260 files changed, 8974 insertions, 3627 deletions

diff --git a/.mailmap b/.mailmap
index 4e83e7b52d15..a62e6a84fd1e 100644
--- a/.mailmap
+++ b/.mailmap
@@ -92,6 +92,7 @@ Rudolf Marek <R.Marek@sh.cvut.cz>
 Rui Saraiva <rmps@joel.ist.utl.pt>
 Sachin P Sant <ssant@in.ibm.com>
 Sam Ravnborg <sam@mars.ravnborg.org>
+Sascha Hauer <s.hauer@pengutronix.de>
 S.Çağlar Onur <caglar@pardus.org.tr>
 Simon Kelley <simon@thekelleys.org.uk>
 Stéphane Witzmann <stephane.witzmann@ubpmes.univ-bpclermont.fr>
@@ -100,6 +101,7 @@ Tejun Heo <htejun@gmail.com>
 Thomas Graf <tgraf@suug.ch>
 Tony Luck <tony.luck@intel.com>
 Tsuneo Yoshioka <Tsuneo.Yoshioka@f-secure.com>
-Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
 Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
+Uwe Kleine-König <ukl@pengutronix.de>
+Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
 Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
diff --git a/Documentation/cpu-freq/user-guide.txt b/Documentation/cpu-freq/user-guide.txt
index e3443ddcfb89..917918f84fc7 100644
--- a/Documentation/cpu-freq/user-guide.txt
+++ b/Documentation/cpu-freq/user-guide.txt
@@ -195,19 +195,3 @@ scaling_setspeed.		By "echoing" a new frequency into this
                                 you can change the speed of the CPU,
                                 but only within the limits of
                                 scaling_min_freq and scaling_max_freq.
-                                
-
-3.2 Deprecated Interfaces
--------------------------
-
-Depending on your kernel configuration, you might find the following 
-cpufreq-related files:
-/proc/cpufreq
-/proc/sys/cpu/*/speed
-/proc/sys/cpu/*/speed-min
-/proc/sys/cpu/*/speed-max
-
-These are files for deprecated interfaces to cpufreq, which offer far
-less functionality. Because of this, these interfaces aren't described
-here.
-
diff --git a/Documentation/filesystems/sysfs-pci.txt b/Documentation/filesystems/sysfs-pci.txt
index 68ef48839c04..9f8740ca3f3b 100644
--- a/Documentation/filesystems/sysfs-pci.txt
+++ b/Documentation/filesystems/sysfs-pci.txt
@@ -9,6 +9,7 @@ that support it.  For example, a given bus might look like this:
      |   |-- class
      |   |-- config
      |   |-- device
+     |   |-- enable
      |   |-- irq
      |   |-- local_cpus
      |   |-- resource
@@ -32,6 +33,7 @@ files, each with their own function.
        class               PCI class (ascii, ro)
        config              PCI config space (binary, rw)
        device              PCI device (ascii, ro)
+       enable              Whether the device is enabled (ascii, rw)
        irq                 IRQ number (ascii, ro)
        local_cpus          nearby CPU mask (cpumask, ro)
        resource            PCI resource host addresses (ascii, ro)
@@ -57,10 +59,19 @@ used to do actual device programming from userspace.  Note that some platforms
 don't support mmapping of certain resources, so be sure to check the return
 value from any attempted mmap.
 
+The 'enable' file provides a counter that indicates how many times the device 
+has been enabled.  If the 'enable' file currently returns '4', and a '1' is
+echoed into it, it will then return '5'.  Echoing a '0' into it will decrease
+the count.  Even when it returns to 0, though, some of the initialisation
+may not be reversed.  
+
 The 'rom' file is special in that it provides read-only access to the device's
 ROM file, if available.  It's disabled by default, however, so applications
 should write the string "1" to the file to enable it before attempting a read
-call, and disable it following the access by writing "0" to the file.
+call, and disable it following the access by writing "0" to the file.  Note
+that the device must be enabled for a rom read to return data succesfully.
+In the event a driver is not bound to the device, it can be enabled using the
+'enable' file, documented above.
 
 Accessing legacy resources through sysfs
 ----------------------------------------
diff --git a/MAINTAINERS b/MAINTAINERS
index 5bff376d297c..0ea3a6d98714 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1021,6 +1021,14 @@ M:	mb@bu3sch.de
 W:      http://bu3sch.de/btgpio.php
 S:      Maintained
 
+BTRFS FILE SYSTEM
+P:      Chris Mason
+M:      chris.mason@oracle.com
+L:      linux-btrfs@vger.kernel.org
+W:      http://btrfs.wiki.kernel.org/
+T:      git kernel.org:/pub/scm/linux/kernel/git/mason/btrfs-unstable.git
+S:      Maintained
+
 BTTV VIDEO4LINUX DRIVER
 P:      Mauro Carvalho Chehab
 M:      mchehab@infradead.org
@@ -2212,7 +2220,7 @@ P:	Sean Hefty
 M:      sean.hefty@intel.com
 P:      Hal Rosenstock
 M:      hal.rosenstock@gmail.com
-L:      general@lists.openfabrics.org
+L:      general@lists.openfabrics.org (moderated for non-subscribers)
 W:      http://www.openib.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/roland/infiniband.git
 S:      Supported
@@ -4841,6 +4849,7 @@ P:	Ingo Molnar
 M:      mingo@redhat.com
 P:      H. Peter Anvin
 M:      hpa@zytor.com
+M:      x86@kernel.org
 L:      linux-kernel@vger.kernel.org
 T:      git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86.git
 S:      Maintained
diff --git a/Makefile b/Makefile
index 7715b2c14fb4..681c1d23b4d4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 29
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Erotic Pickled Herring
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/bug.h b/arch/alpha/include/asm/bug.h
index 7b85b7c93709..1720c8ad86fe 100644
--- a/arch/alpha/include/asm/bug.h
+++ b/arch/alpha/include/asm/bug.h
@@ -8,12 +8,12 @@
 
 /* ??? Would be nice to use .gprel32 here, but we can't be sure that the
    function loaded the GP, so this could fail in modules.  */
-#define BUG()   {                                                       \
+#define BUG()   do {                                                    \
         __asm__ __volatile__(                                           \
                 "call_pal %0  # bugchk\n\t"                             \
                 ".long %1\n\t.8byte %2"                                 \
                 : : "i"(PAL_bugchk), "i"(__LINE__), "i"(__FILE__));     \
-        for ( ; ; ); }
+        for ( ; ; ); } while (0)
 
 #define HAVE_ARCH_BUG
 #endif
diff --git a/arch/frv/mm/dma-alloc.c b/arch/frv/mm/dma-alloc.c
index dc6522c464d4..44840e73e907 100644
--- a/arch/frv/mm/dma-alloc.c
+++ b/arch/frv/mm/dma-alloc.c
@@ -36,10 +36,10 @@
 #include <linux/vmalloc.h>
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/hardirq.h>
 
 #include <asm/pgalloc.h>
 #include <asm/io.h>
-#include <asm/hardirq.h>
 #include <asm/mmu_context.h>
 #include <asm/pgtable.h>
 #include <asm/mmu.h>
diff --git a/arch/ia64/sn/kernel/io_acpi_init.c b/arch/ia64/sn/kernel/io_acpi_init.c
index c5a214026a77..d0223abbbbd4 100644
--- a/arch/ia64/sn/kernel/io_acpi_init.c
+++ b/arch/ia64/sn/kernel/io_acpi_init.c
@@ -443,7 +443,7 @@ sn_acpi_slot_fixup(struct pci_dev *dev)
                 size = pci_resource_len(dev, PCI_ROM_RESOURCE);
                 addr = ioremap(pcidev_info->pdi_pio_mapped_addr[PCI_ROM_RESOURCE],
                                size);
-                image_size = pci_get_rom_size(addr, size);
+                image_size = pci_get_rom_size(dev, addr, size);
                 dev->resource[PCI_ROM_RESOURCE].start = (unsigned long) addr;
                 dev->resource[PCI_ROM_RESOURCE].end =
                                         (unsigned long) addr + image_size - 1;
diff --git a/arch/ia64/sn/kernel/io_init.c b/arch/ia64/sn/kernel/io_init.c
index 4e1801bad83a..e2eb2da60f96 100644
--- a/arch/ia64/sn/kernel/io_init.c
+++ b/arch/ia64/sn/kernel/io_init.c
@@ -269,7 +269,7 @@ sn_io_slot_fixup(struct pci_dev *dev)
 
                         rom = ioremap(pci_resource_start(dev, PCI_ROM_RESOURCE),
                                       size + 1);
-                        image_size = pci_get_rom_size(rom, size + 1);
+                        image_size = pci_get_rom_size(dev, rom, size + 1);
                         dev->resource[PCI_ROM_RESOURCE].end =
                                 dev->resource[PCI_ROM_RESOURCE].start +
                                 image_size - 1;
diff --git a/arch/mips/include/asm/spinlock.h b/arch/mips/include/asm/spinlock.h
index 1a1f320c30d8..0884947ebe27 100644
--- a/arch/mips/include/asm/spinlock.h
+++ b/arch/mips/include/asm/spinlock.h
@@ -51,6 +51,7 @@ static inline int __raw_spin_is_contended(raw_spinlock_t *lock)
 
         return (((counters >> 14) - counters) & 0x1fff) > 1;
 }
+#define __raw_spin_is_contended __raw_spin_is_contended
 
 static inline void __raw_spin_lock(raw_spinlock_t *lock)
 {
diff --git a/arch/sh/boards/board-ap325rxa.c b/arch/sh/boards/board-ap325rxa.c
index caf4c33f4e84..7c35787d29b4 100644
--- a/arch/sh/boards/board-ap325rxa.c
+++ b/arch/sh/boards/board-ap325rxa.c
@@ -22,6 +22,7 @@
 #include <linux/gpio.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/spi_gpio.h>
+#include <media/ov772x.h>
 #include <media/soc_camera_platform.h>
 #include <media/sh_mobile_ceu.h>
 #include <video/sh_mobile_lcdc.h>
@@ -216,7 +217,14 @@ static struct platform_device lcdc_device = {
         },
 };
 
+static void camera_power(int val)
+{
+        gpio_set_value(GPIO_PTZ5, val); /* RST_CAM/RSTB */
+        mdelay(10);
+}
+
 #ifdef CONFIG_I2C
+/* support for the old ncm03j camera */
 static unsigned char camera_ncm03j_magic[] =
 {
         0x87, 0x00, 0x88, 0x08, 0x89, 0x01, 0x8A, 0xE8,
@@ -237,6 +245,23 @@ static unsigned char camera_ncm03j_magic[] =
         0x63, 0xD4, 0x64, 0xEA, 0xD6, 0x0F,
 };
 
+static int camera_probe(void)
+{
+        struct i2c_adapter *a = i2c_get_adapter(0);
+        struct i2c_msg msg;
+        int ret;
+
+        camera_power(1);
+        msg.addr = 0x6e;
+        msg.buf = camera_ncm03j_magic;
+        msg.len = 2;
+        msg.flags = 0;
+        ret = i2c_transfer(a, &msg, 1);
+        camera_power(0);
+
+        return ret;
+}
+
 static int camera_set_capture(struct soc_camera_platform_info *info,
                               int enable)
 {
@@ -245,9 +270,11 @@ static int camera_set_capture(struct soc_camera_platform_info *info,
         int ret = 0;
         int i;
 
+        camera_power(0);
         if (!enable)
                 return 0; /* no disable for now */
 
+        camera_power(1);
         for (i = 0; i < ARRAY_SIZE(camera_ncm03j_magic); i += 2) {
                 u_int8_t buf[8];
 
@@ -286,8 +313,35 @@ static struct platform_device camera_device = {
                 .platform_data  = &camera_info,
         },
 };
+
+static int __init camera_setup(void)
+{
+        if (camera_probe() > 0)
+                platform_device_register(&camera_device);
+
+        return 0;
+}
+late_initcall(camera_setup);
+
 #endif /* CONFIG_I2C */
 
+static int ov7725_power(struct device *dev, int mode)
+{
+        camera_power(0);
+        if (mode)
+                camera_power(1);
+
+        return 0;
+}
+
+static struct ov772x_camera_info ov7725_info = {
+        .buswidth  = SOCAM_DATAWIDTH_8,
+        .flags = OV772X_FLAG_VFLIP | OV772X_FLAG_HFLIP,
+        .link = {
+                .power  = ov7725_power,
+        },
+};
+
 static struct sh_mobile_ceu_info sh_mobile_ceu_info = {
         .flags = SOCAM_PCLK_SAMPLE_RISING | SOCAM_HSYNC_ACTIVE_HIGH |
         SOCAM_VSYNC_ACTIVE_HIGH | SOCAM_MASTER | SOCAM_DATAWIDTH_8,
@@ -338,9 +392,6 @@ static struct platform_device *ap325rxa_devices[] __initdata = {
         &ap325rxa_nor_flash_device,
         &lcdc_device,
         &ceu_device,
-#ifdef CONFIG_I2C
-        &camera_device,
-#endif
         &nand_flash_device,
         &sdcard_cn3_device,
 };
@@ -349,6 +400,10 @@ static struct i2c_board_info __initdata ap325rxa_i2c_devices[] = {
         {
                 I2C_BOARD_INFO("pcf8563", 0x51),
         },
+        {
+                I2C_BOARD_INFO("ov772x", 0x21),
+                .platform_data = &ov7725_info,
+        },
 };
 
 static struct spi_board_info ap325rxa_spi_devices[] = {
@@ -426,7 +481,7 @@ static int __init ap325rxa_devices_setup(void)
         gpio_request(GPIO_PTZ6, NULL);
         gpio_direction_output(GPIO_PTZ6, 0); /* STBY_CAM */
         gpio_request(GPIO_PTZ5, NULL);
-        gpio_direction_output(GPIO_PTZ5, 1); /* RST_CAM */
+        gpio_direction_output(GPIO_PTZ5, 0); /* RST_CAM */
         gpio_request(GPIO_PTZ4, NULL);
         gpio_direction_output(GPIO_PTZ4, 0); /* SADDR */
 
diff --git a/arch/sh/configs/ap325rxa_defconfig b/arch/sh/configs/ap325rxa_defconfig
index 5c423fa8e6b8..352f87d50fdc 100644
--- a/arch/sh/configs/ap325rxa_defconfig
+++ b/arch/sh/configs/ap325rxa_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28
-# Fri Jan  9 16:54:19 2009
+# Linux kernel version: 2.6.29-rc2
+# Tue Jan 27 11:45:08 2009
 #
 CONFIG_SUPERH=y
 CONFIG_SUPERH32=y
@@ -45,12 +45,12 @@ CONFIG_BSD_PROCESS_ACCT=y
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 CONFIG_GROUP_SCHED=y
 CONFIG_FAIR_GROUP_SCHED=y
 # CONFIG_RT_GROUP_SCHED is not set
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -378,6 +378,7 @@ CONFIG_WIRELESS=y
 # CONFIG_WIRELESS_EXT is not set
 # CONFIG_LIB80211 is not set
 # CONFIG_MAC80211 is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -400,6 +401,7 @@ CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
 CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_AR7_PARTS is not set
@@ -447,9 +449,7 @@ CONFIG_MTD_CFI_UTIL=y
 #
 # CONFIG_MTD_COMPLEX_MAPPINGS is not set
 CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_PHYSMAP_START=0xffffffff
-CONFIG_MTD_PHYSMAP_LEN=0
-CONFIG_MTD_PHYSMAP_BANKWIDTH=0
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
 # CONFIG_MTD_PLATRAM is not set
 
 #
@@ -480,6 +480,12 @@ CONFIG_MTD_NAND_SH_FLCTL=y
 # CONFIG_MTD_ONENAND is not set
 
 #
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_QINFO_PROBE is not set
+
+#
 # UBI - Unsorted block images
 #
 CONFIG_MTD_UBI=y
@@ -607,6 +613,10 @@ CONFIG_SMSC911X=y
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
 # CONFIG_IWLWIFI_LEDS is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
@@ -790,6 +800,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -837,7 +848,7 @@ CONFIG_SOC_CAMERA=y
 # CONFIG_SOC_CAMERA_MT9V022 is not set
 # CONFIG_SOC_CAMERA_TW9910 is not set
 CONFIG_SOC_CAMERA_PLATFORM=y
-# CONFIG_SOC_CAMERA_OV772X is not set
+CONFIG_SOC_CAMERA_OV772X=y
 CONFIG_VIDEO_SH_MOBILE_CEU=y
 # CONFIG_RADIO_ADAPTERS is not set
 # CONFIG_DAB is not set
@@ -1012,6 +1023,7 @@ CONFIG_FS_POSIX_ACL=y
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -1060,6 +1072,7 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_JFFS2_FS is not set
 # CONFIG_UBIFS_FS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
diff --git a/arch/sh/configs/migor_defconfig b/arch/sh/configs/migor_defconfig
index 7758263514bc..678576796bdf 100644
--- a/arch/sh/configs/migor_defconfig
+++ b/arch/sh/configs/migor_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28
-# Fri Jan  9 17:09:35 2009
+# Linux kernel version: 2.6.29-rc1
+# Thu Jan 22 09:16:16 2009
 #
 CONFIG_SUPERH=y
 CONFIG_SUPERH32=y
@@ -45,8 +45,12 @@ CONFIG_SYSVIPC_SYSCTL=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 # CONFIG_GROUP_SCHED is not set
+
+#
+# Control Group support
+#
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -389,6 +393,7 @@ CONFIG_WIRELESS_EXT=y
 CONFIG_WIRELESS_EXT_SYSFS=y
 # CONFIG_LIB80211 is not set
 # CONFIG_MAC80211 is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -411,6 +416,7 @@ CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
 CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_AR7_PARTS is not set
@@ -458,9 +464,7 @@ CONFIG_MTD_CFI_UTIL=y
 #
 # CONFIG_MTD_COMPLEX_MAPPINGS is not set
 CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_PHYSMAP_START=0xffffffff
-CONFIG_MTD_PHYSMAP_LEN=0
-CONFIG_MTD_PHYSMAP_BANKWIDTH=0
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
 # CONFIG_MTD_PLATRAM is not set
 
 #
@@ -488,6 +492,12 @@ CONFIG_MTD_NAND_PLATFORM=y
 # CONFIG_MTD_ONENAND is not set
 
 #
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_QINFO_PROBE is not set
+
+#
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
@@ -587,6 +597,10 @@ CONFIG_SMC91X=y
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
 # CONFIG_IWLWIFI_LEDS is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
@@ -761,6 +775,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -806,9 +821,9 @@ CONFIG_SOC_CAMERA=y
 # CONFIG_SOC_CAMERA_MT9M111 is not set
 # CONFIG_SOC_CAMERA_MT9T031 is not set
 # CONFIG_SOC_CAMERA_MT9V022 is not set
-# CONFIG_SOC_CAMERA_TW9910 is not set
-CONFIG_SOC_CAMERA_PLATFORM=y
-# CONFIG_SOC_CAMERA_OV772X is not set
+CONFIG_SOC_CAMERA_TW9910=y
+# CONFIG_SOC_CAMERA_PLATFORM is not set
+CONFIG_SOC_CAMERA_OV772X=y
 CONFIG_VIDEO_SH_MOBILE_CEU=y
 # CONFIG_RADIO_ADAPTERS is not set
 # CONFIG_DAB is not set
@@ -866,11 +881,13 @@ CONFIG_USB_GADGET_SELECTED=y
 # CONFIG_USB_GADGET_PXA25X is not set
 # CONFIG_USB_GADGET_PXA27X is not set
 # CONFIG_USB_GADGET_S3C2410 is not set
+# CONFIG_USB_GADGET_IMX is not set
 CONFIG_USB_GADGET_M66592=y
 CONFIG_USB_M66592=y
 CONFIG_SUPERH_BUILT_IN_M66592=y
 # CONFIG_USB_GADGET_AMD5536UDC is not set
 # CONFIG_USB_GADGET_FSL_QE is not set
+# CONFIG_USB_GADGET_CI13XXX is not set
 # CONFIG_USB_GADGET_NET2280 is not set
 # CONFIG_USB_GADGET_GOKU is not set
 # CONFIG_USB_GADGET_DUMMY_HCD is not set
@@ -883,6 +900,11 @@ CONFIG_USB_G_SERIAL=y
 # CONFIG_USB_MIDI_GADGET is not set
 # CONFIG_USB_G_PRINTER is not set
 # CONFIG_USB_CDC_COMPOSITE is not set
+
+#
+# OTG and related infrastructure
+#
+# CONFIG_USB_GPIO_VBUS is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
@@ -961,6 +983,7 @@ CONFIG_UIO_PDRV_GENIRQ=y
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
 # CONFIG_QUOTA is not set
@@ -1004,6 +1027,7 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_EFS_FS is not set
 # CONFIG_JFFS2_FS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
diff --git a/arch/sh/include/asm/mutex-llsc.h b/arch/sh/include/asm/mutex-llsc.h
index ee839ee58ac8..090358a7e1bb 100644
--- a/arch/sh/include/asm/mutex-llsc.h
+++ b/arch/sh/include/asm/mutex-llsc.h
@@ -21,38 +21,36 @@
 static inline void
 __mutex_fastpath_lock(atomic_t *count, void (*fail_fn)(atomic_t *))
 {
-        int __ex_flag, __res;
+        int __done, __res;
 
         __asm__ __volatile__ (
                 "movli.l        @%2, %0 \n"
                 "add            #-1, %0 \n"
                 "movco.l        %0, @%2 \n"
                 "movt           %1      \n"
-                : "=&z" (__res), "=&r" (__ex_flag)
+                : "=&z" (__res), "=&r" (__done)
                 : "r" (&(count)->counter)
                 : "t");
 
-        __res |= !__ex_flag;
-        if (unlikely(__res != 0))
+        if (unlikely(!__done || __res != 0))
                 fail_fn(count);
 }
 
 static inline int
 __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
 {
-        int __ex_flag, __res;
+        int __done, __res;
 
         __asm__ __volatile__ (
                 "movli.l        @%2, %0 \n"
                 "add            #-1, %0 \n"
                 "movco.l        %0, @%2 \n"
                 "movt           %1      \n"
-                : "=&z" (__res), "=&r" (__ex_flag)
+                : "=&z" (__res), "=&r" (__done)
                 : "r" (&(count)->counter)
                 : "t");
 
-        __res |= !__ex_flag;
-        if (unlikely(__res != 0))
+        if (unlikely(!__done || __res != 0))
                 __res = fail_fn(count);
 
         return __res;
@@ -61,19 +59,18 @@ __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
 static inline void
 __mutex_fastpath_unlock(atomic_t *count, void (*fail_fn)(atomic_t *))
 {
-        int __ex_flag, __res;
+        int __done, __res;
 
         __asm__ __volatile__ (
                 "movli.l        @%2, %0 \n\t"
                 "add            #1, %0  \n\t"
                 "movco.l        %0, @%2 \n\t"
                 "movt           %1      \n\t"
-                : "=&z" (__res), "=&r" (__ex_flag)
+                : "=&z" (__res), "=&r" (__done)
                 : "r" (&(count)->counter)
                 : "t");
 
-        __res |= !__ex_flag;
-        if (unlikely(__res <= 0))
+        if (unlikely(!__done || __res <= 0))
                 fail_fn(count);
 }
 
diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
index 05a868a71ef5..5bc34681d994 100644
--- a/arch/sh/include/asm/syscall_32.h
+++ b/arch/sh/include/asm/syscall_32.h
@@ -21,23 +21,10 @@ static inline void syscall_rollback(struct task_struct *task,
          */
 }
 
-static inline bool syscall_has_error(struct pt_regs *regs)
-{
-        return (regs->sr & 0x1) ? true : false;
-}
-static inline void syscall_set_error(struct pt_regs *regs)
-{
-        regs->sr |= 0x1;
-}
-static inline void syscall_clear_error(struct pt_regs *regs)
-{
-        regs->sr &= ~0x1;
-}
-
 static inline long syscall_get_error(struct task_struct *task,
                                      struct pt_regs *regs)
 {
-        return syscall_has_error(regs) ? regs->regs[0] : 0;
+        return IS_ERR_VALUE(regs->regs[0]) ? regs->regs[0] : 0;
 }
 
 static inline long syscall_get_return_value(struct task_struct *task,
@@ -50,13 +37,10 @@ static inline void syscall_set_return_value(struct task_struct *task,
                                             struct pt_regs *regs,
                                             int error, long val)
 {
-        if (error) {
-                syscall_set_error(regs);
+        if (error)
                 regs->regs[0] = -error;
-        } else {
-                syscall_clear_error(regs);
+        else
                 regs->regs[0] = val;
-        }
 }
 
 static inline void syscall_get_arguments(struct task_struct *task,
diff --git a/arch/sh/include/asm/syscall_64.h b/arch/sh/include/asm/syscall_64.h
index e1143b9784d6..c3561ca72bee 100644
--- a/arch/sh/include/asm/syscall_64.h
+++ b/arch/sh/include/asm/syscall_64.h
@@ -21,23 +21,10 @@ static inline void syscall_rollback(struct task_struct *task,
          */
 }
 
-static inline bool syscall_has_error(struct pt_regs *regs)
-{
-        return (regs->sr & 0x1) ? true : false;
-}
-static inline void syscall_set_error(struct pt_regs *regs)
-{
-        regs->sr |= 0x1;
-}
-static inline void syscall_clear_error(struct pt_regs *regs)
-{
-        regs->sr &= ~0x1;
-}
-
 static inline long syscall_get_error(struct task_struct *task,
                                      struct pt_regs *regs)
 {
-        return syscall_has_error(regs) ? regs->regs[9] : 0;
+        return IS_ERR_VALUE(regs->regs[9]) ? regs->regs[9] : 0;
 }
 
 static inline long syscall_get_return_value(struct task_struct *task,
@@ -50,13 +37,10 @@ static inline void syscall_set_return_value(struct task_struct *task,
                                             struct pt_regs *regs,
                                             int error, long val)
 {
-        if (error) {
-                syscall_set_error(regs);
+        if (error)
                 regs->regs[9] = -error;
-        } else {
-                syscall_clear_error(regs);
+        else
                 regs->regs[9] = val;
-        }
 }
 
 static inline void syscall_get_arguments(struct task_struct *task,
diff --git a/arch/sh/kernel/cpu/sh4/fpu.c b/arch/sh/kernel/cpu/sh4/fpu.c
index 2780917c0088..e3ea5411da6d 100644
--- a/arch/sh/kernel/cpu/sh4/fpu.c
+++ b/arch/sh/kernel/cpu/sh4/fpu.c
@@ -423,7 +423,7 @@ static int ieee_fpe_handler(struct pt_regs *regs)
                 int m;
                 unsigned int hx;
 
-                m = (finsn >> 9) & 0x7;
+                m = (finsn >> 8) & 0x7;
                 hx = tsk->thread.fpu.hard.fp_regs[m];
 
                 if ((tsk->thread.fpu.hard.fpscr & FPSCR_CAUSE_ERROR)
diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c
index 534247508572..370d2cfa34eb 100644
--- a/arch/sh/kernel/setup.c
+++ b/arch/sh/kernel/setup.c
@@ -262,11 +262,11 @@ void __init setup_bootmem_allocator(unsigned long free_pfn)
                         BOOTMEM_DEFAULT);
 
         /*
-         * reserve physical page 0 - it's a special BIOS page on many boxes,
-         * enabling clean reboots, SMP operation, laptop functions.
+         * Reserve physical pages below CONFIG_ZERO_PAGE_OFFSET.
          */
-        reserve_bootmem(__MEMORY_START, CONFIG_ZERO_PAGE_OFFSET,
-                        BOOTMEM_DEFAULT);
+        if (CONFIG_ZERO_PAGE_OFFSET != 0)
+                reserve_bootmem(__MEMORY_START, CONFIG_ZERO_PAGE_OFFSET,
+                                BOOTMEM_DEFAULT);
 
         sparse_memory_present_with_active_regions(0);
 
diff --git a/arch/sh/kernel/signal_32.c b/arch/sh/kernel/signal_32.c
index 77c21bde376a..17784e19ae34 100644
--- a/arch/sh/kernel/signal_32.c
+++ b/arch/sh/kernel/signal_32.c
@@ -510,7 +510,6 @@ handle_syscall_restart(unsigned long save_r0, struct pt_regs *regs,
                 case -ERESTARTNOHAND:
                 no_system_call_restart:
                         regs->regs[0] = -EINTR;
-                        regs->sr |= 1;
                         break;
 
                 case -ERESTARTSYS:
@@ -589,8 +588,7 @@ static void do_signal(struct pt_regs *regs, unsigned int save_r0)
 
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
         if (signr > 0) {
-                if (regs->sr & 1)
-                        handle_syscall_restart(save_r0, regs, &ka.sa);
+                handle_syscall_restart(save_r0, regs, &ka.sa);
 
                 /* Whee!  Actually deliver the signal.  */
                 if (handle_signal(signr, &ka, &info, oldset,
diff --git a/arch/sh/kernel/signal_64.c b/arch/sh/kernel/signal_64.c
index b22fdfaaa191..0663a0ee6021 100644
--- a/arch/sh/kernel/signal_64.c
+++ b/arch/sh/kernel/signal_64.c
@@ -60,7 +60,6 @@ handle_syscall_restart(struct pt_regs *regs, struct sigaction *sa)
                 case -ERESTARTNOHAND:
                 no_system_call_restart:
                         regs->regs[REG_RET] = -EINTR;
-                        regs->sr |= 1;
                         break;
 
                 case -ERESTARTSYS:
@@ -109,8 +108,7 @@ static int do_signal(struct pt_regs *regs, sigset_t *oldset)
 
         signr = get_signal_to_deliver(&info, &ka, regs, 0);
         if (signr > 0) {
-                if (regs->sr & 1)
-                        handle_syscall_restart(regs, &ka.sa);
+                handle_syscall_restart(regs, &ka.sa);
 
                 /* Whee!  Actually deliver the signal.  */
                 if (handle_signal(signr, &info, &ka, oldset, regs) == 0) {
diff --git a/arch/sh/lib/checksum.S b/arch/sh/lib/checksum.S
index cbdd0d40e545..356c8ec92893 100644
--- a/arch/sh/lib/checksum.S
+++ b/arch/sh/lib/checksum.S
@@ -36,8 +36,7 @@
  */
 
 /*      
- * unsigned int csum_partial(const unsigned char *buf, int len,
- *                           unsigned int sum);
+ * asmlinkage __wsum csum_partial(const void *buf, int len, __wsum sum);
  */
 
 .text
@@ -49,11 +48,31 @@ ENTRY(csum_partial)
            * Fortunately, it is easy to convert 2-byte alignment to 4-byte
            * alignment for the unrolled loop.
            */
-        mov     r5, r1
         mov     r4, r0
-        tst     #2, r0          ! Check alignment.
-        bt      2f              ! Jump if alignment is ok.
+        tst     #3, r0          ! Check alignment.
+        bt/s    2f              ! Jump if alignment is ok.
+         mov    r4, r7          ! Keep a copy to check for alignment
         !
+        tst     #1, r0          ! Check alignment.
+        bt      21f             ! Jump if alignment is boundary of 2bytes.
+
+        ! buf is odd
+        tst     r5, r5
+        add     #-1, r5
+        bt      9f
+        mov.b   @r4+, r0
+        extu.b  r0, r0
+        addc    r0, r6          ! t=0 from previous tst
+        mov     r6, r0
+        shll8   r6
+        shlr16  r0
+        shlr8   r0
+        or      r0, r6
+        mov     r4, r0
+        tst     #2, r0
+        bt      2f
+21:
+        ! buf is 2 byte aligned (len could be 0)
         add     #-2, r5         ! Alignment uses up two bytes.
         cmp/pz  r5              !
         bt/s    1f              ! Jump if we had at least two bytes.
@@ -61,16 +80,17 @@ ENTRY(csum_partial)
         bra     6f
          add    #2, r5          ! r5 was < 2.  Deal with it.
 1:
-        mov     r5, r1          ! Save new len for later use.
         mov.w   @r4+, r0
         extu.w  r0, r0
         addc    r0, r6
         bf      2f
         add     #1, r6
 2:
+        ! buf is 4 byte aligned (len could be 0)
+        mov     r5, r1
         mov     #-5, r0
-        shld    r0, r5
-        tst     r5, r5
+        shld    r0, r1
+        tst     r1, r1
         bt/s    4f              ! if it's =0, go to 4f
          clrt
         .align  2
@@ -92,30 +112,31 @@ ENTRY(csum_partial)
         addc    r0, r6
         addc    r2, r6
         movt    r0
-        dt      r5
+        dt      r1
         bf/s    3b
          cmp/eq #1, r0
-        ! here, we know r5==0
-        addc    r5, r6                  ! add carry to r6
+        ! here, we know r1==0
+        addc    r1, r6                  ! add carry to r6
 4:
-        mov     r1, r0
+        mov     r5, r0
         and     #0x1c, r0
         tst     r0, r0
-        bt/s    6f
-         mov    r0, r5
-        shlr2   r5
+        bt      6f
+        ! 4 bytes or more remaining
+        mov     r0, r1
+        shlr2   r1
         mov     #0, r2
 5:
         addc    r2, r6
         mov.l   @r4+, r2
         movt    r0
-        dt      r5
+        dt      r1
         bf/s    5b
          cmp/eq #1, r0
         addc    r2, r6
-        addc    r5, r6          ! r5==0 here, so it means add carry-bit
+        addc    r1, r6          ! r1==0 here, so it means add carry-bit
 6:
-        mov     r1, r5
+        ! 3 bytes or less remaining
         mov     #3, r0
         and     r0, r5
         tst     r5, r5
@@ -139,8 +160,18 @@ ENTRY(csum_partial)
 8:
         addc    r0, r6
         mov     #0, r0
-        addc    r0, r6 
+        addc    r0, r6
 9:
+        ! Check if the buffer was misaligned, if so realign sum
+        mov     r7, r0
+        tst     #1, r0
+        bt      10f
+        mov     r6, r0
+        shll8   r6
+        shlr16  r0
+        shlr8   r0
+        or      r0, r6
+10:
         rts
          mov    r6, r0
 
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 8ffee714f932..a46c3a21e26d 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -891,10 +891,35 @@ prom_tba:	.xword	0
 tlb_type:       .word   0       /* Must NOT end up in BSS */
         .section        ".fixup",#alloc,#execinstr
 
-        .globl  __ret_efault, __retl_efault
-__ret_efault:
+        .globl  __ret_efault, __retl_efault, __ret_one, __retl_one
+ENTRY(__ret_efault)
         ret
          restore %g0, -EFAULT, %o0
-__retl_efault:
+ENDPROC(__ret_efault)
+
+ENTRY(__retl_efault)
         retl
          mov    -EFAULT, %o0
+ENDPROC(__retl_efault)
+
+ENTRY(__retl_one)
+        retl
+         mov    1, %o0
+ENDPROC(__retl_one)
+
+ENTRY(__ret_one_asi)
+        wr      %g0, ASI_AIUS, %asi
+        ret
+         restore %g0, 1, %o0
+ENDPROC(__ret_one_asi)
+
+ENTRY(__retl_one_asi)
+        wr      %g0, ASI_AIUS, %asi
+        retl
+         mov    1, %o0
+ENDPROC(__retl_one_asi)
+
+ENTRY(__retl_o1)
+        retl
+         mov    %o1, %o0
+ENDPROC(__retl_o1)
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
index 09f088ed4a64..f3577223c863 100644
--- a/arch/sparc/kernel/nmi.c
+++ b/arch/sparc/kernel/nmi.c
@@ -70,6 +70,7 @@ static void die_nmi(const char *str, struct pt_regs *regs, int do_panic)
         printk(" on CPU%d, ip %08lx, registers:\n",
                smp_processor_id(), regs->tpc);
         show_regs(regs);
+        dump_stack();
 
         bust_spinlocks(0);
 
diff --git a/arch/sparc/kernel/pcr.c b/arch/sparc/kernel/pcr.c
index 92e0dda141a4..1ae8cdd7e703 100644
--- a/arch/sparc/kernel/pcr.c
+++ b/arch/sparc/kernel/pcr.c
@@ -133,11 +133,16 @@ int __init pcr_arch_init(void)
 
         case cheetah:
         case cheetah_plus:
-        case spitfire:
                 pcr_ops = &direct_pcr_ops;
                 pcr_enable = PCR_SUN4U_ENABLE;
                 break;
 
+        case spitfire:
+                /* UltraSPARC-I/II and derivatives lack a profile
+                 * counter overflow interrupt so we can't make use of
+                 * their hardware currently.
+                 */
+                /* fallthrough */
         default:
                 err = -ENODEV;
                 goto out_unregister;
diff --git a/arch/sparc/lib/GENbzero.S b/arch/sparc/lib/GENbzero.S
index 6a4f956a2f7a..8e7a843ddd88 100644
--- a/arch/sparc/lib/GENbzero.S
+++ b/arch/sparc/lib/GENbzero.S
@@ -6,13 +6,9 @@
 
 #define EX_ST(x,y)              \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    %o1, %o0;       \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_o1;   \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/GENcopy_from_user.S b/arch/sparc/lib/GENcopy_from_user.S
index 2b9df99e87f9..b7d0bd6b1406 100644
--- a/arch/sparc/lib/GENcopy_from_user.S
+++ b/arch/sparc/lib/GENcopy_from_user.S
@@ -5,13 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/GENcopy_to_user.S b/arch/sparc/lib/GENcopy_to_user.S
index bb3f7084daf9..780550e1afc7 100644
--- a/arch/sparc/lib/GENcopy_to_user.S
+++ b/arch/sparc/lib/GENcopy_to_user.S
@@ -5,13 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -31,7 +27,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/NG2copy_from_user.S b/arch/sparc/lib/NG2copy_from_user.S
index c77ef5f22102..119ccb9a54f4 100644
--- a/arch/sparc/lib/NG2copy_from_user.S
+++ b/arch/sparc/lib/NG2copy_from_user.S
@@ -5,14 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one_asi;\
         .text;                  \
         .align 4;
 
@@ -33,7 +28,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/NG2copy_to_user.S b/arch/sparc/lib/NG2copy_to_user.S
index 4bd4093acbbd..7fe1ccefd9d0 100644
--- a/arch/sparc/lib/NG2copy_to_user.S
+++ b/arch/sparc/lib/NG2copy_to_user.S
@@ -5,14 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one_asi;\
         .text;                  \
         .align 4;
 
@@ -42,7 +37,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/NGbzero.S b/arch/sparc/lib/NGbzero.S
index 814d5f7a45e1..beab29bf419b 100644
--- a/arch/sparc/lib/NGbzero.S
+++ b/arch/sparc/lib/NGbzero.S
@@ -6,13 +6,9 @@
 
 #define EX_ST(x,y)              \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    %o1, %o0;       \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_o1;   \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/NGcopy_from_user.S b/arch/sparc/lib/NGcopy_from_user.S
index e7f433f71b42..5d1e4d1ac21e 100644
--- a/arch/sparc/lib/NGcopy_from_user.S
+++ b/arch/sparc/lib/NGcopy_from_user.S
@@ -5,14 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        ret;                    \
-         restore %g0, 1, %o0;   \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __ret_one_asi;\
         .text;                  \
         .align 4;
 
@@ -30,7 +25,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/NGcopy_to_user.S b/arch/sparc/lib/NGcopy_to_user.S
index 6ea01c5532a0..ff630dcb273c 100644
--- a/arch/sparc/lib/NGcopy_to_user.S
+++ b/arch/sparc/lib/NGcopy_to_user.S
@@ -5,14 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        ret;                    \
-         restore %g0, 1, %o0;   \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __ret_one_asi;\
         .text;                  \
         .align 4;
 
@@ -33,7 +28,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/U1copy_from_user.S b/arch/sparc/lib/U1copy_from_user.S
index 3192b0bf4fab..a6ae2ea04bf5 100644
--- a/arch/sparc/lib/U1copy_from_user.S
+++ b/arch/sparc/lib/U1copy_from_user.S
@@ -5,13 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop;                                           \
 
 #include "U1memcpy.S"
diff --git a/arch/sparc/lib/U1copy_to_user.S b/arch/sparc/lib/U1copy_to_user.S
index d1210ffb0b82..f4b970eeb485 100644
--- a/arch/sparc/lib/U1copy_to_user.S
+++ b/arch/sparc/lib/U1copy_to_user.S
@@ -5,13 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop;                                           \
 
 #include "U1memcpy.S"
diff --git a/arch/sparc/lib/U3copy_from_user.S b/arch/sparc/lib/U3copy_from_user.S
index f5bfc8d9d216..b1acd1331c33 100644
--- a/arch/sparc/lib/U3copy_from_user.S
+++ b/arch/sparc/lib/U3copy_from_user.S
@@ -5,13 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/U3copy_to_user.S b/arch/sparc/lib/U3copy_to_user.S
index 2334f111bb0c..ef1e493afdfa 100644
--- a/arch/sparc/lib/U3copy_to_user.S
+++ b/arch/sparc/lib/U3copy_to_user.S
@@ -5,13 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop;                                           \
 
 #include "U3memcpy.S"
diff --git a/arch/sparc/lib/bzero.S b/arch/sparc/lib/bzero.S
index c7bbae8c590f..b6557297440f 100644
--- a/arch/sparc/lib/bzero.S
+++ b/arch/sparc/lib/bzero.S
@@ -88,13 +88,9 @@ __bzero_done:
 
 #define EX_ST(x,y)              \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    %o1, %o0;       \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_o1;   \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/copy_in_user.S b/arch/sparc/lib/copy_in_user.S
index 650af3f21f78..302c0e60dc2c 100644
--- a/arch/sparc/lib/copy_in_user.S
+++ b/arch/sparc/lib/copy_in_user.S
@@ -3,19 +3,16 @@
  * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
+#include <linux/linkage.h>
 #include <asm/asi.h>
 
 #define XCC xcc
 
 #define EX(x,y)                 \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov 1, %o0;            \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -31,18 +28,7 @@
          * to copy register windows around during thread cloning.
          */
 
-        .globl          ___copy_in_user
-        .type           ___copy_in_user,#function
-___copy_in_user:        /* %o0=dst, %o1=src, %o2=len */
-        /* Writing to %asi is _expensive_ so we hardcode it.
-         * Reading %asi to check for KERNEL_DS is comparatively
-         * cheap.
-         */
-        rd              %asi, %g1
-        cmp             %g1, ASI_AIUS
-        bne,pn          %icc, memcpy_user_stub
-         nop
-
+ENTRY(___copy_in_user)  /* %o0=dst, %o1=src, %o2=len */
         cmp             %o2, 0
         be,pn           %XCC, 85f
          or             %o0, %o1, %o3
@@ -53,22 +39,24 @@ ___copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
         /* 16 < len <= 64 */
         andcc           %o3, 0x7, %g0
         bne,pn          %XCC, 90f
-         sub            %o0, %o1, %o3
+         nop
 
         andn            %o2, 0x7, %o4
         and             %o2, 0x7, %o2
 1:      subcc           %o4, 0x8, %o4
         EX(ldxa [%o1] %asi, %o5)
-        EX(stxa %o5, [%o1 + %o3] ASI_AIUS)
+        EX(stxa %o5, [%o0] %asi)
+        add             %o1, 0x8, %o1
         bgu,pt          %XCC, 1b
-         add            %o1, 0x8, %o1
+         add            %o0, 0x8, %o0
         andcc           %o2, 0x4, %g0
         be,pt           %XCC, 1f
          nop
         sub             %o2, 0x4, %o2
         EX(lduwa [%o1] %asi, %o5)
-        EX(stwa %o5, [%o1 + %o3] ASI_AIUS)
+        EX(stwa %o5, [%o0] %asi)
         add             %o1, 0x4, %o1
+        add             %o0, 0x4, %o0
 1:      cmp             %o2, 0
         be,pt           %XCC, 85f
          nop
@@ -78,14 +66,15 @@ ___copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
 80:     /* 0 < len <= 16 */
         andcc           %o3, 0x3, %g0
         bne,pn          %XCC, 90f
-         sub            %o0, %o1, %o3
+         nop
 
 82:
         subcc           %o2, 4, %o2
         EX(lduwa [%o1] %asi, %g1)
-        EX(stwa %g1, [%o1 + %o3] ASI_AIUS)
+        EX(stwa %g1, [%o0] %asi)
+        add             %o1, 4, %o1
         bgu,pt          %XCC, 82b
-         add            %o1, 4, %o1
+         add            %o0, 4, %o0
 
 85:     retl
          clr            %o0
@@ -94,26 +83,10 @@ ___copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
 90:
         subcc           %o2, 1, %o2
         EX(lduba [%o1] %asi, %g1)
-        EX(stba %g1, [%o1 + %o3] ASI_AIUS)
+        EX(stba %g1, [%o0] %asi)
+        add             %o1, 1, %o1
         bgu,pt          %XCC, 90b
-         add            %o1, 1, %o1
+         add            %o0, 1, %o0
         retl
          clr            %o0
-
-        .size           ___copy_in_user, .-___copy_in_user
-
-        /* Act like copy_{to,in}_user(), ie. return zero instead
-         * of original destination pointer.  This is invoked when
-         * copy_{to,in}_user() finds that %asi is kernel space.
-         */
-        .globl          memcpy_user_stub
-        .type           memcpy_user_stub,#function
-memcpy_user_stub:
-        save            %sp, -192, %sp
-        mov             %i0, %o0
-        mov             %i1, %o1
-        call            memcpy
-         mov            %i2, %o2
-        ret
-         restore        %g0, %g0, %o0
-        .size           memcpy_user_stub, .-memcpy_user_stub
+ENDPROC(___copy_in_user)
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 256b00b61892..5a0d76dc56a4 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -418,9 +418,9 @@ ENTRY(ia32_syscall)
         orl   $TS_COMPAT,TI_status(%r10)
         testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
         jnz ia32_tracesys
-ia32_do_syscall:        
         cmpl $(IA32_NR_syscalls-1),%eax
-        ja  int_ret_from_sys_call       /* ia32_tracesys has set RAX(%rsp) */
+        ja ia32_badsys
+ia32_do_call:
         IA32_ARG_FIXUP
         call *ia32_sys_call_table(,%rax,8) # xxx: rip relative
 ia32_sysret:
@@ -435,7 +435,9 @@ ia32_tracesys:
         call syscall_trace_enter
         LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
         RESTORE_REST
-        jmp ia32_do_syscall
+        cmpl $(IA32_NR_syscalls-1),%eax
+        ja  int_ret_from_sys_call       /* ia32_tracesys has set RAX(%rsp) */
+        jmp ia32_do_call
 END(ia32_syscall)
 
 ia32_badsys:
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index ba3e2ff6aedc..c09a14127584 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -1402,6 +1402,7 @@ static inline int __raw_spin_is_contended(struct raw_spinlock *lock)
 {
         return PVOP_CALL1(int, pv_lock_ops.spin_is_contended, lock);
 }
+#define __raw_spin_is_contended __raw_spin_is_contended
 
 static __always_inline void __raw_spin_lock(struct raw_spinlock *lock)
 {
diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
index d17c91981da2..8247e94ac6b1 100644
--- a/arch/x86/include/asm/spinlock.h
+++ b/arch/x86/include/asm/spinlock.h
@@ -245,6 +245,7 @@ static inline int __raw_spin_is_contended(raw_spinlock_t *lock)
 {
         return __ticket_spin_is_contended(lock);
 }
+#define __raw_spin_is_contended __raw_spin_is_contended
 
 static __always_inline void __raw_spin_lock(raw_spinlock_t *lock)
 {
diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
index 707c1f6f95fa..a60c1f3bcb87 100644
--- a/arch/x86/kernel/acpi/sleep.c
+++ b/arch/x86/kernel/acpi/sleep.c
@@ -156,11 +156,11 @@ static int __init acpi_sleep_setup(char *str)
 #ifdef CONFIG_HIBERNATION
                 if (strncmp(str, "s4_nohwsig", 10) == 0)
                         acpi_no_s4_hw_signature();
+                if (strncmp(str, "s4_nonvs", 8) == 0)
+                        acpi_s4_no_nvs();
 #endif
                 if (strncmp(str, "old_ordering", 12) == 0)
                         acpi_old_suspend_ordering();
-                if (strncmp(str, "s4_nonvs", 8) == 0)
-                        acpi_s4_no_nvs();
                 str = strchr(str, ',');
                 if (str != NULL)
                         str += strspn(str, ", \t");
diff --git a/arch/x86/kernel/apic.c b/arch/x86/kernel/apic.c
index 4b6df2469fe3..115449f869ee 100644
--- a/arch/x86/kernel/apic.c
+++ b/arch/x86/kernel/apic.c
@@ -1436,7 +1436,7 @@ static int __init detect_init_APIC(void)
         switch (boot_cpu_data.x86_vendor) {
         case X86_VENDOR_AMD:
                 if ((boot_cpu_data.x86 == 6 && boot_cpu_data.x86_model > 1) ||
-                    (boot_cpu_data.x86 == 15))
+                    (boot_cpu_data.x86 >= 15))
                         break;
                 goto no_apic;
         case X86_VENDOR_INTEL:
diff --git a/arch/x86/kernel/cpu/cpufreq/Kconfig b/arch/x86/kernel/cpu/cpufreq/Kconfig
index efae3b22a0ff..65792c2cc462 100644
--- a/arch/x86/kernel/cpu/cpufreq/Kconfig
+++ b/arch/x86/kernel/cpu/cpufreq/Kconfig
@@ -245,17 +245,6 @@ config X86_E_POWERSAVER
 
 comment "shared options"
 
-config X86_ACPI_CPUFREQ_PROC_INTF
-        bool "/proc/acpi/processor/../performance interface (deprecated)"
-        depends on PROC_FS
-        depends on X86_ACPI_CPUFREQ || X86_POWERNOW_K7_ACPI || X86_POWERNOW_K8_ACPI
-        help
-          This enables the deprecated /proc/acpi/processor/../performance
-          interface. While it is helpful for debugging, the generic,
-          cross-architecture cpufreq interfaces should be used.
-
-          If in doubt, say N.
-
 config X86_SPEEDSTEP_LIB
         tristate
         default (X86_SPEEDSTEP_ICH || X86_SPEEDSTEP_SMI || X86_P4_CLOCKMOD)
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index 5c28b37dea11..fb039cd345d8 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -939,10 +939,25 @@ static void powernow_k8_cpu_exit_acpi(struct powernow_k8_data *data)
         free_cpumask_var(data->acpi_data.shared_cpu_map);
 }
 
+static int get_transition_latency(struct powernow_k8_data *data)
+{
+        int max_latency = 0;
+        int i;
+        for (i = 0; i < data->acpi_data.state_count; i++) {
+                int cur_latency = data->acpi_data.states[i].transition_latency
+                        + data->acpi_data.states[i].bus_master_latency;
+                if (cur_latency > max_latency)
+                        max_latency = cur_latency;
+        }
+        /* value in usecs, needs to be in nanoseconds */
+        return 1000 * max_latency;
+}
+
 #else
 static int powernow_k8_cpu_init_acpi(struct powernow_k8_data *data) { return -ENODEV; }
 static void powernow_k8_cpu_exit_acpi(struct powernow_k8_data *data) { return; }
 static void powernow_k8_acpi_pst_values(struct powernow_k8_data *data, unsigned int index) { return; }
+static int get_transition_latency(struct powernow_k8_data *data) { return 0; }
 #endif /* CONFIG_X86_POWERNOW_K8_ACPI */
 
 /* Take a frequency, and issue the fid/vid transition command */
@@ -1173,7 +1188,13 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
                 if (rc) {
                         goto err_out;
                 }
-        }
+                /* Take a crude guess here.
+                 * That guess was in microseconds, so multiply with 1000 */
+                pol->cpuinfo.transition_latency = (
+                         ((data->rvo + 8) * data->vstable * VST_UNITS_20US) +
+                         ((1 << data->irt) * 30)) * 1000;
+        } else /* ACPI _PSS objects available */
+                pol->cpuinfo.transition_latency = get_transition_latency(data);
 
         /* only run on specific CPU from here on */
         oldmask = current->cpus_allowed;
@@ -1204,11 +1225,6 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
                 cpumask_copy(pol->cpus, &per_cpu(cpu_core_map, pol->cpu));
         data->available_cores = pol->cpus;
 
