Merge commit 'v2.6.34-rc6' into perf/core

Merge reason: update to the latest -rc.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

83 files changed, 3258 insertions, 387 deletions

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 67e0fc542249..93d1f9b469d4 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1695,6 +1695,7 @@ int drbd_send_protocol(struct drbd_conf *mdev)
                         cf |= CF_DRY_RUN;
                 else {
                         dev_err(DEV, "--dry-run is not supported by peer");
+                        kfree(p);
                         return 0;
                 }
         }
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index ed9f1de24a71..3f096e7959b4 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -899,7 +899,8 @@ retry:
 
         drbd_thread_start(&mdev->asender);
 
-        drbd_send_protocol(mdev);
+        if (!drbd_send_protocol(mdev))
+                return -1;
         drbd_send_sync_param(mdev, &mdev->sync_conf);
         drbd_send_sizes(mdev, 0);
         drbd_send_uuids(mdev);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index ddf19425245d..8a549db2aa78 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -48,6 +48,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/compat.h>
 #include <linux/kthread.h>
 #include <linux/errno.h>
 #include <linux/spinlock.h>
@@ -2984,7 +2985,7 @@ static void pkt_get_status(struct pkt_ctrl_command *ctrl_cmd)
         mutex_unlock(&ctl_mutex);
 }
 
-static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
+static long pkt_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         void __user *argp = (void __user *)arg;
         struct pkt_ctrl_command ctrl_cmd;
@@ -3021,10 +3022,20 @@ static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cm
         return ret;
 }
 
+#ifdef CONFIG_COMPAT
+static long pkt_ctl_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        return pkt_ctl_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
+}
+#endif
 
 static const struct file_operations pkt_ctl_fops = {
-        .ioctl   = pkt_ctl_ioctl,
-        .owner   = THIS_MODULE,
+        .open           = nonseekable_open,
+        .unlocked_ioctl = pkt_ctl_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = pkt_ctl_compat_ioctl,
+#endif
+        .owner          = THIS_MODULE,
 };
 
 static struct miscdevice pkt_misc = {
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 2d5d575e889d..75d293eeb3ee 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1113,6 +1113,8 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
         unsigned int cpu = sys_dev->id;
         unsigned long flags;
         struct cpufreq_policy *data;
+        struct kobject *kobj;
+        struct completion *cmp;
 #ifdef CONFIG_SMP
         struct sys_device *cpu_sys_dev;
         unsigned int j;
@@ -1141,10 +1143,11 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
                 dprintk("removing link\n");
                 cpumask_clear_cpu(cpu, data->cpus);
                 spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
-                sysfs_remove_link(&sys_dev->kobj, "cpufreq");
+                kobj = &sys_dev->kobj;
                 cpufreq_cpu_put(data);
                 cpufreq_debug_enable_ratelimit();
                 unlock_policy_rwsem_write(cpu);
+                sysfs_remove_link(kobj, "cpufreq");
                 return 0;
         }
 #endif
@@ -1181,7 +1184,10 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
                                 data->governor->name, CPUFREQ_NAME_LEN);
 #endif
                         cpu_sys_dev = get_cpu_sysdev(j);
-                        sysfs_remove_link(&cpu_sys_dev->kobj, "cpufreq");
+                        kobj = &cpu_sys_dev->kobj;
+                        unlock_policy_rwsem_write(cpu);
+                        sysfs_remove_link(kobj, "cpufreq");
+                        lock_policy_rwsem_write(cpu);
                         cpufreq_cpu_put(data);
                 }
         }
@@ -1192,19 +1198,22 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
         if (cpufreq_driver->target)
                 __cpufreq_governor(data, CPUFREQ_GOV_STOP);
 
-        kobject_put(&data->kobj);
+        kobj = &data->kobj;
+        cmp = &data->kobj_unregister;
+        unlock_policy_rwsem_write(cpu);
+        kobject_put(kobj);
 
         /* we need to make sure that the underlying kobj is actually
          * not referenced anymore by anybody before we proceed with
          * unloading.
          */
         dprintk("waiting for dropping of refcount\n");
-        wait_for_completion(&data->kobj_unregister);
+        wait_for_completion(cmp);
         dprintk("wait complete\n");
 
+        lock_policy_rwsem_write(cpu);
         if (cpufreq_driver->exit)
                 cpufreq_driver->exit(data);
-
         unlock_policy_rwsem_write(cpu);
 
         free_cpumask_var(data->related_cpus);
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 599a40b25cb0..3a147874a465 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -444,6 +444,7 @@ static struct attribute_group dbs_attr_group_old = {
 static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
 {
         unsigned int load = 0;
+        unsigned int max_load = 0;
         unsigned int freq_target;
 
         struct cpufreq_policy *policy;
@@ -501,6 +502,9 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                         continue;
 
                 load = 100 * (wall_time - idle_time) / wall_time;
+
+                if (load > max_load)
+                        max_load = load;
         }
 
         /*
@@ -511,7 +515,7 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                 return;
 
         /* Check for frequency increase */
-        if (load > dbs_tuners_ins.up_threshold) {
+        if (max_load > dbs_tuners_ins.up_threshold) {
                 this_dbs_info->down_skip = 0;
 
                 /* if we are already at full speed then break out early */
@@ -538,7 +542,7 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
          * can support the current CPU usage without triggering the up
          * policy. To be safe, we focus 10 points under the threshold.
          */
-        if (load < (dbs_tuners_ins.down_threshold - 10)) {
+        if (max_load < (dbs_tuners_ins.down_threshold - 10)) {
                 freq_target = (dbs_tuners_ins.freq_step * policy->max) / 100;
 
                 this_dbs_info->requested_freq -= freq_target;
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 7d521e1d17e1..b827c976dc62 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -252,6 +252,18 @@ static void pca953x_irq_bus_lock(unsigned int irq)
 static void pca953x_irq_bus_sync_unlock(unsigned int irq)
 {
         struct pca953x_chip *chip = get_irq_chip_data(irq);
+        uint16_t new_irqs;
+        uint16_t level;
+
+        /* Look for any newly setup interrupt */
+        new_irqs = chip->irq_trig_fall | chip->irq_trig_raise;
+        new_irqs &= ~chip->reg_direction;
+
+        while (new_irqs) {
+                level = __ffs(new_irqs);
+                pca953x_gpio_direction_input(&chip->gpio_chip, level);
+                new_irqs &= ~(1 << level);
+        }
 
         mutex_unlock(&chip->irq_lock);
 }
@@ -278,7 +290,7 @@ static int pca953x_irq_set_type(unsigned int irq, unsigned int type)
         else
                 chip->irq_trig_raise &= ~mask;
 
-        return pca953x_gpio_direction_input(&chip->gpio_chip, level);
+        return 0;
 }
 
 static struct irq_chip pca953x_irq_chip = {
diff --git a/drivers/gpio/pl061.c b/drivers/gpio/pl061.c
index 5ad8f778ced4..105701a1f05b 100644
--- a/drivers/gpio/pl061.c
+++ b/drivers/gpio/pl061.c
@@ -91,6 +91,12 @@ static int pl061_direction_output(struct gpio_chip *gc, unsigned offset,
         gpiodir = readb(chip->base + GPIODIR);
         gpiodir |= 1 << offset;
         writeb(gpiodir, chip->base + GPIODIR);
+
+        /*
+         * gpio value is set again, because pl061 doesn't allow to set value of
+         * a gpio pin before configuring it in OUT mode.
+         */
+        writeb(!!value << offset, chip->base + (1 << (offset + 2)));
         spin_unlock_irqrestore(&chip->lock, flags);
 
         return 0;
@@ -183,7 +189,7 @@ static int pl061_irq_type(unsigned irq, unsigned trigger)
                 gpioibe &= ~(1 << offset);
                 if (trigger & IRQ_TYPE_EDGE_RISING)
                         gpioiev |= 1 << offset;
-                else
+                else if (trigger & IRQ_TYPE_EDGE_FALLING)
                         gpioiev &= ~(1 << offset);
         }
         writeb(gpioibe, chip->base + GPIOIBE);
@@ -204,7 +210,7 @@ static struct irq_chip pl061_irqchip = {
 
 static void pl061_irq_handler(unsigned irq, struct irq_desc *desc)
 {
-        struct list_head *chip_list = get_irq_chip_data(irq);
+        struct list_head *chip_list = get_irq_data(irq);
         struct list_head *ptr;
         struct pl061_gpio *chip;
 
@@ -297,9 +303,9 @@ static int __init pl061_probe(struct amba_device *dev, struct amba_id *id)
                         goto iounmap;
                 }
                 INIT_LIST_HEAD(chip_list);
-                set_irq_chip_data(irq, chip_list);
+                set_irq_data(irq, chip_list);
         } else
-                chip_list = get_irq_chip_data(irq);
+                chip_list = get_irq_data(irq);
         list_add(&chip->list, chip_list);
 
         for (i = 0; i < PL061_GPIO_NR; i++) {
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 3bd872761567..a263b7070fc6 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -476,6 +476,7 @@ void drm_vblank_off(struct drm_device *dev, int crtc)
         unsigned long irqflags;
 
         spin_lock_irqsave(&dev->vbl_lock, irqflags);
+        dev->driver->disable_vblank(dev, crtc);
         DRM_WAKEUP(&dev->vbl_queue[crtc]);
         dev->vblank_enabled[crtc] = 0;
         dev->last_vblank[crtc] = dev->driver->get_vblank_counter(dev, crtc);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 7f52cc124cfe..ef3d91dda71a 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1793,7 +1793,7 @@ i915_get_gem_seqno(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
 
-        if (IS_I965G(dev))
+        if (HAS_PIPE_CONTROL(dev))
                 return ((volatile u32 *)(dev_priv->seqno_page))[0];
         else
                 return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index bd75f99bd65e..eaf1f6bc44f1 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -324,13 +324,12 @@ void r300_gpu_init(struct radeon_device *rdev)
         uint32_t gb_tile_config, tmp;
 
         r100_hdp_reset(rdev);
-        /* FIXME: rv380 one pipes ? */
         if ((rdev->family == CHIP_R300 && rdev->pdev->device != 0x4144) ||
-            (rdev->family == CHIP_R350)) {
+            (rdev->family == CHIP_R350 && rdev->pdev->device != 0x4148)) {
                 /* r300,r350 */
                 rdev->num_gb_pipes = 2;
         } else {
-                /* rv350,rv370,rv380,r300 AD */
+                /* rv350,rv370,rv380,r300 AD, r350 AH */
                 rdev->num_gb_pipes = 1;
         }
         rdev->num_z_pipes = 1;
diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
index ea46d558e8f3..c5c2742e4140 100644
--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
+++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
@@ -921,7 +921,7 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
 
         ptr_addr = drm_buffer_read_object(cmdbuf->buffer,
                         sizeof(stack_ptr_addr), &stack_ptr_addr);
-        ref_age_base = (u32 *)(unsigned long)*ptr_addr;
+        ref_age_base = (u32 *)(unsigned long)get_unaligned(ptr_addr);
 
         for (i=0; i < header.scratch.n_bufs; i++) {
                 buf_idx = drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 3dc968c9f5a4..c2bda4ad62e7 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -59,6 +59,12 @@ void r420_pipes_init(struct radeon_device *rdev)
         /* get max number of pipes */
         gb_pipe_select = RREG32(0x402C);
         num_pipes = ((gb_pipe_select >> 12) & 3) + 1;
+
+        /* SE chips have 1 pipe */
+        if ((rdev->pdev->device == 0x5e4c) ||
+            (rdev->pdev->device == 0x5e4f))
+                num_pipes = 1;
+
         rdev->num_gb_pipes = num_pipes;
         tmp = 0;
         switch (num_pipes) {
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 419630dd2075..2f042a3c0e62 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -435,14 +435,19 @@ static void radeon_init_pipes(struct drm_device *dev)
         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R420) {
                 gb_pipe_sel = RADEON_READ(R400_GB_PIPE_SELECT);
                 dev_priv->num_gb_pipes = ((gb_pipe_sel >> 12) & 0x3) + 1;
+                /* SE cards have 1 pipe */
+                if ((dev->pdev->device == 0x5e4c) ||
+                    (dev->pdev->device == 0x5e4f))
+                        dev_priv->num_gb_pipes = 1;
         } else {
                 /* R3xx */
                 if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R300 &&
                      dev->pdev->device != 0x4144) ||
-                    ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R350)) {
+                    ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R350 &&
+                     dev->pdev->device != 0x4148)) {
                         dev_priv->num_gb_pipes = 2;
                 } else {
-                        /* RV3xx/R300 AD */
+                        /* RV3xx/R300 AD/R350 AH */
                         dev_priv->num_gb_pipes = 1;
                 }
         }
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index b8d672828246..bb1c122cad21 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -86,12 +86,12 @@ static void evergreen_crtc_load_lut(struct drm_crtc *crtc)
         WREG32(EVERGREEN_DC_LUT_WHITE_OFFSET_GREEN + radeon_crtc->crtc_offset, 0xffff);
         WREG32(EVERGREEN_DC_LUT_WHITE_OFFSET_RED + radeon_crtc->crtc_offset, 0xffff);
 
-        WREG32(EVERGREEN_DC_LUT_RW_MODE, radeon_crtc->crtc_id);
-        WREG32(EVERGREEN_DC_LUT_WRITE_EN_MASK, 0x00000007);
+        WREG32(EVERGREEN_DC_LUT_RW_MODE + radeon_crtc->crtc_offset, 0);
+        WREG32(EVERGREEN_DC_LUT_WRITE_EN_MASK + radeon_crtc->crtc_offset, 0x00000007);
 
-        WREG32(EVERGREEN_DC_LUT_RW_INDEX, 0);
+        WREG32(EVERGREEN_DC_LUT_RW_INDEX + radeon_crtc->crtc_offset, 0);
         for (i = 0; i < 256; i++) {
-                WREG32(EVERGREEN_DC_LUT_30_COLOR,
+                WREG32(EVERGREEN_DC_LUT_30_COLOR + radeon_crtc->crtc_offset,
                        (radeon_crtc->lut_r[i] << 20) |
                        (radeon_crtc->lut_g[i] << 10) |
                        (radeon_crtc->lut_b[i] << 0));
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 30293bec0801..fed7b8084779 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1326,7 +1326,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
 
         radeon_encoder->pixel_clock = adjusted_mode->clock;
 
-        if (ASIC_IS_AVIVO(rdev)) {
+        if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE4(rdev)) {
                 if (radeon_encoder->active_device & (ATOM_DEVICE_CV_SUPPORT | ATOM_DEVICE_TV_SUPPORT))
                         atombios_yuv_setup(encoder, true);
                 else
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index d3657dcfdd26..c633319f98ed 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -165,7 +165,7 @@ u32 radeon_get_vblank_counter_kms(struct drm_device *dev, int crtc)
 {
         struct radeon_device *rdev = dev->dev_private;
 
-        if (crtc < 0 || crtc > 1) {
+        if (crtc < 0 || crtc >= rdev->num_crtc) {
                 DRM_ERROR("Invalid crtc %d\n", crtc);
                 return -EINVAL;
         }
@@ -177,7 +177,7 @@ int radeon_enable_vblank_kms(struct drm_device *dev, int crtc)
 {
         struct radeon_device *rdev = dev->dev_private;
 
-        if (crtc < 0 || crtc > 1) {
+        if (crtc < 0 || crtc >= rdev->num_crtc) {
                 DRM_ERROR("Invalid crtc %d\n", crtc);
                 return -EINVAL;
         }
@@ -191,7 +191,7 @@ void radeon_disable_vblank_kms(struct drm_device *dev, int crtc)
 {
         struct radeon_device *rdev = dev->dev_private;
 
-        if (crtc < 0 || crtc > 1) {
+        if (crtc < 0 || crtc >= rdev->num_crtc) {
                 DRM_ERROR("Invalid crtc %d\n", crtc);
                 return;
         }
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index be475e844c2a..c8ab50516672 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -217,6 +217,10 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
         AXIS_DMI_MATCH("DV7", "HP Pavilion dv7", x_inverted),
         AXIS_DMI_MATCH("HP8710", "HP Compaq 8710", y_inverted),
         AXIS_DMI_MATCH("HDX18", "HP HDX 18", x_inverted),
+        AXIS_DMI_MATCH("HPB432x", "HP ProBook 432", xy_rotated_left),
+        AXIS_DMI_MATCH("HPB442x", "HP ProBook 442", xy_rotated_left),
+        AXIS_DMI_MATCH("HPB452x", "HP ProBook 452", y_inverted),
+        AXIS_DMI_MATCH("HPB522x", "HP ProBook 522", xy_swap),
         { NULL, }
 /* Laptop models without axis info (yet):
  * "NC6910" "HP Compaq 6910"
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 2191c8d896a0..0d0d625fece2 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -311,6 +311,22 @@ config TI_DAC7512
           This driver can also be built as a module. If so, the module
           will be calles ti_dac7512.
 
