Merge commit 'v2.6.39-rc7' into sched/core

249 files changed, 2220 insertions, 950 deletions

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index b136c9c1e531..449c556274c0 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -943,6 +943,10 @@ static int acpi_bus_get_flags(struct acpi_device *device)
         if (ACPI_SUCCESS(status))
                 device->flags.lockable = 1;
 
+        /* Power resources cannot be power manageable. */
+        if (device->device_type == ACPI_BUS_TYPE_POWER)
+                return 0;
+
         /* Presence of _PS0|_PR0 indicates 'power manageable' */
         status = acpi_get_handle(device->handle, "_PS0", &temp);
         if (ACPI_FAILURE(status))
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 39d829cd82dd..71afe0371311 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -150,7 +150,7 @@ static const struct ata_port_info ahci_port_info[] = {
         {
                 AHCI_HFLAGS     (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
                                  AHCI_HFLAG_YES_NCQ),
-                .flags          = AHCI_FLAG_COMMON,
+                .flags          = AHCI_FLAG_COMMON | ATA_FLAG_NO_DIPM,
                 .pio_mask       = ATA_PIO4,
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &ahci_ops,
@@ -261,6 +261,12 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
         { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* PBG RAID */
         { PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */
+        { PCI_VDEVICE(INTEL, 0x1e02), board_ahci }, /* Panther Point AHCI */
+        { PCI_VDEVICE(INTEL, 0x1e03), board_ahci }, /* Panther Point AHCI */
+        { PCI_VDEVICE(INTEL, 0x1e04), board_ahci }, /* Panther Point RAID */
+        { PCI_VDEVICE(INTEL, 0x1e05), board_ahci }, /* Panther Point RAID */
+        { PCI_VDEVICE(INTEL, 0x1e06), board_ahci }, /* Panther Point RAID */
+        { PCI_VDEVICE(INTEL, 0x1e07), board_ahci }, /* Panther Point RAID */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 39865009c251..12c5282e7fca 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -229,6 +229,10 @@ enum {
         EM_CTL_ALHD             = (1 << 26), /* Activity LED */
         EM_CTL_XMT              = (1 << 25), /* Transmit Only */
         EM_CTL_SMB              = (1 << 24), /* Single Message Buffer */
+        EM_CTL_SGPIO            = (1 << 19), /* SGPIO messages supported */
+        EM_CTL_SES              = (1 << 18), /* SES-2 messages supported */
+        EM_CTL_SAFTE            = (1 << 17), /* SAF-TE messages supported */
+        EM_CTL_LED              = (1 << 16), /* LED messages supported */
 
         /* em message type */
         EM_MSG_TYPE_LED         = (1 << 0), /* LED */
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 0bc3fd6c3fdb..6f6e7718b05c 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -309,6 +309,14 @@ static const struct pci_device_id piix_pci_tbl[] = {
         { 0x8086, 0x1d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
         /* SATA Controller IDE (PBG) */
         { 0x8086, 0x1d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (Panther Point) */
+        { 0x8086, 0x1e00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
+        /* SATA Controller IDE (Panther Point) */
+        { 0x8086, 0x1e01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
+        /* SATA Controller IDE (Panther Point) */
+        { 0x8086, 0x1e08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (Panther Point) */
+        { 0x8086, 0x1e09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
         { }     /* terminate list */
 };
 
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 26d452339e98..ff9d832a163d 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -109,6 +109,8 @@ static ssize_t ahci_read_em_buffer(struct device *dev,
 static ssize_t ahci_store_em_buffer(struct device *dev,
                                     struct device_attribute *attr,
                                     const char *buf, size_t size);
+static ssize_t ahci_show_em_supported(struct device *dev,
+                                      struct device_attribute *attr, char *buf);
 
 static DEVICE_ATTR(ahci_host_caps, S_IRUGO, ahci_show_host_caps, NULL);
 static DEVICE_ATTR(ahci_host_cap2, S_IRUGO, ahci_show_host_cap2, NULL);
@@ -116,6 +118,7 @@ static DEVICE_ATTR(ahci_host_version, S_IRUGO, ahci_show_host_version, NULL);
 static DEVICE_ATTR(ahci_port_cmd, S_IRUGO, ahci_show_port_cmd, NULL);
 static DEVICE_ATTR(em_buffer, S_IWUSR | S_IRUGO,
                    ahci_read_em_buffer, ahci_store_em_buffer);
+static DEVICE_ATTR(em_message_supported, S_IRUGO, ahci_show_em_supported, NULL);
 
 struct device_attribute *ahci_shost_attrs[] = {
         &dev_attr_link_power_management_policy,
@@ -126,6 +129,7 @@ struct device_attribute *ahci_shost_attrs[] = {
         &dev_attr_ahci_host_version,
         &dev_attr_ahci_port_cmd,
         &dev_attr_em_buffer,
+        &dev_attr_em_message_supported,
         NULL
 };
 EXPORT_SYMBOL_GPL(ahci_shost_attrs);
@@ -343,6 +347,24 @@ static ssize_t ahci_store_em_buffer(struct device *dev,
         return size;
 }
 
+static ssize_t ahci_show_em_supported(struct device *dev,
+                                      struct device_attribute *attr, char *buf)
+{
+        struct Scsi_Host *shost = class_to_shost(dev);
+        struct ata_port *ap = ata_shost_to_port(shost);
+        struct ahci_host_priv *hpriv = ap->host->private_data;
+        void __iomem *mmio = hpriv->mmio;
+        u32 em_ctl;
+
+        em_ctl = readl(mmio + HOST_EM_CTL);
+
+        return sprintf(buf, "%s%s%s%s\n",
+                       em_ctl & EM_CTL_LED ? "led " : "",
+                       em_ctl & EM_CTL_SAFTE ? "saf-te " : "",
+                       em_ctl & EM_CTL_SES ? "ses-2 " : "",
+                       em_ctl & EM_CTL_SGPIO ? "sgpio " : "");
+}
+
 /**
  *      ahci_save_initial_config - Save and fixup initial config values
  *      @dev: target AHCI device
@@ -539,6 +561,27 @@ void ahci_start_engine(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
         u32 tmp;
+        u8 status;
+
+        status = readl(port_mmio + PORT_TFDATA) & 0xFF;
+
+        /*
+         * At end of section 10.1 of AHCI spec (rev 1.3), it states
+         * Software shall not set PxCMD.ST to 1 until it is determined
+         * that a functoinal device is present on the port as determined by
+         * PxTFD.STS.BSY=0, PxTFD.STS.DRQ=0 and PxSSTS.DET=3h
+         *
+         * Even though most AHCI host controllers work without this check,
+         * specific controller will fail under this condition
+         */
+        if (status & (ATA_BUSY | ATA_DRQ))
+                return;
+        else {
+                ahci_scr_read(&ap->link, SCR_STATUS, &tmp);
+
+                if ((tmp & 0xf) != 0x3)
+                        return;
+        }
 
         /* start DMA */
         tmp = readl(port_mmio + PORT_CMD);
@@ -1897,7 +1940,17 @@ static void ahci_pmp_attach(struct ata_port *ap)
         ahci_enable_fbs(ap);
 
         pp->intr_mask |= PORT_IRQ_BAD_PMP;
-        writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
+
+        /*
+         * We must not change the port interrupt mask register if the
+         * port is marked frozen, the value in pp->intr_mask will be
+         * restored later when the port is thawed.
+         *
+         * Note that during initialization, the port is marked as
+         * frozen since the irq handler is not yet registered.
+         */
+        if (!(ap->pflags & ATA_PFLAG_FROZEN))
+                writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
 }
 
 static void ahci_pmp_detach(struct ata_port *ap)
@@ -1913,7 +1966,10 @@ static void ahci_pmp_detach(struct ata_port *ap)
         writel(cmd, port_mmio + PORT_CMD);
 
         pp->intr_mask &= ~PORT_IRQ_BAD_PMP;
-        writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
+
+        /* see comment above in ahci_pmp_attach() */
+        if (!(ap->pflags & ATA_PFLAG_FROZEN))
+                writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
 }
 
 int ahci_port_resume(struct ata_port *ap)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 423c0a6952b2..76c3c15cb1e6 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4139,6 +4139,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
          */
         { "PIONEER DVD-RW  DVRTD08",    "1.00", ATA_HORKAGE_NOSETXFER },
         { "PIONEER DVD-RW  DVR-212D",   "1.28", ATA_HORKAGE_NOSETXFER },
+        { "PIONEER DVD-RW  DVR-216D",   "1.08", ATA_HORKAGE_NOSETXFER },
 
         /* End Marker */
         { }
@@ -5480,7 +5481,7 @@ struct ata_port *ata_port_alloc(struct ata_host *host)
         if (!ap)
                 return NULL;
 
-        ap->pflags |= ATA_PFLAG_INITIALIZING;
+        ap->pflags |= ATA_PFLAG_INITIALIZING | ATA_PFLAG_FROZEN;
         ap->lock = &host->lock;
         ap->print_id = -1;
         ap->host = host;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 88cd22fa65cd..f26f2fe3480a 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -3316,6 +3316,7 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
         struct ata_eh_context *ehc = &link->eh_context;
         struct ata_device *dev, *link_dev = NULL, *lpm_dev = NULL;
         enum ata_lpm_policy old_policy = link->lpm_policy;
+        bool no_dipm = ap->flags & ATA_FLAG_NO_DIPM;
         unsigned int hints = ATA_LPM_EMPTY | ATA_LPM_HIPM;
         unsigned int err_mask;
         int rc;
@@ -3332,7 +3333,7 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
          */
         ata_for_each_dev(dev, link, ENABLED) {
                 bool hipm = ata_id_has_hipm(dev->id);
-                bool dipm = ata_id_has_dipm(dev->id);
+                bool dipm = ata_id_has_dipm(dev->id) && !no_dipm;
 
                 /* find the first enabled and LPM enabled devices */
                 if (!link_dev)
@@ -3389,7 +3390,8 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
 
         /* host config updated, enable DIPM if transitioning to MIN_POWER */
         ata_for_each_dev(dev, link, ENABLED) {
-                if (policy == ATA_LPM_MIN_POWER && ata_id_has_dipm(dev->id)) {
+                if (policy == ATA_LPM_MIN_POWER && !no_dipm &&
+                    ata_id_has_dipm(dev->id)) {
                         err_mask = ata_dev_set_feature(dev,
                                         SETFEATURES_SATA_ENABLE, SATA_DIPM);
                         if (err_mask && err_mask != AC_ERR_DEV) {
diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
index 0da0dcc7dd08..a5fdbdcb0faf 100644
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -33,11 +33,12 @@
 
 
 #define DRV_NAME "pata_at91"
-#define DRV_VERSION "0.1"
+#define DRV_VERSION "0.2"
 
 #define CF_IDE_OFFSET       0x00c00000
 #define CF_ALT_IDE_OFFSET   0x00e00000
 #define CF_IDE_RES_SIZE     0x08
+#define NCS_RD_PULSE_LIMIT  0x3f /* maximal value for pulse bitfields */
 
 struct at91_ide_info {
         unsigned long mode;
@@ -49,8 +50,18 @@ struct at91_ide_info {
         void __iomem *alt_addr;
 };
 
-static const struct ata_timing initial_timing =
-        {XFER_PIO_0, 70, 290, 240, 600, 165, 150, 600, 0};
+static const struct ata_timing initial_timing = {
+        .mode           = XFER_PIO_0,
+        .setup          = 70,
+        .act8b          = 290,
+        .rec8b          = 240,
+        .cyc8b          = 600,
+        .active         = 165,
+        .recover        = 150,
+        .dmack_hold     = 0,
+        .cycle          = 600,
+        .udma           = 0
+};
 
 static unsigned long calc_mck_cycles(unsigned long ns, unsigned long mck_hz)
 {
@@ -109,6 +120,11 @@ static void set_smc_timing(struct device *dev,
         /* (CS0, CS1, DIR, OE) <= (CFCE1, CFCE2, CFRNW, NCSX) timings */
         ncs_read_setup = 1;
         ncs_read_pulse = read_cycle - 2;
+        if (ncs_read_pulse > NCS_RD_PULSE_LIMIT) {
+                ncs_read_pulse = NCS_RD_PULSE_LIMIT;
+                dev_warn(dev, "ncs_read_pulse limited to maximal value %lu\n",
+                        ncs_read_pulse);
+        }
 
         /* Write timings same as read timings */
         write_cycle = read_cycle;
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index fbc5b6e7c591..abe3ab709e87 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -63,6 +63,7 @@ void device_pm_init(struct device *dev)
         dev->power.wakeup = NULL;
         spin_lock_init(&dev->power.lock);
         pm_runtime_init(dev);
+        INIT_LIST_HEAD(&dev->power.entry);
 }
 
 /**
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 4573c83df6dd..abbbd33e8d8a 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -258,7 +258,7 @@ void device_set_wakeup_capable(struct device *dev, bool capable)
         if (!!dev->power.can_wakeup == !!capable)
                 return;
 
-        if (device_is_registered(dev)) {
+        if (device_is_registered(dev) && !list_empty(&dev->power.entry)) {
                 if (capable) {
                         if (wakeup_sysfs_add(dev))
                                 return;
diff --git a/drivers/base/syscore.c b/drivers/base/syscore.c
index 90af2943f9e4..c126db3cb7d1 100644
--- a/drivers/base/syscore.c
+++ b/drivers/base/syscore.c
@@ -73,6 +73,7 @@ int syscore_suspend(void)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(syscore_suspend);
 
 /**
  * syscore_resume - Execute all the registered system core resume callbacks.
@@ -95,6 +96,7 @@ void syscore_resume(void)
                                 "Interrupts enabled after %pF\n", ops->resume);
                 }
 }
+EXPORT_SYMBOL_GPL(syscore_resume);
 #endif /* CONFIG_PM_SLEEP */
 
 /**
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 16dc3645291c..3e904717c1c0 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -777,9 +777,9 @@ static int rbd_do_request(struct request *rq,
                                       ops,
                                       false,
                                       GFP_NOIO, pages, bio);
-        if (IS_ERR(req)) {
+        if (!req) {
                 up_read(&header->snap_rwsem);
-                ret = PTR_ERR(req);
+                ret = -ENOMEM;
                 goto done_pages;
         }
 
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 012cba0d6d96..b072648dc3f6 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -115,6 +115,9 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
         struct agp_memory *new;
         unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
 
+        if (INT_MAX/sizeof(struct page *) < num_agp_pages)
+                return NULL;
+
         new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
         if (new == NULL)
                 return NULL;
@@ -234,11 +237,14 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
         int scratch_pages;
         struct agp_memory *new;
         size_t i;
+        int cur_memory;
 
         if (!bridge)
                 return NULL;
 
-        if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
+        cur_memory = atomic_read(&bridge->current_memory_agp);
+        if ((cur_memory + page_count > bridge->max_memory_agp) ||
+            (cur_memory + page_count < page_count))
                 return NULL;
 
         if (type >= AGP_USER_TYPES) {
@@ -1089,8 +1095,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
                 return -EINVAL;
         }
 
-        /* AK: could wrap */
-        if ((pg_start + mem->page_count) > num_entries)
+        if (((pg_start + mem->page_count) > num_entries) ||
+            ((pg_start + mem->page_count) < pg_start))
                 return -EINVAL;
 
         j = pg_start;
@@ -1124,7 +1130,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
         size_t i;
         struct agp_bridge_data *bridge;
-        int mask_type;
+        int mask_type, num_entries;
 
         bridge = mem->bridge;
         if (!bridge)
@@ -1136,6 +1142,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
         if (type != mem->type)
                 return -EINVAL;
 
+        num_entries = agp_num_entries();
+        if (((pg_start + mem->page_count) > num_entries) ||
+            ((pg_start + mem->page_count) < pg_start))
+                return -EINVAL;
+
         mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
         if (mask_type != 0) {
                 /* The generic routines know nothing of memory types */
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 84b164d1eb2b..838568a7dbf5 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1280,18 +1280,7 @@ static void unplug_port(struct port *port)
                 spin_lock_irq(&pdrvdata_lock);
                 list_del(&port->cons.list);
                 spin_unlock_irq(&pdrvdata_lock);
-#if 0
-                /*
-                 * hvc_remove() not called as removing one hvc port
-                 * results in other hvc ports getting frozen.
-                 *
-                 * Once this is resolved in hvc, this functionality
-                 * will be enabled.  Till that is done, the -EPIPE
-                 * return from get_chars() above will help
-                 * hvc_console.c to clean up on ports we remove here.
-                 */
                 hvc_remove(port->cons.hvc);
-#endif
         }
 
         /* Remove unused data this port might have received. */
diff --git a/drivers/clk/clkdev.c b/drivers/clk/clkdev.c
index 0fc0a79852de..6db161f64ae0 100644
--- a/drivers/clk/clkdev.c
+++ b/drivers/clk/clkdev.c
@@ -32,10 +32,9 @@ static DEFINE_MUTEX(clocks_mutex);
  * Then we take the most specific entry - with the following
  * order of precedence: dev+con > dev only > con only.
  */
-static struct clk *clk_find(const char *dev_id, const char *con_id)
+static struct clk_lookup *clk_find(const char *dev_id, const char *con_id)
 {
-        struct clk_lookup *p;
-        struct clk *clk = NULL;
+        struct clk_lookup *p, *cl = NULL;
         int match, best = 0;
 
         list_for_each_entry(p, &clocks, node) {
@@ -52,27 +51,27 @@ static struct clk *clk_find(const char *dev_id, const char *con_id)
                 }
 
                 if (match > best) {
-                        clk = p->clk;
+                        cl = p;
                         if (match != 3)
                                 best = match;
                         else
                                 break;
                 }
         }
-        return clk;
+        return cl;
 }
 
 struct clk *clk_get_sys(const char *dev_id, const char *con_id)
 {
-        struct clk *clk;
+        struct clk_lookup *cl;
 
         mutex_lock(&clocks_mutex);
-        clk = clk_find(dev_id, con_id);
-        if (clk && !__clk_get(clk))
-                clk = NULL;
+        cl = clk_find(dev_id, con_id);
+        if (cl && !__clk_get(cl->clk))
+                cl = NULL;
         mutex_unlock(&clocks_mutex);
 
-        return clk ? clk : ERR_PTR(-ENOENT);
+        return cl ? cl->clk : ERR_PTR(-ENOENT);
 }
 EXPORT_SYMBOL(clk_get_sys);
 
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index d77005849af8..219d88a0eeae 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -142,6 +142,7 @@ static int cn_call_callback(struct sk_buff *skb)
                 cbq->callback(msg, nsp);
                 kfree_skb(skb);
                 cn_queue_release_callback(cbq);
+                err = 0;
         }
 
         return err;
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 31e71c4fc831..9a8bebcf6b17 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -211,8 +211,6 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci)
 
         scrubval = scrubval & 0x001F;
 
-        amd64_debug("pci-read, sdram scrub control value: %d\n", scrubval);
-
         for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
                 if (scrubrates[i].scrubval == scrubval) {
                         retval = scrubrates[i].bandwidth;
@@ -933,25 +931,74 @@ static int k8_early_channel_count(struct amd64_pvt *pvt)
 /* On F10h and later ErrAddr is MC4_ADDR[47:1] */
 static u64 get_error_address(struct mce *m)
 {
+        struct cpuinfo_x86 *c = &boot_cpu_data;
+        u64 addr;
         u8 start_bit = 1;
         u8 end_bit   = 47;
 
-        if (boot_cpu_data.x86 == 0xf) {
+        if (c->x86 == 0xf) {
                 start_bit = 3;
                 end_bit   = 39;
         }
 
-        return m->addr & GENMASK(start_bit, end_bit);
+        addr = m->addr & GENMASK(start_bit, end_bit);
+
+        /*
+         * Erratum 637 workaround
+         */
+        if (c->x86 == 0x15) {
+                struct amd64_pvt *pvt;
+                u64 cc6_base, tmp_addr;
+                u32 tmp;
+                u8 mce_nid, intlv_en;
+
+                if ((addr & GENMASK(24, 47)) >> 24 != 0x00fdf7)
+                        return addr;
+
+                mce_nid = amd_get_nb_id(m->extcpu);
+                pvt     = mcis[mce_nid]->pvt_info;
+
+                amd64_read_pci_cfg(pvt->F1, DRAM_LOCAL_NODE_LIM, &tmp);
+                intlv_en = tmp >> 21 & 0x7;
+
+                /* add [47:27] + 3 trailing bits */
+                cc6_base  = (tmp & GENMASK(0, 20)) << 3;
+
+                /* reverse and add DramIntlvEn */
+                cc6_base |= intlv_en ^ 0x7;
+
+                /* pin at [47:24] */
+                cc6_base <<= 24;
+
+                if (!intlv_en)
+                        return cc6_base | (addr & GENMASK(0, 23));
+
+                amd64_read_pci_cfg(pvt->F1, DRAM_LOCAL_NODE_BASE, &tmp);
+
+                                                        /* faster log2 */
+                tmp_addr  = (addr & GENMASK(12, 23)) << __fls(intlv_en + 1);
+
+                /* OR DramIntlvSel into bits [14:12] */
+                tmp_addr |= (tmp & GENMASK(21, 23)) >> 9;
+
+                /* add remaining [11:0] bits from original MC4_ADDR */
+                tmp_addr |= addr & GENMASK(0, 11);
+
+                return cc6_base | tmp_addr;
+        }
+
+        return addr;
 }
 
 static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
 {
+        struct cpuinfo_x86 *c = &boot_cpu_data;
         int off = range << 3;
 
         amd64_read_pci_cfg(pvt->F1, DRAM_BASE_LO + off,  &pvt->ranges[range].base.lo);
         amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_LO + off, &pvt->ranges[range].lim.lo);
 
-        if (boot_cpu_data.x86 == 0xf)
+        if (c->x86 == 0xf)
                 return;
 
         if (!dram_rw(pvt, range))
@@ -959,6 +1006,31 @@ static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
 
         amd64_read_pci_cfg(pvt->F1, DRAM_BASE_HI + off,  &pvt->ranges[range].base.hi);
         amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_HI + off, &pvt->ranges[range].lim.hi);
+
+        /* Factor in CC6 save area by reading dst node's limit reg */
+        if (c->x86 == 0x15) {
+                struct pci_dev *f1 = NULL;
+                u8 nid = dram_dst_node(pvt, range);
+                u32 llim;
+
+                f1 = pci_get_domain_bus_and_slot(0, 0, PCI_DEVFN(0x18 + nid, 1));
+                if (WARN_ON(!f1))
+                        return;
+
+                amd64_read_pci_cfg(f1, DRAM_LOCAL_NODE_LIM, &llim);
+
+                pvt->ranges[range].lim.lo &= GENMASK(0, 15);
+
+                                            /* {[39:27],111b} */
+                pvt->ranges[range].lim.lo |= ((llim & 0x1fff) << 3 | 0x7) << 16;
+
+                pvt->ranges[range].lim.hi &= GENMASK(0, 7);
+
+                                            /* [47:40] */
+                pvt->ranges[range].lim.hi |= llim >> 13;
+
+                pci_dev_put(f1);
+        }
 }
 
 static void k8_map_sysaddr_to_csrow(struct mem_ctl_info *mci, u64 sys_addr,
@@ -1403,12 +1475,8 @@ static int f1x_match_to_this_node(struct amd64_pvt *pvt, unsigned range,
                 return -EINVAL;
         }
 
-        if (intlv_en &&
-            (intlv_sel != ((sys_addr >> 12) & intlv_en))) {
-                amd64_warn("Botched intlv bits, en: 0x%x, sel: 0x%x\n",
-                           intlv_en, intlv_sel);
+        if (intlv_en && (intlv_sel != ((sys_addr >> 12) & intlv_en)))
                 return -EINVAL;
-        }
 
         sys_addr = f1x_swap_interleaved_region(pvt, sys_addr);
 
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index 11be36a311eb..9a666cb985b2 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -196,6 +196,9 @@
 
 #define DCT_CFG_SEL                     0x10C
 
+#define DRAM_LOCAL_NODE_BASE            0x120
+#define DRAM_LOCAL_NODE_LIM             0x124
+
 #define DRAM_BASE_HI                    0x140
 #define DRAM_LIMIT_HI                   0x144
 
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 26343fd46596..29ffa350bfbe 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -458,13 +458,13 @@ static ssize_t mci_sdram_scrub_rate_store(struct mem_ctl_info *mci,
                 return -EINVAL;
 
         new_bw = mci->set_sdram_scrub_rate(mci, bandwidth);
-        if (new_bw >= 0) {
-                edac_printk(KERN_DEBUG, EDAC_MC, "Scrub rate set to %d\n", new_bw);
-                return count;
+        if (new_bw < 0) {
+                edac_printk(KERN_WARNING, EDAC_MC,
+                            "Error setting scrub rate to: %lu\n", bandwidth);
+                return -EINVAL;
         }
 
-        edac_printk(KERN_DEBUG, EDAC_MC, "Error setting scrub rate to: %lu\n", bandwidth);
-        return -EINVAL;
+        return count;
 }
 
 /*
@@ -483,7 +483,6 @@ static ssize_t mci_sdram_scrub_rate_show(struct mem_ctl_info *mci, char *data)
                 return bandwidth;
         }
 
-        edac_printk(KERN_DEBUG, EDAC_MC, "Read scrub rate: %d\n", bandwidth);
         return sprintf(data, "%d\n", bandwidth);
 }
 
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index f903d7b6f34a..23d1468ad253 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2199,7 +2199,6 @@ static int ohci_set_config_rom(struct fw_card *card,
 {
         struct fw_ohci *ohci;
         unsigned long flags;
-        int ret = -EBUSY;
         __be32 *next_config_rom;
         dma_addr_t uninitialized_var(next_config_rom_bus);
 
@@ -2240,22 +2239,37 @@ static int ohci_set_config_rom(struct fw_card *card,
 
         spin_lock_irqsave(&ohci->lock, flags);
 
+        /*
+         * If there is not an already pending config_rom update,
+         * push our new allocation into the ohci->next_config_rom
+         * and then mark the local variable as null so that we
+         * won't deallocate the new buffer.
+         *
+         * OTOH, if there is a pending config_rom update, just
+         * use that buffer with the new config_rom data, and
+         * let this routine free the unused DMA allocation.
+         */
+
         if (ohci->next_config_rom == NULL) {
                 ohci->next_config_rom = next_config_rom;
                 ohci->next_config_rom_bus = next_config_rom_bus;
+                next_config_rom = NULL;
+        }
 
-                copy_config_rom(ohci->next_config_rom, config_rom, length);
+        copy_config_rom(ohci->next_config_rom, config_rom, length);
 
-                ohci->next_header = config_rom[0];
-                ohci->next_config_rom[0] = 0;
+        ohci->next_header = config_rom[0];
+        ohci->next_config_rom[0] = 0;
 
-                reg_write(ohci, OHCI1394_ConfigROMmap,
-                          ohci->next_config_rom_bus);
-                ret = 0;
-        }
+        reg_write(ohci, OHCI1394_ConfigROMmap, ohci->next_config_rom_bus);
 
         spin_unlock_irqrestore(&ohci->lock, flags);
 
+        /* If we didn't use the DMA allocation, delete it. */
+        if (next_config_rom != NULL)
+                dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+                                  next_config_rom, next_config_rom_bus);
+
         /*
          * Now initiate a bus reset to have the changes take
          * effect. We clean up the old config rom memory and DMA
@@ -2263,13 +2277,10 @@ static int ohci_set_config_rom(struct fw_card *card,
          * controller could need to access it before the bus reset
          * takes effect.
          */
-        if (ret == 0)
-                fw_schedule_bus_reset(&ohci->card, true, true);
-        else
-                dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
-                                  next_config_rom, next_config_rom_bus);
 
-        return ret;
+        fw_schedule_bus_reset(&ohci->card, true, true);
+
+        return 0;
 }
 
 static void ohci_send_request(struct fw_card *card, struct fw_packet *packet)
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index c58f691ec3ce..b493663c7ba7 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -24,6 +24,7 @@ config DRM_KMS_HELPER
         depends on DRM
         select FB
         select FRAMEBUFFER_CONSOLE if !EXPERT
+        select FRAMEBUFFER_CONSOLE_DETECT_PRIMARY if FRAMEBUFFER_CONSOLE
         help
           FB and CRTC helpers for KMS drivers.
 
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 950720473967..11d7a72c22d9 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -342,9 +342,22 @@ int drm_fb_helper_debug_leave(struct fb_info *info)
 }
 EXPORT_SYMBOL(drm_fb_helper_debug_leave);
 
+bool drm_fb_helper_restore_fbdev_mode(struct drm_fb_helper *fb_helper)
+{
+        bool error = false;
+        int i, ret;
+        for (i = 0; i < fb_helper->crtc_count; i++) {
+                struct drm_mode_set *mode_set = &fb_helper->crtc_info[i].mode_set;
+                ret = drm_crtc_helper_set_config(mode_set);
+                if (ret)
+                        error = true;
+        }
+        return error;
+}
+EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode);
+
 bool drm_fb_helper_force_kernel_mode(void)
 {
-        int i = 0;
         bool ret, error = false;
         struct drm_fb_helper *helper;
 
@@ -352,12 +365,12 @@ bool drm_fb_helper_force_kernel_mode(void)
                 return false;
 
         list_for_each_entry(helper, &kernel_fb_helper_list, kernel_fb_list) {
-                for (i = 0; i < helper->crtc_count; i++) {
-                        struct drm_mode_set *mode_set = &helper->crtc_info[i].mode_set;
-                        ret = drm_crtc_helper_set_config(mode_set);
-                        if (ret)
-                                error = true;
-                }
+                if (helper->dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+                        continue;
+
+                ret = drm_fb_helper_restore_fbdev_mode(helper);
+                if (ret)
+                        error = true;
         }
         return error;
 }
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 741457bd1c46..a1f12cb043de 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -932,11 +932,34 @@ EXPORT_SYMBOL(drm_vblank_put);
 
 void drm_vblank_off(struct drm_device *dev, int crtc)
 {
+        struct drm_pending_vblank_event *e, *t;
+        struct timeval now;
         unsigned long irqflags;
+        unsigned int seq;
 
         spin_lock_irqsave(&dev->vbl_lock, irqflags);
         vblank_disable_and_save(dev, crtc);
         DRM_WAKEUP(&dev->vbl_queue[crtc]);
+
+        /* Send any queued vblank events, lest the natives grow disquiet */
+        seq = drm_vblank_count_and_time(dev, crtc, &now);
+        list_for_each_entry_safe(e, t, &dev->vblank_event_list, base.link) {
+                if (e->pipe != crtc)
+                        continue;
+                DRM_DEBUG("Sending premature vblank event on disable: \
+                          wanted %d, current %d\n",
+                          e->event.sequence, seq);
+
+                e->event.sequence = seq;
+                e->event.tv_sec = now.tv_sec;
+                e->event.tv_usec = now.tv_usec;
+                drm_vblank_put(dev, e->pipe);
+                list_move_tail(&e->base.link, &e->base.file_priv->event_list);
+                wake_up_interruptible(&e->base.file_priv->event_wait);
+                trace_drm_vblank_event_delivered(e->base.pid, e->pipe,
+                                                 e->event.sequence);
+        }
+
         spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
 }
 EXPORT_SYMBOL(drm_vblank_off);
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 5d00b0fc0d91..959186cbf328 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -431,7 +431,7 @@ EXPORT_SYMBOL(drm_mm_search_free_in_range);
 void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new)
 {
         list_replace(&old->node_list, &new->node_list);
-        list_replace(&old->node_list, &new->hole_stack);
+        list_replace(&old->hole_stack, &new->hole_stack);
         new->hole_follows = old->hole_follows;
         new->mm = old->mm;
         new->start = old->start;
@@ -699,8 +699,8 @@ int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
                                 entry->size);
                 total_used += entry->size;
                 if (entry->hole_follows) {
-                        hole_start = drm_mm_hole_node_start(&mm->head_node);
-                        hole_end = drm_mm_hole_node_end(&mm->head_node);
+                        hole_start = drm_mm_hole_node_start(entry);
+                        hole_end = drm_mm_hole_node_end(entry);
                         hole_size = hole_end - hole_start;
                         seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
                                         hole_start, hole_end, hole_size);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 72730377a01b..12876f2795d2 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -2207,7 +2207,7 @@ void i915_driver_lastclose(struct drm_device * dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
 
         if (!dev_priv || drm_core_check_feature(dev, DRIVER_MODESET)) {
-                drm_fb_helper_restore();
+                intel_fb_restore_mode(dev);
                 vga_switcheroo_process_delayed_switch();
                 return;
         }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 432fc04c6bff..373c2a005ec1 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3771,8 +3771,11 @@ static bool g4x_compute_wm0(struct drm_device *dev,
         int entries, tlb_miss;
 
         crtc = intel_get_crtc_for_plane(dev, plane);
-        if (crtc->fb == NULL || !crtc->enabled)
+        if (crtc->fb == NULL || !crtc->enabled) {
+                *cursor_wm = cursor->guard_size;
+                *plane_wm = display->guard_size;
                 return false;
+        }
 
         htotal = crtc->mode.htotal;
         hdisplay = crtc->mode.hdisplay;
@@ -5151,8 +5154,6 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 
         I915_WRITE(DSPCNTR(plane), dspcntr);
         POSTING_READ(DSPCNTR(plane));
-        if (!HAS_PCH_SPLIT(dev))
-                intel_enable_plane(dev_priv, plane, pipe);
 
         ret = intel_pipe_set_base(crtc, x, y, old_fb);
 
@@ -5602,9 +5603,9 @@ static int intel_crtc_clock_get(struct drm_device *dev, struct drm_crtc *crtc)
         intel_clock_t clock;
 
         if ((dpll & DISPLAY_RATE_SELECT_FPA1) == 0)
-                fp = FP0(pipe);
+                fp = I915_READ(FP0(pipe));
         else
-                fp = FP1(pipe);
+                fp = I915_READ(FP1(pipe));
 
         clock.m1 = (fp & FP_M1_DIV_MASK) >> FP_M1_DIV_SHIFT;
         if (IS_PINEVIEW(dev)) {
@@ -6215,36 +6216,6 @@ cleanup_work:
         return ret;
 }
 
-static void intel_crtc_reset(struct drm_crtc *crtc)
-{
-        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-
-        /* Reset flags back to the 'unknown' status so that they
-         * will be correctly set on the initial modeset.
-         */
-        intel_crtc->dpms_mode = -1;
-}
-
-static struct drm_crtc_helper_funcs intel_helper_funcs = {
-        .dpms = intel_crtc_dpms,
-        .mode_fixup = intel_crtc_mode_fixup,
-        .mode_set = intel_crtc_mode_set,
-        .mode_set_base = intel_pipe_set_base,
-        .mode_set_base_atomic = intel_pipe_set_base_atomic,
-        .load_lut = intel_crtc_load_lut,
-        .disable = intel_crtc_disable,
-};
-
-static const struct drm_crtc_funcs intel_crtc_funcs = {
-        .reset = intel_crtc_reset,
-        .cursor_set = intel_crtc_cursor_set,
-        .cursor_move = intel_crtc_cursor_move,
-        .gamma_set = intel_crtc_gamma_set,
-        .set_config = drm_crtc_helper_set_config,
-        .destroy = intel_crtc_destroy,
-        .page_flip = intel_crtc_page_flip,
-};
-
 static void intel_sanitize_modesetting(struct drm_device *dev,
                                        int pipe, int plane)
 {
@@ -6281,6 +6252,42 @@ static void intel_sanitize_modesetting(struct drm_device *dev,
         intel_disable_pipe(dev_priv, pipe);
 }
 
+static void intel_crtc_reset(struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+
+        /* Reset flags back to the 'unknown' status so that they
+         * will be correctly set on the initial modeset.
+         */
+        intel_crtc->dpms_mode = -1;
+
+        /* We need to fix up any BIOS configuration that conflicts with
+         * our expectations.
+         */
+        intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
+}
+
+static struct drm_crtc_helper_funcs intel_helper_funcs = {
+        .dpms = intel_crtc_dpms,
+        .mode_fixup = intel_crtc_mode_fixup,
+        .mode_set = intel_crtc_mode_set,
+        .mode_set_base = intel_pipe_set_base,
+        .mode_set_base_atomic = intel_pipe_set_base_atomic,
+        .load_lut = intel_crtc_load_lut,
+        .disable = intel_crtc_disable,
+};
+
+static const struct drm_crtc_funcs intel_crtc_funcs = {
+        .reset = intel_crtc_reset,
+        .cursor_set = intel_crtc_cursor_set,
+        .cursor_move = intel_crtc_cursor_move,
+        .gamma_set = intel_crtc_gamma_set,
+        .set_config = drm_crtc_helper_set_config,
+        .destroy = intel_crtc_destroy,
+        .page_flip = intel_crtc_page_flip,
+};
+
 static void intel_crtc_init(struct drm_device *dev, int pipe)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
@@ -6330,8 +6337,6 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
 
         setup_timer(&intel_crtc->idle_timer, intel_crtc_idle_timer,
                     (unsigned long)intel_crtc);
-
-        intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
 }
 
 int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
@@ -6572,8 +6577,10 @@ intel_user_framebuffer_create(struct drm_device *dev,
                 return ERR_PTR(-ENOENT);
 
         intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
-        if (!intel_fb)
+        if (!intel_fb) {
+                drm_gem_object_unreference_unlocked(&obj->base);
                 return ERR_PTR(-ENOMEM);
+        }
 
         ret = intel_framebuffer_init(dev, intel_fb, mode_cmd, obj);
         if (ret) {
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index cb8578b7e443..a4d80314e7f8 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1470,7 +1470,8 @@ intel_dp_link_down(struct intel_dp *intel_dp)
 
         if (!HAS_PCH_CPT(dev) &&
             I915_READ(intel_dp->output_reg) & DP_PIPEB_SELECT) {
-                struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.base.crtc);
+                struct drm_crtc *crtc = intel_dp->base.base.crtc;
+
                 /* Hardware workaround: leaving our transcoder select
                  * set to transcoder B while it's off will prevent the
                  * corresponding HDMI output on transcoder A.
@@ -1485,7 +1486,19 @@ intel_dp_link_down(struct intel_dp *intel_dp)
                 /* Changes to enable or select take place the vblank
                  * after being written.
                  */
-                intel_wait_for_vblank(dev, intel_crtc->pipe);
+                if (crtc == NULL) {
+                        /* We can arrive here never having been attached
+                         * to a CRTC, for instance, due to inheriting
+                         * random state from the BIOS.
+                         *
+                         * If the pipe is not running, play safe and
+                         * wait for the clocks to stabilise before
+                         * continuing.
+                         */
+                        POSTING_READ(intel_dp->output_reg);
+                        msleep(50);
+                } else
+                        intel_wait_for_vblank(dev, to_intel_crtc(crtc)->pipe);
         }
 
         I915_WRITE(intel_dp->output_reg, DP & ~DP_PORT_EN);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f5b0d8306d83..1d20712d527f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -338,4 +338,5 @@ extern int intel_overlay_attrs(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
 
 extern void intel_fb_output_poll_changed(struct drm_device *dev);
+extern void intel_fb_restore_mode(struct drm_device *dev);
 #endif /* __INTEL_DRV_H__ */
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 512782728e51..ec49bae73382 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -264,3 +264,13 @@ void intel_fb_output_poll_changed(struct drm_device *dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
         drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper);
 }
+
+void intel_fb_restore_mode(struct drm_device *dev)
+{
+        int ret;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+
+        ret = drm_fb_helper_restore_fbdev_mode(&dev_priv->fbdev->helper);
+        if (ret)
+                DRM_DEBUG("failed to restore crtc mode\n");
+}
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index a562bd2648c7..67cb076d271b 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -539,6 +539,9 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
         struct drm_device *dev = dev_priv->dev;
         struct drm_connector *connector = dev_priv->int_lvds_connector;
 
+        if (dev->switch_power_state != DRM_SWITCH_POWER_ON)
+                return NOTIFY_OK;
+
         /*
          * check and update the status of LVDS connector after receiving
          * the LID nofication event.
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 4256b8ef3947..6b22c1dcc015 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1151,10 +1151,10 @@ intel_tv_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
                             (video_levels->blank << TV_BLANK_LEVEL_SHIFT)));
         {
                 int pipeconf_reg = PIPECONF(pipe);
-                int dspcntr_reg = DSPCNTR(pipe);
+                int dspcntr_reg = DSPCNTR(intel_crtc->plane);
                 int pipeconf = I915_READ(pipeconf_reg);
                 int dspcntr = I915_READ(dspcntr_reg);
-                int dspbase_reg = DSPADDR(pipe);
+                int dspbase_reg = DSPADDR(intel_crtc->plane);
                 int xpos = 0x0, ypos = 0x0;
                 unsigned int xsize, ysize;
                 /* Pipe must be off here */
@@ -1378,7 +1378,9 @@ intel_tv_detect(struct drm_connector *connector, bool force)
         if (type < 0)
                 return connector_status_disconnected;
 
+        intel_tv->type = type;
         intel_tv_find_better_format(connector);
+
         return connector_status_connected;
 }
 
@@ -1670,8 +1672,7 @@ intel_tv_init(struct drm_device *dev)
          *
          * More recent chipsets favour HDMI rather than integrated S-Video.
          */
-        connector->polled =
-                DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT;
+        connector->polled = DRM_CONNECTOR_POLL_CONNECT;
 
         drm_connector_init(dev, connector, &intel_tv_connector_funcs,
                            DRM_MODE_CONNECTOR_SVIDEO);
diff --git a/drivers/gpu/drm/nouveau/nouveau_dma.c b/drivers/gpu/drm/nouveau/nouveau_dma.c
index ce38e97b9428..568caedd7216 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dma.c
@@ -83,7 +83,7 @@ nouveau_dma_init(struct nouveau_channel *chan)
                 return ret;
 
         /* NV_MEMORY_TO_MEMORY_FORMAT requires a notifier object */
-        ret = nouveau_notifier_alloc(chan, NvNotify0, 32, 0xfd0, 0x1000,
+        ret = nouveau_notifier_alloc(chan, NvNotify0, 32, 0xfe0, 0x1000,
                                      &chan->m2mf_ntfy);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 856d56a98d1e..a76514a209b3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -682,6 +682,9 @@ struct drm_nouveau_private {
         /* For PFIFO and PGRAPH. */
         spinlock_t context_switch_lock;
 
+        /* VM/PRAMIN flush, legacy PRAMIN aperture */
+        spinlock_t vm_lock;
+
         /* RAMIN configuration, RAMFC, RAMHT and RAMRO offsets */
         struct nouveau_ramht  *ramht;
         struct nouveau_gpuobj *ramfc;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 889c4454682e..39aee6d4daf8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -181,13 +181,13 @@ nouveau_fbcon_sync(struct fb_info *info)
                 OUT_RING  (chan, 0);
         }
 
