }
 
         /***********************
@@ -7921,7 +7921,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         err = iwl3945_eeprom_init(priv);
         if (err) {
                 IWL_ERROR("Unable to init EEPROM\n");
-                goto out_remove_sysfs;
+                goto out_iounmap;
         }
         /* MAC Address location in EEPROM same for 3945/4965 */
         get_eeprom_mac(priv, priv->mac_addr);
@@ -7975,7 +7975,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         err = iwl3945_init_channel_map(priv);
         if (err) {
                 IWL_ERROR("initializing regulatory failed: %d\n", err);
-                goto out_release_irq;
+                goto out_unset_hw_setting;
         }
 
         err = iwl3945_init_geos(priv);
@@ -8045,25 +8045,22 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         return 0;
 
  out_remove_sysfs:
+        destroy_workqueue(priv->workqueue);
+        priv->workqueue = NULL;
         sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
  out_free_geos:
         iwl3945_free_geos(priv);
  out_free_channel_map:
         iwl3945_free_channel_map(priv);
-
-
- out_release_irq:
-        destroy_workqueue(priv->workqueue);
-        priv->workqueue = NULL;
+ out_unset_hw_setting:
         iwl3945_unset_hw_setting(priv);
-
  out_iounmap:
         pci_iounmap(pdev, priv->hw_base);
  out_pci_release_regions:
         pci_release_regions(pdev);
  out_pci_disable_device:
-        pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
+        pci_disable_device(pdev);
  out_ieee80211_free_hw:
         ieee80211_free_hw(priv->hw);
  out:
diff --git a/drivers/net/wireless/libertas/ethtool.c b/drivers/net/wireless/libertas/ethtool.c
index 61d2f50470c8..b118a35ec605 100644
--- a/drivers/net/wireless/libertas/ethtool.c
+++ b/drivers/net/wireless/libertas/ethtool.c
@@ -23,7 +23,7 @@ static const char * mesh_stat_strings[]= {
 static void lbs_ethtool_get_drvinfo(struct net_device *dev,
                                          struct ethtool_drvinfo *info)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         snprintf(info->fw_version, 32, "%u.%u.%u.p%u",
                 priv->fwrelease >> 24 & 0xff,
@@ -47,7 +47,7 @@ static int lbs_ethtool_get_eeprom_len(struct net_device *dev)
 static int lbs_ethtool_get_eeprom(struct net_device *dev,
                                   struct ethtool_eeprom *eeprom, u8 * bytes)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct cmd_ds_802_11_eeprom_access cmd;
         int ret;
 
@@ -76,7 +76,7 @@ out:
 static void lbs_ethtool_get_stats(struct net_device *dev,
                                   struct ethtool_stats *stats, uint64_t *data)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
 
@@ -113,7 +113,7 @@ static void lbs_ethtool_get_stats(struct net_device *dev,
 
 static int lbs_ethtool_get_sset_count(struct net_device *dev, int sset)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         if (sset == ETH_SS_STATS && dev == priv->mesh_dev)
                 return MESH_STATS_NUM;
@@ -143,7 +143,7 @@ static void lbs_ethtool_get_strings(struct net_device *dev,
 static void lbs_ethtool_get_wol(struct net_device *dev,
                                 struct ethtool_wolinfo *wol)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         if (priv->wol_criteria == 0xffffffff) {
                 /* Interface driver didn't configure wake */
@@ -166,7 +166,7 @@ static void lbs_ethtool_get_wol(struct net_device *dev,
 static int lbs_ethtool_set_wol(struct net_device *dev,
                                struct ethtool_wolinfo *wol)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         uint32_t criteria = 0;
 
         if (priv->wol_criteria == 0xffffffff && wol->wolopts)
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index 2fc637ad85c7..ea3dc038be76 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -59,7 +59,7 @@ static int if_usb_reset_device(struct if_usb_card *cardp);
 static ssize_t if_usb_firmware_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct if_usb_card *cardp = priv->card;
         char fwname[FIRMWARE_NAME_MAX];
         int ret;
@@ -86,7 +86,7 @@ static DEVICE_ATTR(lbs_flash_fw, 0200, NULL, if_usb_firmware_set);
 static ssize_t if_usb_boot2_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct if_usb_card *cardp = priv->card;
         char fwname[FIRMWARE_NAME_MAX];
         int ret;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 4e0007d20030..f76623e0ff9a 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -222,7 +222,7 @@ u8 lbs_data_rate_to_fw_index(u32 rate)
 static ssize_t lbs_anycast_get(struct device *dev,
                 struct device_attribute *attr, char * buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
 
@@ -241,7 +241,7 @@ static ssize_t lbs_anycast_get(struct device *dev,
 static ssize_t lbs_anycast_set(struct device *dev,
                 struct device_attribute *attr, const char * buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         uint32_t datum;
         int ret;
@@ -263,7 +263,7 @@ static ssize_t lbs_anycast_set(struct device *dev,
 static ssize_t lbs_prb_rsp_limit_get(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
         u32 retry_limit;
@@ -286,7 +286,7 @@ static ssize_t lbs_prb_rsp_limit_get(struct device *dev,
 static ssize_t lbs_prb_rsp_limit_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
         unsigned long retry_limit;
@@ -321,7 +321,7 @@ static void lbs_remove_mesh(struct lbs_private *priv);
 static ssize_t lbs_rtap_get(struct device *dev,
                 struct device_attribute *attr, char * buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         return snprintf(buf, 5, "0x%X\n", priv->monitormode);
 }
 
@@ -332,7 +332,7 @@ static ssize_t lbs_rtap_set(struct device *dev,
                 struct device_attribute *attr, const char * buf, size_t count)
 {
         int monitor_mode;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
 
         sscanf(buf, "%x", &monitor_mode);
         if (monitor_mode) {
@@ -383,7 +383,7 @@ static DEVICE_ATTR(lbs_rtap, 0644, lbs_rtap_get, lbs_rtap_set );
 static ssize_t lbs_mesh_get(struct device *dev,
                 struct device_attribute *attr, char * buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         return snprintf(buf, 5, "0x%X\n", !!priv->mesh_dev);
 }
 
@@ -393,7 +393,7 @@ static ssize_t lbs_mesh_get(struct device *dev,
 static ssize_t lbs_mesh_set(struct device *dev,
                 struct device_attribute *attr, const char * buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         int enable;
         int ret, action = CMD_ACT_MESH_CONFIG_STOP;
 
@@ -452,7 +452,7 @@ static struct attribute_group lbs_mesh_attr_group = {
  */
 static int lbs_dev_open(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev) ;
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_NET);
@@ -521,7 +521,7 @@ static int lbs_mesh_stop(struct net_device *dev)
  */
 static int lbs_eth_stop(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_NET);
 
@@ -538,7 +538,7 @@ static int lbs_eth_stop(struct net_device *dev)
 
 static void lbs_tx_timeout(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_TX);
 
@@ -590,7 +590,7 @@ EXPORT_SYMBOL_GPL(lbs_host_to_card_done);
  */
 static struct net_device_stats *lbs_get_stats(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_NET);
         return &priv->stats;
@@ -599,7 +599,7 @@ static struct net_device_stats *lbs_get_stats(struct net_device *dev)
 static int lbs_set_mac_address(struct net_device *dev, void *addr)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct sockaddr *phwaddr = addr;
         struct cmd_ds_802_11_mac_address cmd;
 
@@ -732,7 +732,7 @@ static void lbs_set_mcast_worker(struct work_struct *work)
 
 static void lbs_set_multicast_list(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         schedule_work(&priv->mcast_work);
 }
@@ -748,7 +748,7 @@ static void lbs_set_multicast_list(struct net_device *dev)
 static int lbs_thread(void *data)
 {
         struct net_device *dev = data;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         wait_queue_t wait;
 
         lbs_deb_enter(LBS_DEB_THREAD);
@@ -1184,6 +1184,7 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
                 goto done;
         }
         priv = netdev_priv(dev);
+        dev->ml_priv = priv;
 
         if (lbs_init_adapter(priv)) {
                 lbs_pr_err("failed to initialize adapter structure.\n");
diff --git a/drivers/net/wireless/libertas/persistcfg.c b/drivers/net/wireless/libertas/persistcfg.c
index d42b7a5a1b3f..18fe29faf99b 100644
--- a/drivers/net/wireless/libertas/persistcfg.c
+++ b/drivers/net/wireless/libertas/persistcfg.c
@@ -18,7 +18,7 @@
 static int mesh_get_default_parameters(struct device *dev,
                                        struct mrvl_mesh_defaults *defs)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         int ret;
 
@@ -57,7 +57,7 @@ static ssize_t bootflag_get(struct device *dev,
 static ssize_t bootflag_set(struct device *dev, struct device_attribute *attr,
                             const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         uint32_t datum;
         int ret;
@@ -100,7 +100,7 @@ static ssize_t boottime_get(struct device *dev,
 static ssize_t boottime_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         uint32_t datum;
         int ret;
@@ -152,7 +152,7 @@ static ssize_t channel_get(struct device *dev,
 static ssize_t channel_set(struct device *dev, struct device_attribute *attr,
                            const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         uint32_t datum;
         int ret;
@@ -210,7 +210,7 @@ static ssize_t mesh_id_set(struct device *dev, struct device_attribute *attr,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         int len;
         int ret;
 
@@ -269,7 +269,7 @@ static ssize_t protocol_id_set(struct device *dev,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         uint32_t datum;
         int ret;
 
@@ -323,7 +323,7 @@ static ssize_t metric_id_set(struct device *dev, struct device_attribute *attr,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         uint32_t datum;
         int ret;
 
@@ -377,7 +377,7 @@ static ssize_t capability_set(struct device *dev, struct device_attribute *attr,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         uint32_t datum;
         int ret;
 
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 57f6c12cda20..9014950f4328 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -945,7 +945,7 @@ int lbs_set_scan(struct net_device *dev, struct iw_request_info *info,
                  union iwreq_data *wrqu, char *extra)
 {
         DECLARE_SSID_BUF(ssid);
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1008,7 +1008,7 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
                  struct iw_point *dwrq, char *extra)
 {
 #define SCAN_ITEM_SIZE 128
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int err = 0;
         char *ev = extra;
         char *stop = ev + dwrq->length;
diff --git a/drivers/net/wireless/libertas/tx.c b/drivers/net/wireless/libertas/tx.c
index dac462641170..68bec31ae03b 100644
--- a/drivers/net/wireless/libertas/tx.c
+++ b/drivers/net/wireless/libertas/tx.c
@@ -60,7 +60,7 @@ static u32 convert_radiotap_rate_to_mv(u8 rate)
 int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         unsigned long flags;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct txpd *txpd;
         char *p802x_hdr;
         uint16_t pkt_len;
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index c6102e08179e..f16d136ab4bb 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -163,7 +163,7 @@ static int lbs_get_name(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_freq(struct net_device *dev, struct iw_request_info *info,
                          struct iw_freq *fwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct chan_freq_power *cfp;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -189,7 +189,7 @@ static int lbs_get_freq(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_wap(struct net_device *dev, struct iw_request_info *info,
                         struct sockaddr *awrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -207,7 +207,7 @@ static int lbs_get_wap(struct net_device *dev, struct iw_request_info *info,
 static int lbs_set_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -231,7 +231,7 @@ static int lbs_set_nick(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -248,7 +248,7 @@ static int lbs_get_nick(struct net_device *dev, struct iw_request_info *info,
 static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -273,7 +273,7 @@ static int lbs_set_rts(struct net_device *dev, struct iw_request_info *info,
                         struct iw_param *vwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         u32 val = vwrq->value;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -293,7 +293,7 @@ static int lbs_set_rts(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_rts(struct net_device *dev, struct iw_request_info *info,
                         struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 val = 0;
 
@@ -315,7 +315,7 @@ out:
 static int lbs_set_frag(struct net_device *dev, struct iw_request_info *info,
                          struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u32 val = vwrq->value;
 
@@ -336,7 +336,7 @@ static int lbs_set_frag(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_frag(struct net_device *dev, struct iw_request_info *info,
                          struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 val = 0;
 
@@ -359,7 +359,7 @@ out:
 static int lbs_get_mode(struct net_device *dev,
                          struct iw_request_info *info, u32 * uwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -385,7 +385,7 @@ static int lbs_get_txpow(struct net_device *dev,
                           struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         s16 curlevel = 0;
         int ret = 0;
 
@@ -418,7 +418,7 @@ out:
 static int lbs_set_retry(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 slimit = 0, llimit = 0;
 
@@ -466,7 +466,7 @@ out:
 static int lbs_get_retry(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 val = 0;
 
@@ -542,7 +542,7 @@ static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
                           struct iw_point *dwrq, char *extra)
 {
         int i, j;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct iw_range *range = (struct iw_range *)extra;
         struct chan_freq_power *cfp;
         u8 rates[MAX_RATES + 1];
@@ -708,7 +708,7 @@ out:
 static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -758,7 +758,7 @@ static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_power(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -781,7 +781,7 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
                 EXCELLENT = 95,
                 PERFECT = 100
         };
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         u32 rssi_qual;
         u32 tx_qual;
         u32 quality = 0;
@@ -886,7 +886,7 @@ static int lbs_set_freq(struct net_device *dev, struct iw_request_info *info,
                   struct iw_freq *fwrq, char *extra)
 {
         int ret = -EINVAL;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct chan_freq_power *cfp;
         struct assoc_request * assoc_req;
 
@@ -943,7 +943,7 @@ static int lbs_mesh_set_freq(struct net_device *dev,
                              struct iw_request_info *info,
                              struct iw_freq *fwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct chan_freq_power *cfp;
         int ret = -EINVAL;
 
@@ -994,7 +994,7 @@ out:
 static int lbs_set_rate(struct net_device *dev, struct iw_request_info *info,
                   struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         u8 new_rate = 0;
         int ret = -EINVAL;
         u8 rates[MAX_RATES + 1];
@@ -1054,7 +1054,7 @@ out:
 static int lbs_get_rate(struct net_device *dev, struct iw_request_info *info,
                   struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1079,7 +1079,7 @@ static int lbs_set_mode(struct net_device *dev,
                   struct iw_request_info *info, u32 * uwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1124,7 +1124,7 @@ static int lbs_get_encode(struct net_device *dev,
                            struct iw_request_info *info,
                            struct iw_point *dwrq, u8 * extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1319,7 +1319,7 @@ static int lbs_set_encode(struct net_device *dev,
                     struct iw_point *dwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
         u16 is_default = 0, index = 0, set_tx_key = 0;
 
@@ -1395,7 +1395,7 @@ static int lbs_get_encodeext(struct net_device *dev,
                               char *extra)
 {
         int ret = -EINVAL;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
         int index, max_key_len;
 
@@ -1501,7 +1501,7 @@ static int lbs_set_encodeext(struct net_device *dev,
                               char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
         int alg = ext->alg;
         struct assoc_request * assoc_req;
@@ -1639,7 +1639,7 @@ static int lbs_set_genie(struct net_device *dev,
                           struct iw_point *dwrq,
                           char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         struct assoc_request * assoc_req;
 
@@ -1685,7 +1685,7 @@ static int lbs_get_genie(struct net_device *dev,
                           char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1713,7 +1713,7 @@ static int lbs_set_auth(struct net_device *dev,
                          struct iw_param *dwrq,
                          char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
         int ret = 0;
         int updated = 0;
@@ -1816,7 +1816,7 @@ static int lbs_get_auth(struct net_device *dev,
                          char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1857,7 +1857,7 @@ static int lbs_set_txpow(struct net_device *dev, struct iw_request_info *info,
                    struct iw_param *vwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         s16 dbm = (s16) vwrq->value;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1936,7 +1936,7 @@ out:
 static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
                    struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1971,7 +1971,7 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
 static int lbs_set_essid(struct net_device *dev, struct iw_request_info *info,
                    struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u8 ssid[IW_ESSID_MAX_SIZE];
         u8 ssid_len = 0;
@@ -2040,7 +2040,7 @@ static int lbs_mesh_get_essid(struct net_device *dev,
                               struct iw_request_info *info,
                               struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -2058,7 +2058,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
                               struct iw_request_info *info,
                               struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -2102,7 +2102,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
 static int lbs_set_wap(struct net_device *dev, struct iw_request_info *info,
                  struct sockaddr *awrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
         int ret = 0;
 
diff --git a/drivers/net/wireless/orinoco/orinoco.c b/drivers/net/wireless/orinoco/orinoco.c
index 45a04faa7818..067d1a9c728b 100644
--- a/drivers/net/wireless/orinoco/orinoco.c
+++ b/drivers/net/wireless/orinoco/orinoco.c
@@ -3157,8 +3157,20 @@ static int orinoco_pm_notifier(struct notifier_block *notifier,
 
         return NOTIFY_DONE;
 }
+
+static void orinoco_register_pm_notifier(struct orinoco_private *priv)
+{
+        priv->pm_notifier.notifier_call = orinoco_pm_notifier;
+        register_pm_notifier(&priv->pm_notifier);
+}
+
+static void orinoco_unregister_pm_notifier(struct orinoco_private *priv)
+{
+        unregister_pm_notifier(&priv->pm_notifier);
+}
 #else /* !PM_SLEEP || HERMES_CACHE_FW_ON_INIT */
-#define orinoco_pm_notifier NULL
+#define orinoco_register_pm_notifier(priv) do { } while(0)
+#define orinoco_unregister_pm_notifier(priv) do { } while(0)
 #endif
 
 /********************************************************************/
@@ -3648,8 +3660,7 @@ struct net_device
         priv->cached_fw = NULL;
 
         /* Register PM notifiers */
-        priv->pm_notifier.notifier_call = orinoco_pm_notifier;
-        register_pm_notifier(&priv->pm_notifier);
+        orinoco_register_pm_notifier(priv);
 
         return dev;
 }
@@ -3673,7 +3684,7 @@ void free_orinocodev(struct net_device *dev)
                 kfree(rx_data);
         }
 
-        unregister_pm_notifier(&priv->pm_notifier);
+        orinoco_unregister_pm_notifier(priv);
         orinoco_uncache_fw(priv);
 
         priv->wpa_ie_len = 0;
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 34561e6e816b..f170106bf0ae 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -710,10 +710,11 @@ static struct sk_buff *p54_find_tx_entry(struct ieee80211_hw *dev,
                                            __le32 req_id)
 {
         struct p54_common *priv = dev->priv;
-        struct sk_buff *entry = priv->tx_queue.next;
+        struct sk_buff *entry;
         unsigned long flags;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
+        entry = priv->tx_queue.next;
         while (entry != (struct sk_buff *)&priv->tx_queue) {
                 struct p54_hdr *hdr = (struct p54_hdr *) entry->data;
 