-        /* Take a crude guess here.
-         * That guess was in microseconds, so multiply with 1000 */
-        pol->cpuinfo.transition_latency = (((data->rvo + 8) * data->vstable * VST_UNITS_20US)
-            + (3 * (1 << data->irt) * 10)) * 1000;
-
         if (cpu_family == CPU_HW_PSTATE)
                 pol->cur = find_khz_freq_from_pstate(data->powernow_table, data->currpstate);
         else
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index 48533d77be78..da299eb85fc0 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -36,8 +36,11 @@ static struct _cache_table cache_table[] __cpuinitdata =
 {
         { 0x06, LVL_1_INST, 8 },        /* 4-way set assoc, 32 byte line size */
         { 0x08, LVL_1_INST, 16 },       /* 4-way set assoc, 32 byte line size */
+        { 0x09, LVL_1_INST, 32 },       /* 4-way set assoc, 64 byte line size */
         { 0x0a, LVL_1_DATA, 8 },        /* 2 way set assoc, 32 byte line size */
         { 0x0c, LVL_1_DATA, 16 },       /* 4-way set assoc, 32 byte line size */
+        { 0x0d, LVL_1_DATA, 16 },       /* 4-way set assoc, 64 byte line size */
+        { 0x21, LVL_2,      256 },      /* 8-way set assoc, 64 byte line size */
         { 0x22, LVL_3,      512 },      /* 4-way set assoc, sectored cache, 64 byte line size */
         { 0x23, LVL_3,      1024 },     /* 8-way set assoc, sectored cache, 64 byte line size */
         { 0x25, LVL_3,      2048 },     /* 8-way set assoc, sectored cache, 64 byte line size */
@@ -85,6 +88,18 @@ static struct _cache_table cache_table[] __cpuinitdata =
         { 0x85, LVL_2,    2048 },       /* 8-way set assoc, 32 byte line size */
         { 0x86, LVL_2,     512 },       /* 4-way set assoc, 64 byte line size */
         { 0x87, LVL_2,    1024 },       /* 8-way set assoc, 64 byte line size */
+        { 0xd0, LVL_3,     512 },       /* 4-way set assoc, 64 byte line size */
+        { 0xd1, LVL_3,    1024 },       /* 4-way set assoc, 64 byte line size */
+        { 0xd2, LVL_3,    2048 },       /* 4-way set assoc, 64 byte line size */
+        { 0xd6, LVL_3,    1024 },       /* 8-way set assoc, 64 byte line size */
+        { 0xd7, LVL_3,    2038 },       /* 8-way set assoc, 64 byte line size */
+        { 0xd8, LVL_3,    4096 },       /* 12-way set assoc, 64 byte line size */
+        { 0xdc, LVL_3,    2048 },       /* 12-way set assoc, 64 byte line size */
+        { 0xdd, LVL_3,    4096 },       /* 12-way set assoc, 64 byte line size */
+        { 0xde, LVL_3,    8192 },       /* 12-way set assoc, 64 byte line size */
+        { 0xe2, LVL_3,    2048 },       /* 16-way set assoc, 64 byte line size */
+        { 0xe3, LVL_3,    4096 },       /* 16-way set assoc, 64 byte line size */
+        { 0xe4, LVL_3,    8192 },       /* 16-way set assoc, 64 byte line size */
         { 0x00, 0, 0}
 };
 
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index e28c7a987793..a1346217e43c 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -346,6 +346,7 @@ ENTRY(save_args)
         popq_cfi %rax                   /* move return address... */
         mov %gs:pda_irqstackptr,%rsp
         EMPTY_FRAME 0
+        pushq_cfi %rbp                  /* backlink for unwinder */
         pushq_cfi %rax                  /* ... to the new stack */
         /*
          * We entered an interrupt context - irqs are off:
diff --git a/arch/x86/kernel/io_apic.c b/arch/x86/kernel/io_apic.c
index 1c4a1302536c..9b0c480c383b 100644
--- a/arch/x86/kernel/io_apic.c
+++ b/arch/x86/kernel/io_apic.c
@@ -2528,14 +2528,15 @@ static void irq_complete_move(struct irq_desc **descp)
 
         vector = ~get_irq_regs()->orig_ax;
         me = smp_processor_id();
+
+        if (vector == cfg->vector && cpumask_test_cpu(me, cfg->domain)) {
 #ifdef CONFIG_NUMA_MIGRATE_IRQ_DESC
                 *descp = desc = move_irq_desc(desc, me);
                 /* get the new one */
                 cfg = desc->chip_data;
 #endif
-
-        if (vector == cfg->vector && cpumask_test_cpu(me, cfg->domain))
                 send_cleanup_vector(cfg);
+        }
 }
 #else
 static inline void irq_complete_move(struct irq_desc **descp) {}
diff --git a/arch/x86/kernel/irqinit_32.c b/arch/x86/kernel/irqinit_32.c
index 1507ad4e674d..10a09c2f1828 100644
--- a/arch/x86/kernel/irqinit_32.c
+++ b/arch/x86/kernel/irqinit_32.c
@@ -78,15 +78,6 @@ void __init init_ISA_irqs(void)
         }
 }
 
-/*
- * IRQ2 is cascade interrupt to second interrupt controller
- */
-static struct irqaction irq2 = {
-        .handler = no_action,
-        .mask = CPU_MASK_NONE,
-        .name = "cascade",
-};
-
 DEFINE_PER_CPU(vector_irq_t, vector_irq) = {
         [0 ... IRQ0_VECTOR - 1] = -1,
         [IRQ0_VECTOR] = 0,
@@ -178,9 +169,6 @@ void __init native_init_IRQ(void)
         alloc_intr_gate(THERMAL_APIC_VECTOR, thermal_interrupt);
 #endif
 
-        if (!acpi_ioapic)
-                setup_irq(2, &irq2);
-
         /* setup after call gates are initialised (usually add in
          * the architecture specific gates)
          */
diff --git a/arch/x86/mach-default/setup.c b/arch/x86/mach-default/setup.c
index df167f265622..a265a7c63190 100644
--- a/arch/x86/mach-default/setup.c
+++ b/arch/x86/mach-default/setup.c
@@ -38,6 +38,15 @@ void __init pre_intr_init_hook(void)
         init_ISA_irqs();
 }
 
+/*
+ * IRQ2 is cascade interrupt to second interrupt controller
+ */
+static struct irqaction irq2 = {
+        .handler = no_action,
+        .mask = CPU_MASK_NONE,
+        .name = "cascade",
+};
+
 /**
  * intr_init_hook - post gate setup interrupt initialisation
  *
@@ -53,6 +62,9 @@ void __init intr_init_hook(void)
                 if (x86_quirks->arch_intr_init())
                         return;
         }
+        if (!acpi_ioapic)
+                setup_irq(2, &irq2);
+
 }
 
 /**
diff --git a/arch/x86/mach-voyager/setup.c b/arch/x86/mach-voyager/setup.c
index a580b9562e76..d914a7996a66 100644
--- a/arch/x86/mach-voyager/setup.c
+++ b/arch/x86/mach-voyager/setup.c
@@ -33,13 +33,23 @@ void __init intr_init_hook(void)
         setup_irq(2, &irq2);
 }
 
-void __init pre_setup_arch_hook(void)
+static void voyager_disable_tsc(void)
 {
         /* Voyagers run their CPUs from independent clocks, so disable
          * the TSC code because we can't sync them */
         setup_clear_cpu_cap(X86_FEATURE_TSC);
 }
 
+void __init pre_setup_arch_hook(void)
+{
+        voyager_disable_tsc();
+}
+
+void __init pre_time_init_hook(void)
+{
+        voyager_disable_tsc();
+}
+
 void __init trap_init_hook(void)
 {
 }
diff --git a/arch/x86/mach-voyager/voyager_smp.c b/arch/x86/mach-voyager/voyager_smp.c
index 9840b7ec749a..7ffcdeec4631 100644
--- a/arch/x86/mach-voyager/voyager_smp.c
+++ b/arch/x86/mach-voyager/voyager_smp.c
@@ -81,7 +81,7 @@ static void enable_local_vic_irq(unsigned int irq);
 static void disable_local_vic_irq(unsigned int irq);
 static void before_handle_vic_irq(unsigned int irq);
 static void after_handle_vic_irq(unsigned int irq);
-static void set_vic_irq_affinity(unsigned int irq, cpumask_t mask);
+static void set_vic_irq_affinity(unsigned int irq, const struct cpumask *mask);
 static void ack_vic_irq(unsigned int irq);
 static void vic_enable_cpi(void);
 static void do_boot_cpu(__u8 cpuid);
@@ -211,8 +211,6 @@ static __u32 cpu_booted_map;
 static cpumask_t smp_commenced_mask = CPU_MASK_NONE;
 
 /* This is for the new dynamic CPU boot code */
-cpumask_t cpu_callin_map = CPU_MASK_NONE;
-cpumask_t cpu_callout_map = CPU_MASK_NONE;
 
 /* The per processor IRQ masks (these are usually kept in sync) */
 static __u16 vic_irq_mask[NR_CPUS] __cacheline_aligned;
@@ -378,7 +376,7 @@ void __init find_smp_config(void)
         cpus_addr(phys_cpu_present_map)[0] |=
             voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK +
                                        3) << 24;
-        cpu_possible_map = phys_cpu_present_map;
+        init_cpu_possible(&phys_cpu_present_map);
         printk("VOYAGER SMP: phys_cpu_present_map = 0x%lx\n",
                cpus_addr(phys_cpu_present_map)[0]);
         /* Here we set up the VIC to enable SMP */
@@ -1599,16 +1597,16 @@ static void after_handle_vic_irq(unsigned int irq)
  * change the mask and then do an interrupt enable CPI to re-enable on
  * the selected processors */
 
-void set_vic_irq_affinity(unsigned int irq, cpumask_t mask)
+void set_vic_irq_affinity(unsigned int irq, const struct cpumask *mask)
 {
         /* Only extended processors handle interrupts */
         unsigned long real_mask;
         unsigned long irq_mask = 1 << irq;
         int cpu;
 
-        real_mask = cpus_addr(mask)[0] & voyager_extended_vic_processors;
+        real_mask = cpus_addr(*mask)[0] & voyager_extended_vic_processors;
 
-        if (cpus_addr(mask)[0] == 0)
+        if (cpus_addr(*mask)[0] == 0)
                 /* can't have no CPUs to accept the interrupt -- extremely
                  * bad things will happen */
                 return;
@@ -1750,10 +1748,11 @@ static void __cpuinit voyager_smp_prepare_boot_cpu(void)
         init_gdt(smp_processor_id());
         switch_to_new_gdt();
 
-        cpu_set(smp_processor_id(), cpu_online_map);
-        cpu_set(smp_processor_id(), cpu_callout_map);
-        cpu_set(smp_processor_id(), cpu_possible_map);
-        cpu_set(smp_processor_id(), cpu_present_map);
+        cpu_online_map = cpumask_of_cpu(smp_processor_id());
+        cpu_callout_map = cpumask_of_cpu(smp_processor_id());
+        cpu_callin_map = CPU_MASK_NONE;
+        cpu_present_map = cpumask_of_cpu(smp_processor_id());
+
 }
 
 static int __cpuinit voyager_cpu_up(unsigned int cpu)
@@ -1783,9 +1782,9 @@ void __init smp_setup_processor_id(void)
         x86_write_percpu(cpu_number, hard_smp_processor_id());
 }
 
-static void voyager_send_call_func(cpumask_t callmask)
+static void voyager_send_call_func(const struct cpumask *callmask)
 {
-        __u32 mask = cpus_addr(callmask)[0] & ~(1 << smp_processor_id());
+        __u32 mask = cpus_addr(*callmask)[0] & ~(1 << smp_processor_id());
         send_CPI(mask, VIC_CALL_FUNCTION_CPI);
 }
 
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 90dfae511a41..c76ef1d701c9 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -603,8 +603,6 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
 
         si_code = SEGV_MAPERR;
 
-        if (notify_page_fault(regs))
-                return;
         if (unlikely(kmmio_fault(regs, address)))
                 return;
 
@@ -634,6 +632,9 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
                 if (spurious_fault(address, error_code))
                         return;
 
+                /* kprobes don't want to hook the spurious faults. */
+                if (notify_page_fault(regs))
+                        return;
                 /*
                  * Don't take the mm semaphore here. If we fixup a prefetch
                  * fault we could otherwise deadlock.
@@ -641,6 +642,9 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
                 goto bad_area_nosemaphore;
         }
 
+        /* kprobes don't want to hook the spurious faults. */
+        if (notify_page_fault(regs))
+                return;
 
         /*
          * It's safe to allow irq's after cr2 has been saved and the
diff --git a/arch/x86/xen/multicalls.h b/arch/x86/xen/multicalls.h
index 858938241616..fa3e10725d98 100644
--- a/arch/x86/xen/multicalls.h
+++ b/arch/x86/xen/multicalls.h
@@ -19,8 +19,10 @@ DECLARE_PER_CPU(unsigned long, xen_mc_irq_flags);
    paired with xen_mc_issue() */
 static inline void xen_mc_batch(void)
 {
+        unsigned long flags;
         /* need to disable interrupts until this entry is complete */
-        local_irq_save(__get_cpu_var(xen_mc_irq_flags));
+        local_irq_save(flags);
+        __get_cpu_var(xen_mc_irq_flags) = flags;
 }
 
 static inline struct multicall_space xen_mc_entry(size_t args)
diff --git a/crypto/algapi.c b/crypto/algapi.c
index 7c41e7405c41..56c62e2858d5 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -149,6 +149,9 @@ static struct crypto_larval *__crypto_register_alg(struct crypto_alg *alg)
                 if (q == alg)
                         goto err;
 
+                if (crypto_is_moribund(q))
+                        continue;
+
                 if (crypto_is_larval(q)) {
                         if (!strcmp(alg->cra_driver_name, q->cra_driver_name))
                                 goto err;
@@ -197,7 +200,7 @@ void crypto_alg_tested(const char *name, int err)
 
         down_write(&crypto_alg_sem);
         list_for_each_entry(q, &crypto_alg_list, cra_list) {
-                if (!crypto_is_larval(q))
+                if (crypto_is_moribund(q) || !crypto_is_larval(q))
                         continue;
 
                 test = (struct crypto_larval *)q;
@@ -210,6 +213,7 @@ void crypto_alg_tested(const char *name, int err)
         goto unlock;
 
 found:
+        q->cra_flags |= CRYPTO_ALG_DEAD;
         alg = test->adult;
         if (err || list_empty(&alg->cra_list))
                 goto complete;
diff --git a/crypto/api.c b/crypto/api.c
index 9975a7bd246c..efe77df6863f 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -557,34 +557,34 @@ err:
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(crypto_alloc_tfm);
- 
+
 /*
- *      crypto_free_tfm - Free crypto transform
+ *      crypto_destroy_tfm - Free crypto transform
+ *      @mem: Start of tfm slab
  *      @tfm: Transform to free
  *
- *      crypto_free_tfm() frees up the transform and any associated resources,
+ *      This function frees up the transform and any associated resources,
  *      then drops the refcount on the associated algorithm.
  */
-void crypto_free_tfm(struct crypto_tfm *tfm)
+void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm)
 {
         struct crypto_alg *alg;
         int size;
 
-        if (unlikely(!tfm))
+        if (unlikely(!mem))
                 return;
 
         alg = tfm->__crt_alg;
-        size = sizeof(*tfm) + alg->cra_ctxsize;
+        size = ksize(mem);
 
         if (!tfm->exit && alg->cra_exit)
                 alg->cra_exit(tfm);
         crypto_exit_ops(tfm);
         crypto_mod_put(alg);
-        memset(tfm, 0, size);
-        kfree(tfm);
+        memset(mem, 0, size);
+        kfree(mem);
 }
-
-EXPORT_SYMBOL_GPL(crypto_free_tfm);
+EXPORT_SYMBOL_GPL(crypto_destroy_tfm);
 
 int crypto_has_alg(const char *name, u32 type, u32 mask)
 {
diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
index 9aeeb52004a5..3de89a424401 100644
--- a/crypto/scatterwalk.c
+++ b/crypto/scatterwalk.c
@@ -54,7 +54,8 @@ static void scatterwalk_pagedone(struct scatter_walk *walk, int out,
                 struct page *page;
 
                 page = sg_page(walk->sg) + ((walk->offset - 1) >> PAGE_SHIFT);
-                flush_dcache_page(page);
+                if (!PageSlab(page))
+                        flush_dcache_page(page);
         }
 
         if (more) {
diff --git a/crypto/shash.c b/crypto/shash.c
index c9df367332ff..d5a2b619c55f 100644
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -388,10 +388,15 @@ static int crypto_init_shash_ops_compat(struct crypto_tfm *tfm)
         struct shash_desc *desc = crypto_tfm_ctx(tfm);
         struct crypto_shash *shash;
 
+        if (!crypto_mod_get(calg))
+                return -EAGAIN;
+
         shash = __crypto_shash_cast(crypto_create_tfm(
                 calg, &crypto_shash_type));
-        if (IS_ERR(shash))
+        if (IS_ERR(shash)) {
+                crypto_mod_put(calg);
                 return PTR_ERR(shash);
+        }
 
         desc->tfm = shash;
         tfm->exit = crypto_exit_shash_ops_compat;
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index d7f9839ba264..a7799a99f2d9 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -9,6 +9,7 @@ menuconfig ACPI
         depends on PCI
         depends on PM
         select PNP
+        select CPU_IDLE
         default y
         ---help---
           Advanced Configuration and Power Interface (ACPI) support for 
@@ -287,7 +288,7 @@ config ACPI_CONTAINER
           support physical cpu/memory hot-plug.
 
           If one selects "m", this driver can be loaded with
-          "modprobe acpi_container".
+          "modprobe container".
 
 config ACPI_HOTPLUG_MEMORY
         tristate "Memory Hotplug"
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index 9684cc827930..22ce48985720 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -538,10 +538,9 @@ acpi_tb_parse_root_table(acpi_physical_address rsdp_address, u8 flags)
                         if (ACPI_FAILURE(status)) {
                                 ACPI_WARNING((AE_INFO,
                                               "Truncating %u table entries!",
-                                              (unsigned)
-                                              (acpi_gbl_root_table_list.size -
-                                               acpi_gbl_root_table_list.
-                                               count)));
+                                              (unsigned) (table_count -
+                                               (acpi_gbl_root_table_list.
+                                               count - 2))));
                                 break;
                         }
                 }
diff --git a/drivers/acpi/acpica/uteval.c b/drivers/acpi/acpica/uteval.c
index da9450bc60f7..9c9897dbe907 100644
--- a/drivers/acpi/acpica/uteval.c
+++ b/drivers/acpi/acpica/uteval.c
@@ -116,9 +116,9 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
                 return_ACPI_STATUS(AE_NO_MEMORY);
         }
 
-        /* Default return value is SUPPORTED */
+        /* Default return value is 0, NOT-SUPPORTED */
 
-        return_desc->integer.value = ACPI_UINT32_MAX;
+        return_desc->integer.value = 0;
         walk_state->return_desc = return_desc;
 
         /* Compare input string to static table of supported interfaces */
@@ -127,10 +127,8 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
                 if (!ACPI_STRCMP
                     (string_desc->string.pointer,
                      acpi_interfaces_supported[i])) {
-
-                        /* The interface is supported */
-
-                        return_ACPI_STATUS(AE_OK);
+                        return_desc->integer.value = ACPI_UINT32_MAX;
+                        goto done;
                 }
         }
 
@@ -141,15 +139,14 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
          */
         status = acpi_os_validate_interface(string_desc->string.pointer);
         if (ACPI_SUCCESS(status)) {
-
-                /* The interface is supported */
-
-                return_ACPI_STATUS(AE_OK);
+                return_desc->integer.value = ACPI_UINT32_MAX;
         }
 
-        /* The interface is not supported */
+done:
+        ACPI_DEBUG_PRINT_RAW((ACPI_DB_INFO, "ACPI: BIOS _OSI(%s) %ssupported\n",
+                string_desc->string.pointer,
+                return_desc->integer.value == 0 ? "not-" : ""));
 
-        return_desc->integer.value = 0;
         return_ACPI_STATUS(AE_OK);
 }
 
diff --git a/drivers/acpi/container.c b/drivers/acpi/container.c
index 17020c12623c..fe0cdf83641a 100644
--- a/drivers/acpi/container.c
+++ b/drivers/acpi/container.c
@@ -163,7 +163,7 @@ static void container_notify_cb(acpi_handle handle, u32 type, void *context)
         case ACPI_NOTIFY_BUS_CHECK:
                 /* Fall through */
         case ACPI_NOTIFY_DEVICE_CHECK:
-                printk("Container driver received %s event\n",
+                printk(KERN_WARNING "Container driver received %s event\n",
                        (type == ACPI_NOTIFY_BUS_CHECK) ?
                        "ACPI_NOTIFY_BUS_CHECK" : "ACPI_NOTIFY_DEVICE_CHECK");
                 status = acpi_bus_get_device(handle, &device);
@@ -174,7 +174,8 @@ static void container_notify_cb(acpi_handle handle, u32 type, void *context)
                                         kobject_uevent(&device->dev.kobj,
                                                        KOBJ_ONLINE);
                                 else
-                                        printk("Failed to add container\n");
+                                        printk(KERN_WARNING
+                                               "Failed to add container\n");
                         }
                 } else {
                         if (ACPI_SUCCESS(status)) {
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index 5b30b8d91d71..35094f230b1e 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -855,10 +855,14 @@ fdd_out:
 static ssize_t show_docked(struct device *dev,
                            struct device_attribute *attr, char *buf)
 {
+        struct acpi_device *tmp;
+
         struct dock_station *dock_station = *((struct dock_station **)
                 dev->platform_data);
-        return snprintf(buf, PAGE_SIZE, "%d\n", dock_present(dock_station));
 
+        if (ACPI_SUCCESS(acpi_bus_get_device(dock_station->handle, &tmp)))
+                return snprintf(buf, PAGE_SIZE, "1\n");
+        return snprintf(buf, PAGE_SIZE, "0\n");
 }
 static DEVICE_ATTR(docked, S_IRUGO, show_docked, NULL);
 
@@ -984,7 +988,7 @@ static int dock_add(acpi_handle handle)
 
         ret = device_create_file(&dock_device->dev, &dev_attr_docked);
         if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                 platform_device_unregister(dock_device);
                 kfree(dock_station);
                 dock_station = NULL;
@@ -992,7 +996,7 @@ static int dock_add(acpi_handle handle)
         }
         ret = device_create_file(&dock_device->dev, &dev_attr_undock);
         if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                 device_remove_file(&dock_device->dev, &dev_attr_docked);
                 platform_device_unregister(dock_device);
                 kfree(dock_station);
@@ -1001,7 +1005,7 @@ static int dock_add(acpi_handle handle)
         }
         ret = device_create_file(&dock_device->dev, &dev_attr_uid);
         if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                 device_remove_file(&dock_device->dev, &dev_attr_docked);
                 device_remove_file(&dock_device->dev, &dev_attr_undock);
                 platform_device_unregister(dock_device);
@@ -1011,7 +1015,7 @@ static int dock_add(acpi_handle handle)
         }
         ret = device_create_file(&dock_device->dev, &dev_attr_flags);
         if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                 device_remove_file(&dock_device->dev, &dev_attr_docked);
                 device_remove_file(&dock_device->dev, &dev_attr_undock);
                 device_remove_file(&dock_device->dev, &dev_attr_uid);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index a2b82c90a683..5c2f5d343be6 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -982,7 +982,7 @@ int __init acpi_ec_ecdt_probe(void)
                 saved_ec = kmalloc(sizeof(struct acpi_ec), GFP_KERNEL);
                 if (!saved_ec)
                         return -ENOMEM;
-                memcpy(&saved_ec, boot_ec, sizeof(saved_ec));
+                memcpy(saved_ec, boot_ec, sizeof(*saved_ec));
         /* fall through */
         }
         /* This workaround is needed only on some broken machines,
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index adec3d15810a..5479b9f42513 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -255,12 +255,12 @@ static int acpi_platform_notify(struct device *dev)
         }
         type = acpi_get_bus_type(dev->bus);
         if (!type) {
-                DBG("No ACPI bus support for %s\n", dev->bus_id);
+                DBG("No ACPI bus support for %s\n", dev_name(dev));
                 ret = -EINVAL;
                 goto end;
         }
         if ((ret = type->find_device(dev, &handle)) != 0)
-                DBG("Can't get handler for %s\n", dev->bus_id);
+                DBG("Can't get handler for %s\n", dev_name(dev));
       end:
         if (!ret)
                 acpi_bind_one(dev, handle);
@@ -271,10 +271,10 @@ static int acpi_platform_notify(struct device *dev)
 
                 acpi_get_name(dev->archdata.acpi_handle,
                               ACPI_FULL_PATHNAME, &buffer);
-                DBG("Device %s -> %s\n", dev->bus_id, (char *)buffer.pointer);
+                DBG("Device %s -> %s\n", dev_name(dev), (char *)buffer.pointer);
                 kfree(buffer.pointer);
         } else
-                DBG("Device %s -> No ACPI support\n", dev->bus_id);
+                DBG("Device %s -> No ACPI support\n", dev_name(dev));
 #endif
 
         return ret;
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 6729a4992f2b..b3193ec0a2ef 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -228,10 +228,10 @@ void acpi_os_vprintf(const char *fmt, va_list args)
         if (acpi_in_debugger) {
                 kdb_printf("%s", buffer);
         } else {
-                printk("%s", buffer);
+                printk(KERN_CONT "%s", buffer);
         }
 #else
-        printk("%s", buffer);
+        printk(KERN_CONT "%s", buffer);
 #endif
 }
 
@@ -1317,6 +1317,54 @@ acpi_os_validate_interface (char *interface)
         return AE_SUPPORT;
 }
 
+#ifdef  CONFIG_X86
+
+struct aml_port_desc {
+        uint    start;
+        uint    end;
+        char*   name;
+        char    warned;
+};
+
+static struct aml_port_desc aml_invalid_port_list[] = {
+        {0x20, 0x21, "PIC0", 0},
+        {0xA0, 0xA1, "PIC1", 0},
+        {0x4D0, 0x4D1, "ELCR", 0}
+};
+
+/*
+ * valid_aml_io_address()
+ *
+ * if valid, return true
+ * else invalid, warn once, return false
+ */
+static bool valid_aml_io_address(uint address, uint length)
+{
+        int i;
+        int entries = sizeof(aml_invalid_port_list) / sizeof(struct aml_port_desc);
+
+        for (i = 0; i < entries; ++i) {
+                if ((address >= aml_invalid_port_list[i].start &&
+                        address <= aml_invalid_port_list[i].end) ||
+                        (address + length >= aml_invalid_port_list[i].start &&
+                        address  + length <= aml_invalid_port_list[i].end))
+                {
+                        if (!aml_invalid_port_list[i].warned)
+                        {
+                                printk(KERN_ERR "ACPI: Denied BIOS AML access"
+                                        " to invalid port 0x%x+0x%x (%s)\n",
+                                        address, length,
+                                        aml_invalid_port_list[i].name);
+                                aml_invalid_port_list[i].warned = 1;
+                        }
+                        return false;   /* invalid */
+                }
+        }
+        return true;    /* valid */
+}
+#else
+static inline bool valid_aml_io_address(uint address, uint length) { return true; }
+#endif
 /******************************************************************************
  *
  * FUNCTION:    acpi_os_validate_address
@@ -1346,6 +1394,8 @@ acpi_os_validate_address (
 
         switch (space_id) {
         case ACPI_ADR_SPACE_SYSTEM_IO:
+                if (!valid_aml_io_address(address, length))
+                        return AE_AML_ILLEGAL_ADDRESS;
         case ACPI_ADR_SPACE_SYSTEM_MEMORY:
                 /* Only interference checks against SystemIO and SytemMemory
                    are needed */
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 1c6e73c7865e..6c772ca76bd1 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -593,7 +593,7 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
                 return -ENODEV;
         } else {
                 acpi_irq_penalty[link->irq.active] += PIRQ_PENALTY_PCI_USING;
-                printk(PREFIX "%s [%s] enabled at IRQ %d\n",
+                printk(KERN_WARNING PREFIX "%s [%s] enabled at IRQ %d\n",
                        acpi_device_name(link->device),
                        acpi_device_bid(link->device), link->irq.active);
         }
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 66a9d8145562..7bc22a471fe3 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -66,43 +66,17 @@ ACPI_MODULE_NAME("processor_idle");
 #define ACPI_PROCESSOR_FILE_POWER       "power"
 #define US_TO_PM_TIMER_TICKS(t)         ((t * (PM_TIMER_FREQUENCY/1000)) / 1000)
 #define PM_TIMER_TICK_NS                (1000000000ULL/PM_TIMER_FREQUENCY)
-#ifndef CONFIG_CPU_IDLE
-#define C2_OVERHEAD                     4       /* 1us (3.579 ticks per us) */
-#define C3_OVERHEAD                     4       /* 1us (3.579 ticks per us) */
-static void (*pm_idle_save) (void) __read_mostly;
-#else
 #define C2_OVERHEAD                     1       /* 1us */
 #define C3_OVERHEAD                     1       /* 1us */
-#endif
 #define PM_TIMER_TICKS_TO_US(p)         (((p) * 1000)/(PM_TIMER_FREQUENCY/1000))
 
 static unsigned int max_cstate __read_mostly = ACPI_PROCESSOR_MAX_POWER;
-#ifdef CONFIG_CPU_IDLE
 module_param(max_cstate, uint, 0000);
-#else
-module_param(max_cstate, uint, 0644);
-#endif
 static unsigned int nocst __read_mostly;
 module_param(nocst, uint, 0000);
 
-#ifndef CONFIG_CPU_IDLE
-/*
- * bm_history -- bit-mask with a bit per jiffy of bus-master activity
- * 1000 HZ: 0xFFFFFFFF: 32 jiffies = 32ms
- * 800 HZ: 0xFFFFFFFF: 32 jiffies = 40ms
- * 100 HZ: 0x0000000F: 4 jiffies = 40ms
- * reduce history for more aggressive entry into C3
- */
-static unsigned int bm_history __read_mostly =
-    (HZ >= 800 ? 0xFFFFFFFF : ((1U << (HZ / 25)) - 1));
-module_param(bm_history, uint, 0644);
-
-static int acpi_processor_set_power_policy(struct acpi_processor *pr);
-
-#else   /* CONFIG_CPU_IDLE */
 static unsigned int latency_factor __read_mostly = 2;
 module_param(latency_factor, uint, 0644);
-#endif
 
 /*
  * IBM ThinkPad R40e crashes mysteriously when going into C2 or C3.
@@ -224,71 +198,6 @@ static void acpi_safe_halt(void)
         current_thread_info()->status |= TS_POLLING;
 }
 
-#ifndef CONFIG_CPU_IDLE
-
-static void
-acpi_processor_power_activate(struct acpi_processor *pr,
-                              struct acpi_processor_cx *new)
-{
-        struct acpi_processor_cx *old;
-
-        if (!pr || !new)
-                return;
-
-        old = pr->power.state;
-
-        if (old)
-                old->promotion.count = 0;
-        new->demotion.count = 0;
-
-        /* Cleanup from old state. */
-        if (old) {
-                switch (old->type) {
-                case ACPI_STATE_C3:
-                        /* Disable bus master reload */
-                        if (new->type != ACPI_STATE_C3 && pr->flags.bm_check)
-                                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 0);
-                        break;
-                }
-        }
-
-        /* Prepare to use new state. */
-        switch (new->type) {
-        case ACPI_STATE_C3:
-                /* Enable bus master reload */
-                if (old->type != ACPI_STATE_C3 && pr->flags.bm_check)
-                        acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
-                break;
-        }
-
-        pr->power.state = new;
-
-        return;
-}
-
-static atomic_t c3_cpu_count;
-
-/* Common C-state entry for C2, C3, .. */
-static void acpi_cstate_enter(struct acpi_processor_cx *cstate)
-{
-        /* Don't trace irqs off for idle */
-        stop_critical_timings();
-        if (cstate->entry_method == ACPI_CSTATE_FFH) {
-                /* Call into architectural FFH based C-state */
-                acpi_processor_ffh_cstate_enter(cstate);
-        } else {
-                int unused;
-                /* IO port based C-state */
-                inb(cstate->address);
-                /* Dummy wait op - must do something useless after P_LVL2 read
-                   because chipsets cannot guarantee that STPCLK# signal
-                   gets asserted in time to freeze execution properly. */
-                unused = inl(acpi_gbl_FADT.xpm_timer_block.address);
-        }
-        start_critical_timings();
-}
-#endif /* !CONFIG_CPU_IDLE */
-
 #ifdef ARCH_APICTIMER_STOPS_ON_C3
 
 /*
@@ -390,421 +299,6 @@ static int tsc_halts_in_c(int state)
 }
 #endif
 
-#ifndef CONFIG_CPU_IDLE
-static void acpi_processor_idle(void)
-{
-        struct acpi_processor *pr = NULL;
-        struct acpi_processor_cx *cx = NULL;
-        struct acpi_processor_cx *next_state = NULL;
-        int sleep_ticks = 0;
-        u32 t1, t2 = 0;
-
-        /*
-         * Interrupts must be disabled during bus mastering calculations and
-         * for C2/C3 transitions.
-         */
-        local_irq_disable();
-
-        pr = __get_cpu_var(processors);
-        if (!pr) {
-                local_irq_enable();
-                return;
-        }
-
-        /*
-         * Check whether we truly need to go idle, or should
-         * reschedule:
-         */
-        if (unlikely(need_resched())) {
-                local_irq_enable();
-                return;
-        }
-
-        cx = pr->power.state;
-        if (!cx || acpi_idle_suspend) {
-                if (pm_idle_save) {
-                        pm_idle_save(); /* enables IRQs */
-                } else {
-                        acpi_safe_halt();
-                        local_irq_enable();
-                }
-
-                return;
-        }
-
-        /*
-         * Check BM Activity
-         * -----------------
-         * Check for bus mastering activity (if required), record, and check
-         * for demotion.
-         */
-        if (pr->flags.bm_check) {
-                u32 bm_status = 0;
-                unsigned long diff = jiffies - pr->power.bm_check_timestamp;
-
-                if (diff > 31)
-                        diff = 31;
-
-                pr->power.bm_activity <<= diff;
-
-                acpi_get_register(ACPI_BITREG_BUS_MASTER_STATUS, &bm_status);
-                if (bm_status) {
-                        pr->power.bm_activity |= 0x1;
-                        acpi_set_register(ACPI_BITREG_BUS_MASTER_STATUS, 1);
-                }
-                /*
-                 * PIIX4 Erratum #18: Note that BM_STS doesn't always reflect
-                 * the true state of bus mastering activity; forcing us to
-                 * manually check the BMIDEA bit of each IDE channel.
-                 */
-                else if (errata.piix4.bmisx) {
-                        if ((inb_p(errata.piix4.bmisx + 0x02) & 0x01)
-                            || (inb_p(errata.piix4.bmisx + 0x0A) & 0x01))
-                                pr->power.bm_activity |= 0x1;
-                }
-
-                pr->power.bm_check_timestamp = jiffies;
-
-                /*
-                 * If bus mastering is or was active this jiffy, demote
-                 * to avoid a faulty transition.  Note that the processor
-                 * won't enter a low-power state during this call (to this
-                 * function) but should upon the next.
-                 *
-                 * TBD: A better policy might be to fallback to the demotion
-                 *      state (use it for this quantum only) istead of
-                 *      demoting -- and rely on duration as our sole demotion
-                 *      qualification.  This may, however, introduce DMA
-                 *      issues (e.g. floppy DMA transfer overrun/underrun).
-                 */
-                if ((pr->power.bm_activity & 0x1) &&
-                    cx->demotion.threshold.bm) {
-                        local_irq_enable();
-                        next_state = cx->demotion.state;
-                        goto end;
-                }
-        }
-
-#ifdef CONFIG_HOTPLUG_CPU
-        /*
-         * Check for P_LVL2_UP flag before entering C2 and above on
-         * an SMP system. We do it here instead of doing it at _CST/P_LVL
-         * detection phase, to work cleanly with logical CPU hotplug.
-         */
-        if ((cx->type != ACPI_STATE_C1) && (num_online_cpus() > 1) &&
-            !pr->flags.has_cst && !(acpi_gbl_FADT.flags & ACPI_FADT_C2_MP_SUPPORTED))
-                cx = &pr->power.states[ACPI_STATE_C1];
-#endif
-
-        /*
-         * Sleep:
-         * ------
-         * Invoke the current Cx state to put the processor to sleep.
-         */
-        if (cx->type == ACPI_STATE_C2 || cx->type == ACPI_STATE_C3) {
-                current_thread_info()->status &= ~TS_POLLING;
-                /*
-                 * TS_POLLING-cleared state must be visible before we
-                 * test NEED_RESCHED:
-                 */
-                smp_mb();
-                if (need_resched()) {
-                        current_thread_info()->status |= TS_POLLING;
-                        local_irq_enable();
-                        return;
-                }
-        }
-
-        switch (cx->type) {
-
-        case ACPI_STATE_C1:
-                /*
-                 * Invoke C1.
-                 * Use the appropriate idle routine, the one that would
-                 * be used without acpi C-states.
-                 */
-                if (pm_idle_save) {
-                        pm_idle_save(); /* enables IRQs */
-                } else {
-                        acpi_safe_halt();
-                        local_irq_enable();
-                }
-
-                /*
-                 * TBD: Can't get time duration while in C1, as resumes
-                 *      go to an ISR rather than here.  Need to instrument
-                 *      base interrupt handler.
-                 *
-                 * Note: the TSC better not stop in C1, sched_clock() will
-                 *       skew otherwise.
-                 */
-                sleep_ticks = 0xFFFFFFFF;
-
-                break;
-
-        case ACPI_STATE_C2:
-                /* Get start time (ticks) */
-                t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-                /* Tell the scheduler that we are going deep-idle: */
-                sched_clock_idle_sleep_event();
-                /* Invoke C2 */
-                acpi_state_timer_broadcast(pr, cx, 1);
-                acpi_cstate_enter(cx);
-                /* Get end time (ticks) */
-                t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-
-#if defined (CONFIG_GENERIC_TIME) && defined (CONFIG_X86)
-                /* TSC halts in C2, so notify users */
-                if (tsc_halts_in_c(ACPI_STATE_C2))
-                        mark_tsc_unstable("possible TSC halt in C2");
-#endif
-                /* Compute time (ticks) that we were actually asleep */
-                sleep_ticks = ticks_elapsed(t1, t2);
-
-                /* Tell the scheduler how much we idled: */
-                sched_clock_idle_wakeup_event(sleep_ticks*PM_TIMER_TICK_NS);
-
-                /* Re-enable interrupts */
-                local_irq_enable();
-                /* Do not account our idle-switching overhead: */
-                sleep_ticks -= cx->latency_ticks + C2_OVERHEAD;
-
-                current_thread_info()->status |= TS_POLLING;
-                acpi_state_timer_broadcast(pr, cx, 0);
-                break;
-
-        case ACPI_STATE_C3:
-                acpi_unlazy_tlb(smp_processor_id());
-                /*
-                 * Must be done before busmaster disable as we might
-                 * need to access HPET !
-                 */
-                acpi_state_timer_broadcast(pr, cx, 1);
-                /*
-                 * disable bus master
-                 * bm_check implies we need ARB_DIS
-                 * !bm_check implies we need cache flush
-                 * bm_control implies whether we can do ARB_DIS
-                 *
-                 * That leaves a case where bm_check is set and bm_control is
-                 * not set. In that case we cannot do much, we enter C3
-                 * without doing anything.
-                 */
-                if (pr->flags.bm_check && pr->flags.bm_control) {
-                        if (atomic_inc_return(&c3_cpu_count) ==
-                            num_online_cpus()) {
-                                /*
-                                 * All CPUs are trying to go to C3
-                                 * Disable bus master arbitration
-                                 */
-                                acpi_set_register(ACPI_BITREG_ARB_DISABLE, 1);
-                        }
-                } else if (!pr->flags.bm_check) {
-                        /* SMP with no shared cache... Invalidate cache  */
-                        ACPI_FLUSH_CPU_CACHE();
-                }
-
-                /* Get start time (ticks) */
-                t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-                /* Invoke C3 */
-                /* Tell the scheduler that we are going deep-idle: */
-                sched_clock_idle_sleep_event();
-                acpi_cstate_enter(cx);
-                /* Get end time (ticks) */
-                t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-                if (pr->flags.bm_check && pr->flags.bm_control) {
-                        /* Enable bus master arbitration */
-                        atomic_dec(&c3_cpu_count);
-                        acpi_set_register(ACPI_BITREG_ARB_DISABLE, 0);
-                }
-
-#if defined (CONFIG_GENERIC_TIME) && defined (CONFIG_X86)
-                /* TSC halts in C3, so notify users */
-                if (tsc_halts_in_c(ACPI_STATE_C3))
-                        mark_tsc_unstable("TSC halts in C3");
-#endif
-                /* Compute time (ticks) that we were actually asleep */
-                sleep_ticks = ticks_elapsed(t1, t2);
-                /* Tell the scheduler how much we idled: */
-                sched_clock_idle_wakeup_event(sleep_ticks*PM_TIMER_TICK_NS);
-
-                /* Re-enable interrupts */
-                local_irq_enable();
-                /* Do not account our idle-switching overhead: */
-                sleep_ticks -= cx->latency_ticks + C3_OVERHEAD;
-
-                current_thread_info()->status |= TS_POLLING;
-                acpi_state_timer_broadcast(pr, cx, 0);
-                break;
-
-        default:
-                local_irq_enable();
-                return;
-        }
-        cx->usage++;
-        if ((cx->type != ACPI_STATE_C1) && (sleep_ticks > 0))
-                cx->time += sleep_ticks;
-
-        next_state = pr->power.state;
-
-#ifdef CONFIG_HOTPLUG_CPU
-        /* Don't do promotion/demotion */
-        if ((cx->type == ACPI_STATE_C1) && (num_online_cpus() > 1) &&
-            !pr->flags.has_cst && !(acpi_gbl_FADT.flags & ACPI_FADT_C2_MP_SUPPORTED)) {
-                next_state = cx;
-                goto end;
-        }
-#endif
-
-        /*
-         * Promotion?
-         * ----------
-         * Track the number of longs (time asleep is greater than threshold)
-         * and promote when the count threshold is reached.  Note that bus
-         * mastering activity may prevent promotions.
-         * Do not promote above max_cstate.
-         */
-        if (cx->promotion.state &&
-            ((cx->promotion.state - pr->power.states) <= max_cstate)) {
-                if (sleep_ticks > cx->promotion.threshold.ticks &&
-                  cx->promotion.state->latency <=
-                                pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY)) {
-                        cx->promotion.count++;
-                        cx->demotion.count = 0;
-                        if (cx->promotion.count >=
-                            cx->promotion.threshold.count) {
-                                if (pr->flags.bm_check) {
-                                        if (!
-                                            (pr->power.bm_activity & cx->
-                                             promotion.threshold.bm)) {
-                                                next_state =
-                                                    cx->promotion.state;
-                                                goto end;
-                                        }
-                                } else {
-                                        next_state = cx->promotion.state;
-                                        goto end;
-                                }
-                        }
-                }
-        }
-
-        /*
-         * Demotion?
-         * ---------
-         * Track the number of shorts (time asleep is less than time threshold)
-         * and demote when the usage threshold is reached.
-         */
-        if (cx->demotion.state) {
-                if (sleep_ticks < cx->demotion.threshold.ticks) {
-                        cx->demotion.count++;
-                        cx->promotion.count = 0;
-                        if (cx->demotion.count >= cx->demotion.threshold.count) {
-                                next_state = cx->demotion.state;
-                                goto end;
-                        }
-                }
-        }
-
-      end:
-        /*
-         * Demote if current state exceeds max_cstate
-         * or if the latency of the current state is unacceptable
-         */
-        if ((pr->power.state - pr->power.states) > max_cstate ||
-                pr->power.state->latency >
-                                pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY)) {
-                if (cx->demotion.state)
-                        next_state = cx->demotion.state;
-        }
-
-        /*
-         * New Cx State?
-         * -------------
-         * If we're going to start using a new Cx state we must clean up
-         * from the previous and prepare to use the new.
-         */
-        if (next_state != pr->power.state)
-                acpi_processor_power_activate(pr, next_state);
-}
-
-static int acpi_processor_set_power_policy(struct acpi_processor *pr)
-{
-        unsigned int i;
-        unsigned int state_is_set = 0;
-        struct acpi_processor_cx *lower = NULL;
-        struct acpi_processor_cx *higher = NULL;
-        struct acpi_processor_cx *cx;
-
-
-        if (!pr)
-                return -EINVAL;
-
-        /*
-         * This function sets the default Cx state policy (OS idle handler).
-         * Our scheme is to promote quickly to C2 but more conservatively
-         * to C3.  We're favoring C2  for its characteristics of low latency
-         * (quick response), good power savings, and ability to allow bus
-         * mastering activity.  Note that the Cx state policy is completely
-         * customizable and can be altered dynamically.
-         */
-
-        /* startup state */
-        for (i = 1; i < ACPI_PROCESSOR_MAX_POWER; i++) {
-                cx = &pr->power.states[i];
-                if (!cx->valid)
-                        continue;
-
-                if (!state_is_set)
-                        pr->power.state = cx;
-                state_is_set++;
-                break;
-        }
-
-        if (!state_is_set)
-                return -ENODEV;
-
-        /* demotion */
-        for (i = 1; i < ACPI_PROCESSOR_MAX_POWER; i++) {
-                cx = &pr->power.states[i];
-                if (!cx->valid)
-                        continue;
-
-                if (lower) {
-                        cx->demotion.state = lower;
-                        cx->demotion.threshold.ticks = cx->latency_ticks;
-                        cx->demotion.threshold.count = 1;
-                        if (cx->type == ACPI_STATE_C3)
-                                cx->demotion.threshold.bm = bm_history;
-                }
-
-                lower = cx;
-        }
-
-        /* promotion */
-        for (i = (ACPI_PROCESSOR_MAX_POWER - 1); i > 0; i--) {
-                cx = &pr->power.states[i];
-                if (!cx->valid)
-                        continue;
-
-                if (higher) {
-                        cx->promotion.state = higher;
-                        cx->promotion.threshold.ticks = cx->latency_ticks;
-                        if (cx->type >= ACPI_STATE_C2)
-                                cx->promotion.threshold.count = 4;
-                        else
-                                cx->promotion.threshold.count = 10;
-                        if (higher->type == ACPI_STATE_C3)
-                                cx->promotion.threshold.bm = bm_history;
-                }
-
-                higher = cx;
-        }
-
-        return 0;
-}
-#endif /* !CONFIG_CPU_IDLE */
-
 static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
 {
 
@@ -1047,11 +541,7 @@ static void acpi_processor_power_verify_c2(struct acpi_processor_cx *cx)
          */
         cx->valid = 1;
 
-#ifndef CONFIG_CPU_IDLE
-        cx->latency_ticks = US_TO_PM_TIMER_TICKS(cx->latency);
-#else
         cx->latency_ticks = cx->latency;
-#endif
 
         return;
 }
@@ -1121,7 +611,6 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
                                           " for C3 to be enabled on SMP systems\n"));
                         return;
                 }
-                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 0);
         }
 
         /*
@@ -1132,11 +621,16 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
          */
         cx->valid = 1;
 
-#ifndef CONFIG_CPU_IDLE
-        cx->latency_ticks = US_TO_PM_TIMER_TICKS(cx->latency);
-#else
         cx->latency_ticks = cx->latency;
-#endif
+        /*
+         * On older chipsets, BM_RLD needs to be set
+         * in order for Bus Master activity to wake the
+         * system from C3.  Newer chipsets handle DMA
+         * during C3 automatically and BM_RLD is a NOP.
+         * In either case, the proper way to
+         * handle BM_RLD is to set it and leave it set.
+         */
+        acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
 
         return;
 }
@@ -1201,20 +695,6 @@ static int acpi_processor_get_power_info(struct acpi_processor *pr)
 
         pr->power.count = acpi_processor_power_verify(pr);
 
-#ifndef CONFIG_CPU_IDLE
-        /*
-         * Set Default Policy
-         * ------------------
-         * Now that we know which states are supported, set the default
-         * policy.  Note that this policy can be changed dynamically
-         * (e.g. encourage deeper sleeps to conserve battery life when
-         * not on AC).
-         */
-        result = acpi_processor_set_power_policy(pr);
-        if (result)
-                return result;
-#endif
-
         /*
          * if one state of type C2 or C3 is available, mark this
          * CPU as being "idle manageable"
@@ -1312,69 +792,6 @@ static const struct file_operations acpi_processor_power_fops = {
         .release = single_release,
 };
 
-#ifndef CONFIG_CPU_IDLE
-
-int acpi_processor_cst_has_changed(struct acpi_processor *pr)
-{
-        int result = 0;
-
-        if (boot_option_idle_override)
-                return 0;
-
-        if (!pr)
-                return -EINVAL;
-
-        if (nocst) {
-                return -ENODEV;
-        }
-
-        if (!pr->flags.power_setup_done)
-                return -ENODEV;
-
-        /*
-         * Fall back to the default idle loop, when pm_idle_save had
-         * been initialized.
-         */
-        if (pm_idle_save) {
-                pm_idle = pm_idle_save;
-                /* Relies on interrupts forcing exit from idle. */
-                synchronize_sched();
-        }
-
-        pr->flags.power = 0;
-        result = acpi_processor_get_power_info(pr);
-        if ((pr->flags.power == 1) && (pr->flags.power_setup_done))
-                pm_idle = acpi_processor_idle;
-
-        return result;
-}
-
-#ifdef CONFIG_SMP
-static void smp_callback(void *v)
-{
-        /* we already woke the CPU up, nothing more to do */
-}
-
-/*
- * This function gets called when a part of the kernel has a new latency
- * requirement.  This means we need to get all processors out of their C-state,
- * and then recalculate a new suitable C-state. Just do a cross-cpu IPI; that
- * wakes them all right up.
- */
-static int acpi_processor_latency_notify(struct notifier_block *b,
-                unsigned long l, void *v)
-{
-        smp_call_function(smp_callback, NULL, 1);
-        return NOTIFY_OK;
-}
-
-static struct notifier_block acpi_processor_latency_notifier = {
-        .notifier_call = acpi_processor_latency_notify,
-};
-
-#endif
-
-#else /* CONFIG_CPU_IDLE */
 
 /**
  * acpi_idle_bm_check - checks if bus master activity was detected
@@ -1383,7 +800,7 @@ static int acpi_idle_bm_check(void)
 {
         u32 bm_status = 0;
 
-        acpi_get_register(ACPI_BITREG_BUS_MASTER_STATUS, &bm_status);
+        acpi_get_register_unlocked(ACPI_BITREG_BUS_MASTER_STATUS, &bm_status);
         if (bm_status)
                 acpi_set_register(ACPI_BITREG_BUS_MASTER_STATUS, 1);
         /*
@@ -1400,25 +817,6 @@ static int acpi_idle_bm_check(void)
 }
 
 /**
- * acpi_idle_update_bm_rld - updates the BM_RLD bit depending on target state
- * @pr: the processor
- * @target: the new target state
- */
-static inline void acpi_idle_update_bm_rld(struct acpi_processor *pr,
-                                           struct acpi_processor_cx *target)
-{
-        if (pr->flags.bm_rld_set && target->type != ACPI_STATE_C3) {
-                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 0);
-                pr->flags.bm_rld_set = 0;
-        }
-
-        if (!pr->flags.bm_rld_set && target->type == ACPI_STATE_C3) {
-                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
-                pr->flags.bm_rld_set = 1;
-        }
-}
-
-/**
  * acpi_idle_do_entry - a helper function that does C2 and C3 type entry
  * @cx: cstate data
  *
@@ -1473,9 +871,6 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
                 return 0;
         }
 
-        if (pr->flags.bm_check)
-                acpi_idle_update_bm_rld(pr, cx);
-
         t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
         acpi_idle_do_entry(cx);
         t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
@@ -1527,9 +922,6 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
          */
         acpi_state_timer_broadcast(pr, cx, 1);
 
-        if (pr->flags.bm_check)
-                acpi_idle_update_bm_rld(pr, cx);
-
         if (cx->type == ACPI_STATE_C3)
                 ACPI_FLUSH_CPU_CACHE();
 
@@ -1621,8 +1013,6 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
          */
         acpi_state_timer_broadcast(pr, cx, 1);
 
-        acpi_idle_update_bm_rld(pr, cx);
-
         /*
          * disable bus master
          * bm_check implies we need ARB_DIS
@@ -1795,8 +1185,6 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
         return ret;
 }
 
-#endif /* CONFIG_CPU_IDLE */
-
 int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                               struct acpi_device *device)
 {
@@ -1825,10 +1213,6 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                                "ACPI: processor limited to max C-state %d\n",
                                max_cstate);
                 first_run++;
-#if !defined(CONFIG_CPU_IDLE) && defined(CONFIG_SMP)
-                pm_qos_add_notifier(PM_QOS_CPU_DMA_LATENCY,
-                                &acpi_processor_latency_notifier);
-#endif
         }
 
         if (!pr)
@@ -1852,11 +1236,9 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
          * platforms that only support C1.
          */
         if (pr->flags.power) {
-#ifdef CONFIG_CPU_IDLE
                 acpi_processor_setup_cpuidle(pr);
                 if (cpuidle_register_device(&pr->power.dev))
                         return -EIO;
-#endif
 
                 printk(KERN_INFO PREFIX "CPU%d (power states:", pr->id);
                 for (i = 1; i <= pr->power.count; i++)
@@ -1864,13 +1246,6 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                                 printk(" C%d[C%d]", i,
                                        pr->power.states[i].type);
                 printk(")\n");
-
-#ifndef CONFIG_CPU_IDLE
-                if (pr->id == 0) {
-                        pm_idle_save = pm_idle;
-                        pm_idle = acpi_processor_idle;
-                }
-#endif
         }
 