-        nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy + 3, 0xffffffff);
+        nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3, 0xffffffff);
         FIRE_RING(chan);
         mutex_unlock(&chan->mutex);
 
         ret = -EBUSY;
         for (i = 0; i < 100000; i++) {
-                if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy + 3)) {
+                if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3)) {
                         ret = 0;
                         break;
                 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 78f467fe30be..c3e953b08992 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -152,8 +152,6 @@ nouveau_mem_vram_fini(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
 
-        nouveau_bo_ref(NULL, &dev_priv->vga_ram);
-
         ttm_bo_device_release(&dev_priv->ttm.bdev);
 
         nouveau_ttm_global_release(dev_priv);
@@ -398,7 +396,7 @@ nouveau_mem_vram_init(struct drm_device *dev)
                         dma_bits = 40;
         } else
         if (drm_pci_device_is_pcie(dev) &&
-            dev_priv->chipset != 0x40 &&
+            dev_priv->chipset  > 0x40 &&
             dev_priv->chipset != 0x45) {
                 if (pci_dma_supported(dev->pdev, DMA_BIT_MASK(39)))
                         dma_bits = 39;
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 7ba3fc0b30c1..5b39718ae1f8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -35,19 +35,22 @@ nouveau_notifier_init_channel(struct nouveau_channel *chan)
 {
         struct drm_device *dev = chan->dev;
         struct nouveau_bo *ntfy = NULL;
-        uint32_t flags;
+        uint32_t flags, ttmpl;
         int ret;
 
-        if (nouveau_vram_notify)
+        if (nouveau_vram_notify) {
                 flags = NOUVEAU_GEM_DOMAIN_VRAM;
-        else
+                ttmpl = TTM_PL_FLAG_VRAM;
+        } else {
                 flags = NOUVEAU_GEM_DOMAIN_GART;
+                ttmpl = TTM_PL_FLAG_TT;
+        }
 
         ret = nouveau_gem_new(dev, NULL, PAGE_SIZE, 0, flags, 0, 0, &ntfy);
         if (ret)
                 return ret;
 
-        ret = nouveau_bo_pin(ntfy, flags);
+        ret = nouveau_bo_pin(ntfy, ttmpl);
         if (ret)
                 goto out_err;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_object.c b/drivers/gpu/drm/nouveau/nouveau_object.c
index 4f00c87ed86e..67a16e01ffa6 100644
--- a/drivers/gpu/drm/nouveau/nouveau_object.c
+++ b/drivers/gpu/drm/nouveau/nouveau_object.c
@@ -1039,19 +1039,20 @@ nv_ro32(struct nouveau_gpuobj *gpuobj, u32 offset)
 {
         struct drm_nouveau_private *dev_priv = gpuobj->dev->dev_private;
         struct drm_device *dev = gpuobj->dev;
+        unsigned long flags;
 
         if (gpuobj->pinst == ~0 || !dev_priv->ramin_available) {
                 u64  ptr = gpuobj->vinst + offset;
                 u32 base = ptr >> 16;
                 u32  val;
 
-                spin_lock(&dev_priv->ramin_lock);
+                spin_lock_irqsave(&dev_priv->vm_lock, flags);
                 if (dev_priv->ramin_base != base) {
                         dev_priv->ramin_base = base;
                         nv_wr32(dev, 0x001700, dev_priv->ramin_base);
                 }
                 val = nv_rd32(dev, 0x700000 + (ptr & 0xffff));
-                spin_unlock(&dev_priv->ramin_lock);
+                spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
                 return val;
         }
 
@@ -1063,18 +1064,19 @@ nv_wo32(struct nouveau_gpuobj *gpuobj, u32 offset, u32 val)
 {
         struct drm_nouveau_private *dev_priv = gpuobj->dev->dev_private;
         struct drm_device *dev = gpuobj->dev;
+        unsigned long flags;
 
         if (gpuobj->pinst == ~0 || !dev_priv->ramin_available) {
                 u64  ptr = gpuobj->vinst + offset;
                 u32 base = ptr >> 16;
 
-                spin_lock(&dev_priv->ramin_lock);
+                spin_lock_irqsave(&dev_priv->vm_lock, flags);
                 if (dev_priv->ramin_base != base) {
                         dev_priv->ramin_base = base;
                         nv_wr32(dev, 0x001700, dev_priv->ramin_base);
                 }
                 nv_wr32(dev, 0x700000 + (ptr & 0xffff), val);
-                spin_unlock(&dev_priv->ramin_lock);
+                spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
                 return;
         }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
index a33fe4019286..4bce801bc588 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -55,6 +55,7 @@ nouveau_sgdma_populate(struct ttm_backend *be, unsigned long num_pages,
                                 be->func->clear(be);
                                 return -EFAULT;
                         }
+                        nvbe->ttm_alloced[nvbe->nr_pages] = false;
                 }
 
                 nvbe->nr_pages++;
@@ -427,7 +428,7 @@ nouveau_sgdma_init(struct drm_device *dev)
         u32 aper_size, align;
         int ret;
 
-        if (dev_priv->card_type >= NV_50 || drm_pci_device_is_pcie(dev))
+        if (dev_priv->card_type >= NV_40 && drm_pci_device_is_pcie(dev))
                 aper_size = 512 * 1024 * 1024;
         else
                 aper_size = 64 * 1024 * 1024;
@@ -457,7 +458,7 @@ nouveau_sgdma_init(struct drm_device *dev)
                 dev_priv->gart_info.func = &nv50_sgdma_backend;
         } else
         if (drm_pci_device_is_pcie(dev) &&
-            dev_priv->chipset != 0x40 && dev_priv->chipset != 0x45) {
+            dev_priv->chipset > 0x40 && dev_priv->chipset != 0x45) {
                 if (nv44_graph_class(dev)) {
                         dev_priv->gart_info.func = &nv44_sgdma_backend;
                         align = 512 * 1024;
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index 6e2b1a6caa2d..915fbce89595 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -608,6 +608,7 @@ nouveau_card_init(struct drm_device *dev)
         spin_lock_init(&dev_priv->channels.lock);
         spin_lock_init(&dev_priv->tile.lock);
         spin_lock_init(&dev_priv->context_switch_lock);
+        spin_lock_init(&dev_priv->vm_lock);
 
         /* Make the CRTCs and I2C buses accessible */
         ret = engine->display.early_init(dev);
@@ -767,6 +768,11 @@ static void nouveau_card_takedown(struct drm_device *dev)
         engine->mc.takedown(dev);
         engine->display.late_takedown(dev);
 
+        if (dev_priv->vga_ram) {
+                nouveau_bo_unpin(dev_priv->vga_ram);
+                nouveau_bo_ref(NULL, &dev_priv->vga_ram);
+        }
+
         mutex_lock(&dev->struct_mutex);
         ttm_bo_clean_mm(&dev_priv->ttm.bdev, TTM_PL_VRAM);
         ttm_bo_clean_mm(&dev_priv->ttm.bdev, TTM_PL_TT);
diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
index a6f8aa651fc6..4f95a1e5822e 100644
--- a/drivers/gpu/drm/nouveau/nv50_instmem.c
+++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
@@ -404,23 +404,25 @@ void
 nv50_instmem_flush(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
+        unsigned long flags;
 
-        spin_lock(&dev_priv->ramin_lock);
+        spin_lock_irqsave(&dev_priv->vm_lock, flags);
         nv_wr32(dev, 0x00330c, 0x00000001);
         if (!nv_wait(dev, 0x00330c, 0x00000002, 0x00000000))
                 NV_ERROR(dev, "PRAMIN flush timeout\n");
-        spin_unlock(&dev_priv->ramin_lock);
+        spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
 }
 
 void
 nv84_instmem_flush(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
+        unsigned long flags;
 
-        spin_lock(&dev_priv->ramin_lock);
+        spin_lock_irqsave(&dev_priv->vm_lock, flags);
         nv_wr32(dev, 0x070000, 0x00000001);
         if (!nv_wait(dev, 0x070000, 0x00000002, 0x00000000))
                 NV_ERROR(dev, "PRAMIN flush timeout\n");
-        spin_unlock(&dev_priv->ramin_lock);
+        spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nv50_vm.c b/drivers/gpu/drm/nouveau/nv50_vm.c
index 4fd3432b5b8d..6c2694490741 100644
--- a/drivers/gpu/drm/nouveau/nv50_vm.c
+++ b/drivers/gpu/drm/nouveau/nv50_vm.c
@@ -174,10 +174,11 @@ void
 nv50_vm_flush_engine(struct drm_device *dev, int engine)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
+        unsigned long flags;
 
-        spin_lock(&dev_priv->ramin_lock);
+        spin_lock_irqsave(&dev_priv->vm_lock, flags);
         nv_wr32(dev, 0x100c80, (engine << 16) | 1);
         if (!nv_wait(dev, 0x100c80, 0x00000001, 0x00000000))
                 NV_ERROR(dev, "vm flush timeout: engine %d\n", engine);
-        spin_unlock(&dev_priv->ramin_lock);
+        spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
 }
diff --git a/drivers/gpu/drm/nouveau/nvc0_vm.c b/drivers/gpu/drm/nouveau/nvc0_vm.c
index a0a2a0277f73..a179e6c55afb 100644
--- a/drivers/gpu/drm/nouveau/nvc0_vm.c
+++ b/drivers/gpu/drm/nouveau/nvc0_vm.c
@@ -104,11 +104,12 @@ nvc0_vm_flush(struct nouveau_vm *vm)
         struct nouveau_instmem_engine *pinstmem = &dev_priv->engine.instmem;
         struct drm_device *dev = vm->dev;
         struct nouveau_vm_pgd *vpgd;
+        unsigned long flags;
         u32 engine = (dev_priv->chan_vm == vm) ? 1 : 5;
 
         pinstmem->flush(vm->dev);
 
-        spin_lock(&dev_priv->ramin_lock);
+        spin_lock_irqsave(&dev_priv->vm_lock, flags);
         list_for_each_entry(vpgd, &vm->pgd_list, head) {
                 /* looks like maybe a "free flush slots" counter, the
                  * faster you write to 0x100cbc to more it decreases
@@ -125,5 +126,5 @@ nvc0_vm_flush(struct nouveau_vm *vm)
                                  nv_rd32(dev, 0x100c80), engine);
                 }
         }
-        spin_unlock(&dev_priv->ramin_lock);
+        spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
 }
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index d71d375149f8..7bd745689097 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -135,7 +135,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                 case ATOM_IIO_MOVE_INDEX:
                         temp &=
                             ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
-                              CU8(base + 2));
+                              CU8(base + 3));
                         temp |=
                             ((index >> CU8(base + 2)) &
                              (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -145,7 +145,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                 case ATOM_IIO_MOVE_DATA:
                         temp &=
                             ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
-                              CU8(base + 2));
+                              CU8(base + 3));
                         temp |=
                             ((data >> CU8(base + 2)) &
                              (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -155,7 +155,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                 case ATOM_IIO_MOVE_ATTR:
                         temp &=
                             ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
-                              CU8(base + 2));
+                              CU8(base + 3));
                         temp |=
                             ((ctx->
                               io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 -
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 9d516a8c4dfa..529a3a704731 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -532,10 +532,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                 else
                         pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
 
-                if ((rdev->family == CHIP_R600) ||
-                    (rdev->family == CHIP_RV610) ||
-                    (rdev->family == CHIP_RV630) ||
-                    (rdev->family == CHIP_RV670))
+                if (rdev->family < CHIP_RV770)
                         pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
         } else {
                 pll->flags |= RADEON_PLL_LEGACY;
@@ -565,7 +562,6 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                         if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
                                 if (ss_enabled) {
                                         if (ss->refdiv) {
-                                                pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
                                                 pll->flags |= RADEON_PLL_USE_REF_DIV;
                                                 pll->reference_div = ss->refdiv;
                                                 if (ASIC_IS_AVIVO(rdev))
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 3453910ee0f3..c20eac3379e6 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -353,7 +353,7 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev,
                                         struct drm_display_mode *mode,
                                         struct drm_display_mode *other_mode)
 {
-        u32 tmp = 0;
+        u32 tmp;
         /*
          * Line Buffer Setup
          * There are 3 line buffers, each one shared by 2 display controllers.
@@ -363,64 +363,63 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev,
          * first display controller
          *  0 - first half of lb (3840 * 2)
          *  1 - first 3/4 of lb (5760 * 2)
-         *  2 - whole lb (7680 * 2)
+         *  2 - whole lb (7680 * 2), other crtc must be disabled
          *  3 - first 1/4 of lb (1920 * 2)
          * second display controller
          *  4 - second half of lb (3840 * 2)
          *  5 - second 3/4 of lb (5760 * 2)
-         *  6 - whole lb (7680 * 2)
+         *  6 - whole lb (7680 * 2), other crtc must be disabled
          *  7 - last 1/4 of lb (1920 * 2)
          */
-        if (mode && other_mode) {
-                if (mode->hdisplay > other_mode->hdisplay) {
-                        if (mode->hdisplay > 2560)
-                                tmp = 1; /* 3/4 */
-                        else
-                                tmp = 0; /* 1/2 */
-                } else if (other_mode->hdisplay > mode->hdisplay) {
-                        if (other_mode->hdisplay > 2560)
-                                tmp = 3; /* 1/4 */
-                        else
-                                tmp = 0; /* 1/2 */
-                } else
+        /* this can get tricky if we have two large displays on a paired group
+         * of crtcs.  Ideally for multiple large displays we'd assign them to
+         * non-linked crtcs for maximum line buffer allocation.
+         */
+        if (radeon_crtc->base.enabled && mode) {
+                if (other_mode)
                         tmp = 0; /* 1/2 */
-        } else if (mode)
-                tmp = 2; /* whole */
-        else if (other_mode)
-                tmp = 3; /* 1/4 */
+                else
+                        tmp = 2; /* whole */
+        } else
+                tmp = 0;
 
         /* second controller of the pair uses second half of the lb */
         if (radeon_crtc->crtc_id % 2)
                 tmp += 4;
         WREG32(DC_LB_MEMORY_SPLIT + radeon_crtc->crtc_offset, tmp);
 
-        switch (tmp) {
-        case 0:
-        case 4:
-        default:
-                if (ASIC_IS_DCE5(rdev))
-                        return 4096 * 2;
-                else
-                        return 3840 * 2;
-        case 1:
-        case 5:
-                if (ASIC_IS_DCE5(rdev))
-                        return 6144 * 2;
-                else
-                        return 5760 * 2;
-        case 2:
-        case 6:
-                if (ASIC_IS_DCE5(rdev))
-                        return 8192 * 2;
-                else
-                        return 7680 * 2;
-        case 3:
-        case 7:
-                if (ASIC_IS_DCE5(rdev))
-                        return 2048 * 2;
-                else
-                        return 1920 * 2;
+        if (radeon_crtc->base.enabled && mode) {
+                switch (tmp) {
+                case 0:
+                case 4:
+                default:
+                        if (ASIC_IS_DCE5(rdev))
+                                return 4096 * 2;
+                        else
+                                return 3840 * 2;
+                case 1:
+                case 5:
+                        if (ASIC_IS_DCE5(rdev))
+                                return 6144 * 2;
+                        else
+                                return 5760 * 2;
+                case 2:
+                case 6:
+                        if (ASIC_IS_DCE5(rdev))
+                                return 8192 * 2;
+                        else
+                                return 7680 * 2;
+                case 3:
+                case 7:
+                        if (ASIC_IS_DCE5(rdev))
+                                return 2048 * 2;
+                        else
+                                return 1920 * 2;
+                }
         }
+
+        /* controller not enabled, so no lb used */
+        return 0;
 }
 
 static u32 evergreen_get_number_of_dram_channels(struct radeon_device *rdev)
@@ -863,9 +862,15 @@ int evergreen_pcie_gart_enable(struct radeon_device *rdev)
                 SYSTEM_ACCESS_MODE_NOT_IN_SYS |
                 SYSTEM_APERTURE_UNMAPPED_ACCESS_PASS_THRU |
                 EFFECTIVE_L1_TLB_SIZE(5) | EFFECTIVE_L1_QUEUE_SIZE(5);
-        WREG32(MC_VM_MD_L1_TLB0_CNTL, tmp);
-        WREG32(MC_VM_MD_L1_TLB1_CNTL, tmp);
-        WREG32(MC_VM_MD_L1_TLB2_CNTL, tmp);
+        if (rdev->flags & RADEON_IS_IGP) {
+                WREG32(FUS_MC_VM_MD_L1_TLB0_CNTL, tmp);
+                WREG32(FUS_MC_VM_MD_L1_TLB1_CNTL, tmp);
+                WREG32(FUS_MC_VM_MD_L1_TLB2_CNTL, tmp);
+        } else {
+                WREG32(MC_VM_MD_L1_TLB0_CNTL, tmp);
+                WREG32(MC_VM_MD_L1_TLB1_CNTL, tmp);
+                WREG32(MC_VM_MD_L1_TLB2_CNTL, tmp);
+        }
         WREG32(MC_VM_MB_L1_TLB0_CNTL, tmp);
         WREG32(MC_VM_MB_L1_TLB1_CNTL, tmp);
         WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
@@ -2581,7 +2586,7 @@ static inline u32 evergreen_get_ih_wptr(struct radeon_device *rdev)
         u32 wptr, tmp;
 
         if (rdev->wb.enabled)
-                wptr = rdev->wb.wb[R600_WB_IH_WPTR_OFFSET/4];
+                wptr = le32_to_cpu(rdev->wb.wb[R600_WB_IH_WPTR_OFFSET/4]);
         else
                 wptr = RREG32(IH_RB_WPTR);
 
@@ -2924,11 +2929,6 @@ static int evergreen_startup(struct radeon_device *rdev)
                 rdev->asic->copy = NULL;
                 dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
         }
-        /* XXX: ontario has problems blitting to gart at the moment */
-        if (rdev->family == CHIP_PALM) {
-                rdev->asic->copy = NULL;
-                radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
-        }
 
         /* allocate wb buffer */
         r = radeon_wb_init(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index 9aaa3f0c9372..94533849927e 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -221,6 +221,11 @@
 #define MC_VM_MD_L1_TLB0_CNTL                           0x2654
 #define MC_VM_MD_L1_TLB1_CNTL                           0x2658
 #define MC_VM_MD_L1_TLB2_CNTL                           0x265C
+
+#define FUS_MC_VM_MD_L1_TLB0_CNTL                       0x265C
+#define FUS_MC_VM_MD_L1_TLB1_CNTL                       0x2660
+#define FUS_MC_VM_MD_L1_TLB2_CNTL                       0x2664
+
 #define MC_VM_SYSTEM_APERTURE_DEFAULT_ADDR              0x203C
 #define MC_VM_SYSTEM_APERTURE_HIGH_ADDR                 0x2038
 #define MC_VM_SYSTEM_APERTURE_LOW_ADDR                  0x2034
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 15d58292677a..6f27593901c7 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3231,7 +3231,7 @@ static inline u32 r600_get_ih_wptr(struct radeon_device *rdev)
         u32 wptr, tmp;
 
         if (rdev->wb.enabled)
-                wptr = rdev->wb.wb[R600_WB_IH_WPTR_OFFSET/4];
+                wptr = le32_to_cpu(rdev->wb.wb[R600_WB_IH_WPTR_OFFSET/4]);
         else
                 wptr = RREG32(IH_RB_WPTR);
 
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index f5d12fb103fa..dd881d035f09 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -431,7 +431,7 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                 }
         }
 
-        /* Acer laptop (Acer TravelMate 5730G) has an HDMI port
+        /* Acer laptop (Acer TravelMate 5730/5730G) has an HDMI port
          * on the laptop and a DVI port on the docking station and
          * both share the same encoder, hpd pin, and ddc line.
          * So while the bios table is technically correct,
@@ -440,7 +440,7 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
          * with different crtcs which isn't possible on the hardware
          * side and leaves no crtcs for LVDS or VGA.
          */
-        if ((dev->pdev->device == 0x95c4) &&
+        if (((dev->pdev->device == 0x95c4) || (dev->pdev->device == 0x9591)) &&
             (dev->pdev->subsystem_vendor == 0x1025) &&
             (dev->pdev->subsystem_device == 0x013c)) {
                 if ((*connector_type == DRM_MODE_CONNECTOR_DVII) &&
@@ -1599,9 +1599,10 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
                                                         memcpy((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0],
                                                                fake_edid_record->ucFakeEDIDLength);
 
-                                                        if (drm_edid_is_valid(edid))
+                                                        if (drm_edid_is_valid(edid)) {
                                                                 rdev->mode_info.bios_hardcoded_edid = edid;
-                                                        else
+                                                                rdev->mode_info.bios_hardcoded_edid_size = edid_size;
+                                                        } else
                                                                 kfree(edid);
                                                 }
                                         }
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index ed5dfe58f29c..9d95792bea3e 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -15,6 +15,9 @@
 #define ATPX_VERSION 0
 #define ATPX_GPU_PWR 2
 #define ATPX_MUX_SELECT 3
+#define ATPX_I2C_MUX_SELECT 4
+#define ATPX_SWITCH_START 5
+#define ATPX_SWITCH_END 6
 
 #define ATPX_INTEGRATED 0
 #define ATPX_DISCRETE 1
@@ -149,13 +152,35 @@ static int radeon_atpx_switch_mux(acpi_handle handle, int mux_id)
         return radeon_atpx_execute(handle, ATPX_MUX_SELECT, mux_id);
 }
 
+static int radeon_atpx_switch_i2c_mux(acpi_handle handle, int mux_id)
+{
+        return radeon_atpx_execute(handle, ATPX_I2C_MUX_SELECT, mux_id);
+}
+
+static int radeon_atpx_switch_start(acpi_handle handle, int gpu_id)
+{
+        return radeon_atpx_execute(handle, ATPX_SWITCH_START, gpu_id);
+}
+
+static int radeon_atpx_switch_end(acpi_handle handle, int gpu_id)
+{
+        return radeon_atpx_execute(handle, ATPX_SWITCH_END, gpu_id);
+}
 
 static int radeon_atpx_switchto(enum vga_switcheroo_client_id id)
 {
+        int gpu_id;
+
         if (id == VGA_SWITCHEROO_IGD)
-                radeon_atpx_switch_mux(radeon_atpx_priv.atpx_handle, 0);
+                gpu_id = ATPX_INTEGRATED;
         else
-                radeon_atpx_switch_mux(radeon_atpx_priv.atpx_handle, 1);
+                gpu_id = ATPX_DISCRETE;
+
+        radeon_atpx_switch_start(radeon_atpx_priv.atpx_handle, gpu_id);
+        radeon_atpx_switch_mux(radeon_atpx_priv.atpx_handle, gpu_id);
+        radeon_atpx_switch_i2c_mux(radeon_atpx_priv.atpx_handle, gpu_id);
+        radeon_atpx_switch_end(radeon_atpx_priv.atpx_handle, gpu_id);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 2ef6d5135064..5f45fa12bb8b 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1199,7 +1199,7 @@ radeon_add_atom_connector(struct drm_device *dev,
         if (router->ddc_valid || router->cd_valid) {
                 radeon_connector->router_bus = radeon_i2c_lookup(rdev, &router->i2c_info);
                 if (!radeon_connector->router_bus)
-                        goto failed;
+                        DRM_ERROR("Failed to assign router i2c bus! Check dmesg for i2c errors.\n");
         }
         switch (connector_type) {
         case DRM_MODE_CONNECTOR_VGA:
@@ -1208,7 +1208,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("VGA: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 radeon_connector->dac_load_detect = true;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1226,7 +1226,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DVIA: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 radeon_connector->dac_load_detect = true;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1249,7 +1249,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DVI: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 subpixel_order = SubPixelHorizontalRGB;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1290,7 +1290,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("HDMI: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 drm_connector_attach_property(&radeon_connector->base,
                                               rdev->mode_info.coherent_mode_property,
@@ -1329,10 +1329,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                         else
                                 radeon_dig_connector->dp_i2c_bus = radeon_i2c_create_dp(dev, i2c_bus, "DP-auxch");
                         if (!radeon_dig_connector->dp_i2c_bus)
-                                goto failed;
+                                DRM_ERROR("DP: Failed to assign dp ddc bus! Check dmesg for i2c errors.\n");
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DP: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 subpixel_order = SubPixelHorizontalRGB;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1381,7 +1381,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("LVDS: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 drm_connector_attach_property(&radeon_connector->base,
                                               dev->mode_config.scaling_mode_property,
@@ -1457,7 +1457,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("VGA: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 radeon_connector->dac_load_detect = true;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1475,7 +1475,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DVIA: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 radeon_connector->dac_load_detect = true;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1493,7 +1493,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DVI: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                         radeon_connector->dac_load_detect = true;
@@ -1538,7 +1538,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("LVDS: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 drm_connector_attach_property(&radeon_connector->base,
                                               dev->mode_config.scaling_mode_property,
@@ -1567,9 +1567,4 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                 radeon_legacy_backlight_init(radeon_encoder, connector);
                 }
         }
-        return;
-
-failed:
-        drm_connector_cleanup(connector);
-        kfree(connector);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index bdf2fa1189ae..3189a7efb2e9 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -167,9 +167,6 @@ int radeon_crtc_cursor_set(struct drm_crtc *crtc,
                 return -EINVAL;
         }
 
-        radeon_crtc->cursor_width = width;
-        radeon_crtc->cursor_height = height;
-
         obj = drm_gem_object_lookup(crtc->dev, file_priv, handle);
         if (!obj) {
                 DRM_ERROR("Cannot find cursor object %x for crtc %d\n", handle, radeon_crtc->crtc_id);
@@ -180,6 +177,9 @@ int radeon_crtc_cursor_set(struct drm_crtc *crtc,
         if (ret)
                 goto fail;
 
+        radeon_crtc->cursor_width = width;
+        radeon_crtc->cursor_height = height;
+
         radeon_lock_cursor(crtc, true);
         /* XXX only 27 bit offset for legacy cursor */
         radeon_set_cursor(crtc, obj, gpu_addr);
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index ccbabf734a61..983cbac75af0 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -1096,6 +1096,9 @@ void radeon_router_select_ddc_port(struct radeon_connector *radeon_connector)
         if (!radeon_connector->router.ddc_valid)
                 return;
 
+        if (!radeon_connector->router_bus)
+                return;
+
         radeon_i2c_get_byte(radeon_connector->router_bus,
                             radeon_connector->router.i2c_addr,
                             0x3, &val);
@@ -1121,6 +1124,9 @@ void radeon_router_select_cd_port(struct radeon_connector *radeon_connector)
         if (!radeon_connector->router.cd_valid)
                 return;
 
+        if (!radeon_connector->router_bus)
+                return;
+
         radeon_i2c_get_byte(radeon_connector->router_bus,
                             radeon_connector->router.i2c_addr,
                             0x3, &val);
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index bf7d4c061451..bd58af658581 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -221,6 +221,22 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                         return -EINVAL;
                 }
                 break;
+        case RADEON_INFO_NUM_TILE_PIPES:
+                if (rdev->family >= CHIP_CAYMAN)
+                        value = rdev->config.cayman.max_tile_pipes;
+                else if (rdev->family >= CHIP_CEDAR)
+                        value = rdev->config.evergreen.max_tile_pipes;
+                else if (rdev->family >= CHIP_RV770)
+                        value = rdev->config.rv770.max_tile_pipes;
+                else if (rdev->family >= CHIP_R600)
+                        value = rdev->config.r600.max_tile_pipes;
+                else {
+                        return -EINVAL;
+                }
+                break;
+        case RADEON_INFO_FUSION_GART_WORKING:
+                value = 1;
+                break;
         default:
                 DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/reg_srcs/r600 b/drivers/gpu/drm/radeon/reg_srcs/r600
index af0da4ae3f55..92f1900dc7ca 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/r600
+++ b/drivers/gpu/drm/radeon/reg_srcs/r600
@@ -708,6 +708,7 @@ r600 0x9400
 0x00028D0C DB_RENDER_CONTROL
 0x00028D10 DB_RENDER_OVERRIDE
 0x0002880C DB_SHADER_CONTROL
+0x00028D28 DB_SRESULTS_COMPARE_STATE0
 0x00028D2C DB_SRESULTS_COMPARE_STATE1
 0x00028430 DB_STENCILREFMASK
 0x00028434 DB_STENCILREFMASK_BF
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 060ef6327876..50e40dbd8bb6 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -110,8 +110,7 @@ config SENSORS_ADM1021
         help
           If you say yes here you get support for Analog Devices ADM1021
           and ADM1023 sensor chips and clones: Maxim MAX1617 and MAX1617A,
-          Genesys Logic GL523SM, National Semiconductor LM84, TI THMC10,
-          and the XEON processor built-in sensor.
+          Genesys Logic GL523SM, National Semiconductor LM84 and TI THMC10.
 
           This driver can also be built as a module.  If so, the module
           will be called adm1021.
@@ -618,10 +617,10 @@ config SENSORS_LM90
         depends on I2C
         help
           If you say yes here you get support for National Semiconductor LM90,
-          LM86, LM89 and LM99, Analog Devices ADM1032 and ADT7461, Maxim
-          MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
-          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, and Winbond/Nuvoton
-          W83L771W/G/AWG/ASG sensor chips.
+          LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A,
+          Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
+          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008,
+          and Winbond/Nuvoton W83L771W/G/AWG/ASG sensor chips.
 
           This driver can also be built as a module.  If so, the module
           will be called lm90.
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 250d099ca398..da72dc12068c 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1094,6 +1094,7 @@ static struct attribute *lm85_attributes_minctl[] = {
         &sensor_dev_attr_pwm1_auto_pwm_minctl.dev_attr.attr,
         &sensor_dev_attr_pwm2_auto_pwm_minctl.dev_attr.attr,
         &sensor_dev_attr_pwm3_auto_pwm_minctl.dev_attr.attr,
+        NULL
 };
 
 static const struct attribute_group lm85_group_minctl = {
@@ -1104,6 +1105,7 @@ static struct attribute *lm85_attributes_temp_off[] = {
         &sensor_dev_attr_temp1_auto_temp_off.dev_attr.attr,
         &sensor_dev_attr_temp2_auto_temp_off.dev_attr.attr,
         &sensor_dev_attr_temp3_auto_temp_off.dev_attr.attr,
+        NULL
 };
 
 static const struct attribute_group lm85_group_temp_off = {
@@ -1329,11 +1331,11 @@ static int lm85_probe(struct i2c_client *client,
         if (data->type != emc6d103s) {
                 err = sysfs_create_group(&client->dev.kobj, &lm85_group_minctl);
                 if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
                 err = sysfs_create_group(&client->dev.kobj,
                                          &lm85_group_temp_off);
                 if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
         }
 
         /* The ADT7463/68 have an optional VRM 10 mode where pin 21 is used
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index c43b4e9f96a9..2f94f9504804 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -49,10 +49,10 @@
  * chips, but support three temperature sensors instead of two. MAX6695
  * and MAX6696 only differ in the pinout so they can be treated identically.
  *
- * This driver also supports the ADT7461 chip from Analog Devices.
- * It's supported in both compatibility and extended mode. It is mostly
- * compatible with LM90 except for a data format difference for the
- * temperature value registers.
+ * This driver also supports ADT7461 and ADT7461A from Analog Devices as well as
+ * NCT1008 from ON Semiconductor. The chips are supported in both compatibility
+ * and extended mode. They are mostly compatible with LM90 except for a data
+ * format difference for the temperature value registers.
  *
  * Since the LM90 was the first chipset supported by this driver, most
  * comments will refer to this chipset, but are actually general and
@@ -88,9 +88,10 @@
  * Addresses to scan
  * Address is fully defined internally and cannot be changed except for
  * MAX6659, MAX6680 and MAX6681.
- * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, MAX6649, MAX6657,
- * MAX6658 and W83L771 have address 0x4c.
- * ADM1032-2, ADT7461-2, LM89-1, LM99-1 and MAX6646 have address 0x4d.
+ * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, ADT7461A, MAX6649,
+ * MAX6657, MAX6658, NCT1008 and W83L771 have address 0x4c.
+ * ADM1032-2, ADT7461-2, ADT7461A-2, LM89-1, LM99-1, MAX6646, and NCT1008D
+ * have address 0x4d.
  * MAX6647 has address 0x4e.
  * MAX6659 can have address 0x4c, 0x4d or 0x4e.
  * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b,
@@ -174,6 +175,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
 static const struct i2c_device_id lm90_id[] = {
         { "adm1032", adm1032 },
         { "adt7461", adt7461 },
+        { "adt7461a", adt7461 },
         { "lm90", lm90 },
         { "lm86", lm86 },
         { "lm89", lm86 },
@@ -188,6 +190,7 @@ static const struct i2c_device_id lm90_id[] = {
         { "max6681", max6680 },
         { "max6695", max6696 },
         { "max6696", max6696 },
+        { "nct1008", adt7461 },
         { "w83l771", w83l771 },
         { }
 };
@@ -1153,6 +1156,11 @@ static int lm90_detect(struct i2c_client *new_client,
                  && (reg_config1 & 0x1B) == 0x00
                  && reg_convrate <= 0x0A) {
                         name = "adt7461";
+                } else
+                if (chip_id == 0x57 /* ADT7461A, NCT1008 */
+                 && (reg_config1 & 0x1B) == 0x00
+                 && reg_convrate <= 0x0A) {
+                        name = "adt7461a";
                 }
         } else
         if (man_id == 0x4D) { /* Maxim */
diff --git a/drivers/hwmon/pmbus_core.c b/drivers/hwmon/pmbus_core.c
index edfb92e41735..196ffafafd88 100644
--- a/drivers/hwmon/pmbus_core.c
+++ b/drivers/hwmon/pmbus_core.c
@@ -139,7 +139,6 @@ struct pmbus_data {
          * A single status register covers multiple attributes,
          * so we keep them all together.
          */
-        u8 status_bits;
         u8 status[PB_NUM_STATUS_REG];
 
         u8 currpage;
diff --git a/drivers/hwmon/twl4030-madc-hwmon.c b/drivers/hwmon/twl4030-madc-hwmon.c
index de5819199e2e..57240740b161 100644
--- a/drivers/hwmon/twl4030-madc-hwmon.c
+++ b/drivers/hwmon/twl4030-madc-hwmon.c
@@ -98,7 +98,6 @@ static const struct attribute_group twl4030_madc_group = {
 static int __devinit twl4030_madc_hwmon_probe(struct platform_device *pdev)
 {
         int ret;
-        int status;
         struct device *hwmon;
 
         ret = sysfs_create_group(&pdev->dev.kobj, &twl4030_madc_group);
@@ -107,7 +106,7 @@ static int __devinit twl4030_madc_hwmon_probe(struct platform_device *pdev)
         hwmon = hwmon_device_register(&pdev->dev);
         if (IS_ERR(hwmon)) {
                 dev_err(&pdev->dev, "hwmon_device_register failed.\n");
-                status = PTR_ERR(hwmon);
+                ret = PTR_ERR(hwmon);
                 goto err_reg;
         }
 
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 72c0415f6f94..455e909bc768 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -134,10 +134,15 @@
                                  SMBHSTSTS_BUS_ERR | SMBHSTSTS_DEV_ERR | \
                                  SMBHSTSTS_INTR)
 
+/* Older devices have their ID defined in <linux/pci_ids.h> */
+#define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS   0x1c22
+#define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS      0x1d22
 /* Patsburg also has three 'Integrated Device Function' SMBus controllers */
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF0 0x1d70
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF1 0x1d71
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF2 0x1d72
+#define PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS      0x2330
+#define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
 
 struct i801_priv {
         struct i2c_adapter adapter;
diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
index 0eb1515541e7..2dbba163b102 100644
--- a/drivers/i2c/busses/i2c-parport.c
+++ b/drivers/i2c/busses/i2c-parport.c
@@ -1,7 +1,7 @@
 /* ------------------------------------------------------------------------ *
  * i2c-parport.c I2C bus over parallel port                                 *
  * ------------------------------------------------------------------------ *
-   Copyright (C) 2003-2010 Jean Delvare <khali@linux-fr.org>
+   Copyright (C) 2003-2011 Jean Delvare <khali@linux-fr.org>
    
    Based on older i2c-philips-par.c driver
    Copyright (C) 1995-2000 Simon G. Vogl
@@ -33,6 +33,8 @@
 #include <linux/i2c-algo-bit.h>
 #include <linux/i2c-smbus.h>
 #include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
 #include "i2c-parport.h"
 
 /* ----- Device list ------------------------------------------------------ */
@@ -43,10 +45,11 @@ struct i2c_par {
         struct i2c_algo_bit_data algo_data;
         struct i2c_smbus_alert_setup alert_data;
         struct i2c_client *ara;
-        struct i2c_par *next;
+        struct list_head node;
 };
 
-static struct i2c_par *adapter_list;
+static LIST_HEAD(adapter_list);
+static DEFINE_MUTEX(adapter_list_lock);
 
 /* ----- Low-level parallel port access ----------------------------------- */
 
@@ -228,8 +231,9 @@ static void i2c_parport_attach (struct parport *port)
         }
 
         /* Add the new adapter to the list */
-        adapter->next = adapter_list;
-        adapter_list = adapter;
+        mutex_lock(&adapter_list_lock);
+        list_add_tail(&adapter->node, &adapter_list);
+        mutex_unlock(&adapter_list_lock);
         return;
 
 ERROR1:
@@ -241,11 +245,11 @@ ERROR0:
 
 static void i2c_parport_detach (struct parport *port)
 {
-        struct i2c_par *adapter, *prev;
+        struct i2c_par *adapter, *_n;
 
         /* Walk the list */
-        for (prev = NULL, adapter = adapter_list; adapter;
-             prev = adapter, adapter = adapter->next) {
+        mutex_lock(&adapter_list_lock);
+        list_for_each_entry_safe(adapter, _n, &adapter_list, node) {
                 if (adapter->pdev->port == port) {
                         if (adapter->ara) {
                                 parport_disable_irq(port);
@@ -259,14 +263,11 @@ static void i2c_parport_detach (struct parport *port)
                                 
                         parport_release(adapter->pdev);
                         parport_unregister_device(adapter->pdev);
-                        if (prev)
-                                prev->next = adapter->next;
-                        else
-                                adapter_list = adapter->next;
+                        list_del(&adapter->node);
                         kfree(adapter);
-                        return;
                 }
         }
+        mutex_unlock(&adapter_list_lock);
 }
 
 static struct parport_driver i2c_parport_driver = {
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index fd1e11799137..a5ec5a7cb381 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -1782,7 +1782,6 @@ static int ide_cd_probe(ide_drive_t *drive)
         ide_cd_read_toc(drive, &sense);
         g->fops = &idecd_ops;
         g->flags |= GENHD_FL_REMOVABLE;
-        g->events = DISK_EVENT_MEDIA_CHANGE;
         add_disk(g);
         return 0;
 
diff --git a/drivers/ide/ide-cd_ioctl.c b/drivers/ide/ide-cd_ioctl.c
index 2a6bc50e8a41..02caa7dd51c8 100644
--- a/drivers/ide/ide-cd_ioctl.c
+++ b/drivers/ide/ide-cd_ioctl.c
@@ -79,6 +79,12 @@ int ide_cdrom_drive_status(struct cdrom_device_info *cdi, int slot_nr)
         return CDS_DRIVE_NOT_READY;
 }
 
+/*
+ * ide-cd always generates media changed event if media is missing, which
+ * makes it impossible to use for proper event reporting, so disk->events
+ * is cleared to 0 and the following function is used only to trigger
+ * revalidation and never propagated to userland.
+ */
 unsigned int ide_cdrom_check_events_real(struct cdrom_device_info *cdi,
                                          unsigned int clearing, int slot_nr)
 {
diff --git a/drivers/ide/ide-gd.c b/drivers/ide/ide-gd.c
index c4ffd4888939..70ea8763567d 100644
--- a/drivers/ide/ide-gd.c
+++ b/drivers/ide/ide-gd.c
@@ -298,6 +298,12 @@ static unsigned int ide_gd_check_events(struct gendisk *disk,
                 return 0;
         }
 
+        /*
+         * The following is used to force revalidation on the first open on
+         * removeable devices, and never gets reported to userland as
+         * genhd->events is 0.  This is intended as removeable ide disk
+         * can't really detect MEDIA_CHANGE events.
+         */
         ret = drive->dev_flags & IDE_DFLAG_MEDIA_CHANGED;
         drive->dev_flags &= ~IDE_DFLAG_MEDIA_CHANGED;
 
@@ -413,7 +419,6 @@ static int ide_gd_probe(ide_drive_t *drive)
         if (drive->dev_flags & IDE_DFLAG_REMOVABLE)
                 g->flags = GENHD_FL_REMOVABLE;
         g->fops = &ide_gd_ops;
-        g->events = DISK_EVENT_MEDIA_CHANGE;
         add_disk(g);
         return 0;
 
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index 7de4b7ebffc5..d8ca0a0b970d 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -1799,7 +1799,7 @@ static int qib_6120_setup_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
index 74fe0360bec7..c765a2eb04cf 100644
--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
@@ -2111,7 +2111,7 @@ static int qib_setup_7220_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 55de3cf3441c..6bab3eaea70f 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -3299,7 +3299,7 @@ static int qib_do_7322_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT | QIB_BADINTR);
         dd->flags |= QIB_DOING_RESET;
diff --git a/drivers/input/touchscreen/wm831x-ts.c b/drivers/input/touchscreen/wm831x-ts.c
index 6ae054f8e0aa..9175d49d2546 100644
--- a/drivers/input/touchscreen/wm831x-ts.c
+++ b/drivers/input/touchscreen/wm831x-ts.c
@@ -68,8 +68,23 @@ struct wm831x_ts {
         unsigned int pd_irq;
         bool pressure;
         bool pen_down;
+        struct work_struct pd_data_work;
 };
 
+static void wm831x_pd_data_work(struct work_struct *work)
+{
+        struct wm831x_ts *wm831x_ts =
+                container_of(work, struct wm831x_ts, pd_data_work);
+
+        if (wm831x_ts->pen_down) {
+                enable_irq(wm831x_ts->data_irq);
+                dev_dbg(wm831x_ts->wm831x->dev, "IRQ PD->DATA done\n");
+        } else {
+                enable_irq(wm831x_ts->pd_irq);
+                dev_dbg(wm831x_ts->wm831x->dev, "IRQ DATA->PD done\n");
+        }
+}
+
 static irqreturn_t wm831x_ts_data_irq(int irq, void *irq_data)
 {
         struct wm831x_ts *wm831x_ts = irq_data;
@@ -110,6 +125,9 @@ static irqreturn_t wm831x_ts_data_irq(int irq, void *irq_data)
         }
 
         if (!wm831x_ts->pen_down) {
+                /* Switch from data to pen down */
+                dev_dbg(wm831x->dev, "IRQ DATA->PD\n");
+
                 disable_irq_nosync(wm831x_ts->data_irq);
 