@@ -732,7 +733,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct p54_common *priv = dev->priv;
         struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
         struct p54_frame_sent *payload = (struct p54_frame_sent *) hdr->data;
-        struct sk_buff *entry = (struct sk_buff *) priv->tx_queue.next;
+        struct sk_buff *entry;
         u32 addr = le32_to_cpu(hdr->req_id) - priv->headroom;
         struct memrecord *range = NULL;
         u32 freed = 0;
@@ -741,6 +742,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         int count, idx;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
+        entry = (struct sk_buff *) priv->tx_queue.next;
         while (entry != (struct sk_buff *)&priv->tx_queue) {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
                 struct p54_hdr *entry_hdr;
@@ -976,7 +978,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
                                struct p54_hdr *data, u32 len)
 {
         struct p54_common *priv = dev->priv;
-        struct sk_buff *entry = priv->tx_queue.next;
+        struct sk_buff *entry;
         struct sk_buff *target_skb = NULL;
         struct ieee80211_tx_info *info;
         struct memrecord *range;
@@ -1014,6 +1016,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
                 }
         }
 
+        entry = priv->tx_queue.next;
         while (left--) {
                 u32 hole_size;
                 info = IEEE80211_SKB_CB(entry);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index af6b5847be5c..3e2ac2bbb12f 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1952,6 +1952,8 @@ static struct usb_device_id rt2500usb_device_table[] = {
         { USB_DEVICE(0x13b1, 0x000d), USB_DEVICE_DATA(&rt2500usb_ops) },
         { USB_DEVICE(0x13b1, 0x0011), USB_DEVICE_DATA(&rt2500usb_ops) },
         { USB_DEVICE(0x13b1, 0x001a), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* CNet */
+        { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Conceptronic */
         { USB_DEVICE(0x14b2, 0x3c02), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* D-LINK */
@@ -1976,14 +1978,20 @@ static struct usb_device_id rt2500usb_device_table[] = {
         { USB_DEVICE(0x148f, 0x2570), USB_DEVICE_DATA(&rt2500usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt2500usb_ops) },
         { USB_DEVICE(0x148f, 0x9020), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* Sagem */
+        { USB_DEVICE(0x079b, 0x004b), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Siemens */
         { USB_DEVICE(0x0681, 0x3c06), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* SMC */
         { USB_DEVICE(0x0707, 0xee13), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Spairon */
         { USB_DEVICE(0x114b, 0x0110), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* SURECOM */
+        { USB_DEVICE(0x0769, 0x11f3), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Trust */
         { USB_DEVICE(0x0eb0, 0x9020), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* VTech */
+        { USB_DEVICE(0x0f88, 0x3012), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Zinwell */
         { USB_DEVICE(0x5a57, 0x0260), USB_DEVICE_DATA(&rt2500usb_ops) },
         { 0, }
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 96a8d69f8790..cefee1b26cd8 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2281,7 +2281,18 @@ static const struct rt2x00_ops rt73usb_ops = {
  */
 static struct usb_device_id rt73usb_device_table[] = {
         /* AboCom */
+        { USB_DEVICE(0x07b8, 0xb21b), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07b8, 0xb21c), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x07b8, 0xb21d), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07b8, 0xb21e), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07b8, 0xb21f), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* AL */
+        { USB_DEVICE(0x14b2, 0x3c10), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Amigo */
+        { USB_DEVICE(0x148f, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0eb0, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* AMIT  */
+        { USB_DEVICE(0x18c5, 0x0002), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Askey */
         { USB_DEVICE(0x1690, 0x0722), USB_DEVICE_DATA(&rt73usb_ops) },
         /* ASUS */
@@ -2294,7 +2305,9 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x050d, 0x905c), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Billionton */
         { USB_DEVICE(0x1631, 0xc019), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x08dd, 0x0120), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Buffalo */
+        { USB_DEVICE(0x0411, 0x00d8), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
         /* CNet */
         { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt73usb_ops) },
@@ -2308,6 +2321,11 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c04), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c06), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c07), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Edimax */
+        { USB_DEVICE(0x7392, 0x7318), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x7392, 0x7618), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* EnGenius */
+        { USB_DEVICE(0x1740, 0x3701), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Gemtek */
         { USB_DEVICE(0x15a9, 0x0004), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Gigabyte */
@@ -2328,22 +2346,34 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x0db0, 0xa861), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0db0, 0xa874), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Ralink */
+        { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Qcom */
         { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x18e8, 0x6238), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Samsung */
+        { USB_DEVICE(0x04e8, 0x4471), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Senao */
         { USB_DEVICE(0x1740, 0x7100), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Sitecom */
-        { USB_DEVICE(0x0df6, 0x9712), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0024), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0027), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x002f), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0df6, 0x90ac), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x9712), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Surecom */
         { USB_DEVICE(0x0769, 0x31f3), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Philips */
+        { USB_DEVICE(0x0471, 0x200a), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Planex */
         { USB_DEVICE(0x2019, 0xab01), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x2019, 0xab50), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Zcom */
+        { USB_DEVICE(0x0cde, 0x001c), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* ZyXEL */
+        { USB_DEVICE(0x0586, 0x3415), USB_DEVICE_DATA(&rt73usb_ops) },
         { 0, }
 };
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 22bc07ef2f37..f4747a1134ba 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -48,6 +48,10 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         {USB_DEVICE(0x0bda, 0x8189), .driver_info = DEVICE_RTL8187B},
         {USB_DEVICE(0x0bda, 0x8197), .driver_info = DEVICE_RTL8187B},
         {USB_DEVICE(0x0bda, 0x8198), .driver_info = DEVICE_RTL8187B},
+        /* Surecom */
+        {USB_DEVICE(0x0769, 0x11F2), .driver_info = DEVICE_RTL8187},
+        /* Logitech */
+        {USB_DEVICE(0x0789, 0x010C), .driver_info = DEVICE_RTL8187},
         /* Netgear */
         {USB_DEVICE(0x0846, 0x6100), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0846, 0x6a00), .driver_info = DEVICE_RTL8187},
@@ -57,8 +61,16 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+        /* Sphairon Access Systems GmbH */
+        {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
+        /* Dick Smith Electronics */
+        {USB_DEVICE(0x1371, 0x9401), .driver_info = DEVICE_RTL8187},
         /* Abocom */
         {USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187},
+        /* Qcom */
+        {USB_DEVICE(0x18E8, 0x6232), .driver_info = DEVICE_RTL8187},
+        /* AirLive */
+        {USB_DEVICE(0x1b75, 0x8187), .driver_info = DEVICE_RTL8187},
         {}
 };
 
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
index f5a662a50acb..26c536b51c5a 100644
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -330,6 +330,14 @@ parse_dmar_table(void)
         entry_header = (struct acpi_dmar_header *)(dmar + 1);
         while (((unsigned long)entry_header) <
                         (((unsigned long)dmar) + dmar_tbl->length)) {
+                /* Avoid looping forever on bad ACPI tables */
+                if (entry_header->length == 0) {
+                        printk(KERN_WARNING PREFIX
+                                "Invalid 0-length structure\n");
+                        ret = -EINVAL;
+                        break;
+                }
+
                 dmar_table_print_dmar_entry(entry_header);
 
                 switch (entry_header->type) {
@@ -491,7 +499,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
         int map_size;
         u32 ver;
         static int iommu_allocated = 0;
-        int agaw;
+        int agaw = 0;
 
         iommu = kzalloc(sizeof(*iommu), GFP_KERNEL);
         if (!iommu)
@@ -507,6 +515,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
         iommu->cap = dmar_readq(iommu->reg + DMAR_CAP_REG);
         iommu->ecap = dmar_readq(iommu->reg + DMAR_ECAP_REG);
 
+#ifdef CONFIG_DMAR
         agaw = iommu_calculate_agaw(iommu);
         if (agaw < 0) {
                 printk(KERN_ERR
@@ -514,6 +523,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
                         iommu->seq_id);
                 goto error;
         }
+#endif
         iommu->agaw = agaw;
 
         /* the registers might be more than one page */
@@ -571,19 +581,49 @@ static inline void reclaim_free_desc(struct q_inval *qi)
         }
 }
 
+static int qi_check_fault(struct intel_iommu *iommu, int index)
+{
+        u32 fault;
+        int head;
+        struct q_inval *qi = iommu->qi;
+        int wait_index = (index + 1) % QI_LENGTH;
+
+        fault = readl(iommu->reg + DMAR_FSTS_REG);
+
+        /*
+         * If IQE happens, the head points to the descriptor associated
+         * with the error. No new descriptors are fetched until the IQE
+         * is cleared.
+         */
+        if (fault & DMA_FSTS_IQE) {
+                head = readl(iommu->reg + DMAR_IQH_REG);
+                if ((head >> 4) == index) {
+                        memcpy(&qi->desc[index], &qi->desc[wait_index],
+                                        sizeof(struct qi_desc));
+                        __iommu_flush_cache(iommu, &qi->desc[index],
+                                        sizeof(struct qi_desc));
+                        writel(DMA_FSTS_IQE, iommu->reg + DMAR_FSTS_REG);
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
 /*
  * Submit the queued invalidation descriptor to the remapping
  * hardware unit and wait for its completion.
  */
-void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
+int qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
 {
+        int rc = 0;
         struct q_inval *qi = iommu->qi;
         struct qi_desc *hw, wait_desc;
         int wait_index, index;
         unsigned long flags;
 
         if (!qi)
-                return;
+                return 0;
 
         hw = qi->desc;
 
@@ -601,7 +641,8 @@ void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
 
         hw[index] = *desc;
 
-        wait_desc.low = QI_IWD_STATUS_DATA(2) | QI_IWD_STATUS_WRITE | QI_IWD_TYPE;
+        wait_desc.low = QI_IWD_STATUS_DATA(QI_DONE) |
+                        QI_IWD_STATUS_WRITE | QI_IWD_TYPE;
         wait_desc.high = virt_to_phys(&qi->desc_status[wait_index]);
 
         hw[wait_index] = wait_desc;
@@ -612,13 +653,11 @@ void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
         qi->free_head = (qi->free_head + 2) % QI_LENGTH;
         qi->free_cnt -= 2;
 
-        spin_lock(&iommu->register_lock);
         /*
          * update the HW tail register indicating the presence of
          * new descriptors.
          */
         writel(qi->free_head << 4, iommu->reg + DMAR_IQT_REG);
-        spin_unlock(&iommu->register_lock);
 
         while (qi->desc_status[wait_index] != QI_DONE) {
                 /*
@@ -628,15 +667,21 @@ void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
                  * a deadlock where the interrupt context can wait indefinitely
                  * for free slots in the queue.
                  */
+                rc = qi_check_fault(iommu, index);
+                if (rc)
+                        goto out;
+
                 spin_unlock(&qi->q_lock);
                 cpu_relax();
                 spin_lock(&qi->q_lock);
         }
-
-        qi->desc_status[index] = QI_DONE;
+out:
+        qi->desc_status[index] = qi->desc_status[wait_index] = QI_DONE;
 
         reclaim_free_desc(qi);
         spin_unlock_irqrestore(&qi->q_lock, flags);
+
+        return rc;
 }
 
 /*
@@ -649,13 +694,13 @@ void qi_global_iec(struct intel_iommu *iommu)
         desc.low = QI_IEC_TYPE;
         desc.high = 0;
 
+        /* should never fail */
         qi_submit_sync(&desc, iommu);
 }
 
 int qi_flush_context(struct intel_iommu *iommu, u16 did, u16 sid, u8 fm,
                      u64 type, int non_present_entry_flush)
 {
-
         struct qi_desc desc;
 
         if (non_present_entry_flush) {
@@ -669,10 +714,7 @@ int qi_flush_context(struct intel_iommu *iommu, u16 did, u16 sid, u8 fm,
                         | QI_CC_GRAN(type) | QI_CC_TYPE;
         desc.high = 0;
 
-        qi_submit_sync(&desc, iommu);
-
-        return 0;
-
+        return qi_submit_sync(&desc, iommu);
 }
 
 int qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
@@ -702,10 +744,7 @@ int qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
         desc.high = QI_IOTLB_ADDR(addr) | QI_IOTLB_IH(ih)
                 | QI_IOTLB_AM(size_order);
 
-        qi_submit_sync(&desc, iommu);
-
-        return 0;
-
+        return qi_submit_sync(&desc, iommu);
 }
 
 /*
diff --git a/drivers/pci/hotplug/Kconfig b/drivers/pci/hotplug/Kconfig
index eacfb13998bb..9aa4fe100a0d 100644
--- a/drivers/pci/hotplug/Kconfig
+++ b/drivers/pci/hotplug/Kconfig
@@ -143,7 +143,7 @@ config HOTPLUG_PCI_SHPC
 
 config HOTPLUG_PCI_RPA
         tristate "RPA PCI Hotplug driver"
-        depends on PPC_PSERIES && PPC64 && !HOTPLUG_PCI_FAKE
+        depends on PPC_PSERIES && EEH && !HOTPLUG_PCI_FAKE
         help
           Say Y here if you have a RPA system that supports PCI Hotplug.
 
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index db85284ffb62..39ae37589fda 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -111,6 +111,7 @@ struct controller {
         int cmd_busy;
         unsigned int no_cmd_complete:1;
         unsigned int link_active_reporting:1;
+        unsigned int notification_enabled:1;
 };
 
 #define INT_BUTTON_IGNORE               0
@@ -170,6 +171,7 @@ extern int pciehp_configure_device(struct slot *p_slot);
 extern int pciehp_unconfigure_device(struct slot *p_slot);
 extern void pciehp_queue_pushbutton_work(struct work_struct *work);
 struct controller *pcie_init(struct pcie_device *dev);
+int pcie_init_notification(struct controller *ctrl);
 int pciehp_enable_slot(struct slot *p_slot);
 int pciehp_disable_slot(struct slot *p_slot);
 int pcie_enable_notification(struct controller *ctrl);
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index c2485542f543..681e3912b821 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -434,6 +434,13 @@ static int pciehp_probe(struct pcie_device *dev, const struct pcie_port_service_
                 goto err_out_release_ctlr;
         }
 
+        /* Enable events after we have setup the data structures */
+        rc = pcie_init_notification(ctrl);
+        if (rc) {
+                ctrl_err(ctrl, "Notification initialization failed\n");
+                goto err_out_release_ctlr;
+        }
+
         /* Check if slot is occupied */
         t_slot = pciehp_find_slot(ctrl, ctrl->slot_device_offset);
         t_slot->hpc_ops->get_adapter_status(t_slot, &value);
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 71a8012886b0..7a16c6897bb9 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -934,7 +934,7 @@ static void pcie_disable_notification(struct controller *ctrl)
                 ctrl_warn(ctrl, "Cannot disable software notification\n");
 }
 
-static int pcie_init_notification(struct controller *ctrl)
+int pcie_init_notification(struct controller *ctrl)
 {
         if (pciehp_request_irq(ctrl))
                 return -1;
@@ -942,13 +942,17 @@ static int pcie_init_notification(struct controller *ctrl)
                 pciehp_free_irq(ctrl);
                 return -1;
         }
+        ctrl->notification_enabled = 1;
         return 0;
 }
 
 static void pcie_shutdown_notification(struct controller *ctrl)
 {
-        pcie_disable_notification(ctrl);
-        pciehp_free_irq(ctrl);
+        if (ctrl->notification_enabled) {
+                pcie_disable_notification(ctrl);
+                pciehp_free_irq(ctrl);
+                ctrl->notification_enabled = 0;
+        }
 }
 
 static int pcie_init_slot(struct controller *ctrl)
@@ -1110,13 +1114,8 @@ struct controller *pcie_init(struct pcie_device *dev)
         if (pcie_init_slot(ctrl))
                 goto abort_ctrl;
 
-        if (pcie_init_notification(ctrl))
-                goto abort_slot;
-
         return ctrl;
 
-abort_slot:
-        pcie_cleanup_slot(ctrl);
 abort_ctrl:
         kfree(ctrl);
 abort:
diff --git a/drivers/pci/intr_remapping.c b/drivers/pci/intr_remapping.c
index f78371b22529..45effc5726c0 100644
--- a/drivers/pci/intr_remapping.c
+++ b/drivers/pci/intr_remapping.c
@@ -207,7 +207,7 @@ int alloc_irte(struct intel_iommu *iommu, int irq, u16 count)
         return index;
 }
 
-static void qi_flush_iec(struct intel_iommu *iommu, int index, int mask)
+static int qi_flush_iec(struct intel_iommu *iommu, int index, int mask)
 {
         struct qi_desc desc;
 
@@ -215,7 +215,7 @@ static void qi_flush_iec(struct intel_iommu *iommu, int index, int mask)
                    | QI_IEC_SELECTIVE;
         desc.high = 0;
 
-        qi_submit_sync(&desc, iommu);
+        return qi_submit_sync(&desc, iommu);
 }
 
 int map_irq_to_irte_handle(int irq, u16 *sub_handle)
@@ -283,6 +283,7 @@ int clear_irte_irq(int irq, struct intel_iommu *iommu, u16 index)
 
 int modify_irte(int irq, struct irte *irte_modified)
 {
+        int rc;
         int index;
         struct irte *irte;
         struct intel_iommu *iommu;
@@ -303,14 +304,15 @@ int modify_irte(int irq, struct irte *irte_modified)
         set_64bit((unsigned long *)irte, irte_modified->low | (1 << 1));
         __iommu_flush_cache(iommu, irte, sizeof(*irte));
 
-        qi_flush_iec(iommu, index, 0);
-
+        rc = qi_flush_iec(iommu, index, 0);
         spin_unlock(&irq_2_ir_lock);
-        return 0;
+
+        return rc;
 }
 
 int flush_irte(int irq)
 {
+        int rc;
         int index;
         struct intel_iommu *iommu;
         struct irq_2_iommu *irq_iommu;
@@ -326,10 +328,10 @@ int flush_irte(int irq)
 
         index = irq_iommu->irte_index + irq_iommu->sub_handle;
 
-        qi_flush_iec(iommu, index, irq_iommu->irte_mask);
+        rc = qi_flush_iec(iommu, index, irq_iommu->irte_mask);
         spin_unlock(&irq_2_ir_lock);
 