         /* 'power' [R] */
@@ -1889,34 +1264,12 @@ int acpi_processor_power_exit(struct acpi_processor *pr,
         if (boot_option_idle_override)
                 return 0;
 
-#ifdef CONFIG_CPU_IDLE
         cpuidle_unregister_device(&pr->power.dev);
-#endif
         pr->flags.power_setup_done = 0;
 
         if (acpi_device_dir(device))
                 remove_proc_entry(ACPI_PROCESSOR_FILE_POWER,
                                   acpi_device_dir(device));
 
-#ifndef CONFIG_CPU_IDLE
-
-        /* Unregister the idle handler when processor #0 is removed. */
-        if (pr->id == 0) {
-                if (pm_idle_save)
-                        pm_idle = pm_idle_save;
-
-                /*
-                 * We are about to unload the current idle thread pm callback
-                 * (pm_idle), Wait for all processors to update cached/local
-                 * copies of pm_idle before proceeding.
-                 */
-                cpu_idle_wait();
-#ifdef CONFIG_SMP
-                pm_qos_remove_notifier(PM_QOS_CPU_DMA_LATENCY,
-                                &acpi_processor_latency_notifier);
-#endif
-        }
-#endif
-
         return 0;
 }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 846e227592d4..9cc769b587ff 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -31,14 +31,6 @@
 #include <linux/init.h>
 #include <linux/cpufreq.h>
 
-#ifdef CONFIG_X86_ACPI_CPUFREQ_PROC_INTF
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <linux/mutex.h>
-
-#include <asm/uaccess.h>
-#endif
-
 #ifdef CONFIG_X86
 #include <asm/cpufeature.h>
 #endif
@@ -434,96 +426,6 @@ int acpi_processor_notify_smm(struct module *calling_module)
 
 EXPORT_SYMBOL(acpi_processor_notify_smm);
 
-#ifdef CONFIG_X86_ACPI_CPUFREQ_PROC_INTF
-/* /proc/acpi/processor/../performance interface (DEPRECATED) */
-
-static int acpi_processor_perf_open_fs(struct inode *inode, struct file *file);
-static struct file_operations acpi_processor_perf_fops = {
-        .owner = THIS_MODULE,
-        .open = acpi_processor_perf_open_fs,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int acpi_processor_perf_seq_show(struct seq_file *seq, void *offset)
-{
-        struct acpi_processor *pr = seq->private;
-        int i;
-
-
-        if (!pr)
-                goto end;
-
-        if (!pr->performance) {
-                seq_puts(seq, "<not supported>\n");
-                goto end;
-        }
-
-        seq_printf(seq, "state count:             %d\n"
-                   "active state:            P%d\n",
-                   pr->performance->state_count, pr->performance->state);
-
-        seq_puts(seq, "states:\n");
-        for (i = 0; i < pr->performance->state_count; i++)
-                seq_printf(seq,
-                           "   %cP%d:                  %d MHz, %d mW, %d uS\n",
-                           (i == pr->performance->state ? '*' : ' '), i,
-                           (u32) pr->performance->states[i].core_frequency,
-                           (u32) pr->performance->states[i].power,
-                           (u32) pr->performance->states[i].transition_latency);
-
-      end:
-        return 0;
-}
-
-static int acpi_processor_perf_open_fs(struct inode *inode, struct file *file)
-{
-        return single_open(file, acpi_processor_perf_seq_show,
-                           PDE(inode)->data);
-}
-
-static void acpi_cpufreq_add_file(struct acpi_processor *pr)
-{
-        struct acpi_device *device = NULL;
-
-
-        if (acpi_bus_get_device(pr->handle, &device))
-                return;
-
-        /* add file 'performance' [R/W] */
-        proc_create_data(ACPI_PROCESSOR_FILE_PERFORMANCE, S_IFREG | S_IRUGO,
-                         acpi_device_dir(device),
-                         &acpi_processor_perf_fops, acpi_driver_data(device));
-        return;
-}
-
-static void acpi_cpufreq_remove_file(struct acpi_processor *pr)
-{
-        struct acpi_device *device = NULL;
-
-
-        if (acpi_bus_get_device(pr->handle, &device))
-                return;
-
-        /* remove file 'performance' */
-        remove_proc_entry(ACPI_PROCESSOR_FILE_PERFORMANCE,
-                          acpi_device_dir(device));
-
-        return;
-}
-
-#else
-static void acpi_cpufreq_add_file(struct acpi_processor *pr)
-{
-        return;
-}
-static void acpi_cpufreq_remove_file(struct acpi_processor *pr)
-{
-        return;
-}
-#endif                          /* CONFIG_X86_ACPI_CPUFREQ_PROC_INTF */
-
 static int acpi_processor_get_psd(struct acpi_processor *pr)
 {
         int result = 0;
@@ -747,14 +649,12 @@ err_ret:
 }
 EXPORT_SYMBOL(acpi_processor_preregister_performance);
 
-
 int
 acpi_processor_register_performance(struct acpi_processor_performance
                                     *performance, unsigned int cpu)
 {
         struct acpi_processor *pr;
 
-
         if (!(acpi_processor_ppc_status & PPC_REGISTERED))
                 return -EINVAL;
 
@@ -781,8 +681,6 @@ acpi_processor_register_performance(struct acpi_processor_performance
                 return -EIO;
         }
 
-        acpi_cpufreq_add_file(pr);
-
         mutex_unlock(&performance_mutex);
         return 0;
 }
@@ -795,7 +693,6 @@ acpi_processor_unregister_performance(struct acpi_processor_performance
 {
         struct acpi_processor *pr;
 
-
         mutex_lock(&performance_mutex);
 
         pr = per_cpu(processors, cpu);
@@ -808,8 +705,6 @@ acpi_processor_unregister_performance(struct acpi_processor_performance
                 kfree(pr->performance->states);
         pr->performance = NULL;
 
-        acpi_cpufreq_remove_file(pr);
-
         mutex_unlock(&performance_mutex);
 
         return;
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 7e3c609cbef2..519266654f06 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -90,31 +90,6 @@ void __init acpi_old_suspend_ordering(void)
         old_suspend_ordering = true;
 }
 
-/*
- * According to the ACPI specification the BIOS should make sure that ACPI is
- * enabled and SCI_EN bit is set on wake-up from S1 - S3 sleep states.  Still,
- * some BIOSes don't do that and therefore we use acpi_enable() to enable ACPI
- * on such systems during resume.  Unfortunately that doesn't help in
- * particularly pathological cases in which SCI_EN has to be set directly on
- * resume, although the specification states very clearly that this flag is
- * owned by the hardware.  The set_sci_en_on_resume variable will be set in such
- * cases.
- */
-static bool set_sci_en_on_resume;
-/*
- * The ACPI specification wants us to save NVS memory regions during hibernation
- * and to restore them during the subsequent resume.  However, it is not certain
- * if this mechanism is going to work on all machines, so we allow the user to
- * disable this mechanism using the 'acpi_sleep=s4_nonvs' kernel command line
- * option.
- */
-static bool s4_no_nvs;
-
-void __init acpi_s4_no_nvs(void)
-{
-        s4_no_nvs = true;
-}
-
 /**
  *      acpi_pm_disable_gpes - Disable the GPEs.
  */
@@ -193,6 +168,18 @@ static void acpi_pm_end(void)
 #endif /* CONFIG_ACPI_SLEEP */
 
 #ifdef CONFIG_SUSPEND
+/*
+ * According to the ACPI specification the BIOS should make sure that ACPI is
+ * enabled and SCI_EN bit is set on wake-up from S1 - S3 sleep states.  Still,
+ * some BIOSes don't do that and therefore we use acpi_enable() to enable ACPI
+ * on such systems during resume.  Unfortunately that doesn't help in
+ * particularly pathological cases in which SCI_EN has to be set directly on
+ * resume, although the specification states very clearly that this flag is
+ * owned by the hardware.  The set_sci_en_on_resume variable will be set in such
+ * cases.
+ */
+static bool set_sci_en_on_resume;
+
 extern void do_suspend_lowlevel(void);
 
 static u32 acpi_suspend_states[] = {
@@ -396,6 +383,20 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
 #endif /* CONFIG_SUSPEND */
 
 #ifdef CONFIG_HIBERNATION
+/*
+ * The ACPI specification wants us to save NVS memory regions during hibernation
+ * and to restore them during the subsequent resume.  However, it is not certain
+ * if this mechanism is going to work on all machines, so we allow the user to
+ * disable this mechanism using the 'acpi_sleep=s4_nonvs' kernel command line
+ * option.
+ */
+static bool s4_no_nvs;
+
+void __init acpi_s4_no_nvs(void)
+{
+        s4_no_nvs = true;
+}
+
 static unsigned long s4_hardware_signature;
 static struct acpi_table_facs *facs;
 static bool nosigcheck;
@@ -679,7 +680,7 @@ static void acpi_power_off_prepare(void)
 static void acpi_power_off(void)
 {
         /* acpi_sleep_prepare(ACPI_STATE_S5) should have already been called */
-        printk("%s called\n", __func__);
+        printk(KERN_DEBUG "%s called\n", __func__);
         local_irq_disable();
         acpi_enable_wakeup_device(ACPI_STATE_S5);
         acpi_enter_sleep_state(ACPI_STATE_S5);
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index 775c97a282bd..a8852952fac4 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -293,7 +293,12 @@ static void __init check_multiple_madt(void)
 
 int __init acpi_table_init(void)
 {
-        acpi_initialize_tables(initial_tables, ACPI_MAX_TABLES, 0);
+        acpi_status status;
+
+        status = acpi_initialize_tables(initial_tables, ACPI_MAX_TABLES, 0);
+        if (ACPI_FAILURE(status))
+                return 1;
+
         check_multiple_madt();
         return 0;
 }
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index f261737636da..bb5ed059114a 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1020,7 +1020,7 @@ acpi_video_device_brightness_seq_show(struct seq_file *seq, void *offset)
         }
 
         seq_printf(seq, "levels: ");
-        for (i = 0; i < dev->brightness->count; i++)
+        for (i = 2; i < dev->brightness->count; i++)
                 seq_printf(seq, " %d", dev->brightness->levels[i]);
         seq_printf(seq, "\ncurrent: %d\n", dev->brightness->curr);
 
@@ -1059,7 +1059,7 @@ acpi_video_device_write_brightness(struct file *file,
                 return -EFAULT;
 
         /* validate through the list of available levels */
-        for (i = 0; i < dev->brightness->count; i++)
+        for (i = 2; i < dev->brightness->count; i++)
                 if (level == dev->brightness->levels[i]) {
                         if (ACPI_SUCCESS
                             (acpi_video_device_lcd_set_level(dev, level)))
@@ -1260,7 +1260,7 @@ static int acpi_video_bus_POST_info_seq_show(struct seq_file *seq, void *offset)
                         printk(KERN_WARNING PREFIX
                                "This indicates a BIOS bug. Please contact the manufacturer.\n");
                 }
-                printk("%llx\n", options);
+                printk(KERN_WARNING "%llx\n", options);
                 seq_printf(seq, "can POST: <integrated video>");
                 if (options & 2)
                         seq_printf(seq, " <PCI video>");
@@ -1712,7 +1712,7 @@ acpi_video_get_next_level(struct acpi_video_device *device,
         max = max_below = 0;
         min = min_above = 255;
         /* Find closest level to level_current */
-        for (i = 0; i < device->brightness->count; i++) {
+        for (i = 2; i < device->brightness->count; i++) {
                 l = device->brightness->levels[i];
                 if (abs(l - level_current) < abs(delta)) {
                         delta = l - level_current;
@@ -1722,7 +1722,7 @@ acpi_video_get_next_level(struct acpi_video_device *device,
         }
         /* Ajust level_current to closest available level */
         level_current += delta;
-        for (i = 0; i < device->brightness->count; i++) {
+        for (i = 2; i < device->brightness->count; i++) {
                 l = device->brightness->levels[i];
                 if (l < min)
                         min = l;
@@ -2006,6 +2006,12 @@ static int acpi_video_bus_add(struct acpi_device *device)
                         device->pnp.bus_id[3] = '0' + instance;
                 instance ++;
         }
+        /* a hack to fix the duplicate name "VGA" problem on Pa 3553 */
+        if (!strcmp(device->pnp.bus_id, "VGA")) {
+                if (instance)
+                        device->pnp.bus_id[3] = '0' + instance;
+                instance++;
+        }
 
         video->device = device;
         strcpy(acpi_device_name(device), ACPI_VIDEO_BUS_NAME);
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 72fc0f799a64..89d7a6e94c9c 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -685,6 +685,7 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
  out_release_regions:
         pci_release_regions(dev);
  out:
+        kfree(card);
         return err;
 }
 
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index b60be7b0decf..f146e90404fa 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1713,8 +1713,8 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                 for (i = 0; i < SX_NBOARDS; i++)
                         sx_dprintk(SX_DEBUG_FIRMWARE, "<%x> ", boards[i].flags);
                 sx_dprintk(SX_DEBUG_FIRMWARE, "\n");
-                unlock_kernel();
-                return -EIO;
+                rc = -EIO;
+                goto out;
         }
 
         switch (cmd) {
@@ -1747,7 +1747,8 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                 break;
         case SXIO_DO_RAMTEST:
                 if (sx_initialized)     /* Already initialized: better not ramtest the board.  */
-                        return -EPERM;
+                        rc = -EPERM;
+                        break;
                 if (IS_SX_BOARD(board)) {
                         rc = do_memtest(board, 0, 0x7000);
                         if (!rc)
@@ -1844,6 +1845,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                 rc = -ENOTTY;
                 break;
         }
+out:
         unlock_kernel();
         func_exit();
         return rc;
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 6a2b036c9389..6f45b1658a67 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -117,11 +117,7 @@ static inline cputime64_t get_cpu_idle_time_jiffy(unsigned int cpu,
         busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.irq);
         busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.softirq);
         busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.steal);
-
-        if (!dbs_tuners_ins.ignore_nice) {
-                busy_time = cputime64_add(busy_time,
-                                kstat_cpu(cpu).cpustat.nice);
-        }
+        busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.nice);
 
         idle_time = cputime64_sub(cur_wall_time, busy_time);
         if (wall)
@@ -137,23 +133,6 @@ static inline cputime64_t get_cpu_idle_time(unsigned int cpu, cputime64_t *wall)
         if (idle_time == -1ULL)
                 return get_cpu_idle_time_jiffy(cpu, wall);
 
-        if (dbs_tuners_ins.ignore_nice) {
-                cputime64_t cur_nice;
-                unsigned long cur_nice_jiffies;
-                struct cpu_dbs_info_s *dbs_info;
-
-                dbs_info = &per_cpu(cpu_dbs_info, cpu);
-                cur_nice = cputime64_sub(kstat_cpu(cpu).cpustat.nice,
-                                         dbs_info->prev_cpu_nice);
-                /*
-                 * Assumption: nice time between sampling periods will be
-                 * less than 2^32 jiffies for 32 bit sys
-                 */
-                cur_nice_jiffies = (unsigned long)
-                                        cputime64_to_jiffies64(cur_nice);
-                dbs_info->prev_cpu_nice = kstat_cpu(cpu).cpustat.nice;
-                return idle_time + jiffies_to_usecs(cur_nice_jiffies);
-        }
         return idle_time;
 }
 
@@ -319,6 +298,9 @@ static ssize_t store_ignore_nice_load(struct cpufreq_policy *policy,
                 dbs_info = &per_cpu(cpu_dbs_info, j);
                 dbs_info->prev_cpu_idle = get_cpu_idle_time(j,
                                                 &dbs_info->prev_cpu_wall);
+                if (dbs_tuners_ins.ignore_nice)
+                        dbs_info->prev_cpu_nice = kstat_cpu(j).cpustat.nice;
+
         }
         mutex_unlock(&dbs_mutex);
 
@@ -419,6 +401,23 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                                 j_dbs_info->prev_cpu_idle);
                 j_dbs_info->prev_cpu_idle = cur_idle_time;
 
+                if (dbs_tuners_ins.ignore_nice) {
+                        cputime64_t cur_nice;
+                        unsigned long cur_nice_jiffies;
+
+                        cur_nice = cputime64_sub(kstat_cpu(j).cpustat.nice,
+                                         j_dbs_info->prev_cpu_nice);
+                        /*
+                         * Assumption: nice time between sampling periods will
+                         * be less than 2^32 jiffies for 32 bit sys
+                         */
+                        cur_nice_jiffies = (unsigned long)
+                                        cputime64_to_jiffies64(cur_nice);
+
+                        j_dbs_info->prev_cpu_nice = kstat_cpu(j).cpustat.nice;
+                        idle_time += jiffies_to_usecs(cur_nice_jiffies);
+                }
+
                 if (unlikely(!wall_time || wall_time < idle_time))
                         continue;
 
@@ -575,6 +574,10 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 
                         j_dbs_info->prev_cpu_idle = get_cpu_idle_time(j,
                                                 &j_dbs_info->prev_cpu_wall);
+                        if (dbs_tuners_ins.ignore_nice) {
+                                j_dbs_info->prev_cpu_nice =
+                                                kstat_cpu(j).cpustat.nice;
+                        }
                 }
                 this_dbs_info->cpu = cpu;
                 /*
diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
index 7be2cf3514e7..a5dd7a665aa8 100644
--- a/drivers/firewire/fw-card.c
+++ b/drivers/firewire/fw-card.c
@@ -412,6 +412,7 @@ fw_card_add(struct fw_card *card,
 {
         u32 *config_rom;
         size_t length;
+        int err;
 
         card->max_receive = max_receive;
         card->link_speed = link_speed;
@@ -422,7 +423,13 @@ fw_card_add(struct fw_card *card,
         list_add_tail(&card->link, &card_list);
         mutex_unlock(&card_mutex);
 
-        return card->driver->enable(card, config_rom, length);
+        err = card->driver->enable(card, config_rom, length);
+        if (err < 0) {
+                mutex_lock(&card_mutex);
+                list_del(&card->link);
+                mutex_unlock(&card_mutex);
+        }
+        return err;
 }
 EXPORT_SYMBOL(fw_card_add);
 
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 5130b72d593c..4be3acbaaf9a 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -70,7 +70,7 @@ config DRM_I915
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
-        depends on FB
+        select FB
         tristate "i915 driver"
         help
           Choose this option if you have a system that has Intel 830M, 845G,
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 69aa0ab28403..3795dbc0f50c 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -276,6 +276,7 @@ int drm_irq_uninstall(struct drm_device * dev)
         for (i = 0; i < dev->num_crtcs; i++) {
                 DRM_WAKEUP(&dev->vbl_queue[i]);
                 dev->vblank_enabled[i] = 0;
+                dev->last_vblank[i] = dev->driver->get_vblank_counter(dev, i);
         }
         spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
 
diff --git a/drivers/gpu/drm/drm_memory.c b/drivers/gpu/drm/drm_memory.c
index 803bc9e7ce3c..bcc869bc4092 100644
--- a/drivers/gpu/drm/drm_memory.c
+++ b/drivers/gpu/drm/drm_memory.c
@@ -171,9 +171,14 @@ EXPORT_SYMBOL(drm_core_ioremap);
 
 void drm_core_ioremap_wc(struct drm_map *map, struct drm_device *dev)
 {
-        map->handle = ioremap_wc(map->offset, map->size);
+        if (drm_core_has_AGP(dev) &&
+            dev->agp && dev->agp->cant_use_aperture && map->type == _DRM_AGP)
+                map->handle = agp_remap(map->offset, map->size, dev);
+        else
+                map->handle = ioremap_wc(map->offset, map->size);
 }
 EXPORT_SYMBOL(drm_core_ioremap_wc);
+
 void drm_core_ioremapfree(struct drm_map *map, struct drm_device *dev)
 {
         if (!map->handle || !map->size)
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index ee64b7301f67..81f1cff56fd5 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -731,8 +731,11 @@ static int i915_getparam(struct drm_device *dev, void *data,
         case I915_PARAM_HAS_GEM:
                 value = dev_priv->has_gem;
                 break;
+        case I915_PARAM_NUM_FENCES_AVAIL:
+                value = dev_priv->num_fence_regs - dev_priv->fence_reg_start;
+                break;
         default:
-                DRM_ERROR("Unknown parameter %d\n", param->param);
+                DRM_DEBUG("Unknown parameter %d\n", param->param);
                 return -EINVAL;
         }
 
@@ -764,8 +767,15 @@ static int i915_setparam(struct drm_device *dev, void *data,
         case I915_SETPARAM_ALLOW_BATCHBUFFER:
                 dev_priv->allow_batchbuffer = param->value;
                 break;
+        case I915_SETPARAM_NUM_USED_FENCES:
+                if (param->value > dev_priv->num_fence_regs ||
+                    param->value < 0)
+                        return -EINVAL;
+                /* Userspace can use first N regs */
+                dev_priv->fence_reg_start = param->value;
+                break;
         default:
-                DRM_ERROR("unknown parameter %d\n", param->param);
+                DRM_DEBUG("unknown parameter %d\n", param->param);
                 return -EINVAL;
         }
 
@@ -966,10 +976,6 @@ static int i915_load_modeset_init(struct drm_device *dev)
         if (ret)
                 goto kfree_devname;
 
-        dev_priv->mm.gtt_mapping =
-                io_mapping_create_wc(dev->agp->base,
-                                     dev->agp->agp_info.aper_size * 1024*1024);
-
         /* Allow hardware batchbuffers unless told otherwise.
          */
         dev_priv->allow_batchbuffer = 1;
@@ -1081,6 +1087,23 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                 goto free_priv;
         }
 
+        dev_priv->mm.gtt_mapping =
+                io_mapping_create_wc(dev->agp->base,
+                                     dev->agp->agp_info.aper_size * 1024*1024);
+        /* Set up a WC MTRR for non-PAT systems.  This is more common than
+         * one would think, because the kernel disables PAT on first
+         * generation Core chips because WC PAT gets overridden by a UC
+         * MTRR if present.  Even if a UC MTRR isn't present.
+         */
+        dev_priv->mm.gtt_mtrr = mtrr_add(dev->agp->base,
+                                         dev->agp->agp_info.aper_size *
+                                         1024 * 1024,
+                                         MTRR_TYPE_WRCOMB, 1);
+        if (dev_priv->mm.gtt_mtrr < 0) {
+                DRM_INFO("MTRR allocation failed\n.  Graphics "
+                         "performance may suffer.\n");
+        }
+
 #ifdef CONFIG_HIGHMEM64G
         /* don't enable GEM on PAE - needs agp + set_memory_* interface fixes */
         dev_priv->has_gem = 0;
@@ -1089,6 +1112,10 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         dev_priv->has_gem = 1;
 #endif
 
+        dev->driver->get_vblank_counter = i915_get_vblank_counter;
+        if (IS_GM45(dev))
+                dev->driver->get_vblank_counter = gm45_get_vblank_counter;
+
         i915_gem_load(dev);
 
         /* Init HWS */
@@ -1145,8 +1172,14 @@ int i915_driver_unload(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
+        io_mapping_free(dev_priv->mm.gtt_mapping);
+        if (dev_priv->mm.gtt_mtrr >= 0) {
+                mtrr_del(dev_priv->mm.gtt_mtrr, dev->agp->base,
+                         dev->agp->agp_info.aper_size * 1024 * 1024);
+                dev_priv->mm.gtt_mtrr = -1;
+        }
+
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                io_mapping_free(dev_priv->mm.gtt_mapping);
                 drm_irq_uninstall(dev);
         }
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index f8b3df0926c0..aac12ee31a46 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -112,7 +112,6 @@ static struct drm_driver driver = {
         .suspend = i915_suspend,
         .resume = i915_resume,
         .device_is_agp = i915_driver_device_is_agp,
-        .get_vblank_counter = i915_get_vblank_counter,
         .enable_vblank = i915_enable_vblank,
         .disable_vblank = i915_disable_vblank,
         .irq_preinstall = i915_driver_irq_preinstall,
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index e13518252007..7325363164f8 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -284,6 +284,7 @@ typedef struct drm_i915_private {
                 struct drm_mm gtt_space;
 
                 struct io_mapping *gtt_mapping;
+                int gtt_mtrr;
 
                 /**
                  * List of objects currently involved in rendering from the
@@ -534,6 +535,7 @@ extern int i915_vblank_pipe_get(struct drm_device *dev, void *data,
 extern int i915_enable_vblank(struct drm_device *dev, int crtc);
 extern void i915_disable_vblank(struct drm_device *dev, int crtc);
 extern u32 i915_get_vblank_counter(struct drm_device *dev, int crtc);
+extern u32 gm45_get_vblank_counter(struct drm_device *dev, int crtc);
 extern int i915_vblank_swap(struct drm_device *dev, void *data,
                             struct drm_file *file_priv);
 extern void i915_enable_irq(drm_i915_private_t *dev_priv, u32 mask);
@@ -601,6 +603,7 @@ int i915_gem_init_object(struct drm_gem_object *obj);
 void i915_gem_free_object(struct drm_gem_object *obj);
 int i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment);
 void i915_gem_object_unpin(struct drm_gem_object *obj);
+int i915_gem_object_unbind(struct drm_gem_object *obj);
 void i915_gem_lastclose(struct drm_device *dev);
 uint32_t i915_get_gem_seqno(struct drm_device *dev);
 void i915_gem_retire_requests(struct drm_device *dev);
@@ -784,6 +787,11 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
                         IS_I945GM(dev) || IS_I965GM(dev) || IS_GM45(dev))
 
 #define I915_NEED_GFX_HWS(dev) (IS_G33(dev) || IS_GM45(dev) || IS_G4X(dev))
+/* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
+ * rows, which changed the alignment requirements and fence programming.
+ */
+#define HAS_128_BYTE_Y_TILING(dev) (IS_I9XX(dev) && !(IS_I915G(dev) || \
+                                                      IS_I915GM(dev)))
 #define SUPPORTS_INTEGRATED_HDMI(dev)   (IS_G4X(dev))
 
 #define PRIMARY_RINGBUFFER_SIZE         (128*1024)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index debad5c04cc0..818576654092 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -52,7 +52,7 @@ static void i915_gem_object_free_page_list(struct drm_gem_object *obj);
 static int i915_gem_object_wait_rendering(struct drm_gem_object *obj);
 static int i915_gem_object_bind_to_gtt(struct drm_gem_object *obj,
                                            unsigned alignment);
-static void i915_gem_object_get_fence_reg(struct drm_gem_object *obj);
+static int i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write);
 static void i915_gem_clear_fence_reg(struct drm_gem_object *obj);
 static int i915_gem_evict_something(struct drm_device *dev);
 static int i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
@@ -567,6 +567,7 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         pgoff_t page_offset;
         unsigned long pfn;
         int ret = 0;
+        bool write = !!(vmf->flags & FAULT_FLAG_WRITE);
 
         /* We don't use vmf->pgoff since that has the fake offset */
         page_offset = ((unsigned long)vmf->virtual_address - vma->vm_start) >>
@@ -585,8 +586,13 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 
         /* Need a new fence register? */
         if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
-            obj_priv->tiling_mode != I915_TILING_NONE)
-                i915_gem_object_get_fence_reg(obj);
+            obj_priv->tiling_mode != I915_TILING_NONE) {
+                ret = i915_gem_object_get_fence_reg(obj, write);
+                if (ret) {
+                        mutex_unlock(&dev->struct_mutex);
+                        return VM_FAULT_SIGBUS;
+                }
+        }
 
         pfn = ((dev->agp->base + obj_priv->gtt_offset) >> PAGE_SHIFT) +
                 page_offset;
@@ -1211,7 +1217,7 @@ i915_gem_object_wait_rendering(struct drm_gem_object *obj)
 /**
  * Unbinds an object from the GTT aperture.
  */
-static int
+int
 i915_gem_object_unbind(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
@@ -1445,21 +1451,26 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         int regnum = obj_priv->fence_reg;
+        int tile_width;
         uint32_t val;
         uint32_t pitch_val;
 
         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
             (obj_priv->gtt_offset & (obj->size - 1))) {
-                WARN(1, "%s: object not 1M or size aligned\n", __func__);
+                WARN(1, "%s: object 0x%08x not 1M or size (0x%zx) aligned\n",
+                     __func__, obj_priv->gtt_offset, obj->size);
                 return;
         }
 
-        if (obj_priv->tiling_mode == I915_TILING_Y && (IS_I945G(dev) ||
-                                                       IS_I945GM(dev) ||
-                                                       IS_G33(dev)))
-                pitch_val = (obj_priv->stride / 128) - 1;
+        if (obj_priv->tiling_mode == I915_TILING_Y &&
+            HAS_128_BYTE_Y_TILING(dev))
+                tile_width = 128;
         else
-                pitch_val = (obj_priv->stride / 512) - 1;
+                tile_width = 512;
+
+        /* Note: pitch better be a power of two tile widths */
+        pitch_val = obj_priv->stride / tile_width;
+        pitch_val = ffs(pitch_val) - 1;
 
         val = obj_priv->gtt_offset;
         if (obj_priv->tiling_mode == I915_TILING_Y)
@@ -1483,7 +1494,8 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
 
         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
             (obj_priv->gtt_offset & (obj->size - 1))) {
-                WARN(1, "%s: object not 1M or size aligned\n", __func__);
+                WARN(1, "%s: object 0x%08x not 1M or size aligned\n",
+                     __func__, obj_priv->gtt_offset);
                 return;
         }
 
@@ -1503,6 +1515,7 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
 /**
  * i915_gem_object_get_fence_reg - set up a fence reg for an object
  * @obj: object to map through a fence reg
+ * @write: object is about to be written
  *
  * When mapping objects through the GTT, userspace wants to be able to write
  * to them without having to worry about swizzling if the object is tiled.
@@ -1513,8 +1526,8 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
  * It then sets up the reg based on the object's properties: address, pitch
  * and tiling format.
  */
-static void
-i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
+static int
+i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write)
 {
         struct drm_device *dev = obj->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1527,12 +1540,18 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
                 WARN(1, "allocating a fence for non-tiled object?\n");
                 break;
         case I915_TILING_X:
-                WARN(obj_priv->stride & (512 - 1),
-                     "object is X tiled but has non-512B pitch\n");
+                if (!obj_priv->stride)
+                        return -EINVAL;
+                WARN((obj_priv->stride & (512 - 1)),
+                     "object 0x%08x is X tiled but has non-512B pitch\n",
+                     obj_priv->gtt_offset);
                 break;
         case I915_TILING_Y:
-                WARN(obj_priv->stride & (128 - 1),
-                     "object is Y tiled but has non-128B pitch\n");
+                if (!obj_priv->stride)
+                        return -EINVAL;
+                WARN((obj_priv->stride & (128 - 1)),
+                     "object 0x%08x is Y tiled but has non-128B pitch\n",
+                     obj_priv->gtt_offset);
                 break;
         }
 
@@ -1563,10 +1582,11 @@ try_again:
                  * objects to finish before trying again.
                  */
                 if (i == dev_priv->num_fence_regs) {
-                        ret = i915_gem_object_wait_rendering(reg->obj);
+                        ret = i915_gem_object_set_to_gtt_domain(reg->obj, 0);
                         if (ret) {
-                                WARN(ret, "wait_rendering failed: %d\n", ret);
-                                return;
+                                WARN(ret != -ERESTARTSYS,
+                                     "switch to GTT domain failed: %d\n", ret);
+                                return ret;
                         }
                         goto try_again;
                 }
@@ -1591,6 +1611,8 @@ try_again:
                 i915_write_fence_reg(reg);
         else
                 i830_write_fence_reg(reg);
+
+        return 0;
 }
 
 /**
@@ -1631,7 +1653,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
         if (dev_priv->mm.suspended)
                 return -EBUSY;
         if (alignment == 0)
-                alignment = PAGE_SIZE;
+                alignment = i915_gem_get_gtt_alignment(obj);
         if (alignment & (PAGE_SIZE - 1)) {
                 DRM_ERROR("Invalid object alignment requested %u\n", alignment);
                 return -EINVAL;
@@ -2652,6 +2674,14 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
                                 DRM_ERROR("Failure to bind: %d", ret);
                         return ret;
                 }
+                /*
+                 * Pre-965 chips need a fence register set up in order to
+                 * properly handle tiled surfaces.
+                 */
+                if (!IS_I965G(dev) &&
+                    obj_priv->fence_reg == I915_FENCE_REG_NONE &&
+                    obj_priv->tiling_mode != I915_TILING_NONE)
+                        i915_gem_object_get_fence_reg(obj, true);
         }
         obj_priv->pin_count++;
 
@@ -3229,10 +3259,6 @@ i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
                 dev_priv->mm.wedged = 0;
         }
 
-        dev_priv->mm.gtt_mapping = io_mapping_create_wc(dev->agp->base,
-                                                        dev->agp->agp_info.aper_size
-                                                        * 1024 * 1024);
-
         mutex_lock(&dev->struct_mutex);
         dev_priv->mm.suspended = 0;
 
@@ -3255,7 +3281,6 @@ int
 i915_gem_leavevt_ioctl(struct drm_device *dev, void *data,
                        struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
         int ret;
 
         if (drm_core_check_feature(dev, DRIVER_MODESET))
@@ -3264,7 +3289,6 @@ i915_gem_leavevt_ioctl(struct drm_device *dev, void *data,
         ret = i915_gem_idle(dev);
         drm_irq_uninstall(dev);
 
-        io_mapping_free(dev_priv->mm.gtt_mapping);
         return ret;
 }
 
@@ -3273,6 +3297,9 @@ i915_gem_lastclose(struct drm_device *dev)
 {
         int ret;
 
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                return;
+
         ret = i915_gem_idle(dev);
         if (ret)
                 DRM_ERROR("failed to idle hardware: %d\n", ret);
@@ -3294,7 +3321,7 @@ i915_gem_load(struct drm_device *dev)
         /* Old X drivers will take 0-2 for front, back, depth buffers */
         dev_priv->fence_reg_start = 3;
 
-        if (IS_I965G(dev))
+        if (IS_I965G(dev) || IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                 dev_priv->num_fence_regs = 16;
         else
                 dev_priv->num_fence_regs = 8;
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 241f39b7f460..fa1685cba840 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -173,6 +173,73 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
         dev_priv->mm.bit_6_swizzle_y = swizzle_y;
 }
 
+
+/**
+ * Returns the size of the fence for a tiled object of the given size.
+ */
+static int
+i915_get_fence_size(struct drm_device *dev, int size)
+{
+        int i;
+        int start;
+
+        if (IS_I965G(dev)) {
+                /* The 965 can have fences at any page boundary. */
+                return ALIGN(size, 4096);
+        } else {
+                /* Align the size to a power of two greater than the smallest
+                 * fence size.
+                 */
+                if (IS_I9XX(dev))
+                        start = 1024 * 1024;
+                else
+                        start = 512 * 1024;
+
+                for (i = start; i < size; i <<= 1)
+                        ;
+
+                return i;
+        }
+}
+
+/* Check pitch constriants for all chips & tiling formats */
+static bool
+i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
+{
+        int tile_width;
+
+        /* Linear is always fine */
+        if (tiling_mode == I915_TILING_NONE)
+                return true;
+
+        if (tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev))
+                tile_width = 128;
+        else
+                tile_width = 512;
+
+        /* 965+ just needs multiples of tile width */
+        if (IS_I965G(dev)) {
+                if (stride & (tile_width - 1))
+                        return false;
+                return true;
+        }
+
+        /* Pre-965 needs power of two tile widths */
+        if (stride < tile_width)
+                return false;
+
+        if (stride & (stride - 1))
+                return false;
+
+        /* We don't handle the aperture area covered by the fence being bigger
+         * than the object size.
+         */
+        if (i915_get_fence_size(dev, size) != size)
+                return false;
+
+        return true;
+}
+
 /**
  * Sets the tiling mode of an object, returning the required swizzling of
  * bit 6 of addresses in the object.
@@ -191,6 +258,11 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                 return -EINVAL;
         obj_priv = obj->driver_private;
 
+        if (!i915_tiling_ok(dev, args->stride, obj->size, args->tiling_mode)) {
+                drm_gem_object_unreference(obj);
+                return -EINVAL;
+        }
+
         mutex_lock(&dev->struct_mutex);
 
         if (args->tiling_mode == I915_TILING_NONE) {
@@ -207,7 +279,24 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                         args->swizzle_mode = I915_BIT_6_SWIZZLE_NONE;
                 }
         }
-        obj_priv->tiling_mode = args->tiling_mode;
+        if (args->tiling_mode != obj_priv->tiling_mode) {
+                int ret;
+
+                /* Unbind the object, as switching tiling means we're
+                 * switching the cache organization due to fencing, probably.
+                 */
+                ret = i915_gem_object_unbind(obj);
+                if (ret != 0) {
+                        WARN(ret != -ERESTARTSYS,
+                             "failed to unbind object for tiling switch");
+                        args->tiling_mode = obj_priv->tiling_mode;
+                        mutex_unlock(&dev->struct_mutex);
+                        drm_gem_object_unreference(obj);
+
+                        return ret;
+                }
+                obj_priv->tiling_mode = args->tiling_mode;
+        }
         obj_priv->stride = args->stride;
 
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 6290219de6c8..548ff2c66431 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -174,6 +174,19 @@ u32 i915_get_vblank_counter(struct drm_device *dev, int pipe)
         return count;
 }
 
+u32 gm45_get_vblank_counter(struct drm_device *dev, int pipe)
+{
+        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        int reg = pipe ? PIPEB_FRMCOUNT_GM45 : PIPEA_FRMCOUNT_GM45;
+
+        if (!i915_pipe_enabled(dev, pipe)) {
+                DRM_ERROR("trying to get vblank count for disabled pipe %d\n", pipe);
+                return 0;
+        }
+
+        return I915_READ(reg);
+}
+
 irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 {
         struct drm_device *dev = (struct drm_device *) arg;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 273162579e1b..9d6539a868b3 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -186,12 +186,12 @@
 #define FENCE_REG_830_0                 0x2000
 #define   I830_FENCE_START_MASK         0x07f80000
 #define   I830_FENCE_TILING_Y_SHIFT     12
-#define   I830_FENCE_SIZE_BITS(size)    ((get_order(size >> 19) - 1) << 8)
+#define   I830_FENCE_SIZE_BITS(size)    ((ffs((size) >> 19) - 1) << 8)
 #define   I830_FENCE_PITCH_SHIFT        4
 #define   I830_FENCE_REG_VALID          (1<<0)
 
 #define   I915_FENCE_START_MASK         0x0ff00000
-#define   I915_FENCE_SIZE_BITS(size)    ((get_order(size >> 20) - 1) << 8)
+#define   I915_FENCE_SIZE_BITS(size)    ((ffs((size) >> 20) - 1) << 8)
 
 #define FENCE_REG_965_0                 0x03000
 #define   I965_FENCE_PITCH_SHIFT        2
@@ -1371,6 +1371,9 @@
 #define   PIPE_FRAME_LOW_SHIFT    24
 #define   PIPE_PIXEL_MASK         0x00ffffff
 #define   PIPE_PIXEL_SHIFT        0
+/* GM45+ just has to be different */
+#define PIPEA_FRMCOUNT_GM45     0x70040
+#define PIPEA_FLIPCOUNT_GM45    0x70044
 
 /* Cursor A & B regs */
 #define CURACNTR                0x70080
@@ -1439,6 +1442,9 @@
 #define PIPEBSTAT               0x71024
 #define PIPEBFRAMEHIGH          0x71040
 #define PIPEBFRAMEPIXEL         0x71044
+#define PIPEB_FRMCOUNT_GM45     0x71040
+#define PIPEB_FLIPCOUNT_GM45    0x71044
+
 
 /* Display B control */
 #define DSPBCNTR                0x71180
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 31c3732b7a69..bbdd72909a11 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -755,6 +755,8 @@ static void intel_crtc_mode_set(struct drm_crtc *crtc,
                 case INTEL_OUTPUT_SDVO:
                 case INTEL_OUTPUT_HDMI:
                         is_sdvo = true;
+                        if (intel_output->needs_tv_clock)
+                                is_tv = true;
                         break;
                 case INTEL_OUTPUT_DVO:
                         is_dvo = true;
@@ -1452,6 +1454,7 @@ static int intel_connector_clones(struct drm_device *dev, int type_mask)
 
 static void intel_setup_outputs(struct drm_device *dev)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_connector *connector;
 
         intel_crt_init(dev);
@@ -1463,13 +1466,16 @@ static void intel_setup_outputs(struct drm_device *dev)
         if (IS_I9XX(dev)) {
                 int found;
 
-                found = intel_sdvo_init(dev, SDVOB);
-                if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
-                        intel_hdmi_init(dev, SDVOB);
-
-                found = intel_sdvo_init(dev, SDVOC);
-                if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
-                        intel_hdmi_init(dev, SDVOC);
+                if (I915_READ(SDVOB) & SDVO_DETECTED) {
+                        found = intel_sdvo_init(dev, SDVOB);
+                        if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
+                                intel_hdmi_init(dev, SDVOB);
+                }
+                if (!IS_G4X(dev) || (I915_READ(SDVOB) & SDVO_DETECTED)) {
+                        found = intel_sdvo_init(dev, SDVOC);
+                        if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
+                                intel_hdmi_init(dev, SDVOC);
+                }
         } else
                 intel_dvo_init(dev);
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 8a4cc50c5b4e..957daef8edff 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -82,6 +82,7 @@ struct intel_output {
         struct intel_i2c_chan *i2c_bus; /* for control functions */
         struct intel_i2c_chan *ddc_bus; /* for DDC only stuff */
         bool load_detect_temp;
+        bool needs_tv_clock;
         void *dev_priv;
 };
 
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index b36a5214d8df..6d4f91265354 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -27,6 +27,7 @@
  *      Jesse Barnes <jesse.barnes@intel.com>
  */
 
+#include <linux/dmi.h>
 #include <linux/i2c.h>
 #include "drmP.h"
 #include "drm.h"
@@ -311,10 +312,8 @@ static int intel_lvds_get_modes(struct drm_connector *connector)
         if (dev_priv->panel_fixed_mode != NULL) {
                 struct drm_display_mode *mode;
 
-                mutex_lock(&dev->mode_config.mutex);
                 mode = drm_mode_duplicate(dev, dev_priv->panel_fixed_mode);
                 drm_mode_probed_add(connector, mode);
-                mutex_unlock(&dev->mode_config.mutex);
 
                 return 1;
         }
@@ -405,6 +404,16 @@ void intel_lvds_init(struct drm_device *dev)
         u32 lvds;
         int pipe;
 
+        /* Blacklist machines that we know falsely report LVDS. */
+        /* FIXME: add a check for the Aopen Mini PC */
+
+        /* Apple Mac Mini Core Duo and Mac Mini Core 2 Duo */
+        if(dmi_match(DMI_PRODUCT_NAME, "Macmini1,1") ||
+           dmi_match(DMI_PRODUCT_NAME, "Macmini2,1")) {
+                DRM_DEBUG("Skipping LVDS initialization for Apple Mac Mini\n");
+                return;
+        }
+
         intel_output = kzalloc(sizeof(struct intel_output), GFP_KERNEL);
         if (!intel_output) {
                 return;
@@ -458,7 +467,7 @@ void intel_lvds_init(struct drm_device *dev)
                         dev_priv->panel_fixed_mode =
                                 drm_mode_duplicate(dev, scan);
                         mutex_unlock(&dev->mode_config.mutex);
-                        goto out; /* FIXME: check for quirks */
+                        goto out;
                 }
                 mutex_unlock(&dev->mode_config.mutex);
         }
@@ -492,7 +501,7 @@ void intel_lvds_init(struct drm_device *dev)
                 if (dev_priv->panel_fixed_mode) {
                         dev_priv->panel_fixed_mode->type |=
                                 DRM_MODE_TYPE_PREFERRED;
-                        goto out; /* FIXME: check for quirks */
+                        goto out;
                 }
         }
 
@@ -500,38 +509,6 @@ void intel_lvds_init(struct drm_device *dev)
         if (!dev_priv->panel_fixed_mode)
                 goto failed;
 
-        /* FIXME: detect aopen & mac mini type stuff automatically? */
-        /*
-         * Blacklist machines with BIOSes that list an LVDS panel without
-         * actually having one.
-         */
-        if (IS_I945GM(dev)) {
-                /* aopen mini pc */
-                if (dev->pdev->subsystem_vendor == 0xa0a0)
-                        goto failed;
-
-                if ((dev->pdev->subsystem_vendor == 0x8086) &&
-                    (dev->pdev->subsystem_device == 0x7270)) {
-                        /* It's a Mac Mini or Macbook Pro.
-                         *
-                         * Apple hardware is out to get us.  The macbook pro
-                         * has a real LVDS panel, but the mac mini does not,
-                         * and they have the same device IDs.  We'll
-                         * distinguish by panel size, on the assumption
-                         * that Apple isn't about to make any machines with an
-                         * 800x600 display.
-                         */
-
-                        if (dev_priv->panel_fixed_mode != NULL &&
-                            dev_priv->panel_fixed_mode->hdisplay == 800 &&
-                            dev_priv->panel_fixed_mode->vdisplay == 600) {
-                                DRM_DEBUG("Suspected Mac Mini, ignoring the LVDS\n");
-                                goto failed;
-                        }
-                }
-        }
-
-
 out:
         drm_sysfs_connector_add(connector);
         return;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 407215469102..a30508b639ba 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -40,13 +40,59 @@
 struct intel_sdvo_priv {
         struct intel_i2c_chan *i2c_bus;
         int slaveaddr;
+
+        /* Register for the SDVO device: SDVOB or SDVOC */
         int output_device;
 
-        u16 active_outputs;
+        /* Active outputs controlled by this SDVO output */
+        uint16_t controlled_output;
 
+        /*
+         * Capabilities of the SDVO device returned by
+         * i830_sdvo_get_capabilities()
+         */
         struct intel_sdvo_caps caps;
+
+        /* Pixel clock limitations reported by the SDVO device, in kHz */
         int pixel_clock_min, pixel_clock_max;
 
+        /**
+         * This is set if we're going to treat the device as TV-out.
+         *
+         * While we have these nice friendly flags for output types that ought
+         * to decide this for us, the S-Video output on our HDMI+S-Video card
+         * shows up as RGB1 (VGA).
+         */
+        bool is_tv;
+
+        /**
+         * This is set if we treat the device as HDMI, instead of DVI.
+         */
+        bool is_hdmi;
+
+        /**
+         * Returned SDTV resolutions allowed for the current format, if the
+         * device reported it.
+         */
+        struct intel_sdvo_sdtv_resolution_reply sdtv_resolutions;
+
+        /**
+         * Current selected TV format.
+         *
+         * This is stored in the same structure that's passed to the device, for
+         * convenience.
+         */
+        struct intel_sdvo_tv_format tv_format;
+
+        /*
+         * supported encoding mode, used to determine whether HDMI is
+         * supported
+         */
+        struct intel_sdvo_encode encode;
+
+        /* DDC bus used by this SDVO output */
+        uint8_t ddc_bus;
+
         int save_sdvo_mult;
         u16 save_active_outputs;
         struct intel_sdvo_dtd save_input_dtd_1, save_input_dtd_2;
@@ -148,8 +194,8 @@ static bool intel_sdvo_write_byte(struct intel_output *intel_output, int addr,
 #define SDVO_CMD_NAME_ENTRY(cmd) {cmd, #cmd}
 /** Mapping of command numbers to names, for debug output */
 const static struct _sdvo_cmd_name {
-    u8 cmd;
-    char *name;
+        u8 cmd;
+        char *name;
 } sdvo_cmd_names[] = {
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_RESET),
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_DEVICE_CAPS),
@@ -186,8 +232,35 @@ const static struct _sdvo_cmd_name {
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SUPPORTED_TV_FORMATS),
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_TV_FORMAT),
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_TV_FORMAT),
-    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_TV_RESOLUTION_SUPPORT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SUPPORTED_POWER_STATES),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_POWER_STATE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_ENCODER_POWER_STATE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_DISPLAY_POWER_STATE),
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_CONTROL_BUS_SWITCH),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SDTV_RESOLUTION_SUPPORT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SCALED_HDTV_RESOLUTION_SUPPORT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS),
+    /* HDMI op code */
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SUPP_ENCODE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_ENCODE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_ENCODE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_PIXEL_REPLI),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_PIXEL_REPLI),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_COLORIMETRY_CAP),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_COLORIMETRY),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_COLORIMETRY),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_AUDIO_ENCRYPT_PREFER),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_AUDIO_STAT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_AUDIO_STAT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_INDEX),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_HBUF_INDEX),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_INFO),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_AV_SPLIT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_HBUF_AV_SPLIT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_TXRATE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_HBUF_TXRATE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_HBUF_DATA),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_DATA),
 };
 
 #define SDVO_NAME(dev_priv) ((dev_priv)->output_device == SDVOB ? "SDVOB" : "SDVOC")
@@ -506,6 +579,50 @@ static bool intel_sdvo_set_output_timing(struct intel_output *intel_output,
                                      SDVO_CMD_SET_OUTPUT_TIMINGS_PART1, dtd);
 }
 
+static bool
+intel_sdvo_create_preferred_input_timing(struct intel_output *output,
+                                         uint16_t clock,
+                                         uint16_t width,
+                                         uint16_t height)
+{
+        struct intel_sdvo_preferred_input_timing_args args;
+        uint8_t status;
+
+        args.clock = clock;
+        args.width = width;
+        args.height = height;
+        intel_sdvo_write_cmd(output, SDVO_CMD_CREATE_PREFERRED_INPUT_TIMING,
+                             &args, sizeof(args));
+        status = intel_sdvo_read_response(output, NULL, 0);
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return false;
+
+        return true;
+}
+
+static bool intel_sdvo_get_preferred_input_timing(struct intel_output *output,
+                                                  struct intel_sdvo_dtd *dtd)
+{
+        bool status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_PREFERRED_INPUT_TIMING_PART1,
+                             NULL, 0);
+
+        status = intel_sdvo_read_response(output, &dtd->part1,
+                                          sizeof(dtd->part1));
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return false;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_PREFERRED_INPUT_TIMING_PART2,
+                             NULL, 0);
+
+        status = intel_sdvo_read_response(output, &dtd->part2,
+                                          sizeof(dtd->part2));
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return false;
+
+        return false;
+}
 
 static int intel_sdvo_get_clock_rate_mult(struct intel_output *intel_output)
 {
@@ -536,36 +653,12 @@ static bool intel_sdvo_set_clock_rate_mult(struct intel_output *intel_output, u8
         return true;
 }
 
-static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
-                                  struct drm_display_mode *mode,
-                                  struct drm_display_mode *adjusted_mode)
-{
-        /* Make the CRTC code factor in the SDVO pixel multiplier.  The SDVO
-         * device will be told of the multiplier during mode_set.
-         */
-        adjusted_mode->clock *= intel_sdvo_get_pixel_multiplier(mode);
-        return true;
-}
-
-static void intel_sdvo_mode_set(struct drm_encoder *encoder,
-                                struct drm_display_mode *mode,
-                                struct drm_display_mode *adjusted_mode)
+static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
+                                         struct drm_display_mode *mode)
 {
-        struct drm_device *dev = encoder->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_crtc *crtc = encoder->crtc;
-        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
-        u16 width, height;
-        u16 h_blank_len, h_sync_len, v_blank_len, v_sync_len;
-        u16 h_sync_offset, v_sync_offset;
-        u32 sdvox;
-        struct intel_sdvo_dtd output_dtd;
-        int sdvo_pixel_multiply;
-
-        if (!mode)
-                return;
+        uint16_t width, height;
+        uint16_t h_blank_len, h_sync_len, v_blank_len, v_sync_len;
+        uint16_t h_sync_offset, v_sync_offset;
 
         width = mode->crtc_hdisplay;
         height = mode->crtc_vdisplay;
@@ -580,93 +673,423 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
         h_sync_offset = mode->crtc_hsync_start - mode->crtc_hblank_start;
         v_sync_offset = mode->crtc_vsync_start - mode->crtc_vblank_start;
 
-        output_dtd.part1.clock = mode->clock / 10;
-        output_dtd.part1.h_active = width & 0xff;
-        output_dtd.part1.h_blank = h_blank_len & 0xff;
-        output_dtd.part1.h_high = (((width >> 8) & 0xf) << 4) |
+        dtd->part1.clock = mode->clock / 10;
+        dtd->part1.h_active = width & 0xff;
+        dtd->part1.h_blank = h_blank_len & 0xff;
+        dtd->part1.h_high = (((width >> 8) & 0xf) << 4) |
                 ((h_blank_len >> 8) & 0xf);
-        output_dtd.part1.v_active = height & 0xff;
-        output_dtd.part1.v_blank = v_blank_len & 0xff;
-        output_dtd.part1.v_high = (((height >> 8) & 0xf) << 4) |
+        dtd->part1.v_active = height & 0xff;
+        dtd->part1.v_blank = v_blank_len & 0xff;
+        dtd->part1.v_high = (((height >> 8) & 0xf) << 4) |
                 ((v_blank_len >> 8) & 0xf);
 