                 /* Don't need data any more */
@@ -128,6 +146,10 @@ static irqreturn_t wm831x_ts_data_irq(int irq, void *irq_data)
                                          ABS_PRESSURE, 0);
 
                 input_report_key(wm831x_ts->input_dev, BTN_TOUCH, 0);
+
+                schedule_work(&wm831x_ts->pd_data_work);
+        } else {
+                input_report_key(wm831x_ts->input_dev, BTN_TOUCH, 1);
         }
 
         input_sync(wm831x_ts->input_dev);
@@ -141,6 +163,11 @@ static irqreturn_t wm831x_ts_pen_down_irq(int irq, void *irq_data)
         struct wm831x *wm831x = wm831x_ts->wm831x;
         int ena = 0;
 
+        if (wm831x_ts->pen_down)
+                return IRQ_HANDLED;
+
+        disable_irq_nosync(wm831x_ts->pd_irq);
+
         /* Start collecting data */
         if (wm831x_ts->pressure)
                 ena |= WM831X_TCH_Z_ENA;
@@ -149,14 +176,14 @@ static irqreturn_t wm831x_ts_pen_down_irq(int irq, void *irq_data)
                         WM831X_TCH_X_ENA | WM831X_TCH_Y_ENA | WM831X_TCH_Z_ENA,
                         WM831X_TCH_X_ENA | WM831X_TCH_Y_ENA | ena);
 
-        input_report_key(wm831x_ts->input_dev, BTN_TOUCH, 1);
-        input_sync(wm831x_ts->input_dev);
-
         wm831x_set_bits(wm831x, WM831X_INTERRUPT_STATUS_1,
                         WM831X_TCHPD_EINT, WM831X_TCHPD_EINT);
 
         wm831x_ts->pen_down = true;
-        enable_irq(wm831x_ts->data_irq);
+
+        /* Switch from pen down to data */
+        dev_dbg(wm831x->dev, "IRQ PD->DATA\n");
+        schedule_work(&wm831x_ts->pd_data_work);
 
         return IRQ_HANDLED;
 }
@@ -182,13 +209,28 @@ static void wm831x_ts_input_close(struct input_dev *idev)
         struct wm831x_ts *wm831x_ts = input_get_drvdata(idev);
         struct wm831x *wm831x = wm831x_ts->wm831x;
 
+        /* Shut the controller down, disabling all other functionality too */
         wm831x_set_bits(wm831x, WM831X_TOUCH_CONTROL_1,
-                        WM831X_TCH_ENA | WM831X_TCH_CVT_ENA |
-                        WM831X_TCH_X_ENA | WM831X_TCH_Y_ENA |
-                        WM831X_TCH_Z_ENA, 0);
+                        WM831X_TCH_ENA | WM831X_TCH_X_ENA |
+                        WM831X_TCH_Y_ENA | WM831X_TCH_Z_ENA, 0);
 
-        if (wm831x_ts->pen_down)
+        /* Make sure any pending IRQs are done, the above will prevent
+         * new ones firing.
+         */
+        synchronize_irq(wm831x_ts->data_irq);
+        synchronize_irq(wm831x_ts->pd_irq);
+
+        /* Make sure the IRQ completion work is quiesced */
+        flush_work_sync(&wm831x_ts->pd_data_work);
+
+        /* If we ended up with the pen down then make sure we revert back
+         * to pen detection state for the next time we start up.
+         */
+        if (wm831x_ts->pen_down) {
                 disable_irq(wm831x_ts->data_irq);
+                enable_irq(wm831x_ts->pd_irq);
+                wm831x_ts->pen_down = false;
+        }
 }
 
 static __devinit int wm831x_ts_probe(struct platform_device *pdev)
@@ -198,7 +240,7 @@ static __devinit int wm831x_ts_probe(struct platform_device *pdev)
         struct wm831x_pdata *core_pdata = dev_get_platdata(pdev->dev.parent);
         struct wm831x_touch_pdata *pdata = NULL;
         struct input_dev *input_dev;
-        int error;
+        int error, irqf;
 
         if (core_pdata)
                 pdata = core_pdata->touch;
@@ -212,6 +254,7 @@ static __devinit int wm831x_ts_probe(struct platform_device *pdev)
 
         wm831x_ts->wm831x = wm831x;
         wm831x_ts->input_dev = input_dev;
+        INIT_WORK(&wm831x_ts->pd_data_work, wm831x_pd_data_work);
 
         /*
          * If we have a direct IRQ use it, otherwise use the interrupt
@@ -270,9 +313,14 @@ static __devinit int wm831x_ts_probe(struct platform_device *pdev)
         wm831x_set_bits(wm831x, WM831X_TOUCH_CONTROL_1,
                         WM831X_TCH_RATE_MASK, 6);
 
+        if (pdata && pdata->data_irqf)
+                irqf = pdata->data_irqf;
+        else
+                irqf = IRQF_TRIGGER_HIGH;
+
         error = request_threaded_irq(wm831x_ts->data_irq,
                                      NULL, wm831x_ts_data_irq,
-                                     IRQF_ONESHOT,
+                                     irqf | IRQF_ONESHOT,
                                      "Touchscreen data", wm831x_ts);
         if (error) {
                 dev_err(&pdev->dev, "Failed to request data IRQ %d: %d\n",
@@ -281,9 +329,14 @@ static __devinit int wm831x_ts_probe(struct platform_device *pdev)
         }
         disable_irq(wm831x_ts->data_irq);
 
+        if (pdata && pdata->pd_irqf)
+                irqf = pdata->pd_irqf;
+        else
+                irqf = IRQF_TRIGGER_HIGH;
+
         error = request_threaded_irq(wm831x_ts->pd_irq,
                                      NULL, wm831x_ts_pen_down_irq,
-                                     IRQF_ONESHOT,
+                                     irqf | IRQF_ONESHOT,
                                      "Touchscreen pen down", wm831x_ts);
         if (error) {
                 dev_err(&pdev->dev, "Failed to request pen down IRQ %d: %d\n",
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 6e853c61d87e..7d6f7f18a920 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3170,6 +3170,7 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
         mddev->layout = mddev->new_layout;
         mddev->chunk_sectors = mddev->new_chunk_sectors;
         mddev->delta_disks = 0;
+        mddev->degraded = 0;
         if (mddev->pers->sync_request == NULL) {
                 /* this is now an array without redundancy, so
                  * it must always be in_sync
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index f301e6ae220c..49bf5f891435 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5151,7 +5151,6 @@ static int run(mddev_t *mddev)
 
                 mddev->queue->backing_dev_info.congested_data = mddev;
                 mddev->queue->backing_dev_info.congested_fn = raid5_congested;
-                mddev->queue->queue_lock = &conf->device_lock;
 
                 chunk_size = mddev->chunk_sectors << 9;
                 blk_queue_io_min(mddev->queue, chunk_size);
@@ -5679,6 +5678,7 @@ static void raid5_quiesce(mddev_t *mddev, int state)
 static void *raid45_takeover_raid0(mddev_t *mddev, int level)
 {
         struct raid0_private_data *raid0_priv = mddev->private;
+        sector_t sectors;
 
         /* for raid0 takeover only one zone is supported */
         if (raid0_priv->nr_strip_zones > 1) {
@@ -5687,6 +5687,9 @@ static void *raid45_takeover_raid0(mddev_t *mddev, int level)
                 return ERR_PTR(-EINVAL);
         }
 
+        sectors = raid0_priv->strip_zone[0].zone_end;
+        sector_div(sectors, raid0_priv->strip_zone[0].nb_dev);
+        mddev->dev_sectors = sectors;
         mddev->new_level = level;
         mddev->new_layout = ALGORITHM_PARITY_N;
         mddev->new_chunk_sectors = mddev->chunk_sectors;
diff --git a/drivers/media/common/tuners/tda18271-common.c b/drivers/media/common/tuners/tda18271-common.c
index 5466d47db899..aae40e52af5b 100644
--- a/drivers/media/common/tuners/tda18271-common.c
+++ b/drivers/media/common/tuners/tda18271-common.c
@@ -533,16 +533,7 @@ int tda18271_calc_main_pll(struct dvb_frontend *fe, u32 freq)
         if (tda_fail(ret))
                 goto fail;
 
-        regs[R_MPD]   = (0x77 & pd);
-
-        switch (priv->mode) {
-        case TDA18271_ANALOG:
-                regs[R_MPD]  &= ~0x08;
-                break;
-        case TDA18271_DIGITAL:
-                regs[R_MPD]  |=  0x08;
-                break;
-        }
+        regs[R_MPD]   = (0x7f & pd);
 
         div =  ((d * (freq / 1000)) << 7) / 125;
 
diff --git a/drivers/media/common/tuners/tda18271-fe.c b/drivers/media/common/tuners/tda18271-fe.c
index 9ad4454a148d..d884f5eee73c 100644
--- a/drivers/media/common/tuners/tda18271-fe.c
+++ b/drivers/media/common/tuners/tda18271-fe.c
@@ -579,8 +579,8 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
 #define RF3 2
         u32 rf_default[3];
         u32 rf_freq[3];
-        u8 prog_cal[3];
-        u8 prog_tab[3];
+        s32 prog_cal[3];
+        s32 prog_tab[3];
 
         i = tda18271_lookup_rf_band(fe, &freq, NULL);
 
@@ -602,32 +602,33 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
                         return bcal;
 
                 tda18271_calc_rf_cal(fe, &rf_freq[rf]);
-                prog_tab[rf] = regs[R_EB14];
+                prog_tab[rf] = (s32)regs[R_EB14];
 
                 if (1 == bcal)
-                        prog_cal[rf] = tda18271_calibrate_rf(fe, rf_freq[rf]);
+                        prog_cal[rf] =
+                                (s32)tda18271_calibrate_rf(fe, rf_freq[rf]);
                 else
                         prog_cal[rf] = prog_tab[rf];
 
                 switch (rf) {
                 case RF1:
                         map[i].rf_a1 = 0;
-                        map[i].rf_b1 = (s32)(prog_cal[RF1] - prog_tab[RF1]);
+                        map[i].rf_b1 = (prog_cal[RF1] - prog_tab[RF1]);
                         map[i].rf1   = rf_freq[RF1] / 1000;
                         break;
                 case RF2:
-                        dividend = (s32)(prog_cal[RF2] - prog_tab[RF2]) -
-                                   (s32)(prog_cal[RF1] + prog_tab[RF1]);
+                        dividend = (prog_cal[RF2] - prog_tab[RF2] -
+                                    prog_cal[RF1] + prog_tab[RF1]);
                         divisor = (s32)(rf_freq[RF2] - rf_freq[RF1]) / 1000;
                         map[i].rf_a1 = (dividend / divisor);
                         map[i].rf2   = rf_freq[RF2] / 1000;
                         break;
                 case RF3:
-                        dividend = (s32)(prog_cal[RF3] - prog_tab[RF3]) -
-                                   (s32)(prog_cal[RF2] + prog_tab[RF2]);
+                        dividend = (prog_cal[RF3] - prog_tab[RF3] -
+                                    prog_cal[RF2] + prog_tab[RF2]);
                         divisor = (s32)(rf_freq[RF3] - rf_freq[RF2]) / 1000;
                         map[i].rf_a2 = (dividend / divisor);
-                        map[i].rf_b2 = (s32)(prog_cal[RF2] - prog_tab[RF2]);
+                        map[i].rf_b2 = (prog_cal[RF2] - prog_tab[RF2]);
                         map[i].rf3   = rf_freq[RF3] / 1000;
                         break;
                 default:
diff --git a/drivers/media/common/tuners/tda18271-maps.c b/drivers/media/common/tuners/tda18271-maps.c
index e7f84c705da8..3d5b6ab7e332 100644
--- a/drivers/media/common/tuners/tda18271-maps.c
+++ b/drivers/media/common/tuners/tda18271-maps.c
@@ -229,8 +229,7 @@ static struct tda18271_map tda18271c2_km[] = {
 static struct tda18271_map tda18271_rf_band[] = {
         { .rfmax =  47900, .val = 0x00 },
         { .rfmax =  61100, .val = 0x01 },
-/*      { .rfmax = 152600, .val = 0x02 }, */
-        { .rfmax = 121200, .val = 0x02 },
+        { .rfmax = 152600, .val = 0x02 },
         { .rfmax = 164700, .val = 0x03 },
         { .rfmax = 203500, .val = 0x04 },
         { .rfmax = 457800, .val = 0x05 },
@@ -448,7 +447,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 150000, .val = 0xb0 },
         { .rfmax = 151000, .val = 0xb1 },
         { .rfmax = 152000, .val = 0xb7 },
-        { .rfmax = 153000, .val = 0xbd },
+        { .rfmax = 152600, .val = 0xbd },
         { .rfmax = 154000, .val = 0x20 },
         { .rfmax = 155000, .val = 0x22 },
         { .rfmax = 156000, .val = 0x24 },
@@ -459,7 +458,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 161000, .val = 0x2d },
         { .rfmax = 163000, .val = 0x2e },
         { .rfmax = 164000, .val = 0x2f },
-        { .rfmax = 165000, .val = 0x30 },
+        { .rfmax = 164700, .val = 0x30 },
         { .rfmax = 166000, .val = 0x11 },
         { .rfmax = 167000, .val = 0x12 },
         { .rfmax = 168000, .val = 0x13 },
@@ -510,7 +509,8 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 236000, .val = 0x1b },
         { .rfmax = 237000, .val = 0x1c },
         { .rfmax = 240000, .val = 0x1d },
-        { .rfmax = 242000, .val = 0x1f },
+        { .rfmax = 242000, .val = 0x1e },
+        { .rfmax = 244000, .val = 0x1f },
         { .rfmax = 247000, .val = 0x20 },
         { .rfmax = 249000, .val = 0x21 },
         { .rfmax = 252000, .val = 0x22 },
@@ -624,7 +624,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 453000, .val = 0x93 },
         { .rfmax = 454000, .val = 0x94 },
         { .rfmax = 456000, .val = 0x96 },
-        { .rfmax = 457000, .val = 0x98 },
+        { .rfmax = 457800, .val = 0x98 },
         { .rfmax = 461000, .val = 0x11 },
         { .rfmax = 468000, .val = 0x12 },
         { .rfmax = 472000, .val = 0x13 },
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
index 955254090a0e..03f96d6ca894 100644
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
         DEBSTATUS);
 
 #define DRIVER_VERSION "0.1"
-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
+#define DRIVER_NAME "flexcop-pci"
 #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
 
 struct flexcop_pci {
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index fe4f894183ff..c545039287ad 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -356,13 +356,15 @@ config DVB_USB_LME2510
         select DVB_TDA826X if !DVB_FE_CUSTOMISE
         select DVB_STV0288 if !DVB_FE_CUSTOMISE
         select DVB_IX2505V if !DVB_FE_CUSTOMISE
+        select DVB_STV0299 if !DVB_FE_CUSTOMISE
+        select DVB_PLL if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the LME DM04/QQBOX DVB-S USB2.0 .
 
 config DVB_USB_TECHNISAT_USB2
         tristate "Technisat DVB-S/S2 USB2.0 support"
         depends on DVB_USB
-        select DVB_STB0899 if !DVB_FE_CUSTOMISE
-        select DVB_STB6100 if !DVB_FE_CUSTOMISE
+        select DVB_STV090x if !DVB_FE_CUSTOMISE
+        select DVB_STV6110x if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the Technisat USB2 DVB-S/S2 device
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 97af266d7f1d..65214af5cd74 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -2162,7 +2162,7 @@ struct dibx000_agc_config dib7090_agc_config[2] = {
                 .agc1_pt3       = 98,
                 .agc1_slope1    = 0,
                 .agc1_slope2    = 167,
-                .agc1_pt1       = 98,
+                .agc2_pt1       = 98,
                 .agc2_pt2       = 255,
                 .agc2_slope1    = 104,
                 .agc2_slope2    = 0,
@@ -2440,11 +2440,11 @@ static int tfe7090pvr_frontend0_attach(struct dvb_usb_adapter *adap)
         dib0700_set_i2c_speed(adap->dev, 340);
         adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x90, &tfe7090pvr_dib7000p_config[0]);
 
-        dib7090_slave_reset(adap->fe);
-
         if (adap->fe == NULL)
                 return -ENODEV;
 
+        dib7090_slave_reset(adap->fe);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ngene/ngene-core.c b/drivers/media/dvb/ngene/ngene-core.c
index ccc2d1af49d4..6927c726ce35 100644
--- a/drivers/media/dvb/ngene/ngene-core.c
+++ b/drivers/media/dvb/ngene/ngene-core.c
@@ -1520,6 +1520,7 @@ static int init_channel(struct ngene_channel *chan)
         if (dev->ci.en && (io & NGENE_IO_TSOUT)) {
                 dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1);
                 set_transfer(chan, 1);
+                chan->dev->channel[2].DataFormatFlags = DF_SWAP32;
                 set_transfer(&chan->dev->channel[2], 1);
                 dvb_register_device(adapter, &chan->ci_dev,
                                     &ngene_dvbdev_ci, (void *) chan,
diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c
index 23640ed44d85..056138f63c7d 100644
--- a/drivers/media/media-entity.c
+++ b/drivers/media/media-entity.c
@@ -378,7 +378,6 @@ EXPORT_SYMBOL_GPL(media_entity_create_link);
 
 static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
 {
-        const u32 mask = MEDIA_LNK_FL_ENABLED;
         int ret;
 
         /* Notify both entities. */
@@ -395,7 +394,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
                 return ret;
         }
 
-        link->flags = (link->flags & ~mask) | (flags & mask);
+        link->flags = flags;
         link->reverse->flags = link->flags;
 
         return 0;
@@ -417,6 +416,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
  */
 int __media_entity_setup_link(struct media_link *link, u32 flags)
 {
+        const u32 mask = MEDIA_LNK_FL_ENABLED;
         struct media_device *mdev;
         struct media_entity *source, *sink;
         int ret = -EBUSY;
@@ -424,6 +424,10 @@ int __media_entity_setup_link(struct media_link *link, u32 flags)
         if (link == NULL)
                 return -EINVAL;
 
+        /* The non-modifiable link flags must not be modified. */
+        if ((link->flags & ~mask) != (flags & ~mask))
+                return -EINVAL;
+
         if (link->flags & MEDIA_LNK_FL_IMMUTABLE)
                 return link->flags == flags ? 0 : -EINVAL;
 
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index dc3f04c52d5e..87bad7678d92 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -170,7 +170,7 @@ static int fmr2_setfreq(struct fmr2 *dev)
         return 0;
 }
 
-/* !!! not tested, in my card this does't work !!! */
+/* !!! not tested, in my card this doesn't work !!! */
 static int fmr2_setvolume(struct fmr2 *dev)
 {
         int vol[16] = { 0x021, 0x084, 0x090, 0x104,
diff --git a/drivers/media/radio/saa7706h.c b/drivers/media/radio/saa7706h.c
index 585680ffbfb6..b1193dfc5087 100644
--- a/drivers/media/radio/saa7706h.c
+++ b/drivers/media/radio/saa7706h.c
@@ -376,7 +376,7 @@ static int __devinit saa7706h_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%02x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         sd = &state->sd;
diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
index 7c0d77751f6e..0991e1973678 100644
--- a/drivers/media/radio/tef6862.c
+++ b/drivers/media/radio/tef6862.c
@@ -176,7 +176,7 @@ static int __devinit tef6862_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%02x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct tef6862_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tef6862_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         state->freq = TEF6862_LO_FREQ;
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index ebd68edf5b24..8fc0f081b470 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -46,7 +46,7 @@
 #define MOD_AUTHOR      "Jarod Wilson <jarod@wilsonet.com>"
 #define MOD_DESC        "Driver for SoundGraph iMON MultiMedia IR/Display"
 #define MOD_NAME        "imon"
-#define MOD_VERSION     "0.9.2"
+#define MOD_VERSION     "0.9.3"
 
 #define DISPLAY_MINOR_BASE      144
 #define DEVICE_NAME     "lcd%d"
@@ -460,8 +460,9 @@ static int display_close(struct inode *inode, struct file *file)
 }
 
 /**
- * Sends a packet to the device -- this function must be called
- * with ictx->lock held.
+ * Sends a packet to the device -- this function must be called with
+ * ictx->lock held, or its unlock/lock sequence while waiting for tx
+ * to complete can/will lead to a deadlock.
  */
 static int send_packet(struct imon_context *ictx)
 {
@@ -991,12 +992,21 @@ static void imon_touch_display_timeout(unsigned long data)
  * the iMON remotes, and those used by the Windows MCE remotes (which is
  * really just RC-6), but only one or the other at a time, as the signals
  * are decoded onboard the receiver.
+ *
+ * This function gets called two different ways, one way is from
+ * rc_register_device, for initial protocol selection/setup, and the other is
+ * via a userspace-initiated protocol change request, either by direct sysfs
+ * prodding or by something like ir-keytable. In the rc_register_device case,
+ * the imon context lock is already held, but when initiated from userspace,
+ * it is not, so we must acquire it prior to calling send_packet, which
+ * requires that the lock is held.
  */
 static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
 {
         int retval;
         struct imon_context *ictx = rc->priv;
         struct device *dev = ictx->dev;
+        bool unlock = false;
         unsigned char ir_proto_packet[] = {
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86 };
 
@@ -1029,6 +1039,11 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
 
         memcpy(ictx->usb_tx_buf, &ir_proto_packet, sizeof(ir_proto_packet));
 
+        if (!mutex_is_locked(&ictx->lock)) {
+                unlock = true;
+                mutex_lock(&ictx->lock);
+        }
+
         retval = send_packet(ictx);
         if (retval)
                 goto out;
@@ -1037,6 +1052,9 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
         ictx->pad_mouse = false;
 
 out:
+        if (unlock)
+                mutex_unlock(&ictx->lock);
+
         return retval;
 }
 
@@ -2134,6 +2152,7 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf)
                 goto rdev_setup_failed;
         }
 
+        mutex_unlock(&ictx->lock);
         return ictx;
 
 rdev_setup_failed:
@@ -2205,6 +2224,7 @@ static struct imon_context *imon_init_intf1(struct usb_interface *intf,
                 goto urb_submit_failed;
         }
 
+        mutex_unlock(&ictx->lock);
         return ictx;
 
 urb_submit_failed:
@@ -2299,6 +2319,8 @@ static int __devinit imon_probe(struct usb_interface *interface,
         usb_set_intfdata(interface, ictx);
 
         if (ifnum == 0) {
+                mutex_lock(&ictx->lock);
+
                 if (product == 0xffdc && ictx->rf_device) {
                         sysfs_err = sysfs_create_group(&interface->dev.kobj,
                                                        &imon_rf_attr_group);
@@ -2309,13 +2331,14 @@ static int __devinit imon_probe(struct usb_interface *interface,
 
                 if (ictx->display_supported)
                         imon_init_display(ictx, interface);
+
+                mutex_unlock(&ictx->lock);
         }
 
         dev_info(dev, "iMON device (%04x:%04x, intf%d) on "
                  "usb<%d:%d> initialized\n", vendor, product, ifnum,
                  usbdev->bus->busnum, usbdev->devnum);
 
-        mutex_unlock(&ictx->lock);
         mutex_unlock(&driver_lock);
 
         return 0;
diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
index accaf6c9789a..43908a70bd8b 100644
--- a/drivers/media/rc/ite-cir.c
+++ b/drivers/media/rc/ite-cir.c
@@ -36,6 +36,7 @@
 #include <linux/io.h>
 #include <linux/interrupt.h>
 #include <linux/sched.h>
+#include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/input.h>
 #include <linux/bitops.h>
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 044fb7a382d6..0c273ec465c9 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -220,6 +220,8 @@ static struct usb_device_id mceusb_dev_table[] = {
         { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
         /* Philips/Spinel plus IR transceiver for ASUS */
         { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
+        /* Philips IR transceiver (Dell branded) */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x2093) },
         /* Realtek MCE IR Receiver and card reader */
         { USB_DEVICE(VENDOR_REALTEK, 0x0161),
           .driver_info = MULTIFUNCTION },
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index f53f9c68d38d..a2706648e365 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -707,7 +707,8 @@ static void ir_close(struct input_dev *idev)
 {
         struct rc_dev *rdev = input_get_drvdata(idev);
 
-        rdev->close(rdev);
+         if (rdev)
+                rdev->close(rdev);
 }
 
 /* class for /sys/class/rc */
@@ -733,6 +734,7 @@ static struct {
         { RC_TYPE_SONY,         "sony"          },
         { RC_TYPE_RC5_SZ,       "rc-5-sz"       },
         { RC_TYPE_LIRC,         "lirc"          },
+        { RC_TYPE_OTHER,        "other"         },
 };
 
 #define PROTO_NONE      "none"
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 4498b944dec8..00f51dd121f3 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -875,7 +875,7 @@ config MX3_VIDEO
 config VIDEO_MX3
         tristate "i.MX3x Camera Sensor Interface driver"
         depends on VIDEO_DEV && MX3_IPU && SOC_CAMERA
-        select VIDEOBUF_DMA_CONTIG
+        select VIDEOBUF2_DMA_CONTIG
         select MX3_VIDEO
         ---help---
           This is a v4l2 driver for the i.MX3x Camera Sensor Interface
diff --git a/drivers/media/video/cx18/cx18-streams.c b/drivers/media/video/cx18/cx18-streams.c
index c6e2ca3b1149..6fbc356113c1 100644
--- a/drivers/media/video/cx18/cx18-streams.c
+++ b/drivers/media/video/cx18/cx18-streams.c
@@ -350,9 +350,17 @@ void cx18_streams_cleanup(struct cx18 *cx, int unregister)
 
                 /* No struct video_device, but can have buffers allocated */
                 if (type == CX18_ENC_STREAM_TYPE_IDX) {
+                        /* If the module params didn't inhibit IDX ... */
                         if (cx->stream_buffers[type] != 0) {
                                 cx->stream_buffers[type] = 0;
-                                cx18_stream_free(&cx->streams[type]);
+                                /*
+                                 * Before calling cx18_stream_free(),
+                                 * check if the IDX stream was actually set up.
+                                 * Needed, since the cx18_probe() error path
+                                 * exits through here as well as normal clean up
+                                 */
+                                if (cx->streams[type].buffers != 0)
+                                        cx18_stream_free(&cx->streams[type]);
                         }
                         continue;
                 }
diff --git a/drivers/media/video/cx23885/Kconfig b/drivers/media/video/cx23885/Kconfig
index 3b6e7f28568e..caab1bfb79e2 100644
--- a/drivers/media/video/cx23885/Kconfig
+++ b/drivers/media/video/cx23885/Kconfig
@@ -22,6 +22,7 @@ config VIDEO_CX23885
         select DVB_CX24116 if !DVB_FE_CUSTOMISE
         select DVB_STV0900 if !DVB_FE_CUSTOMISE
         select DVB_DS3000 if !DVB_FE_CUSTOMISE
+        select DVB_STV0367 if !DVB_FE_CUSTOMISE
         select MEDIA_TUNER_MT2131 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_TDA8290 if !MEDIA_TUNER_CUSTOMISE
diff --git a/drivers/media/video/imx074.c b/drivers/media/video/imx074.c
index 1a1169115716..0382ea752e6f 100644
--- a/drivers/media/video/imx074.c
+++ b/drivers/media/video/imx074.c
@@ -298,7 +298,7 @@ static unsigned long imx074_query_bus_param(struct soc_camera_device *icd)
 static int imx074_set_bus_param(struct soc_camera_device *icd,
                                  unsigned long flags)
 {
-        return -1;
+        return -EINVAL;
 }
 
 static struct soc_camera_ops imx074_ops = {
diff --git a/drivers/media/video/m52790.c b/drivers/media/video/m52790.c
index 5e1c9a81984c..303ffa7df4ac 100644
--- a/drivers/media/video/m52790.c
+++ b/drivers/media/video/m52790.c
@@ -174,7 +174,7 @@ static int m52790_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct m52790_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct m52790_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/media/video/omap3isp/isp.c b/drivers/media/video/omap3isp/isp.c
index 503bd7922bd6..472a69359e60 100644
--- a/drivers/media/video/omap3isp/isp.c
+++ b/drivers/media/video/omap3isp/isp.c
@@ -215,20 +215,21 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
         }
 
         switch (xclksel) {
-        case 0:
+        case ISP_XCLK_A:
                 isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                 ISPTCTRL_CTRL_DIVA_MASK,
                                 divisor << ISPTCTRL_CTRL_DIVA_SHIFT);
                 dev_dbg(isp->dev, "isp_set_xclk(): cam_xclka set to %d Hz\n",
                         currentxclk);
                 break;
-        case 1:
+        case ISP_XCLK_B:
                 isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                 ISPTCTRL_CTRL_DIVB_MASK,
                                 divisor << ISPTCTRL_CTRL_DIVB_SHIFT);
                 dev_dbg(isp->dev, "isp_set_xclk(): cam_xclkb set to %d Hz\n",
                         currentxclk);
                 break;
+        case ISP_XCLK_NONE:
         default:
                 omap3isp_put(isp);
                 dev_dbg(isp->dev, "ISP_ERR: isp_set_xclk(): Invalid requested "
@@ -237,13 +238,13 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
         }
 
         /* Do we go from stable whatever to clock? */
-        if (divisor >= 2 && isp->xclk_divisor[xclksel] < 2)
+        if (divisor >= 2 && isp->xclk_divisor[xclksel - 1] < 2)
                 omap3isp_get(isp);
         /* Stopping the clock. */
-        else if (divisor < 2 && isp->xclk_divisor[xclksel] >= 2)
+        else if (divisor < 2 && isp->xclk_divisor[xclksel - 1] >= 2)
                 omap3isp_put(isp);
 
-        isp->xclk_divisor[xclksel] = divisor;
+        isp->xclk_divisor[xclksel - 1] = divisor;
 
         omap3isp_put(isp);
 
@@ -285,7 +286,8 @@ static void isp_power_settings(struct isp_device *isp, int idle)
  */
 void omap3isp_configure_bridge(struct isp_device *isp,
                                enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata)
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift)
 {
         u32 ispctrl_val;
 
@@ -298,9 +300,9 @@ void omap3isp_configure_bridge(struct isp_device *isp,
         switch (input) {
         case CCDC_INPUT_PARALLEL:
                 ispctrl_val |= ISPCTRL_PAR_SER_CLK_SEL_PARALLEL;
-                ispctrl_val |= pdata->data_lane_shift << ISPCTRL_SHIFT_SHIFT;
                 ispctrl_val |= pdata->clk_pol << ISPCTRL_PAR_CLK_POL_SHIFT;
                 ispctrl_val |= pdata->bridge << ISPCTRL_PAR_BRIDGE_SHIFT;
+                shift += pdata->data_lane_shift * 2;
                 break;
 
         case CCDC_INPUT_CSI2A:
@@ -319,6 +321,8 @@ void omap3isp_configure_bridge(struct isp_device *isp,
                 return;
         }
 
+        ispctrl_val |= ((shift/2) << ISPCTRL_SHIFT_SHIFT) & ISPCTRL_SHIFT_MASK;
+
         ispctrl_val &= ~ISPCTRL_SYNC_DETECT_MASK;
         ispctrl_val |= ISPCTRL_SYNC_DETECT_VSRISE;
 
@@ -658,6 +662,8 @@ int omap3isp_pipeline_pm_use(struct media_entity *entity, int use)
 
         /* Apply power change to connected non-nodes. */
         ret = isp_pipeline_pm_power(entity, change);
+        if (ret < 0)
+                entity->use_count -= change;
 
         mutex_unlock(&entity->parent->graph_mutex);
 
@@ -872,6 +878,9 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
                 }
         }
 
+        if (failure < 0)
+                isp->needs_reset = true;
+
         return failure;
 }
 
@@ -884,7 +893,8 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
  * single-shot or continuous mode.
  *
  * Return 0 if successful, or the return value of the failed video::s_stream
- * operation otherwise.
+ * operation otherwise. The pipeline state is not updated when the operation
+ * fails, except when stopping the pipeline.
  */
 int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                  enum isp_pipeline_stream_state state)
@@ -895,7 +905,9 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                 ret = isp_pipeline_disable(pipe);
         else
                 ret = isp_pipeline_enable(pipe, state);
-        pipe->stream_state = state;
+
+        if (ret == 0 || state == ISP_PIPELINE_STREAM_STOPPED)
+                pipe->stream_state = state;
 
         return ret;
 }
@@ -1481,6 +1493,10 @@ void omap3isp_put(struct isp_device *isp)
         if (--isp->ref_count == 0) {
                 isp_disable_interrupts(isp);
                 isp_save_ctx(isp);
+                if (isp->needs_reset) {
+                        isp_reset(isp);
+                        isp->needs_reset = false;
+                }
                 isp_disable_clocks(isp);
         }
         mutex_unlock(&isp->isp_mutex);
diff --git a/drivers/media/video/omap3isp/isp.h b/drivers/media/video/omap3isp/isp.h
index cf5214e95a92..2620c405f5e4 100644
--- a/drivers/media/video/omap3isp/isp.h
+++ b/drivers/media/video/omap3isp/isp.h
@@ -132,7 +132,6 @@ struct isp_reg {
 
 /**
  * struct isp_parallel_platform_data - Parallel interface platform data
- * @width: Parallel bus width in bits (8, 10, 11 or 12)
  * @data_lane_shift: Data lane shifter
  *              0 - CAMEXT[13:0] -> CAM[13:0]
  *              1 - CAMEXT[13:2] -> CAM[11:0]
@@ -146,7 +145,6 @@ struct isp_reg {
  *              ISPCTRL_PAR_BRIDGE_BENDIAN - Big endian
  */
 struct isp_parallel_platform_data {
-        unsigned int width;
         unsigned int data_lane_shift:2;
         unsigned int clk_pol:1;
         unsigned int bridge:4;
@@ -262,6 +260,7 @@ struct isp_device {
         /* ISP Obj */
         spinlock_t stat_lock;   /* common lock for statistic drivers */
         struct mutex isp_mutex; /* For handling ref_count field */
+        bool needs_reset;
         int has_context;
         int ref_count;
         unsigned int autoidle;
@@ -311,11 +310,12 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                  enum isp_pipeline_stream_state state);
 void omap3isp_configure_bridge(struct isp_device *isp,
                                enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata);
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift);
 
-#define ISP_XCLK_NONE                   -1
-#define ISP_XCLK_A                      0
-#define ISP_XCLK_B                      1
+#define ISP_XCLK_NONE                   0
+#define ISP_XCLK_A                      1
+#define ISP_XCLK_B                      2
 
 struct isp_device *omap3isp_get(struct isp_device *isp);
 void omap3isp_put(struct isp_device *isp);
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 5ff9d14ce710..39d501bda636 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -43,6 +43,12 @@ __ccdc_get_format(struct isp_ccdc_device *ccdc, struct v4l2_subdev_fh *fh,
 
 static const unsigned int ccdc_fmts[] = {
         V4L2_MBUS_FMT_Y8_1X8,
+        V4L2_MBUS_FMT_Y10_1X10,
+        V4L2_MBUS_FMT_Y12_1X12,
+        V4L2_MBUS_FMT_SGRBG8_1X8,
+        V4L2_MBUS_FMT_SRGGB8_1X8,
+        V4L2_MBUS_FMT_SBGGR8_1X8,
+        V4L2_MBUS_FMT_SGBRG8_1X8,
         V4L2_MBUS_FMT_SGRBG10_1X10,
         V4L2_MBUS_FMT_SRGGB10_1X10,
         V4L2_MBUS_FMT_SBGGR10_1X10,
@@ -1110,21 +1116,38 @@ static void ccdc_configure(struct isp_ccdc_device *ccdc)
         struct isp_parallel_platform_data *pdata = NULL;
         struct v4l2_subdev *sensor;
         struct v4l2_mbus_framefmt *format;
+        const struct isp_format_info *fmt_info;
+        struct v4l2_subdev_format fmt_src;
+        unsigned int depth_out;
+        unsigned int depth_in = 0;
         struct media_pad *pad;
         unsigned long flags;
+        unsigned int shift;
         u32 syn_mode;
         u32 ccdc_pattern;
 
-        if (ccdc->input == CCDC_INPUT_PARALLEL) {
-                pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
-                sensor = media_entity_to_v4l2_subdev(pad->entity);
+        pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
+        sensor = media_entity_to_v4l2_subdev(pad->entity);
+        if (ccdc->input == CCDC_INPUT_PARALLEL)
                 pdata = &((struct isp_v4l2_subdevs_group *)sensor->host_priv)
                         ->bus.parallel;
+
+        /* Compute shift value for lane shifter to configure the bridge. */
+        fmt_src.pad = pad->index;
+        fmt_src.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+        if (!v4l2_subdev_call(sensor, pad, get_fmt, NULL, &fmt_src)) {
+                fmt_info = omap3isp_video_format_info(fmt_src.format.code);
+                depth_in = fmt_info->bpp;
         }
 
-        omap3isp_configure_bridge(isp, ccdc->input, pdata);
+        fmt_info = omap3isp_video_format_info
+                (isp->isp_ccdc.formats[CCDC_PAD_SINK].code);
+        depth_out = fmt_info->bpp;
+
+        shift = depth_in - depth_out;
+        omap3isp_configure_bridge(isp, ccdc->input, pdata, shift);
 
-        ccdc->syncif.datsz = pdata ? pdata->width : 10;
+        ccdc->syncif.datsz = depth_out;
         ccdc_config_sync_if(ccdc, &ccdc->syncif);
 
         /* CCDC_PAD_SINK */
@@ -1338,7 +1361,7 @@ static int ccdc_sbl_wait_idle(struct isp_ccdc_device *ccdc,
  * @ccdc: Pointer to ISP CCDC device.
  * @event: Pointing which event trigger handler
  *
- * Return 1 when the event and stopping request combination is satisfyied,
+ * Return 1 when the event and stopping request combination is satisfied,
  * zero otherwise.
  */
 static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
@@ -1618,7 +1641,7 @@ static int ccdc_video_queue(struct isp_video *video, struct isp_buffer *buffer)
 
         ccdc_set_outaddr(ccdc, buffer->isp_addr);
 
-        /* We now have a buffer queued on the output, restart the pipeline in
+        /* We now have a buffer queued on the output, restart the pipeline
          * on the next CCDC interrupt if running in continuous mode (or when
          * starting the stream).
          */
diff --git a/drivers/media/video/omap3isp/isppreview.c b/drivers/media/video/omap3isp/isppreview.c
index 2b16988a501d..aba537af87e4 100644
--- a/drivers/media/video/omap3isp/isppreview.c
+++ b/drivers/media/video/omap3isp/isppreview.c
@@ -755,7 +755,7 @@ static struct preview_update update_attrs[] = {
  * @configs - pointer to update config structure.
  * @config - return pointer to appropriate structure field.
  * @bit - for which feature to return pointers.
- * Return size of coresponding prev_params member
+ * Return size of corresponding prev_params member
  */
 static u32
 __preview_get_ptrs(struct prev_params *params, void **param,
diff --git a/drivers/media/video/omap3isp/ispqueue.c b/drivers/media/video/omap3isp/ispqueue.c
index 8fddc5806b0d..9c317148205f 100644
--- a/drivers/media/video/omap3isp/ispqueue.c
+++ b/drivers/media/video/omap3isp/ispqueue.c
@@ -339,7 +339,7 @@ static int isp_video_buffer_prepare_user(struct isp_video_buffer *buf)
         up_read(&current->mm->mmap_sem);
 
         if (ret != buf->npages) {
-                buf->npages = ret;
+                buf->npages = ret < 0 ? 0 : ret;
                 isp_video_buffer_cleanup(buf);
                 return -EFAULT;
         }
@@ -408,8 +408,8 @@ done:
  * isp_video_buffer_prepare_vm_flags - Get VMA flags for a userspace address
  *
  * This function locates the VMAs for the buffer's userspace address and checks
- * that their flags match. The onlflag that we need to care for at the moment is
- * VM_PFNMAP.
+ * that their flags match. The only flag that we need to care for at the moment
+ * is VM_PFNMAP.
  *
  * The buffer vm_flags field is set to the first VMA flags.
  *
diff --git a/drivers/media/video/omap3isp/ispresizer.c b/drivers/media/video/omap3isp/ispresizer.c
index 653f88ba56db..0bb0f8cd36f5 100644
--- a/drivers/media/video/omap3isp/ispresizer.c
+++ b/drivers/media/video/omap3isp/ispresizer.c
@@ -714,19 +714,50 @@ static void resizer_print_status(struct isp_res_device *res)
  * iw and ih are the input width and height after cropping. Those equations need
  * to be satisfied exactly for the resizer to work correctly.
  *
- * Reverting the equations, we can compute the resizing ratios with
+ * The equations can't be easily reverted, as the >> 8 operation is not linear.
+ * In addition, not all input sizes can be achieved for a given output size. To
+ * get the highest input size lower than or equal to the requested input size,
+ * we need to compute the highest resizing ratio that satisfies the following
+ * inequality (taking the 4-tap mode width equation as an example)
+ *
+ *      iw >= (32 * sph + (ow - 1) * hrsz + 16) >> 8 - 7
+ *
+ * (where iw is the requested input width) which can be rewritten as
+ *
+ *        iw - 7            >= (32 * sph + (ow - 1) * hrsz + 16) >> 8
+ *       (iw - 7) << 8      >=  32 * sph + (ow - 1) * hrsz + 16 - b
+ *      ((iw - 7) << 8) + b >=  32 * sph + (ow - 1) * hrsz + 16
+ *
+ * where b is the value of the 8 least significant bits of the right hand side
+ * expression of the last inequality. The highest resizing ratio value will be
+ * achieved when b is equal to its maximum value of 255. That resizing ratio
+ * value will still satisfy the original inequality, as b will disappear when
+ * the expression will be shifted right by 8.
+ *
+ * The reverted the equations thus become
  *
  * - 8-phase, 4-tap mode
- *      hrsz = ((iw - 7) * 256 - 16 - 32 * sph) / (ow - 1)
- *      vrsz = ((ih - 4) * 256 - 16 - 32 * spv) / (oh - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 16 - 32 * sph) / (ow - 1)
+ *      vrsz = ((ih - 4) * 256 + 255 - 16 - 32 * spv) / (oh - 1)
  * - 4-phase, 7-tap mode
- *      hrsz = ((iw - 7) * 256 - 32 - 64 * sph) / (ow - 1)
- *      vrsz = ((ih - 7) * 256 - 32 - 64 * spv) / (oh - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 32 - 64 * sph) / (ow - 1)
+ *      vrsz = ((ih - 7) * 256 + 255 - 32 - 64 * spv) / (oh - 1)
  *
- * The ratios are integer values, and must be rounded down to ensure that the
- * cropped input size is not bigger than the uncropped input size. As the ratio
- * in 7-tap mode is always smaller than the ratio in 4-tap mode, we can use the
- * 7-tap mode equations to compute a ratio approximation.
+ * The ratios are integer values, and are rounded down to ensure that the
+ * cropped input size is not bigger than the uncropped input size.
+ *
+ * As the number of phases/taps, used to select the correct equations to compute
+ * the ratio, depends on the ratio, we start with the 4-tap mode equations to
+ * compute an approximation of the ratio, and switch to the 7-tap mode equations
+ * if the approximation is higher than the ratio threshold.
+ *
+ * As the 7-tap mode equations will return a ratio smaller than or equal to the
+ * 4-tap mode equations, the resulting ratio could become lower than or equal to
+ * the ratio threshold. This 'equations loop' isn't an issue as long as the
+ * correct equations are used to compute the final input size. Starting with the
+ * 4-tap mode equations ensure that, in case of values resulting in a 'ratio
+ * loop', the smallest of the ratio values will be used, never exceeding the
+ * requested input size.
  *
  * We first clamp the output size according to the hardware capabilitie to avoid
  * auto-cropping the input more than required to satisfy the TRM equations. The
@@ -775,6 +806,8 @@ static void resizer_calc_ratios(struct isp_res_device *res,
         unsigned int max_width;
         unsigned int max_height;
         unsigned int width_alignment;
+        unsigned int width;
+        unsigned int height;
 