+config VMWARE_BALLOON
+        tristate "VMware Balloon Driver"
+        depends on X86
+        help
+          This is VMware physical memory management driver which acts
+          like a "balloon" that can be inflated to reclaim physical pages
+          by reserving them in the guest and invalidating them in the
+          monitor, freeing up the underlying machine pages so they can
+          be allocated to other guests. The balloon can also be deflated
+          to allow the guest to use more physical memory.
+
+          If unsure, say N.
+
+          To compile this driver as a module, choose M here: the
+          module will be called vmware_balloon.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 27c484355414..7b6f7eefdf8d 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -29,3 +29,4 @@ obj-$(CONFIG_C2PORT)		+= c2port/
 obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-y                           += eeprom/
 obj-y                           += cb710/
+obj-$(CONFIG_VMWARE_BALLOON)    += vmware_balloon.o
diff --git a/drivers/misc/vmware_balloon.c b/drivers/misc/vmware_balloon.c
new file mode 100644
index 000000000000..e7161c4e3798
--- /dev/null
+++ b/drivers/misc/vmware_balloon.c
@@ -0,0 +1,832 @@
+/*
+ * VMware Balloon driver.
+ *
+ * Copyright (C) 2000-2010, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained by: Dmitry Torokhov <dtor@vmware.com>
+ */
+
+/*
+ * This is VMware physical memory management driver for Linux. The driver
+ * acts like a "balloon" that can be inflated to reclaim physical pages by
+ * reserving them in the guest and invalidating them in the monitor,
+ * freeing up the underlying machine pages so they can be allocated to
+ * other guests.  The balloon can also be deflated to allow the guest to
+ * use more physical memory. Higher level policies can control the sizes
+ * of balloons in VMs in order to manage physical memory resources.
+ */
+
+//#define DEBUG
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/workqueue.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <asm/vmware.h>
+
+MODULE_AUTHOR("VMware, Inc.");
+MODULE_DESCRIPTION("VMware Memory Control (Balloon) Driver");
+MODULE_VERSION("1.2.1.0-K");
+MODULE_ALIAS("dmi:*:svnVMware*:*");
+MODULE_ALIAS("vmware_vmmemctl");
+MODULE_LICENSE("GPL");
+
+/*
+ * Various constants controlling rate of inflaint/deflating balloon,
+ * measured in pages.
+ */
+
+/*
+ * Rate of allocating memory when there is no memory pressure
+ * (driver performs non-sleeping allocations).
+ */
+#define VMW_BALLOON_NOSLEEP_ALLOC_MAX   16384U
+
+/*
+ * Rates of memory allocaton when guest experiences memory pressure
+ * (driver performs sleeping allocations).
+ */
+#define VMW_BALLOON_RATE_ALLOC_MIN      512U
+#define VMW_BALLOON_RATE_ALLOC_MAX      2048U
+#define VMW_BALLOON_RATE_ALLOC_INC      16U
+
+/*
+ * Rates for releasing pages while deflating balloon.
+ */
+#define VMW_BALLOON_RATE_FREE_MIN       512U
+#define VMW_BALLOON_RATE_FREE_MAX       16384U
+#define VMW_BALLOON_RATE_FREE_INC       16U
+
+/*
+ * When guest is under memory pressure, use a reduced page allocation
+ * rate for next several cycles.
+ */
+#define VMW_BALLOON_SLOW_CYCLES         4
+
+/*
+ * Use __GFP_HIGHMEM to allow pages from HIGHMEM zone. We don't
+ * allow wait (__GFP_WAIT) for NOSLEEP page allocations. Use
+ * __GFP_NOWARN, to suppress page allocation failure warnings.
+ */
+#define VMW_PAGE_ALLOC_NOSLEEP          (__GFP_HIGHMEM|__GFP_NOWARN)
+
+/*
+ * Use GFP_HIGHUSER when executing in a separate kernel thread
+ * context and allocation can sleep.  This is less stressful to
+ * the guest memory system, since it allows the thread to block
+ * while memory is reclaimed, and won't take pages from emergency
+ * low-memory pools.
+ */
+#define VMW_PAGE_ALLOC_CANSLEEP         (GFP_HIGHUSER)
+
+/* Maximum number of page allocations without yielding processor */
+#define VMW_BALLOON_YIELD_THRESHOLD     1024
+
+
+/*
+ * Hypervisor communication port definitions.
+ */
+#define VMW_BALLOON_HV_PORT             0x5670
+#define VMW_BALLOON_HV_MAGIC            0x456c6d6f
+#define VMW_BALLOON_PROTOCOL_VERSION    2
+#define VMW_BALLOON_GUEST_ID            1       /* Linux */
+
+#define VMW_BALLOON_CMD_START           0
+#define VMW_BALLOON_CMD_GET_TARGET      1
+#define VMW_BALLOON_CMD_LOCK            2
+#define VMW_BALLOON_CMD_UNLOCK          3
+#define VMW_BALLOON_CMD_GUEST_ID        4
+
+/* error codes */
+#define VMW_BALLOON_SUCCESS             0
+#define VMW_BALLOON_FAILURE             -1
+#define VMW_BALLOON_ERROR_CMD_INVALID   1
+#define VMW_BALLOON_ERROR_PPN_INVALID   2
+#define VMW_BALLOON_ERROR_PPN_LOCKED    3
+#define VMW_BALLOON_ERROR_PPN_UNLOCKED  4
+#define VMW_BALLOON_ERROR_PPN_PINNED    5
+#define VMW_BALLOON_ERROR_PPN_NOTNEEDED 6
+#define VMW_BALLOON_ERROR_RESET         7
+#define VMW_BALLOON_ERROR_BUSY          8
+
+#define VMWARE_BALLOON_CMD(cmd, data, result)           \
+({                                                      \
+        unsigned long __stat, __dummy1, __dummy2;       \
+        __asm__ __volatile__ ("inl (%%dx)" :            \
+                "=a"(__stat),                           \
+                "=c"(__dummy1),                         \
+                "=d"(__dummy2),                         \
+                "=b"(result) :                          \
+                "0"(VMW_BALLOON_HV_MAGIC),              \
+                "1"(VMW_BALLOON_CMD_##cmd),             \
+                "2"(VMW_BALLOON_HV_PORT),               \
+                "3"(data) :                             \
+                "memory");                              \
+        result &= -1UL;                                 \
+        __stat & -1UL;                                  \
+})
+
+#ifdef CONFIG_DEBUG_FS
+struct vmballoon_stats {
+        unsigned int timer;
+
+        /* allocation statustics */
+        unsigned int alloc;
+        unsigned int alloc_fail;
+        unsigned int sleep_alloc;
+        unsigned int sleep_alloc_fail;
+        unsigned int refused_alloc;
+        unsigned int refused_free;
+        unsigned int free;
+
+        /* monitor operations */
+        unsigned int lock;
+        unsigned int lock_fail;
+        unsigned int unlock;
+        unsigned int unlock_fail;
+        unsigned int target;
+        unsigned int target_fail;
+        unsigned int start;
+        unsigned int start_fail;
+        unsigned int guest_type;
+        unsigned int guest_type_fail;
+};
+
+#define STATS_INC(stat) (stat)++
+#else
+#define STATS_INC(stat)
+#endif
+
+struct vmballoon {
+
+        /* list of reserved physical pages */
+        struct list_head pages;
+
+        /* transient list of non-balloonable pages */
+        struct list_head refused_pages;
+
+        /* balloon size in pages */
+        unsigned int size;
+        unsigned int target;
+
+        /* reset flag */
+        bool reset_required;
+
+        /* adjustment rates (pages per second) */
+        unsigned int rate_alloc;
+        unsigned int rate_free;
+
+        /* slowdown page allocations for next few cycles */
+        unsigned int slow_allocation_cycles;
+
+#ifdef CONFIG_DEBUG_FS
+        /* statistics */
+        struct vmballoon_stats stats;
+
+        /* debugfs file exporting statistics */
+        struct dentry *dbg_entry;
+#endif
+
+        struct sysinfo sysinfo;
+
+        struct delayed_work dwork;
+};
+
+static struct vmballoon balloon;
+static struct workqueue_struct *vmballoon_wq;
+
+/*
+ * Send "start" command to the host, communicating supported version
+ * of the protocol.
+ */
+static bool vmballoon_send_start(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        STATS_INC(b->stats.start);
+
+        status = VMWARE_BALLOON_CMD(START, VMW_BALLOON_PROTOCOL_VERSION, dummy);
+        if (status == VMW_BALLOON_SUCCESS)
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.start_fail);
+        return false;
+}
+
+static bool vmballoon_check_status(struct vmballoon *b, unsigned long status)
+{
+        switch (status) {
+        case VMW_BALLOON_SUCCESS:
+                return true;
+
+        case VMW_BALLOON_ERROR_RESET:
+                b->reset_required = true;
+                /* fall through */
+
+        default:
+                return false;
+        }
+}
+
+/*
+ * Communicate guest type to the host so that it can adjust ballooning
+ * algorithm to the one most appropriate for the guest. This command
+ * is normally issued after sending "start" command and is part of
+ * standard reset sequence.
+ */
+static bool vmballoon_send_guest_id(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        status = VMWARE_BALLOON_CMD(GUEST_ID, VMW_BALLOON_GUEST_ID, dummy);
+
+        STATS_INC(b->stats.guest_type);
+
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.guest_type_fail);
+        return false;
+}
+
+/*
+ * Retrieve desired balloon size from the host.
+ */
+static bool vmballoon_send_get_target(struct vmballoon *b, u32 *new_target)
+{
+        unsigned long status;
+        unsigned long target;
+        unsigned long limit;
+        u32 limit32;
+
+        /*
+         * si_meminfo() is cheap. Moreover, we want to provide dynamic
+         * max balloon size later. So let us call si_meminfo() every
+         * iteration.
+         */
+        si_meminfo(&b->sysinfo);
+        limit = b->sysinfo.totalram;
+
+        /* Ensure limit fits in 32-bits */
+        limit32 = (u32)limit;
+        if (limit != limit32)
+                return false;
+
+        /* update stats */
+        STATS_INC(b->stats.target);
+
+        status = VMWARE_BALLOON_CMD(GET_TARGET, limit, target);
+        if (vmballoon_check_status(b, status)) {
+                *new_target = target;
+                return true;
+        }
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.target_fail);
+        return false;
+}
+
+/*
+ * Notify the host about allocated page so that host can use it without
+ * fear that guest will need it. Host may reject some pages, we need to
+ * check the return value and maybe submit a different page.
+ */
+static bool vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.lock);
+
+        status = VMWARE_BALLOON_CMD(LOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.lock_fail);
+        return false;
+}
+
+/*
+ * Notify the host that guest intends to release given page back into
+ * the pool of available (to the guest) pages.
+ */
+static bool vmballoon_send_unlock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.unlock);
+
+        status = VMWARE_BALLOON_CMD(UNLOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.unlock_fail);
+        return false;
+}
+
+/*
+ * Quickly release all pages allocated for the balloon. This function is
+ * called when host decides to "reset" balloon for one reason or another.
+ * Unlike normal "deflate" we do not (shall not) notify host of the pages
+ * being released.
+ */
+static void vmballoon_pop(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int count = 0;
+
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.free);
+                b->size--;
+
+                if (++count >= b->rate_free) {
+                        count = 0;
+                        cond_resched();
+                }
+        }
+}
+
+/*
+ * Perform standard reset sequence by popping the balloon (in case it
+ * is not  empty) and then restarting protocol. This operation normally
+ * happens when host responds with VMW_BALLOON_ERROR_RESET to a command.
+ */
+static void vmballoon_reset(struct vmballoon *b)
+{
+        /* free all pages, skipping monitor unlock */
+        vmballoon_pop(b);
+
+        if (vmballoon_send_start(b)) {
+                b->reset_required = false;
+                if (!vmballoon_send_guest_id(b))
+                        pr_err("failed to send guest ID to the host\n");
+        }
+}
+
+/*
+ * Allocate (or reserve) a page for the balloon and notify the host.  If host
+ * refuses the page put it on "refuse" list and allocate another one until host
+ * is satisfied. "Refused" pages are released at the end of inflation cycle
+ * (when we allocate b->rate_alloc pages).
+ */
+static int vmballoon_reserve_page(struct vmballoon *b, bool can_sleep)
+{
+        struct page *page;
+        gfp_t flags;
+        bool locked = false;
+
+        do {
+                if (!can_sleep)
+                        STATS_INC(b->stats.alloc);
+                else
+                        STATS_INC(b->stats.sleep_alloc);
+
+                flags = can_sleep ? VMW_PAGE_ALLOC_CANSLEEP : VMW_PAGE_ALLOC_NOSLEEP;
+                page = alloc_page(flags);
+                if (!page) {
+                        if (!can_sleep)
+                                STATS_INC(b->stats.alloc_fail);
+                        else
+                                STATS_INC(b->stats.sleep_alloc_fail);
+                        return -ENOMEM;
+                }
+
+                /* inform monitor */
+                locked = vmballoon_send_lock_page(b, page_to_pfn(page));
+                if (!locked) {
+                        if (b->reset_required) {
+                                __free_page(page);
+                                return -EIO;
+                        }
+
+                        /* place on list of non-balloonable pages, retry allocation */
+                        list_add(&page->lru, &b->refused_pages);
+                        STATS_INC(b->stats.refused_alloc);
+                }
+        } while (!locked);
+
+        /* track allocated page */
+        list_add(&page->lru, &b->pages);
+
+        /* update balloon size */
+        b->size++;
+
+        return 0;
+}
+
+/*
+ * Release the page allocated for the balloon. Note that we first notify
+ * the host so it can make sure the page will be available for the guest
+ * to use, if needed.
+ */
+static int vmballoon_release_page(struct vmballoon *b, struct page *page)
+{
+        if (!vmballoon_send_unlock_page(b, page_to_pfn(page)))
+                return -EIO;
+
+        list_del(&page->lru);
+
+        /* deallocate page */
+        __free_page(page);
+        STATS_INC(b->stats.free);
+
+        /* update balloon size */
+        b->size--;
+
+        return 0;
+}
+
+/*
+ * Release pages that were allocated while attempting to inflate the
+ * balloon but were refused by the host for one reason or another.
+ */
+static void vmballoon_release_refused_pages(struct vmballoon *b)
+{
+        struct page *page, *next;
+
+        list_for_each_entry_safe(page, next, &b->refused_pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.refused_free);
+        }
+}
+
+/*
+ * Inflate the balloon towards its target size. Note that we try to limit
+ * the rate of allocation to make sure we are not choking the rest of the
+ * system.
+ */
+static void vmballoon_inflate(struct vmballoon *b)
+{
+        unsigned int goal;
+        unsigned int rate;
+        unsigned int i;
+        unsigned int allocations = 0;
+        int error = 0;
+        bool alloc_can_sleep = false;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /*
+         * First try NOSLEEP page allocations to inflate balloon.
+         *
+         * If we do not throttle nosleep allocations, we can drain all
+         * free pages in the guest quickly (if the balloon target is high).
+         * As a side-effect, draining free pages helps to inform (force)
+         * the guest to start swapping if balloon target is not met yet,
+         * which is a desired behavior. However, balloon driver can consume
+         * all available CPU cycles if too many pages are allocated in a
+         * second. Therefore, we throttle nosleep allocations even when
+         * the guest is not under memory pressure. OTOH, if we have already
+         * predicted that the guest is under memory pressure, then we
+         * slowdown page allocations considerably.
+         */
+
+        goal = b->target - b->size;
+        /*
+         * Start with no sleep allocation rate which may be higher
+         * than sleeping allocation rate.
+         */
+        rate = b->slow_allocation_cycles ?
+                        b->rate_alloc : VMW_BALLOON_NOSLEEP_ALLOC_MAX;
+
+        pr_debug("%s - goal: %d, no-sleep rate: %d, sleep rate: %d\n",
+                 __func__, goal, rate, b->rate_alloc);
+
+        for (i = 0; i < goal; i++) {
+
+                error = vmballoon_reserve_page(b, alloc_can_sleep);
+                if (error) {
+                        if (error != -ENOMEM) {
+                                /*
+                                 * Not a page allocation failure, stop this
+                                 * cycle. Maybe we'll get new target from
+                                 * the host soon.
+                                 */
+                                break;
+                        }
+
+                        if (alloc_can_sleep) {
+                                /*
+                                 * CANSLEEP page allocation failed, so guest
+                                 * is under severe memory pressure. Quickly
+                                 * decrease allocation rate.
+                                 */
+                                b->rate_alloc = max(b->rate_alloc / 2,
+                                                    VMW_BALLOON_RATE_ALLOC_MIN);
+                                break;
+                        }
+
+                        /*
+                         * NOSLEEP page allocation failed, so the guest is
+                         * under memory pressure. Let us slow down page
+                         * allocations for next few cycles so that the guest
+                         * gets out of memory pressure. Also, if we already
+                         * allocated b->rate_alloc pages, let's pause,
+                         * otherwise switch to sleeping allocations.
+                         */
+                        b->slow_allocation_cycles = VMW_BALLOON_SLOW_CYCLES;
+
+                        if (i >= b->rate_alloc)
+                                break;
+
+                        alloc_can_sleep = true;
+                        /* Lower rate for sleeping allocations. */
+                        rate = b->rate_alloc;
+                }
+
+                if (++allocations > VMW_BALLOON_YIELD_THRESHOLD) {
+                        cond_resched();
+                        allocations = 0;
+                }
+
+                if (i >= rate) {
+                        /* We allocated enough pages, let's take a break. */
+                        break;
+                }
+        }
+
+        /*
+         * We reached our goal without failures so try increasing
+         * allocation rate.
+         */
+        if (error == 0 && i >= b->rate_alloc) {
+                unsigned int mult = i / b->rate_alloc;
+
+                b->rate_alloc =
+                        min(b->rate_alloc + mult * VMW_BALLOON_RATE_ALLOC_INC,
+                            VMW_BALLOON_RATE_ALLOC_MAX);
+        }
+
+        vmballoon_release_refused_pages(b);
+}
+
+/*
+ * Decrease the size of the balloon allowing guest to use more memory.
+ */
+static void vmballoon_deflate(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int i = 0;
+        unsigned int goal;
+        int error;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /* limit deallocation rate */
+        goal = min(b->size - b->target, b->rate_free);
+
+        pr_debug("%s - goal: %d, rate: %d\n", __func__, goal, b->rate_free);
+
+        /* free pages to reach target */
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                error = vmballoon_release_page(b, page);
+                if (error) {
+                        /* quickly decrease rate in case of error */
+                        b->rate_free = max(b->rate_free / 2,
+                                           VMW_BALLOON_RATE_FREE_MIN);
+                        return;
+                }
+
+                if (++i >= goal)
+                        break;
+        }
+
+        /* slowly increase rate if there were no errors */
+        b->rate_free = min(b->rate_free + VMW_BALLOON_RATE_FREE_INC,
+                           VMW_BALLOON_RATE_FREE_MAX);
+}
+
+/*
+ * Balloon work function: reset protocol, if needed, get the new size and
+ * adjust balloon as needed. Repeat in 1 sec.
+ */
+static void vmballoon_work(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct vmballoon *b = container_of(dwork, struct vmballoon, dwork);
+        unsigned int target;
+
+        STATS_INC(b->stats.timer);
+
+        if (b->reset_required)
+                vmballoon_reset(b);
+
+        if (b->slow_allocation_cycles > 0)
+                b->slow_allocation_cycles--;
+
+        if (vmballoon_send_get_target(b, &target)) {
+                /* update target, adjust size */
+                b->target = target;
+
+                if (b->size < target)
+                        vmballoon_inflate(b);
+                else if (b->size > target)
+                        vmballoon_deflate(b);
+        }
+
+        queue_delayed_work(vmballoon_wq, dwork, round_jiffies_relative(HZ));
+}
+
+/*
+ * DEBUGFS Interface
+ */
+#ifdef CONFIG_DEBUG_FS
+
+static int vmballoon_debug_show(struct seq_file *f, void *offset)
+{
+        struct vmballoon *b = f->private;
+        struct vmballoon_stats *stats = &b->stats;
+
+        /* format size info */
+        seq_printf(f,
+                   "target:             %8d pages\n"
+                   "current:            %8d pages\n",
+                   b->target, b->size);
+
+        /* format rate info */
+        seq_printf(f,
+                   "rateNoSleepAlloc:   %8d pages/sec\n"
+                   "rateSleepAlloc:     %8d pages/sec\n"
+                   "rateFree:           %8d pages/sec\n",
+                   VMW_BALLOON_NOSLEEP_ALLOC_MAX,
+                   b->rate_alloc, b->rate_free);
+
+        seq_printf(f,
+                   "\n"
+                   "timer:              %8u\n"
+                   "start:              %8u (%4u failed)\n"
+                   "guestType:          %8u (%4u failed)\n"
+                   "lock:               %8u (%4u failed)\n"
+                   "unlock:             %8u (%4u failed)\n"
+                   "target:             %8u (%4u failed)\n"
+                   "primNoSleepAlloc:   %8u (%4u failed)\n"
+                   "primCanSleepAlloc:  %8u (%4u failed)\n"
+                   "primFree:           %8u\n"
+                   "errAlloc:           %8u\n"
+                   "errFree:            %8u\n",
+                   stats->timer,
+                   stats->start, stats->start_fail,
+                   stats->guest_type, stats->guest_type_fail,
+                   stats->lock,  stats->lock_fail,
+                   stats->unlock, stats->unlock_fail,
+                   stats->target, stats->target_fail,
+                   stats->alloc, stats->alloc_fail,
+                   stats->sleep_alloc, stats->sleep_alloc_fail,
+                   stats->free,
+                   stats->refused_alloc, stats->refused_free);
+
+        return 0;
+}
+
+static int vmballoon_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, vmballoon_debug_show, inode->i_private);
+}
+
+static const struct file_operations vmballoon_debug_fops = {
+        .owner          = THIS_MODULE,
+        .open           = vmballoon_debug_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int __init vmballoon_debugfs_init(struct vmballoon *b)
+{
+        int error;
+
+        b->dbg_entry = debugfs_create_file("vmmemctl", S_IRUGO, NULL, b,
+                                           &vmballoon_debug_fops);
+        if (IS_ERR(b->dbg_entry)) {
+                error = PTR_ERR(b->dbg_entry);
+                pr_err("failed to create debugfs entry, error: %d\n", error);
+                return error;
+        }
+
+        return 0;
+}
+
+static void __exit vmballoon_debugfs_exit(struct vmballoon *b)
+{
+        debugfs_remove(b->dbg_entry);
+}
+
+#else
+
+static inline int vmballoon_debugfs_init(struct vmballoon *b)
+{
+        return 0;
+}
+
+static inline void vmballoon_debugfs_exit(struct vmballoon *b)
+{
+}
+
+#endif  /* CONFIG_DEBUG_FS */
+
+static int __init vmballoon_init(void)
+{
+        int error;
+
+        /*
+         * Check if we are running on VMware's hypervisor and bail out
+         * if we are not.
+         */
+        if (!vmware_platform())
+                return -ENODEV;
+
+        vmballoon_wq = create_freezeable_workqueue("vmmemctl");
+        if (!vmballoon_wq) {
+                pr_err("failed to create workqueue\n");
+                return -ENOMEM;
+        }
+
+        INIT_LIST_HEAD(&balloon.pages);
+        INIT_LIST_HEAD(&balloon.refused_pages);
+
+        /* initialize rates */
+        balloon.rate_alloc = VMW_BALLOON_RATE_ALLOC_MAX;
+        balloon.rate_free = VMW_BALLOON_RATE_FREE_MAX;
+
+        INIT_DELAYED_WORK(&balloon.dwork, vmballoon_work);
+
+        /*
+         * Start balloon.
+         */
+        if (!vmballoon_send_start(&balloon)) {
+                pr_err("failed to send start command to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        if (!vmballoon_send_guest_id(&balloon)) {
+                pr_err("failed to send guest ID to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        error = vmballoon_debugfs_init(&balloon);
+        if (error)
+                goto fail;
+
+        queue_delayed_work(vmballoon_wq, &balloon.dwork, 0);
+
+        return 0;
+
+fail:
+        destroy_workqueue(vmballoon_wq);
+        return error;
+}
+module_init(vmballoon_init);
+
+static void __exit vmballoon_exit(void)
+{
+        cancel_delayed_work_sync(&balloon.dwork);
+        destroy_workqueue(vmballoon_wq);
+
+        vmballoon_debugfs_exit(&balloon);
+
+        /*
+         * Deallocate all reserved memory, and reset connection with monitor.
+         * Reset connection before deallocating memory to avoid potential for
+         * additional spurious resets from guest touching deallocated pages.
+         */
+        vmballoon_send_start(&balloon);
+        vmballoon_pop(&balloon);
+}
+module_exit(vmballoon_exit);
diff --git a/drivers/mtd/Makefile b/drivers/mtd/Makefile
index 82d1e4de475b..4521b1ecce45 100644
--- a/drivers/mtd/Makefile
+++ b/drivers/mtd/Makefile
@@ -4,7 +4,7 @@
 