-        output_dtd.part2.h_sync_off = h_sync_offset;
-        output_dtd.part2.h_sync_width = h_sync_len & 0xff;
-        output_dtd.part2.v_sync_off_width = (v_sync_offset & 0xf) << 4 |
+        dtd->part2.h_sync_off = h_sync_offset;
+        dtd->part2.h_sync_width = h_sync_len & 0xff;
+        dtd->part2.v_sync_off_width = (v_sync_offset & 0xf) << 4 |
                 (v_sync_len & 0xf);
-        output_dtd.part2.sync_off_width_high = ((h_sync_offset & 0x300) >> 2) |
+        dtd->part2.sync_off_width_high = ((h_sync_offset & 0x300) >> 2) |
                 ((h_sync_len & 0x300) >> 4) | ((v_sync_offset & 0x30) >> 2) |
                 ((v_sync_len & 0x30) >> 4);
 
-        output_dtd.part2.dtd_flags = 0x18;
+        dtd->part2.dtd_flags = 0x18;
         if (mode->flags & DRM_MODE_FLAG_PHSYNC)
-                output_dtd.part2.dtd_flags |= 0x2;
+                dtd->part2.dtd_flags |= 0x2;
         if (mode->flags & DRM_MODE_FLAG_PVSYNC)
-                output_dtd.part2.dtd_flags |= 0x4;
+                dtd->part2.dtd_flags |= 0x4;
+
+        dtd->part2.sdvo_flags = 0;
+        dtd->part2.v_sync_off_high = v_sync_offset & 0xc0;
+        dtd->part2.reserved = 0;
+}
+
+static void intel_sdvo_get_mode_from_dtd(struct drm_display_mode * mode,
+                                         struct intel_sdvo_dtd *dtd)
+{
+        uint16_t width, height;
+        uint16_t h_blank_len, h_sync_len, v_blank_len, v_sync_len;
+        uint16_t h_sync_offset, v_sync_offset;
+
+        width = mode->crtc_hdisplay;
+        height = mode->crtc_vdisplay;
+
+        /* do some mode translations */
+        h_blank_len = mode->crtc_hblank_end - mode->crtc_hblank_start;
+        h_sync_len = mode->crtc_hsync_end - mode->crtc_hsync_start;
+
+        v_blank_len = mode->crtc_vblank_end - mode->crtc_vblank_start;
+        v_sync_len = mode->crtc_vsync_end - mode->crtc_vsync_start;
+
+        h_sync_offset = mode->crtc_hsync_start - mode->crtc_hblank_start;
+        v_sync_offset = mode->crtc_vsync_start - mode->crtc_vblank_start;
+
+        mode->hdisplay = dtd->part1.h_active;
+        mode->hdisplay += ((dtd->part1.h_high >> 4) & 0x0f) << 8;
+        mode->hsync_start = mode->hdisplay + dtd->part2.h_sync_off;
+        mode->hsync_start += (dtd->part2.sync_off_width_high & 0xa0) << 2;
+        mode->hsync_end = mode->hsync_start + dtd->part2.h_sync_width;
+        mode->hsync_end += (dtd->part2.sync_off_width_high & 0x30) << 4;
+        mode->htotal = mode->hdisplay + dtd->part1.h_blank;
+        mode->htotal += (dtd->part1.h_high & 0xf) << 8;
+
+        mode->vdisplay = dtd->part1.v_active;
+        mode->vdisplay += ((dtd->part1.v_high >> 4) & 0x0f) << 8;
+        mode->vsync_start = mode->vdisplay;
+        mode->vsync_start += (dtd->part2.v_sync_off_width >> 4) & 0xf;
+        mode->vsync_start += (dtd->part2.sync_off_width_high & 0x0a) << 2;
+        mode->vsync_start += dtd->part2.v_sync_off_high & 0xc0;
+        mode->vsync_end = mode->vsync_start +
+                (dtd->part2.v_sync_off_width & 0xf);
+        mode->vsync_end += (dtd->part2.sync_off_width_high & 0x3) << 4;
+        mode->vtotal = mode->vdisplay + dtd->part1.v_blank;
+        mode->vtotal += (dtd->part1.v_high & 0xf) << 8;
+
+        mode->clock = dtd->part1.clock * 10;
+
+        mode->flags &= (DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC);
+        if (dtd->part2.dtd_flags & 0x2)
+                mode->flags |= DRM_MODE_FLAG_PHSYNC;
+        if (dtd->part2.dtd_flags & 0x4)
+                mode->flags |= DRM_MODE_FLAG_PVSYNC;
+}
+
+static bool intel_sdvo_get_supp_encode(struct intel_output *output,
+                                       struct intel_sdvo_encode *encode)
+{
+        uint8_t status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_SUPP_ENCODE, NULL, 0);
+        status = intel_sdvo_read_response(output, encode, sizeof(*encode));
+        if (status != SDVO_CMD_STATUS_SUCCESS) { /* non-support means DVI */
+                memset(encode, 0, sizeof(*encode));
+                return false;
+        }
+
+        return true;
+}
+
+static bool intel_sdvo_set_encode(struct intel_output *output, uint8_t mode)
+{
+        uint8_t status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_SET_ENCODE, &mode, 1);
+        status = intel_sdvo_read_response(output, NULL, 0);
+
+        return (status == SDVO_CMD_STATUS_SUCCESS);
+}
+
+static bool intel_sdvo_set_colorimetry(struct intel_output *output,
+                                       uint8_t mode)
+{
+        uint8_t status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_SET_COLORIMETRY, &mode, 1);
+        status = intel_sdvo_read_response(output, NULL, 0);
+
+        return (status == SDVO_CMD_STATUS_SUCCESS);
+}
+
+#if 0
+static void intel_sdvo_dump_hdmi_buf(struct intel_output *output)
+{
+        int i, j;
+        uint8_t set_buf_index[2];
+        uint8_t av_split;
+        uint8_t buf_size;
+        uint8_t buf[48];
+        uint8_t *pos;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_HBUF_AV_SPLIT, NULL, 0);
+        intel_sdvo_read_response(output, &av_split, 1);
+
+        for (i = 0; i <= av_split; i++) {
+                set_buf_index[0] = i; set_buf_index[1] = 0;
+                intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_INDEX,
+                                     set_buf_index, 2);
+                intel_sdvo_write_cmd(output, SDVO_CMD_GET_HBUF_INFO, NULL, 0);
+                intel_sdvo_read_response(output, &buf_size, 1);
+
+                pos = buf;
+                for (j = 0; j <= buf_size; j += 8) {
+                        intel_sdvo_write_cmd(output, SDVO_CMD_GET_HBUF_DATA,
+                                             NULL, 0);
+                        intel_sdvo_read_response(output, pos, 8);
+                        pos += 8;
+                }
+        }
+}
+#endif
+
+static void intel_sdvo_set_hdmi_buf(struct intel_output *output, int index,
+                                uint8_t *data, int8_t size, uint8_t tx_rate)
+{
+    uint8_t set_buf_index[2];
+
+    set_buf_index[0] = index;
+    set_buf_index[1] = 0;
+
+    intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_INDEX, set_buf_index, 2);
+
+    for (; size > 0; size -= 8) {
+        intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_DATA, data, 8);
+        data += 8;
+    }
+
+    intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_TXRATE, &tx_rate, 1);
+}
+
+static uint8_t intel_sdvo_calc_hbuf_csum(uint8_t *data, uint8_t size)
+{
+        uint8_t csum = 0;
+        int i;
+
+        for (i = 0; i < size; i++)
+                csum += data[i];
+
+        return 0x100 - csum;
+}
+
+#define DIP_TYPE_AVI    0x82
+#define DIP_VERSION_AVI 0x2
+#define DIP_LEN_AVI     13
+
+struct dip_infoframe {
+        uint8_t type;
+        uint8_t version;
+        uint8_t len;
+        uint8_t checksum;
+        union {
+                struct {
+                        /* Packet Byte #1 */
+                        uint8_t S:2;
+                        uint8_t B:2;
+                        uint8_t A:1;
+                        uint8_t Y:2;
+                        uint8_t rsvd1:1;
+                        /* Packet Byte #2 */
+                        uint8_t R:4;
+                        uint8_t M:2;
+                        uint8_t C:2;
+                        /* Packet Byte #3 */
+                        uint8_t SC:2;
+                        uint8_t Q:2;
+                        uint8_t EC:3;
+                        uint8_t ITC:1;
+                        /* Packet Byte #4 */
+                        uint8_t VIC:7;
+                        uint8_t rsvd2:1;
+                        /* Packet Byte #5 */
+                        uint8_t PR:4;
+                        uint8_t rsvd3:4;
+                        /* Packet Byte #6~13 */
+                        uint16_t top_bar_end;
+                        uint16_t bottom_bar_start;
+                        uint16_t left_bar_end;
+                        uint16_t right_bar_start;
+                } avi;
+                struct {
+                        /* Packet Byte #1 */
+                        uint8_t channel_count:3;
+                        uint8_t rsvd1:1;
+                        uint8_t coding_type:4;
+                        /* Packet Byte #2 */
+                        uint8_t sample_size:2; /* SS0, SS1 */
+                        uint8_t sample_frequency:3;
+                        uint8_t rsvd2:3;
+                        /* Packet Byte #3 */
+                        uint8_t coding_type_private:5;
+                        uint8_t rsvd3:3;
+                        /* Packet Byte #4 */
+                        uint8_t channel_allocation;
+                        /* Packet Byte #5 */
+                        uint8_t rsvd4:3;
+                        uint8_t level_shift:4;
+                        uint8_t downmix_inhibit:1;
+                } audio;
+                uint8_t payload[28];
+        } __attribute__ ((packed)) u;
+} __attribute__((packed));
+
+static void intel_sdvo_set_avi_infoframe(struct intel_output *output,
+                                         struct drm_display_mode * mode)
+{
+        struct dip_infoframe avi_if = {
+                .type = DIP_TYPE_AVI,
+                .version = DIP_VERSION_AVI,
+                .len = DIP_LEN_AVI,
+        };
+
+        avi_if.checksum = intel_sdvo_calc_hbuf_csum((uint8_t *)&avi_if,
+                                                    4 + avi_if.len);
+        intel_sdvo_set_hdmi_buf(output, 1, (uint8_t *)&avi_if, 4 + avi_if.len,
+                                SDVO_HBUF_TX_VSYNC);
+}
+
+static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
+                                  struct drm_display_mode *mode,
+                                  struct drm_display_mode *adjusted_mode)
+{
+        struct intel_output *output = enc_to_intel_output(encoder);
+        struct intel_sdvo_priv *dev_priv = output->dev_priv;
 
-        output_dtd.part2.sdvo_flags = 0;
-        output_dtd.part2.v_sync_off_high = v_sync_offset & 0xc0;
-        output_dtd.part2.reserved = 0;
+        if (!dev_priv->is_tv) {
+                /* Make the CRTC code factor in the SDVO pixel multiplier.  The
+                 * SDVO device will be told of the multiplier during mode_set.
+                 */
+                adjusted_mode->clock *= intel_sdvo_get_pixel_multiplier(mode);
+        } else {
+                struct intel_sdvo_dtd output_dtd;
+                bool success;
+
+                /* We need to construct preferred input timings based on our
+                 * output timings.  To do that, we have to set the output
+                 * timings, even though this isn't really the right place in
+                 * the sequence to do it. Oh well.
+                 */
+
+
+                /* Set output timings */
+                intel_sdvo_get_dtd_from_mode(&output_dtd, mode);
+                intel_sdvo_set_target_output(output,
+                                             dev_priv->controlled_output);
+                intel_sdvo_set_output_timing(output, &output_dtd);
+
+                /* Set the input timing to the screen. Assume always input 0. */
+                intel_sdvo_set_target_input(output, true, false);
+
+
+                success = intel_sdvo_create_preferred_input_timing(output,
+                                                                   mode->clock / 10,
+                                                                   mode->hdisplay,
+                                                                   mode->vdisplay);
+                if (success) {
+                        struct intel_sdvo_dtd input_dtd;
 
-        /* Set the output timing to the screen */
-        intel_sdvo_set_target_output(intel_output, sdvo_priv->active_outputs);
-        intel_sdvo_set_output_timing(intel_output, &output_dtd);
+                        intel_sdvo_get_preferred_input_timing(output,
+                                                             &input_dtd);
+                        intel_sdvo_get_mode_from_dtd(adjusted_mode, &input_dtd);
+
+                } else {
+                        return false;
+                }
+        }
+        return true;
+}
+
+static void intel_sdvo_mode_set(struct drm_encoder *encoder,
+                                struct drm_display_mode *mode,
+                                struct drm_display_mode *adjusted_mode)
+{
+        struct drm_device *dev = encoder->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_crtc *crtc = encoder->crtc;
+        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+        struct intel_output *output = enc_to_intel_output(encoder);
+        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
+        u32 sdvox = 0;
+        int sdvo_pixel_multiply;
+        struct intel_sdvo_in_out_map in_out;
+        struct intel_sdvo_dtd input_dtd;
+        u8 status;
+
+        if (!mode)
+                return;
+
+        /* First, set the input mapping for the first input to our controlled
+         * output. This is only correct if we're a single-input device, in
+         * which case the first input is the output from the appropriate SDVO
+         * channel on the motherboard.  In a two-input device, the first input
+         * will be SDVOB and the second SDVOC.
+         */
+        in_out.in0 = sdvo_priv->controlled_output;
+        in_out.in1 = 0;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_SET_IN_OUT_MAP,
+                             &in_out, sizeof(in_out));
+        status = intel_sdvo_read_response(output, NULL, 0);
+
+        if (sdvo_priv->is_hdmi) {
+                intel_sdvo_set_avi_infoframe(output, mode);
+                sdvox |= SDVO_AUDIO_ENABLE;
+        }
+
+        intel_sdvo_get_dtd_from_mode(&input_dtd, mode);
+
+        /* If it's a TV, we already set the output timing in mode_fixup.
+         * Otherwise, the output timing is equal to the input timing.
+         */
+        if (!sdvo_priv->is_tv) {
+                /* Set the output timing to the screen */
+                intel_sdvo_set_target_output(output,
+                                             sdvo_priv->controlled_output);
+                intel_sdvo_set_output_timing(output, &input_dtd);
+        }
 
         /* Set the input timing to the screen. Assume always input 0. */
-        intel_sdvo_set_target_input(intel_output, true, false);
+        intel_sdvo_set_target_input(output, true, false);
 
-        /* We would like to use i830_sdvo_create_preferred_input_timing() to
+        /* We would like to use intel_sdvo_create_preferred_input_timing() to
          * provide the device with a timing it can support, if it supports that
          * feature.  However, presumably we would need to adjust the CRTC to
          * output the preferred timing, and we don't support that currently.
          */
-        intel_sdvo_set_input_timing(intel_output, &output_dtd);
+#if 0
+        success = intel_sdvo_create_preferred_input_timing(output, clock,
+                                                           width, height);
+        if (success) {
+                struct intel_sdvo_dtd *input_dtd;
+
+                intel_sdvo_get_preferred_input_timing(output, &input_dtd);
+                intel_sdvo_set_input_timing(output, &input_dtd);
+        }
+#else
+        intel_sdvo_set_input_timing(output, &input_dtd);
+#endif
 
         switch (intel_sdvo_get_pixel_multiplier(mode)) {
         case 1:
-                intel_sdvo_set_clock_rate_mult(intel_output,
+                intel_sdvo_set_clock_rate_mult(output,
                                                SDVO_CLOCK_RATE_MULT_1X);
                 break;
         case 2:
-                intel_sdvo_set_clock_rate_mult(intel_output,
+                intel_sdvo_set_clock_rate_mult(output,
                                                SDVO_CLOCK_RATE_MULT_2X);
                 break;
         case 4:
-                intel_sdvo_set_clock_rate_mult(intel_output,
+                intel_sdvo_set_clock_rate_mult(output,
                                                SDVO_CLOCK_RATE_MULT_4X);
                 break;
         }
 
         /* Set the SDVO control regs. */
-        if (0/*IS_I965GM(dev)*/) {
-                sdvox = SDVO_BORDER_ENABLE;
-        } else {
-                sdvox = I915_READ(sdvo_priv->output_device);
-                switch (sdvo_priv->output_device) {
-                case SDVOB:
-                        sdvox &= SDVOB_PRESERVE_MASK;
-                        break;
-                case SDVOC:
-                        sdvox &= SDVOC_PRESERVE_MASK;
-                        break;
-                }
-                sdvox |= (9 << 19) | SDVO_BORDER_ENABLE;
-        }
+        if (IS_I965G(dev)) {
+                sdvox |= SDVO_BORDER_ENABLE |
+                        SDVO_VSYNC_ACTIVE_HIGH |
+                        SDVO_HSYNC_ACTIVE_HIGH;
+        } else {
+                sdvox |= I915_READ(sdvo_priv->output_device);
+                switch (sdvo_priv->output_device) {
+                case SDVOB:
+                        sdvox &= SDVOB_PRESERVE_MASK;
+                        break;
+                case SDVOC:
+                        sdvox &= SDVOC_PRESERVE_MASK;
+                        break;
+                }
+                sdvox |= (9 << 19) | SDVO_BORDER_ENABLE;
+        }
         if (intel_crtc->pipe == 1)
                 sdvox |= SDVO_PIPE_B_SELECT;
 
         sdvo_pixel_multiply = intel_sdvo_get_pixel_multiplier(mode);
         if (IS_I965G(dev)) {
-                /* done in crtc_mode_set as the dpll_md reg must be written
-                   early */
-        } else if (IS_I945G(dev) || IS_I945GM(dev)) {
-                /* done in crtc_mode_set as it lives inside the
-                   dpll register */
+                /* done in crtc_mode_set as the dpll_md reg must be written early */
+        } else if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev)) {
+                /* done in crtc_mode_set as it lives inside the dpll register */
         } else {
                 sdvox |= (sdvo_pixel_multiply - 1) << SDVO_PORT_MULTIPLY_SHIFT;
         }
 
-        intel_sdvo_write_sdvox(intel_output, sdvox);
+        intel_sdvo_write_sdvox(output, sdvox);
 }
 
 static void intel_sdvo_dpms(struct drm_encoder *encoder, int mode)
@@ -714,7 +1137,7 @@ static void intel_sdvo_dpms(struct drm_encoder *encoder, int mode)
 
                 if (0)
                         intel_sdvo_set_encoder_power_state(intel_output, mode);
-                intel_sdvo_set_active_outputs(intel_output, sdvo_priv->active_outputs);
+                intel_sdvo_set_active_outputs(intel_output, sdvo_priv->controlled_output);
         }
         return;
 }
@@ -752,6 +1175,9 @@ static void intel_sdvo_save(struct drm_connector *connector)
                                                      &sdvo_priv->save_output_dtd[o]);
                 }
         }
+        if (sdvo_priv->is_tv) {
+                /* XXX: Save TV format/enhancements. */
+        }
 
         sdvo_priv->save_SDVOX = I915_READ(sdvo_priv->output_device);
 }
@@ -759,7 +1185,6 @@ static void intel_sdvo_save(struct drm_connector *connector)
 static void intel_sdvo_restore(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_output *intel_output = to_intel_output(connector);
         struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
         int o;
@@ -790,7 +1215,11 @@ static void intel_sdvo_restore(struct drm_connector *connector)
 
         intel_sdvo_set_clock_rate_mult(intel_output, sdvo_priv->save_sdvo_mult);
 
-        I915_WRITE(sdvo_priv->output_device, sdvo_priv->save_SDVOX);
+        if (sdvo_priv->is_tv) {
+                /* XXX: Restore TV format/enhancements. */
+        }
+
+        intel_sdvo_write_sdvox(intel_output, sdvo_priv->save_SDVOX);
 
         if (sdvo_priv->save_SDVOX & SDVO_ENABLE)
         {
@@ -916,20 +1345,173 @@ static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connect
         status = intel_sdvo_read_response(intel_output, &response, 2);
 
         DRM_DEBUG("SDVO response %d %d\n", response[0], response[1]);
+
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return connector_status_unknown;
+
         if ((response[0] != 0) || (response[1] != 0))
                 return connector_status_connected;
         else
                 return connector_status_disconnected;
 }
 
-static int intel_sdvo_get_modes(struct drm_connector *connector)
+static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
 {
         struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
 
         /* set the bus switch and get the modes */
-        intel_sdvo_set_control_bus_switch(intel_output, SDVO_CONTROL_BUS_DDC2);
+        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
         intel_ddc_get_modes(intel_output);
 
+#if 0
+        struct drm_device *dev = encoder->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        /* Mac mini hack.  On this device, I get DDC through the analog, which
+         * load-detects as disconnected.  I fail to DDC through the SDVO DDC,
+         * but it does load-detect as connected.  So, just steal the DDC bits
+         * from analog when we fail at finding it the right way.
+         */
+        crt = xf86_config->output[0];
+        intel_output = crt->driver_private;
+        if (intel_output->type == I830_OUTPUT_ANALOG &&
+            crt->funcs->detect(crt) == XF86OutputStatusDisconnected) {
+                I830I2CInit(pScrn, &intel_output->pDDCBus, GPIOA, "CRTDDC_A");
+                edid_mon = xf86OutputGetEDID(crt, intel_output->pDDCBus);
+                xf86DestroyI2CBusRec(intel_output->pDDCBus, true, true);
+        }
+        if (edid_mon) {
+                xf86OutputSetEDID(output, edid_mon);
+                modes = xf86OutputGetEDIDModes(output);
+        }
+#endif
+}
+
+/**
+ * This function checks the current TV format, and chooses a default if
+ * it hasn't been set.
+ */
+static void
+intel_sdvo_check_tv_format(struct intel_output *output)
+{
+        struct intel_sdvo_priv *dev_priv = output->dev_priv;
+        struct intel_sdvo_tv_format format, unset;
+        uint8_t status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_TV_FORMAT, NULL, 0);
+        status = intel_sdvo_read_response(output, &format, sizeof(format));
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return;
+
+        memset(&unset, 0, sizeof(unset));
+        if (memcmp(&format, &unset, sizeof(format))) {
+                DRM_DEBUG("%s: Choosing default TV format of NTSC-M\n",
+                          SDVO_NAME(dev_priv));
+
+                format.ntsc_m = true;
+                intel_sdvo_write_cmd(output, SDVO_CMD_SET_TV_FORMAT, NULL, 0);
+                status = intel_sdvo_read_response(output, NULL, 0);
+        }
+}
+
+/*
+ * Set of SDVO TV modes.
+ * Note!  This is in reply order (see loop in get_tv_modes).
+ * XXX: all 60Hz refresh?
+ */
+struct drm_display_mode sdvo_tv_modes[] = {
+        { DRM_MODE("320x200", DRM_MODE_TYPE_DRIVER, 5815680, 321, 384, 416,
+                   200, 0, 232, 201, 233, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("320x240", DRM_MODE_TYPE_DRIVER, 6814080, 321, 384, 416,
+                   240, 0, 272, 241, 273, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("400x300", DRM_MODE_TYPE_DRIVER, 9910080, 401, 464, 496,
+                   300, 0, 332, 301, 333, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("640x350", DRM_MODE_TYPE_DRIVER, 16913280, 641, 704, 736,
+                   350, 0, 382, 351, 383, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("640x400", DRM_MODE_TYPE_DRIVER, 19121280, 641, 704, 736,
+                   400, 0, 432, 401, 433, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("640x400", DRM_MODE_TYPE_DRIVER, 19121280, 641, 704, 736,
+                   400, 0, 432, 401, 433, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("704x480", DRM_MODE_TYPE_DRIVER, 24624000, 705, 768, 800,
+                   480, 0, 512, 481, 513, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("704x576", DRM_MODE_TYPE_DRIVER, 29232000, 705, 768, 800,
+                   576, 0, 608, 577, 609, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x350", DRM_MODE_TYPE_DRIVER, 18751680, 721, 784, 816,
+                   350, 0, 382, 351, 383, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x400", DRM_MODE_TYPE_DRIVER, 21199680, 721, 784, 816,
+                   400, 0, 432, 401, 433, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x480", DRM_MODE_TYPE_DRIVER, 25116480, 721, 784, 816,
+                   480, 0, 512, 481, 513, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x540", DRM_MODE_TYPE_DRIVER, 28054080, 721, 784, 816,
+                   540, 0, 572, 541, 573, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x576", DRM_MODE_TYPE_DRIVER, 29816640, 721, 784, 816,
+                   576, 0, 608, 577, 609, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("768x576", DRM_MODE_TYPE_DRIVER, 31570560, 769, 832, 864,
+                   576, 0, 608, 577, 609, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("800x600", DRM_MODE_TYPE_DRIVER, 34030080, 801, 864, 896,
+                   600, 0, 632, 601, 633, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("832x624", DRM_MODE_TYPE_DRIVER, 36581760, 833, 896, 928,
+                   624, 0, 656, 625, 657, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("920x766", DRM_MODE_TYPE_DRIVER, 48707040, 921, 984, 1016,
+                   766, 0, 798, 767, 799, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 53827200, 1025, 1088, 1120,
+                   768, 0, 800, 769, 801, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("1280x1024", DRM_MODE_TYPE_DRIVER, 87265920, 1281, 1344, 1376,
+                   1024, 0, 1056, 1025, 1057, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+};
+
+static void intel_sdvo_get_tv_modes(struct drm_connector *connector)
+{
+        struct intel_output *output = to_intel_output(connector);
+        uint32_t reply = 0;
+        uint8_t status;
+        int i = 0;
+
+        intel_sdvo_check_tv_format(output);
+
+        /* Read the list of supported input resolutions for the selected TV
+         * format.
+         */
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_SDTV_RESOLUTION_SUPPORT,
+                             NULL, 0);
+        status = intel_sdvo_read_response(output, &reply, 3);
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return;
+
+        for (i = 0; i < ARRAY_SIZE(sdvo_tv_modes); i++)
+                if (reply & (1 << i))
+                        drm_mode_probed_add(connector, &sdvo_tv_modes[i]);
+}
+
+static int intel_sdvo_get_modes(struct drm_connector *connector)
+{
+        struct intel_output *output = to_intel_output(connector);
+        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
+
+        if (sdvo_priv->is_tv)
+                intel_sdvo_get_tv_modes(connector);
+        else
+                intel_sdvo_get_ddc_modes(connector);
+
         if (list_empty(&connector->probed_modes))
                 return 0;
         return 1;
@@ -978,6 +1560,65 @@ static const struct drm_encoder_funcs intel_sdvo_enc_funcs = {
 };
 
 
+/**
+ * Choose the appropriate DDC bus for control bus switch command for this
+ * SDVO output based on the controlled output.
+ *
+ * DDC bus number assignment is in a priority order of RGB outputs, then TMDS
+ * outputs, then LVDS outputs.
+ */
+static void
+intel_sdvo_select_ddc_bus(struct intel_sdvo_priv *dev_priv)
+{
+        uint16_t mask = 0;
+        unsigned int num_bits;
+
+        /* Make a mask of outputs less than or equal to our own priority in the
+         * list.
+         */
+        switch (dev_priv->controlled_output) {
+        case SDVO_OUTPUT_LVDS1:
+                mask |= SDVO_OUTPUT_LVDS1;
+        case SDVO_OUTPUT_LVDS0:
+                mask |= SDVO_OUTPUT_LVDS0;
+        case SDVO_OUTPUT_TMDS1:
+                mask |= SDVO_OUTPUT_TMDS1;
+        case SDVO_OUTPUT_TMDS0:
+                mask |= SDVO_OUTPUT_TMDS0;
+        case SDVO_OUTPUT_RGB1:
+                mask |= SDVO_OUTPUT_RGB1;
+        case SDVO_OUTPUT_RGB0:
+                mask |= SDVO_OUTPUT_RGB0;
+                break;
+        }
+
+        /* Count bits to find what number we are in the priority list. */
+        mask &= dev_priv->caps.output_flags;
+        num_bits = hweight16(mask);
+        if (num_bits > 3) {
+                /* if more than 3 outputs, default to DDC bus 3 for now */
+                num_bits = 3;
+        }
+
+        /* Corresponds to SDVO_CONTROL_BUS_DDCx */
+        dev_priv->ddc_bus = 1 << num_bits;
+}
+
+static bool
+intel_sdvo_get_digital_encoding_mode(struct intel_output *output)
+{
+        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
+        uint8_t status;
+
+        intel_sdvo_set_target_output(output, sdvo_priv->controlled_output);
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_ENCODE, NULL, 0);
+        status = intel_sdvo_read_response(output, &sdvo_priv->is_hdmi, 1);
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return false;
+        return true;
+}
+
 bool intel_sdvo_init(struct drm_device *dev, int output_device)
 {
         struct drm_connector *connector;
@@ -1040,45 +1681,76 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
 
         intel_sdvo_get_capabilities(intel_output, &sdvo_priv->caps);
 
-        memset(&sdvo_priv->active_outputs, 0, sizeof(sdvo_priv->active_outputs));
+        if (sdvo_priv->caps.output_flags &
+            (SDVO_OUTPUT_TMDS0 | SDVO_OUTPUT_TMDS1)) {
+                if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_TMDS0)
+                        sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS0;
+                else
+                        sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS1;
+
+                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
+                encoder_type = DRM_MODE_ENCODER_TMDS;
+                connector_type = DRM_MODE_CONNECTOR_DVID;
 
-        /* TODO, CVBS, SVID, YPRPB & SCART outputs. */
-        if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB0)
+                if (intel_sdvo_get_supp_encode(intel_output,
+                                               &sdvo_priv->encode) &&
+                    intel_sdvo_get_digital_encoding_mode(intel_output) &&
+                    sdvo_priv->is_hdmi) {
+                        /* enable hdmi encoding mode if supported */
+                        intel_sdvo_set_encode(intel_output, SDVO_ENCODE_HDMI);
+                        intel_sdvo_set_colorimetry(intel_output,
+                                                   SDVO_COLORIMETRY_RGB256);
+                        connector_type = DRM_MODE_CONNECTOR_HDMIA;
+                }
+        }
+        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_SVID0)
         {
-                sdvo_priv->active_outputs = SDVO_OUTPUT_RGB0;
+                sdvo_priv->controlled_output = SDVO_OUTPUT_SVID0;
+                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
+                encoder_type = DRM_MODE_ENCODER_TVDAC;
+                connector_type = DRM_MODE_CONNECTOR_SVIDEO;
+                sdvo_priv->is_tv = true;
+                intel_output->needs_tv_clock = true;
+        }
+        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB0)
+        {
+                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB0;
                 connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_DAC;
                 connector_type = DRM_MODE_CONNECTOR_VGA;
         }
         else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB1)
         {
-                sdvo_priv->active_outputs = SDVO_OUTPUT_RGB1;
+                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB1;
                 connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_DAC;
                 connector_type = DRM_MODE_CONNECTOR_VGA;
         }
-        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_TMDS0)
+        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS0)
         {
-                sdvo_priv->active_outputs = SDVO_OUTPUT_TMDS0;
+                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
                 connector->display_info.subpixel_order = SubPixelHorizontalRGB;
-                encoder_type = DRM_MODE_ENCODER_TMDS;
-                connector_type = DRM_MODE_CONNECTOR_DVID;
+                encoder_type = DRM_MODE_ENCODER_LVDS;
+                connector_type = DRM_MODE_CONNECTOR_LVDS;
         }
-        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_TMDS1)
+        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS1)
         {
-                sdvo_priv->active_outputs = SDVO_OUTPUT_TMDS1;
+                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS1;
                 connector->display_info.subpixel_order = SubPixelHorizontalRGB;
-                encoder_type = DRM_MODE_ENCODER_TMDS;
-                connector_type = DRM_MODE_CONNECTOR_DVID;
+                encoder_type = DRM_MODE_ENCODER_LVDS;
+                connector_type = DRM_MODE_CONNECTOR_LVDS;
         }
         else
         {
                 unsigned char bytes[2];
 
+                sdvo_priv->controlled_output = 0;
                 memcpy (bytes, &sdvo_priv->caps.output_flags, 2);
-                DRM_DEBUG("%s: No active RGB or TMDS outputs (0x%02x%02x)\n",
+                DRM_DEBUG("%s: Unknown SDVO output type (0x%02x%02x)\n",
                           SDVO_NAME(sdvo_priv),
                           bytes[0], bytes[1]);
+                encoder_type = DRM_MODE_ENCODER_NONE;
+                connector_type = DRM_MODE_CONNECTOR_Unknown;
                 goto err_i2c;
         }
 
@@ -1089,6 +1761,8 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
         drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
         drm_sysfs_connector_add(connector);
 
+        intel_sdvo_select_ddc_bus(sdvo_priv);
+
         /* Set the input timing to the screen. Assume always input 0. */
         intel_sdvo_set_target_input(intel_output, true, false);
 
diff --git a/drivers/gpu/drm/i915/intel_sdvo_regs.h b/drivers/gpu/drm/i915/intel_sdvo_regs.h
index 861a43f8693c..1117b9c151a6 100644
--- a/drivers/gpu/drm/i915/intel_sdvo_regs.h
+++ b/drivers/gpu/drm/i915/intel_sdvo_regs.h
@@ -173,6 +173,9 @@ struct intel_sdvo_get_trained_inputs_response {
  * Returns two struct intel_sdvo_output_flags structures.
  */
 #define SDVO_CMD_GET_IN_OUT_MAP                         0x06
+struct intel_sdvo_in_out_map {
+    u16 in0, in1;
+};
 
 /**
  * Sets the current mapping of SDVO inputs to outputs on the device.
@@ -206,7 +209,8 @@ struct intel_sdvo_get_trained_inputs_response {
 struct intel_sdvo_get_interrupt_event_source_response {
     u16 interrupt_status;
     unsigned int ambient_light_interrupt:1;
-    unsigned int pad:7;
+    unsigned int hdmi_audio_encrypt_change:1;
+    unsigned int pad:6;
 } __attribute__((packed));
 
 /**
@@ -305,23 +309,411 @@ struct intel_sdvo_set_target_input_args {
 # define SDVO_CLOCK_RATE_MULT_4X                                (1 << 3)
 
 #define SDVO_CMD_GET_SUPPORTED_TV_FORMATS               0x27
+/** 5 bytes of bit flags for TV formats shared by all TV format functions */
+struct intel_sdvo_tv_format {
+    unsigned int ntsc_m:1;
+    unsigned int ntsc_j:1;
+    unsigned int ntsc_443:1;
+    unsigned int pal_b:1;
+    unsigned int pal_d:1;
+    unsigned int pal_g:1;
+    unsigned int pal_h:1;
+    unsigned int pal_i:1;
+
+    unsigned int pal_m:1;
+    unsigned int pal_n:1;
+    unsigned int pal_nc:1;
+    unsigned int pal_60:1;
+    unsigned int secam_b:1;
+    unsigned int secam_d:1;
+    unsigned int secam_g:1;
+    unsigned int secam_k:1;
+
+    unsigned int secam_k1:1;
+    unsigned int secam_l:1;
+    unsigned int secam_60:1;
+    unsigned int hdtv_std_smpte_240m_1080i_59:1;
+    unsigned int hdtv_std_smpte_240m_1080i_60:1;
+    unsigned int hdtv_std_smpte_260m_1080i_59:1;
+    unsigned int hdtv_std_smpte_260m_1080i_60:1;
+    unsigned int hdtv_std_smpte_274m_1080i_50:1;
+
+    unsigned int hdtv_std_smpte_274m_1080i_59:1;
+    unsigned int hdtv_std_smpte_274m_1080i_60:1;
+    unsigned int hdtv_std_smpte_274m_1080p_23:1;
+    unsigned int hdtv_std_smpte_274m_1080p_24:1;
+    unsigned int hdtv_std_smpte_274m_1080p_25:1;
+    unsigned int hdtv_std_smpte_274m_1080p_29:1;
+    unsigned int hdtv_std_smpte_274m_1080p_30:1;
+    unsigned int hdtv_std_smpte_274m_1080p_50:1;
+
+    unsigned int hdtv_std_smpte_274m_1080p_59:1;
+    unsigned int hdtv_std_smpte_274m_1080p_60:1;
+    unsigned int hdtv_std_smpte_295m_1080i_50:1;
+    unsigned int hdtv_std_smpte_295m_1080p_50:1;
+    unsigned int hdtv_std_smpte_296m_720p_59:1;
+    unsigned int hdtv_std_smpte_296m_720p_60:1;
+    unsigned int hdtv_std_smpte_296m_720p_50:1;
+    unsigned int hdtv_std_smpte_293m_480p_59:1;
+
+    unsigned int hdtv_std_smpte_170m_480i_59:1;
+    unsigned int hdtv_std_iturbt601_576i_50:1;
+    unsigned int hdtv_std_iturbt601_576p_50:1;
+    unsigned int hdtv_std_eia_7702a_480i_60:1;
+    unsigned int hdtv_std_eia_7702a_480p_60:1;
+    unsigned int pad:3;
+} __attribute__((packed));
 
 #define SDVO_CMD_GET_TV_FORMAT                          0x28
 
 #define SDVO_CMD_SET_TV_FORMAT                          0x29
 
+/** Returns the resolutiosn that can be used with the given TV format */
+#define SDVO_CMD_GET_SDTV_RESOLUTION_SUPPORT            0x83
+struct intel_sdvo_sdtv_resolution_request {
+    unsigned int ntsc_m:1;
+    unsigned int ntsc_j:1;
+    unsigned int ntsc_443:1;
+    unsigned int pal_b:1;
+    unsigned int pal_d:1;
+    unsigned int pal_g:1;
+    unsigned int pal_h:1;
+    unsigned int pal_i:1;
+
+    unsigned int pal_m:1;
+    unsigned int pal_n:1;
+    unsigned int pal_nc:1;
+    unsigned int pal_60:1;
+    unsigned int secam_b:1;
+    unsigned int secam_d:1;
+    unsigned int secam_g:1;
+    unsigned int secam_k:1;
+
+    unsigned int secam_k1:1;
+    unsigned int secam_l:1;
+    unsigned int secam_60:1;
+    unsigned int pad:5;
+} __attribute__((packed));
+
+struct intel_sdvo_sdtv_resolution_reply {
+    unsigned int res_320x200:1;
+    unsigned int res_320x240:1;
+    unsigned int res_400x300:1;
+    unsigned int res_640x350:1;
+    unsigned int res_640x400:1;
+    unsigned int res_640x480:1;
+    unsigned int res_704x480:1;
+    unsigned int res_704x576:1;
+
+    unsigned int res_720x350:1;
+    unsigned int res_720x400:1;
+    unsigned int res_720x480:1;
+    unsigned int res_720x540:1;
+    unsigned int res_720x576:1;
+    unsigned int res_768x576:1;
+    unsigned int res_800x600:1;
+    unsigned int res_832x624:1;
+
+    unsigned int res_920x766:1;
+    unsigned int res_1024x768:1;
+    unsigned int res_1280x1024:1;
+    unsigned int pad:5;
+} __attribute__((packed));
+
+/* Get supported resolution with squire pixel aspect ratio that can be
+   scaled for the requested HDTV format */
+#define SDVO_CMD_GET_SCALED_HDTV_RESOLUTION_SUPPORT             0x85
+
+struct intel_sdvo_hdtv_resolution_request {
+    unsigned int hdtv_std_smpte_240m_1080i_59:1;
+    unsigned int hdtv_std_smpte_240m_1080i_60:1;
+    unsigned int hdtv_std_smpte_260m_1080i_59:1;
+    unsigned int hdtv_std_smpte_260m_1080i_60:1;
+    unsigned int hdtv_std_smpte_274m_1080i_50:1;
+    unsigned int hdtv_std_smpte_274m_1080i_59:1;
+    unsigned int hdtv_std_smpte_274m_1080i_60:1;
+    unsigned int hdtv_std_smpte_274m_1080p_23:1;
+
+    unsigned int hdtv_std_smpte_274m_1080p_24:1;
+    unsigned int hdtv_std_smpte_274m_1080p_25:1;
+    unsigned int hdtv_std_smpte_274m_1080p_29:1;
+    unsigned int hdtv_std_smpte_274m_1080p_30:1;
+    unsigned int hdtv_std_smpte_274m_1080p_50:1;
+    unsigned int hdtv_std_smpte_274m_1080p_59:1;
+    unsigned int hdtv_std_smpte_274m_1080p_60:1;
+    unsigned int hdtv_std_smpte_295m_1080i_50:1;
+
+    unsigned int hdtv_std_smpte_295m_1080p_50:1;
+    unsigned int hdtv_std_smpte_296m_720p_59:1;
+    unsigned int hdtv_std_smpte_296m_720p_60:1;
+    unsigned int hdtv_std_smpte_296m_720p_50:1;
+    unsigned int hdtv_std_smpte_293m_480p_59:1;
+    unsigned int hdtv_std_smpte_170m_480i_59:1;
+    unsigned int hdtv_std_iturbt601_576i_50:1;
+    unsigned int hdtv_std_iturbt601_576p_50:1;
+
+    unsigned int hdtv_std_eia_7702a_480i_60:1;
+    unsigned int hdtv_std_eia_7702a_480p_60:1;
+    unsigned int pad:6;
+} __attribute__((packed));
+
+struct intel_sdvo_hdtv_resolution_reply {
+    unsigned int res_640x480:1;
+    unsigned int res_800x600:1;
+    unsigned int res_1024x768:1;
+    unsigned int res_1280x960:1;
+    unsigned int res_1400x1050:1;
+    unsigned int res_1600x1200:1;
+    unsigned int res_1920x1440:1;
+    unsigned int res_2048x1536:1;
+
+    unsigned int res_2560x1920:1;
+    unsigned int res_3200x2400:1;
+    unsigned int res_3840x2880:1;
+    unsigned int pad1:5;
+
+    unsigned int res_848x480:1;
+    unsigned int res_1064x600:1;
+    unsigned int res_1280x720:1;
+    unsigned int res_1360x768:1;
+    unsigned int res_1704x960:1;
+    unsigned int res_1864x1050:1;
+    unsigned int res_1920x1080:1;
+    unsigned int res_2128x1200:1;
+
+    unsigned int res_2560x1400:1;
+    unsigned int res_2728x1536:1;
+    unsigned int res_3408x1920:1;
+    unsigned int res_4264x2400:1;
+    unsigned int res_5120x2880:1;
+    unsigned int pad2:3;
+
+    unsigned int res_768x480:1;
+    unsigned int res_960x600:1;
+    unsigned int res_1152x720:1;
+    unsigned int res_1124x768:1;
+    unsigned int res_1536x960:1;
+    unsigned int res_1680x1050:1;
+    unsigned int res_1728x1080:1;
+    unsigned int res_1920x1200:1;
+
+    unsigned int res_2304x1440:1;
+    unsigned int res_2456x1536:1;
+    unsigned int res_3072x1920:1;
+    unsigned int res_3840x2400:1;
+    unsigned int res_4608x2880:1;
+    unsigned int pad3:3;
+
+    unsigned int res_1280x1024:1;
+    unsigned int pad4:7;
+
+    unsigned int res_1280x768:1;
+    unsigned int pad5:7;
+} __attribute__((packed));
+
+/* Get supported power state returns info for encoder and monitor, rely on
+   last SetTargetInput and SetTargetOutput calls */
 #define SDVO_CMD_GET_SUPPORTED_POWER_STATES             0x2a
+/* Get power state returns info for encoder and monitor, rely on last
+   SetTargetInput and SetTargetOutput calls */
+#define SDVO_CMD_GET_POWER_STATE                        0x2b
 #define SDVO_CMD_GET_ENCODER_POWER_STATE                0x2b
 #define SDVO_CMD_SET_ENCODER_POWER_STATE                0x2c
 # define SDVO_ENCODER_STATE_ON                                  (1 << 0)
 # define SDVO_ENCODER_STATE_STANDBY                             (1 << 1)
 # define SDVO_ENCODER_STATE_SUSPEND                             (1 << 2)
 # define SDVO_ENCODER_STATE_OFF                                 (1 << 3)
+# define SDVO_MONITOR_STATE_ON                                  (1 << 4)
+# define SDVO_MONITOR_STATE_STANDBY                             (1 << 5)
+# define SDVO_MONITOR_STATE_SUSPEND                             (1 << 6)
+# define SDVO_MONITOR_STATE_OFF                                 (1 << 7)
+
+#define SDVO_CMD_GET_MAX_PANEL_POWER_SEQUENCING         0x2d
+#define SDVO_CMD_GET_PANEL_POWER_SEQUENCING             0x2e
+#define SDVO_CMD_SET_PANEL_POWER_SEQUENCING             0x2f
+/**
+ * The panel power sequencing parameters are in units of milliseconds.
+ * The high fields are bits 8:9 of the 10-bit values.
+ */
+struct sdvo_panel_power_sequencing {
+    u8 t0;
+    u8 t1;
+    u8 t2;
+    u8 t3;
+    u8 t4;
+
+    unsigned int t0_high:2;
+    unsigned int t1_high:2;
+    unsigned int t2_high:2;
+    unsigned int t3_high:2;
+
+    unsigned int t4_high:2;
+    unsigned int pad:6;
+} __attribute__((packed));
+
+#define SDVO_CMD_GET_MAX_BACKLIGHT_LEVEL                0x30
+struct sdvo_max_backlight_reply {
+    u8 max_value;
+    u8 default_value;
+} __attribute__((packed));
+
+#define SDVO_CMD_GET_BACKLIGHT_LEVEL                    0x31
+#define SDVO_CMD_SET_BACKLIGHT_LEVEL                    0x32
+
+#define SDVO_CMD_GET_AMBIENT_LIGHT                      0x33
+struct sdvo_get_ambient_light_reply {
+    u16 trip_low;
+    u16 trip_high;
+    u16 value;
+} __attribute__((packed));
+#define SDVO_CMD_SET_AMBIENT_LIGHT                      0x34
+struct sdvo_set_ambient_light_reply {
+    u16 trip_low;
+    u16 trip_high;
+    unsigned int enable:1;
+    unsigned int pad:7;
+} __attribute__((packed));
+
+/* Set display power state */
+#define SDVO_CMD_SET_DISPLAY_POWER_STATE                0x7d
+# define SDVO_DISPLAY_STATE_ON                          (1 << 0)
+# define SDVO_DISPLAY_STATE_STANDBY                     (1 << 1)
+# define SDVO_DISPLAY_STATE_SUSPEND                     (1 << 2)
+# define SDVO_DISPLAY_STATE_OFF                         (1 << 3)
+
+#define SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS             0x84
+struct intel_sdvo_enhancements_reply {
+    unsigned int flicker_filter:1;
+    unsigned int flicker_filter_adaptive:1;
+    unsigned int flicker_filter_2d:1;
+    unsigned int saturation:1;
+    unsigned int hue:1;
+    unsigned int brightness:1;
+    unsigned int contrast:1;
+    unsigned int overscan_h:1;
+
+    unsigned int overscan_v:1;
+    unsigned int position_h:1;
+    unsigned int position_v:1;
+    unsigned int sharpness:1;
+    unsigned int dot_crawl:1;
+    unsigned int dither:1;
+    unsigned int max_tv_chroma_filter:1;
+    unsigned int max_tv_luma_filter:1;
+} __attribute__((packed));
+
+/* Picture enhancement limits below are dependent on the current TV format,
+ * and thus need to be queried and set after it.
+ */
+#define SDVO_CMD_GET_MAX_FLICKER_FITER                  0x4d
+#define SDVO_CMD_GET_MAX_ADAPTIVE_FLICKER_FITER         0x7b
+#define SDVO_CMD_GET_MAX_2D_FLICKER_FITER               0x52
+#define SDVO_CMD_GET_MAX_SATURATION                     0x55
+#define SDVO_CMD_GET_MAX_HUE                            0x58
+#define SDVO_CMD_GET_MAX_BRIGHTNESS                     0x5b
+#define SDVO_CMD_GET_MAX_CONTRAST                       0x5e
+#define SDVO_CMD_GET_MAX_OVERSCAN_H                     0x61
+#define SDVO_CMD_GET_MAX_OVERSCAN_V                     0x64
+#define SDVO_CMD_GET_MAX_POSITION_H                     0x67
+#define SDVO_CMD_GET_MAX_POSITION_V                     0x6a
+#define SDVO_CMD_GET_MAX_SHARPNESS_V                    0x6d
+#define SDVO_CMD_GET_MAX_TV_CHROMA                      0x74
+#define SDVO_CMD_GET_MAX_TV_LUMA                        0x77
+struct intel_sdvo_enhancement_limits_reply {
+    u16 max_value;
+    u16 default_value;
+} __attribute__((packed));
 
-#define SDVO_CMD_SET_TV_RESOLUTION_SUPPORT              0x93
+#define SDVO_CMD_GET_LVDS_PANEL_INFORMATION             0x7f
+#define SDVO_CMD_SET_LVDS_PANEL_INFORMATION             0x80
+# define SDVO_LVDS_COLOR_DEPTH_18                       (0 << 0)
+# define SDVO_LVDS_COLOR_DEPTH_24                       (1 << 0)
+# define SDVO_LVDS_CONNECTOR_SPWG                       (0 << 2)
+# define SDVO_LVDS_CONNECTOR_OPENLDI                    (1 << 2)
+# define SDVO_LVDS_SINGLE_CHANNEL                       (0 << 4)
+# define SDVO_LVDS_DUAL_CHANNEL                         (1 << 4)
+
+#define SDVO_CMD_GET_FLICKER_FILTER                     0x4e
+#define SDVO_CMD_SET_FLICKER_FILTER                     0x4f
+#define SDVO_CMD_GET_ADAPTIVE_FLICKER_FITER             0x50
+#define SDVO_CMD_SET_ADAPTIVE_FLICKER_FITER             0x51
+#define SDVO_CMD_GET_2D_FLICKER_FITER                   0x53
+#define SDVO_CMD_SET_2D_FLICKER_FITER                   0x54
+#define SDVO_CMD_GET_SATURATION                         0x56
+#define SDVO_CMD_SET_SATURATION                         0x57
+#define SDVO_CMD_GET_HUE                                0x59
+#define SDVO_CMD_SET_HUE                                0x5a
+#define SDVO_CMD_GET_BRIGHTNESS                         0x5c
+#define SDVO_CMD_SET_BRIGHTNESS                         0x5d
+#define SDVO_CMD_GET_CONTRAST                           0x5f
+#define SDVO_CMD_SET_CONTRAST                           0x60
+#define SDVO_CMD_GET_OVERSCAN_H                         0x62
+#define SDVO_CMD_SET_OVERSCAN_H                         0x63
+#define SDVO_CMD_GET_OVERSCAN_V                         0x65
+#define SDVO_CMD_SET_OVERSCAN_V                         0x66
+#define SDVO_CMD_GET_POSITION_H                         0x68
+#define SDVO_CMD_SET_POSITION_H                         0x69
+#define SDVO_CMD_GET_POSITION_V                         0x6b
+#define SDVO_CMD_SET_POSITION_V                         0x6c
+#define SDVO_CMD_GET_SHARPNESS                          0x6e
+#define SDVO_CMD_SET_SHARPNESS                          0x6f
+#define SDVO_CMD_GET_TV_CHROMA                          0x75
+#define SDVO_CMD_SET_TV_CHROMA                          0x76
+#define SDVO_CMD_GET_TV_LUMA                            0x78
+#define SDVO_CMD_SET_TV_LUMA                            0x79
+struct intel_sdvo_enhancements_arg {
+    u16 value;
+}__attribute__((packed));
+
+#define SDVO_CMD_GET_DOT_CRAWL                          0x70
+#define SDVO_CMD_SET_DOT_CRAWL                          0x71
+# define SDVO_DOT_CRAWL_ON                                      (1 << 0)
+# define SDVO_DOT_CRAWL_DEFAULT_ON                              (1 << 1)
+
+#define SDVO_CMD_GET_DITHER                             0x72
+#define SDVO_CMD_SET_DITHER                             0x73
+# define SDVO_DITHER_ON                                         (1 << 0)
+# define SDVO_DITHER_DEFAULT_ON                                 (1 << 1)
 