-        return 0;
+        return rc;
 }
 
 struct intel_iommu *map_ioapic_to_ir(int apic)
@@ -355,6 +357,7 @@ struct intel_iommu *map_dev_to_ir(struct pci_dev *dev)
 
 int free_irte(int irq)
 {
+        int rc = 0;
         int index, i;
         struct irte *irte;
         struct intel_iommu *iommu;
@@ -375,7 +378,7 @@ int free_irte(int irq)
         if (!irq_iommu->sub_handle) {
                 for (i = 0; i < (1 << irq_iommu->irte_mask); i++)
                         set_64bit((unsigned long *)irte, 0);
-                qi_flush_iec(iommu, index, irq_iommu->irte_mask);
+                rc = qi_flush_iec(iommu, index, irq_iommu->irte_mask);
         }
 
         irq_iommu->iommu = NULL;
@@ -385,7 +388,7 @@ int free_irte(int irq)
 
         spin_unlock(&irq_2_ir_lock);
 
-        return 0;
+        return rc;
 }
 
 static void iommu_set_intr_remapping(struct intel_iommu *iommu, int mode)
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index aac7006949f1..382575007382 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -108,6 +108,37 @@ int pci_cleanup_aer_correct_error_status(struct pci_dev *dev)
 }
 #endif  /*  0  */
 
+
+static void set_device_error_reporting(struct pci_dev *dev, void *data)
+{
+        bool enable = *((bool *)data);
+
+        if (dev->pcie_type != PCIE_RC_PORT &&
+            dev->pcie_type != PCIE_SW_UPSTREAM_PORT &&
+            dev->pcie_type != PCIE_SW_DOWNSTREAM_PORT)
+                return;
+
+        if (enable)
+                pci_enable_pcie_error_reporting(dev);
+        else
+                pci_disable_pcie_error_reporting(dev);
+}
+
+/**
+ * set_downstream_devices_error_reporting - enable/disable the error reporting  bits on the root port and its downstream ports.
+ * @dev: pointer to root port's pci_dev data structure
+ * @enable: true = enable error reporting, false = disable error reporting.
+ */
+static void set_downstream_devices_error_reporting(struct pci_dev *dev,
+                                                   bool enable)
+{
+        set_device_error_reporting(dev, &enable);
+
+        if (!dev->subordinate)
+                return;
+        pci_walk_bus(dev->subordinate, set_device_error_reporting, &enable);
+}
+
 static int find_device_iter(struct device *device, void *data)
 {
         struct pci_dev *dev;
@@ -525,15 +556,11 @@ void aer_enable_rootport(struct aer_rpc *rpc)
         pci_read_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, &reg32);
         pci_write_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, reg32);
 
-        /* Enable Root Port device reporting error itself */
-        pci_read_config_word(pdev, pos+PCI_EXP_DEVCTL, &reg16);
-        reg16 = reg16 |
-                PCI_EXP_DEVCTL_CERE |
-                PCI_EXP_DEVCTL_NFERE |
-                PCI_EXP_DEVCTL_FERE |
-                PCI_EXP_DEVCTL_URRE;
-        pci_write_config_word(pdev, pos+PCI_EXP_DEVCTL,
-                reg16);
+        /*
+         * Enable error reporting for the root port device and downstream port
+         * devices.
+         */
+        set_downstream_devices_error_reporting(pdev, true);
 
         /* Enable Root Port's interrupt in response to error messages */
         pci_write_config_dword(pdev,
@@ -553,6 +580,12 @@ static void disable_root_aer(struct aer_rpc *rpc)
         u32 reg32;
         int pos;
 
+        /*
+         * Disable error reporting for the root port device and downstream port
+         * devices.
+         */
+        set_downstream_devices_error_reporting(pdev, false);
+
         pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
         /* Disable Root's interrupt in response to error messages */
         pci_write_config_dword(pdev, pos + PCI_ERR_ROOT_COMMAND, 0);
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index f9b874eaeb9f..5ea566e20b37 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -97,14 +97,13 @@ static int __devinit pcie_portdrv_probe (struct pci_dev *dev,
 
         pcie_portdrv_save_config(dev);
 
-        pci_enable_pcie_error_reporting(dev);
-
         return 0;
 }
 
 static void pcie_portdrv_remove (struct pci_dev *dev)
 {
         pcie_port_device_remove(dev);
+        pci_disable_device(dev);
         kfree(pci_get_drvdata(dev));
 }
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index baad093aafe3..92b9efe9bcaf 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -23,6 +23,7 @@
 #include <linux/acpi.h>
 #include <linux/kallsyms.h>
 #include <linux/dmi.h>
+#include <linux/pci-aspm.h>
 #include "pci.h"
 
 int isa_dma_bridge_buggy;
@@ -1584,6 +1585,7 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_SERVERWORKS,   PCI_DEVICE_ID_SERVERWORKS_
  */
 #define AMD_813X_MISC                   0x40
 #define AMD_813X_NOIOAMODE              (1<<0)
+#define AMD_813X_REV_B2                 0x13
 
 static void quirk_disable_amd_813x_boot_interrupt(struct pci_dev *dev)
 {
@@ -1591,6 +1593,8 @@ static void quirk_disable_amd_813x_boot_interrupt(struct pci_dev *dev)
 
         if (noioapicquirk)
                 return;
+        if (dev->revision == AMD_813X_REV_B2)
+                return;
 
         pci_read_config_dword(dev, AMD_813X_MISC, &pci_config_dword);
         pci_config_dword &= ~AMD_813X_NOIOAMODE;
@@ -1746,6 +1750,30 @@ static void __devinit quirk_e100_interrupt(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_e100_interrupt);
 
+/*
+ * The 82575 and 82598 may experience data corruption issues when transitioning
+ * out of L0S.  To prevent this we need to disable L0S on the pci-e link
+ */
+static void __devinit quirk_disable_aspm_l0s(struct pci_dev *dev)
+{
+        dev_info(&dev->dev, "Disabling L0s\n");
+        pci_disable_link_state(dev, PCIE_LINK_STATE_L0S);
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a7, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a9, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10b6, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c6, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c7, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c8, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10d6, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10db, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10dd, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10e1, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10ec, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
+
 static void __devinit fixup_rev1_53c810(struct pci_dev* dev)
 {
         /* rev 1 ncr53c810 chips don't set the class at all which means
@@ -1981,7 +2009,6 @@ static void __devinit quirk_msi_ht_cap(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT2000_PCIE,
                         quirk_msi_ht_cap);
 
-
 /* The nVidia CK804 chipset may have 2 HT MSI mappings.
  * MSI are supported if the MSI capability set in any of these mappings.
  */
@@ -2032,6 +2059,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS,
                          PCI_DEVICE_ID_SERVERWORKS_HT1000_PXB,
                          ht_enable_msi_mapping);
 
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE,
+                         ht_enable_msi_mapping);
+
 /* The P5N32-SLI Premium motherboard from Asus has a problem with msi
  * for the MCP55 NIC. It is not yet determined whether the msi problem
  * also affects other devices. As for now, turn off msi for this device.
@@ -2048,11 +2078,105 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA,
                         PCI_DEVICE_ID_NVIDIA_NVENET_15,
                         nvenet_msi_disable);
 
-static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
+static void __devinit nv_ht_enable_msi_mapping(struct pci_dev *dev)
 {
         struct pci_dev *host_bridge;
+        int pos;
+        int i, dev_no;
+        int found = 0;
+
+        dev_no = dev->devfn >> 3;
+        for (i = dev_no; i >= 0; i--) {
+                host_bridge = pci_get_slot(dev->bus, PCI_DEVFN(i, 0));
+                if (!host_bridge)
+                        continue;
+
+                pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE);
+                if (pos != 0) {
+                        found = 1;
+                        break;
+                }
+                pci_dev_put(host_bridge);
+        }
+
+        if (!found)
+                return;
+
+        /* root did that ! */
+        if (msi_ht_cap_enabled(host_bridge))
+                goto out;
+
+        ht_enable_msi_mapping(dev);
+
+out:
+        pci_dev_put(host_bridge);
+}
+
+static void __devinit ht_disable_msi_mapping(struct pci_dev *dev)
+{
         int pos, ttl = 48;
 
+        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
+        while (pos && ttl--) {
+                u8 flags;
+
+                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
+                                         &flags) == 0) {
+                        dev_info(&dev->dev, "Disabling HT MSI Mapping\n");
+
+                        pci_write_config_byte(dev, pos + HT_MSI_FLAGS,
+                                              flags & ~HT_MSI_FLAGS_ENABLE);
+                }
+                pos = pci_find_next_ht_capability(dev, pos,
+                                                  HT_CAPTYPE_MSI_MAPPING);
+        }
+}
+
+static int __devinit ht_check_msi_mapping(struct pci_dev *dev)
+{
+        int pos, ttl = 48;
+        int found = 0;
+
+        /* check if there is HT MSI cap or enabled on this device */
+        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
+        while (pos && ttl--) {
+                u8 flags;
+
+                if (found < 1)
+                        found = 1;
+                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
+                                         &flags) == 0) {
+                        if (flags & HT_MSI_FLAGS_ENABLE) {
+                                if (found < 2) {
+                                        found = 2;
+                                        break;
+                                }
+                        }
+                }
+                pos = pci_find_next_ht_capability(dev, pos,
+                                                  HT_CAPTYPE_MSI_MAPPING);
+        }
+
+        return found;
+}
+
+static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
+{
+        struct pci_dev *host_bridge;
+        int pos;
+        int found;
+
+        /* Enabling HT MSI mapping on this device breaks MCP51 */
+        if (dev->device == 0x270)
+                return;
+
+        /* check if there is HT MSI cap or enabled on this device */
+        found = ht_check_msi_mapping(dev);
+
+        /* no HT MSI CAP */
+        if (found == 0)
+                return;
+
         /*
          * HT MSI mapping should be disabled on devices that are below
          * a non-Hypertransport host bridge. Locate the host bridge...
@@ -2067,24 +2191,19 @@ static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
         pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE);
         if (pos != 0) {
                 /* Host bridge is to HT */
-                ht_enable_msi_mapping(dev);
+                if (found == 1) {
+                        /* it is not enabled, try to enable it */
+                        nv_ht_enable_msi_mapping(dev);
+                }
                 return;
         }
 
-        /* Host bridge is not to HT, disable HT MSI mapping on this device */
-        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
-        while (pos && ttl--) {
-                u8 flags;
+        /* HT MSI is not enabled */
+        if (found == 1)
+                return;
 
-                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
-                                         &flags) == 0) {
-                        dev_info(&dev->dev, "Disabling HT MSI mapping");
-                        pci_write_config_byte(dev, pos + HT_MSI_FLAGS,
-                                              flags & ~HT_MSI_FLAGS_ENABLE);
-                }
-                pos = pci_find_next_ht_capability(dev, pos,
-                                                  HT_CAPTYPE_MSI_MAPPING);
-        }
+        /* Host bridge is not to HT, disable HT MSI mapping on this device */
+        ht_disable_msi_mapping(dev);
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk);
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 94c9f911824e..6bcca616a704 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1297,7 +1297,7 @@ static int __init acer_wmi_init(void)
 
         set_quirks();
 
-        if (!acpi_video_backlight_support() && has_cap(ACER_CAP_BRIGHTNESS)) {
+        if (acpi_video_backlight_support() && has_cap(ACER_CAP_BRIGHTNESS)) {
                 interface->capability &= ~ACER_CAP_BRIGHTNESS;
                 printk(ACER_INFO "Brightness must be controlled by "
                        "generic video driver\n");
diff --git a/drivers/power/ds2760_battery.c b/drivers/power/ds2760_battery.c
index 1d768928e0bb..a52d4a11652d 100644
--- a/drivers/power/ds2760_battery.c
+++ b/drivers/power/ds2760_battery.c
@@ -180,10 +180,13 @@ static int ds2760_battery_read_status(struct ds2760_device_info *di)
         di->empty_uAh = battery_interpolate(scale, di->temp_C / 10);
         di->empty_uAh *= 1000; /* convert to µAh */
 
-        /* From Maxim Application Note 131: remaining capacity =
-         * ((ICA - Empty Value) / (Full Value - Empty Value)) x 100% */
-        di->rem_capacity = ((di->accum_current_uAh - di->empty_uAh) * 100L) /
-                            (di->full_active_uAh - di->empty_uAh);
+        if (di->full_active_uAh == di->empty_uAh)
+                di->rem_capacity = 0;
+        else
+                /* From Maxim Application Note 131: remaining capacity =
+                 * ((ICA - Empty Value) / (Full Value - Empty Value)) x 100% */
+                di->rem_capacity = ((di->accum_current_uAh - di->empty_uAh) * 100L) /
+                                    (di->full_active_uAh - di->empty_uAh);
 
         if (di->rem_capacity < 0)
                 di->rem_capacity = 0;
diff --git a/drivers/sbus/char/bbc_i2c.c b/drivers/sbus/char/bbc_i2c.c
index f08e169ba1b5..7e30e5f6e032 100644
--- a/drivers/sbus/char/bbc_i2c.c
+++ b/drivers/sbus/char/bbc_i2c.c
@@ -129,7 +129,7 @@ static int wait_for_pin(struct bbc_i2c_bus *bp, u8 *status)
         bp->waiting = 1;
         add_wait_queue(&bp->wq, &wait);
         while (limit-- > 0) {
-                unsigned long val;
+                long val;
 
                 val = wait_event_interruptible_timeout(
                                 bp->wq,
diff --git a/drivers/sbus/char/jsflash.c b/drivers/sbus/char/jsflash.c
index a9a9893a5f95..e6d1fc8c54f1 100644
--- a/drivers/sbus/char/jsflash.c
+++ b/drivers/sbus/char/jsflash.c
@@ -38,9 +38,6 @@
 #include <linux/string.h>
 #include <linux/genhd.h>
 #include <linux/blkdev.h>
-
-#define MAJOR_NR        JSFD_MAJOR
-
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/io.h>
diff --git a/drivers/scsi/cxgb3i/cxgb3i.h b/drivers/scsi/cxgb3i/cxgb3i.h
index fde6e4c634e7..a7cf550b9cca 100644
--- a/drivers/scsi/cxgb3i/cxgb3i.h
+++ b/drivers/scsi/cxgb3i/cxgb3i.h
@@ -20,6 +20,7 @@
 #include <linux/list.h>
 #include <linux/netdevice.h>
 #include <linux/scatterlist.h>
+#include <linux/skbuff.h>
 #include <scsi/libiscsi_tcp.h>
 
 /* from cxgb3 LLD */
@@ -113,6 +114,26 @@ struct cxgb3i_endpoint {
         struct cxgb3i_conn *cconn;
 };
 
+/**
+ * struct cxgb3i_task_data - private iscsi task data
+ *
+ * @nr_frags:   # of coalesced page frags (from scsi sgl)
+ * @frags:      coalesced page frags (from scsi sgl)
+ * @skb:        tx pdu skb
+ * @offset:     data offset for the next pdu
+ * @count:      max. possible pdu payload
+ * @sgoffset:   offset to the first sg entry for a given offset
+ */
+#define MAX_PDU_FRAGS   ((ULP2_MAX_PDU_PAYLOAD + 512 - 1) / 512)
+struct cxgb3i_task_data {
+        unsigned short nr_frags;
+        skb_frag_t frags[MAX_PDU_FRAGS];
+        struct sk_buff *skb;
+        unsigned int offset;
+        unsigned int count;
+        unsigned int sgoffset;
+};
+
 int cxgb3i_iscsi_init(void);
 void cxgb3i_iscsi_cleanup(void);
 
diff --git a/drivers/scsi/cxgb3i/cxgb3i_ddp.c b/drivers/scsi/cxgb3i/cxgb3i_ddp.c
index 08f3a09d9233..a83d36e4926f 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_ddp.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_ddp.c
@@ -639,10 +639,11 @@ static int ddp_init(struct t3cdev *tdev)
         write_unlock(&cxgb3i_ddp_rwlock);
 
         ddp_log_info("nppods %u (0x%x ~ 0x%x), bits %u, mask 0x%x,0x%x "
-                        "pkt %u,%u.\n",
+                        "pkt %u/%u, %u/%u.\n",
                         ppmax, ddp->llimit, ddp->ulimit, ddp->idx_bits,
                         ddp->idx_mask, ddp->rsvd_tag_mask,
-                        ddp->max_txsz, ddp->max_rxsz);
+                        ddp->max_txsz, uinfo.max_txsz,
+                        ddp->max_rxsz, uinfo.max_rxsz);
         return 0;
 
 free_ddp_map:
@@ -654,8 +655,8 @@ free_ddp_map:
  * cxgb3i_adapter_ddp_init - initialize the adapter's ddp resource
  * @tdev: t3cdev adapter
  * @tformat: tag format
- * @txsz: max tx pkt size, filled in by this func.
- * @rxsz: max rx pkt size, filled in by this func.
+ * @txsz: max tx pdu payload size, filled in by this func.
+ * @rxsz: max rx pdu payload size, filled in by this func.
  * initialize the ddp pagepod manager for a given adapter if needed and
  * setup the tag format for a given iscsi entity
  */
@@ -685,10 +686,12 @@ int cxgb3i_adapter_ddp_init(struct t3cdev *tdev,
                       tformat->sw_bits, tformat->rsvd_bits,
                       tformat->rsvd_shift, tformat->rsvd_mask);
 
-        *txsz = ddp->max_txsz;
-        *rxsz = ddp->max_rxsz;
-        ddp_log_info("ddp max pkt size: %u, %u.\n",
-                     ddp->max_txsz, ddp->max_rxsz);
+        *txsz = min_t(unsigned int, ULP2_MAX_PDU_PAYLOAD,
+                        ddp->max_txsz - ISCSI_PDU_NONPAYLOAD_LEN);
+        *rxsz = min_t(unsigned int, ULP2_MAX_PDU_PAYLOAD,
+                        ddp->max_rxsz - ISCSI_PDU_NONPAYLOAD_LEN);
+        ddp_log_info("max payload size: %u/%u, %u/%u.\n",
+                     *txsz, ddp->max_txsz, *rxsz, ddp->max_rxsz);
         return 0;
 }
 EXPORT_SYMBOL_GPL(cxgb3i_adapter_ddp_init);
diff --git a/drivers/scsi/cxgb3i/cxgb3i_ddp.h b/drivers/scsi/cxgb3i/cxgb3i_ddp.h
index 5c7c4d95c493..3faae7831c83 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_ddp.h
+++ b/drivers/scsi/cxgb3i/cxgb3i_ddp.h
@@ -13,6 +13,8 @@
 #ifndef __CXGB3I_ULP2_DDP_H__
 #define __CXGB3I_ULP2_DDP_H__
 
+#include <linux/vmalloc.h>
+
 /**
  * struct cxgb3i_tag_format - cxgb3i ulp tag format for an iscsi entity
  *
@@ -85,8 +87,9 @@ struct cxgb3i_ddp_info {
         struct sk_buff **gl_skb;
 };
 