 # Core functionality.
 obj-$(CONFIG_MTD)               += mtd.o
-mtd-y                           := mtdcore.o mtdsuper.o mtdbdi.o
+mtd-y                           := mtdcore.o mtdsuper.o
 mtd-$(CONFIG_MTD_PARTITIONS)    += mtdpart.o
 
 obj-$(CONFIG_MTD_CONCAT)        += mtdconcat.o
diff --git a/drivers/mtd/internal.h b/drivers/mtd/internal.h
index c658fe7216b5..e69de29bb2d1 100644
--- a/drivers/mtd/internal.h
+++ b/drivers/mtd/internal.h
@@ -1,17 +0,0 @@
-/* Internal MTD definitions
- *
- * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-/*
- * mtdbdi.c
- */
-extern struct backing_dev_info mtd_bdi_unmappable;
-extern struct backing_dev_info mtd_bdi_ro_mappable;
-extern struct backing_dev_info mtd_bdi_rw_mappable;
diff --git a/drivers/mtd/mtdbdi.c b/drivers/mtd/mtdbdi.c
index 5ca5aed0b225..e69de29bb2d1 100644
--- a/drivers/mtd/mtdbdi.c
+++ b/drivers/mtd/mtdbdi.c
@@ -1,43 +0,0 @@
-/* MTD backing device capabilities
- *
- * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include <linux/backing-dev.h>
-#include <linux/mtd/mtd.h>
-#include "internal.h"
-
-/*
- * backing device capabilities for non-mappable devices (such as NAND flash)
- * - permits private mappings, copies are taken of the data
- */
-struct backing_dev_info mtd_bdi_unmappable = {
-        .capabilities   = BDI_CAP_MAP_COPY,
-};
-
-/*
- * backing device capabilities for R/O mappable devices (such as ROM)
- * - permits private mappings, copies are taken of the data
- * - permits non-writable shared mappings
- */
-struct backing_dev_info mtd_bdi_ro_mappable = {
-        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
-                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP),
-};
-
-/*
- * backing device capabilities for writable mappable devices (such as RAM)
- * - permits private mappings, copies are taken of the data
- * - permits non-writable shared mappings
- */
-struct backing_dev_info mtd_bdi_rw_mappable = {
-        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
-                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP |
-                           BDI_CAP_WRITE_MAP),
-};
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 5b38b17d2229..b177e750efc3 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -2,6 +2,9 @@
  * Core registration and callback routines for MTD
  * drivers and users.
  *
+ * bdi bits are:
+ * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
  */
 
 #include <linux/module.h>
@@ -16,11 +19,39 @@
 #include <linux/init.h>
 #include <linux/mtd/compatmac.h>
 #include <linux/proc_fs.h>
+#include <linux/backing-dev.h>
 
 #include <linux/mtd/mtd.h>
-#include "internal.h"
 
 #include "mtdcore.h"
+/*
+ * backing device capabilities for non-mappable devices (such as NAND flash)
+ * - permits private mappings, copies are taken of the data
+ */
+struct backing_dev_info mtd_bdi_unmappable = {
+        .capabilities   = BDI_CAP_MAP_COPY,
+};
+
+/*
+ * backing device capabilities for R/O mappable devices (such as ROM)
+ * - permits private mappings, copies are taken of the data
+ * - permits non-writable shared mappings
+ */
+struct backing_dev_info mtd_bdi_ro_mappable = {
+        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
+                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP),
+};
+
+/*
+ * backing device capabilities for writable mappable devices (such as RAM)
+ * - permits private mappings, copies are taken of the data
+ * - permits non-writable shared mappings
+ */
+struct backing_dev_info mtd_bdi_rw_mappable = {
+        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
+                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP |
+                           BDI_CAP_WRITE_MAP),
+};
 
 static int mtd_cls_suspend(struct device *dev, pm_message_t state);
 static int mtd_cls_resume(struct device *dev);
@@ -628,20 +659,55 @@ done:
 /*====================================================================*/
 /* Init code */
 
+static int __init mtd_bdi_init(struct backing_dev_info *bdi, const char *name)
+{
+        int ret;
+
+        ret = bdi_init(bdi);
+        if (!ret)
+                ret = bdi_register(bdi, NULL, name);
+
+        if (ret)
+                bdi_destroy(bdi);
+
+        return ret;
+}
+
 static int __init init_mtd(void)
 {
         int ret;
+
         ret = class_register(&mtd_class);
+        if (ret)
+                goto err_reg;
+
+        ret = mtd_bdi_init(&mtd_bdi_unmappable, "mtd-unmap");
+        if (ret)
+                goto err_bdi1;
+
+        ret = mtd_bdi_init(&mtd_bdi_ro_mappable, "mtd-romap");
+        if (ret)
+                goto err_bdi2;
+
+        ret = mtd_bdi_init(&mtd_bdi_rw_mappable, "mtd-rwmap");
+        if (ret)
+                goto err_bdi3;
 
-        if (ret) {
-                pr_err("Error registering mtd class: %d\n", ret);
-                return ret;
-        }
 #ifdef CONFIG_PROC_FS
         if ((proc_mtd = create_proc_entry( "mtd", 0, NULL )))
                 proc_mtd->read_proc = mtd_read_proc;
 #endif /* CONFIG_PROC_FS */
         return 0;
+
+err_bdi3:
+        bdi_destroy(&mtd_bdi_ro_mappable);
+err_bdi2:
+        bdi_destroy(&mtd_bdi_unmappable);
+err_bdi1:
+        class_unregister(&mtd_class);
+err_reg:
+        pr_err("Error registering mtd class or bdi: %d\n", ret);
+        return ret;
 }
 
 static void __exit cleanup_mtd(void)
@@ -651,6 +717,9 @@ static void __exit cleanup_mtd(void)
                 remove_proc_entry( "mtd", NULL);
 #endif /* CONFIG_PROC_FS */
         class_unregister(&mtd_class);
+        bdi_destroy(&mtd_bdi_unmappable);
+        bdi_destroy(&mtd_bdi_ro_mappable);
+        bdi_destroy(&mtd_bdi_rw_mappable);
 }
 
 module_init(init_mtd);
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index af8b42e0a55b..7c003191fca4 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -13,6 +13,7 @@
 #include <linux/mtd/super.h>
 #include <linux/namei.h>
 #include <linux/ctype.h>
+#include <linux/slab.h>
 
 /*
  * compare superblocks to see if they're equivalent
@@ -44,6 +45,7 @@ static int get_sb_mtd_set(struct super_block *sb, void *_mtd)
 
         sb->s_mtd = mtd;
         sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
+        sb->s_bdi = mtd->backing_dev_info;
         return 0;
 }
 
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index f59c07427af3..d60fc5719fef 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -60,7 +60,13 @@ static void orion_nand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
         }
         buf64 = (uint64_t *)buf;
         while (i < len/8) {
-                uint64_t x;
+                /*
+                 * Since GCC has no proper constraint (PR 43518)
+                 * force x variable to r2/r3 registers as ldrd instruction
+                 * requires first register to be even.
+                 */
+                register uint64_t x asm ("r2");
+
                 asm volatile ("ldrd\t%0, [%1]" : "=&r" (x) : "r" (io_base));
                 buf64[i++] = x;
         }
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index a03d291de854..f0d23de32967 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -1944,7 +1944,7 @@ static int rtl8139_rx(struct net_device *dev, struct rtl8139_private *tp,
                 netif_dbg(tp, rx_status, dev, "%s() status %04x, size %04x, cur %04x\n",
                           __func__, rx_status, rx_size, cur_rx);
 #if RTL8139_DEBUG > 2
-                print_dump_hex(KERN_DEBUG, "Frame contents: ",
+                print_hex_dump(KERN_DEBUG, "Frame contents: ",
                                DUMP_PREFIX_OFFSET, 16, 1,
                                &rx_ring[ring_offset], 70, true);
 #endif
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index a583b50d9de8..12b280afdd51 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -273,6 +273,7 @@ obj-$(CONFIG_USB_RTL8150)       += usb/
 obj-$(CONFIG_USB_HSO)           += usb/
 obj-$(CONFIG_USB_USBNET)        += usb/
 obj-$(CONFIG_USB_ZD1201)        += usb/
+obj-$(CONFIG_USB_IPHETH)        += usb/
 
 obj-y += wireless/
 obj-$(CONFIG_NET_TULIP) += tulip/
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index a257babd1bb4..ac90a3828f69 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -58,8 +58,8 @@
 #include "bnx2_fw.h"
 
 #define DRV_MODULE_NAME         "bnx2"
-#define DRV_MODULE_VERSION      "2.0.8"
-#define DRV_MODULE_RELDATE      "Feb 15, 2010"
+#define DRV_MODULE_VERSION      "2.0.9"
+#define DRV_MODULE_RELDATE      "April 27, 2010"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-5.0.0.j6.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-5.0.0.j3.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-5.0.0.j9.fw"
@@ -651,9 +651,10 @@ bnx2_napi_enable(struct bnx2 *bp)
 }
 
 static void
-bnx2_netif_stop(struct bnx2 *bp)
+bnx2_netif_stop(struct bnx2 *bp, bool stop_cnic)
 {
-        bnx2_cnic_stop(bp);
+        if (stop_cnic)
+                bnx2_cnic_stop(bp);
         if (netif_running(bp->dev)) {
                 int i;
 
@@ -671,14 +672,15 @@ bnx2_netif_stop(struct bnx2 *bp)
 }
 
 static void
-bnx2_netif_start(struct bnx2 *bp)
+bnx2_netif_start(struct bnx2 *bp, bool start_cnic)
 {
         if (atomic_dec_and_test(&bp->intr_sem)) {
                 if (netif_running(bp->dev)) {
                         netif_tx_wake_all_queues(bp->dev);
                         bnx2_napi_enable(bp);
                         bnx2_enable_int(bp);
-                        bnx2_cnic_start(bp);
+                        if (start_cnic)
+                                bnx2_cnic_start(bp);
                 }
         }
 }
@@ -4759,8 +4761,12 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                 rc = bnx2_alloc_bad_rbuf(bp);
         }
 
-        if (bp->flags & BNX2_FLAG_USING_MSIX)
+        if (bp->flags & BNX2_FLAG_USING_MSIX) {
                 bnx2_setup_msix_tbl(bp);
+                /* Prevent MSIX table reads and write from timing out */
+                REG_WR(bp, BNX2_MISC_ECO_HW_CTL,
+                        BNX2_MISC_ECO_HW_CTL_LARGE_GRC_TMOUT_EN);
+        }
 
         return rc;
 }
@@ -6273,12 +6279,12 @@ bnx2_reset_task(struct work_struct *work)
                 return;
         }
 
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
 
         bnx2_init_nic(bp, 1);
 
         atomic_set(&bp->intr_sem, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
         rtnl_unlock();
 }
 
@@ -6320,7 +6326,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
         struct bnx2 *bp = netdev_priv(dev);
 
         if (netif_running(dev))
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, false);
 
         bp->vlgrp = vlgrp;
 
@@ -6331,7 +6337,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
         if (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN)
                 bnx2_fw_sync(bp, BNX2_DRV_MSG_CODE_KEEP_VLAN_UPDATE, 0, 1);
 
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, false);
 }
 #endif
 
@@ -7051,9 +7057,9 @@ bnx2_set_coalesce(struct net_device *dev, struct ethtool_coalesce *coal)
         bp->stats_ticks &= BNX2_HC_STATS_TICKS_HC_STAT_TICKS;
 
         if (netif_running(bp->dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_init_nic(bp, 0);
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
         }
 
         return 0;
@@ -7083,7 +7089,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                 /* Reset will erase chipset stats; save them */
                 bnx2_save_stats(bp);
 
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
                 bnx2_free_skbs(bp);
                 bnx2_free_mem(bp);
@@ -7111,7 +7117,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                         bnx2_setup_cnic_irq_info(bp);
                 mutex_unlock(&bp->cnic_lock);
 #endif
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
         }
         return 0;
 }
@@ -7364,7 +7370,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
         if (etest->flags & ETH_TEST_FL_OFFLINE) {
                 int i;
 
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_DIAG);
                 bnx2_free_skbs(bp);
 
@@ -7383,7 +7389,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
                         bnx2_shutdown_chip(bp);
                 else {
                         bnx2_init_nic(bp, 1);
-                        bnx2_netif_start(bp);
+                        bnx2_netif_start(bp, true);
                 }
 
                 /* wait for link up */
@@ -8377,7 +8383,7 @@ bnx2_suspend(struct pci_dev *pdev, pm_message_t state)
                 return 0;
 
         flush_scheduled_work();
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
         netif_device_detach(dev);
         del_timer_sync(&bp->timer);
         bnx2_shutdown_chip(bp);
@@ -8399,7 +8405,7 @@ bnx2_resume(struct pci_dev *pdev)
         bnx2_set_power_state(bp, PCI_D0);
         netif_device_attach(dev);
         bnx2_init_nic(bp, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
         return 0;
 }
 
@@ -8426,7 +8432,7 @@ static pci_ers_result_t bnx2_io_error_detected(struct pci_dev *pdev,
         }
 
         if (netif_running(dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 del_timer_sync(&bp->timer);
                 bnx2_reset_nic(bp, BNX2_DRV_MSG_CODE_RESET);
         }
@@ -8483,7 +8489,7 @@ static void bnx2_io_resume(struct pci_dev *pdev)
 
         rtnl_lock();
         if (netif_running(dev))
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
 
         netif_device_attach(dev);
         rtnl_unlock();
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 33451092b8e8..d800b598ae3d 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1006,7 +1006,7 @@ static int ems_usb_probe(struct usb_interface *intf,
 
         netdev = alloc_candev(sizeof(struct ems_usb), MAX_TX_URBS);
         if (!netdev) {
-                dev_err(netdev->dev.parent, "Couldn't alloc candev\n");
+                dev_err(&intf->dev, "ems_usb: Couldn't alloc candev\n");
                 return -ENOMEM;
         }
 
@@ -1036,20 +1036,20 @@ static int ems_usb_probe(struct usb_interface *intf,
 
         dev->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!dev->intr_urb) {
-                dev_err(netdev->dev.parent, "Couldn't alloc intr URB\n");
+                dev_err(&intf->dev, "Couldn't alloc intr URB\n");
                 goto cleanup_candev;
         }
 
         dev->intr_in_buffer = kzalloc(INTR_IN_BUFFER_SIZE, GFP_KERNEL);
         if (!dev->intr_in_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Intr buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Intr buffer\n");
                 goto cleanup_intr_urb;
         }
 
         dev->tx_msg_buffer = kzalloc(CPC_HEADER_SIZE +
                                      sizeof(struct ems_cpc_msg), GFP_KERNEL);
         if (!dev->tx_msg_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Tx buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Tx buffer\n");
                 goto cleanup_intr_in_buffer;
         }
 
diff --git a/drivers/net/cxgb3/ael1002.c b/drivers/net/cxgb3/ael1002.c
index 5248f9e0b2f4..35cd36729155 100644
--- a/drivers/net/cxgb3/ael1002.c
+++ b/drivers/net/cxgb3/ael1002.c
@@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops = {
 int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter,
                             int phy_addr, const struct mdio_ops *mdio_ops)
 {
-        cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops,
+        cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops,
                   SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP,
                   "10GBASE-CX4");
         return 0;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index aced6c5e635c..e3f1b8566495 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -439,7 +439,7 @@ static void free_irq_resources(struct adapter *adapter)
 static int await_mgmt_replies(struct adapter *adap, unsigned long init_cnt,
                               unsigned long n)
 {
-        int attempts = 5;
+        int attempts = 10;
 
         while (adap->sge.qs[0].rspq.offload_pkts < init_cnt + n) {
                 if (!--attempts)
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index b997e578e58f..791080303db1 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -166,6 +166,7 @@
 #include <linux/ethtool.h>
 #include <linux/string.h>
 #include <linux/firmware.h>
+#include <linux/rtnetlink.h>
 #include <asm/unaligned.h>
 
 
@@ -2265,8 +2266,13 @@ static void e100_tx_timeout_task(struct work_struct *work)
 
         DPRINTK(TX_ERR, DEBUG, "scb.status=0x%02X\n",
                 ioread8(&nic->csr->scb.status));
-        e100_down(netdev_priv(netdev));
-        e100_up(netdev_priv(netdev));
+
+        rtnl_lock();
+        if (netif_running(netdev)) {
+                e100_down(netdev_priv(netdev));
+                e100_up(netdev_priv(netdev));
+        }
+        rtnl_unlock();
 }
 
 static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode)
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 712ccc66ba25..90155552ea09 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -336,7 +336,6 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
         struct e1000_hw *hw = &adapter->hw;
         static int global_quad_port_a; /* global port a indication */
         struct pci_dev *pdev = adapter->pdev;
-        u16 eeprom_data = 0;
         int is_port_b = er32(STATUS) & E1000_STATUS_FUNC_1;
         s32 rc;
 
@@ -387,16 +386,15 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
                 if (pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD)
                         adapter->flags &= ~FLAG_HAS_WOL;
                 break;
-
         case e1000_82573:
+        case e1000_82574:
+        case e1000_82583:
+                /* Disable ASPM L0s due to hardware errata */
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L0S);
+
                 if (pdev->device == E1000_DEV_ID_82573L) {
-                        if (e1000_read_nvm(&adapter->hw, NVM_INIT_3GIO_3, 1,
-                                       &eeprom_data) < 0)
-                                break;
-                        if (!(eeprom_data & NVM_WORD1A_ASPM_MASK)) {
-                                adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
-                                adapter->max_hw_frame_size = DEFAULT_JUMBO;
-                        }
+                        adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
+                        adapter->max_hw_frame_size = DEFAULT_JUMBO;
                 }
                 break;
         default:
@@ -1792,6 +1790,7 @@ struct e1000_info e1000_82571_info = {
                                   | FLAG_RESET_OVERWRITES_LAA /* errata */
                                   | FLAG_TARC_SPEED_MODE_BIT /* errata */
                                   | FLAG_APME_CHECK_PORT_B,
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
         .pba                    = 38,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -1809,6 +1808,7 @@ struct e1000_info e1000_82572_info = {
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_CTRLEXT_ON_LOAD
                                   | FLAG_TARC_SPEED_MODE_BIT, /* errata */
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
         .pba                    = 38,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -1820,13 +1820,11 @@ struct e1000_info e1000_82572_info = {
 struct e1000_info e1000_82573_info = {
         .mac                    = e1000_82573,
         .flags                  = FLAG_HAS_HW_VLAN_FILTER
-                                  | FLAG_HAS_JUMBO_FRAMES
                                   | FLAG_HAS_WOL
                                   | FLAG_APME_IN_CTRL3
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_SMART_POWER_DOWN
                                   | FLAG_HAS_AMT
-                                  | FLAG_HAS_ERT
                                   | FLAG_HAS_SWSM_ON_LOAD,
         .pba                    = 20,
         .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 118bdf483593..ee32b9b27a9f 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -37,6 +37,7 @@
 #include <linux/io.h>
 #include <linux/netdevice.h>
 #include <linux/pci.h>
+#include <linux/pci-aspm.h>
 
 #include "hw.h"
 
@@ -374,7 +375,7 @@ struct e1000_adapter {
 struct e1000_info {
         enum e1000_mac_type     mac;
         unsigned int            flags;
-        unsigned int            flags2;
+        unsigned int            flags2;
         u32                     pba;
         u32                     max_hw_frame_size;
         s32                     (*get_variants)(struct e1000_adapter *);
@@ -421,6 +422,7 @@ struct e1000_info {
 #define FLAG2_CRC_STRIPPING               (1 << 0)
 #define FLAG2_HAS_PHY_WAKEUP              (1 << 1)
 #define FLAG2_IS_DISCARDING               (1 << 2)
+#define FLAG2_DISABLE_ASPM_L1             (1 << 3)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
@@ -461,6 +463,7 @@ extern void e1000e_update_stats(struct e1000_adapter *adapter);
 extern bool e1000e_has_link(struct e1000_adapter *adapter);
 extern void e1000e_set_interrupt_capability(struct e1000_adapter *adapter);
 extern void e1000e_reset_interrupt_capability(struct e1000_adapter *adapter);
+extern void e1000e_disable_aspm(struct pci_dev *pdev, u16 state);
 
 extern unsigned int copybreak;
 
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 73d43c53015a..fb8fc7d1b50d 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4283,6 +4283,14 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
                 return -EINVAL;
         }
 
+        /* 82573 Errata 17 */
+        if (((adapter->hw.mac.type == e1000_82573) ||
+             (adapter->hw.mac.type == e1000_82574)) &&
+            (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN)) {
+                adapter->flags2 |= FLAG2_DISABLE_ASPM_L1;
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L1);
+        }
+
         while (test_and_set_bit(__E1000_RESETTING, &adapter->state))
                 msleep(1);
         /* e1000e_down -> e1000e_reset dependent on max_frame_size & mtu */
@@ -4605,29 +4613,39 @@ static void e1000_complete_shutdown(struct pci_dev *pdev, bool sleep,
         }
 }
 
-static void e1000e_disable_l1aspm(struct pci_dev *pdev)
+#ifdef CONFIG_PCIEASPM
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        pci_disable_link_state(pdev, state);
+}
+#else
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
 {
         int pos;
-        u16 val;
+        u16 reg16;
 
         /*
-         * 82573 workaround - disable L1 ASPM on mobile chipsets
-         *
-         * L1 ASPM on various mobile (ich7) chipsets do not behave properly
-         * resulting in lost data or garbage information on the pci-e link
-         * level. This could result in (false) bad EEPROM checksum errors,
-         * long ping times (up to 2s) or even a system freeze/hang.
-         *
-         * Unfortunately this feature saves about 1W power consumption when
-         * active.
+         * Both device and parent should have the same ASPM setting.
+         * Disable ASPM in downstream component first and then upstream.
          */
-        pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
-        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &val);
-        if (val & 0x2) {
-                dev_warn(&pdev->dev, "Disabling L1 ASPM\n");
-                val &= ~0x2;
-                pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, val);
-        }
+        pos = pci_pcie_cap(pdev);
+        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &reg16);
+        reg16 &= ~state;
+        pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, reg16);
+
+        pos = pci_pcie_cap(pdev->bus->self);
+        pci_read_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, &reg16);
+        reg16 &= ~state;
+        pci_write_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, reg16);
+}
+#endif
+void e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        dev_info(&pdev->dev, "Disabling ASPM %s %s\n",
+                 (state & PCIE_LINK_STATE_L0S) ? "L0s" : "",
+                 (state & PCIE_LINK_STATE_L1) ? "L1" : "");
+
+        __e1000e_disable_aspm(pdev, state);
 }
 