 #define SDVO_CMD_SET_CONTROL_BUS_SWITCH                 0x7a
-# define SDVO_CONTROL_BUS_PROM                          0x0
-# define SDVO_CONTROL_BUS_DDC1                          0x1
-# define SDVO_CONTROL_BUS_DDC2                          0x2
-# define SDVO_CONTROL_BUS_DDC3                          0x3
+# define SDVO_CONTROL_BUS_PROM                          (1 << 0)
+# define SDVO_CONTROL_BUS_DDC1                          (1 << 1)
+# define SDVO_CONTROL_BUS_DDC2                          (1 << 2)
+# define SDVO_CONTROL_BUS_DDC3                          (1 << 3)
+
+/* HDMI op codes */
+#define SDVO_CMD_GET_SUPP_ENCODE        0x9d
+#define SDVO_CMD_GET_ENCODE             0x9e
+#define SDVO_CMD_SET_ENCODE             0x9f
+  #define SDVO_ENCODE_DVI       0x0
+  #define SDVO_ENCODE_HDMI      0x1
+#define SDVO_CMD_SET_PIXEL_REPLI        0x8b
+#define SDVO_CMD_GET_PIXEL_REPLI        0x8c
+#define SDVO_CMD_GET_COLORIMETRY_CAP    0x8d
+#define SDVO_CMD_SET_COLORIMETRY        0x8e
+  #define SDVO_COLORIMETRY_RGB256   0x0
+  #define SDVO_COLORIMETRY_RGB220   0x1
+  #define SDVO_COLORIMETRY_YCrCb422 0x3
+  #define SDVO_COLORIMETRY_YCrCb444 0x4
+#define SDVO_CMD_GET_COLORIMETRY        0x8f
+#define SDVO_CMD_GET_AUDIO_ENCRYPT_PREFER 0x90
+#define SDVO_CMD_SET_AUDIO_STAT         0x91
+#define SDVO_CMD_GET_AUDIO_STAT         0x92
+#define SDVO_CMD_SET_HBUF_INDEX         0x93
+#define SDVO_CMD_GET_HBUF_INDEX         0x94
+#define SDVO_CMD_GET_HBUF_INFO          0x95
+#define SDVO_CMD_SET_HBUF_AV_SPLIT      0x96
+#define SDVO_CMD_GET_HBUF_AV_SPLIT      0x97
+#define SDVO_CMD_SET_HBUF_DATA          0x98
+#define SDVO_CMD_GET_HBUF_DATA          0x99
+#define SDVO_CMD_SET_HBUF_TXRATE        0x9a
+#define SDVO_CMD_GET_HBUF_TXRATE        0x9b
+  #define SDVO_HBUF_TX_DISABLED (0 << 6)
+  #define SDVO_HBUF_TX_ONCE     (2 << 6)
+  #define SDVO_HBUF_TX_VSYNC    (3 << 6)
+#define SDVO_CMD_GET_AUDIO_TX_INFO      0x9c
+
+struct intel_sdvo_encode{
+    u8 dvi_rev;
+    u8 hdmi_rev;
+} __attribute__ ((packed));
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 63212d7bbc28..df4cf97e5d97 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -1039,9 +1039,9 @@ static int radeon_do_init_cp(struct drm_device *dev, drm_radeon_init_t *init,
 
 #if __OS_HAS_AGP
         if (dev_priv->flags & RADEON_IS_AGP) {
-                drm_core_ioremap(dev_priv->cp_ring, dev);
-                drm_core_ioremap(dev_priv->ring_rptr, dev);
-                drm_core_ioremap(dev->agp_buffer_map, dev);
+                drm_core_ioremap_wc(dev_priv->cp_ring, dev);
+                drm_core_ioremap_wc(dev_priv->ring_rptr, dev);
+                drm_core_ioremap_wc(dev->agp_buffer_map, dev);
                 if (!dev_priv->cp_ring->handle ||
                     !dev_priv->ring_rptr->handle ||
                     !dev->agp_buffer_map->handle) {
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index 03705240000f..abf4dfc8ec22 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -153,7 +153,10 @@ static struct axis_conversion lis3lv02d_axis_y_inverted = {1, -2, 3};
 static struct axis_conversion lis3lv02d_axis_x_inverted = {-1, 2, 3};
 static struct axis_conversion lis3lv02d_axis_z_inverted = {1, 2, -3};
 static struct axis_conversion lis3lv02d_axis_xy_rotated_left = {-2, 1, 3};
+static struct axis_conversion lis3lv02d_axis_xy_rotated_left_usd = {-2, 1, -3};
 static struct axis_conversion lis3lv02d_axis_xy_swap_inverted = {-2, -1, 3};
+static struct axis_conversion lis3lv02d_axis_xy_rotated_right = {2, -1, 3};
+static struct axis_conversion lis3lv02d_axis_xy_swap_yz_inverted = {2, -1, -3};
 
 #define AXIS_DMI_MATCH(_ident, _name, _axis) {          \
         .ident = _ident,                                \
@@ -172,10 +175,12 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
         AXIS_DMI_MATCH("NC2510", "HP Compaq 2510", y_inverted),
         AXIS_DMI_MATCH("NC8510", "HP Compaq 8510", xy_swap_inverted),
         AXIS_DMI_MATCH("HP2133", "HP 2133", xy_rotated_left),
+        AXIS_DMI_MATCH("NC653x", "HP Compaq 653", xy_rotated_left_usd),
+        AXIS_DMI_MATCH("NC673x", "HP Compaq 673", xy_rotated_left_usd),
+        AXIS_DMI_MATCH("NC651xx", "HP Compaq 651", xy_rotated_right),
+        AXIS_DMI_MATCH("NC671xx", "HP Compaq 671", xy_swap_yz_inverted),
         { NULL, }
 /* Laptop models without axis info (yet):
- * "NC651xx" "HP Compaq 651"
- * "NC671xx" "HP Compaq 671"
  * "NC6910" "HP Compaq 6910"
  * HP Compaq 8710x Notebook PC / Mobile Workstation
  * "NC2400" "HP Compaq nc2400"
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index a329e6bd5d2d..3838bc4acaba 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -1823,6 +1823,10 @@ static int dv1394_open(struct inode *inode, struct file *file)
 
 #endif
 
+        printk(KERN_INFO "%s: NOTE, the dv1394 interface is unsupported "
+               "and will not be available in the new firewire driver stack. "
+               "Try libraw1394 based programs instead.\n", current->comm);
+
         return 0;
 }
 
@@ -2567,10 +2571,6 @@ static int __init dv1394_init_module(void)
 {
         int ret;
 
-        printk(KERN_WARNING
-               "NOTE: The dv1394 driver is unsupported and may be removed in a "
-               "future Linux release. Use raw1394 instead.\n");
-
         cdev_init(&dv1394_cdev, &dv1394_fops);
         dv1394_cdev.owner = THIS_MODULE;
         ret = cdev_add(&dv1394_cdev, IEEE1394_DV1394_DEV, 16);
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 595ba8eb4a07..0b28141e43bf 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -4599,6 +4599,7 @@ init_e1_port(struct hfc_multi *hc, struct hm_map *m)
                         printk(KERN_ERR "%s: no memory for coeffs\n",
                             __func__);
                         ret = -ENOMEM;
+                        kfree(bch);
                         goto free_chan;
                 }
                 bch->nr = ch;
@@ -4767,6 +4768,7 @@ init_multi_port(struct hfc_multi *hc, int pt)
                         printk(KERN_ERR "%s: no memory for coeffs\n",
                             __func__);
                         ret = -ENOMEM;
+                        kfree(bch);
                         goto free_chan;
                 }
                 bch->nr = ch + 1;
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 1e3aea9eecf1..09658b218474 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -25,13 +25,13 @@ static inline dev_info_t *which_dev(mddev_t *mddev, sector_t sector)
 {
         dev_info_t *hash;
         linear_conf_t *conf = mddev_to_conf(mddev);
+        sector_t idx = sector >> conf->sector_shift;
 
         /*
          * sector_div(a,b) returns the remainer and sets a to a/b
          */
-        sector >>= conf->sector_shift;
-        (void)sector_div(sector, conf->spacing);
-        hash = conf->hash_table[sector];
+        (void)sector_div(idx, conf->spacing);
+        hash = conf->hash_table[idx];
 
         while (sector >= hash->num_sectors + hash->start_sector)
                 hash++;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 41e2509bf896..4495104f6c9f 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1481,6 +1481,11 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
                 if (find_rdev_nr(mddev, rdev->desc_nr))
                         return -EBUSY;
         }
+        if (mddev->max_disks && rdev->desc_nr >= mddev->max_disks) {
+                printk(KERN_WARNING "md: %s: array is limited to %d devices\n",
+                       mdname(mddev), mddev->max_disks);
+                return -EBUSY;
+        }
         bdevname(rdev->bdev,b);
         while ( (s=strchr(b, '/')) != NULL)
                 *s = '!';
@@ -2441,6 +2446,15 @@ static void analyze_sbs(mddev_t * mddev)
 
         i = 0;
         rdev_for_each(rdev, tmp, mddev) {
+                if (rdev->desc_nr >= mddev->max_disks ||
+                    i > mddev->max_disks) {
+                        printk(KERN_WARNING
+                               "md: %s: %s: only %d devices permitted\n",
+                               mdname(mddev), bdevname(rdev->bdev, b),
+                               mddev->max_disks);
+                        kick_rdev_from_array(rdev);
+                        continue;
+                }
                 if (rdev != freshest)
                         if (super_types[mddev->major_version].
                             validate_super(mddev, rdev)) {
@@ -4614,13 +4628,6 @@ static int hot_add_disk(mddev_t * mddev, dev_t dev)
          * noticed in interrupt contexts ...
          */
 
-        if (rdev->desc_nr == mddev->max_disks) {
-                printk(KERN_WARNING "%s: can not hot-add to full array!\n",
-                        mdname(mddev));
-                err = -EBUSY;
-                goto abort_unbind_export;
-        }
-
         rdev->raid_disk = -1;
 
         md_update_sb(mddev, 1);
@@ -4634,9 +4641,6 @@ static int hot_add_disk(mddev_t * mddev, dev_t dev)
         md_new_event(mddev);
         return 0;
 
-abort_unbind_export:
-        unbind_rdev_from_array(rdev);
-
 abort_export:
         export_rdev(rdev);
         return err;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 7b4f5f7155d8..01e3cffd03b8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1640,7 +1640,8 @@ static void raid1d(mddev_t *mddev)
                         }
 
                         bio = r1_bio->bios[r1_bio->read_disk];
-                        if ((disk=read_balance(conf, r1_bio)) == -1) {
+                        if ((disk=read_balance(conf, r1_bio)) == -1 ||
+                            disk == r1_bio->read_disk) {
                                 printk(KERN_ALERT "raid1: %s: unrecoverable I/O"
                                        " read error for block %llu\n",
                                        bdevname(bio->bi_bdev,b),
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 56073199ceba..c64e6798878a 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -217,6 +217,7 @@ config DELL_LAPTOP
         depends on EXPERIMENTAL
         depends on BACKLIGHT_CLASS_DEVICE
         depends on RFKILL
+        depends on POWER_SUPPLY
         default n
         ---help---
         This driver adds support for rfkill and backlight control to Dell
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index bf5e4d065436..558bf3f2c276 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -35,7 +35,7 @@ struct ssc_device *ssc_request(unsigned int ssc_num)
 
         if (!ssc_valid) {
                 spin_unlock(&user_lock);
-                dev_dbg(&ssc->pdev->dev, "could not find requested device\n");
+                pr_err("ssc: ssc%d platform device is missing\n", ssc_num);
                 return ERR_PTR(-ENODEV);
         }
 
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index 10c421b73eaf..f26667a7abf7 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -207,7 +207,7 @@ static void ilo_ccb_close(struct pci_dev *pdev, struct ccb_data *data)
                   &device_ccb->recv_ctrl);
 
         /* give iLO some time to process stop request */
-        for (retries = 1000; retries > 0; retries--) {
+        for (retries = MAX_WAIT; retries > 0; retries--) {
                 doorbell_set(driver_ccb);
                 udelay(1);
                 if (!(ioread32(&device_ccb->send_ctrl) & (1 << CTRL_BITPOS_A))
@@ -309,7 +309,7 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
         doorbell_clr(driver_ccb);
 
         /* make sure iLO is really handling requests */
-        for (i = 1000; i > 0; i--) {
+        for (i = MAX_WAIT; i > 0; i--) {
                 if (ilo_pkt_dequeue(hw, driver_ccb, SENDQ, &pkt_id, NULL, NULL))
                         break;
                 udelay(1);
@@ -326,7 +326,7 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
 
         return 0;
 free:
-        pci_free_consistent(pdev, data->dma_size, data->dma_va, data->dma_pa);
+        ilo_ccb_close(pdev, data);
 out:
         return error;
 }
diff --git a/drivers/misc/hpilo.h b/drivers/misc/hpilo.h
index a281207696c1..b64a20ef07e3 100644
--- a/drivers/misc/hpilo.h
+++ b/drivers/misc/hpilo.h
@@ -19,6 +19,8 @@
 #define MAX_ILO_DEV     1
 /* max number of files */
 #define MAX_OPEN        (MAX_CCB * MAX_ILO_DEV)
+/* spin counter for open/close delay */
+#define MAX_WAIT        10000
 
 /*
  * Per device, used to track global memory allocations.
diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
index a5bd658c2e83..275b78896a73 100644
--- a/drivers/misc/sgi-xp/xpc.h
+++ b/drivers/misc/sgi-xp/xpc.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 2004-2008 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2004-2009 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 /*
@@ -514,7 +514,8 @@ struct xpc_channel_uv {
                                                 /* partition's notify mq */
 
         struct xpc_send_msg_slot_uv *send_msg_slots;
-        struct xpc_notify_mq_msg_uv *recv_msg_slots;
+        void *recv_msg_slots;   /* each slot will hold a xpc_notify_mq_msg_uv */
+                                /* structure plus the user's payload */
 
         struct xpc_fifo_head_uv msg_slot_free_list;
         struct xpc_fifo_head_uv recv_msg_list;  /* deliverable payloads */
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index f17f7d40ea2c..29c0502a96b2 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 2008 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2008-2009 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 /*
@@ -1010,8 +1010,8 @@ xpc_allocate_recv_msg_slot_uv(struct xpc_channel *ch)
                         continue;
 
                 for (entry = 0; entry < nentries; entry++) {
-                        msg_slot = ch_uv->recv_msg_slots + entry *
-                            ch->entry_size;
+                        msg_slot = ch_uv->recv_msg_slots +
+                            entry * ch->entry_size;
 
                         msg_slot->hdr.msg_slot_number = entry;
                 }
@@ -1308,9 +1308,8 @@ xpc_handle_notify_mq_msg_uv(struct xpc_partition *part,
         /* we're dealing with a normal message sent via the notify_mq */
         ch_uv = &ch->sn.uv;
 
-        msg_slot = (struct xpc_notify_mq_msg_uv *)((u64)ch_uv->recv_msg_slots +
-                    (msg->hdr.msg_slot_number % ch->remote_nentries) *
-                    ch->entry_size);
+        msg_slot = ch_uv->recv_msg_slots +
+            (msg->hdr.msg_slot_number % ch->remote_nentries) * ch->entry_size;
 
         BUG_ON(msg->hdr.msg_slot_number != msg_slot->hdr.msg_slot_number);
         BUG_ON(msg_slot->hdr.size != 0);
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index 535c234286ea..8c694213035b 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -1475,6 +1475,7 @@ el3_resume(struct device *pdev)
         spin_lock_irqsave(&lp->lock, flags);
 
         outw(PowerUp, ioaddr + EL3_CMD);
+        EL3WINDOW(0);
         el3_up(dev);
 
         if (netif_running(dev))
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 379a1324db4e..d31791f60292 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -2276,8 +2276,7 @@ no_mem:
                 } else if ((len = ntohl(r->len_cq)) != 0) {
                         struct sge_fl *fl;
 
-                        if (eth)
-                                lro = qs->lro_enabled && is_eth_tcp(rss_hi);
+                        lro &= eth && is_eth_tcp(rss_hi);
 
                         fl = (len & F_RSPD_FLQ) ? &qs->fl[1] : &qs->fl[0];
                         if (fl->use_pages) {
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 3f7eab42aef1..9b12a13a640f 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -351,6 +351,9 @@ static int gfar_probe(struct of_device *ofdev,
         /* Reset MAC layer */
         gfar_write(&priv->regs->maccfg1, MACCFG1_SOFT_RESET);
 
+        /* We need to delay at least 3 TX clocks */
+        udelay(2);
+
         tempval = (MACCFG1_TX_FLOW | MACCFG1_RX_FLOW);
         gfar_write(&priv->regs->maccfg1, tempval);
 
@@ -1626,6 +1629,12 @@ static void gfar_schedule_cleanup(struct net_device *dev)
         if (netif_rx_schedule_prep(&priv->napi)) {
                 gfar_write(&priv->regs->imask, IMASK_RTX_DISABLED);
                 __netif_rx_schedule(&priv->napi);
+        } else {
+                /*
+                 * Clear IEVENT, so interrupts aren't called again
+                 * because of the packets that have already arrived.
+                 */
+                gfar_write(&priv->regs->ievent, IEVENT_RTX_MASK);
         }
 
         spin_unlock(&priv->rxlock);
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index b1a83344acc7..eaa86897f5c3 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -312,7 +312,7 @@ extern const char gfar_driver_version[];
 #define ATTRELI_EI(x) (x)
 
 #define BD_LFLAG(flags) ((flags) << 16)
-#define BD_LENGTH_MASK          0x00ff
+#define BD_LENGTH_MASK          0x0000ffff
 
 /* TxBD status field bits */
 #define TXBD_READY              0x8000
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 9c78c963b721..f4dd9acb6877 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -1203,7 +1203,7 @@ typedef struct {
 #define NETXEN_IS_MSI_FAMILY(adapter) \
         ((adapter)->flags & (NETXEN_NIC_MSI_ENABLED | NETXEN_NIC_MSIX_ENABLED))
 
-#define MSIX_ENTRIES_PER_ADAPTER        8
+#define MSIX_ENTRIES_PER_ADAPTER        1
 #define NETXEN_MSIX_TBL_SPACE           8192
 #define NETXEN_PCI_REG_MSIX_TBL         0x44
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 645d384fe87e..3b17a7936147 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -76,6 +76,7 @@ static void netxen_nic_poll_controller(struct net_device *netdev);
 #endif
 static irqreturn_t netxen_intr(int irq, void *data);
 static irqreturn_t netxen_msi_intr(int irq, void *data);
+static irqreturn_t netxen_msix_intr(int irq, void *data);
 
 /*  PCI Device ID Table  */
 #define ENTRY(device) \
@@ -1084,7 +1085,9 @@ static int netxen_nic_open(struct net_device *netdev)
                         for (ring = 0; ring < adapter->max_rds_rings; ring++)
                                 netxen_post_rx_buffers(adapter, ctx, ring);
                 }
-                if (NETXEN_IS_MSI_FAMILY(adapter))
+                if (adapter->flags & NETXEN_NIC_MSIX_ENABLED)
+                        handler = netxen_msix_intr;
+                else if (adapter->flags & NETXEN_NIC_MSI_ENABLED)
                         handler = netxen_msi_intr;
                 else {
                         flags |= IRQF_SHARED;
@@ -1612,6 +1615,14 @@ static irqreturn_t netxen_msi_intr(int irq, void *data)
         return IRQ_HANDLED;
 }
 
+static irqreturn_t netxen_msix_intr(int irq, void *data)
+{
+        struct netxen_adapter *adapter = data;
+
+        napi_schedule(&adapter->napi);
+        return IRQ_HANDLED;
+}
+
 static int netxen_nic_poll(struct napi_struct *napi, int budget)
 {
         struct netxen_adapter *adapter = container_of(napi, struct netxen_adapter, napi);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 2c73ca606b35..0771eb6fc6eb 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -437,6 +437,22 @@ enum features {
         RTL_FEATURE_GMII        = (1 << 2),
 };
 
+struct rtl8169_counters {
+        __le64  tx_packets;
+        __le64  rx_packets;
+        __le64  tx_errors;
+        __le32  rx_errors;
+        __le16  rx_missed;
+        __le16  align_errors;
+        __le32  tx_one_collision;
+        __le32  tx_multi_collision;
+        __le64  rx_unicast;
+        __le64  rx_broadcast;
+        __le32  rx_multicast;
+        __le16  tx_aborted;
+        __le16  tx_underun;
+};
+
 struct rtl8169_private {
         void __iomem *mmio_addr;        /* memory map physical address */
         struct pci_dev *pci_dev;        /* Index of PCI device */
@@ -480,6 +496,7 @@ struct rtl8169_private {
         unsigned features;
 
         struct mii_if_info mii;
+        struct rtl8169_counters counters;
 };
 
 MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>");
@@ -1100,22 +1117,6 @@ static const char rtl8169_gstrings[][ETH_GSTRING_LEN] = {
         "tx_underrun",
 };
 
-struct rtl8169_counters {
-        __le64  tx_packets;
-        __le64  rx_packets;
-        __le64  tx_errors;
-        __le32  rx_errors;
-        __le16  rx_missed;
-        __le16  align_errors;
-        __le32  tx_one_collision;
-        __le32  tx_multi_collision;
-        __le64  rx_unicast;
-        __le64  rx_broadcast;
-        __le32  rx_multicast;
-        __le16  tx_aborted;
-        __le16  tx_underun;
-};
-
 static int rtl8169_get_sset_count(struct net_device *dev, int sset)
 {
         switch (sset) {
@@ -1126,16 +1127,21 @@ static int rtl8169_get_sset_count(struct net_device *dev, int sset)
         }
 }
 
-static void rtl8169_get_ethtool_stats(struct net_device *dev,
-                                      struct ethtool_stats *stats, u64 *data)
+static void rtl8169_update_counters(struct net_device *dev)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
         void __iomem *ioaddr = tp->mmio_addr;
         struct rtl8169_counters *counters;
         dma_addr_t paddr;
         u32 cmd;
+        int wait = 1000;
 
-        ASSERT_RTNL();
+        /*
+         * Some chips are unable to dump tally counters when the receiver
+         * is disabled.
+         */
+        if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0)
+                return;
 
         counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr);
         if (!counters)
@@ -1146,31 +1152,45 @@ static void rtl8169_get_ethtool_stats(struct net_device *dev,
         RTL_W32(CounterAddrLow, cmd);
         RTL_W32(CounterAddrLow, cmd | CounterDump);
 
-        while (RTL_R32(CounterAddrLow) & CounterDump) {
-                if (msleep_interruptible(1))
+        while (wait--) {
+                if ((RTL_R32(CounterAddrLow) & CounterDump) == 0) {
+                        /* copy updated counters */
+                        memcpy(&tp->counters, counters, sizeof(*counters));
                         break;
+                }
+                udelay(10);
         }
 
         RTL_W32(CounterAddrLow, 0);
         RTL_W32(CounterAddrHigh, 0);
 
-        data[0] = le64_to_cpu(counters->tx_packets);
-        data[1] = le64_to_cpu(counters->rx_packets);
-        data[2] = le64_to_cpu(counters->tx_errors);
-        data[3] = le32_to_cpu(counters->rx_errors);
-        data[4] = le16_to_cpu(counters->rx_missed);
-        data[5] = le16_to_cpu(counters->align_errors);
-        data[6] = le32_to_cpu(counters->tx_one_collision);
-        data[7] = le32_to_cpu(counters->tx_multi_collision);
-        data[8] = le64_to_cpu(counters->rx_unicast);
-        data[9] = le64_to_cpu(counters->rx_broadcast);
-        data[10] = le32_to_cpu(counters->rx_multicast);
-        data[11] = le16_to_cpu(counters->tx_aborted);
-        data[12] = le16_to_cpu(counters->tx_underun);
-
         pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr);
 }
 
+static void rtl8169_get_ethtool_stats(struct net_device *dev,
+                                      struct ethtool_stats *stats, u64 *data)
+{
+        struct rtl8169_private *tp = netdev_priv(dev);
+
+        ASSERT_RTNL();
+
+        rtl8169_update_counters(dev);
+
+        data[0] = le64_to_cpu(tp->counters.tx_packets);
+        data[1] = le64_to_cpu(tp->counters.rx_packets);
+        data[2] = le64_to_cpu(tp->counters.tx_errors);
+        data[3] = le32_to_cpu(tp->counters.rx_errors);
+        data[4] = le16_to_cpu(tp->counters.rx_missed);
+        data[5] = le16_to_cpu(tp->counters.align_errors);
+        data[6] = le32_to_cpu(tp->counters.tx_one_collision);
+        data[7] = le32_to_cpu(tp->counters.tx_multi_collision);
+        data[8] = le64_to_cpu(tp->counters.rx_unicast);
+        data[9] = le64_to_cpu(tp->counters.rx_broadcast);
+        data[10] = le32_to_cpu(tp->counters.rx_multicast);
+        data[11] = le16_to_cpu(tp->counters.tx_aborted);
+        data[12] = le16_to_cpu(tp->counters.tx_underun);
+}
+
 static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data)
 {
         switch(stringset) {
@@ -3682,6 +3702,9 @@ static int rtl8169_close(struct net_device *dev)
         struct rtl8169_private *tp = netdev_priv(dev);
         struct pci_dev *pdev = tp->pci_dev;
 
+        /* update counters before going down */
+        rtl8169_update_counters(dev);
+
         rtl8169_down(dev);
 
         free_irq(dev->irq, dev);
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index b17efa9cc530..491876341068 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -2221,6 +2221,8 @@ static int gem_do_start(struct net_device *dev)
 
         gp->running = 1;
 
+        napi_enable(&gp->napi);
+
         if (gp->lstate == link_up) {
                 netif_carrier_on(gp->dev);
                 gem_set_link_modes(gp);
@@ -2238,6 +2240,8 @@ static int gem_do_start(struct net_device *dev)
                 spin_lock_irqsave(&gp->lock, flags);
                 spin_lock(&gp->tx_lock);
 
+                napi_disable(&gp->napi);
+
                 gp->running =  0;
                 gem_reset(gp);
                 gem_clean_rings(gp);
@@ -2338,8 +2342,6 @@ static int gem_open(struct net_device *dev)
         if (!gp->asleep)
                 rc = gem_do_start(dev);
         gp->opened = (rc == 0);
-        if (gp->opened)
-                napi_enable(&gp->napi);
 
         mutex_unlock(&gp->pm_mutex);
 
@@ -2476,8 +2478,6 @@ static int gem_resume(struct pci_dev *pdev)
 
                 /* Re-attach net device */
                 netif_device_attach(dev);
-
-                napi_enable(&gp->napi);
         }
 
         spin_lock_irqsave(&gp->lock, flags);
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index 7a72a3112f0a..cc4013be5e18 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -2629,6 +2629,14 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
         int i, qfe_slot = -1;
         int err = -ENODEV;
 
+        sbus_dp = to_of_device(op->dev.parent)->node;
+        if (is_qfe)
+                sbus_dp = to_of_device(op->dev.parent->parent)->node;
+
+        /* We can match PCI devices too, do not accept those here. */
+        if (strcmp(sbus_dp->name, "sbus"))
+                return err;
+
         if (is_qfe) {
                 qp = quattro_sbus_find(op);
                 if (qp == NULL)
@@ -2734,10 +2742,6 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
         if (qp != NULL)
                 hp->happy_flags |= HFLAG_QUATTRO;
 
-        sbus_dp = to_of_device(op->dev.parent)->node;
-        if (is_qfe)
-                sbus_dp = to_of_device(op->dev.parent->parent)->node;
-
         /* Get the supported DVMA burst sizes from our Happy SBUS. */
         hp->happy_bursts = of_getintprop_default(sbus_dp,
                                                  "burst-sizes", 0x00);
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 0bf2114738be..d4c5ecc51f77 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -464,13 +464,14 @@ static void de_rx (struct de_private *de)
                         drop = 1;
 
 rx_next:
-                de->rx_ring[rx_tail].opts1 = cpu_to_le32(DescOwn);
                 if (rx_tail == (DE_RX_RING_SIZE - 1))
                         de->rx_ring[rx_tail].opts2 =
                                 cpu_to_le32(RingEnd | de->rx_buf_sz);
                 else
                         de->rx_ring[rx_tail].opts2 = cpu_to_le32(de->rx_buf_sz);
                 de->rx_ring[rx_tail].addr1 = cpu_to_le32(mapping);
+                wmb();
+                de->rx_ring[rx_tail].opts1 = cpu_to_le32(DescOwn);
                 rx_tail = NEXT_RX(rx_tail);
         }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index d7b81e4fdd56..09fea31d3e36 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -157,10 +157,16 @@ static int update_filter(struct tap_filter *filter, void __user *arg)
 
         nexact = n;
 
-        /* The rest is hashed */
+        /* Remaining multicast addresses are hashed,
+         * unicast will leave the filter disabled. */
         memset(filter->mask, 0, sizeof(filter->mask));
-        for (; n < uf.count; n++)
+        for (; n < uf.count; n++) {
+                if (!is_multicast_ether_addr(addr[n].u)) {
+                        err = 0; /* no filter */
+                        goto done;
+                }
                 addr_hash_set(filter->mask, addr[n].u);
+        }
 
         /* For ALLMULTI just set the mask to all ones.
          * This overrides the mask populated above. */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index b35c8813bef4..c01ea48da5fe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -4042,6 +4042,7 @@ static int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                 priv->is_open = 1;
         }
 
+        pci_save_state(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
 
         return 0;
@@ -4052,6 +4053,7 @@ static int iwl_pci_resume(struct pci_dev *pdev)
         struct iwl_priv *priv = pci_get_drvdata(pdev);
 
         pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
 
         if (priv->is_open)
                 iwl_mac_start(priv->hw);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 412f66bac1af..70a8b21ca39b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -480,6 +480,9 @@ void iwl_clear_stations_table(struct iwl_priv *priv)
         priv->num_stations = 0;
         memset(priv->stations, 0, sizeof(priv->stations));
 
+        /* clean ucode key table bit map */
+        priv->ucode_key_table = 0;
+
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 EXPORT_SYMBOL(iwl_clear_stations_table);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 95d01984c80e..5b44d322b99f 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -8143,6 +8143,7 @@ static int iwl3945_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                 priv->is_open = 1;
         }
 
+        pci_save_state(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
 
         return 0;
@@ -8153,6 +8154,7 @@ static int iwl3945_pci_resume(struct pci_dev *pdev)
         struct iwl3945_priv *priv = pci_get_drvdata(pdev);
 
         pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
 
         if (priv->is_open)
                 iwl3945_mac_start(priv->hw);
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index ab1d615425a8..93eac1423585 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -355,6 +355,8 @@ static int pci_legacy_suspend(struct device *dev, pm_message_t state)
         int i = 0;
 
         if (drv && drv->suspend) {
+                pci_power_t prev = pci_dev->current_state;
+
                 pci_dev->state_saved = false;
 
                 i = drv->suspend(pci_dev, state);
@@ -365,12 +367,16 @@ static int pci_legacy_suspend(struct device *dev, pm_message_t state)
                 if (pci_dev->state_saved)
                         goto Fixup;
 
-                if (WARN_ON_ONCE(pci_dev->current_state != PCI_D0))
+                if (pci_dev->current_state != PCI_D0
+                    && pci_dev->current_state != PCI_UNKNOWN) {
+                        WARN_ONCE(pci_dev->current_state != prev,
+                                "PCI PM: Device state not saved by %pF\n",
+                                drv->suspend);
                         goto Fixup;
+                }
         }
 
         pci_save_state(pci_dev);
-        pci_dev->state_saved = true;
         /*
          * This is for compatibility with existing code with legacy PM support.
          */
@@ -424,35 +430,20 @@ static void pci_pm_default_resume_noirq(struct pci_dev *pci_dev)
         pci_fixup_device(pci_fixup_resume_early, pci_dev);
 }
 
-static int pci_pm_default_resume(struct pci_dev *pci_dev)
+static void pci_pm_default_resume(struct pci_dev *pci_dev)
 {
         pci_fixup_device(pci_fixup_resume, pci_dev);
 
         if (!pci_is_bridge(pci_dev))
                 pci_enable_wake(pci_dev, PCI_D0, false);
-
-        return pci_pm_reenable_device(pci_dev);
-}
-
-static void pci_pm_default_suspend_generic(struct pci_dev *pci_dev)
-{
-        /* If device is enabled at this point, disable it */
-        pci_disable_enabled_device(pci_dev);
-        /*
-         * Save state with interrupts enabled, because in principle the bus the
-         * device is on may be put into a low power state after this code runs.
-         */
-        pci_save_state(pci_dev);
 }
 
 static void pci_pm_default_suspend(struct pci_dev *pci_dev)
 {
-        pci_pm_default_suspend_generic(pci_dev);
-
+        /* Disable non-bridge devices without PM support */
         if (!pci_is_bridge(pci_dev))
-                pci_prepare_to_sleep(pci_dev);
-
-        pci_fixup_device(pci_fixup_suspend, pci_dev);
+                pci_disable_enabled_device(pci_dev);
+        pci_save_state(pci_dev);
 }
 
 static bool pci_has_legacy_pm_support(struct pci_dev *pci_dev)
@@ -497,21 +488,49 @@ static void pci_pm_complete(struct device *dev)
 static int pci_pm_suspend(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
-        int error = 0;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_suspend(dev, PMSG_SUSPEND);
 
-        if (drv && drv->pm && drv->pm->suspend) {
-                error = drv->pm->suspend(dev);
-                suspend_report_result(drv->pm->suspend, error);
+        if (!pm) {
+                pci_pm_default_suspend(pci_dev);
+                goto Fixup;
         }
 
-        if (!error)
-                pci_pm_default_suspend(pci_dev);
+        pci_dev->state_saved = false;
 
-        return error;
+        if (pm->suspend) {
+                pci_power_t prev = pci_dev->current_state;
+                int error;
+
+                error = pm->suspend(dev);
+                suspend_report_result(pm->suspend, error);
+                if (error)
+                        return error;
+
+                if (pci_dev->state_saved)
+                        goto Fixup;
+
+                if (pci_dev->current_state != PCI_D0
+                    && pci_dev->current_state != PCI_UNKNOWN) {
+                        WARN_ONCE(pci_dev->current_state != prev,
+                                "PCI PM: State of device not saved by %pF\n",
+                                pm->suspend);
+                        goto Fixup;
+                }
+        }
+
+        if (!pci_dev->state_saved) {
+                pci_save_state(pci_dev);
+                if (!pci_is_bridge(pci_dev))
+                        pci_prepare_to_sleep(pci_dev);
+        }
+
+ Fixup:
+        pci_fixup_device(pci_fixup_suspend, pci_dev);
+
+        return 0;
 }
 
 static int pci_pm_suspend_noirq(struct device *dev)
@@ -554,7 +573,7 @@ static int pci_pm_resume_noirq(struct device *dev)
 static int pci_pm_resume(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int error = 0;
 
         /*
@@ -567,12 +586,16 @@ static int pci_pm_resume(struct device *dev)
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_resume(dev);
 
-        error = pci_pm_default_resume(pci_dev);
+        pci_pm_default_resume(pci_dev);
 
-        if (!error && drv && drv->pm && drv->pm->resume)
-                error = drv->pm->resume(dev);
+        if (pm) {
+                if (pm->resume)
+                        error = pm->resume(dev);
+        } else {
+                pci_pm_reenable_device(pci_dev);
+        }
 
-        return error;
+        return 0;
 }
 
 #else /* !CONFIG_SUSPEND */
@@ -589,21 +612,31 @@ static int pci_pm_resume(struct device *dev)
 static int pci_pm_freeze(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
-        int error = 0;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_suspend(dev, PMSG_FREEZE);
 
-        if (drv && drv->pm && drv->pm->freeze) {
-                error = drv->pm->freeze(dev);
-                suspend_report_result(drv->pm->freeze, error);
+        if (!pm) {
+                pci_pm_default_suspend(pci_dev);
+                return 0;
         }
 
-        if (!error)
-                pci_pm_default_suspend_generic(pci_dev);
+        pci_dev->state_saved = false;
 
-        return error;
+        if (pm->freeze) {
+                int error;
+
+                error = pm->freeze(dev);
+                suspend_report_result(pm->freeze, error);
+                if (error)
+                        return error;
+        }
+
+        if (!pci_dev->state_saved)
+                pci_save_state(pci_dev);
+
+        return 0;
 }
 
 static int pci_pm_freeze_noirq(struct device *dev)
@@ -646,16 +679,18 @@ static int pci_pm_thaw_noirq(struct device *dev)
 static int pci_pm_thaw(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int error = 0;
 
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_resume(dev);
 
-        pci_pm_reenable_device(pci_dev);
-
-        if (drv && drv->pm && drv->pm->thaw)
-                error =  drv->pm->thaw(dev);
+        if (pm) {
+                if (pm->thaw)
+                        error = pm->thaw(dev);
+        } else {
+                pci_pm_reenable_device(pci_dev);
+        }
 
         return error;
 }
@@ -663,22 +698,29 @@ static int pci_pm_thaw(struct device *dev)
 static int pci_pm_poweroff(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int error = 0;
 
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_suspend(dev, PMSG_HIBERNATE);
 
-        if (!drv || !drv->pm)
-                return 0;
+        if (!pm) {
+                pci_pm_default_suspend(pci_dev);
+                goto Fixup;
+        }
+
+        pci_dev->state_saved = false;
 
-        if (drv->pm->poweroff) {
-                error = drv->pm->poweroff(dev);
-                suspend_report_result(drv->pm->poweroff, error);
+        if (pm->poweroff) {
+                error = pm->poweroff(dev);
+                suspend_report_result(pm->poweroff, error);
         }
 
-        if (!error)
-                pci_pm_default_suspend(pci_dev);
+        if (!pci_dev->state_saved && !pci_is_bridge(pci_dev))
+                pci_prepare_to_sleep(pci_dev);
+
+ Fixup:
+        pci_fixup_device(pci_fixup_suspend, pci_dev);
 
         return error;
 }
@@ -719,7 +761,7 @@ static int pci_pm_restore_noirq(struct device *dev)
 static int pci_pm_restore(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int error = 0;
 
         /*
@@ -732,10 +774,14 @@ static int pci_pm_restore(struct device *dev)
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_resume(dev);
 
-        error = pci_pm_default_resume(pci_dev);
+        pci_pm_default_resume(pci_dev);
 
-        if (!error && drv && drv->pm && drv->pm->restore)
-                error = drv->pm->restore(dev);
+        if (pm) {
+                if (pm->restore)
+                        error = pm->restore(dev);
+        } else {
+                pci_pm_reenable_device(pci_dev);
+        }
 
         return error;
 }
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index db7ec14fa719..dfc4e0ddf241 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -768,8 +768,8 @@ pci_read_rom(struct kobject *kobj, struct bin_attribute *bin_attr,
                 return -EINVAL;
         
         rom = pci_map_rom(pdev, &size); /* size starts out as PCI window size */
-        if (!rom)
-                return 0;
+        if (!rom || !size)
+                return -EIO;
                 
         if (off >= size)
                 count = 0;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 48807556b47a..e3efe6b19ee7 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1418,10 +1418,10 @@ int pci_restore_standard_config(struct pci_dev *dev)
                 break;
         }
 
-        dev->current_state = PCI_D0;
+        pci_update_current_state(dev, PCI_D0);
 
  Restore:
-        return pci_restore_state(dev);
+        return dev->state_saved ? pci_restore_state(dev) : 0;
 }
 
 /**
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 586b6f75910d..b0367f168af4 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -718,9 +718,9 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
 
         /*
          * All PCIe functions are in one slot, remove one function will remove
-         * the the whole slot, so just wait
+         * the whole slot, so just wait until we are the last function left.
          */
-        if (!list_empty(&parent->subordinate->devices))
+        if (!list_is_last(&pdev->bus_list, &parent->subordinate->devices))
                 goto out;
 
         /* All functions are removed, so just disable ASPM for the link */
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 99a914a027f8..f9b874eaeb9f 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -55,25 +55,13 @@ static int pcie_portdrv_suspend(struct pci_dev *dev, pm_message_t state)
 
 }
 
-static int pcie_portdrv_suspend_late(struct pci_dev *dev, pm_message_t state)
-{
-        return pci_save_state(dev);
-}
-
-static int pcie_portdrv_resume_early(struct pci_dev *dev)
-{
-        return pci_restore_state(dev);
-}
-
 static int pcie_portdrv_resume(struct pci_dev *dev)
 {
-        pcie_portdrv_restore_config(dev);
+        pci_set_master(dev);
         return pcie_port_device_resume(dev);
 }
 #else
 #define pcie_portdrv_suspend NULL
-#define pcie_portdrv_suspend_late NULL
-#define pcie_portdrv_resume_early NULL
 #define pcie_portdrv_resume NULL
 #endif
 
@@ -292,8 +280,6 @@ static struct pci_driver pcie_portdriver = {
         .remove         = pcie_portdrv_remove,
 
         .suspend        = pcie_portdrv_suspend,
-        .suspend_late   = pcie_portdrv_suspend_late,
-        .resume_early   = pcie_portdrv_resume_early,
         .resume         = pcie_portdrv_resume,
 
         .err_handler    = &pcie_portdrv_err_handler,
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index 132a78159b60..29cbe47f219f 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -63,7 +63,7 @@ void pci_disable_rom(struct pci_dev *pdev)
  * The PCI window size could be much larger than the
  * actual image size.
  */
-size_t pci_get_rom_size(void __iomem *rom, size_t size)
+size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
 {
         void __iomem *image;
         int last_image;
@@ -72,8 +72,10 @@ size_t pci_get_rom_size(void __iomem *rom, size_t size)
         do {
                 void __iomem *pds;
                 /* Standard PCI ROMs start out with these bytes 55 AA */
-                if (readb(image) != 0x55)
+                if (readb(image) != 0x55) {
+                        dev_err(&pdev->dev, "Invalid ROM contents\n");
                         break;
+                }
                 if (readb(image + 1) != 0xAA)
                         break;
                 /* get the PCI data structure and check its signature */
@@ -159,7 +161,7 @@ void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
          * size is much larger than the actual size of the ROM.
          * True size is important if the ROM is going to be copied.
          */
-        *size = pci_get_rom_size(rom, *size);
+        *size = pci_get_rom_size(pdev, rom, *size);
         return rom;
 }
 
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 1a266d4ab5f1..94363115a42a 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -42,6 +42,7 @@ config ASUS_LAPTOP
         depends on LEDS_CLASS
         depends on NEW_LEDS
         depends on BACKLIGHT_CLASS_DEVICE
+        depends on INPUT
         ---help---
           This is the new Linux driver for Asus laptops. It may also support some
           MEDION, JVC or VICTOR laptops. It makes all the extra buttons generate
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index 8fb8b3591048..56af6cf385b0 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -46,6 +46,7 @@
 #include <acpi/acpi_drivers.h>
 #include <acpi/acpi_bus.h>
 #include <asm/uaccess.h>
+#include <linux/input.h>
 
 #define ASUS_LAPTOP_VERSION "0.42"
 
@@ -181,6 +182,8 @@ struct asus_hotk {
         u8 light_level;         //light sensor level
         u8 light_switch;        //light sensor switch value
         u16 event_count[128];   //count for each event TODO make this better
+        struct input_dev *inputdev;
+        u16 *keycode_map;
 };
 
 /*
@@ -250,6 +253,37 @@ ASUS_LED(rled, "record");
 ASUS_LED(pled, "phone");
 ASUS_LED(gled, "gaming");
 
+struct key_entry {
+        char type;
+        u8 code;
+        u16 keycode;
+};
+
+enum { KE_KEY, KE_END };
+
+static struct key_entry asus_keymap[] = {
+        {KE_KEY, 0x30, KEY_VOLUMEUP},
+        {KE_KEY, 0x31, KEY_VOLUMEDOWN},
+        {KE_KEY, 0x32, KEY_MUTE},
+        {KE_KEY, 0x33, KEY_SWITCHVIDEOMODE},
+        {KE_KEY, 0x34, KEY_SWITCHVIDEOMODE},
+        {KE_KEY, 0x40, KEY_PREVIOUSSONG},
+        {KE_KEY, 0x41, KEY_NEXTSONG},
+        {KE_KEY, 0x43, KEY_STOP},
+        {KE_KEY, 0x45, KEY_PLAYPAUSE},
+        {KE_KEY, 0x50, KEY_EMAIL},
+        {KE_KEY, 0x51, KEY_WWW},
+        {KE_KEY, 0x5C, BTN_EXTRA},  /* Performance */
+        {KE_KEY, 0x5D, KEY_WLAN},
+        {KE_KEY, 0x61, KEY_SWITCHVIDEOMODE},
+        {KE_KEY, 0x6B, BTN_TOUCH}, /* Lock Mouse */
+        {KE_KEY, 0x82, KEY_CAMERA},
+        {KE_KEY, 0x8A, KEY_TV},
+        {KE_KEY, 0x95, KEY_MEDIA},
+        {KE_KEY, 0x99, KEY_PHONE},
+        {KE_END, 0},
+};
+
 /*
  * This function evaluates an ACPI method, given an int as parameter, the
  * method is searched within the scope of the handle, can be NULL. The output
@@ -720,8 +754,68 @@ static ssize_t store_gps(struct device *dev, struct device_attribute *attr,
         return store_status(buf, count, NULL, GPS_ON);
 }
 
+/*
+ * Hotkey functions
+ */
+static struct key_entry *asus_get_entry_by_scancode(int code)
+{
+        struct key_entry *key;
+
+        for (key = asus_keymap; key->type != KE_END; key++)
+                if (code == key->code)
+                        return key;
+
+        return NULL;
+}
+
+static struct key_entry *asus_get_entry_by_keycode(int code)
+{
+        struct key_entry *key;
+
+        for (key = asus_keymap; key->type != KE_END; key++)
+                if (code == key->keycode && key->type == KE_KEY)
+                        return key;
+
+        return NULL;
+}
+
+static int asus_getkeycode(struct input_dev *dev, int scancode, int *keycode)
+{
+        struct key_entry *key = asus_get_entry_by_scancode(scancode);
+
+        if (key && key->type == KE_KEY) {
+                *keycode = key->keycode;
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
+static int asus_setkeycode(struct input_dev *dev, int scancode, int keycode)
+{
+        struct key_entry *key;
+        int old_keycode;
+
+        if (keycode < 0 || keycode > KEY_MAX)
+                return -EINVAL;
+
+        key = asus_get_entry_by_scancode(scancode);
+        if (key && key->type == KE_KEY) {
+                old_keycode = key->keycode;
+                key->keycode = keycode;
+                set_bit(keycode, dev->keybit);
+                if (!asus_get_entry_by_keycode(old_keycode))
+                        clear_bit(old_keycode, dev->keybit);
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
 static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
 {
+        static struct key_entry *key;
+
         /* TODO Find a better way to handle events count. */
         if (!hotk)
                 return;
@@ -738,10 +832,24 @@ static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
                 lcd_blank(FB_BLANK_POWERDOWN);
         }
 
-        acpi_bus_generate_proc_event(hotk->device, event,
-                                hotk->event_count[event % 128]++);
-
-        return;
+        acpi_bus_generate_netlink_event(hotk->device->pnp.device_class,
+                                        dev_name(&hotk->device->dev), event,
+                                        hotk->event_count[event % 128]++);
+
+        if (hotk->inputdev) {
+                key = asus_get_entry_by_scancode(event);
+                if (!key)
+                        return ;
+
+                switch (key->type) {
+                case KE_KEY:
+                        input_report_key(hotk->inputdev, key->keycode, 1);
+                        input_sync(hotk->inputdev);
+                        input_report_key(hotk->inputdev, key->keycode, 0);
+                        input_sync(hotk->inputdev);
+                        break;
+                }
+        }
 }
 
 #define ASUS_CREATE_DEVICE_ATTR(_name)                                  \
@@ -959,6 +1067,38 @@ static int asus_hotk_get_info(void)
         return AE_OK;
 }
 
+static int asus_input_init(void)
+{
+        const struct key_entry *key;
+        int result;
+
+        hotk->inputdev = input_allocate_device();
+        if (!hotk->inputdev) {
+                printk(ASUS_INFO "Unable to allocate input device\n");
+                return 0;
+        }
+        hotk->inputdev->name = "Asus Laptop extra buttons";
+        hotk->inputdev->phys = ASUS_HOTK_FILE "/input0";
+        hotk->inputdev->id.bustype = BUS_HOST;
+        hotk->inputdev->getkeycode = asus_getkeycode;
+        hotk->inputdev->setkeycode = asus_setkeycode;
+
+        for (key = asus_keymap; key->type != KE_END; key++) {
+                switch (key->type) {
+                case KE_KEY:
+                        set_bit(EV_KEY, hotk->inputdev->evbit);
+                        set_bit(key->keycode, hotk->inputdev->keybit);
+                        break;
+                }
+        }
+        result = input_register_device(hotk->inputdev);
+        if (result) {
+                printk(ASUS_INFO "Unable to register input device\n");
+                input_free_device(hotk->inputdev);
+        }
+        return result;
+}
+
 static int asus_hotk_check(void)
 {
         int result = 0;
@@ -1044,7 +1184,7 @@ static int asus_hotk_add(struct acpi_device *device)
         /* GPS is on by default */
         write_status(NULL, 1, GPS_ON);
 
-      end:
+end:
         if (result) {
                 kfree(hotk->name);
                 kfree(hotk);
@@ -1091,10 +1231,17 @@ static void asus_led_exit(void)
         ASUS_LED_UNREGISTER(gled);
 }
 
+static void asus_input_exit(void)
+{
+        if (hotk->inputdev)
+                input_unregister_device(hotk->inputdev);
+}
+
 static void __exit asus_laptop_exit(void)
 {
         asus_backlight_exit();
         asus_led_exit();
+        asus_input_exit();
 
         acpi_bus_unregister_driver(&asus_hotk_driver);
         sysfs_remove_group(&asuspf_device->dev.kobj, &asuspf_attribute_group);
@@ -1216,6 +1363,10 @@ static int __init asus_laptop_init(void)
                 printk(ASUS_INFO "Brightness ignored, must be controlled by "
                        "ACPI video driver\n");
 
+        result = asus_input_init();
+        if (result)
+                goto fail_input;
+
         result = asus_led_init(dev);
         if (result)
                 goto fail_led;
@@ -1242,22 +1393,25 @@ static int __init asus_laptop_init(void)
 
         return 0;
 
-      fail_sysfs:
+fail_sysfs:
         platform_device_del(asuspf_device);
 
-      fail_platform_device2:
+fail_platform_device2:
         platform_device_put(asuspf_device);
 
-      fail_platform_device1:
+fail_platform_device1:
         platform_driver_unregister(&asuspf_driver);
 
-      fail_platform_driver:
+fail_platform_driver:
         asus_led_exit();
 
-      fail_led:
+fail_led:
+        asus_input_exit();
+
+fail_input:
         asus_backlight_exit();
 
-      fail_backlight:
+fail_backlight:
 
         return result;
 }
diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
index 1e74988c7b2d..d63f26e666a4 100644
--- a/drivers/platform/x86/asus_acpi.c
+++ b/drivers/platform/x86/asus_acpi.c
@@ -143,6 +143,7 @@ struct asus_hotk {
                                                          S1300N, S5200N*/
                 A4S,            /* Z81sp */
                 F3Sa,           /* (Centrino) */
+                R1F,
                 END_MODEL
         } model;                /* Models currently supported */
         u16 event_count[128];   /* Count for each event TODO make this better */
@@ -420,7 +421,18 @@ static struct model_data model_conf[END_MODEL] = {
                 .display_get    = "\\ADVG",
                 .display_set    = "SDSP",
         },
-
+        {
+                .name = "R1F",
+                .mt_bt_switch = "BLED",
+                .mt_mled = "MLED",
+                .mt_wled = "WLED",
+                .mt_lcd_switch = "\\Q10",
+                .lcd_status = "\\GP06",
+                .brightness_set = "SPLV",
+                .brightness_get = "GPLV",
+                .display_set = "SDSP",
+                .display_get = "\\INFB"
+        }
 };
 
 /* procdir we use */
@@ -1165,6 +1177,8 @@ static int asus_model_match(char *model)
                 return W3V;
         else if (strncmp(model, "W5A", 3) == 0)
                 return W5A;
+        else if (strncmp(model, "R1F", 3) == 0)
+                return R1F;
         else if (strncmp(model, "A4S", 3) == 0)
                 return A4S;
         else if (strncmp(model, "F3Sa", 4) == 0)
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 9d93cb971e59..786ed8661cb0 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -30,6 +30,7 @@
 #include <linux/uaccess.h>
 #include <linux/input.h>
 #include <linux/rfkill.h>
+#include <linux/pci.h>
 
 #define EEEPC_LAPTOP_VERSION    "0.1"
 
@@ -161,6 +162,10 @@ static struct key_entry eeepc_keymap[] = {
         {KE_KEY, 0x13, KEY_MUTE },
         {KE_KEY, 0x14, KEY_VOLUMEDOWN },
         {KE_KEY, 0x15, KEY_VOLUMEUP },
+        {KE_KEY, 0x1a, KEY_COFFEE },
+        {KE_KEY, 0x1b, KEY_ZOOM },
+        {KE_KEY, 0x1c, KEY_PROG2 },
+        {KE_KEY, 0x1d, KEY_PROG3 },
         {KE_KEY, 0x30, KEY_SWITCHVIDEOMODE },
         {KE_KEY, 0x31, KEY_SWITCHVIDEOMODE },
         {KE_KEY, 0x32, KEY_SWITCHVIDEOMODE },
@@ -510,7 +515,43 @@ static int eeepc_hotk_check(void)
 static void notify_brn(void)
 {
         struct backlight_device *bd = eeepc_backlight_device;
-        bd->props.brightness = read_brightness(bd);
+        if (bd)
+                bd->props.brightness = read_brightness(bd);
+}
+
+static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
+{
+        struct pci_dev *dev;
+        struct pci_bus *bus = pci_find_bus(0, 1);
+
+        if (event != ACPI_NOTIFY_BUS_CHECK)
+                return;
+
+        if (!bus) {
+                printk(EEEPC_WARNING "Unable to find PCI bus 1?\n");
+                return;
+        }
+
+        if (get_acpi(CM_ASL_WLAN) == 1) {
+                dev = pci_get_slot(bus, 0);
+                if (dev) {
+                        /* Device already present */
+                        pci_dev_put(dev);
+                        return;
+                }
+                dev = pci_scan_single_device(bus, 0);
+                if (dev) {
+                        pci_bus_assign_resources(bus);
+                        if (pci_bus_add_device(dev))
+                                printk(EEEPC_ERR "Unable to hotplug wifi\n");
+                }
+        } else {
+                dev = pci_get_slot(bus, 0);
+                if (dev) {
+                        pci_remove_bus_device(dev);
+                        pci_dev_put(dev);
+                }
+        }
 }
 
 static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
@@ -520,8 +561,9 @@ static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
                 return;
         if (event >= NOTIFY_BRN_MIN && event <= NOTIFY_BRN_MAX)
                 notify_brn();
-        acpi_bus_generate_proc_event(ehotk->device, event,
-                                     ehotk->event_count[event % 128]++);
+        acpi_bus_generate_netlink_event(ehotk->device->pnp.device_class,
+                                        dev_name(&ehotk->device->dev), event,
+                                        ehotk->event_count[event % 128]++);
         if (ehotk->inputdev) {
                 key = eepc_get_entry_by_scancode(event);
                 if (key) {
@@ -539,6 +581,45 @@ static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
         }
 }
 