         /*
          * Clamp the output height based on the hardware capabilities and
@@ -786,19 +819,22 @@ static void resizer_calc_ratios(struct isp_res_device *res,
         max_height = min_t(unsigned int, max_height, MAX_OUT_HEIGHT);
         output->height = clamp(output->height, min_height, max_height);
 
-        ratio->vert = ((input->height - 7) * 256 - 32 - 64 * spv)
+        ratio->vert = ((input->height - 4) * 256 + 255 - 16 - 32 * spv)
                     / (output->height - 1);
+        if (ratio->vert > MID_RESIZE_VALUE)
+                ratio->vert = ((input->height - 7) * 256 + 255 - 32 - 64 * spv)
+                            / (output->height - 1);
         ratio->vert = clamp_t(unsigned int, ratio->vert,
                               MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
 
         if (ratio->vert <= MID_RESIZE_VALUE) {
                 upscaled_height = (output->height - 1) * ratio->vert
                                 + 32 * spv + 16;
-                input->height = (upscaled_height >> 8) + 4;
+                height = (upscaled_height >> 8) + 4;
         } else {
                 upscaled_height = (output->height - 1) * ratio->vert
                                 + 64 * spv + 32;
-                input->height = (upscaled_height >> 8) + 7;
+                height = (upscaled_height >> 8) + 7;
         }
 
         /*
@@ -854,20 +890,29 @@ static void resizer_calc_ratios(struct isp_res_device *res,
                               max_width & ~(width_alignment - 1));
         output->width = ALIGN(output->width, width_alignment);
 
-        ratio->horz = ((input->width - 7) * 256 - 32 - 64 * sph)
+        ratio->horz = ((input->width - 7) * 256 + 255 - 16 - 32 * sph)
                     / (output->width - 1);
+        if (ratio->horz > MID_RESIZE_VALUE)
+                ratio->horz = ((input->width - 7) * 256 + 255 - 32 - 64 * sph)
+                            / (output->width - 1);
         ratio->horz = clamp_t(unsigned int, ratio->horz,
                               MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
 
         if (ratio->horz <= MID_RESIZE_VALUE) {
                 upscaled_width = (output->width - 1) * ratio->horz
                                + 32 * sph + 16;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
         } else {
                 upscaled_width = (output->width - 1) * ratio->horz
                                + 64 * sph + 32;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
         }
+
+        /* Center the new crop rectangle. */
+        input->left += (input->width - width) / 2;
+        input->top += (input->height - height) / 2;
+        input->width = width;
+        input->height = height;
 }
 
 /*
diff --git a/drivers/media/video/omap3isp/ispstat.h b/drivers/media/video/omap3isp/ispstat.h
index 820950c9ef46..d86da94fa50d 100644
--- a/drivers/media/video/omap3isp/ispstat.h
+++ b/drivers/media/video/omap3isp/ispstat.h
@@ -131,9 +131,9 @@ struct ispstat {
 struct ispstat_generic_config {
         /*
          * Fields must be in the same order as in:
-         *  - isph3a_aewb_config
-         *  - isph3a_af_config
-         *  - isphist_config
+         *  - omap3isp_h3a_aewb_config
+         *  - omap3isp_h3a_af_config
+         *  - omap3isp_hist_config
          */
         u32 buf_size;
         u16 config_counter;
diff --git a/drivers/media/video/omap3isp/ispvideo.c b/drivers/media/video/omap3isp/ispvideo.c
index 208a7ec739d7..9cd8f1aa567b 100644
--- a/drivers/media/video/omap3isp/ispvideo.c
+++ b/drivers/media/video/omap3isp/ispvideo.c
@@ -47,29 +47,59 @@
 
 static struct isp_format_info formats[] = {
         { V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
-          V4L2_MBUS_FMT_Y8_1X8, V4L2_PIX_FMT_GREY, 8, },
+          V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_GREY, 8, },
+        { V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y10, 10, },
+        { V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y12, 12, },
+        { V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR8, 8, },
+        { V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG8, 8, },
+        { V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG8, 8, },
+        { V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB8, 8, },
         { V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8, V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, 0,
+          V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
         { V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_PIX_FMT_SBGGR10, 10, },
+          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR10, 10, },
         { V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_PIX_FMT_SGBRG10, 10, },
+          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG10, 10, },
         { V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10, 10, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG10, 10, },
         { V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_PIX_FMT_SRGGB10, 10, },
+          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB10, 10, },
         { V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_PIX_FMT_SBGGR12, 12, },
+          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR12, 12, },
         { V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_PIX_FMT_SGBRG12, 12, },
+          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG12, 12, },
         { V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_PIX_FMT_SGRBG12, 12, },
+          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG12, 12, },
         { V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_PIX_FMT_SRGGB12, 12, },
+          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB12, 12, },
         { V4L2_MBUS_FMT_UYVY8_1X16, V4L2_MBUS_FMT_UYVY8_1X16,
-          V4L2_MBUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_UYVY, 16, },
+          V4L2_MBUS_FMT_UYVY8_1X16, 0,
+          V4L2_PIX_FMT_UYVY, 16, },
         { V4L2_MBUS_FMT_YUYV8_1X16, V4L2_MBUS_FMT_YUYV8_1X16,
-          V4L2_MBUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_YUYV, 16, },
+          V4L2_MBUS_FMT_YUYV8_1X16, 0,
+          V4L2_PIX_FMT_YUYV, 16, },
 };
 
 const struct isp_format_info *
@@ -86,6 +116,37 @@ omap3isp_video_format_info(enum v4l2_mbus_pixelcode code)
 }
 
 /*
+ * Decide whether desired output pixel code can be obtained with
+ * the lane shifter by shifting the input pixel code.
+ * @in: input pixelcode to shifter
+ * @out: output pixelcode from shifter
+ * @additional_shift: # of bits the sensor's LSB is offset from CAMEXT[0]
+ *
+ * return true if the combination is possible
+ * return false otherwise
+ */
+static bool isp_video_is_shiftable(enum v4l2_mbus_pixelcode in,
+                enum v4l2_mbus_pixelcode out,
+                unsigned int additional_shift)
+{
+        const struct isp_format_info *in_info, *out_info;
+
+        if (in == out)
+                return true;
+
+        in_info = omap3isp_video_format_info(in);
+        out_info = omap3isp_video_format_info(out);
+
+        if ((in_info->flavor == 0) || (out_info->flavor == 0))
+                return false;
+
+        if (in_info->flavor != out_info->flavor)
+                return false;
+
+        return in_info->bpp - out_info->bpp + additional_shift <= 6;
+}
+
+/*
  * isp_video_mbus_to_pix - Convert v4l2_mbus_framefmt to v4l2_pix_format
  * @video: ISP video instance
  * @mbus: v4l2_mbus_framefmt format (input)
@@ -235,6 +296,7 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                 return -EPIPE;
 
         while (1) {
+                unsigned int shifter_link;
                 /* Retrieve the sink format */
                 pad = &subdev->entity.pads[0];
                 if (!(pad->flags & MEDIA_PAD_FL_SINK))
@@ -263,6 +325,10 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                                 return -ENOSPC;
                 }
 
+                /* If sink pad is on CCDC, the link has the lane shifter
+                 * in the middle of it. */
+                shifter_link = subdev == &isp->isp_ccdc.subdev;
+
                 /* Retrieve the source format */
                 pad = media_entity_remote_source(pad);
                 if (pad == NULL ||
@@ -278,10 +344,24 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                         return -EPIPE;
 
                 /* Check if the two ends match */
-                if (fmt_source.format.code != fmt_sink.format.code ||
-                    fmt_source.format.width != fmt_sink.format.width ||
+                if (fmt_source.format.width != fmt_sink.format.width ||
                     fmt_source.format.height != fmt_sink.format.height)
                         return -EPIPE;
+
+                if (shifter_link) {
+                        unsigned int parallel_shift = 0;
+                        if (isp->isp_ccdc.input == CCDC_INPUT_PARALLEL) {
+                                struct isp_parallel_platform_data *pdata =
+                                        &((struct isp_v4l2_subdevs_group *)
+                                              subdev->host_priv)->bus.parallel;
+                                parallel_shift = pdata->data_lane_shift * 2;
+                        }
+                        if (!isp_video_is_shiftable(fmt_source.format.code,
+                                                fmt_sink.format.code,
+                                                parallel_shift))
+                                return -EPIPE;
+                } else if (fmt_source.format.code != fmt_sink.format.code)
+                        return -EPIPE;
         }
 
         return 0;
diff --git a/drivers/media/video/omap3isp/ispvideo.h b/drivers/media/video/omap3isp/ispvideo.h
index 524a1acd0906..911bea64e78a 100644
--- a/drivers/media/video/omap3isp/ispvideo.h
+++ b/drivers/media/video/omap3isp/ispvideo.h
@@ -49,6 +49,8 @@ struct v4l2_pix_format;
  *      bits. Identical to @code if the format is 10 bits wide or less.
  * @uncompressed: V4L2 media bus format code for the corresponding uncompressed
  *      format. Identical to @code if the format is not DPCM compressed.
+ * @flavor: V4L2 media bus format code for the same pixel layout but
+ *      shifted to be 8 bits per pixel. =0 if format is not shiftable.
  * @pixelformat: V4L2 pixel format FCC identifier
  * @bpp: Bits per pixel
  */
@@ -56,6 +58,7 @@ struct isp_format_info {
         enum v4l2_mbus_pixelcode code;
         enum v4l2_mbus_pixelcode truncated;
         enum v4l2_mbus_pixelcode uncompressed;
+        enum v4l2_mbus_pixelcode flavor;
         u32 pixelformat;
         unsigned int bpp;
 };
diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index 95f8b4e11e46..d142b40ea64e 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -527,7 +527,7 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
         if (ret)
                 return ret;
 
-        if (vb2_is_streaming(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
+        if (vb2_is_busy(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
                 return -EBUSY;
 
         frame = &ctx->d_frame;
@@ -539,8 +539,10 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
                 return -EINVAL;
         }
 
-        for (i = 0; i < frame->fmt->colplanes; i++)
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+        for (i = 0; i < frame->fmt->colplanes; i++) {
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) >> 3;
+        }
 
         /* Output DMA frame pixel size and offsets. */
         frame->f_width = pix->plane_fmt[0].bytesperline * 8
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index 6c919b38a3d8..dc91a8511af6 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -361,10 +361,20 @@ static void fimc_capture_irq_handler(struct fimc_dev *fimc)
 {
         struct fimc_vid_cap *cap = &fimc->vid_cap;
         struct fimc_vid_buffer *v_buf;
+        struct timeval *tv;
+        struct timespec ts;
 
         if (!list_empty(&cap->active_buf_q) &&
             test_bit(ST_CAPT_RUN, &fimc->state)) {
+                ktime_get_real_ts(&ts);
+
                 v_buf = active_queue_pop(cap);
+
+                tv = &v_buf->vb.v4l2_buf.timestamp;
+                tv->tv_sec = ts.tv_sec;
+                tv->tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+                v_buf->vb.v4l2_buf.sequence = cap->frame_count++;
+
                 vb2_buffer_done(&v_buf->vb, VB2_BUF_STATE_DONE);
         }
 
@@ -758,7 +768,7 @@ static void fimc_unlock(struct vb2_queue *vq)
         mutex_unlock(&ctx->fimc_dev->lock);
 }
 
-struct vb2_ops fimc_qops = {
+static struct vb2_ops fimc_qops = {
         .queue_setup     = fimc_queue_setup,
         .buf_prepare     = fimc_buf_prepare,
         .buf_queue       = fimc_buf_queue,
@@ -927,23 +937,23 @@ int fimc_vidioc_try_fmt_mplane(struct file *file, void *priv,
         pix->num_planes = fmt->memplanes;
         pix->colorspace = V4L2_COLORSPACE_JPEG;
 
-        for (i = 0; i < pix->num_planes; ++i) {
-                int bpl = pix->plane_fmt[i].bytesperline;
 
-                dbg("[%d] bpl: %d, depth: %d, w: %d, h: %d",
-                    i, bpl, fmt->depth[i], pix->width, pix->height);
+        for (i = 0; i < pix->num_planes; ++i) {
+                u32 bpl = pix->plane_fmt[i].bytesperline;
+                u32 *sizeimage = &pix->plane_fmt[i].sizeimage;
 
-                if (!bpl || (bpl * 8 / fmt->depth[i]) > pix->width)
-                        bpl = (pix->width * fmt->depth[0]) >> 3;
+                if (fmt->colplanes > 1 && (bpl == 0 || bpl < pix->width))
+                        bpl = pix->width; /* Planar */
 
-                if (!pix->plane_fmt[i].sizeimage)
-                        pix->plane_fmt[i].sizeimage = pix->height * bpl;
+                if (fmt->colplanes == 1 && /* Packed */
+                    (bpl == 0 || ((bpl * 8) / fmt->depth[i]) < pix->width))
+                        bpl = (pix->width * fmt->depth[0]) / 8;
 
-                pix->plane_fmt[i].bytesperline = bpl;
+                if (i == 0) /* Same bytesperline for each plane. */
+                        mod_x = bpl;
 
-                dbg("[%d]: bpl: %d, sizeimage: %d",
-                    i, pix->plane_fmt[i].bytesperline,
-                    pix->plane_fmt[i].sizeimage);
+                pix->plane_fmt[i].bytesperline = mod_x;
+                *sizeimage = (pix->width * pix->height * fmt->depth[i]) / 8;
         }
 
         return 0;
@@ -965,7 +975,7 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
 
         vq = v4l2_m2m_get_vq(ctx->m2m_ctx, f->type);
 
-        if (vb2_is_streaming(vq)) {
+        if (vb2_is_busy(vq)) {
                 v4l2_err(&fimc->m2m.v4l2_dev, "queue (%d) busy\n", f->type);
                 return -EBUSY;
         }
@@ -985,8 +995,10 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
         if (!frame->fmt)
                 return -EINVAL;
 
-        for (i = 0; i < frame->fmt->colplanes; i++)
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+        for (i = 0; i < frame->fmt->colplanes; i++) {
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) / 8;
+        }
 
         frame->f_width  = pix->plane_fmt[0].bytesperline * 8 /
                 frame->fmt->depth[0];
@@ -1750,7 +1762,7 @@ static int __devexit fimc_remove(struct platform_device *pdev)
 }
 
 /* Image pixel limits, similar across several FIMC HW revisions. */
-static struct fimc_pix_limit s5p_pix_limit[3] = {
+static struct fimc_pix_limit s5p_pix_limit[4] = {
         [0] = {
                 .scaler_en_w    = 3264,
                 .scaler_dis_w   = 8192,
@@ -1775,6 +1787,14 @@ static struct fimc_pix_limit s5p_pix_limit[3] = {
                 .out_rot_en_w   = 1280,
                 .out_rot_dis_w  = 1920,
         },
+        [3] = {
+                .scaler_en_w    = 1920,
+                .scaler_dis_w   = 8192,
+                .in_rot_en_h    = 1366,
+                .in_rot_dis_w   = 8192,
+                .out_rot_en_w   = 1366,
+                .out_rot_dis_w  = 1920,
+        },
 };
 
 static struct samsung_fimc_variant fimc0_variant_s5p = {
@@ -1827,7 +1847,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
         .pix_limit       = &s5p_pix_limit[2],
 };
 
-static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc0_variant_exynos4 = {
         .pix_hoff        = 1,
         .has_inp_rot     = 1,
         .has_out_rot     = 1,
@@ -1840,7 +1860,7 @@ static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
         .pix_limit       = &s5p_pix_limit[1],
 };
 
-static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc2_variant_exynos4 = {
         .pix_hoff        = 1,
         .has_cistatus2   = 1,
         .has_mainscaler_ext = 1,
@@ -1848,7 +1868,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
         .min_out_pixsize = 16,
         .hor_offs_align  = 1,
         .out_buf_count   = 32,
-        .pix_limit       = &s5p_pix_limit[2],
+        .pix_limit       = &s5p_pix_limit[3],
 };
 
 /* S5PC100 */
@@ -1874,12 +1894,12 @@ static struct samsung_fimc_driverdata fimc_drvdata_s5pv210 = {
 };
 
 /* S5PV310, S5PC210 */
-static struct samsung_fimc_driverdata fimc_drvdata_s5pv310 = {
+static struct samsung_fimc_driverdata fimc_drvdata_exynos4 = {
         .variant = {
-                [0] = &fimc0_variant_s5pv310,
-                [1] = &fimc0_variant_s5pv310,
-                [2] = &fimc0_variant_s5pv310,
-                [3] = &fimc2_variant_s5pv310,
+                [0] = &fimc0_variant_exynos4,
+                [1] = &fimc0_variant_exynos4,
+                [2] = &fimc0_variant_exynos4,
+                [3] = &fimc2_variant_exynos4,
         },
         .num_entities = 4,
         .lclk_frequency = 166000000UL,
@@ -1893,8 +1913,8 @@ static struct platform_device_id fimc_driver_ids[] = {
                 .name           = "s5pv210-fimc",
                 .driver_data    = (unsigned long)&fimc_drvdata_s5pv210,
         }, {
-                .name           = "s5pv310-fimc",
-                .driver_data    = (unsigned long)&fimc_drvdata_s5pv310,
+                .name           = "exynos4-fimc",
+                .driver_data    = (unsigned long)&fimc_drvdata_exynos4,
         },
         {},
 };
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 3fe54bf41142..134e86bf6d97 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -922,7 +922,7 @@ static int sh_mobile_ceu_get_formats(struct soc_camera_device *icd, unsigned int
                         /* Try 2560x1920, 1280x960, 640x480, 320x240 */
                         mf.width        = 2560 >> shift;
                         mf.height       = 1920 >> shift;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                          s_mbus_fmt, &mf);
                         if (ret < 0)
                                 return ret;
@@ -1224,7 +1224,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
         struct v4l2_cropcap cap;
         int ret;
 
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                          s_mbus_fmt, mf);
         if (ret < 0)
                 return ret;
@@ -1254,7 +1254,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
                 tmp_h = min(2 * tmp_h, max_height);
                 mf->width = tmp_w;
                 mf->height = tmp_h;
-                ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                  s_mbus_fmt, mf);
                 dev_geo(dev, "Camera scaled to %ux%u\n",
                         mf->width, mf->height);
@@ -1658,7 +1658,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
         mf.code         = xlate->code;
         mf.colorspace   = pix->colorspace;
 
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video, try_mbus_fmt, &mf);
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video, try_mbus_fmt, &mf);
         if (ret < 0)
                 return ret;
 
@@ -1682,7 +1682,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
                          */
                         mf.width = 2560;
                         mf.height = 1920;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                          try_mbus_fmt, &mf);
                         if (ret < 0) {
                                 /* Shouldn't actually happen... */
diff --git a/drivers/media/video/sh_mobile_csi2.c b/drivers/media/video/sh_mobile_csi2.c
index dd1b81b1442b..98b87481fa94 100644
--- a/drivers/media/video/sh_mobile_csi2.c
+++ b/drivers/media/video/sh_mobile_csi2.c
@@ -38,6 +38,8 @@ struct sh_csi2 {
         void __iomem                    *base;
         struct platform_device          *pdev;
         struct sh_csi2_client_config    *client;
+        unsigned long (*query_bus_param)(struct soc_camera_device *);
+        int (*set_bus_param)(struct soc_camera_device *, unsigned long);
 };
 
 static int sh_csi2_try_fmt(struct v4l2_subdev *sd,
@@ -208,6 +210,7 @@ static int sh_csi2_notify(struct notifier_block *nb,
         case BUS_NOTIFY_BOUND_DRIVER:
                 snprintf(priv->subdev.name, V4L2_SUBDEV_NAME_SIZE, "%s%s",
                          dev_name(v4l2_dev->dev), ".mipi-csi");
+                priv->subdev.grp_id = (long)icd;
                 ret = v4l2_device_register_subdev(v4l2_dev, &priv->subdev);
                 dev_dbg(dev, "%s(%p): ret(register_subdev) = %d\n", __func__, priv, ret);
                 if (ret < 0)
@@ -215,6 +218,8 @@ static int sh_csi2_notify(struct notifier_block *nb,
 
                 priv->client = pdata->clients + i;
 
+                priv->set_bus_param             = icd->ops->set_bus_param;
+                priv->query_bus_param           = icd->ops->query_bus_param;
                 icd->ops->set_bus_param         = sh_csi2_set_bus_param;
                 icd->ops->query_bus_param       = sh_csi2_query_bus_param;
 
@@ -226,8 +231,10 @@ static int sh_csi2_notify(struct notifier_block *nb,
                 priv->client = NULL;
 
                 /* Driver is about to be unbound */
-                icd->ops->set_bus_param         = NULL;
-                icd->ops->query_bus_param       = NULL;
+                icd->ops->set_bus_param         = priv->set_bus_param;
+                icd->ops->query_bus_param       = priv->query_bus_param;
+                priv->set_bus_param             = NULL;
+                priv->query_bus_param           = NULL;
 
                 v4l2_device_unregister_subdev(&priv->subdev);
 
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 46284489e4eb..3973f9a94753 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -996,10 +996,11 @@ static void soc_camera_free_i2c(struct soc_camera_device *icd)
 {
         struct i2c_client *client =
                 to_i2c_client(to_soc_camera_control(icd));
+        struct i2c_adapter *adap = client->adapter;
         dev_set_drvdata(&icd->dev, NULL);
         v4l2_device_unregister_subdev(i2c_get_clientdata(client));
         i2c_unregister_device(client);
-        i2c_put_adapter(client->adapter);
+        i2c_put_adapter(adap);
 }
 #else
 #define soc_camera_init_i2c(icd, icl)   (-ENODEV)
@@ -1071,6 +1072,9 @@ static int soc_camera_probe(struct device *dev)
                 }
         }
 
+        sd = soc_camera_to_subdev(icd);
+        sd->grp_id = (long)icd;
+
         /* At this point client .probe() should have run already */
         ret = soc_camera_init_user_formats(icd);
         if (ret < 0)
@@ -1092,7 +1096,6 @@ static int soc_camera_probe(struct device *dev)
                 goto evidstart;
 
         /* Try to improve our guess of a reasonable window format */
-        sd = soc_camera_to_subdev(icd);
         if (!v4l2_subdev_call(sd, video, g_mbus_fmt, &mf)) {
                 icd->user_width         = mf.width;
                 icd->user_height        = mf.height;
diff --git a/drivers/media/video/tda9840.c b/drivers/media/video/tda9840.c
index 5d4cf3b3d435..22fa8202d5ca 100644
--- a/drivers/media/video/tda9840.c
+++ b/drivers/media/video/tda9840.c
@@ -171,7 +171,7 @@ static int tda9840_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
+        sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
         if (sd == NULL)
                 return -ENOMEM;
         v4l2_i2c_subdev_init(sd, client, &tda9840_ops);
diff --git a/drivers/media/video/tea6415c.c b/drivers/media/video/tea6415c.c
index 19621ed523ec..827425c5b866 100644
--- a/drivers/media/video/tea6415c.c
+++ b/drivers/media/video/tea6415c.c
@@ -152,7 +152,7 @@ static int tea6415c_probe(struct i2c_client *client,
 
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
-        sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
+        sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
         if (sd == NULL)
                 return -ENOMEM;
         v4l2_i2c_subdev_init(sd, client, &tea6415c_ops);
diff --git a/drivers/media/video/tea6420.c b/drivers/media/video/tea6420.c
index 5ea840401f21..f350b6c24500 100644
--- a/drivers/media/video/tea6420.c
+++ b/drivers/media/video/tea6420.c
@@ -125,7 +125,7 @@ static int tea6420_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
+        sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
         if (sd == NULL)
                 return -ENOMEM;
         v4l2_i2c_subdev_init(sd, client, &tea6420_ops);
diff --git a/drivers/media/video/upd64031a.c b/drivers/media/video/upd64031a.c
index f8138c75be8b..1aab96a88203 100644
--- a/drivers/media/video/upd64031a.c
+++ b/drivers/media/video/upd64031a.c
@@ -230,7 +230,7 @@ static int upd64031a_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         sd = &state->sd;
diff --git a/drivers/media/video/upd64083.c b/drivers/media/video/upd64083.c
index 28e0e6b6ca84..9bbe61700fd5 100644
--- a/drivers/media/video/upd64083.c
+++ b/drivers/media/video/upd64083.c
@@ -202,7 +202,7 @@ static int upd64083_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct upd64083_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct upd64083_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         sd = &state->sd;
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 498e6742579e..6dc7196296b3 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -389,7 +389,8 @@ static int v4l2_open(struct inode *inode, struct file *filp)
         video_get(vdev);
         mutex_unlock(&videodev_lock);
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                 entity = media_entity_get(&vdev->entity);
                 if (!entity) {
                         ret = -EBUSY;
@@ -415,7 +416,8 @@ err:
         /* decrease the refcount in case of an error */
         if (ret) {
 #if defined(CONFIG_MEDIA_CONTROLLER)
-                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+                    vdev->vfl_type != VFL_TYPE_SUBDEV)
                         media_entity_put(entity);
 #endif
                 video_put(vdev);
@@ -437,7 +439,8 @@ static int v4l2_release(struct inode *inode, struct file *filp)
                         mutex_unlock(vdev->lock);
         }
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                 media_entity_put(&vdev->entity);
 #endif
         /* decrease the refcount unconditionally since the release()
@@ -686,7 +689,8 @@ int __video_register_device(struct video_device *vdev, int type, int nr,
 
 #if defined(CONFIG_MEDIA_CONTROLLER)
         /* Part 5: Register the entity. */
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                 vdev->entity.type = MEDIA_ENT_T_DEVNODE_V4L;
                 vdev->entity.name = vdev->name;
                 vdev->entity.v4l.major = VIDEO_MAJOR;
@@ -733,7 +737,8 @@ void video_unregister_device(struct video_device *vdev)
                 return;
 
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                 media_device_unregister_entity(&vdev->entity);
 #endif
 
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index c4742fc15529..c9691115f2d2 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -300,7 +300,7 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q,
 
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
         retval = remap_pfn_range(vma, vma->vm_start,
-                                 PFN_DOWN(virt_to_phys(mem->vaddr)),
+                                 mem->dma_handle >> PAGE_SHIFT,
                                  size, vma->vm_page_prot);
         if (retval) {
                 dev_err(q->dev, "mmap: remap failed with error %d. ", retval);
diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c
index 6698c77e0f64..6ba1461d51ef 100644
--- a/drivers/media/video/videobuf2-core.c
+++ b/drivers/media/video/videobuf2-core.c
@@ -37,6 +37,9 @@ module_param(debug, int, 0644);
 #define call_qop(q, op, args...)                                        \
         (((q)->ops->op) ? ((q)->ops->op(args)) : 0)
 
+#define V4L2_BUFFER_STATE_FLAGS (V4L2_BUF_FLAG_MAPPED | V4L2_BUF_FLAG_QUEUED | \
+                                 V4L2_BUF_FLAG_DONE | V4L2_BUF_FLAG_ERROR)
+
 /**
  * __vb2_buf_mem_alloc() - allocate video memory for the given buffer
  */
@@ -51,7 +54,7 @@ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb,
         for (plane = 0; plane < vb->num_planes; ++plane) {
                 mem_priv = call_memop(q, plane, alloc, q->alloc_ctx[plane],
                                         plane_sizes[plane]);
-                if (!mem_priv)
+                if (IS_ERR_OR_NULL(mem_priv))
                         goto free;
 
                 /* Associate allocator private data with this plane */
@@ -284,7 +287,7 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
         struct vb2_queue *q = vb->vb2_queue;
         int ret = 0;
 
-        /* Copy back data such as timestamp, input, etc. */
+        /* Copy back data such as timestamp, flags, input, etc. */
         memcpy(b, &vb->v4l2_buf, offsetof(struct v4l2_buffer, m));
         b->input = vb->v4l2_buf.input;
         b->reserved = vb->v4l2_buf.reserved;
@@ -313,7 +316,10 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
                         b->m.userptr = vb->v4l2_planes[0].m.userptr;
         }
 
-        b->flags = 0;
+        /*
+         * Clear any buffer state related flags.
+         */
+        b->flags &= ~V4L2_BUFFER_STATE_FLAGS;
 
         switch (vb->state) {
         case VB2_BUF_STATE_QUEUED:
@@ -519,6 +525,7 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
         num_buffers = min_t(unsigned int, req->count, VIDEO_MAX_FRAME);
         memset(plane_sizes, 0, sizeof(plane_sizes));
         memset(q->alloc_ctx, 0, sizeof(q->alloc_ctx));
+        q->memory = req->memory;
 
         /*
          * Ask the driver how many buffers and planes per buffer it requires.
@@ -560,8 +567,6 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
                 ret = num_buffers;
         }
 
-        q->memory = req->memory;
-
         /*
          * Return the number of successfully allocated buffers
          * to the userspace.
@@ -715,6 +720,8 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b,
 
         vb->v4l2_buf.field = b->field;
         vb->v4l2_buf.timestamp = b->timestamp;
+        vb->v4l2_buf.input = b->input;
+        vb->v4l2_buf.flags = b->flags & ~V4L2_BUFFER_STATE_FLAGS;
 
         return 0;
 }
diff --git a/drivers/media/video/videobuf2-dma-contig.c b/drivers/media/video/videobuf2-dma-contig.c
index 58205d596138..a790a5f8c06f 100644
--- a/drivers/media/video/videobuf2-dma-contig.c
+++ b/drivers/media/video/videobuf2-dma-contig.c
@@ -46,7 +46,7 @@ static void *vb2_dma_contig_alloc(void *alloc_ctx, unsigned long size)
                                         GFP_KERNEL);
         if (!buf->vaddr) {
                 dev_err(conf->dev, "dma_alloc_coherent of size %ld failed\n",
-                        buf->size);
+                        size);
                 kfree(buf);
                 return ERR_PTR(-ENOMEM);
         }
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index 53450f433f10..2e165117457b 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -25,7 +25,6 @@
 #include <linux/dma-mapping.h>
 #include <linux/spinlock.h>
 #include <linux/gpio.h>
-#include <linux/regulator/consumer.h>
 #include <plat/usb.h>
 
 #define USBHS_DRIVER_NAME       "usbhs-omap"
@@ -700,8 +699,7 @@ static int usbhs_enable(struct device *dev)
         dev_dbg(dev, "starting TI HSUSB Controller\n");
         if (!pdata) {
                 dev_dbg(dev, "missing platform_data\n");
-                ret =  -ENODEV;
-                goto end_enable;
+                return  -ENODEV;
         }
 
         spin_lock_irqsave(&omap->lock, flags);
@@ -915,7 +913,8 @@ static int usbhs_enable(struct device *dev)
 
 end_count:
         omap->count++;
-        goto end_enable;
+        spin_unlock_irqrestore(&omap->lock, flags);
+        return 0;
 
 err_tll:
         if (pdata->ehci_data->phy_reset) {
@@ -931,8 +930,6 @@ err_tll:
         clk_disable(omap->usbhost_fs_fck);
         clk_disable(omap->usbhost_hs_fck);
         clk_disable(omap->usbhost_ick);
-
-end_enable:
         spin_unlock_irqrestore(&omap->lock, flags);
         return ret;
 }
diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
index 63667a8f140c..d6d62fd07ee9 100644
--- a/drivers/mmc/core/bus.c
+++ b/drivers/mmc/core/bus.c
@@ -284,6 +284,7 @@ int mmc_add_card(struct mmc_card *card)
                 type = "SD-combo";
                 if (mmc_card_blockaddr(card))
                         type = "SDHC-combo";
+                break;
         default:
                 type = "?";
                 break;
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 461e6a17fb90..2b200c1cfbba 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -94,7 +94,7 @@ static void mmc_host_clk_gate_delayed(struct mmc_host *host)
                 spin_unlock_irqrestore(&host->clk_lock, flags);
                 return;
         }
-        mutex_lock(&host->clk_gate_mutex);
+        mmc_claim_host(host);
         spin_lock_irqsave(&host->clk_lock, flags);
         if (!host->clk_requests) {
                 spin_unlock_irqrestore(&host->clk_lock, flags);
@@ -104,7 +104,7 @@ static void mmc_host_clk_gate_delayed(struct mmc_host *host)
                 pr_debug("%s: gated MCI clock\n", mmc_hostname(host));
         }
         spin_unlock_irqrestore(&host->clk_lock, flags);
-        mutex_unlock(&host->clk_gate_mutex);
+        mmc_release_host(host);
 }
 
 /*
@@ -130,7 +130,7 @@ void mmc_host_clk_ungate(struct mmc_host *host)
 {
         unsigned long flags;
 
-        mutex_lock(&host->clk_gate_mutex);
+        mmc_claim_host(host);
         spin_lock_irqsave(&host->clk_lock, flags);
         if (host->clk_gated) {
                 spin_unlock_irqrestore(&host->clk_lock, flags);
@@ -140,7 +140,7 @@ void mmc_host_clk_ungate(struct mmc_host *host)
         }
         host->clk_requests++;
         spin_unlock_irqrestore(&host->clk_lock, flags);
-        mutex_unlock(&host->clk_gate_mutex);
+        mmc_release_host(host);
 }
 
 /**
@@ -215,7 +215,6 @@ static inline void mmc_host_clk_init(struct mmc_host *host)
         host->clk_gated = false;
         INIT_WORK(&host->clk_gate_work, mmc_host_clk_gate_work);
         spin_lock_init(&host->clk_lock);
-        mutex_init(&host->clk_gate_mutex);
 }
 
 /**
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 2e032f0e8cf4..a6c329040140 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -832,7 +832,7 @@ static irqreturn_t mmc_omap_irq(int irq, void *dev_id)
                 return IRQ_HANDLED;
         }
 
-        if (end_command)
+        if (end_command && host->cmd)
                 mmc_omap_cmd_done(host, host->cmd);
         if (host->data != NULL) {
                 if (transfer_error)
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index a136be706347..f8b5f37007b2 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -957,6 +957,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
         host->ioaddr = pci_ioremap_bar(pdev, bar);
         if (!host->ioaddr) {
                 dev_err(&pdev->dev, "failed to remap registers\n");
+                ret = -ENOMEM;
                 goto release;
         }
 
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 9e15f41f87be..5d20661bc357 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1334,6 +1334,13 @@ static void sdhci_tasklet_finish(unsigned long param)
 
         host = (struct sdhci_host*)param;
 
+        /*
+         * If this tasklet gets rescheduled while running, it will
+         * be run again afterwards but without any active request.
+         */
+        if (!host->mrq)
+                return;
+
         spin_lock_irqsave(&host->lock, flags);
 
         del_timer(&host->timer);
@@ -1345,7 +1352,7 @@ static void sdhci_tasklet_finish(unsigned long param)
          * upon error conditions.
          */
         if (!(host->flags & SDHCI_DEVICE_DEAD) &&
-                (mrq->cmd->error ||
+            ((mrq->cmd && mrq->cmd->error) ||
                  (mrq->data && (mrq->data->error ||
                   (mrq->data->stop && mrq->data->stop->error))) ||
                    (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {
diff --git a/drivers/mmc/host/tmio_mmc_pio.c b/drivers/mmc/host/tmio_mmc_pio.c
index 62d37de6de76..710339a85c84 100644
--- a/drivers/mmc/host/tmio_mmc_pio.c
+++ b/drivers/mmc/host/tmio_mmc_pio.c
@@ -728,15 +728,15 @@ static void tmio_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 tmio_mmc_set_clock(host, ios->clock);
 
         /* Power sequence - OFF -> UP -> ON */
-        if (ios->power_mode == MMC_POWER_OFF || !ios->clock) {
+        if (ios->power_mode == MMC_POWER_UP) {
+                /* power up SD bus */
+                if (host->set_pwr)
+                        host->set_pwr(host->pdev, 1);
+        } else if (ios->power_mode == MMC_POWER_OFF || !ios->clock) {
                 /* power down SD bus */
                 if (ios->power_mode == MMC_POWER_OFF && host->set_pwr)
                         host->set_pwr(host->pdev, 0);
                 tmio_mmc_clk_stop(host);
-        } else if (ios->power_mode == MMC_POWER_UP) {
-                /* power up SD bus */
-                if (host->set_pwr)
-                        host->set_pwr(host->pdev, 1);
         } else {
                 /* start bus clock */
                 tmio_mmc_clk_start(host);
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 96c0b34ba8db..657b9f4b6f9b 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -400,7 +400,7 @@ static uint16_t __init doc200x_ident_chip(struct mtd_info *mtd, int nr)
         doc200x_hwcontrol(mtd, 0, NAND_CTRL_ALE | NAND_CTRL_CHANGE);
         doc200x_hwcontrol(mtd, NAND_CMD_NONE, NAND_NCE | NAND_CTRL_CHANGE);
 
-        /* We can't' use dev_ready here, but at least we wait for the
+        /* We can't use dev_ready here, but at least we wait for the
          * command to complete
          */
         udelay(50);
diff --git a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
index 88495c48a81d..241b185e6569 100644
--- a/drivers/net/amd8111e.c
+++ b/drivers/net/amd8111e.c
@@ -106,7 +106,7 @@ MODULE_DESCRIPTION ("AMD8111 based 10/100 Ethernet Controller. Driver Version "M
 MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, amd8111e_pci_tbl);
 module_param_array(speed_duplex, int, NULL, 0);
-MODULE_PARM_DESC(speed_duplex, "Set device speed and duplex modes, 0: Auto Negotitate, 1: 10Mbps Half Duplex, 2: 10Mbps Full Duplex, 3: 100Mbps Half Duplex, 4: 100Mbps Full Duplex");
+MODULE_PARM_DESC(speed_duplex, "Set device speed and duplex modes, 0: Auto Negotiate, 1: 10Mbps Half Duplex, 2: 10Mbps Full Duplex, 3: 100Mbps Half Duplex, 4: 100Mbps Full Duplex");
 module_param_array(coalesce, bool, NULL, 0);
 MODULE_PARM_DESC(coalesce, "Enable or Disable interrupt coalescing, 1: Enable, 0: Disable");
 module_param_array(dynamic_ipg, bool, NULL, 0);
diff --git a/drivers/net/atl1c/atl1c.h b/drivers/net/atl1c/atl1c.h
index 7cb375e0e29c..925929d764ca 100644
--- a/drivers/net/atl1c/atl1c.h
+++ b/drivers/net/atl1c/atl1c.h
@@ -566,9 +566,9 @@ struct atl1c_adapter {
 #define __AT_TESTING        0x0001
 #define __AT_RESETTING      0x0002
 #define __AT_DOWN           0x0003
-        u8 work_event;
-#define ATL1C_WORK_EVENT_RESET          0x01
-#define ATL1C_WORK_EVENT_LINK_CHANGE    0x02
+        unsigned long work_event;
+#define ATL1C_WORK_EVENT_RESET          0
+#define ATL1C_WORK_EVENT_LINK_CHANGE    1
         u32 msg_enable;
 
         bool have_msi;
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index 7d9d5067a65c..a6e1c36e48e6 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -325,7 +325,7 @@ static void atl1c_link_chg_event(struct atl1c_adapter *adapter)
                 }
         }
 
-        adapter->work_event |= ATL1C_WORK_EVENT_LINK_CHANGE;
+        set_bit(ATL1C_WORK_EVENT_LINK_CHANGE, &adapter->work_event);
         schedule_work(&adapter->common_task);
 }
 
@@ -337,20 +337,16 @@ static void atl1c_common_task(struct work_struct *work)
         adapter = container_of(work, struct atl1c_adapter, common_task);
         netdev = adapter->netdev;
 
-        if (adapter->work_event & ATL1C_WORK_EVENT_RESET) {
-                adapter->work_event &= ~ATL1C_WORK_EVENT_RESET;
+        if (test_and_clear_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event)) {
                 netif_device_detach(netdev);
                 atl1c_down(adapter);
                 atl1c_up(adapter);
                 netif_device_attach(netdev);
-                return;
         }
 
-        if (adapter->work_event & ATL1C_WORK_EVENT_LINK_CHANGE) {
-                adapter->work_event &= ~ATL1C_WORK_EVENT_LINK_CHANGE;
+        if (test_and_clear_bit(ATL1C_WORK_EVENT_LINK_CHANGE,
+                &adapter->work_event))
                 atl1c_check_link_status(adapter);
-        }
-        return;
 }
 
 
@@ -369,7 +365,7 @@ static void atl1c_tx_timeout(struct net_device *netdev)
         struct atl1c_adapter *adapter = netdev_priv(netdev);
 
         /* Do the reset outside of interrupt context */
-        adapter->work_event |= ATL1C_WORK_EVENT_RESET;
+        set_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event);
         schedule_work(&adapter->common_task);
 }
 