 #ifdef CONFIG_PM
@@ -4653,7 +4671,8 @@ static int e1000_resume(struct pci_dev *pdev)
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
         pci_save_state(pdev);
-        e1000e_disable_l1aspm(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
 
         err = pci_enable_device_mem(pdev);
         if (err) {
@@ -4795,7 +4814,8 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
         int err;
         pci_ers_result_t result;
 
-        e1000e_disable_l1aspm(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
         err = pci_enable_device_mem(pdev);
         if (err) {
                 dev_err(&pdev->dev,
@@ -4889,13 +4909,6 @@ static void e1000_eeprom_checks(struct e1000_adapter *adapter)
                 dev_warn(&adapter->pdev->dev,
                          "Warning: detected DSPD enabled in EEPROM\n");
         }
-
-        ret_val = e1000_read_nvm(hw, NVM_INIT_3GIO_3, 1, &buf);
-        if (!ret_val && (le16_to_cpu(buf) & (3 << 2))) {
-                /* ASPM enable */
-                dev_warn(&adapter->pdev->dev,
-                         "Warning: detected ASPM enabled in EEPROM\n");
-        }
 }
 
 static const struct net_device_ops e1000e_netdev_ops = {
@@ -4944,7 +4957,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         u16 eeprom_data = 0;
         u16 eeprom_apme_mask = E1000_EEPROM_APME;
 
-        e1000e_disable_l1aspm(pdev);
+        if (ei->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
 
         err = pci_enable_device_mem(pdev);
         if (err)
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index d5160edf2fcf..3acac5f930c8 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -205,8 +205,6 @@ static int fsl_pq_mdio_find_free(struct mii_bus *new_bus)
 static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct device_node *np)
 {
         struct gfar __iomem *enet_regs;
-        u32 __iomem *ioremap_tbipa;
-        u64 addr, size;
 
         /*
          * This is mildly evil, but so is our hardware for doing this.
@@ -220,9 +218,7 @@ static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct devi
                 return &enet_regs->tbipa;
         } else if (of_device_is_compatible(np, "fsl,etsec2-mdio") ||
                         of_device_is_compatible(np, "fsl,etsec2-tbi")) {
-                addr = of_translate_address(np, of_get_address(np, 1, &size, NULL));
-                ioremap_tbipa = ioremap(addr, size);
-                return ioremap_tbipa;
+                return of_iomap(np, 1);
         } else
                 return NULL;
 }
@@ -279,6 +275,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
         u32 __iomem *tbipa;
         struct mii_bus *new_bus;
         int tbiaddr = -1;
+        const u32 *addrp;
         u64 addr = 0, size = 0;
         int err = 0;
 
@@ -297,8 +294,19 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
         new_bus->priv = priv;
         fsl_pq_mdio_bus_name(new_bus->id, np);
 
+        addrp = of_get_address(np, 0, &size, NULL);
+        if (!addrp) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
+
         /* Set the PHY base address */
-        addr = of_translate_address(np, of_get_address(np, 0, &size, NULL));
+        addr = of_translate_address(np, addrp);
+        if (addr == OF_BAD_ADDR) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
+
         map = ioremap(addr, size);
         if (!map) {
                 err = -ENOMEM;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 080d1cea5b26..4e97ca182997 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -549,12 +549,8 @@ static int gfar_parse_group(struct device_node *np,
                 struct gfar_private *priv, const char *model)
 {
         u32 *queue_mask;
-        u64 addr, size;
-
-        addr = of_translate_address(np,
-                        of_get_address(np, 0, &size, NULL));
-        priv->gfargrp[priv->num_grps].regs = ioremap(addr, size);
 
+        priv->gfargrp[priv->num_grps].regs = of_iomap(np, 0);
         if (!priv->gfargrp[priv->num_grps].regs)
                 return -ENOMEM;
 
@@ -1515,9 +1511,9 @@ static void gfar_halt_nodisable(struct net_device *dev)
                 tempval |= (DMACTRL_GRS | DMACTRL_GTS);
                 gfar_write(&regs->dmactrl, tempval);
 
-                while (!(gfar_read(&regs->ievent) &
-                         (IEVENT_GRSC | IEVENT_GTSC)))
-                        cpu_relax();
+                spin_event_timeout(((gfar_read(&regs->ievent) &
+                         (IEVENT_GRSC | IEVENT_GTSC)) ==
+                         (IEVENT_GRSC | IEVENT_GTSC)), -1, 0);
         }
 }
 
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index b405a00817c6..12fc0e7ba2ca 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -39,6 +39,8 @@
 #define IXGBE_82599_MC_TBL_SIZE   128
 #define IXGBE_82599_VFT_TBL_SIZE  128
 
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                                           ixgbe_link_speed speed,
@@ -69,8 +71,14 @@ static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
         if (hw->phy.multispeed_fiber) {
                 /* Set up dual speed SFP+ support */
                 mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
+                mac->ops.disable_tx_laser =
+                                       &ixgbe_disable_tx_laser_multispeed_fiber;
+                mac->ops.enable_tx_laser =
+                                        &ixgbe_enable_tx_laser_multispeed_fiber;
                 mac->ops.flap_tx_laser = &ixgbe_flap_tx_laser_multispeed_fiber;
         } else {
+                mac->ops.disable_tx_laser = NULL;
+                mac->ops.enable_tx_laser = NULL;
                 mac->ops.flap_tx_laser = NULL;
                 if ((mac->ops.get_media_type(hw) ==
                      ixgbe_media_type_backplane) &&
@@ -415,6 +423,44 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
         return status;
 }
 
+ /**
+  *  ixgbe_disable_tx_laser_multispeed_fiber - Disable Tx laser
+  *  @hw: pointer to hardware structure
+  *
+  *  The base drivers may require better control over SFP+ module
+  *  PHY states.  This includes selectively shutting down the Tx
+  *  laser on the PHY, effectively halting physical link.
+  **/
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+
+        /* Disable tx laser; allow 100us to go dark per spec */
+        esdp_reg |= IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        udelay(100);
+}
+
+/**
+ *  ixgbe_enable_tx_laser_multispeed_fiber - Enable Tx laser
+ *  @hw: pointer to hardware structure
+ *
+ *  The base drivers may require better control over SFP+ module
+ *  PHY states.  This includes selectively turning on the Tx
+ *  laser on the PHY, effectively starting physical link.
+ **/
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+
+        /* Enable tx laser; allow 100ms to light up */
+        esdp_reg &= ~IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        msleep(100);
+}
+
 /**
  *  ixgbe_flap_tx_laser_multispeed_fiber - Flap Tx laser
  *  @hw: pointer to hardware structure
@@ -429,23 +475,11 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
  **/
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
 {
-        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
-
         hw_dbg(hw, "ixgbe_flap_tx_laser_multispeed_fiber\n");
 
         if (hw->mac.autotry_restart) {
-                /* Disable tx laser; allow 100us to go dark per spec */
-                esdp_reg |= IXGBE_ESDP_SDP3;
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                udelay(100);
-
-                /* Enable tx laser; allow 100ms to light up */
-                esdp_reg &= ~IXGBE_ESDP_SDP3;
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                msleep(100);
-
+                ixgbe_disable_tx_laser_multispeed_fiber(hw);
+                ixgbe_enable_tx_laser_multispeed_fiber(hw);
                 hw->mac.autotry_restart = false;
         }
 }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 8f677cb86290..6c00ee493a3b 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2982,6 +2982,10 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
         else
                 ixgbe_configure_msi_and_legacy(adapter);
 
+        /* enable the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.enable_tx_laser(hw);
+
         clear_bit(__IXGBE_DOWN, &adapter->state);
         ixgbe_napi_enable_all(adapter);
 
@@ -3243,6 +3247,10 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
         /* signal that we are down to the interrupt handler */
         set_bit(__IXGBE_DOWN, &adapter->state);
 
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
+
         /* disable receive for all VFs and wait one second */
         if (adapter->num_vfs) {
                 /* ping all the active vfs to let them know we are going down */
@@ -6253,6 +6261,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 goto err_eeprom;
         }
 
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
+
         init_timer(&adapter->watchdog_timer);
         adapter->watchdog_timer.function = &ixgbe_watchdog;
         adapter->watchdog_timer.data = (unsigned long)adapter;
@@ -6400,16 +6412,6 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
         del_timer_sync(&adapter->sfp_timer);
         cancel_work_sync(&adapter->watchdog_task);
         cancel_work_sync(&adapter->sfp_task);
-        if (adapter->hw.phy.multispeed_fiber) {
-                struct ixgbe_hw *hw = &adapter->hw;
-                /*
-                 * Restart clause 37 autoneg, disable and re-enable
-                 * the tx laser, to clear & alert the link partner
-                 * that it needs to restart autotry
-                 */
-                hw->mac.autotry_restart = true;
-                hw->mac.ops.flap_tx_laser(hw);
-        }
         cancel_work_sync(&adapter->multispeed_fiber_task);
         cancel_work_sync(&adapter->sfp_config_module_task);
         if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 4ec6dc1a5b75..534affcc38ca 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -2398,6 +2398,8 @@ struct ixgbe_mac_operations {
         s32 (*enable_rx_dma)(struct ixgbe_hw *, u32);
 
         /* Link */
+        void (*disable_tx_laser)(struct ixgbe_hw *);
+        void (*enable_tx_laser)(struct ixgbe_hw *);
         void (*flap_tx_laser)(struct ixgbe_hw *);
         s32 (*setup_link)(struct ixgbe_hw *, ixgbe_link_speed, bool, bool);
         s32 (*check_link)(struct ixgbe_hw *, ixgbe_link_speed *, bool *, bool);
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index 13cc1ca261d9..9e9f9b349766 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -722,12 +722,14 @@ static void ks8851_tx_work(struct work_struct *work)
                 txb = skb_dequeue(&ks->txq);
                 last = skb_queue_empty(&ks->txq);
 
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
-                ks8851_wrpkt(ks, txb, last);
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
-                ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+                if (txb != NULL) {
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+                        ks8851_wrpkt(ks, txb, last);
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                        ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
 
-                ks8851_done_tx(ks, txb);
+                        ks8851_done_tx(ks, txb);
+                }
         }
 
         mutex_unlock(&ks->lock);
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index 3d1d3a7b7ed3..757f87bb1db3 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -781,8 +781,13 @@ static netdev_tx_t el3_start_xmit(struct sk_buff *skb,
                   inw(ioaddr + EL3_STATUS));
 
         spin_lock_irqsave(&lp->window_lock, flags);
+
+        dev->stats.tx_bytes += skb->len;
+
+        /* Put out the doubleword header... */
         outw(skb->len, ioaddr + TX_FIFO);
         outw(0, ioaddr + TX_FIFO);
+        /* ... and the packet rounded to a doubleword. */
         outsl(ioaddr + TX_FIFO, skb->data, (skb->len+3)>>2);
 
         dev->trans_start = jiffies;
@@ -1021,8 +1026,6 @@ static void update_stats(struct net_device *dev)
         /* BadSSD */                               inb(ioaddr + 12);
         up                                       = inb(ioaddr + 13);
 
-        dev->stats.tx_bytes                     += tx + ((up & 0xf0) << 12);
-
         EL3WINDOW(1);
 }
 
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index fd9d6e34fda4..ccc553782a0d 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -1804,23 +1804,30 @@ static void media_check(u_long arg)
     SMC_SELECT_BANK(1);
     media |= (inw(ioaddr + CONFIG) & CFG_AUI_SELECT) ? 2 : 1;
 
+    SMC_SELECT_BANK(saved_bank);
+    spin_unlock_irqrestore(&smc->lock, flags);
+
     /* Check for pending interrupt with watchdog flag set: with
        this, we can limp along even if the interrupt is blocked */
     if (smc->watchdog++ && ((i>>8) & i)) {
         if (!smc->fast_poll)
             printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+        local_irq_save(flags);
         smc_interrupt(dev->irq, dev);
+        local_irq_restore(flags);
         smc->fast_poll = HZ;
     }
     if (smc->fast_poll) {
         smc->fast_poll--;
         smc->media.expires = jiffies + HZ/100;
         add_timer(&smc->media);
-        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irqrestore(&smc->lock, flags);
         return;
     }
 
+    spin_lock_irqsave(&smc->lock, flags);
+
+    saved_bank = inw(ioaddr + BANK_SELECT);
+
     if (smc->cfg & CFG_MII_SELECT) {
         if (smc->mii_if.phy_id < 0)
             goto reschedule;
@@ -1978,15 +1985,16 @@ static int smc_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         int ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         if (smc->cfg & CFG_MII_SELECT)
                 ret = mii_ethtool_gset(&smc->mii_if, ecmd);
         else
                 ret = smc_netdev_get_ecmd(dev, ecmd);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -1996,15 +2004,16 @@ static int smc_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         int ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         if (smc->cfg & CFG_MII_SELECT)
                 ret = mii_ethtool_sset(&smc->mii_if, ecmd);
         else
                 ret = smc_netdev_set_ecmd(dev, ecmd);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -2014,12 +2023,13 @@ static u32 smc_get_link(struct net_device *dev)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         u32 ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         ret = smc_link_ok(dev);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -2056,16 +2066,17 @@ static int smc_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
         int rc = 0;
         u16 saved_bank;
         unsigned int ioaddr = dev->base_addr;
+        unsigned long flags;
 
         if (!netif_running(dev))
                 return -EINVAL;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         saved_bank = inw(ioaddr + BANK_SELECT);
         SMC_SELECT_BANK(3);
         rc = generic_mii_ioctl(&smc->mii_if, mii, cmd, NULL);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return rc;
 }
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index dbb1f5a1824c..4748c21eb72e 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2759,6 +2759,7 @@ static void rtl8169_release_board(struct pci_dev *pdev, struct net_device *dev,
 {
         iounmap(ioaddr);
         pci_release_regions(pdev);
+        pci_clear_mwi(pdev);
         pci_disable_device(pdev);
         free_netdev(dev);
 }
@@ -2825,8 +2826,13 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
         spin_lock_irq(&tp->lock);
 
         RTL_W8(Cfg9346, Cfg9346_Unlock);
+
         RTL_W32(MAC4, high);
+        RTL_R32(MAC4);
+
         RTL_W32(MAC0, low);
+        RTL_R32(MAC0);
+
         RTL_W8(Cfg9346, Cfg9346_Lock);
 
         spin_unlock_irq(&tp->lock);
@@ -3014,9 +3020,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_out_free_dev_1;
         }
 
-        rc = pci_set_mwi(pdev);
-        if (rc < 0)
-                goto err_out_disable_2;
+        if (pci_set_mwi(pdev) < 0)
+                netif_info(tp, probe, dev, "Mem-Wr-Inval unavailable\n");
 
         /* make sure PCI base addr 1 is MMIO */
         if (!(pci_resource_flags(pdev, region) & IORESOURCE_MEM)) {
@@ -3024,7 +3029,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                           "region #%d not an MMIO resource, aborting\n",
                           region);
                 rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
         }
 
         /* check for weird/broken PCI region reporting */
@@ -3032,13 +3037,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 netif_err(tp, probe, dev,
                           "Invalid PCI region size(s), aborting\n");
                 rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
         }
 
         rc = pci_request_regions(pdev, MODULENAME);
         if (rc < 0) {
                 netif_err(tp, probe, dev, "could not request regions\n");
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
         }
 
         tp->cp_cmd = PCIMulRW | RxChkSum;
@@ -3051,7 +3056,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                 if (rc < 0) {
                         netif_err(tp, probe, dev, "DMA configuration failed\n");
-                        goto err_out_free_res_4;
+                        goto err_out_free_res_3;
                 }
         }
 
@@ -3060,7 +3065,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!ioaddr) {
                 netif_err(tp, probe, dev, "cannot remap MMIO, aborting\n");
                 rc = -EIO;
-                goto err_out_free_res_4;
+                goto err_out_free_res_3;
         }
 
         tp->pcie_cap = pci_find_capability(pdev, PCI_CAP_ID_EXP);
@@ -3102,7 +3107,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (i == ARRAY_SIZE(rtl_chip_info)) {
                 dev_err(&pdev->dev,
                         "driver bug, MAC version not found in rtl_chip_info\n");
-                goto err_out_msi_5;
+                goto err_out_msi_4;
         }
         tp->chipset = i;
 
@@ -3167,7 +3172,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         rc = register_netdev(dev);
         if (rc < 0)
-                goto err_out_msi_5;
+                goto err_out_msi_4;
 
         pci_set_drvdata(pdev, dev);
 
@@ -3190,14 +3195,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 out:
         return rc;
 
-err_out_msi_5:
+err_out_msi_4:
         rtl_disable_msi(pdev, tp);
         iounmap(ioaddr);
-err_out_free_res_4:
+err_out_free_res_3:
         pci_release_regions(pdev);
-err_out_mwi_3:
+err_out_mwi_2:
         pci_clear_mwi(pdev);
-err_out_disable_2:
         pci_disable_device(pdev);
 err_out_free_dev_1:
         free_netdev(dev);
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 6486657c47b8..649a264d6a81 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -1861,6 +1861,7 @@ out:
         }
 
         if (disabled) {
+                dev_close(efx->net_dev);
                 EFX_ERR(efx, "has been disabled\n");
                 efx->state = STATE_DISABLED;
         } else {
@@ -1884,8 +1885,7 @@ static void efx_reset_work(struct work_struct *data)
         }
 
         rtnl_lock();
-        if (efx_reset(efx, efx->reset_pending))
-                dev_close(efx->net_dev);
+        (void)efx_reset(efx, efx->reset_pending);
         rtnl_unlock();
 }
 
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index d294d66fd600..08278e7302b3 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -1320,7 +1320,9 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
 
         EFX_LOG(efx, "PHY is %d phy_id %d\n", efx->phy_type, efx->mdio.prtad);
 
-        falcon_probe_board(efx, board_rev);
+        rc = falcon_probe_board(efx, board_rev);
+        if (rc)
+                goto fail2;
 
         kfree(nvconfig);
         return 0;
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index 5712fddd72f2..c7a933a3292e 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -728,15 +728,7 @@ static const struct falcon_board_type board_types[] = {
         },
 };
 
-static const struct falcon_board_type falcon_dummy_board = {
-        .init           = efx_port_dummy_op_int,
-        .init_phy       = efx_port_dummy_op_void,
-        .fini           = efx_port_dummy_op_void,
-        .set_id_led     = efx_port_dummy_op_set_id_led,
-        .monitor        = efx_port_dummy_op_int,
-};
-
-void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
+int falcon_probe_board(struct efx_nic *efx, u16 revision_info)
 {
         struct falcon_board *board = falcon_board(efx);
         u8 type_id = FALCON_BOARD_TYPE(revision_info);
@@ -754,8 +746,9 @@ void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
                          (efx->pci_dev->subsystem_vendor == EFX_VENDID_SFC)
                          ? board->type->ref_model : board->type->gen_type,
                          'A' + board->major, board->minor);
+                return 0;
         } else {
                 EFX_ERR(efx, "unknown board type %d\n", type_id);
-                board->type = &falcon_dummy_board;
+                return -ENODEV;
         }
 }
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 9351c0331a47..3166bafdfbef 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -156,7 +156,7 @@ extern struct efx_nic_type siena_a0_nic_type;
  **************************************************************************
  */
 
-extern void falcon_probe_board(struct efx_nic *efx, u16 revision_info);
+extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
 
 /* TX data path */
 extern int efx_nic_probe_tx(struct efx_tx_queue *tx_queue);
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 38dcc42c4f79..e0c46f59d1f8 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -456,8 +456,17 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
 
 static void siena_update_nic_stats(struct efx_nic *efx)
 {
-        while (siena_try_update_nic_stats(efx) == -EAGAIN)
-                cpu_relax();
+        int retry;
+
+        /* If we're unlucky enough to read statistics wduring the DMA, wait
+         * up to 10ms for it to finish (typically takes <500us) */
+        for (retry = 0; retry < 100; ++retry) {
+                if (siena_try_update_nic_stats(efx) == 0)
+                        return;
+                udelay(100);
+        }
+
+        /* Use the old values instead */
 }
 
 static void siena_start_nic_stats(struct efx_nic *efx)
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 22cf1c446de3..ecc41cffb470 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -8633,6 +8633,7 @@ static int tg3_test_msi(struct tg3 *tp)
         pci_disable_msi(tp->pdev);
 
         tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
+        tp->napi[0].irq_vec = tp->pdev->irq;
 
         err = tg3_request_irq(tp, 0);
         if (err)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index ba56ce4382d9..5d58abc224f4 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,4 +385,26 @@ config USB_CDC_PHONET
           cellular modem, as found on most Nokia handsets with the
           "PC suite" USB profile.
 