+#define ISCSI_PDU_NONPAYLOAD_LEN        312 /* bhs(48) + ahs(256) + digest(8) */
 #define ULP2_MAX_PKT_SIZE       16224
-#define ULP2_MAX_PDU_PAYLOAD    (ULP2_MAX_PKT_SIZE - ISCSI_PDU_NONPAYLOAD_MAX)
+#define ULP2_MAX_PDU_PAYLOAD    (ULP2_MAX_PKT_SIZE - ISCSI_PDU_NONPAYLOAD_LEN)
 #define PPOD_PAGES_MAX          4
 #define PPOD_PAGES_SHIFT        2       /* 4 pages per pod */
 
diff --git a/drivers/scsi/cxgb3i/cxgb3i_init.c b/drivers/scsi/cxgb3i/cxgb3i_init.c
index 091ecb4d9f3d..1ce9f244e46c 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_init.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_init.c
@@ -12,8 +12,8 @@
 #include "cxgb3i.h"
 
 #define DRV_MODULE_NAME         "cxgb3i"
-#define DRV_MODULE_VERSION      "1.0.0"
-#define DRV_MODULE_RELDATE      "Jun. 1, 2008"
+#define DRV_MODULE_VERSION      "1.0.1"
+#define DRV_MODULE_RELDATE      "Jan. 2009"
 
 static char version[] =
         "Chelsio S3xx iSCSI Driver " DRV_MODULE_NAME
diff --git a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
index d83464b9b3f9..fa2a44f37b36 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
@@ -364,7 +364,8 @@ cxgb3i_session_create(struct iscsi_endpoint *ep, u16 cmds_max, u16 qdepth,
 
         cls_session = iscsi_session_setup(&cxgb3i_iscsi_transport, shost,
                                           cmds_max,
-                                          sizeof(struct iscsi_tcp_task),
+                                          sizeof(struct iscsi_tcp_task) +
+                                          sizeof(struct cxgb3i_task_data),
                                           initial_cmdsn, ISCSI_MAX_TARGET);
         if (!cls_session)
                 return NULL;
@@ -402,17 +403,15 @@ static inline int cxgb3i_conn_max_xmit_dlength(struct iscsi_conn *conn)
 {
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
         struct cxgb3i_conn *cconn = tcp_conn->dd_data;
-        unsigned int max = min_t(unsigned int, ULP2_MAX_PDU_PAYLOAD,
-                                 cconn->hba->snic->tx_max_size -
-                                 ISCSI_PDU_NONPAYLOAD_MAX);
+        unsigned int max = max(512 * MAX_SKB_FRAGS, SKB_TX_HEADROOM);
 
+        max = min(cconn->hba->snic->tx_max_size, max);
         if (conn->max_xmit_dlength)
-                conn->max_xmit_dlength = min_t(unsigned int,
-                                                conn->max_xmit_dlength, max);
+                conn->max_xmit_dlength = min(conn->max_xmit_dlength, max);
         else
                 conn->max_xmit_dlength = max;
         align_pdu_size(conn->max_xmit_dlength);
-        cxgb3i_log_info("conn 0x%p, max xmit %u.\n",
+        cxgb3i_api_debug("conn 0x%p, max xmit %u.\n",
                          conn, conn->max_xmit_dlength);
         return 0;
 }
@@ -427,9 +426,7 @@ static inline int cxgb3i_conn_max_recv_dlength(struct iscsi_conn *conn)
 {
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
         struct cxgb3i_conn *cconn = tcp_conn->dd_data;
-        unsigned int max = min_t(unsigned int, ULP2_MAX_PDU_PAYLOAD,
-                                 cconn->hba->snic->rx_max_size -
-                                 ISCSI_PDU_NONPAYLOAD_MAX);
+        unsigned int max = cconn->hba->snic->rx_max_size;
 
         align_pdu_size(max);
         if (conn->max_recv_dlength) {
@@ -439,8 +436,7 @@ static inline int cxgb3i_conn_max_recv_dlength(struct iscsi_conn *conn)
                                          conn->max_recv_dlength, max);
                         return -EINVAL;
                 }
-                conn->max_recv_dlength = min_t(unsigned int,
-                                                conn->max_recv_dlength, max);
+                conn->max_recv_dlength = min(conn->max_recv_dlength, max);
                 align_pdu_size(conn->max_recv_dlength);
         } else
                 conn->max_recv_dlength = max;
@@ -844,7 +840,7 @@ static struct scsi_host_template cxgb3i_host_template = {
         .proc_name              = "cxgb3i",
         .queuecommand           = iscsi_queuecommand,
         .change_queue_depth     = iscsi_change_queue_depth,
-        .can_queue              = 128 * (ISCSI_DEF_XMIT_CMDS_MAX - 1),
+        .can_queue              = CXGB3I_SCSI_QDEPTH_DFLT - 1,
         .sg_tablesize           = SG_ALL,
         .max_sectors            = 0xFFFF,
         .cmd_per_lun            = ISCSI_DEF_CMD_PER_LUN,
diff --git a/drivers/scsi/cxgb3i/cxgb3i_offload.c b/drivers/scsi/cxgb3i/cxgb3i_offload.c
index a865f1fefe8b..de3b3b614cca 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_offload.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_offload.c
@@ -23,19 +23,19 @@
 #include "cxgb3i_ddp.h"
 
 #ifdef __DEBUG_C3CN_CONN__
-#define c3cn_conn_debug         cxgb3i_log_info
+#define c3cn_conn_debug         cxgb3i_log_debug
 #else
 #define c3cn_conn_debug(fmt...)
 #endif
 
 #ifdef __DEBUG_C3CN_TX__
-#define c3cn_tx_debug         cxgb3i_log_debug
+#define c3cn_tx_debug           cxgb3i_log_debug
 #else
 #define c3cn_tx_debug(fmt...)
 #endif
 
 #ifdef __DEBUG_C3CN_RX__
-#define c3cn_rx_debug         cxgb3i_log_debug
+#define c3cn_rx_debug           cxgb3i_log_debug
 #else
 #define c3cn_rx_debug(fmt...)
 #endif
@@ -47,9 +47,9 @@ static int cxgb3_rcv_win = 256 * 1024;
 module_param(cxgb3_rcv_win, int, 0644);
 MODULE_PARM_DESC(cxgb3_rcv_win, "TCP receive window in bytes (default=256KB)");
 
-static int cxgb3_snd_win = 64 * 1024;
+static int cxgb3_snd_win = 128 * 1024;
 module_param(cxgb3_snd_win, int, 0644);
-MODULE_PARM_DESC(cxgb3_snd_win, "TCP send window in bytes (default=64KB)");
+MODULE_PARM_DESC(cxgb3_snd_win, "TCP send window in bytes (default=128KB)");
 
 static int cxgb3_rx_credit_thres = 10 * 1024;
 module_param(cxgb3_rx_credit_thres, int, 0644);
@@ -301,8 +301,8 @@ static void act_open_req_arp_failure(struct t3cdev *dev, struct sk_buff *skb)
 static void skb_entail(struct s3_conn *c3cn, struct sk_buff *skb,
                        int flags)
 {
-        CXGB3_SKB_CB(skb)->seq = c3cn->write_seq;
-        CXGB3_SKB_CB(skb)->flags = flags;
+        skb_tcp_seq(skb) = c3cn->write_seq;
+        skb_flags(skb) = flags;
         __skb_queue_tail(&c3cn->write_queue, skb);
 }
 
@@ -457,12 +457,9 @@ static unsigned int wrlen __read_mostly;
  * The number of WRs needed for an skb depends on the number of fragments
  * in the skb and whether it has any payload in its main body.  This maps the
  * length of the gather list represented by an skb into the # of necessary WRs.
- *
- * The max. length of an skb is controlled by the max pdu size which is ~16K.
- * Also, assume the min. fragment length is the sector size (512), then add
- * extra fragment counts for iscsi bhs and payload padding.
+ * The extra two fragments are for iscsi bhs and payload padding.
  */
-#define SKB_WR_LIST_SIZE        (16384/512 + 3)
+#define SKB_WR_LIST_SIZE        (MAX_SKB_FRAGS + 2)
 static unsigned int skb_wrs[SKB_WR_LIST_SIZE] __read_mostly;
 
 static void s3_init_wr_tab(unsigned int wr_len)
@@ -485,7 +482,7 @@ static void s3_init_wr_tab(unsigned int wr_len)
 
 static inline void reset_wr_list(struct s3_conn *c3cn)
 {
-        c3cn->wr_pending_head = NULL;
+        c3cn->wr_pending_head = c3cn->wr_pending_tail = NULL;
 }
 
 /*
@@ -496,7 +493,7 @@ static inline void reset_wr_list(struct s3_conn *c3cn)
 static inline void enqueue_wr(struct s3_conn *c3cn,
                               struct sk_buff *skb)
 {
-        skb_wr_data(skb) = NULL;
+        skb_tx_wr_next(skb) = NULL;
 
         /*
          * We want to take an extra reference since both us and the driver
@@ -509,10 +506,22 @@ static inline void enqueue_wr(struct s3_conn *c3cn,
         if (!c3cn->wr_pending_head)
                 c3cn->wr_pending_head = skb;
         else
-                skb_wr_data(skb) = skb;
+                skb_tx_wr_next(c3cn->wr_pending_tail) = skb;
         c3cn->wr_pending_tail = skb;
 }
 
+static int count_pending_wrs(struct s3_conn *c3cn)
+{
+        int n = 0;
+        const struct sk_buff *skb = c3cn->wr_pending_head;
+
+        while (skb) {
+                n += skb->csum;
+                skb = skb_tx_wr_next(skb);
+        }
+        return n;
+}
+
 static inline struct sk_buff *peek_wr(const struct s3_conn *c3cn)
 {
         return c3cn->wr_pending_head;
@@ -529,8 +538,8 @@ static inline struct sk_buff *dequeue_wr(struct s3_conn *c3cn)
 
         if (likely(skb)) {
                 /* Don't bother clearing the tail */
-                c3cn->wr_pending_head = skb_wr_data(skb);
-                skb_wr_data(skb) = NULL;
+                c3cn->wr_pending_head = skb_tx_wr_next(skb);
+                skb_tx_wr_next(skb) = NULL;
         }
         return skb;
 }
@@ -543,13 +552,14 @@ static void purge_wr_queue(struct s3_conn *c3cn)
 }
 
 static inline void make_tx_data_wr(struct s3_conn *c3cn, struct sk_buff *skb,
-                                   int len)
+                                   int len, int req_completion)
 {
         struct tx_data_wr *req;
 
         skb_reset_transport_header(skb);
         req = (struct tx_data_wr *)__skb_push(skb, sizeof(*req));
-        req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA));
+        req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA) |
+                        (req_completion ? F_WR_COMPL : 0));
         req->wr_lo = htonl(V_WR_TID(c3cn->tid));
         req->sndseq = htonl(c3cn->snd_nxt);
         /* len includes the length of any HW ULP additions */
@@ -592,7 +602,7 @@ static int c3cn_push_tx_frames(struct s3_conn *c3cn, int req_completion)
 
         if (unlikely(c3cn->state == C3CN_STATE_CONNECTING ||
                      c3cn->state == C3CN_STATE_CLOSE_WAIT_1 ||
-                     c3cn->state == C3CN_STATE_ABORTING)) {
+                     c3cn->state >= C3CN_STATE_ABORTING)) {
                 c3cn_tx_debug("c3cn 0x%p, in closing state %u.\n",
                               c3cn, c3cn->state);
                 return 0;
@@ -615,7 +625,7 @@ static int c3cn_push_tx_frames(struct s3_conn *c3cn, int req_completion)
                 if (c3cn->wr_avail < wrs_needed) {
                         c3cn_tx_debug("c3cn 0x%p, skb len %u/%u, frag %u, "
                                       "wr %d < %u.\n",
-                                      c3cn, skb->len, skb->datalen, frags,
+                                      c3cn, skb->len, skb->data_len, frags,
                                       wrs_needed, c3cn->wr_avail);
                         break;
                 }
@@ -627,20 +637,24 @@ static int c3cn_push_tx_frames(struct s3_conn *c3cn, int req_completion)
                 c3cn->wr_unacked += wrs_needed;
                 enqueue_wr(c3cn, skb);
 
-                if (likely(CXGB3_SKB_CB(skb)->flags & C3CB_FLAG_NEED_HDR)) {
-                        len += ulp_extra_len(skb);
-                        make_tx_data_wr(c3cn, skb, len);
-                        c3cn->snd_nxt += len;
-                        if ((req_completion
-                             && c3cn->wr_unacked == wrs_needed)
-                            || (CXGB3_SKB_CB(skb)->flags & C3CB_FLAG_COMPL)
-                            || c3cn->wr_unacked >= c3cn->wr_max / 2) {
-                                struct work_request_hdr *wr = cplhdr(skb);
+                c3cn_tx_debug("c3cn 0x%p, enqueue, skb len %u/%u, frag %u, "
+                                "wr %d, left %u, unack %u.\n",
+                                c3cn, skb->len, skb->data_len, frags,
+                                wrs_needed, c3cn->wr_avail, c3cn->wr_unacked);
+
 
-                                wr->wr_hi |= htonl(F_WR_COMPL);
+                if (likely(skb_flags(skb) & C3CB_FLAG_NEED_HDR)) {
+                        if ((req_completion &&
+                                c3cn->wr_unacked == wrs_needed) ||
+                            (skb_flags(skb) & C3CB_FLAG_COMPL) ||
+                            c3cn->wr_unacked >= c3cn->wr_max / 2) {
+                                req_completion = 1;
                                 c3cn->wr_unacked = 0;
                         }
-                        CXGB3_SKB_CB(skb)->flags &= ~C3CB_FLAG_NEED_HDR;
+                        len += ulp_extra_len(skb);
+                        make_tx_data_wr(c3cn, skb, len, req_completion);
+                        c3cn->snd_nxt += len;
+                        skb_flags(skb) &= ~C3CB_FLAG_NEED_HDR;
                 }
 
                 total_size += skb->truesize;
@@ -735,8 +749,11 @@ static void process_act_establish(struct s3_conn *c3cn, struct sk_buff *skb)
         if (unlikely(c3cn_flag(c3cn, C3CN_ACTIVE_CLOSE_NEEDED)))
                 /* upper layer has requested closing */
                 send_abort_req(c3cn);
-        else if (c3cn_push_tx_frames(c3cn, 1))
+        else {
+                if (skb_queue_len(&c3cn->write_queue))
+                        c3cn_push_tx_frames(c3cn, 1);
                 cxgb3i_conn_tx_open(c3cn);
+        }
 }
 
 static int do_act_establish(struct t3cdev *cdev, struct sk_buff *skb,
@@ -1082,8 +1099,8 @@ static void process_rx_iscsi_hdr(struct s3_conn *c3cn, struct sk_buff *skb)
                 return;
         }
 
-        CXGB3_SKB_CB(skb)->seq = ntohl(hdr_cpl->seq);
-        CXGB3_SKB_CB(skb)->flags = 0;
+        skb_tcp_seq(skb) = ntohl(hdr_cpl->seq);
+        skb_flags(skb) = 0;
 
         skb_reset_transport_header(skb);
         __skb_pull(skb, sizeof(struct cpl_iscsi_hdr));
@@ -1103,12 +1120,12 @@ static void process_rx_iscsi_hdr(struct s3_conn *c3cn, struct sk_buff *skb)
                 goto abort_conn;
 
         skb_ulp_mode(skb) = ULP2_FLAG_DATA_READY;
-        skb_ulp_pdulen(skb) = ntohs(ddp_cpl.len);
-        skb_ulp_ddigest(skb) = ntohl(ddp_cpl.ulp_crc);
+        skb_rx_pdulen(skb) = ntohs(ddp_cpl.len);
+        skb_rx_ddigest(skb) = ntohl(ddp_cpl.ulp_crc);
         status = ntohl(ddp_cpl.ddp_status);
 
         c3cn_rx_debug("rx skb 0x%p, len %u, pdulen %u, ddp status 0x%x.\n",
-                      skb, skb->len, skb_ulp_pdulen(skb), status);
+                      skb, skb->len, skb_rx_pdulen(skb), status);
 
         if (status & (1 << RX_DDP_STATUS_HCRC_SHIFT))
                 skb_ulp_mode(skb) |= ULP2_FLAG_HCRC_ERROR;
@@ -1126,7 +1143,7 @@ static void process_rx_iscsi_hdr(struct s3_conn *c3cn, struct sk_buff *skb)
         } else if (status & (1 << RX_DDP_STATUS_DDP_SHIFT))
                 skb_ulp_mode(skb) |= ULP2_FLAG_DATA_DDPED;
 
-        c3cn->rcv_nxt = ntohl(ddp_cpl.seq) + skb_ulp_pdulen(skb);
+        c3cn->rcv_nxt = ntohl(ddp_cpl.seq) + skb_rx_pdulen(skb);
         __pskb_trim(skb, len);
         __skb_queue_tail(&c3cn->receive_queue, skb);
         cxgb3i_conn_pdu_ready(c3cn);
@@ -1151,12 +1168,27 @@ static int do_iscsi_hdr(struct t3cdev *t3dev, struct sk_buff *skb, void *ctx)
  * Process an acknowledgment of WR completion.  Advance snd_una and send the
  * next batch of work requests from the write queue.
  */
+static void check_wr_invariants(struct s3_conn *c3cn)
+{
+        int pending = count_pending_wrs(c3cn);
+
+        if (unlikely(c3cn->wr_avail + pending != c3cn->wr_max))
+                cxgb3i_log_error("TID %u: credit imbalance: avail %u, "
+                                "pending %u, total should be %u\n",
+                                c3cn->tid, c3cn->wr_avail, pending,
+                                c3cn->wr_max);
+}
+
 static void process_wr_ack(struct s3_conn *c3cn, struct sk_buff *skb)
 {
         struct cpl_wr_ack *hdr = cplhdr(skb);
         unsigned int credits = ntohs(hdr->credits);
         u32 snd_una = ntohl(hdr->snd_una);
 