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 7cb5a114c733..02a0443d1821 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1873,6 +1873,7 @@ static void be_worker(struct work_struct *work)
                 be_detect_dump_ue(adapter);
 
 reschedule:
+        adapter->work_counter++;
         schedule_delayed_work(&adapter->work, msecs_to_jiffies(1000));
 }
 
diff --git a/drivers/net/bna/bfa_ioc.c b/drivers/net/bna/bfa_ioc.c
index e3de0b8625cd..7581518ecfa2 100644
--- a/drivers/net/bna/bfa_ioc.c
+++ b/drivers/net/bna/bfa_ioc.c
@@ -38,6 +38,8 @@
 #define bfa_ioc_map_port(__ioc) ((__ioc)->ioc_hwif->ioc_map_port(__ioc))
 #define bfa_ioc_notify_fail(__ioc)                      \
                         ((__ioc)->ioc_hwif->ioc_notify_fail(__ioc))
+#define bfa_ioc_sync_start(__ioc)               \
+                        ((__ioc)->ioc_hwif->ioc_sync_start(__ioc))
 #define bfa_ioc_sync_join(__ioc)                        \
                         ((__ioc)->ioc_hwif->ioc_sync_join(__ioc))
 #define bfa_ioc_sync_leave(__ioc)                       \
@@ -602,7 +604,7 @@ bfa_iocpf_sm_fwcheck(struct bfa_iocpf *iocpf, enum iocpf_event event)
         switch (event) {
         case IOCPF_E_SEMLOCKED:
                 if (bfa_ioc_firmware_lock(ioc)) {
-                        if (bfa_ioc_sync_complete(ioc)) {
+                        if (bfa_ioc_sync_start(ioc)) {
                                 iocpf->retry_count = 0;
                                 bfa_ioc_sync_join(ioc);
                                 bfa_fsm_set_state(iocpf, bfa_iocpf_sm_hwinit);
@@ -1314,7 +1316,7 @@ bfa_nw_ioc_fwver_cmp(struct bfa_ioc *ioc, struct bfi_ioc_image_hdr *fwhdr)
  * execution context (driver/bios) must match.
  */
 static bool
-bfa_ioc_fwver_valid(struct bfa_ioc *ioc)
+bfa_ioc_fwver_valid(struct bfa_ioc *ioc, u32 boot_env)
 {
         struct bfi_ioc_image_hdr fwhdr, *drv_fwhdr;
 
@@ -1325,7 +1327,7 @@ bfa_ioc_fwver_valid(struct bfa_ioc *ioc)
         if (fwhdr.signature != drv_fwhdr->signature)
                 return false;
 
-        if (fwhdr.exec != drv_fwhdr->exec)
+        if (swab32(fwhdr.param) != boot_env)
                 return false;
 
         return bfa_nw_ioc_fwver_cmp(ioc, &fwhdr);
@@ -1352,9 +1354,12 @@ bfa_ioc_hwinit(struct bfa_ioc *ioc, bool force)
 {
         enum bfi_ioc_state ioc_fwstate;
         bool fwvalid;
+        u32 boot_env;
 
         ioc_fwstate = readl(ioc->ioc_regs.ioc_fwstate);
 
+        boot_env = BFI_BOOT_LOADER_OS;
+
         if (force)
                 ioc_fwstate = BFI_IOC_UNINIT;
 
@@ -1362,10 +1367,10 @@ bfa_ioc_hwinit(struct bfa_ioc *ioc, bool force)
          * check if firmware is valid
          */
         fwvalid = (ioc_fwstate == BFI_IOC_UNINIT) ?
-                false : bfa_ioc_fwver_valid(ioc);
+                false : bfa_ioc_fwver_valid(ioc, boot_env);
 
         if (!fwvalid) {
-                bfa_ioc_boot(ioc, BFI_BOOT_TYPE_NORMAL, ioc->pcidev.device_id);
+                bfa_ioc_boot(ioc, BFI_BOOT_TYPE_NORMAL, boot_env);
                 return;
         }
 
@@ -1396,7 +1401,7 @@ bfa_ioc_hwinit(struct bfa_ioc *ioc, bool force)
         /**
          * Initialize the h/w for any other states.
          */
-        bfa_ioc_boot(ioc, BFI_BOOT_TYPE_NORMAL, ioc->pcidev.device_id);
+        bfa_ioc_boot(ioc, BFI_BOOT_TYPE_NORMAL, boot_env);
 }
 
 void
@@ -1506,7 +1511,7 @@ bfa_ioc_hb_stop(struct bfa_ioc *ioc)
  */
 static void
 bfa_ioc_download_fw(struct bfa_ioc *ioc, u32 boot_type,
-                    u32 boot_param)
+                    u32 boot_env)
 {
         u32 *fwimg;
         u32 pgnum, pgoff;
@@ -1558,10 +1563,10 @@ bfa_ioc_download_fw(struct bfa_ioc *ioc, u32 boot_type,
         /*
          * Set boot type and boot param at the end.
         */
-        writel((swab32(swab32(boot_type))), ((ioc->ioc_regs.smem_page_start)
+        writel(boot_type, ((ioc->ioc_regs.smem_page_start)
                         + (BFI_BOOT_TYPE_OFF)));
-        writel((swab32(swab32(boot_param))), ((ioc->ioc_regs.smem_page_start)
-                        + (BFI_BOOT_PARAM_OFF)));
+        writel(boot_env, ((ioc->ioc_regs.smem_page_start)
+                        + (BFI_BOOT_LOADER_OFF)));
 }
 
 static void
@@ -1721,7 +1726,7 @@ bfa_ioc_pll_init(struct bfa_ioc *ioc)
  * as the entry vector.
  */
 static void
-bfa_ioc_boot(struct bfa_ioc *ioc, u32 boot_type, u32 boot_param)
+bfa_ioc_boot(struct bfa_ioc *ioc, u32 boot_type, u32 boot_env)
 {
         void __iomem *rb;
 
@@ -1734,7 +1739,7 @@ bfa_ioc_boot(struct bfa_ioc *ioc, u32 boot_type, u32 boot_param)
          * Initialize IOC state of all functions on a chip reset.
          */
         rb = ioc->pcidev.pci_bar_kva;
-        if (boot_param == BFI_BOOT_TYPE_MEMTEST) {
+        if (boot_type == BFI_BOOT_TYPE_MEMTEST) {
                 writel(BFI_IOC_MEMTEST, (rb + BFA_IOC0_STATE_REG));
                 writel(BFI_IOC_MEMTEST, (rb + BFA_IOC1_STATE_REG));
         } else {
@@ -1743,7 +1748,7 @@ bfa_ioc_boot(struct bfa_ioc *ioc, u32 boot_type, u32 boot_param)
         }
 
         bfa_ioc_msgflush(ioc);
-        bfa_ioc_download_fw(ioc, boot_type, boot_param);
+        bfa_ioc_download_fw(ioc, boot_type, boot_env);
 
         /**
          * Enable interrupts just before starting LPU
diff --git a/drivers/net/bna/bfa_ioc.h b/drivers/net/bna/bfa_ioc.h
index e4974bc24ef6..bd48abee781f 100644
--- a/drivers/net/bna/bfa_ioc.h
+++ b/drivers/net/bna/bfa_ioc.h
@@ -194,6 +194,7 @@ struct bfa_ioc_hwif {
                                         bool msix);
         void            (*ioc_notify_fail)      (struct bfa_ioc *ioc);
         void            (*ioc_ownership_reset)  (struct bfa_ioc *ioc);
+        bool            (*ioc_sync_start)       (struct bfa_ioc *ioc);
         void            (*ioc_sync_join)        (struct bfa_ioc *ioc);
         void            (*ioc_sync_leave)       (struct bfa_ioc *ioc);
         void            (*ioc_sync_ack)         (struct bfa_ioc *ioc);
diff --git a/drivers/net/bna/bfa_ioc_ct.c b/drivers/net/bna/bfa_ioc_ct.c
index 469997c4ffd1..87aecdf22cf9 100644
--- a/drivers/net/bna/bfa_ioc_ct.c
+++ b/drivers/net/bna/bfa_ioc_ct.c
@@ -41,6 +41,7 @@ static void bfa_ioc_ct_map_port(struct bfa_ioc *ioc);
 static void bfa_ioc_ct_isr_mode_set(struct bfa_ioc *ioc, bool msix);
 static void bfa_ioc_ct_notify_fail(struct bfa_ioc *ioc);
 static void bfa_ioc_ct_ownership_reset(struct bfa_ioc *ioc);
+static bool bfa_ioc_ct_sync_start(struct bfa_ioc *ioc);
 static void bfa_ioc_ct_sync_join(struct bfa_ioc *ioc);
 static void bfa_ioc_ct_sync_leave(struct bfa_ioc *ioc);
 static void bfa_ioc_ct_sync_ack(struct bfa_ioc *ioc);
@@ -63,6 +64,7 @@ bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc)
         nw_hwif_ct.ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set;
         nw_hwif_ct.ioc_notify_fail = bfa_ioc_ct_notify_fail;
         nw_hwif_ct.ioc_ownership_reset = bfa_ioc_ct_ownership_reset;
+        nw_hwif_ct.ioc_sync_start = bfa_ioc_ct_sync_start;
         nw_hwif_ct.ioc_sync_join = bfa_ioc_ct_sync_join;
         nw_hwif_ct.ioc_sync_leave = bfa_ioc_ct_sync_leave;
         nw_hwif_ct.ioc_sync_ack = bfa_ioc_ct_sync_ack;
@@ -345,6 +347,32 @@ bfa_ioc_ct_ownership_reset(struct bfa_ioc *ioc)
 /**
  * Synchronized IOC failure processing routines
  */
+static bool
+bfa_ioc_ct_sync_start(struct bfa_ioc *ioc)
+{
+        u32 r32 = readl(ioc->ioc_regs.ioc_fail_sync);
+        u32 sync_reqd = bfa_ioc_ct_get_sync_reqd(r32);
+
+        /*
+         * Driver load time.  If the sync required bit for this PCI fn
+         * is set, it is due to an unclean exit by the driver for this
+         * PCI fn in the previous incarnation. Whoever comes here first
+         * should clean it up, no matter which PCI fn.
+         */
+
+        if (sync_reqd & bfa_ioc_ct_sync_pos(ioc)) {
+                writel(0, ioc->ioc_regs.ioc_fail_sync);
+                writel(1, ioc->ioc_regs.ioc_usage_reg);
+                writel(BFI_IOC_UNINIT, ioc->ioc_regs.ioc_fwstate);
+                writel(BFI_IOC_UNINIT, ioc->ioc_regs.alt_ioc_fwstate);
+                return true;
+        }
+
+        return bfa_ioc_ct_sync_complete(ioc);
+}
+/**
+ * Synchronized IOC failure processing routines
+ */
 static void
 bfa_ioc_ct_sync_join(struct bfa_ioc *ioc)
 {
diff --git a/drivers/net/bna/bfi.h b/drivers/net/bna/bfi.h
index a97396811050..6050379526f7 100644
--- a/drivers/net/bna/bfi.h
+++ b/drivers/net/bna/bfi.h
@@ -184,12 +184,14 @@ enum bfi_mclass {
 #define BFI_IOC_MSGLEN_MAX      32      /* 32 bytes */
 
 #define BFI_BOOT_TYPE_OFF               8
-#define BFI_BOOT_PARAM_OFF              12
+#define BFI_BOOT_LOADER_OFF             12
 
-#define BFI_BOOT_TYPE_NORMAL            0       /* param is device id */
+#define BFI_BOOT_TYPE_NORMAL            0
 #define BFI_BOOT_TYPE_FLASH             1
 #define BFI_BOOT_TYPE_MEMTEST           2
 
+#define BFI_BOOT_LOADER_OS              0
+
 #define BFI_BOOT_MEMTEST_RES_ADDR   0x900
 #define BFI_BOOT_MEMTEST_RES_SIG    0xA0A1A2A3
 
diff --git a/drivers/net/bna/bnad.c b/drivers/net/bna/bnad.c
index 9f356d5d0f33..8e6ceab9f4d8 100644
--- a/drivers/net/bna/bnad.c
+++ b/drivers/net/bna/bnad.c
@@ -1837,7 +1837,6 @@ bnad_setup_rx(struct bnad *bnad, uint rx_id)
         /* Initialize the Rx event handlers */
         rx_cbfn.rcb_setup_cbfn = bnad_cb_rcb_setup;
         rx_cbfn.rcb_destroy_cbfn = bnad_cb_rcb_destroy;
-        rx_cbfn.rcb_destroy_cbfn = NULL;
         rx_cbfn.ccb_setup_cbfn = bnad_cb_ccb_setup;
         rx_cbfn.ccb_destroy_cbfn = bnad_cb_ccb_destroy;
         rx_cbfn.rx_cleanup_cbfn = bnad_cb_rx_cleanup;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 8e6d618b5305..d8383a9af9ad 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -8413,6 +8413,8 @@ bnx2_remove_one(struct pci_dev *pdev)
 
         unregister_netdev(dev);
 
+        del_timer_sync(&bp->timer);
+
         if (bp->mips_firmware)
                 release_firmware(bp->mips_firmware);
         if (bp->rv2p_firmware)
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index e83ac6dd6fc0..16581df5ee4e 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -2019,15 +2019,23 @@ static inline void bnx2x_set_pbd_gso(struct sk_buff *skb,
 static inline  u8 bnx2x_set_pbd_csum_e2(struct bnx2x *bp, struct sk_buff *skb,
         u32 *parsing_data, u32 xmit_type)
 {
-        *parsing_data |= ((tcp_hdrlen(skb)/4) <<
-                ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW_SHIFT) &
-                ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW;
+        *parsing_data |=
+                        ((((u8 *)skb_transport_header(skb) - skb->data) >> 1) <<
+                        ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W_SHIFT) &
+                        ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W;
 
-        *parsing_data |= ((((u8 *)tcp_hdr(skb) - skb->data) / 2) <<
-                ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W_SHIFT) &
-                ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W;
+        if (xmit_type & XMIT_CSUM_TCP) {
+                *parsing_data |= ((tcp_hdrlen(skb) / 4) <<
+                        ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW_SHIFT) &
+                        ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW;
 
-        return skb_transport_header(skb) + tcp_hdrlen(skb) - skb->data;
+                return skb_transport_header(skb) + tcp_hdrlen(skb) - skb->data;
+        } else
+                /* We support checksum offload for TCP and UDP only.
+                 * No need to pass the UDP header length - it's a constant.
+                 */
+                return skb_transport_header(skb) +
+                                sizeof(struct udphdr) - skb->data;
 }
 
 /**
@@ -2043,7 +2051,7 @@ static inline u8 bnx2x_set_pbd_csum(struct bnx2x *bp, struct sk_buff *skb,
         struct eth_tx_parse_bd_e1x *pbd,
         u32 xmit_type)
 {
-        u8 hlen = (skb_network_header(skb) - skb->data) / 2;
+        u8 hlen = (skb_network_header(skb) - skb->data) >> 1;
 
         /* for now NS flag is not used in Linux */
         pbd->global_data =
@@ -2051,9 +2059,15 @@ static inline u8 bnx2x_set_pbd_csum(struct bnx2x *bp, struct sk_buff *skb,
                          ETH_TX_PARSE_BD_E1X_LLC_SNAP_EN_SHIFT));
 
         pbd->ip_hlen_w = (skb_transport_header(skb) -
-                        skb_network_header(skb)) / 2;
+                        skb_network_header(skb)) >> 1;
 
-        hlen += pbd->ip_hlen_w + tcp_hdrlen(skb) / 2;
+        hlen += pbd->ip_hlen_w;
+
+        /* We support checksum offload for TCP and UDP only */
+        if (xmit_type & XMIT_CSUM_TCP)
+                hlen += tcp_hdrlen(skb) / 2;
+        else
+                hlen += sizeof(struct udphdr) / 2;
 
         pbd->total_hlen_w = cpu_to_le16(hlen);
         hlen = hlen*2;
diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
index f5050155c6b5..89cb977898cb 100644
--- a/drivers/net/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
@@ -2114,19 +2114,18 @@ static int bnx2x_phys_id(struct net_device *dev, u32 data)
         for (i = 0; i < (data * 2); i++) {
                 if ((i % 2) == 0)
                         bnx2x_set_led(&bp->link_params, &bp->link_vars,
-                                      LED_MODE_OPER, SPEED_1000);
+                                      LED_MODE_ON, SPEED_1000);
                 else
                         bnx2x_set_led(&bp->link_params, &bp->link_vars,
-                                      LED_MODE_OFF, 0);
+                                      LED_MODE_FRONT_PANEL_OFF, 0);
 
                 msleep_interruptible(500);
                 if (signal_pending(current))
                         break;
         }
 
-        if (bp->link_vars.link_up)
-                bnx2x_set_led(&bp->link_params, &bp->link_vars, LED_MODE_OPER,
-                              bp->link_vars.line_speed);
+        bnx2x_set_led(&bp->link_params, &bp->link_vars,
+                      LED_MODE_OPER, bp->link_vars.line_speed);
 
         return 0;
 }
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 494bf960442d..31912f17653f 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1482,8 +1482,11 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
 
 static int agg_device_up(const struct aggregator *agg)
 {
-        return (netif_running(agg->slave->dev) &&
-                netif_carrier_ok(agg->slave->dev));
+        struct port *port = agg->lag_ports;
+        if (!port)
+                return 0;
+        return (netif_running(port->slave->dev) &&
+                netif_carrier_ok(port->slave->dev));
 }
 
 /**
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 9bc5de3e04a8..ba715826e2a8 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -176,7 +176,7 @@ static int tlb_initialize(struct bonding *bond)
         bond_info->tx_hashtbl = new_hashtbl;
 
         for (i = 0; i < TLB_HASH_TABLE_SIZE; i++) {
-                tlb_init_table_entry(&bond_info->tx_hashtbl[i], 1);
+                tlb_init_table_entry(&bond_info->tx_hashtbl[i], 0);
         }
 
         _unlock_tx_hashtbl(bond);
@@ -701,7 +701,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
                  */
                 rlb_choose_channel(skb, bond);
 
-                /* The ARP relpy packets must be delayed so that
+                /* The ARP reply packets must be delayed so that
                  * they can cancel out the influence of the ARP request.
                  */
                 bond->alb_info.rlb_update_delay_counter = RLB_UPDATE_DELAY;
@@ -1042,7 +1042,7 @@ static void alb_change_hw_addr_on_detach(struct bonding *bond, struct slave *sla
  *
  * If the permanent hw address of @slave is @bond's hw address, we need to
  * find a different hw address to give @slave, that isn't in use by any other
- * slave in the bond. This address must be, of course, one of the premanent
+ * slave in the bond. This address must be, of course, one of the permanent
  * addresses of the other slaves.
  *
  * We go over the slave list, and for each slave there we compare its
diff --git a/drivers/net/bonding/bond_alb.h b/drivers/net/bonding/bond_alb.h
index 86861f08b24d..8ca7158b2dda 100644
--- a/drivers/net/bonding/bond_alb.h
+++ b/drivers/net/bonding/bond_alb.h
@@ -75,7 +75,7 @@ struct tlb_client_info {
                                  * gave this entry index.
                                  */
         u32 tx_bytes;           /* Each Client accumulates the BytesTx that
-                                 * were tranmitted to it, and after each
+                                 * were transmitted to it, and after each
                                  * CallBack the LoadHistory is divided
                                  * by the balance interval
                                  */
@@ -122,7 +122,6 @@ struct tlb_slave_info {
 };
 
 struct alb_bond_info {
-        struct timer_list       alb_timer;
         struct tlb_client_info  *tx_hashtbl; /* Dynamically allocated */
         spinlock_t              tx_hashtbl_lock;
         u32                     unbalanced_load;
@@ -140,7 +139,6 @@ struct alb_bond_info {
         struct slave            *next_rx_slave;/* next slave to be assigned
                                                 * to a new rx client for
                                                 */
-        u32                     rlb_interval_counter;
         u8                      primary_is_promisc;        /* boolean */
         u32                     rlb_promisc_timeout_counter;/* counts primary
                                                              * promiscuity time
diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c
index c0a1bc5b1435..bd1d811c204f 100644
--- a/drivers/net/can/mscan/mpc5xxx_can.c
+++ b/drivers/net/can/mscan/mpc5xxx_can.c
@@ -260,7 +260,7 @@ static int __devinit mpc5xxx_can_probe(struct platform_device *ofdev)
 
         if (!ofdev->dev.of_match)
                 return -EINVAL;
-        data = (struct mpc5xxx_can_data *)of_dev->dev.of_match->data;
+        data = (struct mpc5xxx_can_data *)ofdev->dev.of_match->data;
 
         base = of_iomap(np, 0);
         if (!base) {
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index f75d3144b8a5..53c0f04b1b23 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -3040,11 +3040,14 @@ static void ehea_rereg_mrs(void)
 
                                         if (dev->flags & IFF_UP) {
                                                 mutex_lock(&port->port_lock);
-                                                port_napi_enable(port);
                                                 ret = ehea_restart_qps(dev);
-                                                check_sqs(port);
-                                                if (!ret)
+                                                if (!ret) {
+                                                        check_sqs(port);
+                                                        port_napi_enable(port);
                                                         netif_wake_queue(dev);
+                                                } else {
+                                                        netdev_err(dev, "Unable to restart QPS\n");
+                                                }
                                                 mutex_unlock(&port->port_lock);
                                         }
                                 }
diff --git a/drivers/net/fs_enet/mac-fec.c b/drivers/net/fs_enet/mac-fec.c
index 61035fc5599b..b9fbc83d64a7 100644
--- a/drivers/net/fs_enet/mac-fec.c
+++ b/drivers/net/fs_enet/mac-fec.c
@@ -226,8 +226,8 @@ static void set_multicast_finish(struct net_device *dev)
         }
 
         FC(fecp, r_cntrl, FEC_RCNTRL_PROM);
-        FW(fecp, hash_table_high, fep->fec.hthi);
-        FW(fecp, hash_table_low, fep->fec.htlo);
+        FW(fecp, grp_hash_table_high, fep->fec.hthi);
+        FW(fecp, grp_hash_table_low, fep->fec.htlo);
 }
 
 static void set_multicast_list(struct net_device *dev)
@@ -273,8 +273,8 @@ static void restart(struct net_device *dev)
         /*
          * Reset all multicast.
          */
-        FW(fecp, hash_table_high, fep->fec.hthi);
-        FW(fecp, hash_table_low, fep->fec.htlo);
+        FW(fecp, grp_hash_table_high, fep->fec.hthi);
+        FW(fecp, grp_hash_table_low, fep->fec.htlo);
 
         /*
          * Set maximum receive buffer size.
diff --git a/drivers/net/ftmac100.c b/drivers/net/ftmac100.c
index a31661948c42..9bd7746cbfcf 100644
--- a/drivers/net/ftmac100.c
+++ b/drivers/net/ftmac100.c
@@ -139,11 +139,11 @@ static int ftmac100_reset(struct ftmac100 *priv)
                          * that hardware reset completed (what the f*ck).
                          * We still need to wait for a while.
                          */
-                        usleep_range(500, 1000);
+                        udelay(500);
                         return 0;
                 }
 
-                usleep_range(1000, 10000);
+                udelay(1000);
         }
 
         netdev_err(netdev, "software reset failed\n");
@@ -772,7 +772,7 @@ static int ftmac100_mdio_read(struct net_device *netdev, int phy_id, int reg)
                 if ((phycr & FTMAC100_PHYCR_MIIRD) == 0)
                         return phycr & FTMAC100_PHYCR_MIIRDATA;
 
-                usleep_range(100, 1000);
+                udelay(100);
         }
 
         netdev_err(netdev, "mdio read timed out\n");
@@ -801,7 +801,7 @@ static void ftmac100_mdio_write(struct net_device *netdev, int phy_id, int reg,
                 if ((phycr & FTMAC100_PHYCR_MIIWR) == 0)
                         return;
 
-                usleep_range(100, 1000);
+                udelay(100);
         }
 
         netdev_err(netdev, "mdio write timed out\n");
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index ea0dc451da9c..d70fb76edb77 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -173,7 +173,8 @@ static void loopback_setup(struct net_device *dev)
                 | NETIF_F_RXCSUM
                 | NETIF_F_HIGHDMA
                 | NETIF_F_LLTX
-                | NETIF_F_NETNS_LOCAL;
+                | NETIF_F_NETNS_LOCAL
+                | NETIF_F_VLAN_CHALLENGED;
         dev->ethtool_ops        = &loopback_ethtool_ops;
         dev->header_ops         = &eth_header_ops;
         dev->netdev_ops         = &loopback_ops;
diff --git a/drivers/net/mii.c b/drivers/net/mii.c
index 0a6c6a2e7550..d4fc00b1ff93 100644
--- a/drivers/net/mii.c
+++ b/drivers/net/mii.c
@@ -49,6 +49,10 @@ static u32 mii_get_an(struct mii_if_info *mii, u16 addr)
                 result |= ADVERTISED_100baseT_Half;
         if (advert & ADVERTISE_100FULL)
                 result |= ADVERTISED_100baseT_Full;
+        if (advert & ADVERTISE_PAUSE_CAP)
+                result |= ADVERTISED_Pause;
+        if (advert & ADVERTISE_PAUSE_ASYM)
+                result |= ADVERTISED_Asym_Pause;
 
         return result;
 }
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index aa2813e06d00..1074231f0a0d 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -860,6 +860,9 @@ static int __devinit natsemi_probe1 (struct pci_dev *pdev,
                 prev_eedata = eedata;
         }
 
+        /* Store MAC Address in perm_addr */
+        memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
+
         dev->base_addr = (unsigned long __force) ioaddr;
         dev->irq = irq;
 
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index dfb67eb2a94b..eb41e44921e6 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -671,6 +671,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
                 goto done;
 
         spin_lock_irqsave(&target_list_lock, flags);
+restart:
         list_for_each_entry(nt, &target_list, list) {
                 netconsole_target_get(nt);
                 if (nt->np.dev == dev) {
@@ -683,9 +684,16 @@ static int netconsole_netdev_event(struct notifier_block *this,
                                  * rtnl_lock already held
                                  */
                                 if (nt->np.dev) {
+                                        spin_unlock_irqrestore(
+                                                              &target_list_lock,
+                                                              flags);
                                         __netpoll_cleanup(&nt->np);
+                                        spin_lock_irqsave(&target_list_lock,
+                                                          flags);
                                         dev_put(nt->np.dev);
                                         nt->np.dev = NULL;
+                                        netconsole_target_put(nt);
+                                        goto restart;
                                 }
                                 /* Fall through */
                         case NETDEV_GOING_DOWN:
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index d7299f1a4940..679dc8519c5b 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -174,7 +174,7 @@
 
 #define MAX_NUM_CARDS           4
 
-#define MAX_BUFFERS_PER_CMD     32
+#define NETXEN_MAX_FRAGS_PER_TX 14
 #define MAX_TSO_HEADER_DESC     2
 #define MGMT_CMD_DESC_RESV      4
 #define TX_STOP_THRESH          ((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \
@@ -558,7 +558,7 @@ struct netxen_recv_crb {
  */
 struct netxen_cmd_buffer {
         struct sk_buff *skb;
-        struct netxen_skb_frag frag_array[MAX_BUFFERS_PER_CMD + 1];
+        struct netxen_skb_frag frag_array[MAX_SKB_FRAGS + 1];
         u32 frag_count;
 };
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 83348dc4b184..e8a4b6655999 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1844,6 +1844,8 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         struct cmd_desc_type0 *hwdesc, *first_desc;
         struct pci_dev *pdev;
         int i, k;
+        int delta = 0;
+        struct skb_frag_struct *frag;
 
         u32 producer;
         int frag_count, no_of_desc;
@@ -1851,6 +1853,21 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
         frag_count = skb_shinfo(skb)->nr_frags + 1;
 
+        /* 14 frags supported for normal packet and
+         * 32 frags supported for TSO packet
+         */
+        if (!skb_is_gso(skb) && frag_count > NETXEN_MAX_FRAGS_PER_TX) {
+
+                for (i = 0; i < (frag_count - NETXEN_MAX_FRAGS_PER_TX); i++) {
+                        frag = &skb_shinfo(skb)->frags[i];
+                        delta += frag->size;
+                }
+
+                if (!__pskb_pull_tail(skb, delta))
+                        goto drop_packet;
+
+                frag_count = 1 + skb_shinfo(skb)->nr_frags;
+        }
         /* 4 fragments per cmd des */
         no_of_desc = (frag_count + 3) >> 2;
 
diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
index dc44564ef6f9..b0dead00b2d1 100644
--- a/drivers/net/qlcnic/qlcnic.h
+++ b/drivers/net/qlcnic/qlcnic.h
@@ -99,6 +99,7 @@
 #define TX_UDPV6_PKT    0x0c
 
 /* Tx defines */
+#define QLCNIC_MAX_FRAGS_PER_TX 14
 #define MAX_TSO_HEADER_DESC     2
 #define MGMT_CMD_DESC_RESV      4
 #define TX_STOP_THRESH          ((MAX_SKB_FRAGS >> 2) + MAX_TSO_HEADER_DESC \
diff --git a/drivers/net/qlcnic/qlcnic_main.c b/drivers/net/qlcnic/qlcnic_main.c
index cd88c7e1bfa9..cb1a1ef36c0a 100644
--- a/drivers/net/qlcnic/qlcnic_main.c
+++ b/drivers/net/qlcnic/qlcnic_main.c
@@ -2099,6 +2099,7 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         struct cmd_desc_type0 *hwdesc, *first_desc;
         struct pci_dev *pdev;
         struct ethhdr *phdr;
+        int delta = 0;
         int i, k;
 
         u32 producer;
@@ -2118,6 +2119,19 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         }
 
         frag_count = skb_shinfo(skb)->nr_frags + 1;
+        /* 14 frags supported for normal packet and
+         * 32 frags supported for TSO packet
+         */
+        if (!skb_is_gso(skb) && frag_count > QLCNIC_MAX_FRAGS_PER_TX) {
+
+                for (i = 0; i < (frag_count - QLCNIC_MAX_FRAGS_PER_TX); i++)
+                        delta += skb_shinfo(skb)->frags[i].size;
+
+                if (!__pskb_pull_tail(skb, delta))
+                        goto drop_packet;
+
+                frag_count = 1 + skb_shinfo(skb)->nr_frags;
+        }
 
         /* 4 fragments per cmd des */
         no_of_desc = (frag_count + 3) >> 2;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 493b0de3848b..397c36810a15 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -170,6 +170,16 @@ static const struct {
 };
 #undef _R
 
+static const struct rtl_firmware_info {
+        int mac_version;
+        const char *fw_name;
+} rtl_firmware_infos[] = {
+        { .mac_version = RTL_GIGA_MAC_VER_25, .fw_name = FIRMWARE_8168D_1 },
+        { .mac_version = RTL_GIGA_MAC_VER_26, .fw_name = FIRMWARE_8168D_2 },
+        { .mac_version = RTL_GIGA_MAC_VER_29, .fw_name = FIRMWARE_8105E_1 },
+        { .mac_version = RTL_GIGA_MAC_VER_30, .fw_name = FIRMWARE_8105E_1 }
+};
+
 enum cfg_version {
         RTL_CFG_0 = 0x00,
         RTL_CFG_1,
@@ -565,6 +575,7 @@ struct rtl8169_private {
         u32 saved_wolopts;
 
         const struct firmware *fw;
+#define RTL_FIRMWARE_UNKNOWN    ERR_PTR(-EAGAIN);
 };
 
 MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>");
@@ -1789,25 +1800,26 @@ rtl_phy_write_fw(struct rtl8169_private *tp, const struct firmware *fw)
 
 static void rtl_release_firmware(struct rtl8169_private *tp)
 {
-        release_firmware(tp->fw);
-        tp->fw = NULL;
+        if (!IS_ERR_OR_NULL(tp->fw))
+                release_firmware(tp->fw);
+        tp->fw = RTL_FIRMWARE_UNKNOWN;
 }
 
-static int rtl_apply_firmware(struct rtl8169_private *tp, const char *fw_name)
+static void rtl_apply_firmware(struct rtl8169_private *tp)
 {
-        const struct firmware **fw = &tp->fw;
-        int rc = !*fw;
-
-        if (rc) {
-                rc = request_firmware(fw, fw_name, &tp->pci_dev->dev);
-                if (rc < 0)
-                        goto out;
-        }
+        const struct firmware *fw = tp->fw;
 
         /* TODO: release firmware once rtl_phy_write_fw signals failures. */
-        rtl_phy_write_fw(tp, *fw);
-out:
-        return rc;
+        if (!IS_ERR_OR_NULL(fw))
+                rtl_phy_write_fw(tp, fw);
+}
+
+static void rtl_apply_firmware_cond(struct rtl8169_private *tp, u8 reg, u16 val)
+{
+        if (rtl_readphy(tp, reg) != val)
+                netif_warn(tp, hw, tp->dev, "chipset not ready for firmware\n");
+        else
+                rtl_apply_firmware(tp);
 }
 
 static void rtl8169s_hw_phy_config(struct rtl8169_private *tp)
@@ -2246,10 +2258,8 @@ static void rtl8168d_1_hw_phy_config(struct rtl8169_private *tp)
 
         rtl_writephy(tp, 0x1f, 0x0005);
         rtl_writephy(tp, 0x05, 0x001b);
-        if ((rtl_readphy(tp, 0x06) != 0xbf00) ||
-            (rtl_apply_firmware(tp, FIRMWARE_8168D_1) < 0)) {
-                netif_warn(tp, probe, tp->dev, "unable to apply firmware patch\n");
-        }
+
+        rtl_apply_firmware_cond(tp, MII_EXPANSION, 0xbf00);
 
         rtl_writephy(tp, 0x1f, 0x0000);
 }
@@ -2351,10 +2361,8 @@ static void rtl8168d_2_hw_phy_config(struct rtl8169_private *tp)
 
         rtl_writephy(tp, 0x1f, 0x0005);
         rtl_writephy(tp, 0x05, 0x001b);
-        if ((rtl_readphy(tp, 0x06) != 0xb300) ||
-            (rtl_apply_firmware(tp, FIRMWARE_8168D_2) < 0)) {
-                netif_warn(tp, probe, tp->dev, "unable to apply firmware patch\n");
-        }
+
+        rtl_apply_firmware_cond(tp, MII_EXPANSION, 0xb300);
 
         rtl_writephy(tp, 0x1f, 0x0000);
 }
@@ -2474,8 +2482,7 @@ static void rtl8105e_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy(tp, 0x18, 0x0310);
         msleep(100);
 
-        if (rtl_apply_firmware(tp, FIRMWARE_8105E_1) < 0)
-                netif_warn(tp, probe, tp->dev, "unable to apply firmware patch\n");
+        rtl_apply_firmware(tp);
 
         rtl_writephy_batch(tp, phy_reg_init, ARRAY_SIZE(phy_reg_init));
 }
@@ -3237,6 +3244,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         tp->timer.data = (unsigned long) dev;
         tp->timer.function = rtl8169_phy_timer;
 
+        tp->fw = RTL_FIRMWARE_UNKNOWN;
+
         rc = register_netdev(dev);
         if (rc < 0)
                 goto err_out_msi_4;
@@ -3288,10 +3297,10 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
 
         cancel_delayed_work_sync(&tp->task);
 
-        rtl_release_firmware(tp);
-
         unregister_netdev(dev);
 
+        rtl_release_firmware(tp);
+
         if (pci_dev_run_wake(pdev))
                 pm_runtime_get_noresume(&pdev->dev);
 
@@ -3303,6 +3312,37 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
         pci_set_drvdata(pdev, NULL);
 }
 
+static void rtl_request_firmware(struct rtl8169_private *tp)
+{
+        int i;
+
+        /* Return early if the firmware is already loaded / cached. */
+        if (!IS_ERR(tp->fw))
+                goto out;
+
+        for (i = 0; i < ARRAY_SIZE(rtl_firmware_infos); i++) {
+                const struct rtl_firmware_info *info = rtl_firmware_infos + i;
+
+                if (info->mac_version == tp->mac_version) {
+                        const char *name = info->fw_name;
+                        int rc;
+
+                        rc = request_firmware(&tp->fw, name, &tp->pci_dev->dev);
+                        if (rc < 0) {
+                                netif_warn(tp, ifup, tp->dev, "unable to load "
+                                        "firmware patch %s (%d)\n", name, rc);
+                                goto out_disable_request_firmware;
+                        }
+                        goto out;
+                }
+        }
+
+out_disable_request_firmware:
+        tp->fw = NULL;
+out:
+        return;
+}
+
 static int rtl8169_open(struct net_device *dev)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
@@ -3334,11 +3374,13 @@ static int rtl8169_open(struct net_device *dev)
 
         smp_mb();
 
+        rtl_request_firmware(tp);
+
         retval = request_irq(dev->irq, rtl8169_interrupt,
                              (tp->features & RTL_FEATURE_MSI) ? 0 : IRQF_SHARED,
                              dev->name, dev);
         if (retval < 0)
-                goto err_release_ring_2;
+                goto err_release_fw_2;
 
         napi_enable(&tp->napi);
 
@@ -3359,7 +3401,8 @@ static int rtl8169_open(struct net_device *dev)
 out:
         return retval;
 
-err_release_ring_2:
+err_release_fw_2:
+        rtl_release_firmware(tp);
         rtl8169_rx_clear(tp);
 err_free_rx_1:
         dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index d890679e4c4d..a3c2aab53de8 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -328,7 +328,8 @@ static int efx_poll(struct napi_struct *napi, int budget)
  * processing to finish, then directly poll (and ack ) the eventq.
  * Finally reenable NAPI and interrupts.
  *
- * Since we are touching interrupts the caller should hold the suspend lock
+ * This is for use only during a loopback self-test.  It must not
+ * deliver any packets up the stack as this can result in deadlock.
  */
 void efx_process_channel_now(struct efx_channel *channel)
 {
@@ -336,6 +337,7 @@ void efx_process_channel_now(struct efx_channel *channel)
 
         BUG_ON(channel->channel >= efx->n_channels);
         BUG_ON(!channel->enabled);
+        BUG_ON(!efx->loopback_selftest);
 
         /* Disable interrupts and wait for ISRs to complete */
         efx_nic_disable_interrupts(efx);
@@ -1436,7 +1438,7 @@ static void efx_start_all(struct efx_nic *efx)
          * restart the transmit interface early so the watchdog timer stops */
         efx_start_port(efx);
 
-        if (efx_dev_registered(efx))
+        if (efx_dev_registered(efx) && !efx->port_inhibited)
                 netif_tx_wake_all_queues(efx->net_dev);
 
         efx_for_each_channel(channel, efx)
diff --git a/drivers/net/sfc/io.h b/drivers/net/sfc/io.h
index d9d8c2ef1074..cc978803d484 100644
--- a/drivers/net/sfc/io.h
+++ b/drivers/net/sfc/io.h
@@ -152,6 +152,7 @@ static inline void efx_reado(struct efx_nic *efx, efx_oword_t *value,
 
         spin_lock_irqsave(&efx->biu_lock, flags);
         value->u32[0] = _efx_readd(efx, reg + 0);
+        rmb();
         value->u32[1] = _efx_readd(efx, reg + 4);
         value->u32[2] = _efx_readd(efx, reg + 8);
         value->u32[3] = _efx_readd(efx, reg + 12);
@@ -174,6 +175,7 @@ static inline void efx_sram_readq(struct efx_nic *efx, void __iomem *membase,
         value->u64[0] = (__force __le64)__raw_readq(membase + addr);
 #else
         value->u32[0] = (__force __le32)__raw_readl(membase + addr);
+        rmb();
         value->u32[1] = (__force __le32)__raw_readl(membase + addr + 4);
 #endif
         spin_unlock_irqrestore(&efx->biu_lock, flags);
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 9ffa9a6b55a0..191a311da2dc 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -330,7 +330,6 @@ enum efx_rx_alloc_method {
  * @eventq_mask: Event queue pointer mask
  * @eventq_read_ptr: Event queue read pointer
  * @last_eventq_read_ptr: Last event queue read pointer value.
- * @magic_count: Event queue test event count
  * @irq_count: Number of IRQs since last adaptive moderation decision
  * @irq_mod_score: IRQ moderation score
  * @rx_alloc_level: Watermark based heuristic counter for pushing descriptors
@@ -360,7 +359,6 @@ struct efx_channel {
         unsigned int eventq_mask;
         unsigned int eventq_read_ptr;
         unsigned int last_eventq_read_ptr;
-        unsigned int magic_count;
 
         unsigned int irq_count;
         unsigned int irq_mod_score;
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index e8396614daf3..10f1cb79c147 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -84,7 +84,8 @@ static inline void efx_write_buf_tbl(struct efx_nic *efx, efx_qword_t *value,
 static inline efx_qword_t *efx_event(struct efx_channel *channel,
                                      unsigned int index)
 {
-        return ((efx_qword_t *) (channel->eventq.addr)) + index;
+        return ((efx_qword_t *) (channel->eventq.addr)) +
+                (index & channel->eventq_mask);
 }
 
 /* See if an event is present
@@ -673,7 +674,8 @@ void efx_nic_eventq_read_ack(struct efx_channel *channel)
         efx_dword_t reg;
         struct efx_nic *efx = channel->efx;
 
-        EFX_POPULATE_DWORD_1(reg, FRF_AZ_EVQ_RPTR, channel->eventq_read_ptr);
+        EFX_POPULATE_DWORD_1(reg, FRF_AZ_EVQ_RPTR,
+                             channel->eventq_read_ptr & channel->eventq_mask);
         efx_writed_table(efx, &reg, efx->type->evq_rptr_tbl_base,
                          channel->channel);
 }
@@ -908,7 +910,7 @@ efx_handle_generated_event(struct efx_channel *channel, efx_qword_t *event)
 
         code = EFX_QWORD_FIELD(*event, FSF_AZ_DRV_GEN_EV_MAGIC);
         if (code == EFX_CHANNEL_MAGIC_TEST(channel))
-                ++channel->magic_count;
+                ; /* ignore */
         else if (code == EFX_CHANNEL_MAGIC_FILL(channel))
                 /* The queue must be empty, so we won't receive any rx
                  * events, so efx_process_channel() won't refill the
@@ -1015,8 +1017,7 @@ int efx_nic_process_eventq(struct efx_channel *channel, int budget)
                 /* Clear this event by marking it all ones */
                 EFX_SET_QWORD(*p_event);
 
-                /* Increment read pointer */
-                read_ptr = (read_ptr + 1) & channel->eventq_mask;
+                ++read_ptr;
 
                 ev_code = EFX_QWORD_FIELD(event, FSF_AZ_EV_CODE);
 
@@ -1060,6 +1061,13 @@ out:
         return spent;
 }
 
+/* Check whether an event is present in the eventq at the current
+ * read pointer.  Only useful for self-test.
+ */
+bool efx_nic_event_present(struct efx_channel *channel)
+{
+        return efx_event_present(efx_event(channel, channel->eventq_read_ptr));
+}
 
 /* Allocate buffer table entries for event queue */
 int efx_nic_probe_eventq(struct efx_channel *channel)
@@ -1165,7 +1173,7 @@ static void efx_poll_flush_events(struct efx_nic *efx)
         struct efx_tx_queue *tx_queue;
         struct efx_rx_queue *rx_queue;
         unsigned int read_ptr = channel->eventq_read_ptr;
-        unsigned int end_ptr = (read_ptr - 1) & channel->eventq_mask;
+        unsigned int end_ptr = read_ptr + channel->eventq_mask - 1;
 
         do {
                 efx_qword_t *event = efx_event(channel, read_ptr);
@@ -1205,7 +1213,7 @@ static void efx_poll_flush_events(struct efx_nic *efx)
                  * it's ok to throw away every non-flush event */
                 EFX_SET_QWORD(*event);
 