+config USB_IPHETH
+        tristate "Apple iPhone USB Ethernet driver"
+        default n
+        ---help---
+          Module used to share Internet connection (tethering) from your
+          iPhone (Original, 3G and 3GS) to your system.
+          Note that you need userspace libraries and programs that are needed
+          to pair your device with your system and that understand the iPhone
+          protocol.
+
+          For more information: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+
+config USB_SIERRA_NET
+        tristate "USB-to-WWAN Driver for Sierra Wireless modems"
+        depends on USB_USBNET
+        default y
+        help
+          Choose this option if you have a Sierra Wireless USB-to-WWAN device.
+
+          To compile this driver as a module, choose M here: the
+          module will be called sierra_net.
+
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 82ea62955b56..b13a279663ba 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,4 +23,6 @@ obj-$(CONFIG_USB_NET_MCS7830)	+= mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
+obj-$(CONFIG_USB_IPHETH)        += ipheth.o
+obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index c8cdb7f30adc..3547cf13d219 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -431,6 +431,7 @@ static const struct driver_info mbm_info = {
         .bind =         cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       cdc_status,
+        .manage_power = cdc_manage_power,
 };
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
new file mode 100644
index 000000000000..418825d26f90
--- /dev/null
+++ b/drivers/net/usb/ipheth.c
@@ -0,0 +1,569 @@
+/*
+ * ipheth.c - Apple iPhone USB Ethernet driver
+ *
+ * Copyright (c) 2009 Diego Giagio <diego@giagio.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of GIAGIO.COM nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Alternatively, provided that this notice is retained in full, this
+ * software may be distributed under the terms of the GNU General
+ * Public License ("GPL") version 2, in which case the provisions of the
+ * GPL apply INSTEAD OF those given above.
+ *
+ * The provided data structures and external interfaces from this code
+ * are not restricted to be used by modules with a GPL compatible license.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ *
+ * Attention: iPhone device must be paired, otherwise it won't respond to our
+ * driver. For more info: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/usb.h>
+#include <linux/workqueue.h>
+
+#define USB_VENDOR_APPLE        0x05ac
+#define USB_PRODUCT_IPHONE      0x1290
+#define USB_PRODUCT_IPHONE_3G   0x1292
+#define USB_PRODUCT_IPHONE_3GS  0x1294
+
+#define IPHETH_USBINTF_CLASS    255
+#define IPHETH_USBINTF_SUBCLASS 253
+#define IPHETH_USBINTF_PROTO    1
+
+#define IPHETH_BUF_SIZE         1516
+#define IPHETH_TX_TIMEOUT       (5 * HZ)
+
+#define IPHETH_INTFNUM          2
+#define IPHETH_ALT_INTFNUM      1
+
+#define IPHETH_CTRL_ENDP        0x00
+#define IPHETH_CTRL_BUF_SIZE    0x40
+#define IPHETH_CTRL_TIMEOUT     (5 * HZ)
+
+#define IPHETH_CMD_GET_MACADDR   0x00
+#define IPHETH_CMD_CARRIER_CHECK 0x45
+
+#define IPHETH_CARRIER_CHECK_TIMEOUT round_jiffies_relative(1 * HZ)
+#define IPHETH_CARRIER_ON       0x04
+
+static struct usb_device_id ipheth_table[] = {
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3G,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3GS,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { }
+};
+MODULE_DEVICE_TABLE(usb, ipheth_table);
+
+struct ipheth_device {
+        struct usb_device *udev;
+        struct usb_interface *intf;
+        struct net_device *net;
+        struct sk_buff *tx_skb;
+        struct urb *tx_urb;
+        struct urb *rx_urb;
+        unsigned char *tx_buf;
+        unsigned char *rx_buf;
+        unsigned char *ctrl_buf;
+        u8 bulk_in;
+        u8 bulk_out;
+        struct delayed_work carrier_work;
+};
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags);
+
+static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+{
+        struct urb *tx_urb = NULL;
+        struct urb *rx_urb = NULL;
+        u8 *tx_buf = NULL;
+        u8 *rx_buf = NULL;
+
+        tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (tx_urb == NULL)
+                goto error_nomem;
+
+        rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (rx_urb == NULL)
+                goto free_tx_urb;
+
+        tx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &tx_urb->transfer_dma);
+        if (tx_buf == NULL)
+                goto free_rx_urb;
+
+        rx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &rx_urb->transfer_dma);
+        if (rx_buf == NULL)
+                goto free_tx_buf;
+
+
+        iphone->tx_urb = tx_urb;
+        iphone->rx_urb = rx_urb;
+        iphone->tx_buf = tx_buf;
+        iphone->rx_buf = rx_buf;
+        return 0;
+
+free_tx_buf:
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
+                        tx_urb->transfer_dma);
+free_rx_urb:
+        usb_free_urb(rx_urb);
+free_tx_urb:
+        usb_free_urb(tx_urb);
+error_nomem:
+        return -ENOMEM;
+}
+
+static void ipheth_free_urbs(struct ipheth_device *iphone)
+{
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf,
+                        iphone->rx_urb->transfer_dma);
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf,
+                        iphone->tx_urb->transfer_dma);
+        usb_free_urb(iphone->rx_urb);
+        usb_free_urb(iphone->tx_urb);
+}
+
+static void ipheth_kill_urbs(struct ipheth_device *dev)
+{
+        usb_kill_urb(dev->tx_urb);
+        usb_kill_urb(dev->rx_urb);
+}
+
+static void ipheth_rcvbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+        struct sk_buff *skb;
+        int status;
+        char *buf;
+        int len;
+
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+
+        status = urb->status;
+        switch (status) {
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                return;
+        case 0:
+                break;
+        default:
+                err("%s: urb status: %d", __func__, urb->status);
+                return;
+        }
+
+        len = urb->actual_length;
+        buf = urb->transfer_buffer;
+
+        skb = dev_alloc_skb(NET_IP_ALIGN + len);
+        if (!skb) {
+                err("%s: dev_alloc_skb: -ENOMEM", __func__);
+                dev->net->stats.rx_dropped++;
+                return;
+        }
+
+        skb_reserve(skb, NET_IP_ALIGN);
+        memcpy(skb_put(skb, len), buf + NET_IP_ALIGN, len - NET_IP_ALIGN);
+        skb->dev = dev->net;
+        skb->protocol = eth_type_trans(skb, dev->net);
+
+        dev->net->stats.rx_packets++;
+        dev->net->stats.rx_bytes += len;
+
+        netif_rx(skb);
+        ipheth_rx_submit(dev, GFP_ATOMIC);
+}
+
+static void ipheth_sndbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+
+        if (urb->status != 0 &&
+            urb->status != -ENOENT &&
+            urb->status != -ECONNRESET &&
+            urb->status != -ESHUTDOWN)
+                err("%s: urb status: %d", __func__, urb->status);
+
+        dev_kfree_skb_irq(dev->tx_skb);
+        netif_wake_queue(dev->net);
+}
+
+static int ipheth_carrier_set(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        retval = usb_control_msg(udev,
+                        usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                        IPHETH_CMD_CARRIER_CHECK, /* request */
+                        0xc0, /* request type */
+                        0x00, /* value */
+                        0x02, /* index */
+                        dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
+                        IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+                return retval;
+        }
+
+        if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON)
+                netif_carrier_on(dev->net);
+        else
+                netif_carrier_off(dev->net);
+
+        return 0;
+}
+
+static void ipheth_carrier_check_work(struct work_struct *work)
+{
+        struct ipheth_device *dev = container_of(work, struct ipheth_device,
+                                                 carrier_work.work);
+
+        ipheth_carrier_set(dev);
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+}
+
+static int ipheth_get_macaddr(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        struct net_device *net = dev->net;
+        int retval;
+
+        retval = usb_control_msg(udev,
+                                 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                                 IPHETH_CMD_GET_MACADDR, /* request */
+                                 0xc0, /* request type */
+                                 0x00, /* value */
+                                 0x02, /* index */
+                                 dev->ctrl_buf,
+                                 IPHETH_CTRL_BUF_SIZE,
+                                 IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+        } else if (retval < ETH_ALEN) {
+                err("%s: usb_control_msg: short packet: %d bytes",
+                        __func__, retval);
+                retval = -EINVAL;
+        } else {
+                memcpy(net->dev_addr, dev->ctrl_buf, ETH_ALEN);
+                retval = 0;
+        }
+
+        return retval;
+}
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        usb_fill_bulk_urb(dev->rx_urb, udev,
+                          usb_rcvbulkpipe(udev, dev->bulk_in),
+                          dev->rx_buf, IPHETH_BUF_SIZE,
+                          ipheth_rcvbulk_callback,
+                          dev);
+        dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        retval = usb_submit_urb(dev->rx_urb, mem_flags);
+        if (retval)
+                err("%s: usb_submit_urb: %d", __func__, retval);
+        return retval;
+}
+
+static int ipheth_open(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval = 0;
+
+        usb_set_interface(udev, IPHETH_INTFNUM, IPHETH_ALT_INTFNUM);
+
+        retval = ipheth_carrier_set(dev);
+        if (retval)
+                return retval;
+
+        retval = ipheth_rx_submit(dev, GFP_KERNEL);
+        if (retval)
+                return retval;
+
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+        netif_start_queue(net);
+        return retval;
+}
+
+static int ipheth_close(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+
+        cancel_delayed_work_sync(&dev->carrier_work);
+        netif_stop_queue(net);
+        return 0;
+}
+
+static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        /* Paranoid */
+        if (skb->len > IPHETH_BUF_SIZE) {
+                WARN(1, "%s: skb too large: %d bytes", __func__, skb->len);
+                dev->net->stats.tx_dropped++;
+                dev_kfree_skb_irq(skb);
+                return NETDEV_TX_OK;
+        }
+
+        memcpy(dev->tx_buf, skb->data, skb->len);
+        if (skb->len < IPHETH_BUF_SIZE)
+                memset(dev->tx_buf + skb->len, 0, IPHETH_BUF_SIZE - skb->len);
+
+        usb_fill_bulk_urb(dev->tx_urb, udev,
+                          usb_sndbulkpipe(udev, dev->bulk_out),
+                          dev->tx_buf, IPHETH_BUF_SIZE,
+                          ipheth_sndbulk_callback,
+                          dev);
+        dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
+        if (retval) {
+                err("%s: usb_submit_urb: %d", __func__, retval);
+                dev->net->stats.tx_errors++;
+                dev_kfree_skb_irq(skb);
+        } else {
+                dev->tx_skb = skb;
+
+                dev->net->stats.tx_packets++;
+                dev->net->stats.tx_bytes += skb->len;
+                netif_stop_queue(net);
+        }
+
+        return NETDEV_TX_OK;
+}
+
+static void ipheth_tx_timeout(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+
+        err("%s: TX timeout", __func__);
+        dev->net->stats.tx_errors++;
+        usb_unlink_urb(dev->tx_urb);
+}
+
+static struct net_device_stats *ipheth_stats(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return &dev->net->stats;
+}
+
+static u32 ipheth_ethtool_op_get_link(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return netif_carrier_ok(dev->net);
+}
+
+static struct ethtool_ops ops = {
+        .get_link = ipheth_ethtool_op_get_link
+};
+
+static const struct net_device_ops ipheth_netdev_ops = {
+        .ndo_open = &ipheth_open,
+        .ndo_stop = &ipheth_close,
+        .ndo_start_xmit = &ipheth_tx,
+        .ndo_tx_timeout = &ipheth_tx_timeout,
+        .ndo_get_stats = &ipheth_stats,
+};
+
+static struct device_type ipheth_type = {
+        .name   = "wwan",
+};
+
+static int ipheth_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct usb_host_interface *hintf;
+        struct usb_endpoint_descriptor *endp;
+        struct ipheth_device *dev;
+        struct net_device *netdev;
+        int i;
+        int retval;
+
+        netdev = alloc_etherdev(sizeof(struct ipheth_device));
+        if (!netdev)
+                return -ENOMEM;
+
+        netdev->netdev_ops = &ipheth_netdev_ops;
+        netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
+        strcpy(netdev->name, "wwan%d");
+
+        dev = netdev_priv(netdev);
+        dev->udev = udev;
+        dev->net = netdev;
+        dev->intf = intf;
+
+        /* Set up endpoints */
+        hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM);
+        if (hintf == NULL) {
+                retval = -ENODEV;
+                err("Unable to find alternate settings interface");
+                goto err_endpoints;
+        }
+
+        for (i = 0; i < hintf->desc.bNumEndpoints; i++) {
+                endp = &hintf->endpoint[i].desc;
+                if (usb_endpoint_is_bulk_in(endp))
+                        dev->bulk_in = endp->bEndpointAddress;
+                else if (usb_endpoint_is_bulk_out(endp))
+                        dev->bulk_out = endp->bEndpointAddress;
+        }
+        if (!(dev->bulk_in && dev->bulk_out)) {
+                retval = -ENODEV;
+                err("Unable to find endpoints");
+                goto err_endpoints;
+        }
+
+        dev->ctrl_buf = kmalloc(IPHETH_CTRL_BUF_SIZE, GFP_KERNEL);
+        if (dev->ctrl_buf == NULL) {
+                retval = -ENOMEM;
+                goto err_alloc_ctrl_buf;
+        }
+
+        retval = ipheth_get_macaddr(dev);
+        if (retval)
+                goto err_get_macaddr;
+
+        INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
+
+        retval = ipheth_alloc_urbs(dev);
+        if (retval) {
+                err("error allocating urbs: %d", retval);
+                goto err_alloc_urbs;
+        }
+
+        usb_set_intfdata(intf, dev);
+
+        SET_NETDEV_DEV(netdev, &intf->dev);
+        SET_ETHTOOL_OPS(netdev, &ops);
+        SET_NETDEV_DEVTYPE(netdev, &ipheth_type);
+
+        retval = register_netdev(netdev);
+        if (retval) {
+                err("error registering netdev: %d", retval);
+                retval = -EIO;
+                goto err_register_netdev;
+        }
+
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n");
+        return 0;
+
+err_register_netdev:
+        ipheth_free_urbs(dev);
+err_alloc_urbs:
+err_get_macaddr:
+err_alloc_ctrl_buf:
+        kfree(dev->ctrl_buf);
+err_endpoints:
+        free_netdev(netdev);
+        return retval;
+}
+
+static void ipheth_disconnect(struct usb_interface *intf)
+{
+        struct ipheth_device *dev;
+
+        dev = usb_get_intfdata(intf);
+        if (dev != NULL) {
+                unregister_netdev(dev->net);
+                ipheth_kill_urbs(dev);
+                ipheth_free_urbs(dev);
+                kfree(dev->ctrl_buf);
+                free_netdev(dev->net);
+        }
+        usb_set_intfdata(intf, NULL);
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet now disconnected\n");
+}
+
+static struct usb_driver ipheth_driver = {
+        .name =         "ipheth",
+        .probe =        ipheth_probe,
+        .disconnect =   ipheth_disconnect,
+        .id_table =     ipheth_table,
+};
+
+static int __init ipheth_init(void)
+{
+        int retval;
+
+        retval = usb_register(&ipheth_driver);
+        if (retval) {
+                err("usb_register failed: %d", retval);
+                return retval;
+        }
+        return 0;
+}
+
+static void __exit ipheth_exit(void)
+{
+        usb_deregister(&ipheth_driver);
+}
+
+module_init(ipheth_init);
+module_exit(ipheth_exit);
+
+MODULE_AUTHOR("Diego Giagio <diego@giagio.com>");
+MODULE_DESCRIPTION("Apple iPhone USB Ethernet driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 52671ea043a7..c4c334d9770f 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -145,6 +145,7 @@ static struct usb_device_id usb_klsi_table[] = {
         { USB_DEVICE(0x0707, 0x0100) }, /* SMC 2202USB */
         { USB_DEVICE(0x07aa, 0x0001) }, /* Correga K.K. */
         { USB_DEVICE(0x07b8, 0x4000) }, /* D-Link DU-E10 */
+        { USB_DEVICE(0x07c9, 0xb010) }, /* Allied Telesyn AT-USB10 USB Ethernet Adapter */
         { USB_DEVICE(0x0846, 0x1001) }, /* NetGear EA-101 */
         { USB_DEVICE(0x0846, 0x1002) }, /* NetGear EA-101 */
         { USB_DEVICE(0x085a, 0x0008) }, /* PortGear Ethernet Adapter */
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
new file mode 100644
index 000000000000..a44f9e0ea098
--- /dev/null
+++ b/drivers/net/usb/sierra_net.c
@@ -0,0 +1,1001 @@
+/*
+ * USB-to-WWAN Driver for Sierra Wireless modems
+ *
+ * Copyright (C) 2008, 2009, 2010 Paxton Smith, Matthew Safar, Rory Filer
+ *                          <linux@sierrawireless.com>
+ *
+ * Portions of this based on the cdc_ether driver by David Brownell (2003-2005)
+ * and Ole Andre Vadla Ravnas (ActiveSync) (2006).
+ *
+ * IMPORTANT DISCLAIMER: This driver is not commercially supported by
+ * Sierra Wireless. Use at your own risk.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#define DRIVER_VERSION "v.2.0"
+#define DRIVER_AUTHOR "Paxton Smith, Matthew Safar, Rory Filer"
+#define DRIVER_DESC "USB-to-WWAN Driver for Sierra Wireless modems"
+static const char driver_name[] = "sierra_net";
+
+/* if defined debug messages enabled */
+/*#define       DEBUG*/
+
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <net/ip.h>
+#include <net/udp.h>
+#include <asm/unaligned.h>
+#include <linux/usb/usbnet.h>
+
+#define SWI_USB_REQUEST_GET_FW_ATTR     0x06
+#define SWI_GET_FW_ATTR_MASK            0x08
+
+/* atomic counter partially included in MAC address to make sure 2 devices
+ * do not end up with the same MAC - concept breaks in case of > 255 ifaces
+ */
+static  atomic_t iface_counter = ATOMIC_INIT(0);
+
+/*
+ * SYNC Timer Delay definition used to set the expiry time
+ */
+#define SIERRA_NET_SYNCDELAY (2*HZ)
+
+/* Max. MTU supported. The modem buffers are limited to 1500 */
+#define SIERRA_NET_MAX_SUPPORTED_MTU    1500
+
+/* The SIERRA_NET_USBCTL_BUF_LEN defines a buffer size allocated for control
+ * message reception ... and thus the max. received packet.
+ * (May be the cause for parse_hip returning -EINVAL)
+ */
+#define SIERRA_NET_USBCTL_BUF_LEN       1024
+
+/* list of interface numbers - used for constructing interface lists */
+struct sierra_net_iface_info {
+        const u32 infolen;      /* number of interface numbers on list */
+        const u8  *ifaceinfo;   /* pointer to the array holding the numbers */
+};
+
+struct sierra_net_info_data {
+        u16 rx_urb_size;
+        struct sierra_net_iface_info whitelist;
+};
+
+/* Private data structure */
+struct sierra_net_data {
+
+        u8 ethr_hdr_tmpl[ETH_HLEN]; /* ethernet header template for rx'd pkts */
+
+        u16 link_up;            /* air link up or down */
+        u8 tx_hdr_template[4];  /* part of HIP hdr for tx'd packets */
+
+        u8 sync_msg[4];         /* SYNC message */
+        u8 shdwn_msg[4];        /* Shutdown message */
+
+        /* Backpointer to the container */
+        struct usbnet *usbnet;
+
+        u8 ifnum;       /* interface number */
+
+/* Bit masks, must be a power of 2 */
+#define SIERRA_NET_EVENT_RESP_AVAIL    0x01
+#define SIERRA_NET_TIMER_EXPIRY        0x02
+        unsigned long kevent_flags;
+        struct work_struct sierra_net_kevent;
+        struct timer_list sync_timer; /* For retrying SYNC sequence */
+};
+
+struct param {
+        int is_present;
+        union {
+                void  *ptr;
+                u32    dword;
+                u16    word;
+                u8     byte;
+        };
+};
+
+/* HIP message type */
+#define SIERRA_NET_HIP_EXTENDEDID       0x7F
+#define SIERRA_NET_HIP_HSYNC_ID         0x60    /* Modem -> host */
+#define SIERRA_NET_HIP_RESTART_ID       0x62    /* Modem -> host */
+#define SIERRA_NET_HIP_MSYNC_ID         0x20    /* Host -> modem */
+#define SIERRA_NET_HIP_SHUTD_ID         0x26    /* Host -> modem */
+
+#define SIERRA_NET_HIP_EXT_IP_IN_ID   0x0202
+#define SIERRA_NET_HIP_EXT_IP_OUT_ID  0x0002
+
+/* 3G UMTS Link Sense Indication definitions */
+#define SIERRA_NET_HIP_LSI_UMTSID       0x78
+
+/* Reverse Channel Grant Indication HIP message */
+#define SIERRA_NET_HIP_RCGI             0x64
+
+/* LSI Protocol types */
+#define SIERRA_NET_PROTOCOL_UMTS      0x01
+/* LSI Coverage */
+#define SIERRA_NET_COVERAGE_NONE      0x00
+#define SIERRA_NET_COVERAGE_NOPACKET  0x01
+
+/* LSI Session */
+#define SIERRA_NET_SESSION_IDLE       0x00
+/* LSI Link types */
+#define SIERRA_NET_AS_LINK_TYPE_IPv4  0x00
+
+struct lsi_umts {
+        u8 protocol;
+        u8 unused1;
+        __be16 length;
+        /* eventually use a union for the rest - assume umts for now */
+        u8 coverage;
+        u8 unused2[41];
+        u8 session_state;
+        u8 unused3[33];
+        u8 link_type;
+        u8 pdp_addr_len; /* NW-supplied PDP address len */
+        u8 pdp_addr[16]; /* NW-supplied PDP address (bigendian)) */
+        u8 unused4[23];
+        u8 dns1_addr_len; /* NW-supplied 1st DNS address len (bigendian) */
+        u8 dns1_addr[16]; /* NW-supplied 1st DNS address */
+        u8 dns2_addr_len; /* NW-supplied 2nd DNS address len */
+        u8 dns2_addr[16]; /* NW-supplied 2nd DNS address (bigendian)*/
+        u8 wins1_addr_len; /* NW-supplied 1st Wins address len */
+        u8 wins1_addr[16]; /* NW-supplied 1st Wins address (bigendian)*/
+        u8 wins2_addr_len; /* NW-supplied 2nd Wins address len */
+        u8 wins2_addr[16]; /* NW-supplied 2nd Wins address (bigendian) */
+        u8 unused5[4];
+        u8 gw_addr_len; /* NW-supplied GW address len */
+        u8 gw_addr[16]; /* NW-supplied GW address (bigendian) */
+        u8 reserved[8];
+} __attribute__ ((packed));
+
+#define SIERRA_NET_LSI_COMMON_LEN      4
+#define SIERRA_NET_LSI_UMTS_LEN        (sizeof(struct lsi_umts))
+#define SIERRA_NET_LSI_UMTS_STATUS_LEN \
+        (SIERRA_NET_LSI_UMTS_LEN - SIERRA_NET_LSI_COMMON_LEN)
+
+/* Forward definitions */
+static void sierra_sync_timer(unsigned long syncdata);
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu);
+
+/* Our own net device operations structure */
+static const struct net_device_ops sierra_net_device_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = sierra_net_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+/* get private data associated with passed in usbnet device */
+static inline struct sierra_net_data *sierra_net_get_private(struct usbnet *dev)
+{
+        return (struct sierra_net_data *)dev->data[0];
+}
+
+/* set private data associated with passed in usbnet device */
+static inline void sierra_net_set_private(struct usbnet *dev,
+                        struct sierra_net_data *priv)
+{
+        dev->data[0] = (unsigned long)priv;
+}
+
+/* is packet IPv4 */
+static inline int is_ip(struct sk_buff *skb)
+{
+        return (skb->protocol == cpu_to_be16(ETH_P_IP));
+}
+
+/*
+ * check passed in packet and make sure that:
+ *  - it is linear (no scatter/gather)
+ *  - it is ethernet (mac_header properly set)
+ */
+static int check_ethip_packet(struct sk_buff *skb, struct usbnet *dev)
+{
+        skb_reset_mac_header(skb); /* ethernet header */
+
+        if (skb_is_nonlinear(skb)) {
+                netdev_err(dev->net, "Non linear buffer-dropping\n");
+                return 0;
+        }
+
+        if (!pskb_may_pull(skb, ETH_HLEN))
+                return 0;
+        skb->protocol = eth_hdr(skb)->h_proto;
+
+        return 1;
+}
+
+static const u8 *save16bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->word = get_unaligned_be16(datap);
+        return datap + sizeof(p->word);
+}
+
+static const u8 *save8bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->byte = *datap;
+        return datap + sizeof(p->byte);
+}
+
+/*----------------------------------------------------------------------------*
+ *                              BEGIN HIP                                     *
+ *----------------------------------------------------------------------------*/
+/* HIP header */
+#define SIERRA_NET_HIP_HDR_LEN 4
+/* Extended HIP header */
+#define SIERRA_NET_HIP_EXT_HDR_LEN 6
+
+struct hip_hdr {
+        int    hdrlen;
+        struct param payload_len;
+        struct param msgid;
+        struct param msgspecific;
+        struct param extmsgid;
+};
+
+static int parse_hip(const u8 *buf, const u32 buflen, struct hip_hdr *hh)
+{
+        const u8 *curp = buf;
+        int    padded;
+
+        if (buflen < SIERRA_NET_HIP_HDR_LEN)
+                return -EPROTO;
+
+        curp = save16bit(&hh->payload_len, curp);
+        curp = save8bit(&hh->msgid, curp);
+        curp = save8bit(&hh->msgspecific, curp);
+
+        padded = hh->msgid.byte & 0x80;
+        hh->msgid.byte &= 0x7F;                 /* 7 bits */
+
+        hh->extmsgid.is_present = (hh->msgid.byte == SIERRA_NET_HIP_EXTENDEDID);
+        if (hh->extmsgid.is_present) {
+                if (buflen < SIERRA_NET_HIP_EXT_HDR_LEN)
+                        return -EPROTO;
+
+                hh->payload_len.word &= 0x3FFF; /* 14 bits */
+
+                curp = save16bit(&hh->extmsgid, curp);
+                hh->extmsgid.word &= 0x03FF;    /* 10 bits */
+
+                hh->hdrlen = SIERRA_NET_HIP_EXT_HDR_LEN;
+        } else {
+                hh->payload_len.word &= 0x07FF; /* 11 bits */
+                hh->hdrlen = SIERRA_NET_HIP_HDR_LEN;
+        }
+
+        if (padded) {
+                hh->hdrlen++;
+                hh->payload_len.word--;
+        }
+
+        /* if real packet shorter than the claimed length */