+static int eeepc_register_rfkill_notifier(char *node)
+{
+        acpi_status status = AE_OK;
+        acpi_handle handle;
+
+        status = acpi_get_handle(NULL, node, &handle);
+
+        if (ACPI_SUCCESS(status)) {
+                status = acpi_install_notify_handler(handle,
+                                                     ACPI_SYSTEM_NOTIFY,
+                                                     eeepc_rfkill_notify,
+                                                     NULL);
+                if (ACPI_FAILURE(status))
+                        printk(EEEPC_WARNING
+                               "Failed to register notify on %s\n", node);
+        } else
+                return -ENODEV;
+
+        return 0;
+}
+
+static void eeepc_unregister_rfkill_notifier(char *node)
+{
+        acpi_status status = AE_OK;
+        acpi_handle handle;
+
+        status = acpi_get_handle(NULL, node, &handle);
+
+        if (ACPI_SUCCESS(status)) {
+                status = acpi_remove_notify_handler(handle,
+                                                     ACPI_SYSTEM_NOTIFY,
+                                                     eeepc_rfkill_notify);
+                if (ACPI_FAILURE(status))
+                        printk(EEEPC_ERR
+                               "Error removing rfkill notify handler %s\n",
+                                node);
+        }
+}
+
 static int eeepc_hotk_add(struct acpi_device *device)
 {
         acpi_status status = AE_OK;
@@ -558,7 +639,7 @@ static int eeepc_hotk_add(struct acpi_device *device)
         ehotk->device = device;
         result = eeepc_hotk_check();
         if (result)
-                goto end;
+                goto ehotk_fail;
         status = acpi_install_notify_handler(ehotk->handle, ACPI_SYSTEM_NOTIFY,
                                              eeepc_hotk_notify, ehotk);
         if (ACPI_FAILURE(status))
@@ -569,18 +650,25 @@ static int eeepc_hotk_add(struct acpi_device *device)
                                                            RFKILL_TYPE_WLAN);
 
                 if (!ehotk->eeepc_wlan_rfkill)
-                        goto end;
+                        goto wlan_fail;
 
                 ehotk->eeepc_wlan_rfkill->name = "eeepc-wlan";
                 ehotk->eeepc_wlan_rfkill->toggle_radio = eeepc_wlan_rfkill_set;
                 ehotk->eeepc_wlan_rfkill->get_state = eeepc_wlan_rfkill_state;
-                if (get_acpi(CM_ASL_WLAN) == 1)
+                if (get_acpi(CM_ASL_WLAN) == 1) {
                         ehotk->eeepc_wlan_rfkill->state =
                                 RFKILL_STATE_UNBLOCKED;
-                else
+                        rfkill_set_default(RFKILL_TYPE_WLAN,
+                                           RFKILL_STATE_UNBLOCKED);
+                } else {
                         ehotk->eeepc_wlan_rfkill->state =
                                 RFKILL_STATE_SOFT_BLOCKED;
-                rfkill_register(ehotk->eeepc_wlan_rfkill);
+                        rfkill_set_default(RFKILL_TYPE_WLAN,
+                                           RFKILL_STATE_SOFT_BLOCKED);
+                }
+                result = rfkill_register(ehotk->eeepc_wlan_rfkill);
+                if (result)
+                        goto wlan_fail;
         }
 
         if (get_acpi(CM_ASL_BLUETOOTH) != -1) {
@@ -588,27 +676,47 @@ static int eeepc_hotk_add(struct acpi_device *device)
                         rfkill_allocate(&device->dev, RFKILL_TYPE_BLUETOOTH);
 
                 if (!ehotk->eeepc_bluetooth_rfkill)
-                        goto end;
+                        goto bluetooth_fail;
 
                 ehotk->eeepc_bluetooth_rfkill->name = "eeepc-bluetooth";
                 ehotk->eeepc_bluetooth_rfkill->toggle_radio =
                         eeepc_bluetooth_rfkill_set;
                 ehotk->eeepc_bluetooth_rfkill->get_state =
                         eeepc_bluetooth_rfkill_state;
-                if (get_acpi(CM_ASL_BLUETOOTH) == 1)
+                if (get_acpi(CM_ASL_BLUETOOTH) == 1) {
                         ehotk->eeepc_bluetooth_rfkill->state =
                                 RFKILL_STATE_UNBLOCKED;
-                else
+                        rfkill_set_default(RFKILL_TYPE_BLUETOOTH,
+                                           RFKILL_STATE_UNBLOCKED);
+                } else {
                         ehotk->eeepc_bluetooth_rfkill->state =
                                 RFKILL_STATE_SOFT_BLOCKED;
-                rfkill_register(ehotk->eeepc_bluetooth_rfkill);
-        }
+                        rfkill_set_default(RFKILL_TYPE_BLUETOOTH,
+                                           RFKILL_STATE_SOFT_BLOCKED);
+                }
 
- end:
-        if (result) {
-                kfree(ehotk);
-                ehotk = NULL;
+                result = rfkill_register(ehotk->eeepc_bluetooth_rfkill);
+                if (result)
+                        goto bluetooth_fail;
         }
+
+        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P6");
+        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P7");
+
+        return 0;
+
+ bluetooth_fail:
+        if (ehotk->eeepc_bluetooth_rfkill)
+                rfkill_free(ehotk->eeepc_bluetooth_rfkill);
+        rfkill_unregister(ehotk->eeepc_wlan_rfkill);
+        ehotk->eeepc_wlan_rfkill = NULL;
+ wlan_fail:
+        if (ehotk->eeepc_wlan_rfkill)
+                rfkill_free(ehotk->eeepc_wlan_rfkill);
+ ehotk_fail:
+        kfree(ehotk);
+        ehotk = NULL;
+
         return result;
 }
 
@@ -622,6 +730,10 @@ static int eeepc_hotk_remove(struct acpi_device *device, int type)
                                             eeepc_hotk_notify);
         if (ACPI_FAILURE(status))
                 printk(EEEPC_ERR "Error removing notify handler\n");
+
+        eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P6");
+        eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P7");
+
         kfree(ehotk);
         return 0;
 }
@@ -737,13 +849,21 @@ static void eeepc_backlight_exit(void)
 {
         if (eeepc_backlight_device)
                 backlight_device_unregister(eeepc_backlight_device);
-        if (ehotk->inputdev)
-                input_unregister_device(ehotk->inputdev);
+        eeepc_backlight_device = NULL;
+}
+
+static void eeepc_rfkill_exit(void)
+{
         if (ehotk->eeepc_wlan_rfkill)
                 rfkill_unregister(ehotk->eeepc_wlan_rfkill);
         if (ehotk->eeepc_bluetooth_rfkill)
                 rfkill_unregister(ehotk->eeepc_bluetooth_rfkill);
-        eeepc_backlight_device = NULL;
+}
+
+static void eeepc_input_exit(void)
+{
+        if (ehotk->inputdev)
+                input_unregister_device(ehotk->inputdev);
 }
 
 static void eeepc_hwmon_exit(void)
@@ -762,6 +882,8 @@ static void eeepc_hwmon_exit(void)
 static void __exit eeepc_laptop_exit(void)
 {
         eeepc_backlight_exit();
+        eeepc_rfkill_exit();
+        eeepc_input_exit();
         eeepc_hwmon_exit();
         acpi_bus_unregister_driver(&eeepc_hotk_driver);
         sysfs_remove_group(&platform_device->dev.kobj,
@@ -865,6 +987,8 @@ fail_platform_driver:
 fail_hwmon:
         eeepc_backlight_exit();
 fail_backlight:
+        eeepc_input_exit();
+        eeepc_rfkill_exit();
         return result;
 }
 
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index de91ddab0a86..f41135f2fb29 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -463,9 +463,11 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
 
         return 0;
 register_wwan_err:
-        rfkill_unregister(bluetooth_rfkill);
+        if (bluetooth_rfkill)
+                rfkill_unregister(bluetooth_rfkill);
 register_bluetooth_error:
-        rfkill_unregister(wifi_rfkill);
+        if (wifi_rfkill)
+                rfkill_unregister(wifi_rfkill);
 add_sysfs_error:
         cleanup_sysfs(device);
         return err;
diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
index f30db367c82e..c47a44dcb702 100644
--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -507,7 +507,7 @@ static void acpi_pcc_generate_keyinput(struct pcc_acpi *pcc)
 
         hkey_num = result & 0xf;
 
-        if (hkey_num < 0 || hkey_num > ARRAY_SIZE(pcc->keymap)) {
+        if (hkey_num < 0 || hkey_num >= ARRAY_SIZE(pcc->keymap)) {
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "hotkey number out of range: %d\n",
                                   hkey_num));
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index cced4d108319..81450fbd8b12 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -241,6 +241,12 @@ config RTC_DRV_M41T80_WDT
           If you say Y here you will get support for the
           watchdog timer in the ST M41T60 and M41T80 RTC chips series.
 
+config RTC_DRV_DM355EVM
+        tristate "TI DaVinci DM355 EVM RTC"
+        depends on MFD_DM355EVM_MSP
+        help
+          Supports the RTC firmware in the MSP430 on the DM355 EVM.
+
 config RTC_DRV_TWL92330
         boolean "TI TWL92330/Menelaus"
         depends on MENELAUS
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 6e28021abb9d..0e697aa51caa 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_RTC_DRV_AT91SAM9)	+= rtc-at91sam9.o
 obj-$(CONFIG_RTC_DRV_AU1XXX)    += rtc-au1xxx.o
 obj-$(CONFIG_RTC_DRV_BFIN)      += rtc-bfin.o
 obj-$(CONFIG_RTC_DRV_CMOS)      += rtc-cmos.o
+obj-$(CONFIG_RTC_DRV_DM355EVM)  += rtc-dm355evm.o
 obj-$(CONFIG_RTC_DRV_DS1216)    += rtc-ds1216.o
 obj-$(CONFIG_RTC_DRV_DS1286)    += rtc-ds1286.o
 obj-$(CONFIG_RTC_DRV_DS1302)    += rtc-ds1302.o
diff --git a/drivers/rtc/rtc-dm355evm.c b/drivers/rtc/rtc-dm355evm.c
new file mode 100644
index 000000000000..58d4e18530da
--- /dev/null
+++ b/drivers/rtc/rtc-dm355evm.c
@@ -0,0 +1,175 @@
+/*
+ * rtc-dm355evm.c - access battery-backed counter in MSP430 firmware
+ *
+ * Copyright (c) 2008 by David Brownell
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/rtc.h>
+#include <linux/platform_device.h>
+
+#include <linux/i2c/dm355evm_msp.h>
+
+
+/*
+ * The MSP430 firmware on the DM355 EVM uses a watch crystal to feed
+ * a 1 Hz counter.  When a backup battery is supplied, that makes a
+ * reasonable RTC for applications where alarms and non-NTP drift
+ * compensation aren't important.
+ *
+ * The only real glitch is the inability to read or write all four
+ * counter bytes atomically:  the count may increment in the middle
+ * of an operation, causing trouble when the LSB rolls over.
+ *
+ * This driver was tested with firmware revision A4.
+ */
+union evm_time {
+        u8      bytes[4];
+        u32     value;
+};
+
+static int dm355evm_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+        union evm_time  time;
+        int             status;
+        int             tries = 0;
+
+        do {
+                /*
+                 * Read LSB(0) to MSB(3) bytes.  Defend against the counter
+                 * rolling over by re-reading until the value is stable,
+                 * and assuming the four reads take at most a few seconds.
+                 */
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_0);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[0] == status)
+                        break;
+                time.bytes[0] = status;
+
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_1);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[1] == status)
+                        break;
+                time.bytes[1] = status;
+
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_2);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[2] == status)
+                        break;
+                time.bytes[2] = status;
+
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_3);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[3] == status)
+                        break;
+                time.bytes[3] = status;
+
+        } while (++tries < 5);
+
+        dev_dbg(dev, "read timestamp %08x\n", time.value);
+
+        rtc_time_to_tm(le32_to_cpu(time.value), tm);
+        return 0;
+}
+
+static int dm355evm_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+        union evm_time  time;
+        unsigned long   value;
+        int             status;
+
+        rtc_tm_to_time(tm, &value);
+        time.value = cpu_to_le32(value);
+
+        dev_dbg(dev, "write timestamp %08x\n", time.value);
+
+        /*
+         * REVISIT handle non-atomic writes ... maybe just retry until
+         * byte[1] sticks (no rollover)?
+         */
+        status = dm355evm_msp_write(time.bytes[0], DM355EVM_MSP_RTC_0);
+        if (status < 0)
+                return status;
+
+        status = dm355evm_msp_write(time.bytes[1], DM355EVM_MSP_RTC_1);
+        if (status < 0)
+                return status;
+
+        status = dm355evm_msp_write(time.bytes[2], DM355EVM_MSP_RTC_2);
+        if (status < 0)
+                return status;
+
+        status = dm355evm_msp_write(time.bytes[3], DM355EVM_MSP_RTC_3);
+        if (status < 0)
+                return status;
+
+        return 0;
+}
+
+static struct rtc_class_ops dm355evm_rtc_ops = {
+        .read_time      = dm355evm_rtc_read_time,
+        .set_time       = dm355evm_rtc_set_time,
+};
+
+/*----------------------------------------------------------------------*/
+
+static int __devinit dm355evm_rtc_probe(struct platform_device *pdev)
+{
+        struct rtc_device *rtc;
+
+        rtc = rtc_device_register(pdev->name,
+                                  &pdev->dev, &dm355evm_rtc_ops, THIS_MODULE);
+        if (IS_ERR(rtc)) {
+                dev_err(&pdev->dev, "can't register RTC device, err %ld\n",
+                        PTR_ERR(rtc));
+                return PTR_ERR(rtc);
+        }
+        platform_set_drvdata(pdev, rtc);
+
+        return 0;
+}
+
+static int __devexit dm355evm_rtc_remove(struct platform_device *pdev)
+{
+        struct rtc_device *rtc = platform_get_drvdata(pdev);
+
+        rtc_device_unregister(rtc);
+        platform_set_drvdata(pdev, NULL);
+        return 0;
+}
+
+/*
+ * I2C is used to talk to the MSP430, but this platform device is
+ * exposed by an MFD driver that manages I2C communications.
+ */
+static struct platform_driver rtc_dm355evm_driver = {
+        .probe          = dm355evm_rtc_probe,
+        .remove         = __devexit_p(dm355evm_rtc_remove),
+        .driver         = {
+                .owner  = THIS_MODULE,
+                .name   = "rtc-dm355evm",
+        },
+};
+
+static int __init dm355evm_rtc_init(void)
+{
+        return platform_driver_register(&rtc_dm355evm_driver);
+}
+module_init(dm355evm_rtc_init);
+
+static void __exit dm355evm_rtc_exit(void)
+{
+        platform_driver_unregister(&rtc_dm355evm_driver);
+}
+module_exit(dm355evm_rtc_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/rtc/rtc-ds1390.c b/drivers/rtc/rtc-ds1390.c
index e54b5c619bdf..e01b955db077 100644
--- a/drivers/rtc/rtc-ds1390.c
+++ b/drivers/rtc/rtc-ds1390.c
@@ -122,7 +122,6 @@ static const struct rtc_class_ops ds1390_rtc_ops = {
 
 static int __devinit ds1390_probe(struct spi_device *spi)
 {
-        struct rtc_device *rtc;
         unsigned char tmp;
         struct ds1390 *chip;
         int res;
diff --git a/drivers/staging/android/Kconfig b/drivers/staging/android/Kconfig
index 6b996db0dd6a..604bd1e0d546 100644
--- a/drivers/staging/android/Kconfig
+++ b/drivers/staging/android/Kconfig
@@ -27,6 +27,7 @@ menuconfig ANDROID_RAM_CONSOLE_ERROR_CORRECTION
         bool "Android RAM Console Enable error correction"
         default n
         depends on ANDROID_RAM_CONSOLE
+        depends on !ANDROID_RAM_CONSOLE_EARLY_INIT
         select REED_SOLOMON
         select REED_SOLOMON_ENC8
         select REED_SOLOMON_DEC8
diff --git a/drivers/staging/android/ram_console.c b/drivers/staging/android/ram_console.c
index bf006857a87a..643ac5ce381d 100644
--- a/drivers/staging/android/ram_console.c
+++ b/drivers/staging/android/ram_console.c
@@ -224,9 +224,23 @@ static int __init ram_console_init(struct ram_console_buffer *buffer,
         ram_console_buffer_size =
                 buffer_size - sizeof(struct ram_console_buffer);
 
+        if (ram_console_buffer_size > buffer_size) {
+                pr_err("ram_console: buffer %p, invalid size %d, datasize %d\n",
+                       buffer, buffer_size, ram_console_buffer_size);
+                return 0;
+        }
+
 #ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
         ram_console_buffer_size -= (DIV_ROUND_UP(ram_console_buffer_size,
                                                 ECC_BLOCK_SIZE) + 1) * ECC_SIZE;
+
+        if (ram_console_buffer_size > buffer_size) {
+                pr_err("ram_console: buffer %p, invalid size %d, "
+                       "non-ecc datasize %d\n",
+                       buffer, buffer_size, ram_console_buffer_size);
+                return 0;
+        }
+
         ram_console_par_buffer = buffer->data + ram_console_buffer_size;
 
 
diff --git a/drivers/staging/android/timed_gpio.c b/drivers/staging/android/timed_gpio.c
index 903270cbbe02..33daff0481d2 100644
--- a/drivers/staging/android/timed_gpio.c
+++ b/drivers/staging/android/timed_gpio.c
@@ -50,7 +50,7 @@ static ssize_t gpio_enable_show(struct device *dev, struct device_attribute *att
         if (hrtimer_active(&gpio_data->timer)) {
                 ktime_t r = hrtimer_get_remaining(&gpio_data->timer);
                 struct timeval t = ktime_to_timeval(r);
-                remaining = t.tv_sec * 1000 + t.tv_usec;
+                remaining = t.tv_sec * 1000 + t.tv_usec / 1000;
         } else
                 remaining = 0;
 
diff --git a/drivers/staging/at76_usb/Kconfig b/drivers/staging/at76_usb/Kconfig
index 4c0e55e15448..8606f9621624 100644
--- a/drivers/staging/at76_usb/Kconfig
+++ b/drivers/staging/at76_usb/Kconfig
@@ -1,6 +1,6 @@
 config USB_ATMEL
         tristate "Atmel at76c503/at76c505/at76c505a USB cards"
-        depends on MAC80211 && WLAN_80211 && USB
+        depends on WLAN_80211 && USB
         default N
         select FW_LOADER
         ---help---
diff --git a/drivers/staging/at76_usb/at76_usb.c b/drivers/staging/at76_usb/at76_usb.c
index 185533e54769..c8e4d31c7df2 100644
--- a/drivers/staging/at76_usb/at76_usb.c
+++ b/drivers/staging/at76_usb/at76_usb.c
@@ -6,7 +6,6 @@
  * Copyright (c) 2004 Nick Jones
  * Copyright (c) 2004 Balint Seeber <n0_5p4m_p13453@hotmail.com>
  * Copyright (c) 2007 Guido Guenther <agx@sigxcpu.org>
- * Copyright (c) 2007 Kalle Valo <kalle.valo@iki.fi>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
@@ -17,13 +16,6 @@
  * Atmel AT76C503A/505/505A.
  *
  * Some iw_handler code was taken from airo.c, (C) 1999 Benjamin Reed
- *
- * TODO for the mac80211 port:
- * o adhoc support
- * o RTS/CTS support
- * o Power Save Mode support
- * o support for short/long preambles
- * o export variables through debugfs/sysfs
  */
 
 #include <linux/init.h>
@@ -44,7 +36,7 @@
 #include <net/ieee80211_radiotap.h>
 #include <linux/firmware.h>
 #include <linux/leds.h>
-#include <net/mac80211.h>
+#include <net/ieee80211.h>
 
 #include "at76_usb.h"
 
@@ -84,43 +76,31 @@
 #define DBG_WE_EVENTS           0x08000000      /* dump wireless events */
 #define DBG_FW                  0x10000000      /* firmware download */
 #define DBG_DFU                 0x20000000      /* device firmware upgrade */
-#define DBG_CMD                 0x40000000
-#define DBG_MAC80211            0x80000000
 
 #define DBG_DEFAULTS            0
 
 /* Use our own dbg macro */
 #define at76_dbg(bits, format, arg...) \
-do {    \
-        if (at76_debug & (bits))        \
-                printk(KERN_DEBUG DRIVER_NAME ": " format "\n" , ## arg); \
-} while (0)
-
-#define at76_dbg_dump(bits, buf, len, format, arg...)   \
-do {    \
-        if (at76_debug & (bits)) {      \
+        do { \
+                if (at76_debug & (bits)) \
                 printk(KERN_DEBUG DRIVER_NAME ": " format "\n" , ## arg); \
-                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, buf, len); \
-                }                                                       \
-} while (0)
+        } while (0)
 
 static int at76_debug = DBG_DEFAULTS;
 
-#define FIRMWARE_IS_WPA(ver) ((ver.major == 1) && (ver.minor == 103))
-
 /* Protect against concurrent firmware loading and parsing */
 static struct mutex fw_mutex;
 
 static struct fwentry firmwares[] = {
-        [0] = { "" },
-        [BOARD_503_ISL3861] = { "atmel_at76c503-i3861.bin" },
-        [BOARD_503_ISL3863] = { "atmel_at76c503-i3863.bin" },
-        [BOARD_503] = { "atmel_at76c503-rfmd.bin" },
-        [BOARD_503_ACC] = { "atmel_at76c503-rfmd-acc.bin" },
-        [BOARD_505] = { "atmel_at76c505-rfmd.bin" },
-        [BOARD_505_2958] = { "atmel_at76c505-rfmd2958.bin" },
-        [BOARD_505A] = { "atmel_at76c505a-rfmd2958.bin" },
-        [BOARD_505AMX] = { "atmel_at76c505amx-rfmd.bin" },
+        [0] = {""},
+        [BOARD_503_ISL3861] = {"atmel_at76c503-i3861.bin"},
+        [BOARD_503_ISL3863] = {"atmel_at76c503-i3863.bin"},
+        [BOARD_503] = {"atmel_at76c503-rfmd.bin"},
+        [BOARD_503_ACC] = {"atmel_at76c503-rfmd-acc.bin"},
+        [BOARD_505] = {"atmel_at76c505-rfmd.bin"},
+        [BOARD_505_2958] = {"atmel_at76c505-rfmd2958.bin"},
+        [BOARD_505A] = {"atmel_at76c505a-rfmd2958.bin"},
+        [BOARD_505AMX] = {"atmel_at76c505amx-rfmd.bin"},
 };
 
 #define USB_DEVICE_DATA(__ops)  .driver_info = (kernel_ulong_t)(__ops)
@@ -130,133 +110,135 @@ static struct usb_device_id dev_table[] = {
          * at76c503-i3861
          */
         /* Generic AT76C503/3861 device */
-        { USB_DEVICE(0x03eb, 0x7603), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x03eb, 0x7603), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Linksys WUSB11 v2.1/v2.6 */
-        { USB_DEVICE(0x066b, 0x2211), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x066b, 0x2211), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Netgear MA101 rev. A */
-        { USB_DEVICE(0x0864, 0x4100), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0864, 0x4100), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Tekram U300C / Allnet ALL0193 */
-        { USB_DEVICE(0x0b3b, 0x1612), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0b3b, 0x1612), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* HP HN210W J7801A */
-        { USB_DEVICE(0x03f0, 0x011c), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x03f0, 0x011c), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Sitecom/Z-Com/Zyxel M4Y-750 */
-        { USB_DEVICE(0x0cde, 0x0001), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0cde, 0x0001), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Dynalink/Askey WLL013 (intersil) */
-        { USB_DEVICE(0x069a, 0x0320), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x069a, 0x0320), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* EZ connect 11Mpbs Wireless USB Adapter SMC2662W v1 */
-        { USB_DEVICE(0x0d5c, 0xa001), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0d5c, 0xa001), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* BenQ AWL300 */
-        { USB_DEVICE(0x04a5, 0x9000), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x04a5, 0x9000), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Addtron AWU-120, Compex WLU11 */
-        { USB_DEVICE(0x05dd, 0xff31), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x05dd, 0xff31), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Intel AP310 AnyPoint II USB */
-        { USB_DEVICE(0x8086, 0x0200), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x8086, 0x0200), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Dynalink L11U */
-        { USB_DEVICE(0x0d8e, 0x7100), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0d8e, 0x7100), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Arescom WL-210, FCC id 07J-GL2411USB */
-        { USB_DEVICE(0x0d8e, 0x7110), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0d8e, 0x7110), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* I-O DATA WN-B11/USB */
-        { USB_DEVICE(0x04bb, 0x0919), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x04bb, 0x0919), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* BT Voyager 1010 */
-        { USB_DEVICE(0x069a, 0x0821), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x069a, 0x0821), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /*
          * at76c503-i3863
          */
         /* Generic AT76C503/3863 device */
-        { USB_DEVICE(0x03eb, 0x7604), USB_DEVICE_DATA(BOARD_503_ISL3863) },
+        {USB_DEVICE(0x03eb, 0x7604), USB_DEVICE_DATA(BOARD_503_ISL3863)},
         /* Samsung SWL-2100U */
-        { USB_DEVICE(0x055d, 0xa000), USB_DEVICE_DATA(BOARD_503_ISL3863) },
+        {USB_DEVICE(0x055d, 0xa000), USB_DEVICE_DATA(BOARD_503_ISL3863)},
         /*
          * at76c503-rfmd
          */
         /* Generic AT76C503/RFMD device */
-        { USB_DEVICE(0x03eb, 0x7605), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x03eb, 0x7605), USB_DEVICE_DATA(BOARD_503)},
         /* Dynalink/Askey WLL013 (rfmd) */
-        { USB_DEVICE(0x069a, 0x0321), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x069a, 0x0321), USB_DEVICE_DATA(BOARD_503)},
         /* Linksys WUSB11 v2.6 */
-        { USB_DEVICE(0x077b, 0x2219), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x077b, 0x2219), USB_DEVICE_DATA(BOARD_503)},
         /* Network Everywhere NWU11B */
-        { USB_DEVICE(0x077b, 0x2227), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x077b, 0x2227), USB_DEVICE_DATA(BOARD_503)},
         /* Netgear MA101 rev. B */
-        { USB_DEVICE(0x0864, 0x4102), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x0864, 0x4102), USB_DEVICE_DATA(BOARD_503)},
         /* D-Link DWL-120 rev. E */
-        { USB_DEVICE(0x2001, 0x3200), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x2001, 0x3200), USB_DEVICE_DATA(BOARD_503)},
         /* Actiontec 802UAT1, HWU01150-01UK */
-        { USB_DEVICE(0x1668, 0x7605), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1668, 0x7605), USB_DEVICE_DATA(BOARD_503)},
         /* AirVast W-Buddie WN210 */
-        { USB_DEVICE(0x03eb, 0x4102), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x03eb, 0x4102), USB_DEVICE_DATA(BOARD_503)},
         /* Dick Smith Electronics XH1153 802.11b USB adapter */
-        { USB_DEVICE(0x1371, 0x5743), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1371, 0x5743), USB_DEVICE_DATA(BOARD_503)},
         /* CNet CNUSB611 */
-        { USB_DEVICE(0x1371, 0x0001), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1371, 0x0001), USB_DEVICE_DATA(BOARD_503)},
         /* FiberLine FL-WL200U */
-        { USB_DEVICE(0x1371, 0x0002), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1371, 0x0002), USB_DEVICE_DATA(BOARD_503)},
         /* BenQ AWL400 USB stick */
-        { USB_DEVICE(0x04a5, 0x9001), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x04a5, 0x9001), USB_DEVICE_DATA(BOARD_503)},
         /* 3Com 3CRSHEW696 */
-        { USB_DEVICE(0x0506, 0x0a01), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x0506, 0x0a01), USB_DEVICE_DATA(BOARD_503)},
         /* Siemens Santis ADSL WLAN USB adapter WLL 013 */
-        { USB_DEVICE(0x0681, 0x001b), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x0681, 0x001b), USB_DEVICE_DATA(BOARD_503)},
         /* Belkin F5D6050, version 2 */
-        { USB_DEVICE(0x050d, 0x0050), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x050d, 0x0050), USB_DEVICE_DATA(BOARD_503)},
         /* iBlitzz, BWU613 (not *B or *SB) */
-        { USB_DEVICE(0x07b8, 0xb000), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x07b8, 0xb000), USB_DEVICE_DATA(BOARD_503)},
         /* Gigabyte GN-WLBM101 */
-        { USB_DEVICE(0x1044, 0x8003), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1044, 0x8003), USB_DEVICE_DATA(BOARD_503)},
         /* Planex GW-US11S */
-        { USB_DEVICE(0x2019, 0x3220), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x2019, 0x3220), USB_DEVICE_DATA(BOARD_503)},
         /* Internal WLAN adapter in h5[4,5]xx series iPAQs */
-        { USB_DEVICE(0x049f, 0x0032), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x049f, 0x0032), USB_DEVICE_DATA(BOARD_503)},
         /* Corega Wireless LAN USB-11 mini */
-        { USB_DEVICE(0x07aa, 0x0011), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x07aa, 0x0011), USB_DEVICE_DATA(BOARD_503)},
         /* Corega Wireless LAN USB-11 mini2 */
-        { USB_DEVICE(0x07aa, 0x0018), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x07aa, 0x0018), USB_DEVICE_DATA(BOARD_503)},
         /* Uniden PCW100 */
-        { USB_DEVICE(0x05dd, 0xff35), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x05dd, 0xff35), USB_DEVICE_DATA(BOARD_503)},
         /*
          * at76c503-rfmd-acc
          */
         /* SMC2664W */
-        { USB_DEVICE(0x083a, 0x3501), USB_DEVICE_DATA(BOARD_503_ACC) },
+        {USB_DEVICE(0x083a, 0x3501), USB_DEVICE_DATA(BOARD_503_ACC)},
         /* Belkin F5D6050, SMC2662W v2, SMC2662W-AR */
-        { USB_DEVICE(0x0d5c, 0xa002), USB_DEVICE_DATA(BOARD_503_ACC) },
+        {USB_DEVICE(0x0d5c, 0xa002), USB_DEVICE_DATA(BOARD_503_ACC)},
         /*
          * at76c505-rfmd
          */
         /* Generic AT76C505/RFMD */
-        { USB_DEVICE(0x03eb, 0x7606), USB_DEVICE_DATA(BOARD_505) },
+        {USB_DEVICE(0x03eb, 0x7606), USB_DEVICE_DATA(BOARD_505)},
         /*
          * at76c505-rfmd2958
          */
         /* Generic AT76C505/RFMD, OvisLink WL-1130USB */
-        { USB_DEVICE(0x03eb, 0x7613), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x03eb, 0x7613), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Fiberline FL-WL240U */
-        { USB_DEVICE(0x1371, 0x0014), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x1371, 0x0014), USB_DEVICE_DATA(BOARD_505_2958)},
         /* CNet CNUSB-611G */
-        { USB_DEVICE(0x1371, 0x0013), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x1371, 0x0013), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Linksys WUSB11 v2.8 */
-        { USB_DEVICE(0x1915, 0x2233), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x1915, 0x2233), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Xterasys XN-2122B, IBlitzz BWU613B/BWU613SB */
-        { USB_DEVICE(0x12fd, 0x1001), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x12fd, 0x1001), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Corega WLAN USB Stick 11 */
-        { USB_DEVICE(0x07aa, 0x7613), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x07aa, 0x7613), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Microstar MSI Box MS6978 */
-        { USB_DEVICE(0x0db0, 0x1020), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x0db0, 0x1020), USB_DEVICE_DATA(BOARD_505_2958)},
         /*
          * at76c505a-rfmd2958
          */
         /* Generic AT76C505A device */
-        { USB_DEVICE(0x03eb, 0x7614), USB_DEVICE_DATA(BOARD_505A) },
+        {USB_DEVICE(0x03eb, 0x7614), USB_DEVICE_DATA(BOARD_505A)},
         /* Generic AT76C505AS device */
-        { USB_DEVICE(0x03eb, 0x7617), USB_DEVICE_DATA(BOARD_505A) },
+        {USB_DEVICE(0x03eb, 0x7617), USB_DEVICE_DATA(BOARD_505A)},
         /* Siemens Gigaset USB WLAN Adapter 11 */
-        { USB_DEVICE(0x1690, 0x0701), USB_DEVICE_DATA(BOARD_505A) },
+        {USB_DEVICE(0x1690, 0x0701), USB_DEVICE_DATA(BOARD_505A)},
+        /* OQO Model 01+ Internal Wi-Fi */
+        {USB_DEVICE(0x1557, 0x0002), USB_DEVICE_DATA(BOARD_505A)},
         /*
          * at76c505amx-rfmd
          */
         /* Generic AT76C505AMX device */
-        { USB_DEVICE(0x03eb, 0x7615), USB_DEVICE_DATA(BOARD_505AMX) },
-        { }
+        {USB_DEVICE(0x03eb, 0x7615), USB_DEVICE_DATA(BOARD_505AMX)},
+        {}
 };
 
 MODULE_DEVICE_TABLE(usb, dev_table);
@@ -264,8 +246,26 @@ MODULE_DEVICE_TABLE(usb, dev_table);
 /* Supported rates of this hardware, bit 7 marks basic rates */
 static const u8 hw_rates[] = { 0x82, 0x84, 0x0b, 0x16 };
 
+/* Frequency of each channel in MHz */
+static const long channel_frequency[] = {
+        2412, 2417, 2422, 2427, 2432, 2437, 2442,
+        2447, 2452, 2457, 2462, 2467, 2472, 2484
+};
+
+#define NUM_CHANNELS ARRAY_SIZE(channel_frequency)
+
 static const char *const preambles[] = { "long", "short", "auto" };
 
+static const char *const mac_states[] = {
+        [MAC_INIT] = "INIT",
+        [MAC_SCANNING] = "SCANNING",
+        [MAC_AUTH] = "AUTH",
+        [MAC_ASSOC] = "ASSOC",
+        [MAC_JOINING] = "JOINING",
+        [MAC_CONNECTED] = "CONNECTED",
+        [MAC_OWN_IBSS] = "OWN_IBSS"
+};
+
 /* Firmware download */
 /* DFU states */
 #define STATE_IDLE                      0x00
@@ -300,30 +300,17 @@ struct dfu_status {
 
 static inline int at76_is_intersil(enum board_type board)
 {
-        if (board == BOARD_503_ISL3861 || board == BOARD_503_ISL3863)
-                return 1;
-        return 0;
+        return (board == BOARD_503_ISL3861 || board == BOARD_503_ISL3863);
 }
 
 static inline int at76_is_503rfmd(enum board_type board)
 {
-        if (board == BOARD_503 || board == BOARD_503_ACC)
-                return 1;
-        return 0;
-}
-
-static inline int at76_is_505(enum board_type board)
-{
-        if (board == BOARD_505 || board == BOARD_505_2958)
-                return 1;
-        return 0;
+        return (board == BOARD_503 || board == BOARD_503_ACC);
 }
 
 static inline int at76_is_505a(enum board_type board)
 {
-        if (board == BOARD_505A || board == BOARD_505AMX)
-                return 1;
-        return 0;
+        return (board == BOARD_505A || board == BOARD_505AMX);
 }
 
 /* Load a block of the first (internal) part of the firmware */
@@ -504,6 +491,41 @@ exit:
         return ret;
 }
 
+/* Report that the scan results are ready */
+static inline void at76_iwevent_scan_complete(struct net_device *netdev)
+{
+        union iwreq_data wrqu;
+        wrqu.data.length = 0;
+        wrqu.data.flags = 0;
+        wireless_send_event(netdev, SIOCGIWSCAN, &wrqu, NULL);
+        at76_dbg(DBG_WE_EVENTS, "%s: SIOCGIWSCAN sent", netdev->name);
+}
+
+static inline void at76_iwevent_bss_connect(struct net_device *netdev,
+                                            u8 *bssid)
+{
+        union iwreq_data wrqu;
+        wrqu.data.length = 0;
+        wrqu.data.flags = 0;
+        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(netdev, SIOCGIWAP, &wrqu, NULL);
+        at76_dbg(DBG_WE_EVENTS, "%s: %s: SIOCGIWAP sent", netdev->name,
+                 __func__);
+}
+
+static inline void at76_iwevent_bss_disconnect(struct net_device *netdev)
+{
+        union iwreq_data wrqu;
+        wrqu.data.length = 0;
+        wrqu.data.flags = 0;
+        memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(netdev, SIOCGIWAP, &wrqu, NULL);
+        at76_dbg(DBG_WE_EVENTS, "%s: %s: SIOCGIWAP sent", netdev->name,
+                 __func__);
+}
+
 #define HEX2STR_BUFFERS 4
 #define HEX2STR_MAX_LEN 64
 #define BIN2HEX(x) ((x) < 10 ? '0' + (x) : (x) + 'A' - 10)
@@ -575,6 +597,37 @@ static void at76_ledtrig_tx_activity(void)
                 mod_timer(&ledtrig_tx_timer, jiffies + HZ / 4);
 }
 
+/* Check if the given ssid is hidden */
+static inline int at76_is_hidden_ssid(u8 *ssid, int length)
+{
+        static const u8 zeros[32];
+
+        if (length == 0)
+                return 1;
+
+        if (length == 1 && ssid[0] == ' ')
+                return 1;
+
+        return (memcmp(ssid, zeros, length) == 0);
+}
+
+static inline void at76_free_bss_list(struct at76_priv *priv)
+{
+        struct list_head *next, *ptr;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+
+        priv->curr_bss = NULL;
+
+        list_for_each_safe(ptr, next, &priv->bss_list) {
+                list_del(ptr);
+                kfree(list_entry(ptr, struct bss_info, list));
+        }
+
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+}
+
 static int at76_remap(struct usb_device *udev)
 {
         int ret;
@@ -598,7 +651,7 @@ static int at76_get_op_mode(struct usb_device *udev)
                 return -ENOMEM;
         ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x33,
                               USB_TYPE_VENDOR | USB_DIR_IN |
-                              USB_RECIP_INTERFACE, 0x01, 0, &op_mode, 1,
+                              USB_RECIP_INTERFACE, 0x01, 0, op_mode, 1,
                               USB_CTRL_GET_TIMEOUT);
         saved = *op_mode;
         kfree(op_mode);
@@ -676,7 +729,7 @@ exit:
         kfree(hwcfg);
         if (ret < 0)
                 printk(KERN_ERR "%s: cannot get HW Config (error %d)\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -685,15 +738,15 @@ static struct reg_domain const *at76_get_reg_domain(u16 code)
 {
         int i;
         static struct reg_domain const fd_tab[] = {
-                { 0x10, "FCC (USA)", 0x7ff },   /* ch 1-11 */
-                { 0x20, "IC (Canada)", 0x7ff }, /* ch 1-11 */
-                { 0x30, "ETSI (most of Europe)", 0x1fff },      /* ch 1-13 */
-                { 0x31, "Spain", 0x600 },       /* ch 10-11 */
-                { 0x32, "France", 0x1e00 },     /* ch 10-13 */
-                { 0x40, "MKK (Japan)", 0x2000 },        /* ch 14 */
-                { 0x41, "MKK1 (Japan)", 0x3fff },       /* ch 1-14 */
-                { 0x50, "Israel", 0x3fc },      /* ch 3-9 */
-                { 0x00, "<unknown>", 0xffffffff }       /* ch 1-32 */
+                {0x10, "FCC (USA)", 0x7ff},     /* ch 1-11 */
+                {0x20, "IC (Canada)", 0x7ff},   /* ch 1-11 */
+                {0x30, "ETSI (most of Europe)", 0x1fff},        /* ch 1-13 */
+                {0x31, "Spain", 0x600}, /* ch 10-11 */
+                {0x32, "France", 0x1e00},       /* ch 10-13 */
+                {0x40, "MKK (Japan)", 0x2000},  /* ch 14 */
+                {0x41, "MKK1 (Japan)", 0x3fff}, /* ch 1-14 */
+                {0x50, "Israel", 0x3fc},        /* ch 3-9 */
+                {0x00, "<unknown>", 0xffffffff} /* ch 1-32 */
         };
 
         /* Last entry is fallback for unknown domain code */
@@ -731,7 +784,7 @@ static inline int at76_get_cmd_status(struct usb_device *udev, u8 cmd)
         ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x22,
                               USB_TYPE_VENDOR | USB_DIR_IN |
                               USB_RECIP_INTERFACE, cmd, 0, stat_buf,
-                              sizeof(stat_buf), USB_CTRL_GET_TIMEOUT);
+                              40, USB_CTRL_GET_TIMEOUT);
         if (ret >= 0)
                 ret = stat_buf[5];
         kfree(stat_buf);
@@ -739,24 +792,6 @@ static inline int at76_get_cmd_status(struct usb_device *udev, u8 cmd)
         return ret;
 }
 
-#define MAKE_CMD_CASE(c) case (c): return #c
-
-static const char *at76_get_cmd_string(u8 cmd_status)
-{
-        switch (cmd_status) {
-                MAKE_CMD_CASE(CMD_SET_MIB);
-                MAKE_CMD_CASE(CMD_GET_MIB);
-                MAKE_CMD_CASE(CMD_SCAN);
-                MAKE_CMD_CASE(CMD_JOIN);
-                MAKE_CMD_CASE(CMD_START_IBSS);
-                MAKE_CMD_CASE(CMD_RADIO_ON);
-                MAKE_CMD_CASE(CMD_RADIO_OFF);
-                MAKE_CMD_CASE(CMD_STARTUP);
-        }
-
-        return "UNKNOWN";
-}
-
 static int at76_set_card_command(struct usb_device *udev, u8 cmd, void *buf,
                                  int buf_size)
 {
@@ -772,10 +807,6 @@ static int at76_set_card_command(struct usb_device *udev, u8 cmd, void *buf,
         cmd_buf->size = cpu_to_le16(buf_size);
         memcpy(cmd_buf->data, buf, buf_size);
 
-        at76_dbg_dump(DBG_CMD, cmd_buf, sizeof(struct at76_command) + buf_size,
-                      "issuing command %s (0x%02x)",
-                      at76_get_cmd_string(cmd), cmd);
-
         ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x0e,
                               USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
                               0, 0, cmd_buf,
@@ -813,13 +844,13 @@ static int at76_wait_completion(struct at76_priv *priv, int cmd)
                 status = at76_get_cmd_status(priv->udev, cmd);
                 if (status < 0) {
                         printk(KERN_ERR "%s: at76_get_cmd_status failed: %d\n",
-                               wiphy_name(priv->hw->wiphy), status);
+                               priv->netdev->name, status);
                         break;
                 }
 
                 at76_dbg(DBG_WAIT_COMPLETE,
                          "%s: Waiting on cmd %d, status = %d (%s)",
-                         wiphy_name(priv->hw->wiphy), cmd, status,
+                         priv->netdev->name, cmd, status,
                          at76_get_cmd_status_string(status));
 
                 if (status != CMD_STATUS_IN_PROGRESS
@@ -830,7 +861,7 @@ static int at76_wait_completion(struct at76_priv *priv, int cmd)
                 if (time_after(jiffies, timeout)) {
                         printk(KERN_ERR
                                "%s: completion timeout for command %d\n",
-                               wiphy_name(priv->hw->wiphy), cmd);
+                               priv->netdev->name, cmd);
                         status = -ETIMEDOUT;
                         break;
                 }
@@ -853,7 +884,7 @@ static int at76_set_mib(struct at76_priv *priv, struct set_mib_buffer *buf)
         if (ret != CMD_STATUS_COMPLETE) {
                 printk(KERN_INFO
                        "%s: set_mib: at76_wait_completion failed "
-                       "with %d\n", wiphy_name(priv->hw->wiphy), ret);
+                       "with %d\n", priv->netdev->name, ret);
                 ret = -EIO;
         }
 
@@ -874,7 +905,7 @@ static int at76_set_radio(struct at76_priv *priv, int enable)
         ret = at76_set_card_command(priv->udev, cmd, NULL, 0);
         if (ret < 0)
                 printk(KERN_ERR "%s: at76_set_card_command(%d) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), cmd, ret);
+                       priv->netdev->name, cmd, ret);
         else
                 ret = 1;
 
@@ -895,7 +926,44 @@ static int at76_set_pm_mode(struct at76_priv *priv)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (pm_mode) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
+
+        return ret;
+}
+
+/* Set the association id for power save mode */
+static int at76_set_associd(struct at76_priv *priv, u16 id)
+{
+        int ret = 0;
+
+        priv->mib_buf.type = MIB_MAC_MGMT;
+        priv->mib_buf.size = 2;
+        priv->mib_buf.index = offsetof(struct mib_mac_mgmt, station_id);
+        priv->mib_buf.data.word = cpu_to_le16(id);
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (associd) failed: %d\n",
+                       priv->netdev->name, ret);
+
+        return ret;
+}
+
+/* Set the listen interval for power save mode */
+static int at76_set_listen_interval(struct at76_priv *priv, u16 interval)
+{
+        int ret = 0;
+
+        priv->mib_buf.type = MIB_MAC;
+        priv->mib_buf.size = 2;
+        priv->mib_buf.index = offsetof(struct mib_mac, listen_interval);
+        priv->mib_buf.data.word = cpu_to_le16(interval);
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR
+                       "%s: set_mib (listen_interval) failed: %d\n",
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -912,7 +980,7 @@ static int at76_set_preamble(struct at76_priv *priv, u8 type)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (preamble) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -929,7 +997,7 @@ static int at76_set_frag(struct at76_priv *priv, u16 size)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (frag threshold) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -946,7 +1014,7 @@ static int at76_set_rts(struct at76_priv *priv, u16 size)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (rts) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -963,41 +1031,24 @@ static int at76_set_autorate_fallback(struct at76_priv *priv, int onoff)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (autorate fallback) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
 
-static int at76_set_tkip_bssid(struct at76_priv *priv, const void *addr)
+static int at76_add_mac_address(struct at76_priv *priv, void *addr)
 {
         int ret = 0;
 
-        priv->mib_buf.type = MIB_MAC_ENCRYPTION;
+        priv->mib_buf.type = MIB_MAC_ADDR;
         priv->mib_buf.size = ETH_ALEN;
-        priv->mib_buf.index = offsetof(struct mib_mac_encryption, tkip_bssid);
+        priv->mib_buf.index = offsetof(struct mib_mac_addr, mac_addr);
         memcpy(priv->mib_buf.data.addr, addr, ETH_ALEN);
 
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
-                printk(KERN_ERR "%s: set_mib (MAC_ENCRYPTION, tkip_bssid) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-
-        return ret;
-}
-
-static int at76_reset_rsc(struct at76_priv *priv)
-{
-        int ret = 0;
-
-        priv->mib_buf.type = MIB_MAC_ENCRYPTION;
-        priv->mib_buf.size = 4 * 8;
-        priv->mib_buf.index = offsetof(struct mib_mac_encryption, key_rsc);
-        memset(priv->mib_buf.data.data, 0 , priv->mib_buf.size);
-
-        ret = at76_set_mib(priv, &priv->mib_buf);
-        if (ret < 0)
-                printk(KERN_ERR "%s: set_mib (MAC_ENCRYPTION, key_rsc) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                printk(KERN_ERR "%s: set_mib (MAC_ADDR, mac_addr) failed: %d\n",
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -1016,16 +1067,16 @@ static void at76_dump_mib_mac_addr(struct at76_priv *priv)
                            sizeof(struct mib_mac_addr));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MAC_ADDR) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
         at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: mac_addr %s res 0x%x 0x%x",
-                 wiphy_name(priv->hw->wiphy),
+                 priv->netdev->name,
                  mac2str(m->mac_addr), m->res[0], m->res[1]);
         for (i = 0; i < ARRAY_SIZE(m->group_addr); i++)
                 at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: group addr %d: %s, "
-                         "status %d", wiphy_name(priv->hw->wiphy), i,
+                         "status %d", priv->netdev->name, i,
                          mac2str(m->group_addr[i]), m->group_addr_status[i]);
 exit:
         kfree(m);
@@ -1045,13 +1096,13 @@ static void at76_dump_mib_mac_wep(struct at76_priv *priv)
                            sizeof(struct mib_mac_wep));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MAC_WEP) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
         at76_dbg(DBG_MIB, "%s: MIB MAC_WEP: priv_invoked %u def_key_id %u "
                  "key_len %u excl_unencr %u wep_icv_err %u wep_excluded %u "
-                 "encr_level %u key %d", wiphy_name(priv->hw->wiphy),
+                 "encr_level %u key %d", priv->netdev->name,
                  m->privacy_invoked, m->wep_default_key_id,
                  m->wep_key_mapping_len, m->exclude_unencrypted,
                  le32_to_cpu(m->wep_icv_error_count),
@@ -1063,55 +1114,12 @@ static void at76_dump_mib_mac_wep(struct at76_priv *priv)
 
         for (i = 0; i < WEP_KEYS; i++)
                 at76_dbg(DBG_MIB, "%s: MIB MAC_WEP: key %d: %s",
-                         wiphy_name(priv->hw->wiphy), i,
+                         priv->netdev->name, i,
                          hex2str(m->wep_default_keyvalue[i], key_len));
 exit:
         kfree(m);
 }
 