+        c3cn_tx_debug("%u WR credits, avail %u, unack %u, TID %u, state %u.\n",
+                        credits, c3cn->wr_avail, c3cn->wr_unacked,
+                        c3cn->tid, c3cn->state);
+
         c3cn->wr_avail += credits;
         if (c3cn->wr_unacked > c3cn->wr_max - c3cn->wr_avail)
                 c3cn->wr_unacked = c3cn->wr_max - c3cn->wr_avail;
@@ -1171,6 +1203,17 @@ static void process_wr_ack(struct s3_conn *c3cn, struct sk_buff *skb)
                         break;
                 }
                 if (unlikely(credits < p->csum)) {
+                        struct tx_data_wr *w = cplhdr(p);
+                        cxgb3i_log_error("TID %u got %u WR credits need %u, "
+                                         "len %u, main body %u, frags %u, "
+                                         "seq # %u, ACK una %u, ACK nxt %u, "
+                                         "WR_AVAIL %u, WRs pending %u\n",
+                                         c3cn->tid, credits, p->csum, p->len,
+                                         p->len - p->data_len,
+                                         skb_shinfo(p)->nr_frags,
+                                         ntohl(w->sndseq), snd_una,
+                                         ntohl(hdr->snd_nxt), c3cn->wr_avail,
+                                         count_pending_wrs(c3cn) - credits);
                         p->csum -= credits;
                         break;
                 } else {
@@ -1180,15 +1223,24 @@ static void process_wr_ack(struct s3_conn *c3cn, struct sk_buff *skb)
                 }
         }
 
-        if (unlikely(before(snd_una, c3cn->snd_una)))
+        check_wr_invariants(c3cn);
+
+        if (unlikely(before(snd_una, c3cn->snd_una))) {
+                cxgb3i_log_error("TID %u, unexpected sequence # %u in WR_ACK "
+                                 "snd_una %u\n",
+                                 c3cn->tid, snd_una, c3cn->snd_una);
                 goto out_free;
+        }
 
         if (c3cn->snd_una != snd_una) {
                 c3cn->snd_una = snd_una;
                 dst_confirm(c3cn->dst_cache);
         }
 
-        if (skb_queue_len(&c3cn->write_queue) && c3cn_push_tx_frames(c3cn, 0))
+        if (skb_queue_len(&c3cn->write_queue)) {
+                if (c3cn_push_tx_frames(c3cn, 0))
+                        cxgb3i_conn_tx_open(c3cn);
+        } else
                 cxgb3i_conn_tx_open(c3cn);
 out_free:
         __kfree_skb(skb);
@@ -1452,7 +1504,7 @@ static void init_offload_conn(struct s3_conn *c3cn,
                               struct dst_entry *dst)
 {
         BUG_ON(c3cn->cdev != cdev);
-        c3cn->wr_max = c3cn->wr_avail = T3C_DATA(cdev)->max_wrs;
+        c3cn->wr_max = c3cn->wr_avail = T3C_DATA(cdev)->max_wrs - 1;
         c3cn->wr_unacked = 0;
         c3cn->mss_idx = select_mss(c3cn, dst_mtu(dst));
 
@@ -1671,9 +1723,17 @@ int cxgb3i_c3cn_send_pdus(struct s3_conn *c3cn, struct sk_buff *skb)
                 goto out_err;
         }
 
-        err = -EPIPE;
         if (c3cn->err) {
                 c3cn_tx_debug("c3cn 0x%p, err %d.\n", c3cn, c3cn->err);
+                err = -EPIPE;
+                goto out_err;
+        }
+
+        if (c3cn->write_seq - c3cn->snd_una >= cxgb3_snd_win) {
+                c3cn_tx_debug("c3cn 0x%p, snd %u - %u > %u.\n",
+                                c3cn, c3cn->write_seq, c3cn->snd_una,
+                                cxgb3_snd_win);
+                err = -EAGAIN;
                 goto out_err;
         }
 
diff --git a/drivers/scsi/cxgb3i/cxgb3i_offload.h b/drivers/scsi/cxgb3i/cxgb3i_offload.h
index d23156907ffd..6344b9eb2589 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_offload.h
+++ b/drivers/scsi/cxgb3i/cxgb3i_offload.h
@@ -178,25 +178,33 @@ void cxgb3i_c3cn_release(struct s3_conn *);
  * @flag:       see C3CB_FLAG_* below
  * @ulp_mode:   ULP mode/submode of sk_buff
  * @seq:        tcp sequence number
- * @ddigest:    pdu data digest
- * @pdulen:     recovered pdu length
- * @wr_data:    scratch area for tx wr
  */
+struct cxgb3_skb_rx_cb {
+        __u32 ddigest;                  /* data digest */
+        __u32 pdulen;                   /* recovered pdu length */
+};
+
+struct cxgb3_skb_tx_cb {
+        struct sk_buff *wr_next;        /* next wr */
+};
+
 struct cxgb3_skb_cb {
         __u8 flags;
         __u8 ulp_mode;
         __u32 seq;
-        __u32 ddigest;
-        __u32 pdulen;
-        struct sk_buff *wr_data;
+        union {
+                struct cxgb3_skb_rx_cb rx;
+                struct cxgb3_skb_tx_cb tx;
+        };
 };
 
 #define CXGB3_SKB_CB(skb)       ((struct cxgb3_skb_cb *)&((skb)->cb[0]))
-
+#define skb_flags(skb)          (CXGB3_SKB_CB(skb)->flags)
 #define skb_ulp_mode(skb)       (CXGB3_SKB_CB(skb)->ulp_mode)
-#define skb_ulp_ddigest(skb)    (CXGB3_SKB_CB(skb)->ddigest)
-#define skb_ulp_pdulen(skb)     (CXGB3_SKB_CB(skb)->pdulen)
-#define skb_wr_data(skb)        (CXGB3_SKB_CB(skb)->wr_data)
+#define skb_tcp_seq(skb)        (CXGB3_SKB_CB(skb)->seq)
+#define skb_rx_ddigest(skb)     (CXGB3_SKB_CB(skb)->rx.ddigest)
+#define skb_rx_pdulen(skb)      (CXGB3_SKB_CB(skb)->rx.pdulen)
+#define skb_tx_wr_next(skb)     (CXGB3_SKB_CB(skb)->tx.wr_next)
 
 enum c3cb_flags {
         C3CB_FLAG_NEED_HDR = 1 << 0,    /* packet needs a TX_DATA_WR header */
@@ -217,6 +225,7 @@ struct sge_opaque_hdr {
 /* for TX: a skb must have a headroom of at least TX_HEADER_LEN bytes */
 #define TX_HEADER_LEN \
                 (sizeof(struct tx_data_wr) + sizeof(struct sge_opaque_hdr))
+#define SKB_TX_HEADROOM         SKB_MAX_HEAD(TX_HEADER_LEN)
 
 /*
  * get and set private ip for iscsi traffic
diff --git a/drivers/scsi/cxgb3i/cxgb3i_pdu.c b/drivers/scsi/cxgb3i/cxgb3i_pdu.c
index ce7ce8c6094c..17115c230d65 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_pdu.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_pdu.c
@@ -32,6 +32,10 @@
 #define cxgb3i_tx_debug(fmt...)
 #endif
 
+/* always allocate rooms for AHS */
+#define SKB_TX_PDU_HEADER_LEN   \
+        (sizeof(struct iscsi_hdr) + ISCSI_MAX_AHS_SIZE)
+static unsigned int skb_extra_headroom;
 static struct page *pad_page;
 
 /*
@@ -146,12 +150,13 @@ static inline void tx_skb_setmode(struct sk_buff *skb, int hcrc, int dcrc)
 
 void cxgb3i_conn_cleanup_task(struct iscsi_task *task)
 {
-        struct iscsi_tcp_task *tcp_task = task->dd_data;
+        struct cxgb3i_task_data *tdata = task->dd_data +
+                                        sizeof(struct iscsi_tcp_task);
 
         /* never reached the xmit task callout */
-        if (tcp_task->dd_data)
-                kfree_skb(tcp_task->dd_data);
-        tcp_task->dd_data = NULL;
+        if (tdata->skb)
+                __kfree_skb(tdata->skb);
+        memset(tdata, 0, sizeof(struct cxgb3i_task_data));
 
         /* MNC - Do we need a check in case this is called but
          * cxgb3i_conn_alloc_pdu has never been called on the task */
@@ -159,28 +164,102 @@ void cxgb3i_conn_cleanup_task(struct iscsi_task *task)
         iscsi_tcp_cleanup_task(task);
 }
 
-/*
- * We do not support ahs yet
- */
+static int sgl_seek_offset(struct scatterlist *sgl, unsigned int sgcnt,
+                                unsigned int offset, unsigned int *off,
+                                struct scatterlist **sgp)
+{
+        int i;
+        struct scatterlist *sg;
+
+        for_each_sg(sgl, sg, sgcnt, i) {
+                if (offset < sg->length) {
+                        *off = offset;
+                        *sgp = sg;
+                        return 0;
+                }
+                offset -= sg->length;
+        }
+        return -EFAULT;
+}
+
+static int sgl_read_to_frags(struct scatterlist *sg, unsigned int sgoffset,
+                                unsigned int dlen, skb_frag_t *frags,
+                                int frag_max)
+{
+        unsigned int datalen = dlen;
+        unsigned int sglen = sg->length - sgoffset;
+        struct page *page = sg_page(sg);
+        int i;
+
+        i = 0;
+        do {
+                unsigned int copy;
+
+                if (!sglen) {
+                        sg = sg_next(sg);
+                        if (!sg) {
+                                cxgb3i_log_error("%s, sg NULL, len %u/%u.\n",
+                                                 __func__, datalen, dlen);
+                                return -EINVAL;
+                        }
+                        sgoffset = 0;
+                        sglen = sg->length;
+                        page = sg_page(sg);
+
+                }
+                copy = min(datalen, sglen);
+                if (i && page == frags[i - 1].page &&
+                    sgoffset + sg->offset ==
+                        frags[i - 1].page_offset + frags[i - 1].size) {
+                        frags[i - 1].size += copy;
+                } else {
+                        if (i >= frag_max) {
+                                cxgb3i_log_error("%s, too many pages %u, "
+                                                 "dlen %u.\n", __func__,
+                                                 frag_max, dlen);
+                                return -EINVAL;
+                        }
+
+                        frags[i].page = page;
+                        frags[i].page_offset = sg->offset + sgoffset;
+                        frags[i].size = copy;
+                        i++;
+                }
+                datalen -= copy;
+                sgoffset += copy;
+                sglen -= copy;
+        } while (datalen);
+
+        return i;
+}
+
 int cxgb3i_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
 {
+        struct iscsi_conn *conn = task->conn;
         struct iscsi_tcp_task *tcp_task = task->dd_data;
-        struct sk_buff *skb;
+        struct cxgb3i_task_data *tdata = task->dd_data + sizeof(*tcp_task);
+        struct scsi_cmnd *sc = task->sc;
+        int headroom = SKB_TX_PDU_HEADER_LEN;
 
+        tcp_task->dd_data = tdata;
         task->hdr = NULL;
-        /* always allocate rooms for AHS */
-        skb = alloc_skb(sizeof(struct iscsi_hdr) + ISCSI_MAX_AHS_SIZE +
-                        TX_HEADER_LEN,  GFP_ATOMIC);
-        if (!skb)
+
+        /* write command, need to send data pdus */
+        if (skb_extra_headroom && (opcode == ISCSI_OP_SCSI_DATA_OUT ||
+            (opcode == ISCSI_OP_SCSI_CMD &&
+            (scsi_bidi_cmnd(sc) || sc->sc_data_direction == DMA_TO_DEVICE))))
+                headroom += min(skb_extra_headroom, conn->max_xmit_dlength);
+
+        tdata->skb = alloc_skb(TX_HEADER_LEN + headroom, GFP_ATOMIC);
+        if (!tdata->skb)
                 return -ENOMEM;
+        skb_reserve(tdata->skb, TX_HEADER_LEN);
 
         cxgb3i_tx_debug("task 0x%p, opcode 0x%x, skb 0x%p.\n",
-                        task, opcode, skb);
+                        task, opcode, tdata->skb);
 
-        tcp_task->dd_data = skb;
-        skb_reserve(skb, TX_HEADER_LEN);
-        task->hdr = (struct iscsi_hdr *)skb->data;
-        task->hdr_max = sizeof(struct iscsi_hdr);
+        task->hdr = (struct iscsi_hdr *)tdata->skb->data;
+        task->hdr_max = SKB_TX_PDU_HEADER_LEN;
 
         /* data_out uses scsi_cmd's itt */
         if (opcode != ISCSI_OP_SCSI_DATA_OUT)
@@ -192,13 +271,13 @@ int cxgb3i_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
 int cxgb3i_conn_init_pdu(struct iscsi_task *task, unsigned int offset,
                               unsigned int count)
 {
-        struct iscsi_tcp_task *tcp_task = task->dd_data;
-        struct sk_buff *skb = tcp_task->dd_data;
         struct iscsi_conn *conn = task->conn;
-        struct page *pg;
+        struct iscsi_tcp_task *tcp_task = task->dd_data;
+        struct cxgb3i_task_data *tdata = tcp_task->dd_data;
+        struct sk_buff *skb = tdata->skb;
         unsigned int datalen = count;
         int i, padlen = iscsi_padding(count);
-        skb_frag_t *frag;
+        struct page *pg;
 
         cxgb3i_tx_debug("task 0x%p,0x%p, offset %u, count %u, skb 0x%p.\n",
                         task, task->sc, offset, count, skb);
@@ -209,90 +288,94 @@ int cxgb3i_conn_init_pdu(struct iscsi_task *task, unsigned int offset,
                 return 0;
 
         if (task->sc) {
-                struct scatterlist *sg;
-                struct scsi_data_buffer *sdb;
-                unsigned int sgoffset = offset;
-                struct page *sgpg;
-                unsigned int sglen;
-
-                sdb = scsi_out(task->sc);
-                sg = sdb->table.sgl;
-
-                for_each_sg(sdb->table.sgl, sg, sdb->table.nents, i) {
-                        cxgb3i_tx_debug("sg %d, page 0x%p, len %u offset %u\n",
-                                        i, sg_page(sg), sg->length, sg->offset);
-
-                        if (sgoffset < sg->length)
-                                break;
-                        sgoffset -= sg->length;
+                struct scsi_data_buffer *sdb = scsi_out(task->sc);
+                struct scatterlist *sg = NULL;
+                int err;
+
+                tdata->offset = offset;
+                tdata->count = count;
+                err = sgl_seek_offset(sdb->table.sgl, sdb->table.nents,
+                                        tdata->offset, &tdata->sgoffset, &sg);
+                if (err < 0) {
+                        cxgb3i_log_warn("tpdu, sgl %u, bad offset %u/%u.\n",
+                                        sdb->table.nents, tdata->offset,
+                                        sdb->length);
+                        return err;
                 }
-                sgpg = sg_page(sg);
-                sglen = sg->length - sgoffset;
-
-                do {
-                        int j = skb_shinfo(skb)->nr_frags;
-                        unsigned int copy;
-
-                        if (!sglen) {
-                                sg = sg_next(sg);
-                                sgpg = sg_page(sg);
-                                sgoffset = 0;
-                                sglen = sg->length;
-                                ++i;
+                err = sgl_read_to_frags(sg, tdata->sgoffset, tdata->count,
+                                        tdata->frags, MAX_PDU_FRAGS);
+                if (err < 0) {
+                        cxgb3i_log_warn("tpdu, sgl %u, bad offset %u + %u.\n",
+                                        sdb->table.nents, tdata->offset,
+                                        tdata->count);
+                        return err;
+                }
+                tdata->nr_frags = err;
+
+                if (tdata->nr_frags > MAX_SKB_FRAGS ||
+                    (padlen && tdata->nr_frags == MAX_SKB_FRAGS)) {
+                        char *dst = skb->data + task->hdr_len;
+                        skb_frag_t *frag = tdata->frags;
+
+                        /* data fits in the skb's headroom */
+                        for (i = 0; i < tdata->nr_frags; i++, frag++) {
+                                char *src = kmap_atomic(frag->page,
+                                                        KM_SOFTIRQ0);
+
+                                memcpy(dst, src+frag->page_offset, frag->size);
+                                dst += frag->size;
+                                kunmap_atomic(src, KM_SOFTIRQ0);
                         }
-                        copy = min(sglen, datalen);
-                        if (j && skb_can_coalesce(skb, j, sgpg,
-                                                  sg->offset + sgoffset)) {
-                                skb_shinfo(skb)->frags[j - 1].size += copy;
-                        } else {
-                                get_page(sgpg);
-                                skb_fill_page_desc(skb, j, sgpg,
-                                                   sg->offset + sgoffset, copy);
+                        if (padlen) {
+                                memset(dst, 0, padlen);
+                                padlen = 0;
                         }
-                        sgoffset += copy;
-                        sglen -= copy;
-                        datalen -= copy;
-                } while (datalen);
+                        skb_put(skb, count + padlen);
+                } else {
+                        /* data fit into frag_list */
+                        for (i = 0; i < tdata->nr_frags; i++)
+                                get_page(tdata->frags[i].page);
+
+                        memcpy(skb_shinfo(skb)->frags, tdata->frags,
+                                sizeof(skb_frag_t) * tdata->nr_frags);
+                        skb_shinfo(skb)->nr_frags = tdata->nr_frags;
+                        skb->len += count;
+                        skb->data_len += count;
+                        skb->truesize += count;
+                }
+
         } else {
                 pg = virt_to_page(task->data);
 
-                while (datalen) {
-                        i = skb_shinfo(skb)->nr_frags;
-                        frag = &skb_shinfo(skb)->frags[i];
-
-                        get_page(pg);
-                        frag->page = pg;
-                        frag->page_offset = 0;
-                        frag->size = min((unsigned int)PAGE_SIZE, datalen);
-
-                        skb_shinfo(skb)->nr_frags++;
-                        datalen -= frag->size;
-                        pg++;
-                }
+                get_page(pg);
+                skb_fill_page_desc(skb, 0, pg, offset_in_page(task->data),
+                                        count);
+                skb->len += count;
+                skb->data_len += count;
+                skb->truesize += count;
         }
 
         if (padlen) {
                 i = skb_shinfo(skb)->nr_frags;
-                frag = &skb_shinfo(skb)->frags[i];
-                frag->page = pad_page;
-                frag->page_offset = 0;
-                frag->size = padlen;
-                skb_shinfo(skb)->nr_frags++;
+                get_page(pad_page);
+                skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags, pad_page, 0,
+                                 padlen);
+
+                skb->data_len += padlen;
+                skb->truesize += padlen;
+                skb->len += padlen;
         }
 
-        datalen = count + padlen;
-        skb->data_len += datalen;
-        skb->truesize += datalen;
-        skb->len += datalen;
         return 0;
 }
 
 int cxgb3i_conn_xmit_pdu(struct iscsi_task *task)
 {
-        struct iscsi_tcp_task *tcp_task = task->dd_data;
-        struct sk_buff *skb = tcp_task->dd_data;
         struct iscsi_tcp_conn *tcp_conn = task->conn->dd_data;
         struct cxgb3i_conn *cconn = tcp_conn->dd_data;
+        struct iscsi_tcp_task *tcp_task = task->dd_data;
+        struct cxgb3i_task_data *tdata = tcp_task->dd_data;
+        struct sk_buff *skb = tdata->skb;
         unsigned int datalen;
         int err;
 