+        if (buflen < (hh->hdrlen + hh->payload_len.word))
+                return -EINVAL;
+
+        return 0;
+}
+
+static void build_hip(u8 *buf, const u16 payloadlen,
+                struct sierra_net_data *priv)
+{
+        /* the following doesn't have the full functionality. We
+         * currently build only one kind of header, so it is faster this way
+         */
+        put_unaligned_be16(payloadlen, buf);
+        memcpy(buf+2, priv->tx_hdr_template, sizeof(priv->tx_hdr_template));
+}
+/*----------------------------------------------------------------------------*
+ *                              END HIP                                       *
+ *----------------------------------------------------------------------------*/
+
+static int sierra_net_send_cmd(struct usbnet *dev,
+                u8 *cmd, int cmdlen, const char * cmd_name)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int  status;
+
+        status = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SEND_ENCAPSULATED_COMMAND,
+                        USB_DIR_OUT|USB_TYPE_CLASS|USB_RECIP_INTERFACE, 0,
+                        priv->ifnum, cmd, cmdlen, USB_CTRL_SET_TIMEOUT);
+
+        if (status != cmdlen && status != -ENODEV)
+                netdev_err(dev->net, "Submit %s failed %d\n", cmd_name, status);
+
+        return status;
+}
+
+static int sierra_net_send_sync(struct usbnet *dev)
+{
+        int  status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        status = sierra_net_send_cmd(dev, priv->sync_msg,
+                        sizeof(priv->sync_msg), "SYNC");
+
+        return status;
+}
+
+static void sierra_net_set_ctx_index(struct sierra_net_data *priv, u8 ctx_ix)
+{
+        dev_dbg(&(priv->usbnet->udev->dev), "%s %d", __func__, ctx_ix);
+        priv->tx_hdr_template[0] = 0x3F;
+        priv->tx_hdr_template[1] = ctx_ix;
+        *((u16 *)&priv->tx_hdr_template[2]) =
+                cpu_to_be16(SIERRA_NET_HIP_EXT_IP_OUT_ID);
+}
+
+static inline int sierra_net_is_valid_addrlen(u8 len)
+{
+        return (len == sizeof(struct in_addr));
+}
+
+static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen)
+{
+        struct lsi_umts *lsi = (struct lsi_umts *)data;
+
+        if (datalen < sizeof(struct lsi_umts)) {
+                netdev_err(dev->net, "%s: Data length %d, exp %Zu\n",
+                                __func__, datalen,
+                                sizeof(struct lsi_umts));
+                return -1;
+        }
+
+        if (lsi->length != cpu_to_be16(SIERRA_NET_LSI_UMTS_STATUS_LEN)) {
+                netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n",
+                                __func__, be16_to_cpu(lsi->length),
+                                (u32)SIERRA_NET_LSI_UMTS_STATUS_LEN);
+                return -1;
+        }
+
+        /* Validate the protocol  - only support UMTS for now */
+        if (lsi->protocol != SIERRA_NET_PROTOCOL_UMTS) {
+                netdev_err(dev->net, "Protocol unsupported, 0x%02x\n",
+                        lsi->protocol);
+                return -1;
+        }
+
+        /* Validate the link type */
+        if (lsi->link_type != SIERRA_NET_AS_LINK_TYPE_IPv4) {
+                netdev_err(dev->net, "Link type unsupported: 0x%02x\n",
+                        lsi->link_type);
+                return -1;
+        }
+
+        /* Validate the coverage */
+        if (lsi->coverage == SIERRA_NET_COVERAGE_NONE
+           || lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) {
+                netdev_err(dev->net, "No coverage, 0x%02x\n", lsi->coverage);
+                return 0;
+        }
+
+        /* Validate the session state */
+        if (lsi->session_state == SIERRA_NET_SESSION_IDLE) {
+                netdev_err(dev->net, "Session idle, 0x%02x\n",
+                        lsi->session_state);
+                return 0;
+        }
+
+        /* Set link_sense true */
+        return 1;
+}
+
+static void sierra_net_handle_lsi(struct usbnet *dev, char *data,
+                struct hip_hdr  *hh)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int link_up;
+
+        link_up = sierra_net_parse_lsi(dev, data + hh->hdrlen,
+                                        hh->payload_len.word);
+        if (link_up < 0) {
+                netdev_err(dev->net, "Invalid LSI\n");
+                return;
+        }
+        if (link_up) {
+                sierra_net_set_ctx_index(priv, hh->msgspecific.byte);
+                priv->link_up = 1;
+                netif_carrier_on(dev->net);
+        } else {
+                priv->link_up = 0;
+                netif_carrier_off(dev->net);
+        }
+}
+
+static void sierra_net_dosync(struct usbnet *dev)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* tell modem we are ready */
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+
+        /* Now, start a timer and make sure we get the Restart Indication */
+        priv->sync_timer.function = sierra_sync_timer;
+        priv->sync_timer.data = (unsigned long) dev;
+        priv->sync_timer.expires = jiffies + SIERRA_NET_SYNCDELAY;
+        add_timer(&priv->sync_timer);
+}
+
+static void sierra_net_kevent(struct work_struct *work)
+{
+        struct sierra_net_data *priv =
+                container_of(work, struct sierra_net_data, sierra_net_kevent);
+        struct usbnet *dev = priv->usbnet;
+        int  len;
+        int  err;
+        u8  *buf;
+        u8   ifnum;
+
+        if (test_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags);
+
+                /* Query the modem for the LSI message */
+                buf = kzalloc(SIERRA_NET_USBCTL_BUF_LEN, GFP_KERNEL);
+                if (!buf) {
+                        netdev_err(dev->net,
+                                "failed to allocate buf for LS msg\n");
+                        return;
+                }
+                ifnum = priv->ifnum;
+                len = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
+                                USB_CDC_GET_ENCAPSULATED_RESPONSE,
+                                USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE,
+                                0, ifnum, buf, SIERRA_NET_USBCTL_BUF_LEN,
+                                USB_CTRL_SET_TIMEOUT);
+
+                if (len < 0) {
+                        netdev_err(dev->net,
+                                "usb_control_msg failed, status %d\n", len);
+                } else {
+                        struct hip_hdr  hh;
+
+                        dev_dbg(&dev->udev->dev, "%s: Received status message,"
+                                " %04x bytes", __func__, len);
+
+                        err = parse_hip(buf, len, &hh);
+                        if (err) {
+                                netdev_err(dev->net, "%s: Bad packet,"
+                                        " parse result %d\n", __func__, err);
+                                kfree(buf);
+                                return;
+                        }
+
+                        /* Validate packet length */
+                        if (len != hh.hdrlen + hh.payload_len.word) {
+                                netdev_err(dev->net, "%s: Bad packet, received"
+                                        " %d, expected %d\n",   __func__, len,
+                                        hh.hdrlen + hh.payload_len.word);
+                                kfree(buf);
+                                return;
+                        }
+
+                        /* Switch on received message types */
+                        switch (hh.msgid.byte) {
+                        case SIERRA_NET_HIP_LSI_UMTSID:
+                                dev_dbg(&dev->udev->dev, "LSI for ctx:%d",
+                                        hh.msgspecific.byte);
+                                sierra_net_handle_lsi(dev, buf, &hh);
+                                break;
+                        case SIERRA_NET_HIP_RESTART_ID:
+                                dev_dbg(&dev->udev->dev, "Restart reported: %d,"
+                                                " stopping sync timer",
+                                                hh.msgspecific.byte);
+                                /* Got sync resp - stop timer & clear mask */
+                                del_timer_sync(&priv->sync_timer);
+                                clear_bit(SIERRA_NET_TIMER_EXPIRY,
+                                          &priv->kevent_flags);
+                                break;
+                        case SIERRA_NET_HIP_HSYNC_ID:
+                                dev_dbg(&dev->udev->dev, "SYNC received");
+                                err = sierra_net_send_sync(dev);
+                                if (err < 0)
+                                        netdev_err(dev->net,
+                                                "Send SYNC failed %d\n", err);
+                                break;
+                        case SIERRA_NET_HIP_EXTENDEDID:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "extmsgid 0x%04x\n", hh.extmsgid.word);
+                                break;
+                        case SIERRA_NET_HIP_RCGI:
+                                /* Ignored */
+                                break;
+                        default:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "msgid 0x%02x\n", hh.msgid.byte);
+                                break;
+                        }
+                }
+                kfree(buf);
+        }
+        /* The sync timer bit might be set */
+        if (test_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags);
+                dev_dbg(&dev->udev->dev, "Deferred sync timer expiry");
+                sierra_net_dosync(priv->usbnet);
+        }
+
+        if (priv->kevent_flags)
+                dev_dbg(&dev->udev->dev, "sierra_net_kevent done, "
+                        "kevent_flags = 0x%lx", priv->kevent_flags);
+}
+
+static void sierra_net_defer_kevent(struct usbnet *dev, int work)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        set_bit(work, &priv->kevent_flags);
+        schedule_work(&priv->sierra_net_kevent);
+}
+
+/*
+ * Sync Retransmit Timer Handler. On expiry, kick the work queue
+ */
+void sierra_sync_timer(unsigned long syncdata)
+{
+        struct usbnet *dev = (struct usbnet *)syncdata;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* Kick the tasklet */
+        sierra_net_defer_kevent(dev, SIERRA_NET_TIMER_EXPIRY);
+}
+
+static void sierra_net_status(struct usbnet *dev, struct urb *urb)
+{
+        struct usb_cdc_notification *event;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        if (urb->actual_length < sizeof *event)
+                return;
+
+        /* Add cases to handle other standard notifications. */
+        event = urb->transfer_buffer;
+        switch (event->bNotificationType) {
+        case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+        case USB_CDC_NOTIFY_SPEED_CHANGE:
+                /* USB 305 sends those */
+                break;
+        case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+                sierra_net_defer_kevent(dev, SIERRA_NET_EVENT_RESP_AVAIL);
+                break;
+        default:
+                netdev_err(dev->net, ": unexpected notification %02x!\n",
+                                event->bNotificationType);
+                break;
+        }
+}
+
+static void sierra_net_get_drvinfo(struct net_device *net,
+                struct ethtool_drvinfo *info)
+{
+        /* Inherit standard device info */
+        usbnet_get_drvinfo(net, info);
+        strncpy(info->driver, driver_name, sizeof info->driver);
+        strncpy(info->version, DRIVER_VERSION, sizeof info->version);
+}
+
+static u32 sierra_net_get_link(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        /* Report link is down whenever the interface is down */
+        return sierra_net_get_private(dev)->link_up && netif_running(net);
+}
+
+static struct ethtool_ops sierra_net_ethtool_ops = {
+        .get_drvinfo = sierra_net_get_drvinfo,
+        .get_link = sierra_net_get_link,
+        .get_msglevel = usbnet_get_msglevel,
+        .set_msglevel = usbnet_set_msglevel,
+        .get_settings = usbnet_get_settings,
+        .set_settings = usbnet_set_settings,
+        .nway_reset = usbnet_nway_reset,
+};
+
+/* MTU can not be more than 1500 bytes, enforce it. */
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu)
+{
+        if (new_mtu > SIERRA_NET_MAX_SUPPORTED_MTU)
+                return -EINVAL;
+
+        return usbnet_change_mtu(net, new_mtu);
+}
+
+static int is_whitelisted(const u8 ifnum,
+                        const struct sierra_net_iface_info *whitelist)
+{
+        if (whitelist) {
+                const u8 *list = whitelist->ifaceinfo;
+                int i;
+
+                for (i = 0; i < whitelist->infolen; i++) {
+                        if (list[i] == ifnum)
+                                return 1;
+                }
+        }
+        return 0;
+}
+
+static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
+{
+        int result = 0;
+        u16 *attrdata;
+
+        attrdata = kmalloc(sizeof(*attrdata), GFP_KERNEL);
+        if (!attrdata)
+                return -ENOMEM;
+
+        result = usb_control_msg(
+                        dev->udev,
+                        usb_rcvctrlpipe(dev->udev, 0),
+                        /* _u8 vendor specific request */
+                        SWI_USB_REQUEST_GET_FW_ATTR,
+                        USB_DIR_IN | USB_TYPE_VENDOR,   /* __u8 request type */
+                        0x0000,         /* __u16 value not used */
+                        0x0000,         /* __u16 index  not used */
+                        attrdata,       /* char *data */
+                        sizeof(*attrdata),              /* __u16 size */
+                        USB_CTRL_SET_TIMEOUT);  /* int timeout */
+
+        if (result < 0) {
+                kfree(attrdata);
+                return -EIO;
+        }
+
+        *datap = *attrdata;
+
+        kfree(attrdata);
+        return result;
+}
+
+/*
+ * collects the bulk endpoints, the status endpoint.
+ */
+static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8      ifacenum;
+        u8      numendpoints;
+        u16     fwattr = 0;
+        int     status;
+        struct ethhdr *eth;
+        struct sierra_net_data *priv;
+        static const u8 sync_tmplate[sizeof(priv->sync_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_MSYNC_ID, 0x00};
+        static const u8 shdwn_tmplate[sizeof(priv->shdwn_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_SHUTD_ID, 0x00};
+
+        struct sierra_net_info_data *data =
+                        (struct sierra_net_info_data *)dev->driver_info->data;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        ifacenum = intf->cur_altsetting->desc.bInterfaceNumber;
+        /* We only accept certain interfaces */
+        if (!is_whitelisted(ifacenum, &data->whitelist)) {
+                dev_dbg(&dev->udev->dev, "Ignoring interface: %d", ifacenum);
+                return -ENODEV;
+        }
+        numendpoints = intf->cur_altsetting->desc.bNumEndpoints;
+        /* We have three endpoints, bulk in and out, and a status */
+        if (numendpoints != 3) {
+                dev_err(&dev->udev->dev, "Expected 3 endpoints, found: %d",
+                        numendpoints);
+                return -ENODEV;
+        }
+        /* Status endpoint set in usbnet_get_endpoints() */
+        dev->status = NULL;
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                dev_err(&dev->udev->dev, "Error in usbnet_get_endpoints (%d)",
+                        status);
+                return -ENODEV;
+        }
+        /* Initialize sierra private data */
+        priv = kzalloc(sizeof *priv, GFP_KERNEL);
+        if (!priv) {
+                dev_err(&dev->udev->dev, "No memory");
+                return -ENOMEM;
+        }
+
+        priv->usbnet = dev;
+        priv->ifnum = ifacenum;
+        dev->net->netdev_ops = &sierra_net_device_ops;
+
+        /* change MAC addr to include, ifacenum, and to be unique */
+        dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter);
+        dev->net->dev_addr[ETH_ALEN-1] = ifacenum;
+
+        /* we will have to manufacture ethernet headers, prepare template */
+        eth = (struct ethhdr *)priv->ethr_hdr_tmpl;
+        memcpy(&eth->h_dest, dev->net->dev_addr, ETH_ALEN);
+        eth->h_proto = cpu_to_be16(ETH_P_IP);
+
+        /* prepare shutdown message template */
+        memcpy(priv->shdwn_msg, shdwn_tmplate, sizeof(priv->shdwn_msg));
+        /* set context index initially to 0 - prepares tx hdr template */
+        sierra_net_set_ctx_index(priv, 0);
+
+        /* decrease the rx_urb_size and max_tx_size to 4k on USB 1.1 */
+        dev->rx_urb_size  = data->rx_urb_size;
+        if (dev->udev->speed != USB_SPEED_HIGH)
+                dev->rx_urb_size  = min_t(size_t, 4096, data->rx_urb_size);
+
+        dev->net->hard_header_len += SIERRA_NET_HIP_EXT_HDR_LEN;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+
+        /* Set up the netdev */
+        dev->net->flags |= IFF_NOARP;
+        dev->net->ethtool_ops = &sierra_net_ethtool_ops;
+        netif_carrier_off(dev->net);
+
+        sierra_net_set_private(dev, priv);
+
+        priv->kevent_flags = 0;
+
+        /* Use the shared workqueue */
+        INIT_WORK(&priv->sierra_net_kevent, sierra_net_kevent);
+
+        /* Only need to do this once */
+        init_timer(&priv->sync_timer);
+
+        /* verify fw attributes */
+        status = sierra_net_get_fw_attr(dev, &fwattr);
+        dev_dbg(&dev->udev->dev, "Fw attr: %x\n", fwattr);
+
+        /* test whether firmware supports DHCP */
+        if (!(status == sizeof(fwattr) && (fwattr & SWI_GET_FW_ATTR_MASK))) {
+                /* found incompatible firmware version */
+                dev_err(&dev->udev->dev, "Incompatible driver and firmware"
+                        " versions\n");
+                kfree(priv);
+                return -ENODEV;
+        }
+        /* prepare sync message from template */
+        memcpy(priv->sync_msg, sync_tmplate, sizeof(priv->sync_msg));
+
+        return 0;
+}
+
+static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* Kill the timer then flush the work queue */
+        del_timer_sync(&priv->sync_timer);
+
+        flush_scheduled_work();
+
+        /* tell modem we are going away */
+        status = sierra_net_send_cmd(dev, priv->shdwn_msg,
+                        sizeof(priv->shdwn_msg), "Shutdown");
+        if (status < 0)
+                netdev_err(dev->net,
+                        "usb_control_msg failed, status %d\n", status);
+
+        sierra_net_set_private(dev, NULL);
+
+        kfree(priv);
+}
+
+static struct sk_buff *sierra_net_skb_clone(struct usbnet *dev,
+                struct sk_buff *skb, int len)
+{
+        struct sk_buff *new_skb;
+
+        /* clone skb */
+        new_skb = skb_clone(skb, GFP_ATOMIC);
+
+        /* remove len bytes from original */
+        skb_pull(skb, len);
+
+        /* trim next packet to it's length */
+        if (new_skb) {
+                skb_trim(new_skb, len);
+        } else {
+                if (netif_msg_rx_err(dev))
+                        netdev_err(dev->net, "failed to get skb\n");
+                dev->net->stats.rx_dropped++;
+        }
+
+        return new_skb;
+}
+
+/* ---------------------------- Receive data path ----------------------*/
+static int sierra_net_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int err;
+        struct hip_hdr  hh;
+        struct sk_buff *new_skb;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* could contain multiple packets */
+        while (likely(skb->len)) {
+                err = parse_hip(skb->data, skb->len, &hh);
+                if (err) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "Invalid HIP header %d\n",
+                                        err);
+                        /* dev->net->stats.rx_errors incremented by caller */
+                        dev->net->stats.rx_length_errors++;
+                        return 0;
+                }
+
+                /* Validate Extended HIP header */
+                if (!hh.extmsgid.is_present
+                    || hh.extmsgid.word != SIERRA_NET_HIP_EXT_IP_IN_ID) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "HIP/ETH: Invalid pkt\n");
+
+                        dev->net->stats.rx_frame_errors++;
+                        /* dev->net->stats.rx_errors incremented by caller */;
+                        return 0;
+                }
+
+                skb_pull(skb, hh.hdrlen);
+
+                /* We are going to accept this packet, prepare it */
+                memcpy(skb->data, sierra_net_get_private(dev)->ethr_hdr_tmpl,
+                        ETH_HLEN);
+
+                /* Last packet in batch handled by usbnet */
+                if (hh.payload_len.word == skb->len)
+                        return 1;
+
+                new_skb = sierra_net_skb_clone(dev, skb, hh.payload_len.word);
+                if (new_skb)
+                        usbnet_skb_return(dev, new_skb);
+
+        } /* while */
+
+        return 0;
+}
+
+/* ---------------------------- Transmit data path ----------------------*/
+struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                gfp_t flags)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        u16 len;
+        bool need_tail;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        if (priv->link_up && check_ethip_packet(skb, dev) && is_ip(skb)) {
+                /* enough head room as is? */
+                if (SIERRA_NET_HIP_EXT_HDR_LEN <= skb_headroom(skb)) {
+                        /* Save the Eth/IP length and set up HIP hdr */
+                        len = skb->len;
+                        skb_push(skb, SIERRA_NET_HIP_EXT_HDR_LEN);
+                        /* Handle ZLP issue */
+                        need_tail = ((len + SIERRA_NET_HIP_EXT_HDR_LEN)
+                                % dev->maxpacket == 0);
+                        if (need_tail) {
+                                if (unlikely(skb_tailroom(skb) == 0)) {
+                                        netdev_err(dev->net, "tx_fixup:"
+                                                "no room for packet\n");
+                                        dev_kfree_skb_any(skb);
+                                        return NULL;
+                                } else {
+                                        skb->data[skb->len] = 0;
+                                        __skb_put(skb, 1);
+                                        len = len + 1;
+                                }
+                        }
+                        build_hip(skb->data, len, priv);
+                        return skb;
+                } else {
+                        /*
+                         * compensate in the future if necessary
+                         */
+                        netdev_err(dev->net, "tx_fixup: no room for HIP\n");
+                } /* headroom */
+        }
+
+        if (!priv->link_up)
+                dev->net->stats.tx_carrier_errors++;
+
+        /* tx_dropped incremented by usbnet */
+
+        /* filter the packet out, release it  */
+        dev_kfree_skb_any(skb);
+        return NULL;
+}
+
+static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
+static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
+        .rx_urb_size = 8 * 1024,
+        .whitelist = {
+                .infolen = ARRAY_SIZE(sierra_net_ifnum_list),
+                .ifaceinfo = sierra_net_ifnum_list
+        }
+};
+
+static const struct driver_info sierra_net_info_68A3 = {
+        .description = "Sierra Wireless USB-to-WWAN Modem",
+        .flags = FLAG_WWAN | FLAG_SEND_ZLP,
+        .bind = sierra_net_bind,
+        .unbind = sierra_net_unbind,
+        .status = sierra_net_status,
+        .rx_fixup = sierra_net_rx_fixup,
+        .tx_fixup = sierra_net_tx_fixup,
+        .data = (unsigned long)&sierra_net_info_data_68A3,
+};
+
+static const struct usb_device_id products[] = {
+        {USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
+        .driver_info = (unsigned long) &sierra_net_info_68A3},
+
+        {}, /* last item */
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+/* We are based on usbnet, so let it handle the USB driver specifics */
+static struct usb_driver sierra_net_driver = {
+        .name = "sierra_net",
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume,
+        .no_dynamic_id = 1,
+};
+
+static int __init sierra_net_init(void)
+{
+        BUILD_BUG_ON(FIELD_SIZEOF(struct usbnet, data)
+                                < sizeof(struct cdc_state));
+
+        return usb_register(&sierra_net_driver);
+}
+
+static void __exit sierra_net_exit(void)
+{
+        usb_deregister(&sierra_net_driver);
+}
+
+module_exit(sierra_net_exit);
+module_init(sierra_net_init);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c4844adff92a..92b3e64fc14d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -259,7 +259,7 @@ static struct iwl_lib_ops iwl6000_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
@@ -323,7 +323,7 @@ static struct iwl_lib_ops iwl6050_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8b8e3e1cbb44..bdff56583e11 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3331,6 +3331,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 
         cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
+        cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 3352f7086632..049b652bcb5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -3358,7 +3358,6 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
          */
         IWL_DEBUG_INFO(priv, "perform radio reset.\n");
         iwl_internal_short_hw_scan(priv);
-        return;
 }
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 732590f5fe30..36940a9ec6b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -506,7 +506,7 @@ void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
-int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                        const u8 *ie, int ie_len, int left);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 6054c5fba0c1..ef1720a852e9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1296,6 +1296,7 @@ struct iwl_priv {
         struct work_struct tt_work;
         struct work_struct ct_enter;
         struct work_struct ct_exit;
+        struct work_struct start_internal_scan;
 