-static void at76_dump_mib_mac_encryption(struct at76_priv *priv)
-{
-        int i;
-        int ret;
-        /*int key_len;*/
-        struct mib_mac_encryption *m;
-
-        m = kmalloc(sizeof(struct mib_mac_encryption), GFP_KERNEL);
-        if (!m)
-                return;
-
-        ret = at76_get_mib(priv->udev, MIB_MAC_ENCRYPTION, m,
-                           sizeof(struct mib_mac_encryption));
-        if (ret < 0) {
-                dev_err(&priv->udev->dev,
-                        "%s: at76_get_mib (MAC_ENCRYPTION) failed: %d\n",
-                        wiphy_name(priv->hw->wiphy), ret);
-                goto exit;
-        }
-
-        at76_dbg(DBG_MIB,
-                 "%s: MIB MAC_ENCRYPTION: tkip_bssid %s priv_invoked %u "
-                 "ciph_key_id %u grp_key_id %u excl_unencr %u "
-                 "ckip_key_perm %u wep_icv_err %u wep_excluded %u",
-                 wiphy_name(priv->hw->wiphy), mac2str(m->tkip_bssid),
-                 m->privacy_invoked, m->cipher_default_key_id,
-                 m->cipher_default_group_key_id, m->exclude_unencrypted,
-                 m->ckip_key_permutation,
-                 le32_to_cpu(m->wep_icv_error_count),
-                 le32_to_cpu(m->wep_excluded_count));
-
-        /*key_len = (m->encryption_level == 1) ?
-            WEP_SMALL_KEY_LEN : WEP_LARGE_KEY_LEN;*/
-
-        for (i = 0; i < CIPHER_KEYS; i++)
-                at76_dbg(DBG_MIB, "%s: MIB MAC_ENCRYPTION: key %d: %s",
-                         wiphy_name(priv->hw->wiphy), i,
-                         hex2str(m->cipher_default_keyvalue[i],
-                                 CIPHER_KEY_LEN));
-exit:
-        kfree(m);
-}
-
 static void at76_dump_mib_mac_mgmt(struct at76_priv *priv)
 {
         int ret;
@@ -1125,7 +1133,7 @@ static void at76_dump_mib_mac_mgmt(struct at76_priv *priv)
                            sizeof(struct mib_mac_mgmt));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MAC_MGMT) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
@@ -1136,7 +1144,7 @@ static void at76_dump_mib_mac_mgmt(struct at76_priv *priv)
                  "pm_mode %d ibss_change %d res %d "
                  "multi_domain_capability_implemented %d "
                  "international_roaming %d country_string %.3s",
-                 wiphy_name(priv->hw->wiphy), le16_to_cpu(m->beacon_period),
+                 priv->netdev->name, le16_to_cpu(m->beacon_period),
                  le16_to_cpu(m->CFP_max_duration),
                  le16_to_cpu(m->medium_occupancy_limit),
                  le16_to_cpu(m->station_id), le16_to_cpu(m->ATIM_window),
@@ -1161,7 +1169,7 @@ static void at76_dump_mib_mac(struct at76_priv *priv)
         ret = at76_get_mib(priv->udev, MIB_MAC, m, sizeof(struct mib_mac));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MAC) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
@@ -1171,8 +1179,7 @@ static void at76_dump_mib_mac(struct at76_priv *priv)
                  "scan_type %d scan_channel %d probe_delay %u "
                  "min_channel_time %d max_channel_time %d listen_int %d "
                  "desired_ssid %s desired_bssid %s desired_bsstype %d",
-                 wiphy_name(priv->hw->wiphy),
-                 le32_to_cpu(m->max_tx_msdu_lifetime),
+                 priv->netdev->name, le32_to_cpu(m->max_tx_msdu_lifetime),
                  le32_to_cpu(m->max_rx_lifetime),
                  le16_to_cpu(m->frag_threshold), le16_to_cpu(m->rts_threshold),
                  le16_to_cpu(m->cwmin), le16_to_cpu(m->cwmax),
@@ -1198,7 +1205,7 @@ static void at76_dump_mib_phy(struct at76_priv *priv)
         ret = at76_get_mib(priv->udev, MIB_PHY, m, sizeof(struct mib_phy));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (PHY) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
@@ -1207,7 +1214,7 @@ static void at76_dump_mib_phy(struct at76_priv *priv)
                  "mpdu_max_length %d cca_mode_supported %d operation_rate_set "
                  "0x%x 0x%x 0x%x 0x%x channel_id %d current_cca_mode %d "
                  "phy_type %d current_reg_domain %d",
-                 wiphy_name(priv->hw->wiphy), le32_to_cpu(m->ed_threshold),
+                 priv->netdev->name, le32_to_cpu(m->ed_threshold),
                  le16_to_cpu(m->slot_time), le16_to_cpu(m->sifs_time),
                  le16_to_cpu(m->preamble_length),
                  le16_to_cpu(m->plcp_header_length),
@@ -1231,14 +1238,13 @@ static void at76_dump_mib_local(struct at76_priv *priv)
         ret = at76_get_mib(priv->udev, MIB_LOCAL, m, sizeof(struct mib_local));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (LOCAL) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
         at76_dbg(DBG_MIB, "%s: MIB LOCAL: beacon_enable %d "
                  "txautorate_fallback %d ssid_size %d promiscuous_mode %d "
-                 "preamble_type %d", wiphy_name(priv->hw->wiphy),
-                 m->beacon_enable,
+                 "preamble_type %d", priv->netdev->name, m->beacon_enable,
                  m->txautorate_fallback, m->ssid_size, m->promiscuous_mode,
                  m->preamble_type);
 exit:
@@ -1257,21 +1263,118 @@ static void at76_dump_mib_mdomain(struct at76_priv *priv)
                            sizeof(struct mib_mdomain));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MDOMAIN) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
         at76_dbg(DBG_MIB, "%s: MIB MDOMAIN: channel_list %s",
-                 wiphy_name(priv->hw->wiphy),
+                 priv->netdev->name,
                  hex2str(m->channel_list, sizeof(m->channel_list)));
 
         at76_dbg(DBG_MIB, "%s: MIB MDOMAIN: tx_powerlevel %s",
-                 wiphy_name(priv->hw->wiphy),
+                 priv->netdev->name,
                  hex2str(m->tx_powerlevel, sizeof(m->tx_powerlevel)));
 exit:
         kfree(m);
 }
 
+static int at76_get_current_bssid(struct at76_priv *priv)
+{
+        int ret = 0;
+        struct mib_mac_mgmt *mac_mgmt =
+            kmalloc(sizeof(struct mib_mac_mgmt), GFP_KERNEL);
+
+        if (!mac_mgmt) {
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        ret = at76_get_mib(priv->udev, MIB_MAC_MGMT, mac_mgmt,
+                           sizeof(struct mib_mac_mgmt));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib failed: %d\n",
+                       priv->netdev->name, ret);
+                goto error;
+        }
+        memcpy(priv->bssid, mac_mgmt->current_bssid, ETH_ALEN);
+        printk(KERN_INFO "%s: using BSSID %s\n", priv->netdev->name,
+               mac2str(priv->bssid));
+error:
+        kfree(mac_mgmt);
+exit:
+        return ret;
+}
+
+static int at76_get_current_channel(struct at76_priv *priv)
+{
+        int ret = 0;
+        struct mib_phy *phy = kmalloc(sizeof(struct mib_phy), GFP_KERNEL);
+
+        if (!phy) {
+                ret = -ENOMEM;
+                goto exit;
+        }
+        ret = at76_get_mib(priv->udev, MIB_PHY, phy, sizeof(struct mib_phy));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib(MIB_PHY) failed: %d\n",
+                       priv->netdev->name, ret);
+                goto error;
+        }
+        priv->channel = phy->channel_id;
+error:
+        kfree(phy);
+exit:
+        return ret;
+}
+
+/**
+ * at76_start_scan - start a scan
+ *
+ * @use_essid - use the configured ESSID in non passive mode
+ */
+static int at76_start_scan(struct at76_priv *priv, int use_essid)
+{
+        struct at76_req_scan scan;
+
+        memset(&scan, 0, sizeof(struct at76_req_scan));
+        memset(scan.bssid, 0xff, ETH_ALEN);
+
+        if (use_essid) {
+                memcpy(scan.essid, priv->essid, IW_ESSID_MAX_SIZE);
+                scan.essid_size = priv->essid_size;
+        } else
+                scan.essid_size = 0;
+
+        /* jal: why should we start at a certain channel? we do scan the whole
+           range allowed by reg domain. */
+        scan.channel = priv->channel;
+
+        /* atmelwlandriver differs between scan type 0 and 1 (active/passive)
+           For ad-hoc mode, it uses type 0 only. */
+        scan.scan_type = priv->scan_mode;
+
+        /* INFO: For probe_delay, not multiplying by 1024 as this will be
+           slightly less than min_channel_time
+           (per spec: probe delay < min. channel time) */
+        scan.min_channel_time = cpu_to_le16(priv->scan_min_time);
+        scan.max_channel_time = cpu_to_le16(priv->scan_max_time);
+        scan.probe_delay = cpu_to_le16(priv->scan_min_time * 1000);
+        scan.international_scan = 0;
+
+        /* other values are set to 0 for type 0 */
+
+        at76_dbg(DBG_PROGRESS, "%s: start_scan (use_essid = %d, intl = %d, "
+                 "channel = %d, probe_delay = %d, scan_min_time = %d, "
+                 "scan_max_time = %d)",
+                 priv->netdev->name, use_essid,
+                 scan.international_scan, scan.channel,
+                 le16_to_cpu(scan.probe_delay),
+                 le16_to_cpu(scan.min_channel_time),
+                 le16_to_cpu(scan.max_channel_time));
+
+        return at76_set_card_command(priv->udev, CMD_SCAN, &scan, sizeof(scan));
+}
+
 /* Enable monitor mode */
 static int at76_start_monitor(struct at76_priv *priv)
 {
@@ -1292,6 +1395,86 @@ static int at76_start_monitor(struct at76_priv *priv)
         return ret;
 }
 
+static int at76_start_ibss(struct at76_priv *priv)
+{
+        struct at76_req_ibss bss;
+        int ret;
+
+        WARN_ON(priv->mac_state != MAC_OWN_IBSS);
+        if (priv->mac_state != MAC_OWN_IBSS)
+                return -EBUSY;
+
+        memset(&bss, 0, sizeof(struct at76_req_ibss));
+        memset(bss.bssid, 0xff, ETH_ALEN);
+        memcpy(bss.essid, priv->essid, IW_ESSID_MAX_SIZE);
+        bss.essid_size = priv->essid_size;
+        bss.bss_type = ADHOC_MODE;
+        bss.channel = priv->channel;
+
+        ret = at76_set_card_command(priv->udev, CMD_START_IBSS, &bss,
+                                    sizeof(struct at76_req_ibss));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: start_ibss failed: %d\n",
+                       priv->netdev->name, ret);
+                return ret;
+        }
+
+        ret = at76_wait_completion(priv, CMD_START_IBSS);
+        if (ret != CMD_STATUS_COMPLETE) {
+                printk(KERN_ERR "%s: start_ibss failed to complete, %d\n",
+                       priv->netdev->name, ret);
+                return ret;
+        }
+
+        ret = at76_get_current_bssid(priv);
+        if (ret < 0)
+                return ret;
+
+        ret = at76_get_current_channel(priv);
+        if (ret < 0)
+                return ret;
+
+        /* not sure what this is good for ??? */
+        priv->mib_buf.type = MIB_MAC_MGMT;
+        priv->mib_buf.size = 1;
+        priv->mib_buf.index = offsetof(struct mib_mac_mgmt, ibss_change);
+        priv->mib_buf.data.byte = 0;
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: set_mib (ibss change ok) failed: %d\n",
+                       priv->netdev->name, ret);
+                return ret;
+        }
+
+        netif_carrier_on(priv->netdev);
+        netif_start_queue(priv->netdev);
+        return 0;
+}
+
+/* Request card to join BSS in managed or ad-hoc mode */
+static int at76_join_bss(struct at76_priv *priv, struct bss_info *ptr)
+{
+        struct at76_req_join join;
+
+        BUG_ON(!ptr);
+
+        memset(&join, 0, sizeof(struct at76_req_join));
+        memcpy(join.bssid, ptr->bssid, ETH_ALEN);
+        memcpy(join.essid, ptr->ssid, ptr->ssid_len);
+        join.essid_size = ptr->ssid_len;
+        join.bss_type = (priv->iw_mode == IW_MODE_ADHOC ? 1 : 2);
+        join.channel = ptr->channel;
+        join.timeout = cpu_to_le16(2000);
+
+        at76_dbg(DBG_PROGRESS,
+                 "%s join addr %s ssid %s type %d ch %d timeout %d",
+                 priv->netdev->name, mac2str(join.bssid), join.essid,
+                 join.bss_type, join.channel, le16_to_cpu(join.timeout));
+        return at76_set_card_command(priv->udev, CMD_JOIN, &join,
+                                     sizeof(struct at76_req_join));
+}
+
 /* Calculate padding from txbuf->wlength (which excludes the USB TX header),
    likely to compensate a flaw in the AT76C503A USB part ... */
 static inline int at76_calc_padding(int wlen)
@@ -1310,6 +1493,14 @@ static inline int at76_calc_padding(int wlen)
         return 0;
 }
 
+/* We are doing a lot of things here in an interrupt. Need
+   a bh handler (Watching TV with a TV card is probably
+   a good test: if you see flickers, we are doing too much.
+   Currently I do see flickers... even with our tasklet :-( )
+   Maybe because the bttv driver and usb-uhci use the same interrupt
+*/
+/* Or maybe because our BH handler is preempting bttv's BH handler.. BHs don't
+ * solve everything.. (alex) */
 static void at76_rx_callback(struct urb *urb)
 {
         struct at76_priv *priv = urb->context;
@@ -1319,6 +1510,1758 @@ static void at76_rx_callback(struct urb *urb)
         return;
 }
 
+static void at76_tx_callback(struct urb *urb)
+{
+        struct at76_priv *priv = urb->context;
+        struct net_device_stats *stats = &priv->stats;
+        unsigned long flags;
+        struct at76_tx_buffer *mgmt_buf;
+        int ret;
+
+        switch (urb->status) {
+        case 0:
+                stats->tx_packets++;
+                break;
+        case -ENOENT:
+        case -ECONNRESET:
+                /* urb has been unlinked */
+                return;
+        default:
+                at76_dbg(DBG_URB, "%s - nonzero tx status received: %d",
+                         __func__, urb->status);
+                stats->tx_errors++;
+                break;
+        }
+
+        spin_lock_irqsave(&priv->mgmt_spinlock, flags);
+        mgmt_buf = priv->next_mgmt_bulk;
+        priv->next_mgmt_bulk = NULL;
+        spin_unlock_irqrestore(&priv->mgmt_spinlock, flags);
+
+        if (!mgmt_buf) {
+                netif_wake_queue(priv->netdev);
+                return;
+        }
+
+        /* we don't copy the padding bytes, but add them
+           to the length */
+        memcpy(priv->bulk_out_buffer, mgmt_buf,
+               le16_to_cpu(mgmt_buf->wlength) + AT76_TX_HDRLEN);
+        usb_fill_bulk_urb(priv->tx_urb, priv->udev, priv->tx_pipe,
+                          priv->bulk_out_buffer,
+                          le16_to_cpu(mgmt_buf->wlength) + mgmt_buf->padding +
+                          AT76_TX_HDRLEN, at76_tx_callback, priv);
+        ret = usb_submit_urb(priv->tx_urb, GFP_ATOMIC);
+        if (ret)
+                printk(KERN_ERR "%s: error in tx submit urb: %d\n",
+                       priv->netdev->name, ret);
+
+        kfree(mgmt_buf);
+}
+
+/* Send a management frame on bulk-out.  txbuf->wlength must be set */
+static int at76_tx_mgmt(struct at76_priv *priv, struct at76_tx_buffer *txbuf)
+{
+        unsigned long flags;
+        int ret;
+        int urb_status;
+        void *oldbuf = NULL;
+
+        netif_carrier_off(priv->netdev);        /* stop netdev watchdog */
+        netif_stop_queue(priv->netdev); /* stop tx data packets */
+
+        spin_lock_irqsave(&priv->mgmt_spinlock, flags);
+
+        urb_status = priv->tx_urb->status;
+        if (urb_status == -EINPROGRESS) {
+                /* cannot transmit now, put in the queue */
+                oldbuf = priv->next_mgmt_bulk;
+                priv->next_mgmt_bulk = txbuf;
+        }
+        spin_unlock_irqrestore(&priv->mgmt_spinlock, flags);
+
+        if (oldbuf) {
+                /* a data/mgmt tx is already pending in the URB -
+                   if this is no error in some situations we must
+                   implement a queue or silently modify the old msg */
+                printk(KERN_ERR "%s: removed pending mgmt buffer %s\n",
+                       priv->netdev->name, hex2str(oldbuf, 64));
+                kfree(oldbuf);
+                return 0;
+        }
+
+        txbuf->tx_rate = TX_RATE_1MBIT;
+        txbuf->padding = at76_calc_padding(le16_to_cpu(txbuf->wlength));
+        memset(txbuf->reserved, 0, sizeof(txbuf->reserved));
+
+        if (priv->next_mgmt_bulk)
+                printk(KERN_ERR "%s: URB status %d, but mgmt is pending\n",
+                       priv->netdev->name, urb_status);
+
+        at76_dbg(DBG_TX_MGMT,
+                 "%s: tx mgmt: wlen %d tx_rate %d pad %d %s",
+                 priv->netdev->name, le16_to_cpu(txbuf->wlength),
+                 txbuf->tx_rate, txbuf->padding,
+                 hex2str(txbuf->packet, le16_to_cpu(txbuf->wlength)));
+
+        /* txbuf was not consumed above -> send mgmt msg immediately */
+        memcpy(priv->bulk_out_buffer, txbuf,
+               le16_to_cpu(txbuf->wlength) + AT76_TX_HDRLEN);
+        usb_fill_bulk_urb(priv->tx_urb, priv->udev, priv->tx_pipe,
+                          priv->bulk_out_buffer,
+                          le16_to_cpu(txbuf->wlength) + txbuf->padding +
+                          AT76_TX_HDRLEN, at76_tx_callback, priv);
+        ret = usb_submit_urb(priv->tx_urb, GFP_ATOMIC);
+        if (ret)
+                printk(KERN_ERR "%s: error in tx submit urb: %d\n",
+                       priv->netdev->name, ret);
+
+        kfree(txbuf);
+
+        return ret;
+}
+
+/* Go to the next information element */
+static inline void next_ie(struct ieee80211_info_element **ie)
+{
+        *ie = (struct ieee80211_info_element *)(&(*ie)->data[(*ie)->len]);
+}
+
+/* Challenge is the challenge string (in TLV format)
+   we got with seq_nr 2 for shared secret authentication only and
+   send in seq_nr 3 WEP encrypted to prove we have the correct WEP key;
+   otherwise it is NULL */
+static int at76_auth_req(struct at76_priv *priv, struct bss_info *bss,
+                         int seq_nr, struct ieee80211_info_element *challenge)
+{
+        struct at76_tx_buffer *tx_buffer;
+        struct ieee80211_hdr_3addr *mgmt;
+        struct ieee80211_auth *req;
+        int buf_len = (seq_nr != 3 ? AUTH_FRAME_SIZE :
+                       AUTH_FRAME_SIZE + 1 + 1 + challenge->len);
+
+        BUG_ON(!bss);
+        BUG_ON(seq_nr == 3 && !challenge);
+        tx_buffer = kmalloc(buf_len + MAX_PADDING_SIZE, GFP_ATOMIC);
+        if (!tx_buffer)
+                return -ENOMEM;
+
+        req = (struct ieee80211_auth *)tx_buffer->packet;
+        mgmt = &req->header;
+
+        /* make wireless header */
+        /* first auth msg is not encrypted, only the second (seq_nr == 3) */
+        mgmt->frame_ctl =
+            cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH |
+                        (seq_nr == 3 ? IEEE80211_FCTL_PROTECTED : 0));
+
+        mgmt->duration_id = cpu_to_le16(0x8000);
+        memcpy(mgmt->addr1, bss->bssid, ETH_ALEN);
+        memcpy(mgmt->addr2, priv->netdev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->addr3, bss->bssid, ETH_ALEN);
+        mgmt->seq_ctl = cpu_to_le16(0);
+
+        req->algorithm = cpu_to_le16(priv->auth_mode);
+        req->transaction = cpu_to_le16(seq_nr);
+        req->status = cpu_to_le16(0);
+
+        if (seq_nr == 3)
+                memcpy(req->info_element, challenge, 1 + 1 + challenge->len);
+
+        /* init. at76_priv tx header */
+        tx_buffer->wlength = cpu_to_le16(buf_len - AT76_TX_HDRLEN);
+        at76_dbg(DBG_TX_MGMT, "%s: AuthReq bssid %s alg %d seq_nr %d",
+                 priv->netdev->name, mac2str(mgmt->addr3),
+                 le16_to_cpu(req->algorithm), le16_to_cpu(req->transaction));
+        if (seq_nr == 3)
+                at76_dbg(DBG_TX_MGMT, "%s: AuthReq challenge: %s ...",
+                         priv->netdev->name, hex2str(req->info_element, 18));
+
+        /* either send immediately (if no data tx is pending
+           or put it in pending list */
+        return at76_tx_mgmt(priv, tx_buffer);
+}
+
+static int at76_assoc_req(struct at76_priv *priv, struct bss_info *bss)
+{
+        struct at76_tx_buffer *tx_buffer;
+        struct ieee80211_hdr_3addr *mgmt;
+        struct ieee80211_assoc_request *req;
+        struct ieee80211_info_element *ie;
+        char *essid;
+        int essid_len;
+        u16 capa;
+
+        BUG_ON(!bss);
+
+        tx_buffer = kmalloc(ASSOCREQ_MAX_SIZE + MAX_PADDING_SIZE, GFP_ATOMIC);
+        if (!tx_buffer)
+                return -ENOMEM;
+
+        req = (struct ieee80211_assoc_request *)tx_buffer->packet;
+        mgmt = &req->header;
+        ie = req->info_element;
+
+        /* make wireless header */
+        mgmt->frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                      IEEE80211_STYPE_ASSOC_REQ);
+
+        mgmt->duration_id = cpu_to_le16(0x8000);
+        memcpy(mgmt->addr1, bss->bssid, ETH_ALEN);
+        memcpy(mgmt->addr2, priv->netdev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->addr3, bss->bssid, ETH_ALEN);
+        mgmt->seq_ctl = cpu_to_le16(0);
+
+        /* we must set the Privacy bit in the capabilities to assure an
+           Agere-based AP with optional WEP transmits encrypted frames
+           to us.  AP only set the Privacy bit in their capabilities
+           if WEP is mandatory in the BSS! */
+        capa = bss->capa;
+        if (priv->wep_enabled)
+                capa |= WLAN_CAPABILITY_PRIVACY;
+        if (priv->preamble_type != PREAMBLE_TYPE_LONG)
+                capa |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+        req->capability = cpu_to_le16(capa);
+
+        req->listen_interval = cpu_to_le16(2 * bss->beacon_interval);
+
+        /* write TLV data elements */
+
+        ie->id = MFIE_TYPE_SSID;
+        ie->len = bss->ssid_len;
+        memcpy(ie->data, bss->ssid, bss->ssid_len);
+        next_ie(&ie);
+
+        ie->id = MFIE_TYPE_RATES;
+        ie->len = sizeof(hw_rates);
+        memcpy(ie->data, hw_rates, sizeof(hw_rates));
+        next_ie(&ie);           /* ie points behind the supp_rates field */
+
+        /* init. at76_priv tx header */
+        tx_buffer->wlength = cpu_to_le16((u8 *)ie - (u8 *)mgmt);
+
+        ie = req->info_element;
+        essid = ie->data;
+        essid_len = min_t(int, IW_ESSID_MAX_SIZE, ie->len);
+
+        next_ie(&ie);           /* points to IE of rates now */
+        at76_dbg(DBG_TX_MGMT,
+                 "%s: AssocReq bssid %s capa 0x%04x ssid %.*s rates %s",
+                 priv->netdev->name, mac2str(mgmt->addr3),
+                 le16_to_cpu(req->capability), essid_len, essid,
+                 hex2str(ie->data, ie->len));
+
+        /* either send immediately (if no data tx is pending
+           or put it in pending list */
+        return at76_tx_mgmt(priv, tx_buffer);
+}
+
+/* We got to check the bss_list for old entries */
+static void at76_bss_list_timeout(unsigned long par)
+{
+        struct at76_priv *priv = (struct at76_priv *)par;
+        unsigned long flags;
+        struct list_head *lptr, *nptr;
+        struct bss_info *ptr;
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+
+        list_for_each_safe(lptr, nptr, &priv->bss_list) {
+
+                ptr = list_entry(lptr, struct bss_info, list);
+
+                if (ptr != priv->curr_bss
+                    && time_after(jiffies, ptr->last_rx + BSS_LIST_TIMEOUT)) {
+                        at76_dbg(DBG_BSS_TABLE_RM,
+                                 "%s: bss_list: removing old BSS %s ch %d",
+                                 priv->netdev->name, mac2str(ptr->bssid),
+                                 ptr->channel);
+                        list_del(&ptr->list);
+                        kfree(ptr);
+                }
+        }
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+        /* restart the timer */
+        mod_timer(&priv->bss_list_timer, jiffies + BSS_LIST_TIMEOUT);
+}
+
+static inline void at76_set_mac_state(struct at76_priv *priv,
+                                      enum mac_state mac_state)
+{
+        at76_dbg(DBG_MAC_STATE, "%s state: %s", priv->netdev->name,
+                 mac_states[mac_state]);
+        priv->mac_state = mac_state;
+}
+
+static void at76_dump_bss_table(struct at76_priv *priv)
+{
+        struct bss_info *ptr;
+        unsigned long flags;
+        struct list_head *lptr;
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+
+        at76_dbg(DBG_BSS_TABLE, "%s BSS table (curr=%p):", priv->netdev->name,
+                 priv->curr_bss);
+
+        list_for_each(lptr, &priv->bss_list) {
+                ptr = list_entry(lptr, struct bss_info, list);
+                at76_dbg(DBG_BSS_TABLE, "0x%p: bssid %s channel %d ssid %.*s "
+                         "(%s) capa 0x%04x rates %s rssi %d link %d noise %d",
+                         ptr, mac2str(ptr->bssid), ptr->channel, ptr->ssid_len,
+                         ptr->ssid, hex2str(ptr->ssid, ptr->ssid_len),
+                         ptr->capa, hex2str(ptr->rates, ptr->rates_len),
+                         ptr->rssi, ptr->link_qual, ptr->noise_level);
+        }
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+}
+
+/* Called upon successful association to mark interface as connected */
+static void at76_work_assoc_done(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_assoc_done);
+
+        mutex_lock(&priv->mtx);
+
+        WARN_ON(priv->mac_state != MAC_ASSOC);
+        WARN_ON(!priv->curr_bss);
+        if (priv->mac_state != MAC_ASSOC || !priv->curr_bss)
+                goto exit;
+
+        if (priv->iw_mode == IW_MODE_INFRA) {
+                if (priv->pm_mode != AT76_PM_OFF) {
+                        /* calculate the listen interval in units of
+                           beacon intervals of the curr_bss */
+                        u32 pm_period_beacon = (priv->pm_period >> 10) /
+                            priv->curr_bss->beacon_interval;
+
+                        pm_period_beacon = max(pm_period_beacon, 2u);
+                        pm_period_beacon = min(pm_period_beacon, 0xffffu);
+
+                        at76_dbg(DBG_PM,
+                                 "%s: pm_mode %d assoc id 0x%x listen int %d",
+                                 priv->netdev->name, priv->pm_mode,
+                                 priv->assoc_id, pm_period_beacon);
+
+                        at76_set_associd(priv, priv->assoc_id);
+                        at76_set_listen_interval(priv, (u16)pm_period_beacon);
+                }
+                schedule_delayed_work(&priv->dwork_beacon, BEACON_TIMEOUT);
+        }
+        at76_set_pm_mode(priv);
+
+        netif_carrier_on(priv->netdev);
+        netif_wake_queue(priv->netdev);
+        at76_set_mac_state(priv, MAC_CONNECTED);
+        at76_iwevent_bss_connect(priv->netdev, priv->curr_bss->bssid);
+        at76_dbg(DBG_PROGRESS, "%s: connected to BSSID %s",
+                 priv->netdev->name, mac2str(priv->curr_bss->bssid));
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* We only store the new mac address in netdev struct,
+   it gets set when the netdev is opened. */
+static int at76_set_mac_address(struct net_device *netdev, void *addr)
+{
+        struct sockaddr *mac = addr;
+        memcpy(netdev->dev_addr, mac->sa_data, ETH_ALEN);
+        return 1;
+}
+
+static struct net_device_stats *at76_get_stats(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        return &priv->stats;
+}
+
+static struct iw_statistics *at76_get_wireless_stats(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "RETURN qual %d level %d noise %d updated %d",
+                 priv->wstats.qual.qual, priv->wstats.qual.level,
+                 priv->wstats.qual.noise, priv->wstats.qual.updated);
+
+        return &priv->wstats;
+}
+
+static void at76_set_multicast(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int promisc;
+
+        promisc = ((netdev->flags & IFF_PROMISC) != 0);
+        if (promisc != priv->promisc) {
+                /* This gets called in interrupt, must reschedule */
+                priv->promisc = promisc;
+                schedule_work(&priv->work_set_promisc);
+        }
+}
+
+/* Stop all network activity, flush all pending tasks */
+static void at76_quiesce(struct at76_priv *priv)
+{
+        unsigned long flags;
+
+        netif_stop_queue(priv->netdev);
+        netif_carrier_off(priv->netdev);
+
+        at76_set_mac_state(priv, MAC_INIT);
+
+        cancel_delayed_work(&priv->dwork_get_scan);
+        cancel_delayed_work(&priv->dwork_beacon);
+        cancel_delayed_work(&priv->dwork_auth);
+        cancel_delayed_work(&priv->dwork_assoc);
+        cancel_delayed_work(&priv->dwork_restart);
+
+        spin_lock_irqsave(&priv->mgmt_spinlock, flags);
+        kfree(priv->next_mgmt_bulk);
+        priv->next_mgmt_bulk = NULL;
+        spin_unlock_irqrestore(&priv->mgmt_spinlock, flags);
+}
+
+/*******************************************************************************
+ * at76_priv implementations of iw_handler functions:
+ */
+static int at76_iw_handler_commit(struct net_device *netdev,
+                                  struct iw_request_info *info,
+                                  void *null, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s %s: restarting the device", netdev->name,
+                 __func__);
+
+        if (priv->mac_state != MAC_INIT)
+                at76_quiesce(priv);
+
+        /* Wait half second before the restart to process subsequent
+         * requests from the same iwconfig in a single restart */
+        schedule_delayed_work(&priv->dwork_restart, HZ / 2);
+
+        return 0;
+}
+
+static int at76_iw_handler_get_name(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    char *name, char *extra)
+{
+        strcpy(name, "IEEE 802.11b");
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWNAME - name %s", netdev->name, name);
+        return 0;
+}
+
+static int at76_iw_handler_set_freq(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_freq *freq, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int chan = -1;
+        int ret = -EIWCOMMIT;
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWFREQ - freq.m %d freq.e %d",
+                 netdev->name, freq->m, freq->e);
+
+        if ((freq->e == 0) && (freq->m <= 1000))
+                /* Setting by channel number */
+                chan = freq->m;
+        else {
+                /* Setting by frequency - search the table */
+                int mult = 1;
+                int i;
+
+                for (i = 0; i < (6 - freq->e); i++)
+                        mult *= 10;
+
+                for (i = 0; i < NUM_CHANNELS; i++) {
+                        if (freq->m == (channel_frequency[i] * mult))
+                                chan = i + 1;
+                }
+        }
+
+        if (chan < 1 || !priv->domain)
+                /* non-positive channels are invalid
+                 * we need a domain info to set the channel
+                 * either that or an invalid frequency was
+                 * provided by the user */
+                ret = -EINVAL;
+        else if (!(priv->domain->channel_map & (1 << (chan - 1)))) {
+                printk(KERN_INFO "%s: channel %d not allowed for domain %s\n",
+                       priv->netdev->name, chan, priv->domain->name);
+                ret = -EINVAL;
+        }
+
+        if (ret == -EIWCOMMIT) {
+                priv->channel = chan;
+                at76_dbg(DBG_IOCTL, "%s: SIOCSIWFREQ - ch %d", netdev->name,
+                         chan);
+        }
+
+        return ret;
+}
+
+static int at76_iw_handler_get_freq(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_freq *freq, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        freq->m = priv->channel;
+        freq->e = 0;
+
+        if (priv->channel)
+                at76_dbg(DBG_IOCTL, "%s: SIOCGIWFREQ - freq %ld x 10e%d",
+                         netdev->name, channel_frequency[priv->channel - 1], 6);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWFREQ - ch %d", netdev->name,
+                 priv->channel);
+
+        return 0;
+}
+
+static int at76_iw_handler_set_mode(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    __u32 *mode, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWMODE - %d", netdev->name, *mode);
+
+        if ((*mode != IW_MODE_ADHOC) && (*mode != IW_MODE_INFRA) &&
+            (*mode != IW_MODE_MONITOR))
+                return -EINVAL;
+
+        priv->iw_mode = *mode;
+        if (priv->iw_mode != IW_MODE_INFRA)
+                priv->pm_mode = AT76_PM_OFF;
+
+        return -EIWCOMMIT;
+}
+
+static int at76_iw_handler_get_mode(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    __u32 *mode, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        *mode = priv->iw_mode;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWMODE - %d", netdev->name, *mode);
+
+        return 0;
+}
+
+static int at76_iw_handler_get_range(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_point *data, char *extra)
+{
+        /* inspired by atmel.c */
+        struct at76_priv *priv = netdev_priv(netdev);
+        struct iw_range *range = (struct iw_range *)extra;
+        int i;
+
+        data->length = sizeof(struct iw_range);
+        memset(range, 0, sizeof(struct iw_range));
+
+        /* TODO: range->throughput = xxxxxx; */
+
+        range->min_nwid = 0x0000;
+        range->max_nwid = 0x0000;
+
+        /* this driver doesn't maintain sensitivity information */
+        range->sensitivity = 0;
+
+        range->max_qual.qual = 100;
+        range->max_qual.level = 100;
+        range->max_qual.noise = 0;
+        range->max_qual.updated = IW_QUAL_NOISE_INVALID;
+
+        range->avg_qual.qual = 50;
+        range->avg_qual.level = 50;
+        range->avg_qual.noise = 0;
+        range->avg_qual.updated = IW_QUAL_NOISE_INVALID;
+
+        range->bitrate[0] = 1000000;
+        range->bitrate[1] = 2000000;
+        range->bitrate[2] = 5500000;
+        range->bitrate[3] = 11000000;
+        range->num_bitrates = 4;
+
+        range->min_rts = 0;
+        range->max_rts = MAX_RTS_THRESHOLD;
+
+        range->min_frag = MIN_FRAG_THRESHOLD;
+        range->max_frag = MAX_FRAG_THRESHOLD;
+
+        range->pmp_flags = IW_POWER_PERIOD;
+        range->pmt_flags = IW_POWER_ON;
+        range->pm_capa = IW_POWER_PERIOD | IW_POWER_ALL_R;
+
+        range->encoding_size[0] = WEP_SMALL_KEY_LEN;
+        range->encoding_size[1] = WEP_LARGE_KEY_LEN;
+        range->num_encoding_sizes = 2;
+        range->max_encoding_tokens = WEP_KEYS;
+
+        /* both WL-240U and Linksys WUSB11 v2.6 specify 15 dBm as output power
+           - take this for all (ignore antenna gains) */
+        range->txpower[0] = 15;
+        range->num_txpower = 1;
+        range->txpower_capa = IW_TXPOW_DBM;
+
+        range->we_version_source = WIRELESS_EXT;
+        range->we_version_compiled = WIRELESS_EXT;
+
+        /* same as the values used in atmel.c */
+        range->retry_capa = IW_RETRY_LIMIT;
+        range->retry_flags = IW_RETRY_LIMIT;
+        range->r_time_flags = 0;
+        range->min_retry = 1;
+        range->max_retry = 255;
+
+        range->num_channels = NUM_CHANNELS;
+        range->num_frequency = 0;
+
+        for (i = 0; i < NUM_CHANNELS; i++) {
+                /* test if channel map bit is raised */
+                if (priv->domain->channel_map & (0x1 << i)) {
+                        range->num_frequency += 1;
+
+                        range->freq[i].i = i + 1;
+                        range->freq[i].m = channel_frequency[i] * 100000;
+                        range->freq[i].e = 1;   /* freq * 10^1 */
+                }
+        }
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWRANGE", netdev->name);
+
+        return 0;
+}
+
+static int at76_iw_handler_set_spy(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWSPY - number of addresses %d",
+                 netdev->name, data->length);
+
+        spin_lock_bh(&priv->spy_spinlock);
+        ret = iw_handler_set_spy(priv->netdev, info, (union iwreq_data *)data,
+                                 extra);
+        spin_unlock_bh(&priv->spy_spinlock);
+
+        return ret;
+}
+
+static int at76_iw_handler_get_spy(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct iw_point *data, char *extra)
+{
+
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        spin_lock_bh(&priv->spy_spinlock);
+        ret = iw_handler_get_spy(priv->netdev, info,
+                                 (union iwreq_data *)data, extra);
+        spin_unlock_bh(&priv->spy_spinlock);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWSPY - number of addresses %d",
+                 netdev->name, data->length);
+
+        return ret;
+}
+
+static int at76_iw_handler_set_thrspy(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWTHRSPY - number of addresses %d)",
+                 netdev->name, data->length);
+
+        spin_lock_bh(&priv->spy_spinlock);
+        ret = iw_handler_set_thrspy(netdev, info, (union iwreq_data *)data,
+                                    extra);
+        spin_unlock_bh(&priv->spy_spinlock);
+
+        return ret;
+}
+
+static int at76_iw_handler_get_thrspy(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret;
+
+        spin_lock_bh(&priv->spy_spinlock);
+        ret = iw_handler_get_thrspy(netdev, info, (union iwreq_data *)data,
+                                    extra);
+        spin_unlock_bh(&priv->spy_spinlock);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWTHRSPY - number of addresses %d)",
+                 netdev->name, data->length);
+
+        return ret;
+}
+
+static int at76_iw_handler_set_wap(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct sockaddr *ap_addr, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWAP - wap/bssid %s", netdev->name,
+                 mac2str(ap_addr->sa_data));
+
+        /* if the incoming address == ff:ff:ff:ff:ff:ff, the user has
+           chosen any or auto AP preference */
+        if (is_broadcast_ether_addr(ap_addr->sa_data)
+            || is_zero_ether_addr(ap_addr->sa_data))
+                priv->wanted_bssid_valid = 0;
+        else {
+                /* user wants to set a preferred AP address */
+                priv->wanted_bssid_valid = 1;
+                memcpy(priv->wanted_bssid, ap_addr->sa_data, ETH_ALEN);
+        }
+
+        return -EIWCOMMIT;
+}
+
+static int at76_iw_handler_get_wap(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct sockaddr *ap_addr, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        ap_addr->sa_family = ARPHRD_ETHER;
+        memcpy(ap_addr->sa_data, priv->bssid, ETH_ALEN);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWAP - wap/bssid %s", netdev->name,
+                 mac2str(ap_addr->sa_data));
+
+        return 0;
+}
+
+static int at76_iw_handler_set_scan(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWSCAN", netdev->name);
+
+        if (mutex_lock_interruptible(&priv->mtx))
+                return -EINTR;
+
+        if (!netif_running(netdev)) {
+                ret = -ENETDOWN;
+                goto exit;
+        }
+
+        /* jal: we don't allow "iwlist ethX scan" while we are
+           in monitor mode */
+        if (priv->iw_mode == IW_MODE_MONITOR) {
+                ret = -EBUSY;
+                goto exit;
+        }
+
+        /* Discard old scan results */
+        if ((jiffies - priv->last_scan) > (20 * HZ))
+                priv->scan_state = SCAN_IDLE;
+        priv->last_scan = jiffies;
+
+        /* Initiate a scan command */
+        if (priv->scan_state == SCAN_IN_PROGRESS) {
+                ret = -EBUSY;
+                goto exit;
+        }
+
+        priv->scan_state = SCAN_IN_PROGRESS;
+
+        at76_quiesce(priv);
+
+        /* Try to do passive or active scan if WE asks as. */
+        if (wrqu->data.length
+            && wrqu->data.length == sizeof(struct iw_scan_req)) {
+                struct iw_scan_req *req = (struct iw_scan_req *)extra;
+
+                if (req->scan_type == IW_SCAN_TYPE_PASSIVE)
+                        priv->scan_mode = SCAN_TYPE_PASSIVE;
+                else if (req->scan_type == IW_SCAN_TYPE_ACTIVE)
+                        priv->scan_mode = SCAN_TYPE_ACTIVE;
+
+                /* Sanity check values? */
+                if (req->min_channel_time > 0)
+                        priv->scan_min_time = req->min_channel_time;
+
+                if (req->max_channel_time > 0)
+                        priv->scan_max_time = req->max_channel_time;
+        }
+
+        /* change to scanning state */
+        at76_set_mac_state(priv, MAC_SCANNING);
+        schedule_work(&priv->work_start_scan);
+
+exit:
+        mutex_unlock(&priv->mtx);
+        return ret;
+}
+
+static int at76_iw_handler_get_scan(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        unsigned long flags;
+        struct list_head *lptr, *nptr;
+        struct bss_info *curr_bss;
+        struct iw_event *iwe = kmalloc(sizeof(struct iw_event), GFP_KERNEL);
+        char *curr_val, *curr_pos = extra;
+        int i;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWSCAN", netdev->name);
+
+        if (!iwe)
+                return -ENOMEM;
+
+        if (priv->scan_state != SCAN_COMPLETED) {
+                /* scan not yet finished */
+                kfree(iwe);
+                return -EAGAIN;
+        }
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+
+        list_for_each_safe(lptr, nptr, &priv->bss_list) {
+                curr_bss = list_entry(lptr, struct bss_info, list);
+
+                iwe->cmd = SIOCGIWAP;
+                iwe->u.ap_addr.sa_family = ARPHRD_ETHER;
+                memcpy(iwe->u.ap_addr.sa_data, curr_bss->bssid, 6);
+                curr_pos = iwe_stream_add_event(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                IW_EV_ADDR_LEN);
+
+                iwe->u.data.length = curr_bss->ssid_len;
+                iwe->cmd = SIOCGIWESSID;
+                iwe->u.data.flags = 1;
+
+                curr_pos = iwe_stream_add_point(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                curr_bss->ssid);
+
+                iwe->cmd = SIOCGIWMODE;
+                iwe->u.mode = (curr_bss->capa & WLAN_CAPABILITY_IBSS) ?
+                    IW_MODE_ADHOC :
+                    (curr_bss->capa & WLAN_CAPABILITY_ESS) ?
+                    IW_MODE_MASTER : IW_MODE_AUTO;
+                /* IW_MODE_AUTO = 0 which I thought is
+                 * the most logical value to return in this case */
+                curr_pos = iwe_stream_add_event(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                IW_EV_UINT_LEN);
+
+                iwe->cmd = SIOCGIWFREQ;
+                iwe->u.freq.m = curr_bss->channel;
+                iwe->u.freq.e = 0;
+                curr_pos = iwe_stream_add_event(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                IW_EV_FREQ_LEN);
+
+                iwe->cmd = SIOCGIWENCODE;
+                if (curr_bss->capa & WLAN_CAPABILITY_PRIVACY)
+                        iwe->u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+                else
+                        iwe->u.data.flags = IW_ENCODE_DISABLED;
+
+                iwe->u.data.length = 0;
+                curr_pos = iwe_stream_add_point(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                NULL);
+
+                /* Add quality statistics */
+                iwe->cmd = IWEVQUAL;
+                iwe->u.qual.noise = 0;
+                iwe->u.qual.updated =
+                    IW_QUAL_NOISE_INVALID | IW_QUAL_LEVEL_UPDATED;
+                iwe->u.qual.level = (curr_bss->rssi * 100 / 42);
+                if (iwe->u.qual.level > 100)
+                        iwe->u.qual.level = 100;
+                if (at76_is_intersil(priv->board_type))
+                        iwe->u.qual.qual = curr_bss->link_qual;
+                else {
+                        iwe->u.qual.qual = 0;
+                        iwe->u.qual.updated |= IW_QUAL_QUAL_INVALID;
+                }
+                /* Add new value to event */
+                curr_pos = iwe_stream_add_event(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                IW_EV_QUAL_LEN);
+
+                /* Rate: stuffing multiple values in a single event requires
+                 * a bit more of magic - Jean II */
+                curr_val = curr_pos + IW_EV_LCP_LEN;
+
+                iwe->cmd = SIOCGIWRATE;
+                /* Those two flags are ignored... */
+                iwe->u.bitrate.fixed = 0;
+                iwe->u.bitrate.disabled = 0;
+                /* Max 8 values */
+                for (i = 0; i < curr_bss->rates_len; i++) {
+                        /* Bit rate given in 500 kb/s units (+ 0x80) */
+                        iwe->u.bitrate.value =
+                            ((curr_bss->rates[i] & 0x7f) * 500000);
+                        /* Add new value to event */
+                        curr_val = iwe_stream_add_value(info, curr_pos,
+                                                        curr_val,
+                                                        extra +
+                                                        IW_SCAN_MAX_DATA, iwe,
+                                                        IW_EV_PARAM_LEN);
+                }
+
+                /* Check if we added any event */
+                if ((curr_val - curr_pos) > IW_EV_LCP_LEN)
+                        curr_pos = curr_val;
+
+                /* more information may be sent back using IWECUSTOM */
+
+        }
+
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+
+        data->length = (curr_pos - extra);
+        data->flags = 0;
+
+        kfree(iwe);
+        return 0;
+}
+
+static int at76_iw_handler_set_essid(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWESSID - %s", netdev->name, extra);
+
+        if (data->flags) {
+                memcpy(priv->essid, extra, data->length);
+                priv->essid_size = data->length;
+        } else
+                priv->essid_size = 0;   /* Use any SSID */
+
+        return -EIWCOMMIT;
+}
+
+static int at76_iw_handler_get_essid(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        if (priv->essid_size) {
+                /* not the ANY ssid in priv->essid */
+                data->flags = 1;
+                data->length = priv->essid_size;
+                memcpy(extra, priv->essid, data->length);
+        } else {
+                /* the ANY ssid was specified */
+                if (priv->mac_state == MAC_CONNECTED && priv->curr_bss) {
+                        /* report the SSID we have found */
+                        data->flags = 1;
+                        data->length = priv->curr_bss->ssid_len;
+                        memcpy(extra, priv->curr_bss->ssid, data->length);
+                } else {
+                        /* report ANY back */
+                        data->flags = 0;
+                        data->length = 0;
+                }
+        }
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWESSID - %.*s", netdev->name,
+                 data->length, extra);
+
+        return 0;
+}
+
+static int at76_iw_handler_set_rate(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_param *bitrate, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWRATE - %d", netdev->name,
+                 bitrate->value);
+
+        switch (bitrate->value) {
+        case -1:
+                priv->txrate = TX_RATE_AUTO;
+                break;          /* auto rate */
+        case 1000000:
+                priv->txrate = TX_RATE_1MBIT;
+                break;
+        case 2000000:
+                priv->txrate = TX_RATE_2MBIT;
+                break;
+        case 5500000:
+                priv->txrate = TX_RATE_5_5MBIT;
+                break;
+        case 11000000:
+                priv->txrate = TX_RATE_11MBIT;
+                break;
+        default:
+                ret = -EINVAL;
+        }
+
+        return ret;
+}
+
+static int at76_iw_handler_get_rate(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_param *bitrate, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        switch (priv->txrate) {
+                /* return max rate if RATE_AUTO */
+        case TX_RATE_AUTO:
+                bitrate->value = 11000000;
+                break;
+        case TX_RATE_1MBIT:
+                bitrate->value = 1000000;
+                break;
+        case TX_RATE_2MBIT:
+                bitrate->value = 2000000;
+                break;
+        case TX_RATE_5_5MBIT:
+                bitrate->value = 5500000;
+                break;
+        case TX_RATE_11MBIT:
+                bitrate->value = 11000000;
+                break;
+        default:
+                ret = -EINVAL;
+        }
+
+        bitrate->fixed = (priv->txrate != TX_RATE_AUTO);
+        bitrate->disabled = 0;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWRATE - %d", netdev->name,
+                 bitrate->value);
+
+        return ret;
+}
+
+static int at76_iw_handler_set_rts(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct iw_param *rts, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = -EIWCOMMIT;
+        int rthr = rts->value;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWRTS - value %d disabled %s",
+                 netdev->name, rts->value, (rts->disabled) ? "true" : "false");
+
+        if (rts->disabled)
+                rthr = MAX_RTS_THRESHOLD;
+
+        if ((rthr < 0) || (rthr > MAX_RTS_THRESHOLD))
+                ret = -EINVAL;
+        else
+                priv->rts_threshold = rthr;
+
+        return ret;
+}
+
+static int at76_iw_handler_get_rts(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct iw_param *rts, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        rts->value = priv->rts_threshold;
+        rts->disabled = (rts->value >= MAX_RTS_THRESHOLD);
+        rts->fixed = 1;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWRTS - value %d disabled %s",
+                 netdev->name, rts->value, (rts->disabled) ? "true" : "false");
+
+        return 0;
+}
+
+static int at76_iw_handler_set_frag(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_param *frag, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = -EIWCOMMIT;
+        int fthr = frag->value;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWFRAG - value %d, disabled %s",
+                 netdev->name, frag->value,
+                 (frag->disabled) ? "true" : "false");
+
+        if (frag->disabled)
+                fthr = MAX_FRAG_THRESHOLD;
+
+        if ((fthr < MIN_FRAG_THRESHOLD) || (fthr > MAX_FRAG_THRESHOLD))
+                ret = -EINVAL;
+        else
+                priv->frag_threshold = fthr & ~0x1;     /* get an even value */
+
+        return ret;
+}
+
+static int at76_iw_handler_get_frag(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_param *frag, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        frag->value = priv->frag_threshold;
+        frag->disabled = (frag->value >= MAX_FRAG_THRESHOLD);
+        frag->fixed = 1;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWFRAG - value %d, disabled %s",
+                 netdev->name, frag->value,
+                 (frag->disabled) ? "true" : "false");
+
+        return 0;
+}
+
+static int at76_iw_handler_get_txpow(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *power, char *extra)
+{
+        power->value = 15;
+        power->fixed = 1;       /* No power control */
+        power->disabled = 0;
+        power->flags = IW_TXPOW_DBM;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWTXPOW - txpow %d dBm", netdev->name,
+                 power->value);
+
+        return 0;
+}
+
+/* jal: short retry is handled by the firmware (at least 0.90.x),
+   while long retry is not (?) */
+static int at76_iw_handler_set_retry(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *retry, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWRETRY disabled %d flags 0x%x val %d",
+                 netdev->name, retry->disabled, retry->flags, retry->value);
+
+        if (!retry->disabled && (retry->flags & IW_RETRY_LIMIT)) {
+                if ((retry->flags & IW_RETRY_MIN) ||
+                    !(retry->flags & IW_RETRY_MAX))
+                        priv->short_retry_limit = retry->value;
+                else
+                        ret = -EINVAL;
+        } else
+                ret = -EINVAL;
+
+        return ret;
+}
+
+/* Adapted (ripped) from atmel.c */
+static int at76_iw_handler_get_retry(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *retry, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWRETRY", netdev->name);
+
+        retry->disabled = 0;    /* Can't be disabled */
+        retry->flags = IW_RETRY_LIMIT;
+        retry->value = priv->short_retry_limit;
+
+        return 0;
+}
+
+static int at76_iw_handler_set_encode(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      struct iw_point *encoding, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int index = (encoding->flags & IW_ENCODE_INDEX) - 1;
+        int len = encoding->length;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWENCODE - enc.flags %08x "
+                 "pointer %p len %d", netdev->name, encoding->flags,
+                 encoding->pointer, encoding->length);
+        at76_dbg(DBG_IOCTL,
+                 "%s: SIOCSIWENCODE - old wepstate: enabled %s key_id %d "
+                 "auth_mode %s", netdev->name,
+                 (priv->wep_enabled) ? "true" : "false", priv->wep_key_id,
+                 (priv->auth_mode ==
+                  WLAN_AUTH_SHARED_KEY) ? "restricted" : "open");
+
+        /* take the old default key if index is invalid */
+        if ((index < 0) || (index >= WEP_KEYS))
+                index = priv->wep_key_id;
+
+        if (len > 0) {
+                if (len > WEP_LARGE_KEY_LEN)
+                        len = WEP_LARGE_KEY_LEN;
+
+                memset(priv->wep_keys[index], 0, WEP_KEY_LEN);
+                memcpy(priv->wep_keys[index], extra, len);
+                priv->wep_keys_len[index] = (len <= WEP_SMALL_KEY_LEN) ?
+                    WEP_SMALL_KEY_LEN : WEP_LARGE_KEY_LEN;
+                priv->wep_enabled = 1;
+        }
+
+        priv->wep_key_id = index;
+        priv->wep_enabled = ((encoding->flags & IW_ENCODE_DISABLED) == 0);
+
+        if (encoding->flags & IW_ENCODE_RESTRICTED)
+                priv->auth_mode = WLAN_AUTH_SHARED_KEY;
+        if (encoding->flags & IW_ENCODE_OPEN)
+                priv->auth_mode = WLAN_AUTH_OPEN;
+
+        at76_dbg(DBG_IOCTL,
+                 "%s: SIOCSIWENCODE - new wepstate: enabled %s key_id %d "
+                 "key_len %d auth_mode %s", netdev->name,
+                 (priv->wep_enabled) ? "true" : "false", priv->wep_key_id + 1,
+                 priv->wep_keys_len[priv->wep_key_id],
+                 (priv->auth_mode ==
+                  WLAN_AUTH_SHARED_KEY) ? "restricted" : "open");
+
+        return -EIWCOMMIT;
+}
+
+static int at76_iw_handler_get_encode(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      struct iw_point *encoding, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int index = (encoding->flags & IW_ENCODE_INDEX) - 1;
+
+        if ((index < 0) || (index >= WEP_KEYS))
+                index = priv->wep_key_id;
+
+        encoding->flags =
+            (priv->auth_mode == WLAN_AUTH_SHARED_KEY) ?
+            IW_ENCODE_RESTRICTED : IW_ENCODE_OPEN;
+
+        if (!priv->wep_enabled)
+                encoding->flags |= IW_ENCODE_DISABLED;
+
+        if (encoding->pointer) {
+                encoding->length = priv->wep_keys_len[index];
+
+                memcpy(extra, priv->wep_keys[index], priv->wep_keys_len[index]);
+
+                encoding->flags |= (index + 1);
+        }
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWENCODE - enc.flags %08x "
+                 "pointer %p len %d", netdev->name, encoding->flags,
+                 encoding->pointer, encoding->length);
+        at76_dbg(DBG_IOCTL,
+                 "%s: SIOCGIWENCODE - wepstate: enabled %s key_id %d "
+                 "key_len %d auth_mode %s", netdev->name,
+                 (priv->wep_enabled) ? "true" : "false", priv->wep_key_id + 1,
+                 priv->wep_keys_len[priv->wep_key_id],
+                 (priv->auth_mode ==
+                  WLAN_AUTH_SHARED_KEY) ? "restricted" : "open");
+
+        return 0;
+}
+
+static int at76_iw_handler_set_power(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *prq, char *extra)
+{
+        int err = -EIWCOMMIT;
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL,
+                 "%s: SIOCSIWPOWER - disabled %s flags 0x%x value 0x%x",
+                 netdev->name, (prq->disabled) ? "true" : "false", prq->flags,
+                 prq->value);
+
+        if (prq->disabled)
+                priv->pm_mode = AT76_PM_OFF;
+        else {
+                switch (prq->flags & IW_POWER_MODE) {
+                case IW_POWER_ALL_R:
+                case IW_POWER_ON:
+                        break;
+                default:
+                        err = -EINVAL;
+                        goto exit;
+                }
+                if (prq->flags & IW_POWER_PERIOD)
+                        priv->pm_period = prq->value;
+
+                if (prq->flags & IW_POWER_TIMEOUT) {
+                        err = -EINVAL;
+                        goto exit;
+                }
+                priv->pm_mode = AT76_PM_ON;
+        }
+exit:
+        return err;
+}
+
+static int at76_iw_handler_get_power(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *power, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        power->disabled = (priv->pm_mode == AT76_PM_OFF);
+        if (!power->disabled) {
+                power->flags = IW_POWER_PERIOD | IW_POWER_ALL_R;
+                power->value = priv->pm_period;
+        }
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWPOWER - %s flags 0x%x value 0x%x",
+                 netdev->name, power->disabled ? "disabled" : "enabled",
+                 power->flags, power->value);
+
+        return 0;
+}
+
+/*******************************************************************************
+ * Private IOCTLS
+ */
+static int at76_iw_set_short_preamble(struct net_device *netdev,
+                                      struct iw_request_info *info, char *name,
+                                      char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int val = *((int *)name);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_SHORT_PREAMBLE, %d",
+                 netdev->name, val);
+
+        if (val < PREAMBLE_TYPE_LONG || val > PREAMBLE_TYPE_AUTO)
+                ret = -EINVAL;
+        else
+                priv->preamble_type = val;
+
+        return ret;
+}
+
+static int at76_iw_get_short_preamble(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        snprintf(wrqu->name, sizeof(wrqu->name), "%s (%d)",
+                 preambles[priv->preamble_type], priv->preamble_type);
+        return 0;
+}
+
+static int at76_iw_set_debug(struct net_device *netdev,
+                             struct iw_request_info *info,
+                             struct iw_point *data, char *extra)
+{
+        char *ptr;
+        u32 val;
+
+        if (data->length > 0) {
+                val = simple_strtol(extra, &ptr, 0);
+
+                if (ptr == extra)
+                        val = DBG_DEFAULTS;
+
+                at76_dbg(DBG_IOCTL, "%s: AT76_SET_DEBUG input %d: %s -> 0x%x",
+                         netdev->name, data->length, extra, val);
+        } else
+                val = DBG_DEFAULTS;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_DEBUG, old 0x%x, new 0x%x",
+                 netdev->name, at76_debug, val);
+
+        /* jal: some more output to pin down lockups */
+        at76_dbg(DBG_IOCTL, "%s: netif running %d queue_stopped %d "
+                 "carrier_ok %d", netdev->name, netif_running(netdev),
+                 netif_queue_stopped(netdev), netif_carrier_ok(netdev));
+
+        at76_debug = val;
+
+        return 0;
+}
+
+static int at76_iw_get_debug(struct net_device *netdev,
+                             struct iw_request_info *info,
+                             union iwreq_data *wrqu, char *extra)
+{
+        snprintf(wrqu->name, sizeof(wrqu->name), "0x%08x", at76_debug);
+        return 0;
+}
+
+static int at76_iw_set_powersave_mode(struct net_device *netdev,
+                                      struct iw_request_info *info, char *name,
+                                      char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int val = *((int *)name);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_POWERSAVE_MODE, %d (%s)",
+                 netdev->name, val,
+                 val == AT76_PM_OFF ? "active" : val == AT76_PM_ON ? "save" :
+                 val == AT76_PM_SMART ? "smart save" : "<invalid>");
+        if (val < AT76_PM_OFF || val > AT76_PM_SMART)
+                ret = -EINVAL;
+        else
+                priv->pm_mode = val;
+
+        return ret;
+}
+
+static int at76_iw_get_powersave_mode(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int *param = (int *)extra;
+
+        param[0] = priv->pm_mode;
+        return 0;
+}
+
+static int at76_iw_set_scan_times(struct net_device *netdev,
+                                  struct iw_request_info *info, char *name,
+                                  char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int mint = *((int *)name);
+        int maxt = *((int *)name + 1);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_SCAN_TIMES - min %d max %d",
+                 netdev->name, mint, maxt);
+        if (mint <= 0 || maxt <= 0 || mint > maxt)
+                ret = -EINVAL;
+        else {
+                priv->scan_min_time = mint;
+                priv->scan_max_time = maxt;
+        }
+
+        return ret;
+}
+
+static int at76_iw_get_scan_times(struct net_device *netdev,
+                                  struct iw_request_info *info,
+                                  union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int *param = (int *)extra;
+
+        param[0] = priv->scan_min_time;
+        param[1] = priv->scan_max_time;
+        return 0;
+}
+
+static int at76_iw_set_scan_mode(struct net_device *netdev,
+                                 struct iw_request_info *info, char *name,
+                                 char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int val = *((int *)name);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_SCAN_MODE - mode %s",
+                 netdev->name, (val = SCAN_TYPE_ACTIVE) ? "active" :
+                 (val = SCAN_TYPE_PASSIVE) ? "passive" : "<invalid>");
+
+        if (val != SCAN_TYPE_ACTIVE && val != SCAN_TYPE_PASSIVE)
+                ret = -EINVAL;
+        else
+                priv->scan_mode = val;
+
+        return ret;
+}
+
+static int at76_iw_get_scan_mode(struct net_device *netdev,
+                                 struct iw_request_info *info,
+                                 union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int *param = (int *)extra;
+
+        param[0] = priv->scan_mode;
+        return 0;
+}
+
+#define AT76_SET_HANDLER(h, f) [h - SIOCIWFIRST] = (iw_handler) f
+
+/* Standard wireless handlers */
+static const iw_handler at76_handlers[] = {
+        AT76_SET_HANDLER(SIOCSIWCOMMIT, at76_iw_handler_commit),
+        AT76_SET_HANDLER(SIOCGIWNAME, at76_iw_handler_get_name),
+        AT76_SET_HANDLER(SIOCSIWFREQ, at76_iw_handler_set_freq),
+        AT76_SET_HANDLER(SIOCGIWFREQ, at76_iw_handler_get_freq),
+        AT76_SET_HANDLER(SIOCSIWMODE, at76_iw_handler_set_mode),
+        AT76_SET_HANDLER(SIOCGIWMODE, at76_iw_handler_get_mode),
+        AT76_SET_HANDLER(SIOCGIWRANGE, at76_iw_handler_get_range),
+        AT76_SET_HANDLER(SIOCSIWSPY, at76_iw_handler_set_spy),
+        AT76_SET_HANDLER(SIOCGIWSPY, at76_iw_handler_get_spy),
+        AT76_SET_HANDLER(SIOCSIWTHRSPY, at76_iw_handler_set_thrspy),
+        AT76_SET_HANDLER(SIOCGIWTHRSPY, at76_iw_handler_get_thrspy),
+        AT76_SET_HANDLER(SIOCSIWAP, at76_iw_handler_set_wap),
+        AT76_SET_HANDLER(SIOCGIWAP, at76_iw_handler_get_wap),
+        AT76_SET_HANDLER(SIOCSIWSCAN, at76_iw_handler_set_scan),
+        AT76_SET_HANDLER(SIOCGIWSCAN, at76_iw_handler_get_scan),
+        AT76_SET_HANDLER(SIOCSIWESSID, at76_iw_handler_set_essid),
+        AT76_SET_HANDLER(SIOCGIWESSID, at76_iw_handler_get_essid),
+        AT76_SET_HANDLER(SIOCSIWRATE, at76_iw_handler_set_rate),
+        AT76_SET_HANDLER(SIOCGIWRATE, at76_iw_handler_get_rate),
+        AT76_SET_HANDLER(SIOCSIWRTS, at76_iw_handler_set_rts),
+        AT76_SET_HANDLER(SIOCGIWRTS, at76_iw_handler_get_rts),
+        AT76_SET_HANDLER(SIOCSIWFRAG, at76_iw_handler_set_frag),
+        AT76_SET_HANDLER(SIOCGIWFRAG, at76_iw_handler_get_frag),
+        AT76_SET_HANDLER(SIOCGIWTXPOW, at76_iw_handler_get_txpow),
+        AT76_SET_HANDLER(SIOCSIWRETRY, at76_iw_handler_set_retry),
+        AT76_SET_HANDLER(SIOCGIWRETRY, at76_iw_handler_get_retry),
+        AT76_SET_HANDLER(SIOCSIWENCODE, at76_iw_handler_set_encode),
+        AT76_SET_HANDLER(SIOCGIWENCODE, at76_iw_handler_get_encode),
+        AT76_SET_HANDLER(SIOCSIWPOWER, at76_iw_handler_set_power),
+        AT76_SET_HANDLER(SIOCGIWPOWER, at76_iw_handler_get_power)
+};
+
+#define AT76_SET_PRIV(h, f) [h - SIOCIWFIRSTPRIV] = (iw_handler) f
+
+/* Private wireless handlers */
+static const iw_handler at76_priv_handlers[] = {
+        AT76_SET_PRIV(AT76_SET_SHORT_PREAMBLE, at76_iw_set_short_preamble),
+        AT76_SET_PRIV(AT76_GET_SHORT_PREAMBLE, at76_iw_get_short_preamble),
+        AT76_SET_PRIV(AT76_SET_DEBUG, at76_iw_set_debug),
+        AT76_SET_PRIV(AT76_GET_DEBUG, at76_iw_get_debug),
+        AT76_SET_PRIV(AT76_SET_POWERSAVE_MODE, at76_iw_set_powersave_mode),
+        AT76_SET_PRIV(AT76_GET_POWERSAVE_MODE, at76_iw_get_powersave_mode),
+        AT76_SET_PRIV(AT76_SET_SCAN_TIMES, at76_iw_set_scan_times),
+        AT76_SET_PRIV(AT76_GET_SCAN_TIMES, at76_iw_get_scan_times),
+        AT76_SET_PRIV(AT76_SET_SCAN_MODE, at76_iw_set_scan_mode),
+        AT76_SET_PRIV(AT76_GET_SCAN_MODE, at76_iw_get_scan_mode),
+};
+
+/* Names and arguments of private wireless handlers */
+static const struct iw_priv_args at76_priv_args[] = {
+        /* 0 - long, 1 - short */
+        {AT76_SET_SHORT_PREAMBLE,
+         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "set_preamble"},
+
+        {AT76_GET_SHORT_PREAMBLE,
+         0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 10, "get_preamble"},
+
+        /* we must pass the new debug mask as a string, because iwpriv cannot
+         * parse hex numbers starting with 0x :-(  */
+        {AT76_SET_DEBUG,
+         IW_PRIV_TYPE_CHAR | 10, 0, "set_debug"},
+
+        {AT76_GET_DEBUG,
+         0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 10, "get_debug"},
+
+        /* 1 - active, 2 - power save, 3 - smart power save */
+        {AT76_SET_POWERSAVE_MODE,
+         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "set_powersave"},
+
+        {AT76_GET_POWERSAVE_MODE,
+         0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_powersave"},
+
+        /* min_channel_time, max_channel_time */
+        {AT76_SET_SCAN_TIMES,
+         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "set_scan_times"},
+
+        {AT76_GET_SCAN_TIMES,
+         0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, "get_scan_times"},
+
+        /* 0 - active, 1 - passive scan */
+        {AT76_SET_SCAN_MODE,
+         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "set_scan_mode"},
+
+        {AT76_GET_SCAN_MODE,
+         0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_scan_mode"},
+};
+
+static const struct iw_handler_def at76_handler_def = {
+        .num_standard = ARRAY_SIZE(at76_handlers),
+        .num_private = ARRAY_SIZE(at76_priv_handlers),
+        .num_private_args = ARRAY_SIZE(at76_priv_args),
+        .standard = at76_handlers,
+        .private = at76_priv_handlers,
+        .private_args = at76_priv_args,
+        .get_wireless_stats = at76_get_wireless_stats,
+};
+
+static const u8 snapsig[] = { 0xaa, 0xaa, 0x03 };
+
+/* RFC 1042 encapsulates Ethernet frames in 802.2 SNAP (0xaa, 0xaa, 0x03) with
+ * a SNAP OID of 0 (0x00, 0x00, 0x00) */
+static const u8 rfc1042sig[] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+
+static int at76_tx(struct sk_buff *skb, struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        struct net_device_stats *stats = &priv->stats;
+        int ret = 0;
+        int wlen;
+        int submit_len;
+        struct at76_tx_buffer *tx_buffer = priv->bulk_out_buffer;
+        struct ieee80211_hdr_3addr *i802_11_hdr =
+            (struct ieee80211_hdr_3addr *)tx_buffer->packet;
+        u8 *payload = i802_11_hdr->payload;
+        struct ethhdr *eh = (struct ethhdr *)skb->data;
+
+        if (netif_queue_stopped(netdev)) {
+                printk(KERN_ERR "%s: %s called while netdev is stopped\n",
+                       netdev->name, __func__);
+                /* skip this packet */
+                dev_kfree_skb(skb);
+                return 0;
+        }
+
+        if (priv->tx_urb->status == -EINPROGRESS) {
+                printk(KERN_ERR "%s: %s called while tx urb is pending\n",
+                       netdev->name, __func__);
+                /* skip this packet */
+                dev_kfree_skb(skb);
+                return 0;
+        }
+
+        if (skb->len < ETH_HLEN) {
+                printk(KERN_ERR "%s: %s: skb too short (%d)\n",
+                       netdev->name, __func__, skb->len);
+                dev_kfree_skb(skb);
+                return 0;
+        }
+
+        at76_ledtrig_tx_activity();     /* tell ledtrigger we send a packet */
+
+        /* we can get rid of memcpy if we set netdev->hard_header_len to
+           reserve enough space, but we would need to keep the skb around */
+
+        if (ntohs(eh->h_proto) <= ETH_DATA_LEN) {
+                /* this is a 802.3 packet */
+                if (skb->len >= ETH_HLEN + sizeof(rfc1042sig)
+                    && skb->data[ETH_HLEN] == rfc1042sig[0]
+                    && skb->data[ETH_HLEN + 1] == rfc1042sig[1]) {
+                        /* higher layer delivered SNAP header - keep it */
+                        memcpy(payload, skb->data + ETH_HLEN,
+                               skb->len - ETH_HLEN);
+                        wlen = IEEE80211_3ADDR_LEN + skb->len - ETH_HLEN;
+                } else {
+                        printk(KERN_ERR "%s: dropping non-SNAP 802.2 packet "
+                               "(DSAP 0x%02x SSAP 0x%02x cntrl 0x%02x)\n",
+                               priv->netdev->name, skb->data[ETH_HLEN],
+                               skb->data[ETH_HLEN + 1],
+                               skb->data[ETH_HLEN + 2]);
+                        dev_kfree_skb(skb);
+                        return 0;
+                }
+        } else {
+                /* add RFC 1042 header in front */
+                memcpy(payload, rfc1042sig, sizeof(rfc1042sig));
+                memcpy(payload + sizeof(rfc1042sig), &eh->h_proto,
+                       skb->len - offsetof(struct ethhdr, h_proto));
+                wlen = IEEE80211_3ADDR_LEN + sizeof(rfc1042sig) + skb->len -
+                    offsetof(struct ethhdr, h_proto);
+        }
+
+        /* make wireless header */
+        i802_11_hdr->frame_ctl =
+            cpu_to_le16(IEEE80211_FTYPE_DATA |
+                        (priv->wep_enabled ? IEEE80211_FCTL_PROTECTED : 0) |
+                        (priv->iw_mode ==
+                         IW_MODE_INFRA ? IEEE80211_FCTL_TODS : 0));
+
+        if (priv->iw_mode == IW_MODE_ADHOC) {
+                memcpy(i802_11_hdr->addr1, eh->h_dest, ETH_ALEN);
+                memcpy(i802_11_hdr->addr2, eh->h_source, ETH_ALEN);
+                memcpy(i802_11_hdr->addr3, priv->bssid, ETH_ALEN);
+        } else if (priv->iw_mode == IW_MODE_INFRA) {
+                memcpy(i802_11_hdr->addr1, priv->bssid, ETH_ALEN);
+                memcpy(i802_11_hdr->addr2, eh->h_source, ETH_ALEN);
+                memcpy(i802_11_hdr->addr3, eh->h_dest, ETH_ALEN);
+        }
+
+        i802_11_hdr->duration_id = cpu_to_le16(0);
+        i802_11_hdr->seq_ctl = cpu_to_le16(0);
+
+        /* setup 'Atmel' header */
+        tx_buffer->wlength = cpu_to_le16(wlen);
+        tx_buffer->tx_rate = priv->txrate;
+        /* for broadcast destination addresses, the firmware 0.100.x
+           seems to choose the highest rate set with CMD_STARTUP in
+           basic_rate_set replacing this value */
+
+        memset(tx_buffer->reserved, 0, sizeof(tx_buffer->reserved));
+
+        tx_buffer->padding = at76_calc_padding(wlen);
+        submit_len = wlen + AT76_TX_HDRLEN + tx_buffer->padding;
+
+        at76_dbg(DBG_TX_DATA_CONTENT, "%s skb->data %s", priv->netdev->name,
+                 hex2str(skb->data, 32));
+        at76_dbg(DBG_TX_DATA, "%s tx: wlen 0x%x pad 0x%x rate %d hdr %s",
+                 priv->netdev->name,
+                 le16_to_cpu(tx_buffer->wlength),
+                 tx_buffer->padding, tx_buffer->tx_rate,
+                 hex2str(i802_11_hdr, sizeof(*i802_11_hdr)));
+        at76_dbg(DBG_TX_DATA_CONTENT, "%s payload %s", priv->netdev->name,
+                 hex2str(payload, 48));
+
+        /* send stuff */
+        netif_stop_queue(netdev);
+        netdev->trans_start = jiffies;
+
+        usb_fill_bulk_urb(priv->tx_urb, priv->udev, priv->tx_pipe, tx_buffer,
+                          submit_len, at76_tx_callback, priv);
+        ret = usb_submit_urb(priv->tx_urb, GFP_ATOMIC);
+        if (ret) {
+                stats->tx_errors++;
+                printk(KERN_ERR "%s: error in tx submit urb: %d\n",
+                       netdev->name, ret);
+                if (ret == -EINVAL)
+                        printk(KERN_ERR
+                               "%s: -EINVAL: tx urb %p hcpriv %p complete %p\n",
+                               priv->netdev->name, priv->tx_urb,
+                               priv->tx_urb->hcpriv, priv->tx_urb->complete);
+        } else {
+                stats->tx_bytes += skb->len;
+                dev_kfree_skb(skb);
+        }
+
+        return ret;
+}
+
+static void at76_tx_timeout(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        if (!priv)
+                return;
+        dev_warn(&netdev->dev, "tx timeout.");
+
+        usb_unlink_urb(priv->tx_urb);
+        priv->stats.tx_errors++;
+}
+
 static int at76_submit_rx_urb(struct at76_priv *priv)
 {
         int ret;
@@ -1327,7 +3270,7 @@ static int at76_submit_rx_urb(struct at76_priv *priv)
 