@@ -300,13 +383,14 @@ int cxgb3i_conn_xmit_pdu(struct iscsi_task *task)
                 return 0;
 
         datalen = skb->data_len;
-        tcp_task->dd_data = NULL;
+        tdata->skb = NULL;
         err = cxgb3i_c3cn_send_pdus(cconn->cep->c3cn, skb);
-        cxgb3i_tx_debug("task 0x%p, skb 0x%p, len %u/%u, rv %d.\n",
-                        task, skb, skb->len, skb->data_len, err);
         if (err > 0) {
                 int pdulen = err;
 
+        cxgb3i_tx_debug("task 0x%p, skb 0x%p, len %u/%u, rv %d.\n",
+                        task, skb, skb->len, skb->data_len, err);
+
                 if (task->conn->hdrdgst_en)
                         pdulen += ISCSI_DIGEST_SIZE;
                 if (datalen && task->conn->datadgst_en)
@@ -325,12 +409,14 @@ int cxgb3i_conn_xmit_pdu(struct iscsi_task *task)
                 return err;
         }
         /* reset skb to send when we are called again */
-        tcp_task->dd_data = skb;
+        tdata->skb = skb;
         return -EAGAIN;
 }
 
 int cxgb3i_pdu_init(void)
 {
+        if (SKB_TX_HEADROOM > (512 * MAX_SKB_FRAGS))
+                skb_extra_headroom = SKB_TX_HEADROOM;
         pad_page = alloc_page(GFP_KERNEL);
         if (!pad_page)
                 return -ENOMEM;
@@ -366,7 +452,9 @@ void cxgb3i_conn_pdu_ready(struct s3_conn *c3cn)
         skb = skb_peek(&c3cn->receive_queue);
         while (!err && skb) {
                 __skb_unlink(skb, &c3cn->receive_queue);
-                read += skb_ulp_pdulen(skb);
+                read += skb_rx_pdulen(skb);
+                cxgb3i_rx_debug("conn 0x%p, cn 0x%p, rx skb 0x%p, pdulen %u.\n",
+                                conn, c3cn, skb, skb_rx_pdulen(skb));
                 err = cxgb3i_conn_read_pdu_skb(conn, skb);
                 __kfree_skb(skb);
                 skb = skb_peek(&c3cn->receive_queue);
@@ -377,6 +465,11 @@ void cxgb3i_conn_pdu_ready(struct s3_conn *c3cn)
                 cxgb3i_c3cn_rx_credits(c3cn, read);
         }
         conn->rxdata_octets += read;
+
+        if (err) {
+                cxgb3i_log_info("conn 0x%p rx failed err %d.\n", conn, err);
+                iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+        }
 }
 
 void cxgb3i_conn_tx_open(struct s3_conn *c3cn)
diff --git a/drivers/scsi/cxgb3i/cxgb3i_pdu.h b/drivers/scsi/cxgb3i/cxgb3i_pdu.h
index a3f685cc2362..0770b23d90da 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_pdu.h
+++ b/drivers/scsi/cxgb3i/cxgb3i_pdu.h
@@ -53,7 +53,7 @@ struct cpl_rx_data_ddp_norss {
 #define ULP2_FLAG_DCRC_ERROR            0x20
 #define ULP2_FLAG_PAD_ERROR             0x40
 
-void cxgb3i_conn_closing(struct s3_conn *);
+void cxgb3i_conn_closing(struct s3_conn *c3cn);
 void cxgb3i_conn_pdu_ready(struct s3_conn *c3cn);
 void cxgb3i_conn_tx_open(struct s3_conn *c3cn);
 #endif
diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
index a48e4990fe12..34be88d7afa5 100644
--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -1251,6 +1251,7 @@ static struct pci_device_id hptiop_id_table[] = {
         { PCI_VDEVICE(TTI, 0x3530), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x3560), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x4322), (kernel_ulong_t)&hptiop_itl_ops },
+        { PCI_VDEVICE(TTI, 0x4321), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x4210), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x4211), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x4310), (kernel_ulong_t)&hptiop_itl_ops },
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 940dc32ff0dc..b82ffd90632e 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1040,12 +1040,11 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                                 action = ACTION_FAIL;
                         break;
                 case ABORTED_COMMAND:
+                        action = ACTION_FAIL;
                         if (sshdr.asc == 0x10) { /* DIF */
                                 description = "Target Data Integrity Failure";
-                                action = ACTION_FAIL;
                                 error = -EILSEQ;
-                        } else
-                                action = ACTION_RETRY;
+                        }
                         break;
                 case NOT_READY:
                         /* If the device is in the process of becoming
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index d57566b8be0a..55310dbc10a6 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -107,6 +107,7 @@ static void scsi_disk_release(struct device *cdev);
 static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *);
 static void sd_print_result(struct scsi_disk *, int);
 
+static DEFINE_SPINLOCK(sd_index_lock);
 static DEFINE_IDA(sd_index_ida);
 
 /* This semaphore is used to mediate the 0->1 reference get in the
@@ -1914,7 +1915,9 @@ static int sd_probe(struct device *dev)
                 if (!ida_pre_get(&sd_index_ida, GFP_KERNEL))
                         goto out_put;
 
+                spin_lock(&sd_index_lock);
                 error = ida_get_new(&sd_index_ida, &index);
+                spin_unlock(&sd_index_lock);
         } while (error == -EAGAIN);
 
         if (error)
@@ -1936,7 +1939,9 @@ static int sd_probe(struct device *dev)
         return 0;
 
  out_free_index:
+        spin_lock(&sd_index_lock);
         ida_remove(&sd_index_ida, index);
+        spin_unlock(&sd_index_lock);
  out_put:
         put_disk(gd);
  out_free:
@@ -1986,7 +1991,9 @@ static void scsi_disk_release(struct device *dev)
         struct scsi_disk *sdkp = to_scsi_disk(dev);
         struct gendisk *disk = sdkp->disk;
         
+        spin_lock(&sd_index_lock);
         ida_remove(&sd_index_ida, sdkp->index);
+        spin_unlock(&sd_index_lock);
 
         disk->private_data = NULL;
         put_disk(disk);
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index 3599828b9766..022e89ffec1d 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -133,7 +133,7 @@
 # define SCSPTR3        0xffed0024      /* 16 bit SCIF */
 # define SCSPTR4        0xffee0024      /* 16 bit SCIF */
 # define SCSPTR5        0xffef0024      /* 16 bit SCIF */
-# define SCIF_OPER      0x0001          /* Overrun error bit */
+# define SCIF_ORER      0x0001          /* Overrun error bit */
 # define SCSCR_INIT(port)       0x3a    /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */
 #elif defined(CONFIG_CPU_SUBTYPE_SH7201) || \
       defined(CONFIG_CPU_SUBTYPE_SH7203) || \
diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
index ab69c1bf36a8..c2747bc88c6f 100644
--- a/drivers/staging/panel/panel.c
+++ b/drivers/staging/panel/panel.c
@@ -2164,19 +2164,20 @@ static void __exit panel_cleanup_module(void)
         if (scan_timer.function != NULL)
                 del_timer(&scan_timer);
 
-        if (keypad_enabled)
-                misc_deregister(&keypad_dev);
+        if (pprt != NULL) {
+                if (keypad_enabled)
+                        misc_deregister(&keypad_dev);
+
+                if (lcd_enabled) {
+                        panel_lcd_print("\x0cLCD driver " PANEL_VERSION
+                                        "\nunloaded.\x1b[Lc\x1b[Lb\x1b[L-");
+                        misc_deregister(&lcd_dev);
+                }
 
-        if (lcd_enabled) {
-                panel_lcd_print("\x0cLCD driver " PANEL_VERSION
-                                "\nunloaded.\x1b[Lc\x1b[Lb\x1b[L-");
-                misc_deregister(&lcd_dev);
+                /* TODO: free all input signals */
+                parport_release(pprt);
+                parport_unregister_device(pprt);
         }
-
-        /* TODO: free all input signals */
-
-        parport_release(pprt);
-        parport_unregister_device(pprt);
         parport_unregister_driver(&panel_driver);
 }
 
diff --git a/drivers/staging/rtl8187se/Kconfig b/drivers/staging/rtl8187se/Kconfig
index 79c225acd1ad..f636296b54bc 100644
--- a/drivers/staging/rtl8187se/Kconfig
+++ b/drivers/staging/rtl8187se/Kconfig
@@ -1,5 +1,6 @@
 config RTL8187SE
         tristate "RealTek RTL8187SE Wireless LAN NIC driver"
         depends on PCI
+        depends on WIRELESS_EXT && COMPAT_NET_DEV_OPS
         default N
         ---help---
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
index af64cfbe16db..7370296225e1 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
@@ -234,20 +234,21 @@ out:
 void ieee80211_crypto_deinit(void)
 {
         struct list_head *ptr, *n;
+        struct ieee80211_crypto_alg *alg = NULL;
 
         if (hcrypt == NULL)
                 return;
 
-        for (ptr = hcrypt->algs.next, n = ptr->next; ptr != &hcrypt->algs;
-             ptr = n, n = ptr->next) {
-                struct ieee80211_crypto_alg *alg =
-                        (struct ieee80211_crypto_alg *) ptr;
-                list_del(ptr);
-                printk(KERN_DEBUG "ieee80211_crypt: unregistered algorithm "
-                       "'%s' (deinit)\n", alg->ops->name);
-                kfree(alg);
+        list_for_each_safe(ptr, n, &hcrypt->algs) {
+                alg = list_entry(ptr, struct ieee80211_crypto_alg, list);
+                if (alg) {
+                        list_del(ptr);
+                        printk(KERN_DEBUG
+                               "ieee80211_crypt: unregistered algorithm '%s' (deinit)\n",
+                               alg->ops->name);
+                        kfree(alg);
+                }
         }
-
         kfree(hcrypt);
 }
 
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index 94534955e38b..66de5cc8ddf1 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -6161,10 +6161,10 @@ static void __exit rtl8180_pci_module_exit(void)
 {
         pci_unregister_driver (&rtl8180_pci_driver);
         rtl8180_proc_module_remove();
-        ieee80211_crypto_deinit();
         ieee80211_crypto_tkip_exit();
         ieee80211_crypto_ccmp_exit();
         ieee80211_crypto_wep_exit();
+        ieee80211_crypto_deinit();
         DMESG("Exiting");
 }
 
diff --git a/drivers/staging/winbond/wbusb.c b/drivers/staging/winbond/wbusb.c
index b003f9a7e151..f716b2e92b65 100644
--- a/drivers/staging/winbond/wbusb.c
+++ b/drivers/staging/winbond/wbusb.c
@@ -319,16 +319,18 @@ static int wb35_probe(struct usb_interface *intf, const struct usb_device_id *id
         struct usb_device *udev = interface_to_usbdev(intf);
         struct wbsoft_priv *priv;
         struct ieee80211_hw *dev;
-        int err;
+        int nr, err;
 
         usb_get_dev(udev);
 
         // 20060630.2 Check the device if it already be opened
-        err = usb_control_msg(udev, usb_rcvctrlpipe( udev, 0 ),
-                              0x01, USB_TYPE_VENDOR|USB_RECIP_DEVICE|USB_DIR_IN,
-                              0x0, 0x400, &ltmp, 4, HZ*100 );
-        if (err)
+        nr = usb_control_msg(udev, usb_rcvctrlpipe( udev, 0 ),
+                             0x01, USB_TYPE_VENDOR|USB_RECIP_DEVICE|USB_DIR_IN,
+                             0x0, 0x400, &ltmp, 4, HZ*100 );
+        if (nr < 0) {
+                err = nr;
                 goto error;
+        }
 
         ltmp = cpu_to_le32(ltmp);
         if (ltmp) {  // Is already initialized?
@@ -337,8 +339,10 @@ static int wb35_probe(struct usb_interface *intf, const struct usb_device_id *id
         }
 
         dev = ieee80211_alloc_hw(sizeof(*priv), &wbsoft_ops);
-        if (!dev)
+        if (!dev) {
+                err = -ENOMEM;
                 goto error;
+        }
 
         priv = dev->priv;
 
@@ -369,9 +373,11 @@ static int wb35_probe(struct usb_interface *intf, const struct usb_device_id *id
         }
 
         dev->extra_tx_headroom = 12;    /* FIXME */
-        dev->flags = 0;
+        dev->flags = IEEE80211_HW_SIGNAL_UNSPEC;
+        dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
 
         dev->channel_change_time = 1000;
+        dev->max_signal = 100;
         dev->queues = 1;
 
         dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &wbsoft_band_2GHz;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 326dd7f65ee9..b3d5a23ab56f 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1376,6 +1376,15 @@ static struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1324), /* Conexant USB MODEM RD02-D400 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
+        },
+        { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
+        .driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
+                                           data interface instead of
+                                           communications interface.
+                                           Maybe we should define a new
+                                           quirk for this. */
+        },
 
         /* control interfaces with various AT-command sets */
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 31fb204f44c6..49e7f56e0d7f 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -653,7 +653,7 @@ int usb_get_descriptor(struct usb_device *dev, unsigned char type,
                 if (result <= 0 && result != -ETIMEDOUT)
                         continue;
                 if (result > 1 && ((u8 *)buf)[1] != type) {
-                        result = -EPROTO;
+                        result = -ENODATA;
                         continue;
                 }
                 break;
@@ -696,8 +696,13 @@ static int usb_get_string(struct usb_device *dev, unsigned short langid,
                         USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
                         (USB_DT_STRING << 8) + index, langid, buf, size,
                         USB_CTRL_GET_TIMEOUT);
-                if (!(result == 0 || result == -EPIPE))
-                        break;
+                if (result == 0 || result == -EPIPE)
+                        continue;
+                if (result > 1 && ((u8 *) buf)[1] != USB_DT_STRING) {
+                        result = -ENODATA;
+                        continue;
+                }
+                break;
         }
         return result;
 }
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 3219d137340a..e55fef52a5dc 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -191,6 +191,7 @@ config USB_GADGET_OMAP
         boolean "OMAP USB Device Controller"
         depends on ARCH_OMAP
         select ISP1301_OMAP if MACH_OMAP_H2 || MACH_OMAP_H3 || MACH_OMAP_H4_OTG
+        select USB_OTG_UTILS if ARCH_OMAP
         help
            Many Texas Instruments OMAP processors have flexible full
            speed USB device controllers, with support for up to 30
diff --git a/drivers/usb/gadget/f_obex.c b/drivers/usb/gadget/f_obex.c
index 80c2e7e9622f..38aa896cc5db 100644
--- a/drivers/usb/gadget/f_obex.c
+++ b/drivers/usb/gadget/f_obex.c
@@ -366,9 +366,9 @@ obex_bind(struct usb_configuration *c, struct usb_function *f)
                 f->hs_descriptors = usb_copy_descriptors(hs_function);
 
                 obex->hs.obex_in = usb_find_endpoint(hs_function,
-                                f->descriptors, &obex_hs_ep_in_desc);
+                                f->hs_descriptors, &obex_hs_ep_in_desc);
                 obex->hs.obex_out = usb_find_endpoint(hs_function,
-                                f->descriptors, &obex_hs_ep_out_desc);
+                                f->hs_descriptors, &obex_hs_ep_out_desc);
         }
 
         /* Avoid letting this gadget enumerate until the userspace
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index b10fa31cc915..1ab9dac7e12d 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -3879,7 +3879,11 @@ static int __init check_parameters(struct fsg_dev *fsg)
         mod_data.protocol_type = USB_SC_SCSI;
         mod_data.protocol_name = "Transparent SCSI";
 
-        if (gadget_is_sh(fsg->gadget))
+        /* Some peripheral controllers are known not to be able to
+         * halt bulk endpoints correctly.  If one of them is present,
+         * disable stalls.
+         */
+        if (gadget_is_sh(fsg->gadget) || gadget_is_at91(fsg->gadget))
                 mod_data.can_stall = 0;
 
         if (mod_data.release == 0xffff) {       // Parameter wasn't set
diff --git a/drivers/usb/gadget/fsl_usb2_udc.c b/drivers/usb/gadget/fsl_usb2_udc.c
index f3c6703cffda..d8d9a52a44b3 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.c
+++ b/drivers/usb/gadget/fsl_usb2_udc.c
@@ -404,7 +404,10 @@ static void struct_ep_qh_setup(struct fsl_udc *udc, unsigned char ep_num,
         }
         if (zlt)
                 tmp |= EP_QUEUE_HEAD_ZLT_SEL;
+
         p_QH->max_pkt_length = cpu_to_le32(tmp);
+        p_QH->next_dtd_ptr = 1;
+        p_QH->size_ioc_int_sts = 0;
 
         return;
 }
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 4725d15d096f..e551bb38852b 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -485,6 +485,7 @@ static int ehci_init(struct usb_hcd *hcd)
          * periodic_size can shrink by USBCMD update if hcc_params allows.
          */
         ehci->periodic_size = DEFAULT_I_TDPS;
+        INIT_LIST_HEAD(&ehci->cached_itd_list);
         if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
                 return retval;
 
@@ -497,6 +498,7 @@ static int ehci_init(struct usb_hcd *hcd)
 
         ehci->reclaim = NULL;
         ehci->next_uframe = -1;
+        ehci->clock_frame = -1;
 
         /*
          * dedicate a qh for the async ring head, since we couldn't unlink
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index 0431397836f6..10d52919abbb 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -128,6 +128,7 @@ static inline void qh_put (struct ehci_qh *qh)
 
 static void ehci_mem_cleanup (struct ehci_hcd *ehci)
 {
+        free_cached_itd_list(ehci);
         if (ehci->async)
                 qh_put (ehci->async);
         ehci->async = NULL;
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index a081ee65bde6..07bcb931021b 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1004,7 +1004,8 @@ iso_stream_put(struct ehci_hcd *ehci, struct ehci_iso_stream *stream)
 
                 is_in = (stream->bEndpointAddress & USB_DIR_IN) ? 0x10 : 0;
                 stream->bEndpointAddress &= 0x0f;
-                stream->ep->hcpriv = NULL;
+                if (stream->ep)
+                        stream->ep->hcpriv = NULL;
 
                 if (stream->rescheduled) {
                         ehci_info (ehci, "ep%d%s-iso rescheduled "
@@ -1653,14 +1654,28 @@ itd_complete (
                         (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
         }
         iso_stream_put (ehci, stream);
-        /* OK to recycle this ITD now that its completion callback ran. */
+
 done:
         usb_put_urb(urb);
         itd->urb = NULL;
-        itd->stream = NULL;
-        list_move(&itd->itd_list, &stream->free_list);
-        iso_stream_put(ehci, stream);
-
+        if (ehci->clock_frame != itd->frame || itd->index[7] != -1) {
+                /* OK to recycle this ITD now. */
+                itd->stream = NULL;
+                list_move(&itd->itd_list, &stream->free_list);
+                iso_stream_put(ehci, stream);
+        } else {
+                /* HW might remember this ITD, so we can't recycle it yet.
+                 * Move it to a safe place until a new frame starts.
+                 */
+                list_move(&itd->itd_list, &ehci->cached_itd_list);
+                if (stream->refcount == 2) {
+                        /* If iso_stream_put() were called here, stream
+                         * would be freed.  Instead, just prevent reuse.
+                         */
+                        stream->ep->hcpriv = NULL;
+                        stream->ep = NULL;
+                }
+        }
         return retval;
 }
 