         struct tasklet_struct irq_tasklet;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 4e1ba824dc50..8171c701e4e1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -203,6 +203,10 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
 
+/* 6000 regulatory - indirect access */
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
+                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
+
 /* 6000 and up regulatory tx power - indirect access */
 /* max. elements per section */
 #define EEPROM_MAX_TXPOWER_SECTION_ELEMENTS     (8)
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9ab0e412bf10..12e455a4b90e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -470,6 +470,8 @@ EXPORT_SYMBOL(iwl_init_scan_params);
 
 static int iwl_scan_initiate(struct iwl_priv *priv)
 {
+        WARN_ON(!mutex_is_locked(&priv->mutex));
+
         IWL_DEBUG_INFO(priv, "Starting scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = false;
@@ -547,24 +549,31 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
  * internal short scan, this function should only been called while associated.
  * It will reset and tune the radio to prevent possible RF related problem
  */
-int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+void iwl_internal_short_hw_scan(struct iwl_priv *priv)
 {
-        int ret = 0;
+        queue_work(priv->workqueue, &priv->start_internal_scan);
+}
+
+static void iwl_bg_start_internal_scan(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, start_internal_scan);
+
+        mutex_lock(&priv->mutex);
 
         if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
                 IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCANNING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
 
         priv->scan_bands = 0;
@@ -577,9 +586,8 @@ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = true;
         queue_work(priv->workqueue, &priv->request_scan);
-
-out:
-        return ret;
+ unlock:
+        mutex_unlock(&priv->mutex);
 }
 EXPORT_SYMBOL(iwl_internal_short_hw_scan);
 
@@ -965,6 +973,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
         INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
diff --git a/drivers/pci/hotplug/rpadlpar_core.c b/drivers/pci/hotplug/rpadlpar_core.c
index 4e3e0382c16e..083034710fa6 100644
--- a/drivers/pci/hotplug/rpadlpar_core.c
+++ b/drivers/pci/hotplug/rpadlpar_core.c
@@ -20,6 +20,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/string.h>
+#include <linux/vmalloc.h>
 
 #include <asm/pci-bridge.h>
 #include <linux/mutex.h>
@@ -430,6 +431,8 @@ int dlpar_remove_slot(char *drc_name)
                         rc = dlpar_remove_pci_slot(drc_name, dn);
                         break;
         }
+        vm_unmap_aliases();
+
         printk(KERN_INFO "%s: slot %s removed\n", DLPAR_MODULE_NAME, drc_name);
 exit:
         mutex_unlock(&rpadlpar_mutex);
diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
index 719702240780..ef7411c660b9 100644
--- a/drivers/pci/hotplug/rpaphp_core.c
+++ b/drivers/pci/hotplug/rpaphp_core.c
@@ -29,6 +29,7 @@
 #include <linux/pci_hotplug.h>
 #include <linux/smp.h>
 #include <linux/init.h>
+#include <linux/vmalloc.h>
 #include <asm/eeh.h>       /* for eeh_add_device() */
 #include <asm/rtas.h>           /* rtas_call */
 #include <asm/pci-bridge.h>     /* for pci_controller */
@@ -418,6 +419,8 @@ static int disable_slot(struct hotplug_slot *hotplug_slot)
                 return -EINVAL;
 
         pcibios_remove_pci_devices(slot->bus);
+        vm_unmap_aliases();
+
         slot->state = NOT_CONFIGURED;
         return 0;
 }
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 5ea587e59e48..37499127c801 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -679,7 +679,7 @@ static void __pci_start_power_transition(struct pci_dev *dev, pci_power_t state)
  */
 int __pci_complete_power_transition(struct pci_dev *dev, pci_power_t state)
 {
-        return state > PCI_D0 ?
+        return state >= PCI_D0 ?
                         pci_platform_power_transition(dev, state) : -EINVAL;
 }
 EXPORT_SYMBOL_GPL(__pci_complete_power_transition);
@@ -716,10 +716,6 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
                  */
                 return 0;
 
-        /* Check if we're already there */
-        if (dev->current_state == state)
-                return 0;
-
         __pci_start_power_transition(dev, state);
 
         /* This device is quirked not to be put into D3, so
diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
index aa495ad9bbd4..7a711ee314b7 100644
--- a/drivers/pci/pcie/aer/aerdrv.c
+++ b/drivers/pci/pcie/aer/aerdrv.c
@@ -244,11 +244,17 @@ static pci_ers_result_t aer_root_reset(struct pci_dev *dev)
 
         /* Assert Secondary Bus Reset */
         pci_read_config_word(dev, PCI_BRIDGE_CONTROL, &p2p_ctrl);
-        p2p_ctrl |= PCI_CB_BRIDGE_CTL_CB_RESET;
+        p2p_ctrl |= PCI_BRIDGE_CTL_BUS_RESET;
         pci_write_config_word(dev, PCI_BRIDGE_CONTROL, p2p_ctrl);
 
+        /*
+         * we should send hot reset message for 2ms to allow it time to
+         * propogate to all downstream ports
+         */
+        msleep(2);
+
         /* De-assert Secondary Bus Reset */
-        p2p_ctrl &= ~PCI_CB_BRIDGE_CTL_CB_RESET;
+        p2p_ctrl &= ~PCI_BRIDGE_CTL_BUS_RESET;
         pci_write_config_word(dev, PCI_BRIDGE_CONTROL, p2p_ctrl);
 
         /*
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 882bd8d29fe3..c82548afcd5c 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -174,19 +174,14 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
         pci_read_config_dword(dev, pos, &sz);
         pci_write_config_dword(dev, pos, l);
 
-        if (!sz)
-                goto fail;      /* BAR not implemented */
-
         /*
          * All bits set in sz means the device isn't working properly.
-         * If it's a memory BAR or a ROM, bit 0 must be clear; if it's
-         * an io BAR, bit 1 must be clear.
+         * If the BAR isn't implemented, all bits must be 0.  If it's a
+         * memory BAR or a ROM, bit 0 must be clear; if it's an io BAR, bit
+         * 1 must be clear.
          */
-        if (sz == 0xffffffff) {
-                dev_err(&dev->dev, "reg %x: invalid size %#x; broken device?\n",
-                        pos, sz);
+        if (!sz || sz == 0xffffffff)
                 goto fail;
-        }
 
         /*
          * I don't know how l can have all bits set.  Copied from old code.
@@ -249,17 +244,13 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                                    pos, res);
                 }
         } else {
-                u32 size = pci_size(l, sz, mask);
+                sz = pci_size(l, sz, mask);
 
-                if (!size) {
-                        dev_err(&dev->dev, "reg %x: invalid size "
-                                "(l %#x sz %#x mask %#x); broken device?",
-                                pos, l, sz, mask);
+                if (!sz)
                         goto fail;
-                }
 
                 res->start = l;
-                res->end = l + size;
+                res->end = l + sz;
 
                 dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res);
         }
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 4014cf8e4a26..508f94a2a78d 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -335,7 +335,6 @@ static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *le
 
                 mutex_lock(&s->ops_mutex);
                 list_del(&p_dev->socket_device_list);
-                p_dev->_removed = 1;
                 mutex_unlock(&s->ops_mutex);
 
                 dev_dbg(&p_dev->dev, "unregistering device\n");
@@ -654,14 +653,7 @@ static int pcmcia_requery_callback(struct device *dev, void * _data)
 
 static void pcmcia_requery(struct pcmcia_socket *s)
 {
-        int present, has_pfc;
-
-        mutex_lock(&s->ops_mutex);
-        present = s->pcmcia_state.present;
-        mutex_unlock(&s->ops_mutex);
-
-        if (!present)
-                return;
+        int has_pfc;
 
         if (s->functions == 0) {
                 pcmcia_card_add(s);
@@ -828,11 +820,12 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
         }
 
         if (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) {
-                if (dev->device_no != did->device_no)
-                        return 0;
+                dev_dbg(&dev->dev, "this is a pseudo-multi-function device\n");
                 mutex_lock(&dev->socket->ops_mutex);
                 dev->socket->pcmcia_state.has_pfc = 1;
                 mutex_unlock(&dev->socket->ops_mutex);
+                if (dev->device_no != did->device_no)
+                        return 0;
         }
 
         if (did->match_flags & PCMCIA_DEV_ID_MATCH_FUNC_ID) {
@@ -843,7 +836,7 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
 
                 /* if this is a pseudo-multi-function device,
                  * we need explicit matches */
-                if (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO)
+                if (dev->socket->pcmcia_state.has_pfc)
                         return 0;
                 if (dev->device_no)
                         return 0;
@@ -1260,9 +1253,7 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
 
         switch (event) {
         case CS_EVENT_CARD_REMOVAL:
-                mutex_lock(&s->ops_mutex);
-                s->pcmcia_state.present = 0;
-                mutex_unlock(&s->ops_mutex);
+                atomic_set(&skt->present, 0);
                 pcmcia_card_remove(skt, NULL);
                 handle_event(skt, event);
                 mutex_lock(&s->ops_mutex);
@@ -1271,9 +1262,9 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
                 break;
 
         case CS_EVENT_CARD_INSERTION:
+                atomic_set(&skt->present, 1);
                 mutex_lock(&s->ops_mutex);
                 s->pcmcia_state.has_pfc = 0;
-                s->pcmcia_state.present = 1;
                 destroy_cis_cache(s); /* to be on the safe side... */
                 mutex_unlock(&s->ops_mutex);
                 pcmcia_card_add(skt);
@@ -1313,7 +1304,13 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
     return 0;
 } /* ds_event */
 
-
+/*
+ * NOTE: This is racy. There's no guarantee the card will still be
+ * physically present, even if the call to this function returns
+ * non-NULL. Furthermore, the device driver most likely is unbound
+ * almost immediately, so the timeframe where pcmcia_dev_present
+ * returns NULL is probably really really small.
+ */
 struct pcmcia_device *pcmcia_dev_present(struct pcmcia_device *_p_dev)
 {
         struct pcmcia_device *p_dev;
@@ -1323,22 +1320,9 @@ struct pcmcia_device *pcmcia_dev_present(struct pcmcia_device *_p_dev)
         if (!p_dev)
                 return NULL;
 
-        mutex_lock(&p_dev->socket->ops_mutex);
-        if (!p_dev->socket->pcmcia_state.present)
-                goto out;
-
-        if (p_dev->socket->pcmcia_state.dead)
-                goto out;
+        if (atomic_read(&p_dev->socket->present) != 0)
+                ret = p_dev;
 
-        if (p_dev->_removed)
-                goto out;
-
-        if (p_dev->suspended)
-                goto out;
-
-        ret = p_dev;
- out:
-        mutex_unlock(&p_dev->socket->ops_mutex);
         pcmcia_put_dev(p_dev);
         return ret;
 }
@@ -1388,6 +1372,8 @@ static int __devinit pcmcia_bus_add_socket(struct device *dev,
                 return ret;
         }
 
+        atomic_set(&socket->present, 0);
+
         return 0;
 }
 
@@ -1399,10 +1385,6 @@ static void pcmcia_bus_remove_socket(struct device *dev,
         if (!socket)
                 return;
 
-        mutex_lock(&socket->ops_mutex);
-        socket->pcmcia_state.dead = 1;
-        mutex_unlock(&socket->ops_mutex);
-
         pccard_register_pcmcia(socket, NULL);
 
         /* unregister any unbound devices */
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 7bec4588c268..6c3320d75055 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -390,6 +390,7 @@ config EEEPC_WMI
         depends on ACPI_WMI
         depends on INPUT
         depends on EXPERIMENTAL
+        select INPUT_SPARSEKMAP
         ---help---
           Say Y here if you want to support WMI-based hotkeys on Eee PC laptops.
 