-                read_ptr = (read_ptr + 1) & channel->eventq_mask;
+                ++read_ptr;
         } while (read_ptr != end_ptr);
 
         channel->eventq_read_ptr = read_ptr;
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index d9de1b647d41..a42db6e35be3 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -184,6 +184,7 @@ extern void efx_nic_fini_eventq(struct efx_channel *channel);
 extern void efx_nic_remove_eventq(struct efx_channel *channel);
 extern int efx_nic_process_eventq(struct efx_channel *channel, int rx_quota);
 extern void efx_nic_eventq_read_ack(struct efx_channel *channel);
+extern bool efx_nic_event_present(struct efx_channel *channel);
 
 /* MAC/PHY */
 extern void falcon_drain_tx_fifo(struct efx_nic *efx);
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index a0f49b348d62..50ad3bcaf68a 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -131,8 +131,6 @@ static int efx_test_chip(struct efx_nic *efx, struct efx_self_tests *tests)
 static int efx_test_interrupts(struct efx_nic *efx,
                                struct efx_self_tests *tests)
 {
-        struct efx_channel *channel;
-
         netif_dbg(efx, drv, efx->net_dev, "testing interrupts\n");
         tests->interrupt = -1;
 
@@ -140,15 +138,6 @@ static int efx_test_interrupts(struct efx_nic *efx,
         efx->last_irq_cpu = -1;
         smp_wmb();
 
-        /* ACK each interrupting event queue. Receiving an interrupt due to
-         * traffic before a test event is raised is considered a pass */
-        efx_for_each_channel(channel, efx) {
-                if (channel->work_pending)
-                        efx_process_channel_now(channel);
-                if (efx->last_irq_cpu >= 0)
-                        goto success;
-        }
-
         efx_nic_generate_interrupt(efx);
 
         /* Wait for arrival of test interrupt. */
@@ -173,13 +162,13 @@ static int efx_test_eventq_irq(struct efx_channel *channel,
                                struct efx_self_tests *tests)
 {
         struct efx_nic *efx = channel->efx;
-        unsigned int magic_count, count;
+        unsigned int read_ptr, count;
 
         tests->eventq_dma[channel->channel] = -1;
         tests->eventq_int[channel->channel] = -1;
         tests->eventq_poll[channel->channel] = -1;
 
-        magic_count = channel->magic_count;
+        read_ptr = channel->eventq_read_ptr;
         channel->efx->last_irq_cpu = -1;
         smp_wmb();
 
@@ -190,10 +179,7 @@ static int efx_test_eventq_irq(struct efx_channel *channel,
         do {
                 schedule_timeout_uninterruptible(HZ / 100);
 
-                if (channel->work_pending)
-                        efx_process_channel_now(channel);
-
-                if (channel->magic_count != magic_count)
+                if (ACCESS_ONCE(channel->eventq_read_ptr) != read_ptr)
                         goto eventq_ok;
         } while (++count < 2);
 
@@ -211,8 +197,7 @@ static int efx_test_eventq_irq(struct efx_channel *channel,
         }
 
         /* Check to see if event was received even if interrupt wasn't */
-        efx_process_channel_now(channel);
-        if (channel->magic_count != magic_count) {
+        if (efx_nic_event_present(channel)) {
                 netif_err(efx, drv, efx->net_dev,
                           "channel %d event was generated, but "
                           "failed to trigger an interrupt\n", channel->channel);
@@ -770,6 +755,8 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
         __efx_reconfigure_port(efx);
         mutex_unlock(&efx->mac_lock);
 
+        netif_tx_wake_all_queues(efx->net_dev);
+
         return rc_test;
 }
 
diff --git a/drivers/net/sfc/tx.c b/drivers/net/sfc/tx.c
index 139801908217..d2c85dfdf3bf 100644
--- a/drivers/net/sfc/tx.c
+++ b/drivers/net/sfc/tx.c
@@ -435,7 +435,8 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
          * queue state. */
         smp_mb();
         if (unlikely(netif_tx_queue_stopped(tx_queue->core_txq)) &&
-            likely(efx->port_enabled)) {
+            likely(efx->port_enabled) &&
+            likely(!efx->port_inhibited)) {
                 fill_level = tx_queue->insert_count - tx_queue->read_count;
                 if (fill_level < EFX_TXQ_THRESHOLD(efx)) {
                         EFX_BUG_ON_PARANOID(!efx_dev_registered(efx));
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index cb317cd069ff..484f795a779d 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -240,7 +240,8 @@ static const struct ethtool_ops sis900_ethtool_ops;
  *      @net_dev: the net device to get address for
  *
  *      Older SiS900 and friends, use EEPROM to store MAC address.
- *      MAC address is read from read_eeprom() into @net_dev->dev_addr.
+ *      MAC address is read from read_eeprom() into @net_dev->dev_addr and
+ *      @net_dev->perm_addr.
  */
 
 static int __devinit sis900_get_mac_addr(struct pci_dev * pci_dev, struct net_device *net_dev)
@@ -261,6 +262,9 @@ static int __devinit sis900_get_mac_addr(struct pci_dev * pci_dev, struct net_de
         for (i = 0; i < 3; i++)
                 ((u16 *)(net_dev->dev_addr))[i] = read_eeprom(ioaddr, i+EEPROMMACAddr);
 
+        /* Store MAC Address in perm_addr */
+        memcpy(net_dev->perm_addr, net_dev->dev_addr, ETH_ALEN);
+
         return 1;
 }
 
@@ -271,7 +275,8 @@ static int __devinit sis900_get_mac_addr(struct pci_dev * pci_dev, struct net_de
  *
  *      SiS630E model, use APC CMOS RAM to store MAC address.
  *      APC CMOS RAM is accessed through ISA bridge.
- *      MAC address is read into @net_dev->dev_addr.
+ *      MAC address is read into @net_dev->dev_addr and
+ *      @net_dev->perm_addr.
  */
 
 static int __devinit sis630e_get_mac_addr(struct pci_dev * pci_dev,
@@ -296,6 +301,10 @@ static int __devinit sis630e_get_mac_addr(struct pci_dev * pci_dev,
                 outb(0x09 + i, 0x70);
                 ((u8 *)(net_dev->dev_addr))[i] = inb(0x71);
         }
+
+        /* Store MAC Address in perm_addr */
+        memcpy(net_dev->perm_addr, net_dev->dev_addr, ETH_ALEN);
+
         pci_write_config_byte(isa_bridge, 0x48, reg & ~0x40);
         pci_dev_put(isa_bridge);
 
@@ -310,7 +319,7 @@ static int __devinit sis630e_get_mac_addr(struct pci_dev * pci_dev,
  *
  *      SiS635 model, set MAC Reload Bit to load Mac address from APC
  *      to rfdr. rfdr is accessed through rfcr. MAC address is read into
- *      @net_dev->dev_addr.
+ *      @net_dev->dev_addr and @net_dev->perm_addr.
  */
 
 static int __devinit sis635_get_mac_addr(struct pci_dev * pci_dev,
@@ -334,6 +343,9 @@ static int __devinit sis635_get_mac_addr(struct pci_dev * pci_dev,
                 *( ((u16 *)net_dev->dev_addr) + i) = inw(ioaddr + rfdr);
         }
 
+        /* Store MAC Address in perm_addr */
+        memcpy(net_dev->perm_addr, net_dev->dev_addr, ETH_ALEN);
+
         /* enable packet filtering */
         outl(rfcrSave | RFEN, rfcr + ioaddr);
 
@@ -353,7 +365,7 @@ static int __devinit sis635_get_mac_addr(struct pci_dev * pci_dev,
  *      EEDONE signal to refuse EEPROM access by LAN.
  *      The EEPROM map of SiS962 or SiS963 is different to SiS900.
  *      The signature field in SiS962 or SiS963 spec is meaningless.
- *      MAC address is read into @net_dev->dev_addr.
+ *      MAC address is read into @net_dev->dev_addr and @net_dev->perm_addr.
  */
 
 static int __devinit sis96x_get_mac_addr(struct pci_dev * pci_dev,
@@ -372,6 +384,9 @@ static int __devinit sis96x_get_mac_addr(struct pci_dev * pci_dev,
                         for (i = 0; i < 3; i++)
                                 ((u16 *)(net_dev->dev_addr))[i] = read_eeprom(ioaddr, i+EEPROMMACAddr);
 
+                        /* Store MAC Address in perm_addr */
+                        memcpy(net_dev->perm_addr, net_dev->dev_addr, ETH_ALEN);
+
                         outl(EEDONE, ee_addr);
                         return 1;
                 } else {
diff --git a/drivers/net/stmmac/dwmac_lib.c b/drivers/net/stmmac/dwmac_lib.c
index d65fab1ba790..e25093510b0c 100644
--- a/drivers/net/stmmac/dwmac_lib.c
+++ b/drivers/net/stmmac/dwmac_lib.c
@@ -26,9 +26,9 @@
 
 #undef DWMAC_DMA_DEBUG
 #ifdef DWMAC_DMA_DEBUG
-#define DBG(fmt, args...)  printk(fmt, ## args)
+#define DWMAC_LIB_DBG(fmt, args...)  printk(fmt, ## args)
 #else
-#define DBG(fmt, args...)  do { } while (0)
+#define DWMAC_LIB_DBG(fmt, args...)  do { } while (0)
 #endif
 
 /* CSR1 enables the transmit DMA to check for new descriptor */
@@ -152,7 +152,7 @@ int dwmac_dma_interrupt(void __iomem *ioaddr,
         /* read the status register (CSR5) */
         u32 intr_status = readl(ioaddr + DMA_STATUS);
 
-        DBG(INFO, "%s: [CSR5: 0x%08x]\n", __func__, intr_status);
+        DWMAC_LIB_DBG(KERN_INFO "%s: [CSR5: 0x%08x]\n", __func__, intr_status);
 #ifdef DWMAC_DMA_DEBUG
         /* It displays the DMA process states (CSR5 register) */
         show_tx_process_state(intr_status);
@@ -160,43 +160,43 @@ int dwmac_dma_interrupt(void __iomem *ioaddr,
 #endif
         /* ABNORMAL interrupts */
         if (unlikely(intr_status & DMA_STATUS_AIS)) {
-                DBG(INFO, "CSR5[15] DMA ABNORMAL IRQ: ");
+                DWMAC_LIB_DBG(KERN_INFO "CSR5[15] DMA ABNORMAL IRQ: ");
                 if (unlikely(intr_status & DMA_STATUS_UNF)) {
-                        DBG(INFO, "transmit underflow\n");
+                        DWMAC_LIB_DBG(KERN_INFO "transmit underflow\n");
                         ret = tx_hard_error_bump_tc;
                         x->tx_undeflow_irq++;
                 }
                 if (unlikely(intr_status & DMA_STATUS_TJT)) {
-                        DBG(INFO, "transmit jabber\n");
+                        DWMAC_LIB_DBG(KERN_INFO "transmit jabber\n");
                         x->tx_jabber_irq++;
                 }
                 if (unlikely(intr_status & DMA_STATUS_OVF)) {
-                        DBG(INFO, "recv overflow\n");
+                        DWMAC_LIB_DBG(KERN_INFO "recv overflow\n");
                         x->rx_overflow_irq++;
                 }
                 if (unlikely(intr_status & DMA_STATUS_RU)) {
-                        DBG(INFO, "receive buffer unavailable\n");
+                        DWMAC_LIB_DBG(KERN_INFO "receive buffer unavailable\n");
                         x->rx_buf_unav_irq++;
                 }
                 if (unlikely(intr_status & DMA_STATUS_RPS)) {
-                        DBG(INFO, "receive process stopped\n");
+                        DWMAC_LIB_DBG(KERN_INFO "receive process stopped\n");
                         x->rx_process_stopped_irq++;
                 }
                 if (unlikely(intr_status & DMA_STATUS_RWT)) {
-                        DBG(INFO, "receive watchdog\n");
+                        DWMAC_LIB_DBG(KERN_INFO "receive watchdog\n");
                         x->rx_watchdog_irq++;
                 }
                 if (unlikely(intr_status & DMA_STATUS_ETI)) {
-                        DBG(INFO, "transmit early interrupt\n");
+                        DWMAC_LIB_DBG(KERN_INFO "transmit early interrupt\n");
                         x->tx_early_irq++;
                 }
                 if (unlikely(intr_status & DMA_STATUS_TPS)) {
-                        DBG(INFO, "transmit process stopped\n");
+                        DWMAC_LIB_DBG(KERN_INFO "transmit process stopped\n");
                         x->tx_process_stopped_irq++;
                         ret = tx_hard_error;
                 }
                 if (unlikely(intr_status & DMA_STATUS_FBI)) {
-                        DBG(INFO, "fatal bus error\n");
+                        DWMAC_LIB_DBG(KERN_INFO "fatal bus error\n");
                         x->fatal_bus_error_irq++;
                         ret = tx_hard_error;
                 }
@@ -215,7 +215,7 @@ int dwmac_dma_interrupt(void __iomem *ioaddr,
         /* Clear the interrupt by writing a logic 1 to the CSR5[15-0] */
         writel((intr_status & 0x1ffff), ioaddr + DMA_STATUS);
 
-        DBG(INFO, "\n\n");
+        DWMAC_LIB_DBG(KERN_INFO "\n\n");
         return ret;
 }
 
diff --git a/drivers/net/stmmac/stmmac_main.c b/drivers/net/stmmac/stmmac_main.c
index 0e5f03135b50..cc973fc38405 100644
--- a/drivers/net/stmmac/stmmac_main.c
+++ b/drivers/net/stmmac/stmmac_main.c
@@ -750,7 +750,6 @@ static void stmmac_dma_interrupt(struct stmmac_priv *priv)
                         priv->hw->dma->dma_mode(priv->ioaddr, tc, SF_DMA_MODE);
                         priv->xstats.threshold = tc;
                 }
-                stmmac_tx_err(priv);
         } else if (unlikely(status == tx_hard_error))
                 stmmac_tx_err(priv);
 }
@@ -781,21 +780,6 @@ static int stmmac_open(struct net_device *dev)
 
         stmmac_verify_args();
 
-        ret = stmmac_init_phy(dev);
-        if (unlikely(ret)) {
-                pr_err("%s: Cannot attach to PHY (error: %d)\n", __func__, ret);
-                return ret;
-        }
-
-        /* Request the IRQ lines */
-        ret = request_irq(dev->irq, stmmac_interrupt,
-                          IRQF_SHARED, dev->name, dev);
-        if (unlikely(ret < 0)) {
-                pr_err("%s: ERROR: allocating the IRQ %d (error: %d)\n",
-                       __func__, dev->irq, ret);
-                return ret;
-        }
-
 #ifdef CONFIG_STMMAC_TIMER
         priv->tm = kzalloc(sizeof(struct stmmac_timer *), GFP_KERNEL);
         if (unlikely(priv->tm == NULL)) {
@@ -814,6 +798,11 @@ static int stmmac_open(struct net_device *dev)
         } else
                 priv->tm->enable = 1;
 #endif
+        ret = stmmac_init_phy(dev);
+        if (unlikely(ret)) {
+                pr_err("%s: Cannot attach to PHY (error: %d)\n", __func__, ret);
+                goto open_error;
+        }
 
         /* Create and initialize the TX/RX descriptors chains. */
         priv->dma_tx_size = STMMAC_ALIGN(dma_txsize);
@@ -822,12 +811,11 @@ static int stmmac_open(struct net_device *dev)
         init_dma_desc_rings(dev);
 
         /* DMA initialization and SW reset */
-        if (unlikely(priv->hw->dma->init(priv->ioaddr, priv->plat->pbl,
-                                         priv->dma_tx_phy,
-                                         priv->dma_rx_phy) < 0)) {
-
+        ret = priv->hw->dma->init(priv->ioaddr, priv->plat->pbl,
+                                  priv->dma_tx_phy, priv->dma_rx_phy);
+        if (ret < 0) {
                 pr_err("%s: DMA initialization failed\n", __func__);
-                return -1;
+                goto open_error;
         }
 
         /* Copy the MAC addr into the HW  */
@@ -848,6 +836,15 @@ static int stmmac_open(struct net_device *dev)
         writel(0xffffffff, priv->ioaddr + MMC_HIGH_INTR_MASK);
         writel(0xffffffff, priv->ioaddr + MMC_LOW_INTR_MASK);
 
+        /* Request the IRQ lines */
+        ret = request_irq(dev->irq, stmmac_interrupt,
+                         IRQF_SHARED, dev->name, dev);
+        if (unlikely(ret < 0)) {
+                pr_err("%s: ERROR: allocating the IRQ %d (error: %d)\n",
+                       __func__, dev->irq, ret);
+                goto open_error;
+        }
+
         /* Enable the MAC Rx/Tx */
         stmmac_enable_mac(priv->ioaddr);
 
@@ -878,7 +875,17 @@ static int stmmac_open(struct net_device *dev)
         napi_enable(&priv->napi);
         skb_queue_head_init(&priv->rx_recycle);
         netif_start_queue(dev);
+
         return 0;
+
+open_error:
+#ifdef CONFIG_STMMAC_TIMER
+        kfree(priv->tm);
+#endif
+        if (priv->phydev)
+                phy_disconnect(priv->phydev);
+
+        return ret;
 }
 
 /**
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index b8c5f35577e4..7a5daefb6f33 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -12327,8 +12327,10 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
                 if (val & VCPU_CFGSHDW_ASPM_DBNC)
                         tp->tg3_flags |= TG3_FLAG_ASPM_WORKAROUND;
                 if ((val & VCPU_CFGSHDW_WOL_ENABLE) &&
-                    (val & VCPU_CFGSHDW_WOL_MAGPKT))
+                    (val & VCPU_CFGSHDW_WOL_MAGPKT)) {
                         tp->tg3_flags |= TG3_FLAG_WOL_ENABLE;
+                        device_set_wakeup_enable(&tp->pdev->dev, true);
+                }
                 goto done;
         }
 
@@ -12461,8 +12463,10 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
                         tp->tg3_flags &= ~TG3_FLAG_WOL_CAP;
 
                 if ((tp->tg3_flags & TG3_FLAG_WOL_CAP) &&
-                    (nic_cfg & NIC_SRAM_DATA_CFG_WOL_ENABLE))
+                    (nic_cfg & NIC_SRAM_DATA_CFG_WOL_ENABLE)) {
                         tp->tg3_flags |= TG3_FLAG_WOL_ENABLE;
+                        device_set_wakeup_enable(&tp->pdev->dev, true);
+                }
 
                 if (cfg2 & (1 << 17))
                         tp->phy_flags |= TG3_PHYFLG_CAPACITIVE_COUPLING;
diff --git a/drivers/net/tokenring/3c359.c b/drivers/net/tokenring/3c359.c
index 8a3b191b195b..ff32befd8443 100644
--- a/drivers/net/tokenring/3c359.c
+++ b/drivers/net/tokenring/3c359.c
@@ -1251,7 +1251,7 @@ static netdev_tx_t xl_xmit(struct sk_buff *skb, struct net_device *dev)
 /* 
  * The NIC has told us that a packet has been downloaded onto the card, we must
  * find out which packet it has done, clear the skb and information for the packet
- * then advance around the ring for all tranmitted packets
+ * then advance around the ring for all transmitted packets
  */
 
 static void xl_dn_comp(struct net_device *dev) 
@@ -1568,7 +1568,7 @@ static void xl_arb_cmd(struct net_device *dev)
                         if (lan_status_diff & LSC_SOFT_ERR)
                                         printk(KERN_WARNING "%s: Adapter transmitted Soft Error Report Mac Frame\n",dev->name);
                         if (lan_status_diff & LSC_TRAN_BCN) 
-                                        printk(KERN_INFO "%s: We are tranmitting the beacon, aaah\n",dev->name);
+                                        printk(KERN_INFO "%s: We are transmitting the beacon, aaah\n",dev->name);
                         if (lan_status_diff & LSC_SS) 
                                         printk(KERN_INFO "%s: Single Station on the ring\n", dev->name);
                         if (lan_status_diff & LSC_RING_REC)
diff --git a/drivers/net/tokenring/lanstreamer.c b/drivers/net/tokenring/lanstreamer.c
index 5bd140704533..9354ca9da576 100644
--- a/drivers/net/tokenring/lanstreamer.c
+++ b/drivers/net/tokenring/lanstreamer.c
@@ -1675,7 +1675,7 @@ drop_frame:
                         if (lan_status_diff & LSC_SOFT_ERR)
                                 printk(KERN_WARNING "%s: Adapter transmitted Soft Error Report Mac Frame\n", dev->name);
                         if (lan_status_diff & LSC_TRAN_BCN)
-                                printk(KERN_INFO "%s: We are tranmitting the beacon, aaah\n", dev->name);
+                                printk(KERN_INFO "%s: We are transmitting the beacon, aaah\n", dev->name);
                         if (lan_status_diff & LSC_SS)
                                 printk(KERN_INFO "%s: Single Station on the ring\n", dev->name);
                         if (lan_status_diff & LSC_RING_REC)
diff --git a/drivers/net/tokenring/olympic.c b/drivers/net/tokenring/olympic.c
index 3d2fbe60b46e..2684003b8ab6 100644
--- a/drivers/net/tokenring/olympic.c
+++ b/drivers/net/tokenring/olympic.c
@@ -1500,7 +1500,7 @@ drop_frame:
                         if (lan_status_diff & LSC_SOFT_ERR)
                                         printk(KERN_WARNING "%s: Adapter transmitted Soft Error Report Mac Frame\n",dev->name);
                         if (lan_status_diff & LSC_TRAN_BCN) 
-                                        printk(KERN_INFO "%s: We are tranmitting the beacon, aaah\n",dev->name);
+                                        printk(KERN_INFO "%s: We are transmitting the beacon, aaah\n",dev->name);
                         if (lan_status_diff & LSC_SS) 
                                         printk(KERN_INFO "%s: Single Station on the ring\n", dev->name);
                         if (lan_status_diff & LSC_RING_REC)
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 341f7056a800..a301479ecc60 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -460,7 +460,7 @@ static const struct driver_info	cdc_info = {
         .manage_power = cdc_manage_power,
 };
 
-static const struct driver_info mbm_info = {
+static const struct driver_info wwan_info = {
         .description =  "Mobile Broadband Network Device",
         .flags =        FLAG_WWAN,
         .bind =         usbnet_cdc_bind,
@@ -471,6 +471,7 @@ static const struct driver_info mbm_info = {
 
 /*-------------------------------------------------------------------------*/
 
+#define HUAWEI_VENDOR_ID        0x12D1
 
 static const struct usb_device_id       products [] = {
 /*
@@ -587,8 +588,17 @@ static const struct usb_device_id	products [] = {
 }, {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
                         USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long)&mbm_info,
+        .driver_info = (unsigned long)&wwan_info,
 
+}, {
+        /* Various Huawei modems with a network port like the UMG1831 */
+        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+                 | USB_DEVICE_ID_MATCH_INT_INFO,
+        .idVendor               = HUAWEI_VENDOR_ID,
+        .bInterfaceClass        = USB_CLASS_COMM,
+        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
+        .bInterfaceProtocol     = 255,
+        .driver_info = (unsigned long)&wwan_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 967371f04454..1033ef6476a4 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -54,13 +54,13 @@
 #include <linux/usb/usbnet.h>
 #include <linux/usb/cdc.h>
 
-#define DRIVER_VERSION                          "7-Feb-2011"
+#define DRIVER_VERSION                          "23-Apr-2011"
 
 /* CDC NCM subclass 3.2.1 */
 #define USB_CDC_NCM_NDP16_LENGTH_MIN            0x10
 
 /* Maximum NTB length */
-#define CDC_NCM_NTB_MAX_SIZE_TX                 16384   /* bytes */
+#define CDC_NCM_NTB_MAX_SIZE_TX                 (16384 + 4) /* bytes, must be short terminated */
 #define CDC_NCM_NTB_MAX_SIZE_RX                 16384   /* bytes */
 
 /* Minimum value for MaxDatagramSize, ch. 6.2.9 */
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 47a6c870b51f..48d4efdb4959 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -730,7 +730,7 @@ static int smsc95xx_phy_initialize(struct usbnet *dev)
                 msleep(10);
                 bmcr = smsc95xx_mdio_read(dev->net, dev->mii.phy_id, MII_BMCR);
                 timeout++;
-        } while ((bmcr & MII_BMCR) && (timeout < 100));
+        } while ((bmcr & BMCR_RESET) && (timeout < 100));
 
         if (timeout >= 100) {
                 netdev_warn(dev->net, "timeout on PHY Reset");
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 069c1cf0fdf7..009bba3d753e 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -736,6 +736,7 @@ int usbnet_open (struct net_device *net)
                 }
         }
 
+        set_bit(EVENT_DEV_OPEN, &dev->flags);
         netif_start_queue (net);
         netif_info(dev, ifup, dev->net,
                    "open: enable queueing (rx %d, tx %d) mtu %d %s framing\n",
@@ -1259,6 +1260,9 @@ void usbnet_disconnect (struct usb_interface *intf)
         if (dev->driver_info->unbind)
                 dev->driver_info->unbind (dev, intf);
 
+        usb_kill_urb(dev->interrupt);
+        usb_free_urb(dev->interrupt);
+
         free_netdev(net);
         usb_put_dev (xdev);
 }
@@ -1498,6 +1502,10 @@ int usbnet_resume (struct usb_interface *intf)
         int                     retval;
 
         if (!--dev->suspend_count) {
+                /* resume interrupt URBs */
+                if (dev->interrupt && test_bit(EVENT_DEV_OPEN, &dev->flags))
+                        usb_submit_urb(dev->interrupt, GFP_NOIO);
+
                 spin_lock_irq(&dev->txq.lock);
                 while ((res = usb_get_from_anchor(&dev->deferred))) {
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 2de9b90c5f8f..3b99f64104fd 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -403,6 +403,17 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,
         if (tb[IFLA_ADDRESS] == NULL)
                 random_ether_addr(dev->dev_addr);
 
+        if (tb[IFLA_IFNAME])
+                nla_strlcpy(dev->name, tb[IFLA_IFNAME], IFNAMSIZ);
+        else
+                snprintf(dev->name, IFNAMSIZ, DRV_NAME "%%d");
+
+        if (strchr(dev->name, '%')) {
+                err = dev_alloc_name(dev, dev->name);
+                if (err < 0)
+                        goto err_alloc_name;
+        }
+
         err = register_netdevice(dev);
         if (err < 0)
                 goto err_register_dev;
@@ -422,6 +433,7 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,
 
 err_register_dev:
         /* nothing to do */
+err_alloc_name:
 err_configure_peer:
         unregister_netdevice(peer);
         return err;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index f1b8af64569c..2d10239ce829 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1040,7 +1040,7 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
         }
 
         ret = ath9k_htc_hw_init(hif_dev->htc_handle,
-                                &hif_dev->udev->dev, hif_dev->device_id,
+                                &interface->dev, hif_dev->device_id,
                                 hif_dev->udev->product, id->driver_info);
         if (ret) {
                 ret = -EINVAL;
@@ -1158,7 +1158,7 @@ fail_resume:
 #endif
 
 static struct usb_driver ath9k_hif_usb_driver = {
-        .name = "ath9k_hif_usb",
+        .name = KBUILD_MODNAME,
         .probe = ath9k_hif_usb_probe,
         .disconnect = ath9k_hif_usb_disconnect,
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 1ec9bcd6b281..c95bc5cc1a1f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1254,15 +1254,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         ah->txchainmask = common->tx_chainmask;
         ah->rxchainmask = common->rx_chainmask;
 
-        if ((common->bus_ops->ath_bus_type != ATH_USB) && !ah->chip_fullsleep) {
-                ath9k_hw_abortpcurecv(ah);
-                if (!ath9k_hw_stopdmarecv(ah)) {
-                        ath_dbg(common, ATH_DBG_XMIT,
-                                "Failed to stop receive dma\n");
-                        bChannelChange = false;
-                }
-        }
-
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
                 return -EIO;
 
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 562257ac52cf..edc1cbbfecaf 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -751,28 +751,47 @@ void ath9k_hw_abortpcurecv(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_abortpcurecv);
 
-bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
+bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset)
 {
 #define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
 #define AH_RX_TIME_QUANTUM     100     /* usec */
         struct ath_common *common = ath9k_hw_common(ah);
+        u32 mac_status, last_mac_status = 0;
         int i;
 
+        /* Enable access to the DMA observation bus */
+        REG_WRITE(ah, AR_MACMISC,
+                  ((AR_MACMISC_DMA_OBS_LINE_8 << AR_MACMISC_DMA_OBS_S) |
+                   (AR_MACMISC_MISC_OBS_BUS_1 <<
+                    AR_MACMISC_MISC_OBS_BUS_MSB_S)));
+
         REG_WRITE(ah, AR_CR, AR_CR_RXD);
 
         /* Wait for rx enable bit to go low */
         for (i = AH_RX_STOP_DMA_TIMEOUT / AH_TIME_QUANTUM; i != 0; i--) {
                 if ((REG_READ(ah, AR_CR) & AR_CR_RXE) == 0)
                         break;
+
+                if (!AR_SREV_9300_20_OR_LATER(ah)) {
+                        mac_status = REG_READ(ah, AR_DMADBG_7) & 0x7f0;
+                        if (mac_status == 0x1c0 && mac_status == last_mac_status) {
+                                *reset = true;
+                                break;
+                        }
+
+                        last_mac_status = mac_status;
+                }
+
                 udelay(AH_TIME_QUANTUM);
         }
 
         if (i == 0) {
                 ath_err(common,
-                        "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
+                        "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x DMADBG_7=0x%08x\n",
                         AH_RX_STOP_DMA_TIMEOUT / 1000,
                         REG_READ(ah, AR_CR),
-                        REG_READ(ah, AR_DIAG_SW));
+                        REG_READ(ah, AR_DIAG_SW),
+                        REG_READ(ah, AR_DMADBG_7));
                 return false;
         } else {
                 return true;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index b2b2ff852c32..c2a59386fb9c 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -695,7 +695,7 @@ bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set);
 void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp);
 void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning);
 void ath9k_hw_abortpcurecv(struct ath_hw *ah);
-bool ath9k_hw_stopdmarecv(struct ath_hw *ah);
+bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset);
 int ath9k_hw_beaconq_setup(struct ath_hw *ah);
 
 /* Interrupt Handling */
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index dddb85de622d..17d04ff8d678 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1376,7 +1376,6 @@ static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
 
         ath9k_calculate_iter_data(hw, vif, &iter_data);
 
-        ath9k_ps_wakeup(sc);
         /* Set BSSID mask. */
         memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
         ath_hw_setbssidmask(common);
@@ -1411,7 +1410,6 @@ static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
         }
 
         ath9k_hw_set_interrupts(ah, ah->imask);
-        ath9k_ps_restore(sc);
 
         /* Set up ANI */
         if ((iter_data.naps + iter_data.nadhocs) > 0) {
@@ -1457,6 +1455,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         struct ath_vif *avp = (void *)vif->drv_priv;
         int ret = 0;
 
+        ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
 
         switch (vif->type) {
@@ -1503,6 +1502,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         ath9k_do_vif_add_setup(hw, vif);
 out:
         mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
         return ret;
 }
 
@@ -1517,6 +1517,7 @@ static int ath9k_change_interface(struct ieee80211_hw *hw,
 
         ath_dbg(common, ATH_DBG_CONFIG, "Change Interface\n");
         mutex_lock(&sc->mutex);
+        ath9k_ps_wakeup(sc);
 
         /* See if new interface type is valid. */
         if ((new_type == NL80211_IFTYPE_ADHOC) &&
@@ -1546,6 +1547,7 @@ static int ath9k_change_interface(struct ieee80211_hw *hw,
 
         ath9k_do_vif_add_setup(hw, vif);
 out:
+        ath9k_ps_restore(sc);
         mutex_unlock(&sc->mutex);
         return ret;
 }
@@ -1558,6 +1560,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 
         ath_dbg(common, ATH_DBG_CONFIG, "Detach Interface\n");
 
+        ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
 
         sc->nvifs--;
@@ -1569,6 +1572,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         ath9k_calculate_summary_state(hw, NULL);
 
         mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
 }
 
 static void ath9k_enable_ps(struct ath_softc *sc)
@@ -1809,6 +1813,7 @@ static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
 
         txq = sc->tx.txq_map[queue];
 
+        ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
 
         memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
@@ -1832,6 +1837,7 @@ static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
                         ath_beaconq_config(sc);
 
         mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
 
         return ret;
 }
@@ -1894,6 +1900,7 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
         int slottime;
         int error;
 
+        ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
 
         if (changed & BSS_CHANGED_BSSID) {
@@ -1994,6 +2001,7 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
 }
 
 static u64 ath9k_get_tsf(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a9c3f4672aa0..b29c80def35e 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -486,12 +486,12 @@ start_recv:
 bool ath_stoprecv(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
-        bool stopped;
+        bool stopped, reset = false;
 
         spin_lock_bh(&sc->rx.rxbuflock);
         ath9k_hw_abortpcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
-        stopped = ath9k_hw_stopdmarecv(ah);
+        stopped = ath9k_hw_stopdmarecv(ah, &reset);
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 ath_edma_stop_recv(sc);
@@ -506,7 +506,7 @@ bool ath_stoprecv(struct ath_softc *sc)
                         "confusing the DMA engine when we start RX up\n");
                 ATH_DBG_WARN_ON_ONCE(!stopped);
         }
-        return stopped;
+        return stopped && !reset;
 }
 
 void ath_flushrecv(struct ath_softc *sc)
diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
index 248c670fdfbe..5c2cfe694152 100644
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
         {APL9_WORLD, CTL_ETSI, CTL_ETSI},
 
         {APL3_FCCA, CTL_FCC, CTL_FCC},
+        {APL7_FCCA, CTL_FCC, CTL_FCC},
         {APL1_ETSIC, CTL_FCC, CTL_ETSI},
         {APL2_ETSIC, CTL_FCC, CTL_ETSI},
         {APL2_APLD, CTL_FCC, NO_CTL},
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index d59b0168c14a..5af40d9170a0 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -72,6 +72,7 @@ MODULE_FIRMWARE("b43/ucode11.fw");
 MODULE_FIRMWARE("b43/ucode13.fw");
 MODULE_FIRMWARE("b43/ucode14.fw");
 MODULE_FIRMWARE("b43/ucode15.fw");
+MODULE_FIRMWARE("b43/ucode16_mimo.fw");
 MODULE_FIRMWARE("b43/ucode5.fw");
 MODULE_FIRMWARE("b43/ucode9.fw");
 
diff --git a/drivers/net/wireless/iwlegacy/Kconfig b/drivers/net/wireless/iwlegacy/Kconfig
index 2a45dd44cc12..aef65cd47661 100644
--- a/drivers/net/wireless/iwlegacy/Kconfig
+++ b/drivers/net/wireless/iwlegacy/Kconfig
@@ -1,6 +1,5 @@
 config IWLWIFI_LEGACY
-        tristate "Intel Wireless Wifi legacy devices"
-        depends on PCI && MAC80211
+        tristate
         select FW_LOADER
         select NEW_LEDS
         select LEDS_CLASS
@@ -65,7 +64,8 @@ endmenu
 
 config IWL4965
         tristate "Intel Wireless WiFi 4965AGN (iwl4965)"
-        depends on IWLWIFI_LEGACY
+        depends on PCI && MAC80211
+        select IWLWIFI_LEGACY
         ---help---
           This option enables support for
 
@@ -92,7 +92,8 @@ config IWL4965
 
 config IWL3945
         tristate "Intel PRO/Wireless 3945ABG/BG Network Connection (iwl3945)"
-        depends on IWLWIFI_LEGACY
+        depends on PCI && MAC80211
+        select IWLWIFI_LEGACY
         ---help---
           Select to build the driver supporting the:
 
diff --git a/drivers/net/wireless/iwlegacy/iwl-3945-hw.h b/drivers/net/wireless/iwlegacy/iwl-3945-hw.h
index 779d3cb86e2c..5c3a68d3af12 100644
--- a/drivers/net/wireless/iwlegacy/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlegacy/iwl-3945-hw.h
@@ -74,8 +74,6 @@
 /* RSSI to dBm */
 #define IWL39_RSSI_OFFSET       95
 
-#define IWL_DEFAULT_TX_POWER    0x0F
-
 /*
  * EEPROM related constants, enums, and structures.
  */
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-hw.h b/drivers/net/wireless/iwlegacy/iwl-4965-hw.h
index 08b189c8472d..fc6fa2886d9c 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlegacy/iwl-4965-hw.h
@@ -804,9 +804,6 @@ struct iwl4965_scd_bc_tbl {
 
 #define IWL4965_DEFAULT_TX_RETRY  15
 
-/* Limit range of txpower output target to be between these values */
-#define IWL4965_TX_POWER_TARGET_POWER_MIN       (0)     /* 0 dBm: 1 milliwatt */
-
 /* EEPROM */
 #define IWL4965_FIRST_AMPDU_QUEUE       10
 
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-tx.c b/drivers/net/wireless/iwlegacy/iwl-4965-tx.c
index 5c40502f869a..79ac081832fb 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965-tx.c
+++ b/drivers/net/wireless/iwlegacy/iwl-4965-tx.c
@@ -316,12 +316,18 @@ int iwl4965_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         hdr_len = ieee80211_hdrlen(fc);
 
-        /* Find index into station table for destination station */
-        sta_id = iwl_legacy_sta_id_or_broadcast(priv, ctx, info->control.sta);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
-                               hdr->addr1);
-                goto drop_unlock;
+        /* For management frames use broadcast id to do not break aggregation */
+        if (!ieee80211_is_data(fc))
+                sta_id = ctx->bcast_sta_id;
+        else {
+                /* Find index into station table for destination station */
+                sta_id = iwl_legacy_sta_id_or_broadcast(priv, ctx, info->control.sta);
+
+                if (sta_id == IWL_INVALID_STATION) {
+                        IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
+                                       hdr->addr1);
+                        goto drop_unlock;
+                }
         }
 
         IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -1127,12 +1133,16 @@ int iwl4965_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
              q->read_ptr = iwl_legacy_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 tx_info = &txq->txb[txq->q.read_ptr];
-                iwl4965_tx_status(priv, tx_info,
-                                 txq_id >= IWL4965_FIRST_AMPDU_QUEUE);
+
+                if (WARN_ON_ONCE(tx_info->skb == NULL))
+                        continue;
 
                 hdr = (struct ieee80211_hdr *)tx_info->skb->data;
-                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                if (ieee80211_is_data_qos(hdr->frame_control))
                         nfreed++;
+
+                iwl4965_tx_status(priv, tx_info,
+                                 txq_id >= IWL4965_FIRST_AMPDU_QUEUE);
                 tx_info->skb = NULL;
 
                 priv->cfg->ops->lib->txq_free_tfd(priv, txq);
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index 7007d61bb6b5..c1511b14b239 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -160,6 +160,7 @@ int iwl_legacy_init_geos(struct iwl_priv *priv)
         struct ieee80211_channel *geo_ch;
         struct ieee80211_rate *rates;
         int i = 0;
+        s8 max_tx_power = 0;
 
         if (priv->bands[IEEE80211_BAND_2GHZ].n_bitrates ||
             priv->bands[IEEE80211_BAND_5GHZ].n_bitrates) {
@@ -235,8 +236,8 @@ int iwl_legacy_init_geos(struct iwl_priv *priv)
 
                         geo_ch->flags |= ch->ht40_extension_channel;
 
-                        if (ch->max_power_avg > priv->tx_power_device_lmt)
-                                priv->tx_power_device_lmt = ch->max_power_avg;
+                        if (ch->max_power_avg > max_tx_power)
+                                max_tx_power = ch->max_power_avg;
                 } else {
                         geo_ch->flags |= IEEE80211_CHAN_DISABLED;
                 }
@@ -249,6 +250,10 @@ int iwl_legacy_init_geos(struct iwl_priv *priv)
                                  geo_ch->flags);
         }
 
+        priv->tx_power_device_lmt = max_tx_power;
+        priv->tx_power_user_lmt = max_tx_power;
+        priv->tx_power_next = max_tx_power;
+
         if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) &&
              priv->cfg->sku & IWL_SKU_A) {
                 IWL_INFO(priv, "Incorrectly detected BG card as ABG. "
@@ -1124,11 +1129,11 @@ int iwl_legacy_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
         if (!priv->cfg->ops->lib->send_tx_power)
                 return -EOPNOTSUPP;
 
-        if (tx_power < IWL4965_TX_POWER_TARGET_POWER_MIN) {
+        /* 0 dBm mean 1 milliwatt */
+        if (tx_power < 0) {
                 IWL_WARN(priv,
-                         "Requested user TXPOWER %d below lower limit %d.\n",
-                         tx_power,
-                         IWL4965_TX_POWER_TARGET_POWER_MIN);
+                         "Requested user TXPOWER %d below 1 mW.\n",
+                         tx_power);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/wireless/iwlegacy/iwl-eeprom.c b/drivers/net/wireless/iwlegacy/iwl-eeprom.c
index 04c5648027df..cb346d1a9ffa 100644
--- a/drivers/net/wireless/iwlegacy/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlegacy/iwl-eeprom.c
@@ -471,13 +471,6 @@ int iwl_legacy_init_channel_map(struct iwl_priv *priv)
                                              flags & EEPROM_CHANNEL_RADAR))
                                        ? "" : "not ");
 
-                        /* Set the tx_power_user_lmt to the highest power
-                         * supported by any channel */
-                        if (eeprom_ch_info[ch].max_power_avg >
-                                                priv->tx_power_user_lmt)
-                                priv->tx_power_user_lmt =
-                                    eeprom_ch_info[ch].max_power_avg;
-
                         ch_info++;
                 }
         }
diff --git a/drivers/net/wireless/iwlegacy/iwl-led.c b/drivers/net/wireless/iwlegacy/iwl-led.c
index 15eb8b707157..bda0d61b2c0d 100644
--- a/drivers/net/wireless/iwlegacy/iwl-led.c
+++ b/drivers/net/wireless/iwlegacy/iwl-led.c
@@ -48,8 +48,21 @@ module_param(led_mode, int, S_IRUGO);
 MODULE_PARM_DESC(led_mode, "0=system default, "
                 "1=On(RF On)/Off(RF Off), 2=blinking");
 
+/* Throughput           OFF time(ms)    ON time (ms)
+ *      >300                    25              25
+ *      >200 to 300             40              40
+ *      >100 to 200             55              55
+ *      >70 to 100              65              65
+ *      >50 to 70               75              75
+ *      >20 to 50               85              85
+ *      >10 to 20               95              95
+ *      >5 to 10                110             110
+ *      >1 to 5                 130             130
+ *      >0 to 1                 167             167
+ *      <=0                                     SOLID ON
+ */
 static const struct ieee80211_tpt_blink iwl_blink[] = {
-        { .throughput = 0 * 1024 - 1, .blink_time = 334 },
+        { .throughput = 0, .blink_time = 334 },
         { .throughput = 1 * 1024 - 1, .blink_time = 260 },
         { .throughput = 5 * 1024 - 1, .blink_time = 220 },
         { .throughput = 10 * 1024 - 1, .blink_time = 190 },
@@ -101,6 +114,11 @@ static int iwl_legacy_led_cmd(struct iwl_priv *priv,
         if (priv->blink_on == on && priv->blink_off == off)
                 return 0;
 