@@ -2101,6 +2116,20 @@ done:
 
 /*-------------------------------------------------------------------------*/
 
+static void free_cached_itd_list(struct ehci_hcd *ehci)
+{
+        struct ehci_itd *itd, *n;
+
+        list_for_each_entry_safe(itd, n, &ehci->cached_itd_list, itd_list) {
+                struct ehci_iso_stream  *stream = itd->stream;
+                itd->stream = NULL;
+                list_move(&itd->itd_list, &stream->free_list);
+                iso_stream_put(ehci, stream);
+        }
+}
+
+/*-------------------------------------------------------------------------*/
+
 static void
 scan_periodic (struct ehci_hcd *ehci)
 {
@@ -2115,10 +2144,17 @@ scan_periodic (struct ehci_hcd *ehci)
          * Touches as few pages as possible:  cache-friendly.
          */
         now_uframe = ehci->next_uframe;
-        if (HC_IS_RUNNING (ehci_to_hcd(ehci)->state))
+        if (HC_IS_RUNNING(ehci_to_hcd(ehci)->state)) {
                 clock = ehci_readl(ehci, &ehci->regs->frame_index);
-        else
+                clock_frame = (clock >> 3) % ehci->periodic_size;
+        } else  {
                 clock = now_uframe + mod - 1;
+                clock_frame = -1;
+        }
+        if (ehci->clock_frame != clock_frame) {
+                free_cached_itd_list(ehci);
+                ehci->clock_frame = clock_frame;
+        }
         clock %= mod;
         clock_frame = clock >> 3;
 
@@ -2277,6 +2313,10 @@ restart:
                         /* rescan the rest of this frame, then ... */
                         clock = now;
                         clock_frame = clock >> 3;
+                        if (ehci->clock_frame != clock_frame) {
+                                free_cached_itd_list(ehci);
+                                ehci->clock_frame = clock_frame;
+                        }
                 } else {
                         now_uframe++;
                         now_uframe %= mod;
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index fb7054ccf4fc..262b00c9b334 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -87,6 +87,10 @@ struct ehci_hcd {			/* one per controller */
         int                     next_uframe;    /* scan periodic, start here */
         unsigned                periodic_sched; /* periodic activity count */
 
+        /* list of itds completed while clock_frame was still active */
+        struct list_head        cached_itd_list;
+        unsigned                clock_frame;
+
         /* per root hub port */
         unsigned long           reset_done [EHCI_MAX_ROOT_PORTS];
 
@@ -220,6 +224,8 @@ timer_action (struct ehci_hcd *ehci, enum ehci_timer_action action)
         }
 }
 
+static void free_cached_itd_list(struct ehci_hcd *ehci);
+
 /*-------------------------------------------------------------------------*/
 
 #include <linux/usb/ehci_def.h>
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 5a8fd5d57a11..2dc7606f319c 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -377,18 +377,8 @@ int __init musb_platform_init(struct musb *musb)
         u32             revision;
 
         musb->mregs += DAVINCI_BASE_OFFSET;
-#if 0
-        /* REVISIT there's something odd about clocking, this
-         * didn't appear do the job ...
-         */
-        musb->clock = clk_get(pDevice, "usb");
-        if (IS_ERR(musb->clock))
-                return PTR_ERR(musb->clock);
 
-        status = clk_enable(musb->clock);
-        if (status < 0)
-                return -ENODEV;
-#endif
+        clk_enable(musb->clock);
 
         /* returns zero if e.g. not clocked */
         revision = musb_readl(tibase, DAVINCI_USB_VERSION_REG);
@@ -453,5 +443,8 @@ int musb_platform_exit(struct musb *musb)
         }
 
         phy_off();
+
+        clk_disable(musb->clock);
+
         return 0;
 }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 2cc34fa05b73..af77e4659006 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -115,7 +115,7 @@
 
 
 unsigned musb_debug;
-module_param(musb_debug, uint, S_IRUGO | S_IWUSR);
+module_param_named(debug, musb_debug, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Debug message level. Default = 0");
 
 #define DRIVER_AUTHOR "Mentor Graphics, Texas Instruments, Nokia"
@@ -767,6 +767,7 @@ static irqreturn_t musb_stage2_irq(struct musb *musb, u8 int_usb,
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
                 case OTG_STATE_A_HOST:
                 case OTG_STATE_A_SUSPEND:
+                        usb_hcd_resume_root_hub(musb_to_hcd(musb));
                         musb_root_disconnect(musb);
                         if (musb->a_wait_bcon != 0)
                                 musb_platform_try_idle(musb, jiffies
@@ -1815,7 +1816,7 @@ static void musb_free(struct musb *musb)
 #ifdef CONFIG_SYSFS
         device_remove_file(musb->controller, &dev_attr_mode);
         device_remove_file(musb->controller, &dev_attr_vbus);
-#ifdef CONFIG_USB_MUSB_OTG
+#ifdef CONFIG_USB_GADGET_MUSB_HDRC
         device_remove_file(musb->controller, &dev_attr_srp);
 #endif
 #endif
@@ -2063,7 +2064,7 @@ fail2:
 #ifdef CONFIG_SYSFS
         device_remove_file(musb->controller, &dev_attr_mode);
         device_remove_file(musb->controller, &dev_attr_vbus);
-#ifdef CONFIG_USB_MUSB_OTG
+#ifdef CONFIG_USB_GADGET_MUSB_HDRC
         device_remove_file(musb->controller, &dev_attr_srp);
 #endif
 #endif
@@ -2243,10 +2244,10 @@ static int __init musb_init(void)
         return platform_driver_probe(&musb_driver, musb_probe);
 }
 
-/* make us init after usbcore and before usb
- * gadget and host-side drivers start to register
+/* make us init after usbcore and i2c (transceivers, regulators, etc)
+ * and before usb gadget and host-side drivers start to register
  */
-subsys_initcall(musb_init);
+fs_initcall(musb_init);
 
 static void __exit musb_cleanup(void)
 {
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 4ea305387981..c7ebd0867fcc 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -575,7 +575,7 @@ static void rxstate(struct musb *musb, struct musb_request *req)
         struct usb_request      *request = &req->request;
         struct musb_ep          *musb_ep = &musb->endpoints[epnum].ep_out;
         void __iomem            *epio = musb->endpoints[epnum].regs;
-        u16                     fifo_count = 0;
+        unsigned                fifo_count = 0;
         u16                     len = musb_ep->packet_sz;
 
         csr = musb_readw(epio, MUSB_RXCSR);
@@ -687,7 +687,7 @@ static void rxstate(struct musb *musb, struct musb_request *req)
                                         len, fifo_count,
                                         musb_ep->packet_sz);
 
-                        fifo_count = min(len, fifo_count);
+                        fifo_count = min_t(unsigned, len, fifo_count);
 
 #ifdef  CONFIG_USB_TUSB_OMAP_DMA
                         if (tusb_dma_omap() && musb_ep->dma) {
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index a035ceccf950..6dbbd0786a6a 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -335,16 +335,11 @@ musb_save_toggle(struct musb_hw_ep *ep, int is_in, struct urb *urb)
 static struct musb_qh *
 musb_giveback(struct musb_qh *qh, struct urb *urb, int status)
 {
-        int                     is_in;
         struct musb_hw_ep       *ep = qh->hw_ep;
         struct musb             *musb = ep->musb;
+        int                     is_in = usb_pipein(urb->pipe);
         int                     ready = qh->is_ready;
 
-        if (ep->is_shared_fifo)
-                is_in = 1;
-        else
-                is_in = usb_pipein(urb->pipe);
-
         /* save toggle eagerly, for paranoia */
         switch (qh->type) {
         case USB_ENDPOINT_XFER_BULK:
@@ -432,7 +427,7 @@ musb_advance_schedule(struct musb *musb, struct urb *urb,
         else
                 qh = musb_giveback(qh, urb, urb->status);
 
-        if (qh && qh->is_ready && !list_empty(&qh->hep->urb_list)) {
+        if (qh != NULL && qh->is_ready) {
                 DBG(4, "... next ep%d %cX urb %p\n",
                                 hw_ep->epnum, is_in ? 'R' : 'T',
                                 next_urb(qh));
@@ -942,8 +937,8 @@ static bool musb_h_ep0_continue(struct musb *musb, u16 len, struct urb *urb)
         switch (musb->ep0_stage) {
         case MUSB_EP0_IN:
                 fifo_dest = urb->transfer_buffer + urb->actual_length;
-                fifo_count = min(len, ((u16) (urb->transfer_buffer_length
-                                        - urb->actual_length)));
+                fifo_count = min_t(size_t, len, urb->transfer_buffer_length -
+                                   urb->actual_length);
                 if (fifo_count < len)
                         urb->status = -EOVERFLOW;
 
@@ -976,10 +971,9 @@ static bool musb_h_ep0_continue(struct musb *musb, u16 len, struct urb *urb)
                 }
                 /* FALLTHROUGH */
         case MUSB_EP0_OUT:
-                fifo_count = min(qh->maxpacket, ((u16)
-                                (urb->transfer_buffer_length
-                                - urb->actual_length)));
-
+                fifo_count = min_t(size_t, qh->maxpacket,
+                                   urb->transfer_buffer_length -
+                                   urb->actual_length);
                 if (fifo_count) {
                         fifo_dest = (u8 *) (urb->transfer_buffer
                                         + urb->actual_length);
@@ -1161,7 +1155,8 @@ void musb_host_tx(struct musb *musb, u8 epnum)
         struct urb              *urb;
         struct musb_hw_ep       *hw_ep = musb->endpoints + epnum;
         void __iomem            *epio = hw_ep->regs;
-        struct musb_qh          *qh = hw_ep->out_qh;
+        struct musb_qh          *qh = hw_ep->is_shared_fifo ? hw_ep->in_qh
+                                                            : hw_ep->out_qh;
         u32                     status = 0;
         void __iomem            *mbase = musb->mregs;
         struct dma_channel      *dma;
@@ -1308,7 +1303,8 @@ void musb_host_tx(struct musb *musb, u8 epnum)
                  * packets before updating TXCSR ... other docs disagree ...
                  */
                 /* PIO:  start next packet in this URB */
-                wLength = min(qh->maxpacket, (u16) wLength);
+                if (wLength > qh->maxpacket)
+                        wLength = qh->maxpacket;
                 musb_write_fifo(hw_ep, wLength, buf);
                 qh->segsize = wLength;
 
@@ -1867,19 +1863,21 @@ static int musb_urb_enqueue(
         }
         qh->type_reg = type_reg;
 
-        /* precompute rxinterval/txinterval register */
-        interval = min((u8)16, epd->bInterval); /* log encoding */
+        /* Precompute RXINTERVAL/TXINTERVAL register */
         switch (qh->type) {
         case USB_ENDPOINT_XFER_INT:
-                /* fullspeed uses linear encoding */
-                if (USB_SPEED_FULL == urb->dev->speed) {
-                        interval = epd->bInterval;
-                        if (!interval)
-                                interval = 1;
+                /*
+                 * Full/low speeds use the  linear encoding,
+                 * high speed uses the logarithmic encoding.
+                 */
+                if (urb->dev->speed <= USB_SPEED_FULL) {
+                        interval = max_t(u8, epd->bInterval, 1);
+                        break;
                 }
                 /* FALLTHROUGH */
         case USB_ENDPOINT_XFER_ISOC:
-                /* iso always uses log encoding */
+                /* ISO always uses logarithmic encoding */
+                interval = min_t(u8, epd->bInterval, 16);
                 break;
         default:
                 /* REVISIT we actually want to use NAK limits, hinting to the
@@ -2037,9 +2035,9 @@ static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 goto done;
 
         /* Any URB not actively programmed into endpoint hardware can be
-         * immediately given back.  Such an URB must be at the head of its
+         * immediately given back; that's any URB not at the head of an
          * endpoint queue, unless someday we get real DMA queues.  And even
-         * then, it might not be known to the hardware...
+         * if it's at the head, it might not be known to the hardware...
          *
          * Otherwise abort current transfer, pending dma, etc.; urb->status
          * has already been updated.  This is a synchronous abort; it'd be
@@ -2078,6 +2076,15 @@ static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 qh->is_ready = 0;
                 __musb_giveback(musb, urb, 0);
                 qh->is_ready = ready;
+
+                /* If nothing else (usually musb_giveback) is using it
+                 * and its URB list has emptied, recycle this qh.
+                 */
+                if (ready && list_empty(&qh->hep->urb_list)) {
+                        qh->hep->hcpriv = NULL;
+                        list_del(&qh->ring);
+                        kfree(qh);
+                }
         } else
                 ret = musb_cleanup_urb(urb, qh, urb->pipe & USB_DIR_IN);
 done:
@@ -2093,15 +2100,16 @@ musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
         unsigned long           flags;
         struct musb             *musb = hcd_to_musb(hcd);
         u8                      is_in = epnum & USB_DIR_IN;
-        struct musb_qh          *qh = hep->hcpriv;
-        struct urb              *urb, *tmp;
+        struct musb_qh          *qh;
+        struct urb              *urb;
         struct list_head        *sched;
 
-        if (!qh)
-                return;
-
         spin_lock_irqsave(&musb->lock, flags);
 
+        qh = hep->hcpriv;
+        if (qh == NULL)
+                goto exit;
+
         switch (qh->type) {
         case USB_ENDPOINT_XFER_CONTROL:
                 sched = &musb->control;
@@ -2135,13 +2143,28 @@ musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
 
                 /* cleanup */
                 musb_cleanup_urb(urb, qh, urb->pipe & USB_DIR_IN);
-        } else
-                urb = NULL;
 
-        /* then just nuke all the others */
-        list_for_each_entry_safe_from(urb, tmp, &hep->urb_list, urb_list)
-                musb_giveback(qh, urb, -ESHUTDOWN);
+                /* Then nuke all the others ... and advance the
+                 * queue on hw_ep (e.g. bulk ring) when we're done.
+                 */
+                while (!list_empty(&hep->urb_list)) {
+                        urb = next_urb(qh);
+                        urb->status = -ESHUTDOWN;
+                        musb_advance_schedule(musb, urb, qh->hw_ep, is_in);
+                }
+        } else {
+                /* Just empty the queue; the hardware is busy with
+                 * other transfers, and since !qh->is_ready nothing
+                 * will activate any of these as it advances.
+                 */
+                while (!list_empty(&hep->urb_list))
+                        __musb_giveback(musb, next_urb(qh), -ESHUTDOWN);
 
+                hep->hcpriv = NULL;
+                list_del(&qh->ring);
+                kfree(qh);
+        }
+exit:
         spin_unlock_irqrestore(&musb->lock, flags);
 }
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index bfd0b68ceccd..b7c132bded7f 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -294,7 +294,11 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 
 /* Ericsson products */
 #define ERICSSON_VENDOR_ID                      0x0bdb
-#define ERICSSON_PRODUCT_F3507G                 0x1900
+#define ERICSSON_PRODUCT_F3507G_1               0x1900
+#define ERICSSON_PRODUCT_F3507G_2               0x1902
+
+#define BENQ_VENDOR_ID                          0x04a5
+#define BENQ_PRODUCT_H10                        0x4068
 
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
@@ -509,7 +513,10 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626) },
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
-        { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) },
+        { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G_1) },
+        { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G_2) },
+        { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+        { USB_DEVICE(0x1da5, 0x4515) }, /* BenQ H20 */
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 50dc33a6065b..6f59c8e510ea 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -907,13 +907,13 @@ UNUSUAL_DEV(  0x05e3, 0x0701, 0x0000, 0xffff,
                 "Genesys Logic",
                 "USB to IDE Optical",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ),
+                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 | US_FL_IGNORE_RESIDUE ),
 
 UNUSUAL_DEV(  0x05e3, 0x0702, 0x0000, 0xffff,
                 "Genesys Logic",
                 "USB to IDE Disk",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ),
+                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 | US_FL_IGNORE_RESIDUE ),
 
 /* Reported by Ben Efros <ben@pc-doctor.com> */
 UNUSUAL_DEV(  0x05e3, 0x0723, 0x9451, 0x9451,
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index 2181ce4d7ebd..35e8eb02b9e9 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1853,13 +1853,14 @@ static void aty128_bl_exit(struct backlight_device *bd)
  *  Initialisation
  */
 
-#ifdef CONFIG_PPC_PMAC
+#ifdef CONFIG_PPC_PMAC__disabled
 static void aty128_early_resume(void *data)
 {
         struct aty128fb_par *par = data;
 
         if (try_acquire_console_sem())
                 return;
+        pci_restore_state(par->pdev);
         aty128_do_resume(par->pdev);
         release_console_sem();
 }
@@ -1907,7 +1908,14 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
                 /* Indicate sleep capability */
                 if (par->chip_gen == rage_M3) {
                         pmac_call_feature(PMAC_FTR_DEVICE_CAN_WAKE, NULL, 0, 1);
+#if 0 /* Disable the early video resume hack for now as it's causing problems, among
+       * others we now rely on the PCI core restoring the config space for us, which
+       * isn't the case with that hack, and that code path causes various things to
+       * be called with interrupts off while they shouldn't. I'm leaving the code in
+       * as it can be useful for debugging purposes
+       */
                         pmac_set_early_video_resume(aty128_early_resume, par);
+#endif
                 }
 
                 /* Find default mode */
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index ca5f0dc28546..81603f85e17e 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -2762,12 +2762,13 @@ int radeonfb_pci_resume(struct pci_dev *pdev)
         return rc;
 }
 