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index 52262b012abb..efe8f6388906 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -79,15 +79,15 @@ static uint wapf = 1;
 module_param(wapf, uint, 0644);
 MODULE_PARM_DESC(wapf, "WAPF value");
 
-static uint wlan_status = 1;
-static uint bluetooth_status = 1;
+static int wlan_status = 1;
+static int bluetooth_status = 1;
 
-module_param(wlan_status, uint, 0644);
+module_param(wlan_status, int, 0644);
 MODULE_PARM_DESC(wlan_status, "Set the wireless status on boot "
                  "(0 = disabled, 1 = enabled, -1 = don't do anything). "
                  "default is 1");
 
-module_param(bluetooth_status, uint, 0644);
+module_param(bluetooth_status, int, 0644);
 MODULE_PARM_DESC(bluetooth_status, "Set the wireless status on boot "
                  "(0 = disabled, 1 = enabled, -1 = don't do anything). "
                  "default is 1");
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 6ba6c30e5bb6..66f53c3c35e8 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -217,6 +217,7 @@ static void dell_wmi_notify(u32 value, void *context)
                 if (dell_new_hk_type && (buffer_entry[1] != 0x10)) {
                         printk(KERN_INFO "dell-wmi: Received unknown WMI event"
                                          " (0x%x)\n", buffer_entry[1]);
+                        kfree(obj);
                         return;
                 }
 
@@ -234,7 +235,7 @@ static void dell_wmi_notify(u32 value, void *context)
                             key->keycode == KEY_BRIGHTNESSDOWN) && acpi_video) {
                         /* Don't report brightness notifications that will also
                          * come via ACPI */
-                        return;
+                        ;
                 } else {
                         input_report_key(dell_wmi_input_dev, key->keycode, 1);
                         input_sync(dell_wmi_input_dev);
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 54a015785ca8..0306174ba875 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -169,7 +169,6 @@ struct eeepc_laptop {
         struct backlight_device *backlight_device;
 
         struct input_dev *inputdev;
-        struct key_entry *keymap;
 
         struct rfkill *wlan_rfkill;
         struct rfkill *bluetooth_rfkill;
@@ -1204,8 +1203,8 @@ static int eeepc_input_init(struct eeepc_laptop *eeepc)
 static void eeepc_input_exit(struct eeepc_laptop *eeepc)
 {
         if (eeepc->inputdev) {
+                sparse_keymap_free(eeepc->inputdev);
                 input_unregister_device(eeepc->inputdev);
-                kfree(eeepc->keymap);
         }
 }
 
diff --git a/drivers/platform/x86/eeepc-wmi.c b/drivers/platform/x86/eeepc-wmi.c
index 9f8822658fd7..b227eb469f49 100644
--- a/drivers/platform/x86/eeepc-wmi.c
+++ b/drivers/platform/x86/eeepc-wmi.c
@@ -23,6 +23,8 @@
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -30,22 +32,34 @@
 #include <linux/slab.h>
 #include <linux/input.h>
 #include <linux/input/sparse-keymap.h>
+#include <linux/fb.h>
+#include <linux/backlight.h>
+#include <linux/platform_device.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 
+#define EEEPC_WMI_FILE  "eeepc-wmi"
+
 MODULE_AUTHOR("Yong Wang <yong.y.wang@intel.com>");
 MODULE_DESCRIPTION("Eee PC WMI Hotkey Driver");
 MODULE_LICENSE("GPL");
 
 #define EEEPC_WMI_EVENT_GUID    "ABBC0F72-8EA1-11D1-00A0-C90629100000"
+#define EEEPC_WMI_MGMT_GUID     "97845ED0-4E6D-11DE-8A39-0800200C9A66"
 
 MODULE_ALIAS("wmi:"EEEPC_WMI_EVENT_GUID);
+MODULE_ALIAS("wmi:"EEEPC_WMI_MGMT_GUID);
 
 #define NOTIFY_BRNUP_MIN        0x11
 #define NOTIFY_BRNUP_MAX        0x1f
 #define NOTIFY_BRNDOWN_MIN      0x20
 #define NOTIFY_BRNDOWN_MAX      0x2e
 
+#define EEEPC_WMI_METHODID_DEVS 0x53564544
+#define EEEPC_WMI_METHODID_DSTS 0x53544344
+
+#define EEEPC_WMI_DEVID_BACKLIGHT       0x00050012
+
 static const struct key_entry eeepc_wmi_keymap[] = {
         /* Sleep already handled via generic ACPI code */
         { KE_KEY, 0x5d, { KEY_WLAN } },
@@ -58,18 +72,198 @@ static const struct key_entry eeepc_wmi_keymap[] = {
         { KE_END, 0},
 };
 
-static struct input_dev *eeepc_wmi_input_dev;
+struct bios_args {
+        u32     dev_id;
+        u32     ctrl_param;
+};
+
+struct eeepc_wmi {
+        struct input_dev *inputdev;
+        struct backlight_device *backlight_device;
+};
+
+static struct platform_device *platform_device;
+
+static int eeepc_wmi_input_init(struct eeepc_wmi *eeepc)
+{
+        int err;
+
+        eeepc->inputdev = input_allocate_device();
+        if (!eeepc->inputdev)
+                return -ENOMEM;
+
+        eeepc->inputdev->name = "Eee PC WMI hotkeys";
+        eeepc->inputdev->phys = EEEPC_WMI_FILE "/input0";
+        eeepc->inputdev->id.bustype = BUS_HOST;
+        eeepc->inputdev->dev.parent = &platform_device->dev;
+
+        err = sparse_keymap_setup(eeepc->inputdev, eeepc_wmi_keymap, NULL);
+        if (err)
+                goto err_free_dev;
+
+        err = input_register_device(eeepc->inputdev);
+        if (err)
+                goto err_free_keymap;
+
+        return 0;
+
+err_free_keymap:
+        sparse_keymap_free(eeepc->inputdev);
+err_free_dev:
+        input_free_device(eeepc->inputdev);
+        return err;
+}
+
+static void eeepc_wmi_input_exit(struct eeepc_wmi *eeepc)
+{
+        if (eeepc->inputdev) {
+                sparse_keymap_free(eeepc->inputdev);
+                input_unregister_device(eeepc->inputdev);
+        }
+
+        eeepc->inputdev = NULL;
+}
+
+static acpi_status eeepc_wmi_get_devstate(u32 dev_id, u32 *ctrl_param)
+{
+        struct acpi_buffer input = { (acpi_size)sizeof(u32), &dev_id };
+        struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+        union acpi_object *obj;
+        acpi_status status;
+        u32 tmp;
+
+        status = wmi_evaluate_method(EEEPC_WMI_MGMT_GUID,
+                        1, EEEPC_WMI_METHODID_DSTS, &input, &output);
+
+        if (ACPI_FAILURE(status))
+                return status;
+
+        obj = (union acpi_object *)output.pointer;
+        if (obj && obj->type == ACPI_TYPE_INTEGER)
+                tmp = (u32)obj->integer.value;
+        else
+                tmp = 0;
+
+        if (ctrl_param)
+                *ctrl_param = tmp;
+
+        kfree(obj);
+
+        return status;
+
+}
+
+static acpi_status eeepc_wmi_set_devstate(u32 dev_id, u32 ctrl_param)
+{
+        struct bios_args args = {
+                .dev_id = dev_id,
+                .ctrl_param = ctrl_param,
+        };
+        struct acpi_buffer input = { (acpi_size)sizeof(args), &args };
+        acpi_status status;
+
+        status = wmi_evaluate_method(EEEPC_WMI_MGMT_GUID,
+                        1, EEEPC_WMI_METHODID_DEVS, &input, NULL);
+
+        return status;
+}
+
+static int read_brightness(struct backlight_device *bd)
+{
+        static u32 ctrl_param;
+        acpi_status status;
+
+        status = eeepc_wmi_get_devstate(EEEPC_WMI_DEVID_BACKLIGHT, &ctrl_param);
+
+        if (ACPI_FAILURE(status))
+                return -1;
+        else
+                return ctrl_param & 0xFF;
+}
+
+static int update_bl_status(struct backlight_device *bd)
+{
+
+        static u32 ctrl_param;
+        acpi_status status;
+
+        ctrl_param = bd->props.brightness;
+
+        status = eeepc_wmi_set_devstate(EEEPC_WMI_DEVID_BACKLIGHT, ctrl_param);
+
+        if (ACPI_FAILURE(status))
+                return -1;
+        else
+                return 0;
+}
+
+static const struct backlight_ops eeepc_wmi_bl_ops = {
+        .get_brightness = read_brightness,
+        .update_status = update_bl_status,
+};
+
+static int eeepc_wmi_backlight_notify(struct eeepc_wmi *eeepc, int code)
+{
+        struct backlight_device *bd = eeepc->backlight_device;
+        int old = bd->props.brightness;
+        int new;
+
+        if (code >= NOTIFY_BRNUP_MIN && code <= NOTIFY_BRNUP_MAX)
+                new = code - NOTIFY_BRNUP_MIN + 1;
+        else if (code >= NOTIFY_BRNDOWN_MIN && code <= NOTIFY_BRNDOWN_MAX)
+                new = code - NOTIFY_BRNDOWN_MIN;
+
+        bd->props.brightness = new;
+        backlight_update_status(bd);
+        backlight_force_update(bd, BACKLIGHT_UPDATE_HOTKEY);
+
+        return old;
+}
+
+static int eeepc_wmi_backlight_init(struct eeepc_wmi *eeepc)
+{
+        struct backlight_device *bd;
+        struct backlight_properties props;
+
+        memset(&props, 0, sizeof(struct backlight_properties));
+        props.max_brightness = 15;
+        bd = backlight_device_register(EEEPC_WMI_FILE,
+                                       &platform_device->dev, eeepc,
+                                       &eeepc_wmi_bl_ops, &props);
+        if (IS_ERR(bd)) {
+                pr_err("Could not register backlight device\n");
+                return PTR_ERR(bd);
+        }
+
+        eeepc->backlight_device = bd;
+
+        bd->props.brightness = read_brightness(bd);
+        bd->props.power = FB_BLANK_UNBLANK;
+        backlight_update_status(bd);
+
+        return 0;
+}
+
+static void eeepc_wmi_backlight_exit(struct eeepc_wmi *eeepc)
+{
+        if (eeepc->backlight_device)
+                backlight_device_unregister(eeepc->backlight_device);
+
+        eeepc->backlight_device = NULL;
+}
 
 static void eeepc_wmi_notify(u32 value, void *context)
 {
+        struct eeepc_wmi *eeepc = context;
         struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *obj;
         acpi_status status;
         int code;
+        int orig_code;
 
         status = wmi_get_event_data(value, &response);
         if (status != AE_OK) {
-                pr_err("EEEPC WMI: bad event status 0x%x\n", status);
+                pr_err("bad event status 0x%x\n", status);
                 return;
         }
 
@@ -77,81 +271,142 @@ static void eeepc_wmi_notify(u32 value, void *context)
 
         if (obj && obj->type == ACPI_TYPE_INTEGER) {
                 code = obj->integer.value;
+                orig_code = code;
 
                 if (code >= NOTIFY_BRNUP_MIN && code <= NOTIFY_BRNUP_MAX)
                         code = NOTIFY_BRNUP_MIN;
-                else if (code >= NOTIFY_BRNDOWN_MIN && code <= NOTIFY_BRNDOWN_MAX)
+                else if (code >= NOTIFY_BRNDOWN_MIN &&
+                         code <= NOTIFY_BRNDOWN_MAX)
                         code = NOTIFY_BRNDOWN_MIN;
 
-                if (!sparse_keymap_report_event(eeepc_wmi_input_dev,
+                if (code == NOTIFY_BRNUP_MIN || code == NOTIFY_BRNDOWN_MIN) {
+                        if (!acpi_video_backlight_support())
+                                eeepc_wmi_backlight_notify(eeepc, orig_code);
+                }
+
+                if (!sparse_keymap_report_event(eeepc->inputdev,
                                                 code, 1, true))
-                        pr_info("EEEPC WMI: Unknown key %x pressed\n", code);
+                        pr_info("Unknown key %x pressed\n", code);
         }
 
         kfree(obj);
 }
 
-static int eeepc_wmi_input_setup(void)
+static int __devinit eeepc_wmi_platform_probe(struct platform_device *device)
 {
+        struct eeepc_wmi *eeepc;
         int err;
+        acpi_status status;
 
-        eeepc_wmi_input_dev = input_allocate_device();
-        if (!eeepc_wmi_input_dev)
-                return -ENOMEM;
-
-        eeepc_wmi_input_dev->name = "Eee PC WMI hotkeys";
-        eeepc_wmi_input_dev->phys = "wmi/input0";
-        eeepc_wmi_input_dev->id.bustype = BUS_HOST;
+        eeepc = platform_get_drvdata(device);
 
-        err = sparse_keymap_setup(eeepc_wmi_input_dev, eeepc_wmi_keymap, NULL);
+        err = eeepc_wmi_input_init(eeepc);
         if (err)
-                goto err_free_dev;
+                goto error_input;
 
-        err = input_register_device(eeepc_wmi_input_dev);
-        if (err)
-                goto err_free_keymap;
+        if (!acpi_video_backlight_support()) {
+                err = eeepc_wmi_backlight_init(eeepc);
+                if (err)
+                        goto error_backlight;
+        } else
+                pr_info("Backlight controlled by ACPI video driver\n");
+
+        status = wmi_install_notify_handler(EEEPC_WMI_EVENT_GUID,
+                                        eeepc_wmi_notify, eeepc);
+        if (ACPI_FAILURE(status)) {
+                pr_err("Unable to register notify handler - %d\n",
+                        status);
+                err = -ENODEV;
+                goto error_wmi;
+        }
 
         return 0;
 
-err_free_keymap:
-        sparse_keymap_free(eeepc_wmi_input_dev);
-err_free_dev:
-        input_free_device(eeepc_wmi_input_dev);
+error_wmi:
+        eeepc_wmi_backlight_exit(eeepc);
+error_backlight:
+        eeepc_wmi_input_exit(eeepc);
+error_input:
         return err;
 }
 
+static int __devexit eeepc_wmi_platform_remove(struct platform_device *device)
+{
+        struct eeepc_wmi *eeepc;
+
+        eeepc = platform_get_drvdata(device);
+        wmi_remove_notify_handler(EEEPC_WMI_EVENT_GUID);
+        eeepc_wmi_backlight_exit(eeepc);
+        eeepc_wmi_input_exit(eeepc);
+
+        return 0;
+}
+
+static struct platform_driver platform_driver = {
+        .driver = {
+                .name = EEEPC_WMI_FILE,
+                .owner = THIS_MODULE,
+        },
+        .probe = eeepc_wmi_platform_probe,
+        .remove = __devexit_p(eeepc_wmi_platform_remove),
+};
+
 static int __init eeepc_wmi_init(void)
 {
+        struct eeepc_wmi *eeepc;
         int err;
-        acpi_status status;
 
-        if (!wmi_has_guid(EEEPC_WMI_EVENT_GUID)) {
-                pr_warning("EEEPC WMI: No known WMI GUID found\n");
+        if (!wmi_has_guid(EEEPC_WMI_EVENT_GUID) ||
+            !wmi_has_guid(EEEPC_WMI_MGMT_GUID)) {
+                pr_warning("No known WMI GUID found\n");
                 return -ENODEV;
         }
 
-        err = eeepc_wmi_input_setup();
-        if (err)
-                return err;
+        eeepc = kzalloc(sizeof(struct eeepc_wmi), GFP_KERNEL);
+        if (!eeepc)
+                return -ENOMEM;
 
-        status = wmi_install_notify_handler(EEEPC_WMI_EVENT_GUID,
-                                        eeepc_wmi_notify, NULL);
-        if (ACPI_FAILURE(status)) {
-                sparse_keymap_free(eeepc_wmi_input_dev);
-                input_unregister_device(eeepc_wmi_input_dev);
-                pr_err("EEEPC WMI: Unable to register notify handler - %d\n",
-                        status);
-                return -ENODEV;
+        platform_device = platform_device_alloc(EEEPC_WMI_FILE, -1);
+        if (!platform_device) {
+                pr_warning("Unable to allocate platform device\n");
+                err = -ENOMEM;
+                goto fail_platform;
+        }
+
+        err = platform_device_add(platform_device);
+        if (err) {
+                pr_warning("Unable to add platform device\n");
+                goto put_dev;
+        }
+
+        platform_set_drvdata(platform_device, eeepc);
+
+        err = platform_driver_register(&platform_driver);
+        if (err) {
+                pr_warning("Unable to register platform driver\n");
+                goto del_dev;
         }
 
         return 0;
+
+del_dev:
+        platform_device_del(platform_device);
+put_dev:
+        platform_device_put(platform_device);
+fail_platform:
+        kfree(eeepc);
+
+        return err;
 }
 
 static void __exit eeepc_wmi_exit(void)
 {
-        wmi_remove_notify_handler(EEEPC_WMI_EVENT_GUID);
-        sparse_keymap_free(eeepc_wmi_input_dev);
-        input_unregister_device(eeepc_wmi_input_dev);
+        struct eeepc_wmi *eeepc;
+
+        eeepc = platform_get_drvdata(platform_device);
+        platform_driver_unregister(&platform_driver);
+        platform_device_unregister(platform_device);
+        kfree(eeepc);
 }
 
 module_init(eeepc_wmi_init);
diff --git a/drivers/regulator/max8925-regulator.c b/drivers/regulator/max8925-regulator.c
index b6218f11c957..552cad85ae5a 100644
--- a/drivers/regulator/max8925-regulator.c
+++ b/drivers/regulator/max8925-regulator.c
@@ -109,7 +109,7 @@ static int max8925_is_enabled(struct regulator_dev *rdev)
         struct max8925_regulator_info *info = rdev_get_drvdata(rdev);
         int ret;
 
-        ret = max8925_reg_read(info->i2c, info->vol_reg);
+        ret = max8925_reg_read(info->i2c, info->enable_reg);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/serial/serial_ks8695.c b/drivers/serial/serial_ks8695.c
index 2e71bbc04dac..b1962025b1aa 100644
--- a/drivers/serial/serial_ks8695.c
+++ b/drivers/serial/serial_ks8695.c
@@ -650,6 +650,7 @@ static struct console ks8695_console = {
 
 static int __init ks8695_console_init(void)
 {
+        add_preferred_console(SERIAL_KS8695_DEVNAME, 0, NULL);
         register_console(&ks8695_console);
         return 0;
 }
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index 581d2dbf675a..ecf405562f5c 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -49,6 +49,7 @@ enum {
         M_MBP_2,        /* MacBook Pro 2nd gen */
         M_MBP_SR,       /* MacBook Pro (Santa Rosa) */
         M_MBP_4,        /* MacBook Pro, 4th gen */
+        M_MBP_5_1,    /* MacBook Pro, 5,1th gen */
         M_UNKNOWN       /* placeholder */
 };
 
@@ -70,6 +71,7 @@ static struct efifb_dmi_info {
         [M_MBP_2] = { "mbp2", 0, 0, 0, 0 }, /* placeholder */
         [M_MBP_SR] = { "mbp3", 0x80030000, 2048 * 4, 1440, 900 },
         [M_MBP_4] = { "mbp4", 0xc0060000, 2048 * 4, 1920, 1200 },
+        [M_MBP_5_1] = { "mbp51", 0xc0010000, 2048 * 4, 1440, 900 },
         [M_UNKNOWN] = { NULL, 0, 0, 0, 0 }
 };
 
@@ -106,6 +108,7 @@ static struct dmi_system_id __initdata dmi_system_table[] = {
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro3,1", M_MBP_SR),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro3,1", M_MBP_SR),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro4,1", M_MBP_4),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,1", M_MBP_5_1),
         {},
 };
 
diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
index ef36fca2eed4..3a7e9ff8a746 100644
--- a/drivers/w1/masters/omap_hdq.c
+++ b/drivers/w1/masters/omap_hdq.c
@@ -16,6 +16,7 @@
 #include <linux/err.h>
 #include <linux/clk.h>
 #include <linux/io.h>
+#include <linux/sched.h>
 
 #include <asm/irq.h>
 #include <mach/hardware.h>
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 1ed3d554e372..17726a05a0a6 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -115,9 +115,8 @@ static struct w1_therm_family_converter w1_therm_families[] = {
 
 static inline int w1_DS18B20_convert_temp(u8 rom[9])
 {
-        int t = ((s16)rom[1] << 8) | rom[0];
-        t = t*1000/16;
-        return t;
+        s16 t = le16_to_cpup((__le16 *)rom);
+        return t*1000/16;
 }
 
 static inline int w1_DS18S20_convert_temp(u8 rom[9])
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 500d38342e1e..801ead191499 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -121,7 +121,7 @@ static ssize_t booke_wdt_write(struct file *file, const char __user *buf,
         return count;
 }
 
-static const struct watchdog_info ident = {
+static struct watchdog_info ident = {
         .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
         .identity = "PowerPC Book-E Watchdog",
 };
diff --git a/drivers/watchdog/sb_wdog.c b/drivers/watchdog/sb_wdog.c
index c8eadd478175..88c83aa57303 100644
--- a/drivers/watchdog/sb_wdog.c
+++ b/drivers/watchdog/sb_wdog.c
@@ -67,8 +67,8 @@ static DEFINE_SPINLOCK(sbwd_lock);
 void sbwdog_set(char __iomem *wdog, unsigned long t)
 {
         spin_lock(&sbwd_lock);
-        __raw_writeb(0, wdog - 0x10);
-        __raw_writeq(t & 0x7fffffUL, wdog);
+        __raw_writeb(0, wdog);
+        __raw_writeq(t & 0x7fffffUL, wdog - 0x10);
         spin_unlock(&sbwd_lock);
 }
 
diff --git a/drivers/watchdog/sbc_fitpc2_wdt.c b/drivers/watchdog/sbc_fitpc2_wdt.c
index 8d44c9b6fb5b..c7d67e9a7465 100644
--- a/drivers/watchdog/sbc_fitpc2_wdt.c
+++ b/drivers/watchdog/sbc_fitpc2_wdt.c
@@ -30,7 +30,7 @@
 static int nowayout = WATCHDOG_NOWAYOUT;
 static unsigned int margin = 60;        /* (secs) Default is 1 minute */
 static unsigned long wdt_status;
-static DEFINE_SPINLOCK(wdt_lock);
+static DEFINE_MUTEX(wdt_lock);
 
 #define WDT_IN_USE              0
 #define WDT_OK_TO_CLOSE         1
@@ -45,26 +45,26 @@ static DEFINE_SPINLOCK(wdt_lock);
 
 static void wdt_send_data(unsigned char command, unsigned char data)
 {
-        outb(command, COMMAND_PORT);
-        msleep(100);
         outb(data, DATA_PORT);
         msleep(200);
+        outb(command, COMMAND_PORT);
+        msleep(100);
 }
 
 static void wdt_enable(void)
 {
-        spin_lock(&wdt_lock);
+        mutex_lock(&wdt_lock);
         wdt_send_data(IFACE_ON_COMMAND, 1);
         wdt_send_data(REBOOT_COMMAND, margin);
-        spin_unlock(&wdt_lock);
+        mutex_unlock(&wdt_lock);
 }
 
 static void wdt_disable(void)
 {
-        spin_lock(&wdt_lock);
+        mutex_lock(&wdt_lock);
         wdt_send_data(IFACE_ON_COMMAND, 0);
         wdt_send_data(REBOOT_COMMAND, 0);
-        spin_unlock(&wdt_lock);
+        mutex_unlock(&wdt_lock);
 }
 
 static int fitpc2_wdt_open(struct inode *inode, struct file *file)