+        if (off == 0) {
+                /* led is SOLID_ON */
+                on = IWL_LED_SOLID;
+        }
+
         IWL_DEBUG_LED(priv, "Led blink time compensation=%u\n",
                         priv->cfg->base_params->led_compensation);
         led_cmd.on = iwl_legacy_blink_compensation(priv, on,
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index 28eb3d885ba1..cc7ebcee60e5 100644
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -3825,10 +3825,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         priv->force_reset[IWL_FW_RESET].reset_duration =
                 IWL_DELAY_NEXT_FORCE_FW_RELOAD;
 
-
-        priv->tx_power_user_lmt = IWL_DEFAULT_TX_POWER;
-        priv->tx_power_next = IWL_DEFAULT_TX_POWER;
-
         if (eeprom->version < EEPROM_3945_EEPROM_VERSION) {
                 IWL_WARN(priv, "Unsupported EEPROM version: 0x%04X\n",
                          eeprom->version);
diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
index 91b3d8b9d7a5..a62fe24ee594 100644
--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
@@ -2984,15 +2984,15 @@ static void iwl4965_bg_txpower_work(struct work_struct *work)
         struct iwl_priv *priv = container_of(work, struct iwl_priv,
                         txpower_work);
 
+        mutex_lock(&priv->mutex);
+
         /* If a scan happened to start before we got here
          * then just return; the statistics notification will
          * kick off another scheduled work to compensate for
          * any temperature delta we missed here. */
         if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
             test_bit(STATUS_SCANNING, &priv->status))
-                return;
-
-        mutex_lock(&priv->mutex);
+                goto out;
 
         /* Regardless of if we are associated, we must reconfigure the
          * TX power since frames can be sent on non-radar channels while
@@ -3002,7 +3002,7 @@ static void iwl4965_bg_txpower_work(struct work_struct *work)
         /* Update last_temperature to keep is_calib_needed from running
          * when it isn't needed... */
         priv->last_temperature = priv->temperature;
-
+out:
         mutex_unlock(&priv->mutex);
 }
 
@@ -3140,12 +3140,6 @@ static int iwl4965_init_drv(struct iwl_priv *priv)
 
         iwl_legacy_init_scan_params(priv);
 
-        /* Set the tx_power_user_lmt to the lowest power level
-         * this value will get overwritten by channel max power avg
-         * from eeprom */
-        priv->tx_power_user_lmt = IWL4965_TX_POWER_TARGET_POWER_MIN;
-        priv->tx_power_next = IWL4965_TX_POWER_TARGET_POWER_MIN;
-
         ret = iwl_legacy_init_channel_map(priv);
         if (ret) {
                 IWL_ERR(priv, "initializing regulatory failed: %d\n", ret);
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 3ea31b659d1a..22e045b5bcee 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -530,6 +530,9 @@ static struct iwl_ht_params iwl5000_ht_params = {
 struct iwl_cfg iwl5300_agn_cfg = {
         .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
         IWL_DEVICE_5000,
+        /* at least EEPROM 0x11A has wrong info */
+        .valid_tx_ant = ANT_ABC,        /* .cfg overwrite */
+        .valid_rx_ant = ANT_ABC,        /* .cfg overwrite */
         .ht_params = &iwl5000_ht_params,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
index dfdbea6e8f99..fbbde0712fa5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
@@ -335,7 +335,6 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
         struct ieee80211_channel *channel = conf->channel;
         const struct iwl_channel_info *ch_info;
         int ret = 0;
-        bool ht_changed[NUM_IWL_RXON_CTX] = {};
 
         IWL_DEBUG_MAC80211(priv, "changed %#x", changed);
 
@@ -383,10 +382,8 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
 
                 for_each_context(priv, ctx) {
                         /* Configure HT40 channels */
-                        if (ctx->ht.enabled != conf_is_ht(conf)) {
+                        if (ctx->ht.enabled != conf_is_ht(conf))
                                 ctx->ht.enabled = conf_is_ht(conf);
-                                ht_changed[ctx->ctxid] = true;
-                        }
 
                         if (ctx->ht.enabled) {
                                 if (conf_is_ht40_minus(conf)) {
@@ -455,8 +452,6 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
                 if (!memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
                         continue;
                 iwlagn_commit_rxon(priv, ctx);
-                if (ht_changed[ctx->ctxid])
-                        iwlagn_update_qos(priv, ctx);
         }
  out:
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index a709d05c5868..0712b67283a4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -568,12 +568,17 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         hdr_len = ieee80211_hdrlen(fc);
 
-        /* Find index into station table for destination station */
-        sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
-                               hdr->addr1);
-                goto drop_unlock;
+        /* For management frames use broadcast id to do not break aggregation */
+        if (!ieee80211_is_data(fc))
+                sta_id = ctx->bcast_sta_id;
+        else {
+                /* Find index into station table for destination station */
+                sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
+                if (sta_id == IWL_INVALID_STATION) {
+                        IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
+                                       hdr->addr1);
+                        goto drop_unlock;
+                }
         }
 
         IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -1224,12 +1229,16 @@ int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 tx_info = &txq->txb[txq->q.read_ptr];
-                iwlagn_tx_status(priv, tx_info,
-                                 txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
+
+                if (WARN_ON_ONCE(tx_info->skb == NULL))
+                        continue;
 
                 hdr = (struct ieee80211_hdr *)tx_info->skb->data;
-                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                if (ieee80211_is_data_qos(hdr->frame_control))
                         nfreed++;
+
+                iwlagn_tx_status(priv, tx_info,
+                                 txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
                 tx_info->skb = NULL;
 
                 if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 36952274950e..c1ceb4b23971 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -137,6 +137,7 @@ struct mwl8k_tx_queue {
 struct mwl8k_priv {
         struct ieee80211_hw *hw;
         struct pci_dev *pdev;
+        int irq;
 
         struct mwl8k_device_info *device_info;
 
@@ -3761,9 +3762,11 @@ static int mwl8k_start(struct ieee80211_hw *hw)
         rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
                          IRQF_SHARED, MWL8K_NAME, hw);
         if (rc) {
+                priv->irq = -1;
                 wiphy_err(hw->wiphy, "failed to register IRQ handler\n");
                 return -EIO;
         }
+        priv->irq = priv->pdev->irq;
 
         /* Enable TX reclaim and RX tasklets.  */
         tasklet_enable(&priv->poll_tx_task);
@@ -3800,6 +3803,7 @@ static int mwl8k_start(struct ieee80211_hw *hw)
         if (rc) {
                 iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
                 free_irq(priv->pdev->irq, hw);
+                priv->irq = -1;
                 tasklet_disable(&priv->poll_tx_task);
                 tasklet_disable(&priv->poll_rx_task);
         }
@@ -3818,7 +3822,10 @@ static void mwl8k_stop(struct ieee80211_hw *hw)
 
         /* Disable interrupts */
         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
-        free_irq(priv->pdev->irq, hw);
+        if (priv->irq != -1) {
+                free_irq(priv->pdev->irq, hw);
+                priv->irq = -1;
+        }
 
         /* Stop finalize join worker */
         cancel_work_sync(&priv->finalize_join_worker);
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 7834c26c2954..042842e704de 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -703,7 +703,7 @@ void p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct p54_tx_info *p54info;
         struct p54_hdr *hdr;
         struct p54_tx_data *txhdr;
-        unsigned int padding, len, extra_len;
+        unsigned int padding, len, extra_len = 0;
         int i, j, ridx;
         u16 hdr_flags = 0, aid = 0;
         u8 rate, queue = 0, crypt_offset = 0;
diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index a3755ffc03d4..bc8ce48f0778 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -2550,7 +2550,6 @@ static int __devinit sio_ite_8872_probe(struct pci_dev *pdev, int autoirq,
                                          const struct parport_pc_via_data *via)
 {
         short inta_addr[6] = { 0x2A0, 0x2C0, 0x220, 0x240, 0x1E0 };
-        struct resource *base_res;
         u32 ite8872set;
         u32 ite8872_lpt, ite8872_lpthi;
         u8 ite8872_irq, type;
@@ -2561,8 +2560,7 @@ static int __devinit sio_ite_8872_probe(struct pci_dev *pdev, int autoirq,
 
         /* make sure which one chip */
         for (i = 0; i < 5; i++) {
-                base_res = request_region(inta_addr[i], 32, "it887x");
-                if (base_res) {
+                if (request_region(inta_addr[i], 32, "it887x")) {
                         int test;
                         pci_write_config_dword(pdev, 0x60,
                                                 0xe5000000 | inta_addr[i]);
@@ -2571,7 +2569,7 @@ static int __devinit sio_ite_8872_probe(struct pci_dev *pdev, int autoirq,
                         test = inb(inta_addr[i]);
                         if (test != 0xff)
                                 break;
-                        release_region(inta_addr[i], 0x8);
+                        release_region(inta_addr[i], 32);
                 }
         }
         if (i >= 5) {
@@ -2635,7 +2633,7 @@ static int __devinit sio_ite_8872_probe(struct pci_dev *pdev, int autoirq,
         /*
          * Release the resource so that parport_pc_probe_port can get it.
          */
-        release_resource(base_res);
+        release_region(inta_addr[i], 32);
         if (parport_pc_probe_port(ite8872_lpt, ite8872_lpthi,
                                    irq, PARPORT_DMA_NONE, &pdev->dev, 0)) {
                 printk(KERN_INFO
diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
index c8ff646c0b05..0fa466a91bf4 100644
--- a/drivers/pci/Kconfig
+++ b/drivers/pci/Kconfig
@@ -88,4 +88,6 @@ config PCI_IOAPIC
         depends on HOTPLUG
         default y
 
-select NLS if (DMI || ACPI)
+config PCI_LABEL
+        def_bool y if (DMI || ACPI)
+        select NLS
diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
index 98d61c8e984b..c85f744270a5 100644
--- a/drivers/pci/Makefile
+++ b/drivers/pci/Makefile
@@ -56,10 +56,10 @@ obj-$(CONFIG_TILE) += setup-bus.o setup-irq.o
 # ACPI Related PCI FW Functions
 # ACPI _DSM provided firmware instance and string name
 #
-obj-$(CONFIG_ACPI)    += pci-acpi.o pci-label.o
+obj-$(CONFIG_ACPI)    += pci-acpi.o
 
 # SMBIOS provided firmware instance and labels
-obj-$(CONFIG_DMI)    += pci-label.o
+obj-$(CONFIG_PCI_LABEL) += pci-label.o
 
 # Cardbus & CompactPCI use setup-bus
 obj-$(CONFIG_HOTPLUG) += setup-bus.o
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 505c1c7075f0..d552d2c77844 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -1299,7 +1299,7 @@ static void iommu_detach_domain(struct dmar_domain *domain,
 static struct iova_domain reserved_iova_list;
 static struct lock_class_key reserved_rbtree_key;
 
-static void dmar_init_reserved_ranges(void)
+static int dmar_init_reserved_ranges(void)
 {
         struct pci_dev *pdev = NULL;
         struct iova *iova;
@@ -1313,8 +1313,10 @@ static void dmar_init_reserved_ranges(void)
         /* IOAPIC ranges shouldn't be accessed by DMA */
         iova = reserve_iova(&reserved_iova_list, IOVA_PFN(IOAPIC_RANGE_START),
                 IOVA_PFN(IOAPIC_RANGE_END));
-        if (!iova)
+        if (!iova) {
                 printk(KERN_ERR "Reserve IOAPIC range failed\n");
+                return -ENODEV;
+        }
 
         /* Reserve all PCI MMIO to avoid peer-to-peer access */
         for_each_pci_dev(pdev) {
@@ -1327,11 +1329,13 @@ static void dmar_init_reserved_ranges(void)
                         iova = reserve_iova(&reserved_iova_list,
                                             IOVA_PFN(r->start),
                                             IOVA_PFN(r->end));
-                        if (!iova)
+                        if (!iova) {
                                 printk(KERN_ERR "Reserve iova failed\n");
+                                return -ENODEV;
+                        }
                 }
         }
-
+        return 0;
 }
 
 static void domain_reserve_special_ranges(struct dmar_domain *domain)
@@ -1835,7 +1839,7 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
 
         ret = iommu_attach_domain(domain, iommu);
         if (ret) {
-                domain_exit(domain);
+                free_domain_mem(domain);
                 goto error;
         }
 
@@ -2213,7 +2217,7 @@ static int __init iommu_prepare_static_identity_mapping(int hw)
         return 0;
 }
 
-int __init init_dmars(void)
+static int __init init_dmars(int force_on)
 {
         struct dmar_drhd_unit *drhd;
         struct dmar_rmrr_unit *rmrr;
@@ -2393,8 +2397,15 @@ int __init init_dmars(void)
          *   enable translation
          */
         for_each_drhd_unit(drhd) {
-                if (drhd->ignored)
+                if (drhd->ignored) {
+                        /*
+                         * we always have to disable PMRs or DMA may fail on
+                         * this device
+                         */
+                        if (force_on)
+                                iommu_disable_protect_mem_regions(drhd->iommu);
                         continue;
+                }
                 iommu = drhd->iommu;
 
                 iommu_flush_write_buffer(iommu);
@@ -3240,9 +3251,15 @@ static int device_notifier(struct notifier_block *nb,
         if (!domain)
                 return 0;
 
-        if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through)
+        if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) {
                 domain_remove_one_dev_info(domain, pdev);
 
+                if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
+                    !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
+                    list_empty(&domain->devices))
+                        domain_exit(domain);
+        }
+
         return 0;
 }
 
@@ -3277,12 +3294,21 @@ int __init intel_iommu_init(void)
         if (no_iommu || dmar_disabled)
                 return -ENODEV;
 
-        iommu_init_mempool();
-        dmar_init_reserved_ranges();
+        if (iommu_init_mempool()) {
+                if (force_on)
+                        panic("tboot: Failed to initialize iommu memory\n");
+                return  -ENODEV;
+        }
+
+        if (dmar_init_reserved_ranges()) {
+                if (force_on)
+                        panic("tboot: Failed to reserve iommu ranges\n");
+                return  -ENODEV;
+        }
 
         init_no_remapping_devices();
 
-        ret = init_dmars();
+        ret = init_dmars(force_on);
         if (ret) {
                 if (force_on)
                         panic("tboot: Failed to initialize DMARs\n");
@@ -3391,6 +3417,11 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
                 domain->iommu_count--;
                 domain_update_iommu_cap(domain);
                 spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
+
+                spin_lock_irqsave(&iommu->lock, tmp_flags);
+                clear_bit(domain->id, iommu->domain_ids);
+                iommu->domains[domain->id] = NULL;
+                spin_unlock_irqrestore(&iommu->lock, tmp_flags);
         }
 
         spin_unlock_irqrestore(&device_domain_lock, flags);
@@ -3607,9 +3638,9 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
 
                 pte = dmar_domain->pgd;
                 if (dma_pte_present(pte)) {
-                        free_pgtable_page(dmar_domain->pgd);
                         dmar_domain->pgd = (struct dma_pte *)
                                 phys_to_virt(dma_pte_addr(pte));
+                        free_pgtable_page(pte);
                 }
                 dmar_domain->agaw--;
         }
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index fe77e8223841..e8c19def1b0f 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -173,7 +173,7 @@ static int pcmcia_access_config(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
 
         if (!(c->state & CONFIG_LOCKED)) {
-                dev_dbg(&p_dev->dev, "Configuration isn't't locked\n");
+                dev_dbg(&p_dev->dev, "Configuration isn't locked\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EACCES;
         }
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 5f2dd386152b..2c1abf63957f 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -585,8 +585,9 @@ static bool eeepc_wlan_rfkill_blocked(struct eeepc_laptop *eeepc)
         return true;
 }
 
-static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc)
+static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
 {
+        struct pci_dev *port;
         struct pci_dev *dev;
         struct pci_bus *bus;
         bool blocked = eeepc_wlan_rfkill_blocked(eeepc);
@@ -599,9 +600,16 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc)
         mutex_lock(&eeepc->hotplug_lock);
 
         if (eeepc->hotplug_slot) {
-                bus = pci_find_bus(0, 1);
+                port = acpi_get_pci_dev(handle);
+                if (!port) {
+                        pr_warning("Unable to find port\n");
+                        goto out_unlock;
+                }
+
+                bus = port->subordinate;
+
                 if (!bus) {
-                        pr_warning("Unable to find PCI bus 1?\n");
+                        pr_warning("Unable to find PCI bus?\n");
                         goto out_unlock;
                 }
 
@@ -609,6 +617,7 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc)
                         pr_err("Unable to read PCI config space?\n");
                         goto out_unlock;
                 }
+
                 absent = (l == 0xffffffff);
 
                 if (blocked != absent) {
@@ -647,6 +656,17 @@ out_unlock:
         mutex_unlock(&eeepc->hotplug_lock);
 }
 
+static void eeepc_rfkill_hotplug_update(struct eeepc_laptop *eeepc, char *node)
+{
+        acpi_status status = AE_OK;
+        acpi_handle handle;
+
+        status = acpi_get_handle(NULL, node, &handle);
+
+        if (ACPI_SUCCESS(status))
+                eeepc_rfkill_hotplug(eeepc, handle);
+}
+
 static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
 {
         struct eeepc_laptop *eeepc = data;
@@ -654,7 +674,7 @@ static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
         if (event != ACPI_NOTIFY_BUS_CHECK)
                 return;
 
-        eeepc_rfkill_hotplug(eeepc);
+        eeepc_rfkill_hotplug(eeepc, handle);
 }
 
 static int eeepc_register_rfkill_notifier(struct eeepc_laptop *eeepc,
@@ -672,6 +692,11 @@ static int eeepc_register_rfkill_notifier(struct eeepc_laptop *eeepc,
                                                      eeepc);
                 if (ACPI_FAILURE(status))
                         pr_warning("Failed to register notify on %s\n", node);
+                /*
+                 * Refresh pci hotplug in case the rfkill state was
+                 * changed during setup.
+                 */
+                eeepc_rfkill_hotplug(eeepc, handle);
         } else
                 return -ENODEV;
 
@@ -693,6 +718,12 @@ static void eeepc_unregister_rfkill_notifier(struct eeepc_laptop *eeepc,
                 if (ACPI_FAILURE(status))
                         pr_err("Error removing rfkill notify handler %s\n",
                                 node);
+                        /*
+                         * Refresh pci hotplug in case the rfkill
+                         * state was changed after
+                         * eeepc_unregister_rfkill_notifier()
+                         */
+                eeepc_rfkill_hotplug(eeepc, handle);
         }
 }
 
@@ -816,11 +847,7 @@ static void eeepc_rfkill_exit(struct eeepc_laptop *eeepc)
                 rfkill_destroy(eeepc->wlan_rfkill);
                 eeepc->wlan_rfkill = NULL;
         }
-        /*
-         * Refresh pci hotplug in case the rfkill state was changed after
-         * eeepc_unregister_rfkill_notifier()
-         */
-        eeepc_rfkill_hotplug(eeepc);
+
         if (eeepc->hotplug_slot)
                 pci_hp_deregister(eeepc->hotplug_slot);
 
@@ -889,11 +916,6 @@ static int eeepc_rfkill_init(struct eeepc_laptop *eeepc)
         eeepc_register_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P5");
         eeepc_register_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P6");
         eeepc_register_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P7");
-        /*
-         * Refresh pci hotplug in case the rfkill state was changed during
-         * setup.
-         */
-        eeepc_rfkill_hotplug(eeepc);
 
 exit:
         if (result && result != -ENODEV)
@@ -928,8 +950,11 @@ static int eeepc_hotk_restore(struct device *device)
         struct eeepc_laptop *eeepc = dev_get_drvdata(device);
 
         /* Refresh both wlan rfkill state and pci hotplug */
-        if (eeepc->wlan_rfkill)
-                eeepc_rfkill_hotplug(eeepc);
+        if (eeepc->wlan_rfkill) {
+                eeepc_rfkill_hotplug_update(eeepc, "\\_SB.PCI0.P0P5");
+                eeepc_rfkill_hotplug_update(eeepc, "\\_SB.PCI0.P0P6");
+                eeepc_rfkill_hotplug_update(eeepc, "\\_SB.PCI0.P0P7");
+        }
 
         if (eeepc->bluetooth_rfkill)
                 rfkill_set_sw_state(eeepc->bluetooth_rfkill,
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index 8f709aec4da0..6fe8cd6e23b5 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -934,6 +934,14 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
 /*
  * Backlight device
  */
+struct sony_backlight_props {
+        struct backlight_device *dev;
+        int                     handle;
+        u8                      offset;
+        u8                      maxlvl;
+};
+struct sony_backlight_props sony_bl_props;
+
 static int sony_backlight_update_status(struct backlight_device *bd)
 {
         return acpi_callsetfunc(sony_nc_acpi_handle, "SBRT",
@@ -954,21 +962,26 @@ static int sony_nc_get_brightness_ng(struct backlight_device *bd)
 {
         int result;
         int *handle = (int *)bl_get_data(bd);
+        struct sony_backlight_props *sdev =
+                (struct sony_backlight_props *)bl_get_data(bd);
 
-        sony_call_snc_handle(*handle, 0x0200, &result);
+        sony_call_snc_handle(sdev->handle, 0x0200, &result);
 
-        return result & 0xff;
+        return (result & 0xff) - sdev->offset;
 }
 
 static int sony_nc_update_status_ng(struct backlight_device *bd)
 {
         int value, result;
         int *handle = (int *)bl_get_data(bd);
+        struct sony_backlight_props *sdev =
+                (struct sony_backlight_props *)bl_get_data(bd);
 
-        value = bd->props.brightness;
-        sony_call_snc_handle(*handle, 0x0100 | (value << 16), &result);
+        value = bd->props.brightness + sdev->offset;
+        if (sony_call_snc_handle(sdev->handle, 0x0100 | (value << 16), &result))
+                return -EIO;
 
-        return sony_nc_get_brightness_ng(bd);
+        return value;
 }
 
 static const struct backlight_ops sony_backlight_ops = {
@@ -981,8 +994,6 @@ static const struct backlight_ops sony_backlight_ng_ops = {
         .update_status = sony_nc_update_status_ng,
         .get_brightness = sony_nc_get_brightness_ng,
 };
-static int backlight_ng_handle;
-static struct backlight_device *sony_backlight_device;
 
 /*
  * New SNC-only Vaios event mapping to driver known keys
@@ -1549,6 +1560,75 @@ static void sony_nc_kbd_backlight_resume(void)
                                 &ignore);
 }
 
+static void sony_nc_backlight_ng_read_limits(int handle,
+                struct sony_backlight_props *props)
+{
+        int offset;
+        acpi_status status;
+        u8 brlvl, i;
+        u8 min = 0xff, max = 0x00;
+        struct acpi_object_list params;
+        union acpi_object in_obj;
+        union acpi_object *lvl_enum;
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+
+        props->handle = handle;
+        props->offset = 0;
+        props->maxlvl = 0xff;
+
+        offset = sony_find_snc_handle(handle);
+        if (offset < 0)
+                return;
+
+        /* try to read the boundaries from ACPI tables, if we fail the above
+         * defaults should be reasonable
+         */
+        params.count = 1;
+        params.pointer = &in_obj;
+        in_obj.type = ACPI_TYPE_INTEGER;
+        in_obj.integer.value = offset;
+        status = acpi_evaluate_object(sony_nc_acpi_handle, "SN06", &params,
+                        &buffer);
+        if (ACPI_FAILURE(status))
+                return;
+
+        lvl_enum = (union acpi_object *) buffer.pointer;
+        if (!lvl_enum) {
+                pr_err("No SN06 return object.");
+                return;
+        }
+        if (lvl_enum->type != ACPI_TYPE_BUFFER) {
+                pr_err("Invalid SN06 return object 0x%.2x\n",
+                       lvl_enum->type);
+                goto out_invalid;
+        }
+
+        /* the buffer lists brightness levels available, brightness levels are
+         * from 0 to 8 in the array, other values are used by ALS control.
+         */
+        for (i = 0; i < 9 && i < lvl_enum->buffer.length; i++) {
+
+                brlvl = *(lvl_enum->buffer.pointer + i);
+                dprintk("Brightness level: %d\n", brlvl);
+
+                if (!brlvl)
+                        break;
+
+                if (brlvl > max)
+                        max = brlvl;
+                if (brlvl < min)
+                        min = brlvl;
+        }
+        props->offset = min;
+        props->maxlvl = max;
+        dprintk("Brightness levels: min=%d max=%d\n", props->offset,
+                        props->maxlvl);
+
+out_invalid:
+        kfree(buffer.pointer);
+        return;
+}
+
 static void sony_nc_backlight_setup(void)
 {
         acpi_handle unused;
@@ -1557,14 +1637,14 @@ static void sony_nc_backlight_setup(void)
         struct backlight_properties props;
 
         if (sony_find_snc_handle(0x12f) != -1) {
-                backlight_ng_handle = 0x12f;
                 ops = &sony_backlight_ng_ops;
-                max_brightness = 0xff;
+                sony_nc_backlight_ng_read_limits(0x12f, &sony_bl_props);
+                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
 
         } else if (sony_find_snc_handle(0x137) != -1) {
-                backlight_ng_handle = 0x137;
                 ops = &sony_backlight_ng_ops;
-                max_brightness = 0xff;
+                sony_nc_backlight_ng_read_limits(0x137, &sony_bl_props);
+                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
 
         } else if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "GBRT",
                                                 &unused))) {
@@ -1577,22 +1657,22 @@ static void sony_nc_backlight_setup(void)
         memset(&props, 0, sizeof(struct backlight_properties));
         props.type = BACKLIGHT_PLATFORM;
         props.max_brightness = max_brightness;
-        sony_backlight_device = backlight_device_register("sony", NULL,
-                                                          &backlight_ng_handle,
-                                                          ops, &props);
+        sony_bl_props.dev = backlight_device_register("sony", NULL,
+                                                      &sony_bl_props,
+                                                      ops, &props);
 
-        if (IS_ERR(sony_backlight_device)) {
-                pr_warning(DRV_PFX "unable to register backlight device\n");
-                sony_backlight_device = NULL;
+        if (IS_ERR(sony_bl_props.dev)) {
+                pr_warn(DRV_PFX "unable to register backlight device\n");
+                sony_bl_props.dev = NULL;
         } else
-                sony_backlight_device->props.brightness =
-                    ops->get_brightness(sony_backlight_device);
+                sony_bl_props.dev->props.brightness =
+                        ops->get_brightness(sony_bl_props.dev);
 }
 
 static void sony_nc_backlight_cleanup(void)
 {
-        if (sony_backlight_device)
-                backlight_device_unregister(sony_backlight_device);
+        if (sony_bl_props.dev)
+                backlight_device_unregister(sony_bl_props.dev);
 }
 
 static int sony_nc_add(struct acpi_device *device)
@@ -2590,7 +2670,7 @@ static long sonypi_misc_ioctl(struct file *fp, unsigned int cmd,
         mutex_lock(&spic_dev.lock);
         switch (cmd) {
         case SONYPI_IOCGBRT:
-                if (sony_backlight_device == NULL) {
+                if (sony_bl_props.dev == NULL) {
                         ret = -EIO;
                         break;
                 }
@@ -2603,7 +2683,7 @@ static long sonypi_misc_ioctl(struct file *fp, unsigned int cmd,
                                 ret = -EFAULT;
                 break;
         case SONYPI_IOCSBRT:
-                if (sony_backlight_device == NULL) {
+                if (sony_bl_props.dev == NULL) {
                         ret = -EIO;
                         break;
                 }
@@ -2617,8 +2697,8 @@ static long sonypi_misc_ioctl(struct file *fp, unsigned int cmd,
                         break;
                 }
                 /* sync the backlight device status */
-                sony_backlight_device->props.brightness =
-                    sony_backlight_get_brightness(sony_backlight_device);
+                sony_bl_props.dev->props.brightness =
+                    sony_backlight_get_brightness(sony_bl_props.dev);
                 break;
         case SONYPI_IOCGBAT1CAP:
                 if (ec_read16(SONYPI_BAT1_FULL, &val16)) {
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index efb3b6b9bcdb..562fcf0dd2b5 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -128,7 +128,8 @@ enum {
 };
 
 /* ACPI HIDs */
-#define TPACPI_ACPI_HKEY_HID            "IBM0068"
+#define TPACPI_ACPI_IBM_HKEY_HID        "IBM0068"
+#define TPACPI_ACPI_LENOVO_HKEY_HID     "LEN0068"
 #define TPACPI_ACPI_EC_HID              "PNP0C09"
 
 /* Input IDs */
@@ -3879,7 +3880,8 @@ errexit:
 }
 
 static const struct acpi_device_id ibm_htk_device_ids[] = {
-        {TPACPI_ACPI_HKEY_HID, 0},
+        {TPACPI_ACPI_IBM_HKEY_HID, 0},
+        {TPACPI_ACPI_LENOVO_HKEY_HID, 0},
         {"", 0},
 };
 
diff --git a/drivers/rtc/rtc-coh901331.c b/drivers/rtc/rtc-coh901331.c
index 316f484999b5..80f9c88214c5 100644
--- a/drivers/rtc/rtc-coh901331.c
+++ b/drivers/rtc/rtc-coh901331.c
@@ -220,6 +220,7 @@ static int __init coh901331_probe(struct platform_device *pdev)
         }
         clk_disable(rtap->clk);
 
+        platform_set_drvdata(pdev, rtap);
         rtap->rtc = rtc_device_register("coh901331", &pdev->dev, &coh901331_ops,
                                          THIS_MODULE);
         if (IS_ERR(rtap->rtc)) {
@@ -227,11 +228,10 @@ static int __init coh901331_probe(struct platform_device *pdev)
                 goto out_no_rtc;
         }
 
-        platform_set_drvdata(pdev, rtap);
-
         return 0;
 
  out_no_rtc:
+        platform_set_drvdata(pdev, NULL);
  out_no_clk_enable:
         clk_put(rtap->clk);
  out_no_clk:
diff --git a/drivers/rtc/rtc-max8925.c b/drivers/rtc/rtc-max8925.c
index 174036dda786..20494b5edc3c 100644
--- a/drivers/rtc/rtc-max8925.c
+++ b/drivers/rtc/rtc-max8925.c
@@ -257,6 +257,8 @@ static int __devinit max8925_rtc_probe(struct platform_device *pdev)
                 goto out_irq;
         }
 
+        dev_set_drvdata(&pdev->dev, info);
+
         info->rtc_dev = rtc_device_register("max8925-rtc", &pdev->dev,
                                         &max8925_rtc_ops, THIS_MODULE);
         ret = PTR_ERR(info->rtc_dev);
@@ -265,7 +267,6 @@ static int __devinit max8925_rtc_probe(struct platform_device *pdev)
                 goto out_rtc;
         }
 
-        dev_set_drvdata(&pdev->dev, info);
         platform_set_drvdata(pdev, info);
 
         return 0;
diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
index de0dd7b1f146..bcae8dd41496 100644
--- a/drivers/rtc/rtc-omap.c
+++ b/drivers/rtc/rtc-omap.c
@@ -394,7 +394,7 @@ static int __init omap_rtc_probe(struct platform_device *pdev)
         return 0;
 
 fail2:
-        free_irq(omap_rtc_timer, NULL);
+        free_irq(omap_rtc_timer, rtc);
 fail1:
         rtc_device_unregister(rtc);
 fail0:
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 4d2df2f76ea0..475e603fc584 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2314,15 +2314,14 @@ static void dasd_flush_request_queue(struct dasd_block *block)
 
 static int dasd_open(struct block_device *bdev, fmode_t mode)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
         struct dasd_device *base;
         int rc;
 
-        if (!block)
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
                 return -ENODEV;
 
-        base = block->base;
-        atomic_inc(&block->open_count);
+        atomic_inc(&base->block->open_count);
         if (test_bit(DASD_FLAG_OFFLINE, &base->flags)) {
                 rc = -ENODEV;
                 goto unlock;
@@ -2355,21 +2354,28 @@ static int dasd_open(struct block_device *bdev, fmode_t mode)
                 goto out;
         }
 
+        dasd_put_device(base);
         return 0;
 
 out:
         module_put(base->discipline->owner);
 unlock:
-        atomic_dec(&block->open_count);
+        atomic_dec(&base->block->open_count);
+        dasd_put_device(base);
         return rc;
 }
 
 static int dasd_release(struct gendisk *disk, fmode_t mode)
 {
-        struct dasd_block *block = disk->private_data;
+        struct dasd_device *base;
 
-        atomic_dec(&block->open_count);
-        module_put(block->base->discipline->owner);
+        base = dasd_device_from_gendisk(disk);
+        if (!base)
+                return -ENODEV;
+
+        atomic_dec(&base->block->open_count);
+        module_put(base->discipline->owner);
+        dasd_put_device(base);
         return 0;
 }
 
@@ -2378,20 +2384,20 @@ static int dasd_release(struct gendisk *disk, fmode_t mode)
  */
 static int dasd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 {
-        struct dasd_block *block;
         struct dasd_device *base;
 
-        block = bdev->bd_disk->private_data;
-        if (!block)
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
                 return -ENODEV;
-        base = block->base;
 
         if (!base->discipline ||
-            !base->discipline->fill_geometry)
+            !base->discipline->fill_geometry) {
+                dasd_put_device(base);
                 return -EINVAL;
-
-        base->discipline->fill_geometry(block, geo);
-        geo->start = get_start_sect(bdev) >> block->s2b_shift;
+        }
+        base->discipline->fill_geometry(base->block, geo);
+        geo->start = get_start_sect(bdev) >> base->block->s2b_shift;
+        dasd_put_device(base);
         return 0;
 }
 
@@ -2528,7 +2534,6 @@ void dasd_generic_remove(struct ccw_device *cdev)
         dasd_set_target_state(device, DASD_STATE_NEW);
         /* dasd_delete_device destroys the device reference. */
         block = device->block;
-        device->block = NULL;
         dasd_delete_device(device);
         /*
          * life cycle of block is bound to device, so delete it after
@@ -2650,7 +2655,6 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
         dasd_set_target_state(device, DASD_STATE_NEW);
         /* dasd_delete_device destroys the device reference. */
         block = device->block;
-        device->block = NULL;
         dasd_delete_device(device);
         /*
          * life cycle of block is bound to device, so delete it after
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index 42e1bf35f689..d71511c7850a 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -674,6 +674,36 @@ dasd_device_from_cdev(struct ccw_device *cdev)
         return device;
 }
 
+void dasd_add_link_to_gendisk(struct gendisk *gdp, struct dasd_device *device)
+{
+        struct dasd_devmap *devmap;
+
+        devmap = dasd_find_busid(dev_name(&device->cdev->dev));
+        if (IS_ERR(devmap))
+                return;
+        spin_lock(&dasd_devmap_lock);
+        gdp->private_data = devmap;
+        spin_unlock(&dasd_devmap_lock);
+}
+
+struct dasd_device *dasd_device_from_gendisk(struct gendisk *gdp)
+{
+        struct dasd_device *device;
+        struct dasd_devmap *devmap;
+
+        if (!gdp->private_data)
+                return NULL;
+        device = NULL;
+        spin_lock(&dasd_devmap_lock);
+        devmap = gdp->private_data;
+        if (devmap && devmap->device) {
+                device = devmap->device;
+                dasd_get_device(device);
+        }
+        spin_unlock(&dasd_devmap_lock);
+        return device;
+}
+
 /*
  * SECTION: files in sysfs
  */
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index 29143eda9dd9..85dddb1e4126 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -239,7 +239,6 @@ static void dasd_ext_handler(unsigned int ext_int_code,
         addr_t ip;
         int rc;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
         switch (ext_int_code >> 24) {
         case DASD_DIAG_CODE_31BIT:
                 ip = (addr_t) param32;
@@ -250,6 +249,7 @@ static void dasd_ext_handler(unsigned int ext_int_code,
         default:
                 return;
         }
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
         if (!ip) {              /* no intparm: unsolicited interrupt */
                 DBF_EVENT(DBF_NOTICE, "%s", "caught unsolicited "
                               "interrupt");
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index db8005d9f2fd..3ebdf5f92f8f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2037,7 +2037,7 @@ static void dasd_eckd_check_for_device_change(struct dasd_device *device,
                 return;
 
         /* summary unit check */
-        if ((sense[7] == 0x0D) &&
+        if ((sense[27] & DASD_SENSE_BIT_0) && (sense[7] == 0x0D) &&
             (scsw_dstat(&irb->scsw) & DEV_STAT_UNIT_CHECK)) {
                 dasd_alias_handle_summary_unit_check(device, irb);
                 return;
@@ -2053,7 +2053,8 @@ static void dasd_eckd_check_for_device_change(struct dasd_device *device,
         /* loss of device reservation is handled via base devices only
          * as alias devices may be used with several bases
          */
-        if (device->block && (sense[7] == 0x3F) &&
+        if (device->block && (sense[27] & DASD_SENSE_BIT_0) &&
+            (sense[7] == 0x3F) &&
             (scsw_dstat(&irb->scsw) & DEV_STAT_UNIT_CHECK) &&
             test_bit(DASD_FLAG_IS_RESERVED, &device->flags)) {
                 if (device->features & DASD_FEATURE_FAILONSLCK)
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index 5505bc07e1e7..19a1ff03d65e 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -73,7 +73,7 @@ int dasd_gendisk_alloc(struct dasd_block *block)
         if (base->features & DASD_FEATURE_READONLY ||
             test_bit(DASD_FLAG_DEVICE_RO, &base->flags))
                 set_disk_ro(gdp, 1);
-        gdp->private_data = block;
+        dasd_add_link_to_gendisk(gdp, base);
         gdp->queue = block->request_queue;
         block->gdp = gdp;
         set_capacity(block->gdp, 0);
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index df9f6999411d..d1e4f2c1264c 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -686,6 +686,9 @@ struct dasd_device *dasd_device_from_cdev(struct ccw_device *);
 struct dasd_device *dasd_device_from_cdev_locked(struct ccw_device *);
 struct dasd_device *dasd_device_from_devindex(int);
 
+void dasd_add_link_to_gendisk(struct gendisk *, struct dasd_device *);
+struct dasd_device *dasd_device_from_gendisk(struct gendisk *);
+
 int dasd_parse(void);
 int dasd_busid_known(const char *);
 
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 26075e95b1ba..72261e4c516d 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -42,16 +42,22 @@ dasd_ioctl_api_version(void __user *argp)
 static int
 dasd_ioctl_enable(struct block_device *bdev)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
-        dasd_enable_device(block->base);
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+
+        dasd_enable_device(base);
         /* Formatting the dasd device can change the capacity. */
         mutex_lock(&bdev->bd_mutex);
-        i_size_write(bdev->bd_inode, (loff_t)get_capacity(block->gdp) << 9);
+        i_size_write(bdev->bd_inode,
+                     (loff_t)get_capacity(base->block->gdp) << 9);
         mutex_unlock(&bdev->bd_mutex);
+        dasd_put_device(base);
         return 0;
 }
 
@@ -62,11 +68,14 @@ dasd_ioctl_enable(struct block_device *bdev)
 static int
 dasd_ioctl_disable(struct block_device *bdev)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
         /*
          * Man this is sick. We don't do a real disable but only downgrade
          * the device to DASD_STATE_BASIC. The reason is that dasdfmt uses
@@ -75,7 +84,7 @@ dasd_ioctl_disable(struct block_device *bdev)
          * using the BIODASDFMT ioctl. Therefore the correct state for the
          * device is DASD_STATE_BASIC that allows to do basic i/o.
          */
-        dasd_set_target_state(block->base, DASD_STATE_BASIC);
+        dasd_set_target_state(base, DASD_STATE_BASIC);
         /*
          * Set i_size to zero, since read, write, etc. check against this
          * value.
@@ -83,6 +92,7 @@ dasd_ioctl_disable(struct block_device *bdev)
         mutex_lock(&bdev->bd_mutex);
         i_size_write(bdev->bd_inode, 0);
         mutex_unlock(&bdev->bd_mutex);
+        dasd_put_device(base);
         return 0;
 }
 
@@ -191,26 +201,36 @@ static int dasd_format(struct dasd_block *block, struct format_data_t *fdata)
 static int
 dasd_ioctl_format(struct block_device *bdev, void __user *argp)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
         struct format_data_t fdata;
+        int rc;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
         if (!argp)
                 return -EINVAL;
-
-        if (block->base->features & DASD_FEATURE_READONLY ||
-            test_bit(DASD_FLAG_DEVICE_RO, &block->base->flags))
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        if (base->features & DASD_FEATURE_READONLY ||
+            test_bit(DASD_FLAG_DEVICE_RO, &base->flags)) {
+                dasd_put_device(base);
                 return -EROFS;
-        if (copy_from_user(&fdata, argp, sizeof(struct format_data_t)))
+        }
+        if (copy_from_user(&fdata, argp, sizeof(struct format_data_t))) {
+                dasd_put_device(base);
                 return -EFAULT;
+        }
         if (bdev != bdev->bd_contains) {
                 pr_warning("%s: The specified DASD is a partition and cannot "
                            "be formatted\n",
-                           dev_name(&block->base->cdev->dev));
+                           dev_name(&base->cdev->dev));
+                dasd_put_device(base);
                 return -EINVAL;
         }
-        return dasd_format(block, &fdata);
+        rc = dasd_format(base->block, &fdata);
+        dasd_put_device(base);
+        return rc;
 }
 
 #ifdef CONFIG_DASD_PROFILE
@@ -340,8 +360,8 @@ static int dasd_ioctl_information(struct dasd_block *block,
 static int
 dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
 {
-        struct dasd_block *block =  bdev->bd_disk->private_data;
-        int intval;
+        struct dasd_device *base;
+        int intval, rc;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -350,10 +370,17 @@ dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
                 return -EINVAL;
         if (get_user(intval, (int __user *)argp))
                 return -EFAULT;
-        if (!intval && test_bit(DASD_FLAG_DEVICE_RO, &block->base->flags))
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        if (!intval && test_bit(DASD_FLAG_DEVICE_RO, &base->flags)) {
+                dasd_put_device(base);
                 return -EROFS;
+        }
         set_disk_ro(bdev->bd_disk, intval);
-        return dasd_set_feature(block->base->cdev, DASD_FEATURE_READONLY, intval);
+        rc = dasd_set_feature(base->cdev, DASD_FEATURE_READONLY, intval);
+        dasd_put_device(base);
+        return rc;
 }
 
 static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
@@ -372,59 +399,78 @@ static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
 int dasd_ioctl(struct block_device *bdev, fmode_t mode,
                unsigned int cmd, unsigned long arg)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_block *block;
+        struct dasd_device *base;
         void __user *argp;
+        int rc;
 
         if (is_compat_task())
                 argp = compat_ptr(arg);
         else
                 argp = (void __user *)arg;
 