-#ifdef CONFIG_PPC_OF
+#ifdef CONFIG_PPC_OF__disabled
 static void radeonfb_early_resume(void *data)
 {
         struct radeonfb_info *rinfo = data;
 
         rinfo->no_schedule = 1;
+        pci_restore_state(rinfo->pdev);
         radeonfb_pci_resume(rinfo->pdev);
         rinfo->no_schedule = 0;
 }
@@ -2834,7 +2835,14 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk, int ignore_devlis
                  */
                 if (rinfo->pm_mode != radeon_pm_none) {
                         pmac_call_feature(PMAC_FTR_DEVICE_CAN_WAKE, rinfo->of_node, 0, 1);
+#if 0 /* Disable the early video resume hack for now as it's causing problems, among
+       * others we now rely on the PCI core restoring the config space for us, which
+       * isn't the case with that hack, and that code path causes various things to
+       * be called with interrupts off while they shouldn't. I'm leaving the code in
+       * as it can be useful for debugging purposes
+       */
                         pmac_set_early_video_resume(radeonfb_early_resume, rinfo);
+#endif
                 }
 
 #if 0
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
index a24e680d2b9c..2e940199fc89 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/i810/i810_main.c
@@ -993,6 +993,7 @@ static int i810_check_params(struct fb_var_screeninfo *var,
         struct i810fb_par *par = info->par;
         int line_length, vidmem, mode_valid = 0, retval = 0;
         u32 vyres = var->yres_virtual, vxres = var->xres_virtual;
+
         /*
          *  Memory limit
          */
@@ -1002,12 +1003,12 @@ static int i810_check_params(struct fb_var_screeninfo *var,
         if (vidmem > par->fb.size) {
                 vyres = par->fb.size/line_length;
                 if (vyres < var->yres) {
-                        vyres = yres;
+                        vyres = info->var.yres;
                         vxres = par->fb.size/vyres;
                         vxres /= var->bits_per_pixel >> 3;
                         line_length = get_line_length(par, vxres, 
                                                       var->bits_per_pixel);
-                        vidmem = line_length * yres;
+                        vidmem = line_length * info->var.yres;
                         if (vxres < var->xres) {
                                 printk("i810fb: required video memory, "
                                        "%d bytes, for %dx%d-%d (virtual) "
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 48ff701d3a72..2552b9f325ee 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -2230,7 +2230,7 @@ static int __devexit pxafb_remove(struct platform_device *dev)
 
 static struct platform_driver pxafb_driver = {
         .probe          = pxafb_probe,
-        .remove         = pxafb_remove,
+        .remove         = __devexit_p(pxafb_remove),
         .suspend        = pxafb_suspend,
         .resume         = pxafb_resume,
         .driver         = {
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 0e2b8fd24df1..2c5d069e5f06 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -446,7 +446,6 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
 {
         struct sh_mobile_lcdc_chan *ch;
         struct sh_mobile_lcdc_board_cfg *board_cfg;
-        unsigned long tmp;
         int k;
 
         /* tell the board code to disable the panel */
@@ -456,9 +455,8 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
                 if (board_cfg->display_off)
                         board_cfg->display_off(board_cfg->board_data);
 
-                /* cleanup deferred io if SYS bus */
-                tmp = ch->cfg.sys_bus_cfg.deferred_io_msec;
-                if (ch->ldmt1r_value & (1 << 12) && tmp) {
+                /* cleanup deferred io if enabled */
+                if (ch->info.fbdefio) {
                         fb_deferred_io_cleanup(&ch->info);
                         ch->info.fbdefio = NULL;
                 }
diff --git a/drivers/w1/masters/w1-gpio.c b/drivers/w1/masters/w1-gpio.c
index 9e1138a75e8b..a411702413d6 100644
--- a/drivers/w1/masters/w1-gpio.c
+++ b/drivers/w1/masters/w1-gpio.c
@@ -39,7 +39,7 @@ static u8 w1_gpio_read_bit(void *data)
 {
         struct w1_gpio_platform_data *pdata = data;
 
-        return gpio_get_value(pdata->pin);
+        return gpio_get_value(pdata->pin) ? 1 : 0;
 }
 
 static int __init w1_gpio_probe(struct platform_device *pdev)
diff --git a/drivers/w1/slaves/Kconfig b/drivers/w1/slaves/Kconfig
index 8d0b1fb1e52e..1f51366417b9 100644
--- a/drivers/w1/slaves/Kconfig
+++ b/drivers/w1/slaves/Kconfig
@@ -16,6 +16,12 @@ config W1_SLAVE_SMEM
           Say Y here if you want to connect 1-wire
           simple 64bit memory rom(ds2401/ds2411/ds1990*) to your wire.
 
+config W1_SLAVE_DS2431
+        tristate "1kb EEPROM family support (DS2431)"
+        help
+          Say Y here if you want to use a 1-wire
+          1kb EEPROM family device (DS2431)
+
 config W1_SLAVE_DS2433
         tristate "4kb EEPROM family support (DS2433)"
         help
diff --git a/drivers/w1/slaves/Makefile b/drivers/w1/slaves/Makefile
index 990f400b6d22..f1f51f19b129 100644
--- a/drivers/w1/slaves/Makefile
+++ b/drivers/w1/slaves/Makefile
@@ -4,6 +4,7 @@
 
 obj-$(CONFIG_W1_SLAVE_THERM)    += w1_therm.o
 obj-$(CONFIG_W1_SLAVE_SMEM)     += w1_smem.o
+obj-$(CONFIG_W1_SLAVE_DS2431)   += w1_ds2431.o
 obj-$(CONFIG_W1_SLAVE_DS2433)   += w1_ds2433.o
 obj-$(CONFIG_W1_SLAVE_DS2760)   += w1_ds2760.o
 obj-$(CONFIG_W1_SLAVE_BQ27000)  += w1_bq27000.o
diff --git a/drivers/w1/slaves/w1_ds2433.c b/drivers/w1/slaves/w1_ds2433.c
index 858c16a544c2..139447148822 100644
--- a/drivers/w1/slaves/w1_ds2433.c
+++ b/drivers/w1/slaves/w1_ds2433.c
@@ -156,6 +156,9 @@ out_up:
  */
 static int w1_f23_write(struct w1_slave *sl, int addr, int len, const u8 *data)
 {
+#ifdef CONFIG_W1_SLAVE_DS2433_CRC
+        struct w1_f23_data *f23 = sl->family_data;
+#endif
         u8 wrbuf[4];
         u8 rdbuf[W1_PAGE_SIZE + 3];
         u8 es = (addr + len - 1) & 0x1f;
@@ -196,7 +199,9 @@ static int w1_f23_write(struct w1_slave *sl, int addr, int len, const u8 *data)
 
         /* Reset the bus to wake up the EEPROM (this may not be needed) */
         w1_reset_bus(sl->master);
-
+#ifdef CONFIG_W1_SLAVE_DS2433_CRC
+        f23->validcrc &= ~(1 << (addr >> W1_PAGE_BITS));
+#endif
         return 0;
 }
 
diff --git a/drivers/watchdog/gef_wdt.c b/drivers/watchdog/gef_wdt.c
index f0c2b7a1a175..734d9806a872 100644
--- a/drivers/watchdog/gef_wdt.c
+++ b/drivers/watchdog/gef_wdt.c
@@ -269,7 +269,7 @@ static int __devinit gef_wdt_probe(struct of_device *dev,
         bus_clk = 133; /* in MHz */
 
         freq = fsl_get_sys_freq();
-        if (freq > 0)
+        if (freq != -1)
                 bus_clk = freq;
 
         /* Map devices registers into memory */
diff --git a/drivers/watchdog/ks8695_wdt.c b/drivers/watchdog/ks8695_wdt.c
index 0b798fdaa378..74c92d384112 100644
--- a/drivers/watchdog/ks8695_wdt.c
+++ b/drivers/watchdog/ks8695_wdt.c
@@ -21,6 +21,7 @@
 #include <linux/watchdog.h>
 #include <linux/io.h>
 #include <linux/uaccess.h>
+#include <mach/timex.h>
 #include <mach/regs-timer.h>
 
 #define WDT_DEFAULT_TIME        5       /* seconds */
diff --git a/drivers/watchdog/orion5x_wdt.c b/drivers/watchdog/orion5x_wdt.c
index 14a339f58b6a..b64ae1a17832 100644
--- a/drivers/watchdog/orion5x_wdt.c
+++ b/drivers/watchdog/orion5x_wdt.c
@@ -29,6 +29,7 @@
 #define  WDT_EN                 0x0010
 #define WDT_VAL                 (TIMER_VIRT_BASE + 0x0024)
 
+#define ORION5X_TCLK            166666667
 #define WDT_MAX_DURATION        (0xffffffff / ORION5X_TCLK)
 #define WDT_IN_USE              0
 #define WDT_OK_TO_CLOSE         1
diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c
index 57027f4653ce..f3553fa40b17 100644
--- a/drivers/watchdog/rc32434_wdt.c
+++ b/drivers/watchdog/rc32434_wdt.c
@@ -34,104 +34,89 @@
 #include <asm/time.h>
 #include <asm/mach-rc32434/integ.h>
 
-#define MAX_TIMEOUT                     20
-#define RC32434_WDT_INTERVAL            (15 * HZ)
-
-#define VERSION "0.2"
+#define VERSION "0.4"
 
 static struct {
-        struct completion stop;
-        int running;
-        struct timer_list timer;
-        int queue;
-        int default_ticks;
         unsigned long inuse;
 } rc32434_wdt_device;
 
 static struct integ __iomem *wdt_reg;
-static int ticks = 100 * HZ;
 
 static int expect_close;
-static int timeout;
+
+/* Board internal clock speed in Hz,
+ * the watchdog timer ticks at. */
+extern unsigned int idt_cpu_freq;
+
+/* translate wtcompare value to seconds and vice versa */
+#define WTCOMP2SEC(x)   (x / idt_cpu_freq)
+#define SEC2WTCOMP(x)   (x * idt_cpu_freq)
+
+/* Use a default timeout of 20s. This should be
+ * safe for CPU clock speeds up to 400MHz, as
+ * ((2 ^ 32) - 1) / (400MHz / 2) = 21s.  */
+#define WATCHDOG_TIMEOUT 20
+
+static int timeout = WATCHDOG_TIMEOUT;
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
         __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
+/* apply or and nand masks to data read from addr and write back */
+#define SET_BITS(addr, or, nand) \
+        writel((readl(&addr) | or) & ~nand, &addr)
 
 static void rc32434_wdt_start(void)
 {
-        u32 val;
-
-        if (!rc32434_wdt_device.inuse) {
-                writel(0, &wdt_reg->wtcount);
+        u32 or, nand;
 
-                val = RC32434_ERR_WRE;
-                writel(readl(&wdt_reg->errcs) | val, &wdt_reg->errcs);
+        /* zero the counter before enabling */
+        writel(0, &wdt_reg->wtcount);
 
-                val = RC32434_WTC_EN;
-                writel(readl(&wdt_reg->wtc) | val, &wdt_reg->wtc);
-        }
-        rc32434_wdt_device.running++;
-}
+        /* don't generate a non-maskable interrupt,
+         * do a warm reset instead */
+        nand = 1 << RC32434_ERR_WNE;
+        or = 1 << RC32434_ERR_WRE;
 
-static void rc32434_wdt_stop(void)
-{
-        u32 val;
+        /* reset the ERRCS timeout bit in case it's set */
+        nand |= 1 << RC32434_ERR_WTO;
 
-        if (rc32434_wdt_device.running) {
+        SET_BITS(wdt_reg->errcs, or, nand);
 
-                val = ~RC32434_WTC_EN;
-                writel(readl(&wdt_reg->wtc) & val, &wdt_reg->wtc);
+        /* reset WTC timeout bit and enable WDT */
+        nand = 1 << RC32434_WTC_TO;
+        or = 1 << RC32434_WTC_EN;
 
-                val = ~RC32434_ERR_WRE;
-                writel(readl(&wdt_reg->errcs) & val, &wdt_reg->errcs);
+        SET_BITS(wdt_reg->wtc, or, nand);
+}
 
-                rc32434_wdt_device.running = 0;
-        }
+static void rc32434_wdt_stop(void)
+{
+        /* Disable WDT */
+        SET_BITS(wdt_reg->wtc, 0, 1 << RC32434_WTC_EN);
 }
 
-static void rc32434_wdt_set(int new_timeout)
+static int rc32434_wdt_set(int new_timeout)
 {
-        u32 cmp = new_timeout * HZ;
-        u32 state, val;
+        int max_to = WTCOMP2SEC((u32)-1);
 
+        if (new_timeout < 0 || new_timeout > max_to) {
+                printk(KERN_ERR KBUILD_MODNAME
+                        ": timeout value must be between 0 and %d",
+                        max_to);
+                return -EINVAL;
+        }
         timeout = new_timeout;
-        /*
-         * store and disable WTC
-         */
-        state = (u32)(readl(&wdt_reg->wtc) & RC32434_WTC_EN);
-        val = ~RC32434_WTC_EN;
-        writel(readl(&wdt_reg->wtc) & val, &wdt_reg->wtc);
-
-        writel(0, &wdt_reg->wtcount);
-        writel(cmp, &wdt_reg->wtcompare);
-
-        /*
-         * restore WTC
-         */
-
-        writel(readl(&wdt_reg->wtc) | state, &wdt_reg);
-}
+        writel(SEC2WTCOMP(timeout), &wdt_reg->wtcompare);
 
-static void rc32434_wdt_reset(void)
-{
-        ticks = rc32434_wdt_device.default_ticks;
+        return 0;
 }
 
-static void rc32434_wdt_update(unsigned long unused)
+static void rc32434_wdt_ping(void)
 {
-        if (rc32434_wdt_device.running)
-                ticks--;
-
         writel(0, &wdt_reg->wtcount);
-
-        if (rc32434_wdt_device.queue && ticks)
-                mod_timer(&rc32434_wdt_device.timer,
-                        jiffies + RC32434_WDT_INTERVAL);
-        else
-                complete(&rc32434_wdt_device.stop);
 }
 
 static int rc32434_wdt_open(struct inode *inode, struct file *file)
@@ -142,19 +127,23 @@ static int rc32434_wdt_open(struct inode *inode, struct file *file)
         if (nowayout)
                 __module_get(THIS_MODULE);
 
+        rc32434_wdt_start();
+        rc32434_wdt_ping();
+
         return nonseekable_open(inode, file);
 }
 
 static int rc32434_wdt_release(struct inode *inode, struct file *file)
 {
-        if (expect_close && nowayout == 0) {
+        if (expect_close == 42) {
                 rc32434_wdt_stop();
                 printk(KERN_INFO KBUILD_MODNAME ": disabling watchdog timer\n");
                 module_put(THIS_MODULE);
-        } else
+        } else {
                 printk(KERN_CRIT KBUILD_MODNAME
                         ": device closed unexpectedly. WDT will not stop !\n");
-
+                rc32434_wdt_ping();
+        }
         clear_bit(0, &rc32434_wdt_device.inuse);
         return 0;
 }
@@ -174,10 +163,10 @@ static ssize_t rc32434_wdt_write(struct file *file, const char *data,
                                 if (get_user(c, data + i))
                                         return -EFAULT;
                                 if (c == 'V')
-                                        expect_close = 1;
+                                        expect_close = 42;
                         }
                 }
-                rc32434_wdt_update(0);
+                rc32434_wdt_ping();
                 return len;
         }
         return 0;
@@ -197,11 +186,11 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd,
         };
         switch (cmd) {
         case WDIOC_KEEPALIVE:
-                rc32434_wdt_reset();
+                rc32434_wdt_ping();
                 break;
         case WDIOC_GETSTATUS:
         case WDIOC_GETBOOTSTATUS:
-                value = readl(&wdt_reg->wtcount);
+                value = 0;
                 if (copy_to_user(argp, &value, sizeof(int)))
                         return -EFAULT;
                 break;
@@ -218,6 +207,7 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd,
                         break;
                 case WDIOS_DISABLECARD:
                         rc32434_wdt_stop();
+                        break;
                 default:
                         return -EINVAL;
                 }
@@ -225,11 +215,9 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd,
         case WDIOC_SETTIMEOUT:
                 if (copy_from_user(&new_timeout, argp, sizeof(int)))
                         return -EFAULT;
-                if (new_timeout < 1)
+                if (rc32434_wdt_set(new_timeout))
                         return -EINVAL;
-                if (new_timeout > MAX_TIMEOUT)
-                        return -EINVAL;
-                rc32434_wdt_set(new_timeout);
+                /* Fall through */
         case WDIOC_GETTIMEOUT:
                 return copy_to_user(argp, &timeout, sizeof(int));
         default:
@@ -254,15 +242,15 @@ static struct miscdevice rc32434_wdt_miscdev = {
         .fops   = &rc32434_wdt_fops,
 };
 
-static char banner[] = KERN_INFO KBUILD_MODNAME
+static char banner[] __devinitdata = KERN_INFO KBUILD_MODNAME
                 ": Watchdog Timer version " VERSION ", timer margin: %d sec\n";
 
-static int rc32434_wdt_probe(struct platform_device *pdev)
+static int __devinit rc32434_wdt_probe(struct platform_device *pdev)
 {
         int ret;
         struct resource *r;
 
-        r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "rb500_wdt_res");
+        r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "rb532_wdt_res");
         if (!r) {
                 printk(KERN_ERR KBUILD_MODNAME
                         "failed to retrieve resources\n");
@@ -277,24 +265,12 @@ static int rc32434_wdt_probe(struct platform_device *pdev)
         }
 
         ret = misc_register(&rc32434_wdt_miscdev);
-
         if (ret < 0) {
                 printk(KERN_ERR KBUILD_MODNAME
                         "failed to register watchdog device\n");
                 goto unmap;
         }
 
-        init_completion(&rc32434_wdt_device.stop);
-        rc32434_wdt_device.queue = 0;
-
-        clear_bit(0, &rc32434_wdt_device.inuse);
-
-        setup_timer(&rc32434_wdt_device.timer, rc32434_wdt_update, 0L);
-
-        rc32434_wdt_device.default_ticks = ticks;
-
-        rc32434_wdt_start();
-
         printk(banner, timeout);
 
         return 0;
@@ -304,23 +280,17 @@ unmap:
         return ret;
 }
 
-static int rc32434_wdt_remove(struct platform_device *pdev)
+static int __devexit rc32434_wdt_remove(struct platform_device *pdev)
 {
-        if (rc32434_wdt_device.queue) {
-                rc32434_wdt_device.queue = 0;
-                wait_for_completion(&rc32434_wdt_device.stop);
-        }
         misc_deregister(&rc32434_wdt_miscdev);
-
         iounmap(wdt_reg);
-
         return 0;
 }
 
 static struct platform_driver rc32434_wdt = {
         .probe  = rc32434_wdt_probe,
-        .remove = rc32434_wdt_remove,
-        .driver = {
+        .remove = __devexit_p(rc32434_wdt_remove),
+        .driver = {
                 .name = "rc32434_wdt",
         }
 };