-        if (!block)
-                return -ENODEV;
-
         if ((_IOC_DIR(cmd) != _IOC_NONE) && !arg) {
                 PRINT_DEBUG("empty data ptr");
                 return -EINVAL;
         }
 
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        block = base->block;
+        rc = 0;
         switch (cmd) {
         case BIODASDDISABLE:
-                return dasd_ioctl_disable(bdev);
+                rc = dasd_ioctl_disable(bdev);
+                break;
         case BIODASDENABLE:
-                return dasd_ioctl_enable(bdev);
+                rc = dasd_ioctl_enable(bdev);
+                break;
         case BIODASDQUIESCE:
-                return dasd_ioctl_quiesce(block);
+                rc = dasd_ioctl_quiesce(block);
+                break;
         case BIODASDRESUME:
-                return dasd_ioctl_resume(block);
+                rc = dasd_ioctl_resume(block);
+                break;
         case BIODASDFMT:
-                return dasd_ioctl_format(bdev, argp);
+                rc = dasd_ioctl_format(bdev, argp);
+                break;
         case BIODASDINFO:
-                return dasd_ioctl_information(block, cmd, argp);
+                rc = dasd_ioctl_information(block, cmd, argp);
+                break;
         case BIODASDINFO2:
-                return dasd_ioctl_information(block, cmd, argp);
+                rc = dasd_ioctl_information(block, cmd, argp);
+                break;
         case BIODASDPRRD:
-                return dasd_ioctl_read_profile(block, argp);
+                rc = dasd_ioctl_read_profile(block, argp);
+                break;
         case BIODASDPRRST:
-                return dasd_ioctl_reset_profile(block);
+                rc = dasd_ioctl_reset_profile(block);
+                break;
         case BLKROSET:
-                return dasd_ioctl_set_ro(bdev, argp);
+                rc = dasd_ioctl_set_ro(bdev, argp);
+                break;
         case DASDAPIVER:
-                return dasd_ioctl_api_version(argp);
+                rc = dasd_ioctl_api_version(argp);
+                break;
         case BIODASDCMFENABLE:
-                return enable_cmf(block->base->cdev);
+                rc = enable_cmf(base->cdev);
+                break;
         case BIODASDCMFDISABLE:
-                return disable_cmf(block->base->cdev);
+                rc = disable_cmf(base->cdev);
+                break;
         case BIODASDREADALLCMB:
-                return dasd_ioctl_readall_cmb(block, cmd, argp);
+                rc = dasd_ioctl_readall_cmb(block, cmd, argp);
+                break;
         default:
                 /* if the discipline has an ioctl method try it. */
-                if (block->base->discipline->ioctl) {
-                        int rval = block->base->discipline->ioctl(block, cmd, argp);
-                        if (rval != -ENOIOCTLCMD)
-                                return rval;
-                }
-
-                return -EINVAL;
+                if (base->discipline->ioctl) {
+                        rc = base->discipline->ioctl(block, cmd, argp);
+                        if (rc == -ENOIOCTLCMD)
+                                rc = -EINVAL;
+                } else
+                        rc = -EINVAL;
         }
+        dasd_put_device(base);
+        return rc;
 }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index c532ba929ccd..e8f267eb8887 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -407,8 +407,11 @@ static inline void account_sbals(struct qdio_q *q, int count)
         q->q_stats.nr_sbals[pos]++;
 }
 
-static void announce_buffer_error(struct qdio_q *q, int count)
+static void process_buffer_error(struct qdio_q *q, int count)
 {
+        unsigned char state = (q->is_input_q) ? SLSB_P_INPUT_NOT_INIT :
+                                        SLSB_P_OUTPUT_NOT_INIT;
+
         q->qdio_error |= QDIO_ERROR_SLSB_STATE;
 
         /* special handling for no target buffer empty */
@@ -426,6 +429,12 @@ static void announce_buffer_error(struct qdio_q *q, int count)
         DBF_ERROR("F14:%2x F15:%2x",
                   q->sbal[q->first_to_check]->element[14].flags & 0xff,
                   q->sbal[q->first_to_check]->element[15].flags & 0xff);
+
+        /*
+         * Interrupts may be avoided as long as the error is present
+         * so change the buffer state immediately to avoid starvation.
+         */
+        set_buf_states(q, q->first_to_check, state, count);
 }
 
 static inline void inbound_primed(struct qdio_q *q, int count)
@@ -506,8 +515,7 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
                         account_sbals(q, count);
                 break;
         case SLSB_P_INPUT_ERROR:
-                announce_buffer_error(q, count);
-                /* process the buffer, the upper layer will take care of it */
+                process_buffer_error(q, count);
                 q->first_to_check = add_buf(q->first_to_check, count);
                 atomic_sub(count, &q->nr_buf_used);
                 if (q->irq_ptr->perf_stat_enabled)
@@ -677,8 +685,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
                         account_sbals(q, count);
                 break;
         case SLSB_P_OUTPUT_ERROR:
-                announce_buffer_error(q, count);
-                /* process the buffer, the upper layer will take care of it */
+                process_buffer_error(q, count);
                 q->first_to_check = add_buf(q->first_to_check, count);
                 atomic_sub(count, &q->nr_buf_used);
                 if (q->irq_ptr->perf_stat_enabled)
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/kvm/kvm_virtio.c
index 414427d64a8f..607998f0b7d8 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/kvm/kvm_virtio.c
@@ -381,10 +381,10 @@ static void kvm_extint_handler(unsigned int ext_int_code,
         u16 subcode;
         u32 param;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
         subcode = ext_int_code >> 16;
         if ((subcode & 0xff00) != VIRTIO_SUBCODE_64)
                 return;
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
 
         /* The LSB might be overloaded, we have to mask it */
         vq = (struct virtqueue *)(param64 & ~1UL);
diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
index 564e6ecd17c2..0119b8147797 100644
--- a/drivers/scsi/device_handler/scsi_dh.c
+++ b/drivers/scsi/device_handler/scsi_dh.c
@@ -394,12 +394,14 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
         unsigned long flags;
         struct scsi_device *sdev;
         struct scsi_device_handler *scsi_dh = NULL;
+        struct device *dev = NULL;
 
         spin_lock_irqsave(q->queue_lock, flags);
         sdev = q->queuedata;
         if (sdev && sdev->scsi_dh_data)
                 scsi_dh = sdev->scsi_dh_data->scsi_dh;
-        if (!scsi_dh || !get_device(&sdev->sdev_gendev) ||
+        dev = get_device(&sdev->sdev_gendev);
+        if (!scsi_dh || !dev ||
             sdev->sdev_state == SDEV_CANCEL ||
             sdev->sdev_state == SDEV_DEL)
                 err = SCSI_DH_NOSYS;
@@ -410,12 +412,13 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
         if (err) {
                 if (fn)
                         fn(data, err);
-                return err;
+                goto out;
         }
 
         if (scsi_dh->activate)
                 err = scsi_dh->activate(sdev, fn, data);
-        put_device(&sdev->sdev_gendev);
+out:
+        put_device(dev);
         return err;
 }
 EXPORT_SYMBOL_GPL(scsi_dh_activate);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index 1c6d2b405eef..d72f1f2b1392 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
                 goto out;
         }
 
+        /* Check for overflow and wraparound */
+        if (karg.data_sge_offset * 4 > ioc->request_sz ||
+            karg.data_sge_offset > (UINT_MAX / 4)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         /* copy in request message frame from user */
         if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
                 printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
@@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
         Mpi2DiagBufferPostReply_t *mpi_reply;
         int rc, i;
         u8 buffer_type;
-        unsigned long timeleft;
+        unsigned long timeleft, request_size, copy_size;
         u16 smid;
         u16 ioc_status;
         u8 issue_reset = 0;
@@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
                 return -ENOMEM;
         }
 
+        request_size = ioc->diag_buffer_sz[buffer_type];
+
         if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
                 printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
                     "or bytes_to_read are not 4 byte aligned\n", ioc->name,
@@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
                 return -EINVAL;
         }
 
+        if (karg.starting_offset > request_size)
+                return -EINVAL;
+
         diag_data = (void *)(request_data + karg.starting_offset);
         dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), "
             "offset(%d), sz(%d)\n", ioc->name, __func__,
             diag_data, karg.starting_offset, karg.bytes_to_read));
 
+        /* Truncate data on requests that are too large */
+        if ((diag_data + karg.bytes_to_read < diag_data) ||
+            (diag_data + karg.bytes_to_read > request_data + request_size))
+                copy_size = request_size - karg.starting_offset;
+        else
+                copy_size = karg.bytes_to_read;
+
         if (copy_to_user((void __user *)uarg->diagnostic_data,
-            diag_data, karg.bytes_to_read)) {
+            diag_data, copy_size)) {
                 printk(MPT2SAS_ERR_FMT "%s: Unable to write "
                     "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
                     __func__, diag_data);
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 96d5ad0c1e42..7f636b118287 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3814,6 +3814,9 @@ static long pmcraid_ioctl_passthrough(
                         rc = -EFAULT;
                         goto out_free_buffer;
                 }
+        } else if (request_size < 0) {
+                rc = -EINVAL;
+                goto out_free_buffer;
         }
 
         /* check if we have any additional command parameters */
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ab55c2fa7ce2..0bac91e72370 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -400,10 +400,15 @@ static inline int scsi_host_is_busy(struct Scsi_Host *shost)
 static void scsi_run_queue(struct request_queue *q)
 {
         struct scsi_device *sdev = q->queuedata;
-        struct Scsi_Host *shost = sdev->host;
+        struct Scsi_Host *shost;
         LIST_HEAD(starved_list);
         unsigned long flags;
 
+        /* if the device is dead, sdev will be NULL, so no queue to run */
+        if (!sdev)
+                return;
+
+        shost = sdev->host;
         if (scsi_target(sdev)->single_lun)
                 scsi_single_lun_run(sdev);
 
@@ -411,8 +416,6 @@ static void scsi_run_queue(struct request_queue *q)
         list_splice_init(&shost->starved_list, &starved_list);
 
         while (!list_empty(&starved_list)) {
-                int flagset;
-
                 /*
                  * As long as shost is accepting commands and we have
                  * starved queues, call blk_run_queue. scsi_request_fn
@@ -435,20 +438,7 @@ static void scsi_run_queue(struct request_queue *q)
                         continue;
                 }
 
-                spin_unlock(shost->host_lock);
-
-                spin_lock(sdev->request_queue->queue_lock);
-                flagset = test_bit(QUEUE_FLAG_REENTER, &q->queue_flags) &&
-                                !test_bit(QUEUE_FLAG_REENTER,
-                                        &sdev->request_queue->queue_flags);
-                if (flagset)
-                        queue_flag_set(QUEUE_FLAG_REENTER, sdev->request_queue);
-                __blk_run_queue(sdev->request_queue);
-                if (flagset)
-                        queue_flag_clear(QUEUE_FLAG_REENTER, sdev->request_queue);
-                spin_unlock(sdev->request_queue->queue_lock);
-
-                spin_lock(shost->host_lock);
+                blk_run_queue_async(sdev->request_queue);
         }
         /* put any unprocessed entries back */
         list_splice(&starved_list, &shost->starved_list);
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index e44ff64233fd..e63912510fb9 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -322,14 +322,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
                 kfree(evt);
         }
 
-        if (sdev->request_queue) {
-                sdev->request_queue->queuedata = NULL;
-                /* user context needed to free queue */
-                scsi_free_queue(sdev->request_queue);
-                /* temporary expedient, try to catch use of queue lock
-                 * after free of sdev */
-                sdev->request_queue = NULL;
-        }
+        /* NULL queue means the device can't be used */
+        sdev->request_queue = NULL;
 
         scsi_target_reap(scsi_target(sdev));
 
@@ -937,6 +931,12 @@ void __scsi_remove_device(struct scsi_device *sdev)
         if (sdev->host->hostt->slave_destroy)
                 sdev->host->hostt->slave_destroy(sdev);
         transport_destroy_device(dev);
+
+        /* cause the request function to reject all I/O requests */
+        sdev->request_queue->queuedata = NULL;
+
+        /* Freeing the queue signals to block that we're done */
+        scsi_free_queue(sdev->request_queue);
         put_device(dev);
 }
 
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 28c33506e4ad..815069d13f9b 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3816,28 +3816,17 @@ fail_host_msg:
 static void
 fc_bsg_goose_queue(struct fc_rport *rport)
 {
-        int flagset;
-        unsigned long flags;
-
         if (!rport->rqst_q)
                 return;
 
+        /*
+         * This get/put dance makes no sense
+         */
         get_device(&rport->dev);
-
-        spin_lock_irqsave(rport->rqst_q->queue_lock, flags);
-        flagset = test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags) &&
-                  !test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags);
-        if (flagset)
-                queue_flag_set(QUEUE_FLAG_REENTER, rport->rqst_q);
-        __blk_run_queue(rport->rqst_q);
-        if (flagset)
-                queue_flag_clear(QUEUE_FLAG_REENTER, rport->rqst_q);
-        spin_unlock_irqrestore(rport->rqst_q->queue_lock, flags);
-
+        blk_run_queue_async(rport->rqst_q);
         put_device(&rport->dev);
 }
 
-
 /**
  * fc_bsg_rport_dispatch - process rport bsg requests and dispatch to LLDD
  * @q:          rport request queue
diff --git a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_hw.c b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_hw.c
index eeb7dd43f9a8..830822f86e41 100644
--- a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_hw.c
+++ b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_hw.c
@@ -2288,7 +2288,3 @@ err_dev:
         free_netdev(dev);
         return NULL;
 }
-
-EXPORT_SYMBOL(init_ft1000_card);
-EXPORT_SYMBOL(stop_ft1000_card);
-EXPORT_SYMBOL(flarion_ft1000_cnt);
diff --git a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
index 935608e72007..bdfb1aec58df 100644
--- a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
+++ b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
@@ -214,6 +214,3 @@ void ft1000CleanupProc(struct net_device *dev)
         remove_proc_entry(FT1000_PROC, init_net.proc_net);
         unregister_netdevice_notifier(&ft1000_netdev_notifier);
 }
-
-EXPORT_SYMBOL(ft1000InitProc);
-EXPORT_SYMBOL(ft1000CleanupProc);
diff --git a/drivers/staging/gma500/Kconfig b/drivers/staging/gma500/Kconfig
index 5501eb9b3355..ce8bedaeaac2 100644
--- a/drivers/staging/gma500/Kconfig
+++ b/drivers/staging/gma500/Kconfig
@@ -1,6 +1,6 @@
 config DRM_PSB
         tristate "Intel GMA500 KMS Framebuffer"
-        depends on DRM && PCI
+        depends on DRM && PCI && X86
         select FB_CFB_COPYAREA
         select FB_CFB_FILLRECT
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/staging/intel_sst/intelmid_v1_control.c b/drivers/staging/intel_sst/intelmid_v1_control.c
index 9cc15c1c18d4..1ea814218059 100644
--- a/drivers/staging/intel_sst/intelmid_v1_control.c
+++ b/drivers/staging/intel_sst/intelmid_v1_control.c
@@ -28,6 +28,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/pci.h>
+#include <linux/delay.h>
 #include <linux/file.h>
 #include <asm/mrst.h>
 #include <sound/pcm.h>
diff --git a/drivers/staging/intel_sst/intelmid_v2_control.c b/drivers/staging/intel_sst/intelmid_v2_control.c
index 26d815a67eb8..3c6b3abff3c3 100644
--- a/drivers/staging/intel_sst/intelmid_v2_control.c
+++ b/drivers/staging/intel_sst/intelmid_v2_control.c
@@ -29,6 +29,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/pci.h>
+#include <linux/delay.h>
 #include <linux/file.h>
 #include "intel_sst.h"
 #include "intelmid_snd_control.h"
diff --git a/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c b/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
index b5d21f6497f9..22c04eabed41 100644
--- a/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
+++ b/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
@@ -12,6 +12,7 @@
  */
 #include <linux/cs5535.h>
 #include <linux/gpio.h>
+#include <linux/delay.h>
 #include <asm/olpc.h>
 
 #include "olpc_dcon.h"
diff --git a/drivers/staging/rt2860/common/cmm_data_pci.c b/drivers/staging/rt2860/common/cmm_data_pci.c
index bef0bbd8cef7..f01a51c381f1 100644
--- a/drivers/staging/rt2860/common/cmm_data_pci.c
+++ b/drivers/staging/rt2860/common/cmm_data_pci.c
@@ -444,7 +444,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                         return (NDIS_STATUS_FAILURE);
                 }
         }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
         /* I am kind of doubting the U2M bit operation */
         /* if (pRxD->U2M == 0) */
         /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/rt2860/common/cmm_data_usb.c b/drivers/staging/rt2860/common/cmm_data_usb.c
index 5637857ae9eb..83a62faa7e57 100644
--- a/drivers/staging/rt2860/common/cmm_data_usb.c
+++ b/drivers/staging/rt2860/common/cmm_data_usb.c
@@ -860,7 +860,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("received packet too long\n"));
                 return NDIS_STATUS_FAILURE;
         }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
         /* I am kind of doubting the U2M bit operation */
         /* if (pRxD->U2M == 0) */
         /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/rts_pstor/debug.h b/drivers/staging/rts_pstor/debug.h
index e1408b0e7ae4..ab305be96fb5 100644
--- a/drivers/staging/rts_pstor/debug.h
+++ b/drivers/staging/rts_pstor/debug.h
@@ -28,7 +28,7 @@
 
 #define RTSX_STOR "rts_pstor: "
 
-#if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
 #define RTSX_DEBUGP(x...) printk(KERN_DEBUG RTSX_STOR x)
 #define RTSX_DEBUGPN(x...) printk(KERN_DEBUG x)
 #define RTSX_DEBUGPX(x...) printk(x)
diff --git a/drivers/staging/rts_pstor/ms.c b/drivers/staging/rts_pstor/ms.c
index 810e170894f5..d89795c6a3ac 100644
--- a/drivers/staging/rts_pstor/ms.c
+++ b/drivers/staging/rts_pstor/ms.c
@@ -23,6 +23,7 @@
 #include <linux/blkdev.h>
 #include <linux/kthread.h>
 #include <linux/sched.h>
+#include <linux/vmalloc.h>
 
 #include "rtsx.h"
 #include "rtsx_transport.h"
diff --git a/drivers/staging/rts_pstor/rtsx_chip.c b/drivers/staging/rts_pstor/rtsx_chip.c
index d2f1c715a684..4e60780ea804 100644
--- a/drivers/staging/rts_pstor/rtsx_chip.c
+++ b/drivers/staging/rts_pstor/rtsx_chip.c
@@ -24,6 +24,7 @@
 #include <linux/kthread.h>
 #include <linux/sched.h>
 #include <linux/workqueue.h>
+#include <linux/vmalloc.h>
 
 #include "rtsx.h"
 #include "rtsx_transport.h"
@@ -1311,11 +1312,11 @@ void rtsx_polling_func(struct rtsx_chip *chip)
 
 #ifdef SUPPORT_OCP
         if (CHECK_LUN_MODE(chip, SD_MS_2LUN)) {
-                #if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
                 if (chip->ocp_stat & (SD_OC_NOW | SD_OC_EVER | MS_OC_NOW | MS_OC_EVER)) {
                         RTSX_DEBUGP("Over current, OCPSTAT is 0x%x\n", chip->ocp_stat);
                 }
-                #endif
+#endif
 
                 if (chip->ocp_stat & (SD_OC_NOW | SD_OC_EVER)) {
                         if (chip->card_exist & SD_CARD) {
diff --git a/drivers/staging/rts_pstor/rtsx_scsi.c b/drivers/staging/rts_pstor/rtsx_scsi.c
index 20c2464a20f9..7de1fae443fc 100644
--- a/drivers/staging/rts_pstor/rtsx_scsi.c
+++ b/drivers/staging/rts_pstor/rtsx_scsi.c
@@ -23,6 +23,7 @@
 #include <linux/blkdev.h>
 #include <linux/kthread.h>
 #include <linux/sched.h>
+#include <linux/vmalloc.h>
 
 #include "rtsx.h"
 #include "rtsx_transport.h"
diff --git a/drivers/staging/rts_pstor/sd.c b/drivers/staging/rts_pstor/sd.c
index 8d066bd428c4..b1277a6c7a8b 100644
--- a/drivers/staging/rts_pstor/sd.c
+++ b/drivers/staging/rts_pstor/sd.c
@@ -909,7 +909,7 @@ static int sd_change_phase(struct rtsx_chip *chip, u8 sample_point, u8 tune_dir)
                 RTSX_WRITE_REG(chip, SD_VPCLK0_CTL, PHASE_NOT_RESET, PHASE_NOT_RESET);
                 RTSX_WRITE_REG(chip, CLK_CTL, CHANGE_CLK, 0);
         } else {
-#if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
                 rtsx_read_register(chip, SD_VP_CTL, &val);
                 RTSX_DEBUGP("SD_VP_CTL: 0x%x\n", val);
                 rtsx_read_register(chip, SD_DCMPS_CTL, &val);
@@ -958,7 +958,7 @@ static int sd_change_phase(struct rtsx_chip *chip, u8 sample_point, u8 tune_dir)
         return STATUS_SUCCESS;
 
 Fail:
-#if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
         rtsx_read_register(chip, SD_VP_CTL, &val);
         RTSX_DEBUGP("SD_VP_CTL: 0x%x\n", val);
         rtsx_read_register(chip, SD_DCMPS_CTL, &val);
diff --git a/drivers/staging/rts_pstor/trace.h b/drivers/staging/rts_pstor/trace.h
index 2c668bae6ff4..bc83b49a4eb4 100644
--- a/drivers/staging/rts_pstor/trace.h
+++ b/drivers/staging/rts_pstor/trace.h
@@ -82,7 +82,7 @@ do {													\
 #define TRACE_GOTO(chip, label) goto label
 #endif
 
-#if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
 static inline void rtsx_dump(u8 *buf, int buf_len)
 {
         int i;
diff --git a/drivers/staging/rts_pstor/xd.c b/drivers/staging/rts_pstor/xd.c
index 7bcd468b8f2c..9f3add1e8f59 100644
--- a/drivers/staging/rts_pstor/xd.c
+++ b/drivers/staging/rts_pstor/xd.c
@@ -23,6 +23,7 @@
 #include <linux/blkdev.h>
 #include <linux/kthread.h>
 #include <linux/sched.h>
+#include <linux/vmalloc.h>
 
 #include "rtsx.h"
 #include "rtsx_transport.h"
diff --git a/drivers/staging/solo6x10/Kconfig b/drivers/staging/solo6x10/Kconfig
index 2cf77c940860..03dcac4ea4d0 100644
--- a/drivers/staging/solo6x10/Kconfig
+++ b/drivers/staging/solo6x10/Kconfig
@@ -2,6 +2,7 @@ config SOLO6X10
         tristate "Softlogic 6x10 MPEG codec cards"
         depends on PCI && VIDEO_DEV && SND && I2C
         select VIDEOBUF_DMA_SG
+        select SND_PCM
         ---help---
           This driver supports the Softlogic based MPEG-4 and h.264 codec
           codec cards.
diff --git a/drivers/staging/spectra/ffsport.c b/drivers/staging/spectra/ffsport.c
index 20dae73d3b78..506547b603e1 100644
--- a/drivers/staging/spectra/ffsport.c
+++ b/drivers/staging/spectra/ffsport.c
@@ -653,7 +653,7 @@ static int SBD_setup_device(struct spectra_nand_dev *dev, int which)
         }
         dev->queue->queuedata = dev;
 
-        /* As Linux block layer does't support >4KB hardware sector,  */
+        /* As Linux block layer doesn't support >4KB hardware sector,  */
         /* Here we force report 512 byte hardware sector size to Kernel */
         blk_queue_logical_block_size(dev->queue, 512);
 
diff --git a/drivers/staging/tidspbridge/dynload/cload.c b/drivers/staging/tidspbridge/dynload/cload.c
index 5cecd237e3f6..fe1ef0addb09 100644
--- a/drivers/staging/tidspbridge/dynload/cload.c
+++ b/drivers/staging/tidspbridge/dynload/cload.c
@@ -718,7 +718,7 @@ static void dload_symbols(struct dload_state *dlthis)
          * as a temporary for .dllview record construction.
          * Allocate storage for the whole table.  Add 1 to the section count
          * in case a trampoline section is auto-generated as well as the
-         * size of the trampoline section name so DLLView does't get lost.
+         * size of the trampoline section name so DLLView doesn't get lost.
          */
 
         siz = sym_count * sizeof(struct local_symbol);
diff --git a/drivers/staging/tty/specialix.c b/drivers/staging/tty/specialix.c
index cb24c6d999db..5c3598ec7456 100644
--- a/drivers/staging/tty/specialix.c
+++ b/drivers/staging/tty/specialix.c
@@ -978,7 +978,7 @@ static void sx_change_speed(struct specialix_board *bp,
         spin_lock_irqsave(&bp->lock, flags);
         sx_out(bp, CD186x_CAR, port_No(port));
 
-        /* The Specialix board does't implement the RTS lines.
+        /* The Specialix board doesn't implement the RTS lines.
            They are used to set the IRQ level. Don't touch them. */
         if (sx_crtscts(tty))
                 port->MSVR = MSVR_DTR | (sx_in(bp, CD186x_MSVR) & MSVR_RTS);
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 0f02a4b12ae4..4f4f13321f40 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -876,8 +876,10 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
         }
 
         /* kill threads related to this sdev, if v.c. exists */
-        kthread_stop(vdev->ud.tcp_rx);
-        kthread_stop(vdev->ud.tcp_tx);
+        if (vdev->ud.tcp_rx)
+                kthread_stop(vdev->ud.tcp_rx);
+        if (vdev->ud.tcp_tx)
+                kthread_stop(vdev->ud.tcp_tx);
 
         usbip_uinfo("stop threads\n");
 
@@ -949,9 +951,6 @@ static void vhci_device_init(struct vhci_device *vdev)
 {
         memset(vdev, 0, sizeof(*vdev));
 
-        vdev->ud.tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx");
-        vdev->ud.tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx");
-
         vdev->ud.side   = USBIP_VHCI;
         vdev->ud.status = VDEV_ST_NULL;
         /* vdev->ud.lock   = SPIN_LOCK_UNLOCKED; */
@@ -1139,7 +1138,7 @@ static int vhci_hcd_probe(struct platform_device *pdev)
                 usbip_uerr("create hcd failed\n");
                 return -ENOMEM;
         }
-
+        hcd->has_tt = 1;
 
         /* this is private data for vhci_hcd */
         the_controller = hcd_to_vhci(hcd);
diff --git a/drivers/staging/usbip/vhci_sysfs.c b/drivers/staging/usbip/vhci_sysfs.c
index 3f2459f30415..e2dadbd5ef1e 100644
--- a/drivers/staging/usbip/vhci_sysfs.c
+++ b/drivers/staging/usbip/vhci_sysfs.c
@@ -21,6 +21,7 @@
 #include "vhci.h"
 
 #include <linux/in.h>
+#include <linux/kthread.h>
 
 /* TODO: refine locking ?*/
 
@@ -220,13 +221,13 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
         vdev->ud.tcp_socket = socket;
         vdev->ud.status     = VDEV_ST_NOTASSIGNED;
 
-        wake_up_process(vdev->ud.tcp_rx);
-        wake_up_process(vdev->ud.tcp_tx);
-
         spin_unlock(&vdev->ud.lock);
         spin_unlock(&the_controller->lock);
         /* end the lock */
 
+        vdev->ud.tcp_rx = kthread_run(vhci_rx_loop, &vdev->ud, "vhci_rx");
+        vdev->ud.tcp_tx = kthread_run(vhci_tx_loop, &vdev->ud, "vhci_tx");
+
         rh_port_connect(rhport, speed);
 
         return count;
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index 6a71f52c59b1..76378397b763 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -273,7 +273,7 @@ exit:
 }
 
 int prism2_set_default_key(struct wiphy *wiphy, struct net_device *dev,
-                           u8 key_index)
+                           u8 key_index, bool unicast, bool multicast)
 {
         wlandevice_t *wlandev = dev->ml_priv;
 
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 47f8cdb207f1..74273e638c0d 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -1658,8 +1658,12 @@ static void gsm_queue(struct gsm_mux *gsm)
 
         if ((gsm->control & ~PF) == UI)
                 gsm->fcs = gsm_fcs_add_block(gsm->fcs, gsm->buf, gsm->len);
-        /* generate final CRC with received FCS */
-        gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->received_fcs);
+        if (gsm->encoding == 0){
+                /* WARNING: gsm->received_fcs is used for gsm->encoding = 0 only.
+                            In this case it contain the last piece of data
+                            required to generate final CRC */
+                gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->received_fcs);
+        }
         if (gsm->fcs != GOOD_FCS) {
                 gsm->bad_fcs++;
                 if (debug & 4)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index cb36b0d4ef3c..62df72d9f0aa 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -382,12 +382,13 @@ static void imx_start_tx(struct uart_port *port)
 static irqreturn_t imx_rtsint(int irq, void *dev_id)
 {
         struct imx_port *sport = dev_id;
-        unsigned int val = readl(sport->port.membase + USR1) & USR1_RTSS;
+        unsigned int val;
         unsigned long flags;
 
         spin_lock_irqsave(&sport->port.lock, flags);
 
         writel(USR1_RTSD, sport->port.membase + USR1);
+        val = readl(sport->port.membase + USR1) & USR1_RTSS;
         uart_handle_cts_change(&sport->port, !!val);
         wake_up_interruptible(&sport->port.state->port.delta_msr_wait);
 
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 7e41a95c5ceb..627f3a678759 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -40,6 +40,7 @@
 #include <linux/slab.h>
 #include <linux/usb/ulpi.h>
 #include <plat/usb.h>
+#include <linux/regulator/consumer.h>
 
 /* EHCI Register Set */
 #define EHCI_INSNREG04                                  (0xA0)
@@ -118,6 +119,8 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
         struct ehci_hcd                         *omap_ehci;
         int                                     ret = -ENODEV;
         int                                     irq;
+        int                                     i;
+        char                                    supply[7];
 
         if (usb_disabled())
                 return -ENODEV;
@@ -158,6 +161,23 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
         hcd->rsrc_len = resource_size(res);
         hcd->regs = regs;
 
+        /* get ehci regulator and enable */
+        for (i = 0 ; i < OMAP3_HS_USB_PORTS ; i++) {
+                if (pdata->port_mode[i] != OMAP_EHCI_PORT_MODE_PHY) {
+                        pdata->regulator[i] = NULL;
+                        continue;
+                }
+                snprintf(supply, sizeof(supply), "hsusb%d", i);
+                pdata->regulator[i] = regulator_get(dev, supply);
+                if (IS_ERR(pdata->regulator[i])) {
+                        pdata->regulator[i] = NULL;
+                        dev_dbg(dev,
+                        "failed to get ehci port%d regulator\n", i);
+                } else {
+                        regulator_enable(pdata->regulator[i]);
+                }
+        }
+
         ret = omap_usbhs_enable(dev);
         if (ret) {
                 dev_err(dev, "failed to start usbhs with err %d\n", ret);
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index 795345ad45e6..7b2e69aa2e98 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -1633,6 +1633,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                         ints[i].qh = NULL;
                         ints[i].qtd = NULL;
 
+                        urb->status = status;
                         isp1760_urb_done(hcd, urb);
                         if (qtd)
                                 pe(hcd, qh, qtd);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index a78f2ebd11b7..73f75d26436c 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -777,7 +777,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                 if (t1 != t2)
                         xhci_writel(xhci, t2, port_array[port_index]);
 
-                if (DEV_HIGHSPEED(t1)) {
+                if (hcd->speed != HCD_USB3) {
                         /* enable remote wake up for USB 2.0 */
                         u32 __iomem *addr;
                         u32 tmp;
@@ -866,6 +866,21 @@ int xhci_bus_resume(struct usb_hcd *hcd)
                                 temp |= PORT_LINK_STROBE | XDEV_U0;
                                 xhci_writel(xhci, temp, port_array[port_index]);
                         }
+                        /* wait for the port to enter U0 and report port link
+                         * state change.
+                         */
+                        spin_unlock_irqrestore(&xhci->lock, flags);
+                        msleep(20);
+                        spin_lock_irqsave(&xhci->lock, flags);
+
+                        /* Clear PLC */
+                        temp = xhci_readl(xhci, port_array[port_index]);
+                        if (temp & PORT_PLC) {
+                                temp = xhci_port_state_to_neutral(temp);
+                                temp |= PORT_PLC;
+                                xhci_writel(xhci, temp, port_array[port_index]);
+                        }
+
                         slot_id = xhci_find_slot_id_by_port(hcd,
                                         xhci, port_index + 1);
                         if (slot_id)
@@ -873,7 +888,7 @@ int xhci_bus_resume(struct usb_hcd *hcd)
                 } else
                         xhci_writel(xhci, temp, port_array[port_index]);
 
-                if (DEV_HIGHSPEED(temp)) {
+                if (hcd->speed != HCD_USB3) {
                         /* disable remote wake up for USB 2.0 */
                         u32 __iomem *addr;
                         u32 tmp;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 6dfbf9ffd7a6..f47c20197c61 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1887,11 +1887,9 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                         otg_set_vbus(musb->xceiv, 1);
 
                 hcd->self.uses_pio_for_control = 1;
-
-                if (musb->xceiv->last_event == USB_EVENT_NONE)
-                        pm_runtime_put(musb->controller);
-
         }
+        if (musb->xceiv->last_event == USB_EVENT_NONE)
+                pm_runtime_put(musb->controller);
 
         return 0;
 
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 57a27fa954b4..e9e60b6e0583 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -270,7 +270,7 @@ static int musb_otg_notifications(struct notifier_block *nb,
                 DBG(4, "VBUS Disconnect\n");
 
 #ifdef CONFIG_USB_GADGET_MUSB_HDRC
-                if (is_otg_enabled(musb))
+                if (is_otg_enabled(musb) || is_peripheral_enabled(musb))
                         if (musb->gadget_driver)
 #endif
                         {
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index 4fb5b2bf2348..4bcc8b82640b 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -590,15 +590,10 @@ static struct virtio_config_ops virtio_pci_config_ops = {
 
 static void virtio_pci_release_dev(struct device *_d)
 {
-        struct virtio_device *dev = container_of(_d, struct virtio_device, dev);
+        struct virtio_device *dev = container_of(_d, struct virtio_device,
+                                                 dev);
         struct virtio_pci_device *vp_dev = to_vp_device(dev);
-        struct pci_dev *pci_dev = vp_dev->pci_dev;
 
-        vp_del_vqs(dev);
-        pci_set_drvdata(pci_dev, NULL);
-        pci_iounmap(pci_dev, vp_dev->ioaddr);
-        pci_release_regions(pci_dev);
-        pci_disable_device(pci_dev);
         kfree(vp_dev);
 }
 
@@ -681,6 +676,12 @@ static void __devexit virtio_pci_remove(struct pci_dev *pci_dev)
         struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
 
         unregister_virtio_device(&vp_dev->vdev);
+
+        vp_del_vqs(&vp_dev->vdev);
+        pci_set_drvdata(pci_dev, NULL);
+        pci_iounmap(pci_dev, vp_dev->ioaddr);
+        pci_release_regions(pci_dev);
+        pci_disable_device(pci_dev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index cc2f73e03475..b0043fb26a4d 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -371,6 +371,7 @@ void *virtqueue_detach_unused_buf(struct virtqueue *_vq)
                 /* detach_buf clears data, so grab it now. */
                 buf = vq->data[i];
                 detach_buf(vq, i);
+                vq->vring.avail->idx--;
                 END_USE(vq);
                 return buf;
         }
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index 35a0d12dad73..5fd020da7c55 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -35,6 +35,7 @@
  *      document number 324645-001, 324646-001: Cougar Point (CPT)
  *      document number TBD                   : Patsburg (PBG)
  *      document number TBD                   : DH89xxCC
+ *      document number TBD                   : Panther Point
  */
 
 /*
@@ -153,6 +154,38 @@ enum iTCO_chipsets {
         TCO_PBG1,       /* Patsburg */
         TCO_PBG2,       /* Patsburg */
         TCO_DH89XXCC,   /* DH89xxCC */
+        TCO_PPT0,       /* Panther Point */
+        TCO_PPT1,       /* Panther Point */
+        TCO_PPT2,       /* Panther Point */
+        TCO_PPT3,       /* Panther Point */
+        TCO_PPT4,       /* Panther Point */
+        TCO_PPT5,       /* Panther Point */
+        TCO_PPT6,       /* Panther Point */
+        TCO_PPT7,       /* Panther Point */
+        TCO_PPT8,       /* Panther Point */
+        TCO_PPT9,       /* Panther Point */
+        TCO_PPT10,      /* Panther Point */
+        TCO_PPT11,      /* Panther Point */
+        TCO_PPT12,      /* Panther Point */
+        TCO_PPT13,      /* Panther Point */
+        TCO_PPT14,      /* Panther Point */
+        TCO_PPT15,      /* Panther Point */
+        TCO_PPT16,      /* Panther Point */
+        TCO_PPT17,      /* Panther Point */
+        TCO_PPT18,      /* Panther Point */
+        TCO_PPT19,      /* Panther Point */
+        TCO_PPT20,      /* Panther Point */
+        TCO_PPT21,      /* Panther Point */
+        TCO_PPT22,      /* Panther Point */
+        TCO_PPT23,      /* Panther Point */
+        TCO_PPT24,      /* Panther Point */
+        TCO_PPT25,      /* Panther Point */
+        TCO_PPT26,      /* Panther Point */
+        TCO_PPT27,      /* Panther Point */
+        TCO_PPT28,      /* Panther Point */
+        TCO_PPT29,      /* Panther Point */
+        TCO_PPT30,      /* Panther Point */
+        TCO_PPT31,      /* Panther Point */
 };
 
 static struct {
@@ -244,6 +277,38 @@ static struct {
         {"Patsburg", 2},
         {"Patsburg", 2},
         {"DH89xxCC", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
         {NULL, 0}
 };
 
@@ -363,6 +428,38 @@ static DEFINE_PCI_DEVICE_TABLE(iTCO_wdt_pci_tbl) = {
         { ITCO_PCI_DEVICE(0x1d40,                               TCO_PBG1)},
         { ITCO_PCI_DEVICE(0x1d41,                               TCO_PBG2)},
         { ITCO_PCI_DEVICE(0x2310,                               TCO_DH89XXCC)},
+        { ITCO_PCI_DEVICE(0x1e40,                               TCO_PPT0)},
+        { ITCO_PCI_DEVICE(0x1e41,                               TCO_PPT1)},
+        { ITCO_PCI_DEVICE(0x1e42,                               TCO_PPT2)},
+        { ITCO_PCI_DEVICE(0x1e43,                               TCO_PPT3)},
+        { ITCO_PCI_DEVICE(0x1e44,                               TCO_PPT4)},
+        { ITCO_PCI_DEVICE(0x1e45,                               TCO_PPT5)},
+        { ITCO_PCI_DEVICE(0x1e46,                               TCO_PPT6)},
+        { ITCO_PCI_DEVICE(0x1e47,                               TCO_PPT7)},
+        { ITCO_PCI_DEVICE(0x1e48,                               TCO_PPT8)},
+        { ITCO_PCI_DEVICE(0x1e49,                               TCO_PPT9)},
+        { ITCO_PCI_DEVICE(0x1e4a,                               TCO_PPT10)},
+        { ITCO_PCI_DEVICE(0x1e4b,                               TCO_PPT11)},
+        { ITCO_PCI_DEVICE(0x1e4c,                               TCO_PPT12)},
+        { ITCO_PCI_DEVICE(0x1e4d,                               TCO_PPT13)},
+        { ITCO_PCI_DEVICE(0x1e4e,                               TCO_PPT14)},
+        { ITCO_PCI_DEVICE(0x1e4f,                               TCO_PPT15)},
+        { ITCO_PCI_DEVICE(0x1e50,                               TCO_PPT16)},
+        { ITCO_PCI_DEVICE(0x1e51,                               TCO_PPT17)},
+        { ITCO_PCI_DEVICE(0x1e52,                               TCO_PPT18)},
+        { ITCO_PCI_DEVICE(0x1e53,                               TCO_PPT19)},
+        { ITCO_PCI_DEVICE(0x1e54,                               TCO_PPT20)},
+        { ITCO_PCI_DEVICE(0x1e55,                               TCO_PPT21)},
+        { ITCO_PCI_DEVICE(0x1e56,                               TCO_PPT22)},
+        { ITCO_PCI_DEVICE(0x1e57,                               TCO_PPT23)},
+        { ITCO_PCI_DEVICE(0x1e58,                               TCO_PPT24)},
+        { ITCO_PCI_DEVICE(0x1e59,                               TCO_PPT25)},
+        { ITCO_PCI_DEVICE(0x1e5a,                               TCO_PPT26)},
+        { ITCO_PCI_DEVICE(0x1e5b,                               TCO_PPT27)},
+        { ITCO_PCI_DEVICE(0x1e5c,                               TCO_PPT28)},
+        { ITCO_PCI_DEVICE(0x1e5d,                               TCO_PPT29)},
+        { ITCO_PCI_DEVICE(0x1e5e,                               TCO_PPT30)},
+        { ITCO_PCI_DEVICE(0x1e5f,                               TCO_PPT31)},
         { 0, },                 /* End of list */
 };
 MODULE_DEVICE_TABLE(pci, iTCO_wdt_pci_tbl);
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 1ac94125bf93..a2eee574784e 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -8,6 +8,7 @@
 #include <linux/sysrq.h>
 #include <linux/stop_machine.h>
 #include <linux/freezer.h>
+#include <linux/syscore_ops.h>
 
 #include <xen/xen.h>
 #include <xen/xenbus.h>
@@ -70,8 +71,13 @@ static int xen_suspend(void *data)
         BUG_ON(!irqs_disabled());
 
         err = sysdev_suspend(PMSG_FREEZE);
+        if (!err) {
+                err = syscore_suspend();
+                if (err)
+                        sysdev_resume();
+        }
         if (err) {
-                printk(KERN_ERR "xen_suspend: sysdev_suspend failed: %d\n",
+                printk(KERN_ERR "xen_suspend: system core suspend failed: %d\n",
                         err);
                 return err;
         }
@@ -95,6 +101,7 @@ static int xen_suspend(void *data)
                 xen_timer_resume();
         }
 
+        syscore_resume();
         sysdev_resume();
 
         return 0;