         if (!priv->rx_urb) {
                 printk(KERN_ERR "%s: %s: priv->rx_urb is NULL\n",
-                       wiphy_name(priv->hw->wiphy), __func__);
+                       priv->netdev->name, __func__);
                 return -EFAULT;
         }
 
@@ -1335,7 +3278,7 @@ static int at76_submit_rx_urb(struct at76_priv *priv)
                 skb = dev_alloc_skb(sizeof(struct at76_rx_buffer));
                 if (!skb) {
                         printk(KERN_ERR "%s: cannot allocate rx skbuff\n",
-                               wiphy_name(priv->hw->wiphy));
+                               priv->netdev->name);
                         ret = -ENOMEM;
                         goto exit;
                 }
@@ -1355,18 +3298,110 @@ static int at76_submit_rx_urb(struct at76_priv *priv)
                                  "usb_submit_urb returned -ENODEV");
                 else
                         printk(KERN_ERR "%s: rx, usb_submit_urb failed: %d\n",
-                               wiphy_name(priv->hw->wiphy), ret);
+                               priv->netdev->name, ret);
         }
 
 exit:
         if (ret < 0 && ret != -ENODEV)
                 printk(KERN_ERR "%s: cannot submit rx urb - please unload the "
                        "driver and/or power cycle the device\n",
-                       wiphy_name(priv->hw->wiphy));
+                       priv->netdev->name);
 
         return ret;
 }
 
+static int at76_open(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        at76_dbg(DBG_PROC_ENTRY, "%s(): entry", __func__);
+
+        if (mutex_lock_interruptible(&priv->mtx))
+                return -EINTR;
+
+        /* if netdev->dev_addr != priv->mac_addr we must
+           set the mac address in the device ! */
+        if (compare_ether_addr(netdev->dev_addr, priv->mac_addr)) {
+                if (at76_add_mac_address(priv, netdev->dev_addr) >= 0)
+                        at76_dbg(DBG_PROGRESS, "%s: set new MAC addr %s",
+                                 netdev->name, mac2str(netdev->dev_addr));
+        }
+
+        priv->scan_state = SCAN_IDLE;
+        priv->last_scan = jiffies;
+
+        ret = at76_submit_rx_urb(priv);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: open: submit_rx_urb failed: %d\n",
+                       netdev->name, ret);
+                goto error;
+        }
+
+        schedule_delayed_work(&priv->dwork_restart, 0);
+
+        at76_dbg(DBG_PROC_ENTRY, "%s(): end", __func__);
+error:
+        mutex_unlock(&priv->mtx);
+        return ret < 0 ? ret : 0;
+}
+
+static int at76_stop(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_DEVSTART, "%s: ENTER", __func__);
+
+        if (mutex_lock_interruptible(&priv->mtx))
+                return -EINTR;
+
+        at76_quiesce(priv);
+
+        if (!priv->device_unplugged) {
+                /* We are called by "ifconfig ethX down", not because the
+                 * device is not available anymore. */
+                at76_set_radio(priv, 0);
+
+                /* We unlink rx_urb because at76_open() re-submits it.
+                 * If unplugged, at76_delete_device() takes care of it. */
+                usb_kill_urb(priv->rx_urb);
+        }
+
+        /* free the bss_list */
+        at76_free_bss_list(priv);
+
+        mutex_unlock(&priv->mtx);
+        at76_dbg(DBG_DEVSTART, "%s: EXIT", __func__);
+
+        return 0;
+}
+
+static void at76_ethtool_get_drvinfo(struct net_device *netdev,
+                                     struct ethtool_drvinfo *info)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        strncpy(info->driver, DRIVER_NAME, sizeof(info->driver));
+        strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
+
+        usb_make_path(priv->udev, info->bus_info, sizeof(info->bus_info));
+
+        snprintf(info->fw_version, sizeof(info->fw_version), "%d.%d.%d-%d",
+                 priv->fw_version.major, priv->fw_version.minor,
+                 priv->fw_version.patch, priv->fw_version.build);
+}
+
+static u32 at76_ethtool_get_link(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        return priv->mac_state == MAC_CONNECTED;
+}
+
+static struct ethtool_ops at76_ethtool_ops = {
+        .get_drvinfo = at76_ethtool_get_drvinfo,
+        .get_link = at76_ethtool_get_link,
+};
+
 /* Download external firmware */
 static int at76_load_external_fw(struct usb_device *udev, struct fwentry *fwe)
 {
@@ -1463,6 +3498,406 @@ exit:
         return ret;
 }
 
+static int at76_match_essid(struct at76_priv *priv, struct bss_info *ptr)
+{
+        /* common criteria for both modi */
+
+        int ret = (priv->essid_size == 0 /* ANY ssid */  ||
+                   (priv->essid_size == ptr->ssid_len &&
+                    !memcmp(priv->essid, ptr->ssid, ptr->ssid_len)));
+        if (!ret)
+                at76_dbg(DBG_BSS_MATCH,
+                         "%s bss table entry %p: essid didn't match",
+                         priv->netdev->name, ptr);
+        return ret;
+}
+
+static inline int at76_match_mode(struct at76_priv *priv, struct bss_info *ptr)
+{
+        int ret;
+
+        if (priv->iw_mode == IW_MODE_ADHOC)
+                ret = ptr->capa & WLAN_CAPABILITY_IBSS;
+        else
+                ret = ptr->capa & WLAN_CAPABILITY_ESS;
+        if (!ret)
+                at76_dbg(DBG_BSS_MATCH,
+                         "%s bss table entry %p: mode didn't match",
+                         priv->netdev->name, ptr);
+        return ret;
+}
+
+static int at76_match_rates(struct at76_priv *priv, struct bss_info *ptr)
+{
+        int i;
+
+        for (i = 0; i < ptr->rates_len; i++) {
+                u8 rate = ptr->rates[i];
+
+                if (!(rate & 0x80))
+                        continue;
+
+                /* this is a basic rate we have to support
+                   (see IEEE802.11, ch. 7.3.2.2) */
+                if (rate != (0x80 | hw_rates[0])
+                    && rate != (0x80 | hw_rates[1])
+                    && rate != (0x80 | hw_rates[2])
+                    && rate != (0x80 | hw_rates[3])) {
+                        at76_dbg(DBG_BSS_MATCH,
+                                 "%s: bss table entry %p: basic rate %02x not "
+                                 "supported", priv->netdev->name, ptr, rate);
+                        return 0;
+                }
+        }
+
+        /* if we use short preamble, the bss must support it */
+        if (priv->preamble_type == PREAMBLE_TYPE_SHORT &&
+            !(ptr->capa & WLAN_CAPABILITY_SHORT_PREAMBLE)) {
+                at76_dbg(DBG_BSS_MATCH,
+                         "%s: %p does not support short preamble",
+                         priv->netdev->name, ptr);
+                return 0;
+        } else
+                return 1;
+}
+
+static inline int at76_match_wep(struct at76_priv *priv, struct bss_info *ptr)
+{
+        if (!priv->wep_enabled && ptr->capa & WLAN_CAPABILITY_PRIVACY) {
+                /* we have disabled WEP, but the BSS signals privacy */
+                at76_dbg(DBG_BSS_MATCH,
+                         "%s: bss table entry %p: requires encryption",
+                         priv->netdev->name, ptr);
+                return 0;
+        }
+        /* otherwise if the BSS does not signal privacy it may well
+           accept encrypted packets from us ... */
+        return 1;
+}
+
+static inline int at76_match_bssid(struct at76_priv *priv, struct bss_info *ptr)
+{
+        if (!priv->wanted_bssid_valid ||
+            !compare_ether_addr(ptr->bssid, priv->wanted_bssid))
+                return 1;
+
+        at76_dbg(DBG_BSS_MATCH,
+                 "%s: requested bssid - %s does not match",
+                 priv->netdev->name, mac2str(priv->wanted_bssid));
+        at76_dbg(DBG_BSS_MATCH,
+                 "      AP bssid - %s of bss table entry %p",
+                 mac2str(ptr->bssid), ptr);
+        return 0;
+}
+
+/**
+ * at76_match_bss - try to find a matching bss in priv->bss
+ *
+ * last - last bss tried
+ *
+ * last == NULL signals a new round starting with priv->bss_list.next
+ * this function must be called inside an acquired priv->bss_list_spinlock
+ * otherwise the timeout on bss may remove the newly chosen entry
+ */
+static struct bss_info *at76_match_bss(struct at76_priv *priv,
+                                       struct bss_info *last)
+{
+        struct bss_info *ptr = NULL;
+        struct list_head *curr;
+
+        curr = last ? last->list.next : priv->bss_list.next;
+        while (curr != &priv->bss_list) {
+                ptr = list_entry(curr, struct bss_info, list);
+                if (at76_match_essid(priv, ptr) && at76_match_mode(priv, ptr)
+                    && at76_match_wep(priv, ptr) && at76_match_rates(priv, ptr)
+                    && at76_match_bssid(priv, ptr))
+                        break;
+                curr = curr->next;
+        }
+
+        if (curr == &priv->bss_list)
+                ptr = NULL;
+        /* otherwise ptr points to the struct bss_info we have chosen */
+
+        at76_dbg(DBG_BSS_TABLE, "%s %s: returned %p", priv->netdev->name,
+                 __func__, ptr);
+        return ptr;
+}
+
+/* Start joining a matching BSS, or create own IBSS */
+static void at76_work_join(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_join);
+        int ret;
+        unsigned long flags;
+
+        mutex_lock(&priv->mtx);
+
+        WARN_ON(priv->mac_state != MAC_JOINING);
+        if (priv->mac_state != MAC_JOINING)
+                goto exit;
+
+        /* secure the access to priv->curr_bss ! */
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+        priv->curr_bss = at76_match_bss(priv, priv->curr_bss);
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+
+        if (!priv->curr_bss) {
+                /* here we haven't found a matching (i)bss ... */
+                if (priv->iw_mode == IW_MODE_ADHOC) {
+                        at76_set_mac_state(priv, MAC_OWN_IBSS);
+                        at76_start_ibss(priv);
+                        goto exit;
+                }
+                /* haven't found a matching BSS in infra mode - try again */
+                at76_set_mac_state(priv, MAC_SCANNING);
+                schedule_work(&priv->work_start_scan);
+                goto exit;
+        }
+
+        ret = at76_join_bss(priv, priv->curr_bss);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: join_bss failed with %d\n",
+                       priv->netdev->name, ret);
+                goto exit;
+        }
+
+        ret = at76_wait_completion(priv, CMD_JOIN);
+        if (ret != CMD_STATUS_COMPLETE) {
+                if (ret != CMD_STATUS_TIME_OUT)
+                        printk(KERN_ERR "%s: join_bss completed with %d\n",
+                               priv->netdev->name, ret);
+                else
+                        printk(KERN_INFO "%s: join_bss ssid %s timed out\n",
+                               priv->netdev->name,
+                               mac2str(priv->curr_bss->bssid));
+
+                /* retry next BSS immediately */
+                schedule_work(&priv->work_join);
+                goto exit;
+        }
+
+        /* here we have joined the (I)BSS */
+        if (priv->iw_mode == IW_MODE_ADHOC) {
+                struct bss_info *bptr = priv->curr_bss;
+                at76_set_mac_state(priv, MAC_CONNECTED);
+                /* get ESSID, BSSID and channel for priv->curr_bss */
+                priv->essid_size = bptr->ssid_len;
+                memcpy(priv->essid, bptr->ssid, bptr->ssid_len);
+                memcpy(priv->bssid, bptr->bssid, ETH_ALEN);
+                priv->channel = bptr->channel;
+                at76_iwevent_bss_connect(priv->netdev, bptr->bssid);
+                netif_carrier_on(priv->netdev);
+                netif_start_queue(priv->netdev);
+                /* just to be sure */
+                cancel_delayed_work(&priv->dwork_get_scan);
+                cancel_delayed_work(&priv->dwork_auth);
+                cancel_delayed_work(&priv->dwork_assoc);
+        } else {
+                /* send auth req */
+                priv->retries = AUTH_RETRIES;
+                at76_set_mac_state(priv, MAC_AUTH);
+                at76_auth_req(priv, priv->curr_bss, 1, NULL);
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer + HZ", __func__, __LINE__);
+                schedule_delayed_work(&priv->dwork_auth, AUTH_TIMEOUT);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Reap scan results */
+static void at76_dwork_get_scan(struct work_struct *work)
+{
+        int status;
+        int ret;
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_get_scan.work);
+
+        mutex_lock(&priv->mtx);
+        WARN_ON(priv->mac_state != MAC_SCANNING);
+        if (priv->mac_state != MAC_SCANNING)
+                goto exit;
+
+        status = at76_get_cmd_status(priv->udev, CMD_SCAN);
+        if (status < 0) {
+                printk(KERN_ERR "%s: %s: at76_get_cmd_status failed with %d\n",
+                       priv->netdev->name, __func__, status);
+                status = CMD_STATUS_IN_PROGRESS;
+                /* INFO: Hope it was a one off error - if not, scanning
+                   further down the line and stop this cycle */
+        }
+        at76_dbg(DBG_PROGRESS,
+                 "%s %s: got cmd_status %d (state %s, need_any %d)",
+                 priv->netdev->name, __func__, status,
+                 mac_states[priv->mac_state], priv->scan_need_any);
+
+        if (status != CMD_STATUS_COMPLETE) {
+                if ((status != CMD_STATUS_IN_PROGRESS) &&
+                    (status != CMD_STATUS_IDLE))
+                        printk(KERN_ERR "%s: %s: Bad scan status: %s\n",
+                               priv->netdev->name, __func__,
+                               at76_get_cmd_status_string(status));
+
+                /* the first cmd status after scan start is always a IDLE ->
+                   start the timer to poll again until COMPLETED */
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer for %d ticks",
+                         __func__, __LINE__, SCAN_POLL_INTERVAL);
+                schedule_delayed_work(&priv->dwork_get_scan,
+                                      SCAN_POLL_INTERVAL);
+                goto exit;
+        }
+
+        if (at76_debug & DBG_BSS_TABLE)
+                at76_dump_bss_table(priv);
+
+        if (priv->scan_need_any) {
+                ret = at76_start_scan(priv, 0);
+                if (ret < 0)
+                        printk(KERN_ERR
+                               "%s: %s: start_scan (ANY) failed with %d\n",
+                               priv->netdev->name, __func__, ret);
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer for %d ticks", __func__,
+                         __LINE__, SCAN_POLL_INTERVAL);
+                schedule_delayed_work(&priv->dwork_get_scan,
+                                      SCAN_POLL_INTERVAL);
+                priv->scan_need_any = 0;
+        } else {
+                priv->scan_state = SCAN_COMPLETED;
+                /* report the end of scan to user space */
+                at76_iwevent_scan_complete(priv->netdev);
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Handle loss of beacons from the AP */
+static void at76_dwork_beacon(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_beacon.work);
+
+        mutex_lock(&priv->mtx);
+        if (priv->mac_state != MAC_CONNECTED || priv->iw_mode != IW_MODE_INFRA)
+                goto exit;
+
+        /* We haven't received any beacons from out AP for BEACON_TIMEOUT */
+        printk(KERN_INFO "%s: lost beacon bssid %s\n",
+               priv->netdev->name, mac2str(priv->curr_bss->bssid));
+
+        netif_carrier_off(priv->netdev);
+        netif_stop_queue(priv->netdev);
+        at76_iwevent_bss_disconnect(priv->netdev);
+        at76_set_mac_state(priv, MAC_SCANNING);
+        schedule_work(&priv->work_start_scan);
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Handle authentication response timeout */
+static void at76_dwork_auth(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_auth.work);
+
+        mutex_lock(&priv->mtx);
+        WARN_ON(priv->mac_state != MAC_AUTH);
+        if (priv->mac_state != MAC_AUTH)
+                goto exit;
+
+        at76_dbg(DBG_PROGRESS, "%s: authentication response timeout",
+                 priv->netdev->name);
+
+        if (priv->retries-- >= 0) {
+                at76_auth_req(priv, priv->curr_bss, 1, NULL);
+                at76_dbg(DBG_MGMT_TIMER, "%s:%d: starting mgmt_timer + HZ",
+                         __func__, __LINE__);
+                schedule_delayed_work(&priv->dwork_auth, AUTH_TIMEOUT);
+        } else {
+                /* try to get next matching BSS */
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Handle association response timeout */
+static void at76_dwork_assoc(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_assoc.work);
+
+        mutex_lock(&priv->mtx);
+        WARN_ON(priv->mac_state != MAC_ASSOC);
+        if (priv->mac_state != MAC_ASSOC)
+                goto exit;
+
+        at76_dbg(DBG_PROGRESS, "%s: association response timeout",
+                 priv->netdev->name);
+
+        if (priv->retries-- >= 0) {
+                at76_assoc_req(priv, priv->curr_bss);
+                at76_dbg(DBG_MGMT_TIMER, "%s:%d: starting mgmt_timer + HZ",
+                         __func__, __LINE__);
+                schedule_delayed_work(&priv->dwork_assoc, ASSOC_TIMEOUT);
+        } else {
+                /* try to get next matching BSS */
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Read new bssid in ad-hoc mode */
+static void at76_work_new_bss(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_new_bss);
+        int ret;
+        struct mib_mac_mgmt mac_mgmt;
+
+        mutex_lock(&priv->mtx);
+
+        ret = at76_get_mib(priv->udev, MIB_MAC_MGMT, &mac_mgmt,
+                           sizeof(struct mib_mac_mgmt));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib failed: %d\n",
+                       priv->netdev->name, ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_PROGRESS, "ibss_change = 0x%2x", mac_mgmt.ibss_change);
+        memcpy(priv->bssid, mac_mgmt.current_bssid, ETH_ALEN);
+        at76_dbg(DBG_PROGRESS, "using BSSID %s", mac2str(priv->bssid));
+
+        at76_iwevent_bss_connect(priv->netdev, priv->bssid);
+
+        priv->mib_buf.type = MIB_MAC_MGMT;
+        priv->mib_buf.size = 1;
+        priv->mib_buf.index = offsetof(struct mib_mac_mgmt, ibss_change);
+        priv->mib_buf.data.byte = 0;
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (ibss change ok) failed: %d\n",
+                       priv->netdev->name, ret);
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
 static int at76_startup_device(struct at76_priv *priv)
 {
         struct at76_card_config *ccfg = &priv->card_config;
@@ -1470,14 +3905,14 @@ static int at76_startup_device(struct at76_priv *priv)
 
         at76_dbg(DBG_PARAMS,
                  "%s param: ssid %.*s (%s) mode %s ch %d wep %s key %d "
-                 "keylen %d", wiphy_name(priv->hw->wiphy), priv->essid_size,
-                 priv->essid, hex2str(priv->essid, IW_ESSID_MAX_SIZE),
+                 "keylen %d", priv->netdev->name, priv->essid_size, priv->essid,
+                 hex2str(priv->essid, IW_ESSID_MAX_SIZE),
                  priv->iw_mode == IW_MODE_ADHOC ? "adhoc" : "infra",
                  priv->channel, priv->wep_enabled ? "enabled" : "disabled",
                  priv->wep_key_id, priv->wep_keys_len[priv->wep_key_id]);
         at76_dbg(DBG_PARAMS,
                  "%s param: preamble %s rts %d retry %d frag %d "
-                 "txrate %s auth_mode %d", wiphy_name(priv->hw->wiphy),
+                 "txrate %s auth_mode %d", priv->netdev->name,
                  preambles[priv->preamble_type], priv->rts_threshold,
                  priv->short_retry_limit, priv->frag_threshold,
                  priv->txrate == TX_RATE_1MBIT ? "1MBit" : priv->txrate ==
@@ -1488,7 +3923,7 @@ static int at76_startup_device(struct at76_priv *priv)
         at76_dbg(DBG_PARAMS,
                  "%s param: pm_mode %d pm_period %d auth_mode %s "
                  "scan_times %d %d scan_mode %s",
-                 wiphy_name(priv->hw->wiphy), priv->pm_mode, priv->pm_period,
+                 priv->netdev->name, priv->pm_mode, priv->pm_period,
                  priv->auth_mode == WLAN_AUTH_OPEN ? "open" : "shared_secret",
                  priv->scan_min_time, priv->scan_max_time,
                  priv->scan_mode == SCAN_TYPE_ACTIVE ? "active" : "passive");
@@ -1522,8 +3957,7 @@ static int at76_startup_device(struct at76_priv *priv)
         ccfg->ssid_len = priv->essid_size;
 
         ccfg->wep_default_key_id = priv->wep_key_id;
-        memcpy(ccfg->wep_default_key_value, priv->wep_keys,
-               sizeof(priv->wep_keys));
+        memcpy(ccfg->wep_default_key_value, priv->wep_keys, 4 * WEP_KEY_LEN);
 
         ccfg->short_preamble = priv->preamble_type;
         ccfg->beacon_period = cpu_to_le16(priv->beacon_period);
@@ -1532,7 +3966,7 @@ static int at76_startup_device(struct at76_priv *priv)
                                     sizeof(struct at76_card_config));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 return ret;
         }
 
@@ -1578,6 +4012,69 @@ static int at76_startup_device(struct at76_priv *priv)
         return 0;
 }
 
+/* Restart the interface */
+static void at76_dwork_restart(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_restart.work);
+
+        mutex_lock(&priv->mtx);
+
+        netif_carrier_off(priv->netdev);        /* stop netdev watchdog */
+        netif_stop_queue(priv->netdev); /* stop tx data packets */
+
+        at76_startup_device(priv);
+
+        if (priv->iw_mode != IW_MODE_MONITOR) {
+                priv->netdev->type = ARPHRD_ETHER;
+                at76_set_mac_state(priv, MAC_SCANNING);
+                schedule_work(&priv->work_start_scan);
+        } else {
+                priv->netdev->type = ARPHRD_IEEE80211_RADIOTAP;
+                at76_start_monitor(priv);
+        }
+
+        mutex_unlock(&priv->mtx);
+}
+
+/* Initiate scanning */
+static void at76_work_start_scan(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_start_scan);
+        int ret;
+
+        mutex_lock(&priv->mtx);
+
+        WARN_ON(priv->mac_state != MAC_SCANNING);
+        if (priv->mac_state != MAC_SCANNING)
+                goto exit;
+
+        /* only clear the bss list when a scan is actively initiated,
+         * otherwise simply rely on at76_bss_list_timeout */
+        if (priv->scan_state == SCAN_IN_PROGRESS) {
+                at76_free_bss_list(priv);
+                priv->scan_need_any = 1;
+        } else
+                priv->scan_need_any = 0;
+
+        ret = at76_start_scan(priv, 1);
+
+        if (ret < 0)
+                printk(KERN_ERR "%s: %s: start_scan failed with %d\n",
+                       priv->netdev->name, __func__, ret);
+        else {
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer for %d ticks",
+                         __func__, __LINE__, SCAN_POLL_INTERVAL);
+                schedule_delayed_work(&priv->dwork_get_scan,
+                                      SCAN_POLL_INTERVAL);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
 /* Enable or disable promiscuous mode */
 static void at76_work_set_promisc(struct work_struct *work)
 {
@@ -1595,7 +4092,7 @@ static void at76_work_set_promisc(struct work_struct *work)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (promiscuous_mode) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         mutex_unlock(&priv->mtx);
 }
@@ -1611,759 +4108,1088 @@ static void at76_work_submit_rx(struct work_struct *work)
         mutex_unlock(&priv->mtx);
 }
 
-static void at76_rx_tasklet(unsigned long param)
+/* We got an association response */
+static void at76_rx_mgmt_assoc(struct at76_priv *priv,
+                               struct at76_rx_buffer *buf)
 {
-        struct urb *urb = (struct urb *)param;
-        struct at76_priv *priv = urb->context;
-        struct at76_rx_buffer *buf;
-        struct ieee80211_rx_status rx_status = { 0 };
-
-        if (priv->device_unplugged) {
-                at76_dbg(DBG_DEVSTART, "device unplugged");
-                if (urb)
-                        at76_dbg(DBG_DEVSTART, "urb status %d", urb->status);
+        struct ieee80211_assoc_response *resp =
+            (struct ieee80211_assoc_response *)buf->packet;
+        u16 assoc_id = le16_to_cpu(resp->aid);
+        u16 status = le16_to_cpu(resp->status);
+
+        at76_dbg(DBG_RX_MGMT, "%s: rx AssocResp bssid %s capa 0x%04x status "
+                 "0x%04x assoc_id 0x%04x rates %s", priv->netdev->name,
+                 mac2str(resp->header.addr3), le16_to_cpu(resp->capability),
+                 status, assoc_id, hex2str(resp->info_element->data,
+                                           resp->info_element->len));
+
+        if (priv->mac_state != MAC_ASSOC) {
+                printk(KERN_INFO "%s: AssocResp in state %s ignored\n",
+                       priv->netdev->name, mac_states[priv->mac_state]);
                 return;
         }
 
-        if (!priv->rx_skb || !priv->rx_skb->data)
-                return;
-
-        buf = (struct at76_rx_buffer *)priv->rx_skb->data;
-
-        if (urb->status != 0) {
-                if (urb->status != -ENOENT && urb->status != -ECONNRESET)
-                        at76_dbg(DBG_URB,
-                                 "%s %s: - nonzero Rx bulk status received: %d",
-                                 __func__, wiphy_name(priv->hw->wiphy),
-                                 urb->status);
-                return;
+        BUG_ON(!priv->curr_bss);
+
+        cancel_delayed_work(&priv->dwork_assoc);
+        if (status == WLAN_STATUS_SUCCESS) {
+                struct bss_info *ptr = priv->curr_bss;
+                priv->assoc_id = assoc_id & 0x3fff;
+                /* update iwconfig params */
+                memcpy(priv->bssid, ptr->bssid, ETH_ALEN);
+                memcpy(priv->essid, ptr->ssid, ptr->ssid_len);
+                priv->essid_size = ptr->ssid_len;
+                priv->channel = ptr->channel;
+                schedule_work(&priv->work_assoc_done);
+        } else {
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
         }
+}
 
-        at76_dbg(DBG_RX_ATMEL_HDR,
-                 "%s: rx frame: rate %d rssi %d noise %d link %d",
-                 wiphy_name(priv->hw->wiphy), buf->rx_rate, buf->rssi,
-                 buf->noise_level, buf->link_quality);
-
-        skb_trim(priv->rx_skb, le16_to_cpu(buf->wlength) + AT76_RX_HDRLEN);
-        at76_dbg_dump(DBG_RX_DATA, &priv->rx_skb->data[AT76_RX_HDRLEN],
-                      priv->rx_skb->len, "RX: len=%d",
-                      (int)(priv->rx_skb->len - AT76_RX_HDRLEN));
+/* Process disassociation request from the AP */
+static void at76_rx_mgmt_disassoc(struct at76_priv *priv,
+                                  struct at76_rx_buffer *buf)
+{
+        struct ieee80211_disassoc *resp =
+            (struct ieee80211_disassoc *)buf->packet;
+        struct ieee80211_hdr_3addr *mgmt = &resp->header;
+
+        at76_dbg(DBG_RX_MGMT,
+                 "%s: rx DisAssoc bssid %s reason 0x%04x destination %s",
+                 priv->netdev->name, mac2str(mgmt->addr3),
+                 le16_to_cpu(resp->reason), mac2str(mgmt->addr1));
+
+        /* We are not connected, ignore */
+        if (priv->mac_state == MAC_SCANNING || priv->mac_state == MAC_INIT
+            || !priv->curr_bss)
+                return;
 
-        rx_status.signal = buf->rssi;
-        /* FIXME: is rate_idx still present in structure? */
-        rx_status.rate_idx = buf->rx_rate;
-        rx_status.flag |= RX_FLAG_DECRYPTED;
-        rx_status.flag |= RX_FLAG_IV_STRIPPED;
+        /* Not our BSSID, ignore */
+        if (compare_ether_addr(mgmt->addr3, priv->curr_bss->bssid))
+                return;
 
-        skb_pull(priv->rx_skb, AT76_RX_HDRLEN);
-        at76_dbg(DBG_MAC80211, "calling ieee80211_rx_irqsafe(): %d/%d",
-                 priv->rx_skb->len, priv->rx_skb->data_len);
-        ieee80211_rx_irqsafe(priv->hw, priv->rx_skb, &rx_status);
+        /* Not for our STA and not broadcast, ignore */
+        if (compare_ether_addr(priv->netdev->dev_addr, mgmt->addr1)
+            && !is_broadcast_ether_addr(mgmt->addr1))
+                return;
 
-        /* Use a new skb for the next receive */
-        priv->rx_skb = NULL;
+        if (priv->mac_state != MAC_ASSOC && priv->mac_state != MAC_CONNECTED
+            && priv->mac_state != MAC_JOINING) {
+                printk(KERN_INFO "%s: DisAssoc in state %s ignored\n",
+                       priv->netdev->name, mac_states[priv->mac_state]);
+                return;
+        }
 
-        at76_submit_rx_urb(priv);
+        if (priv->mac_state == MAC_CONNECTED) {
+                netif_carrier_off(priv->netdev);
+                netif_stop_queue(priv->netdev);
+                at76_iwevent_bss_disconnect(priv->netdev);
+        }
+        cancel_delayed_work(&priv->dwork_get_scan);
+        cancel_delayed_work(&priv->dwork_beacon);
+        cancel_delayed_work(&priv->dwork_auth);
+        cancel_delayed_work(&priv->dwork_assoc);
+        at76_set_mac_state(priv, MAC_JOINING);
+        schedule_work(&priv->work_join);
 }
 
-/* Load firmware into kernel memory and parse it */
-static struct fwentry *at76_load_firmware(struct usb_device *udev,
-                                          enum board_type board_type)
+static void at76_rx_mgmt_auth(struct at76_priv *priv,
+                              struct at76_rx_buffer *buf)
 {
-        int ret;
-        char *str;
-        struct at76_fw_header *fwh;
-        struct fwentry *fwe = &firmwares[board_type];
-
-        mutex_lock(&fw_mutex);
-
-        if (fwe->loaded) {
-                at76_dbg(DBG_FW, "re-using previously loaded fw");
-                goto exit;
+        struct ieee80211_auth *resp = (struct ieee80211_auth *)buf->packet;
+        struct ieee80211_hdr_3addr *mgmt = &resp->header;
+        int seq_nr = le16_to_cpu(resp->transaction);
+        int alg = le16_to_cpu(resp->algorithm);
+        int status = le16_to_cpu(resp->status);
+
+        at76_dbg(DBG_RX_MGMT,
+                 "%s: rx AuthFrame bssid %s alg %d seq_nr %d status %d "
+                 "destination %s", priv->netdev->name, mac2str(mgmt->addr3),
+                 alg, seq_nr, status, mac2str(mgmt->addr1));
+
+        if (alg == WLAN_AUTH_SHARED_KEY && seq_nr == 2)
+                at76_dbg(DBG_RX_MGMT, "%s: AuthFrame challenge %s ...",
+                         priv->netdev->name, hex2str(resp->info_element, 18));
+
+        if (priv->mac_state != MAC_AUTH) {
+                printk(KERN_INFO "%s: ignored AuthFrame in state %s\n",
+                       priv->netdev->name, mac_states[priv->mac_state]);
+                return;
         }
-
-        at76_dbg(DBG_FW, "downloading firmware %s", fwe->fwname);
-        ret = request_firmware(&fwe->fw, fwe->fwname, &udev->dev);
-        if (ret < 0) {
-                dev_printk(KERN_ERR, &udev->dev, "firmware %s not found!\n",
-                           fwe->fwname);
-                dev_printk(KERN_ERR, &udev->dev,
-                           "you may need to download the firmware from "
-                           "http://developer.berlios.de/projects/at76c503a/\n");
-                goto exit;
+        if (priv->auth_mode != alg) {
+                printk(KERN_INFO "%s: ignored AuthFrame for alg %d\n",
+                       priv->netdev->name, alg);
+                return;
         }
 
-        at76_dbg(DBG_FW, "got it.");
-        fwh = (struct at76_fw_header *)(fwe->fw->data);
+        BUG_ON(!priv->curr_bss);
 
-        if (fwe->fw->size <= sizeof(*fwh)) {
-                dev_printk(KERN_ERR, &udev->dev,
-                           "firmware is too short (0x%zx)\n", fwe->fw->size);
-                goto exit;
+        /* Not our BSSID or not for our STA, ignore */
+        if (compare_ether_addr(mgmt->addr3, priv->curr_bss->bssid)
+            || compare_ether_addr(priv->netdev->dev_addr, mgmt->addr1))
+                return;
+
+        cancel_delayed_work(&priv->dwork_auth);
+        if (status != WLAN_STATUS_SUCCESS) {
+                /* try to join next bss */
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
+                return;
         }
 
-        /* CRC currently not checked */
-        fwe->board_type = le32_to_cpu(fwh->board_type);
-        if (fwe->board_type != board_type) {
-                dev_printk(KERN_ERR, &udev->dev,
-                           "board type mismatch, requested %u, got %u\n",
-                           board_type, fwe->board_type);
-                goto exit;
+        if (priv->auth_mode == WLAN_AUTH_OPEN || seq_nr == 4) {
+                priv->retries = ASSOC_RETRIES;
+                at76_set_mac_state(priv, MAC_ASSOC);
+                at76_assoc_req(priv, priv->curr_bss);
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer + HZ", __func__, __LINE__);
+                schedule_delayed_work(&priv->dwork_assoc, ASSOC_TIMEOUT);
+                return;
         }
 
-        fwe->fw_version.major = fwh->major;
-        fwe->fw_version.minor = fwh->minor;
-        fwe->fw_version.patch = fwh->patch;
-        fwe->fw_version.build = fwh->build;
+        WARN_ON(seq_nr != 2);
+        at76_auth_req(priv, priv->curr_bss, seq_nr + 1, resp->info_element);
+        at76_dbg(DBG_MGMT_TIMER, "%s:%d: starting mgmt_timer + HZ", __func__,
+                 __LINE__);
+        schedule_delayed_work(&priv->dwork_auth, AUTH_TIMEOUT);
+}
 
-        str = (char *)fwh + le32_to_cpu(fwh->str_offset);
-        fwe->intfw = (u8 *)fwh + le32_to_cpu(fwh->int_fw_offset);
-        fwe->intfw_size = le32_to_cpu(fwh->int_fw_len);
-        fwe->extfw = (u8 *)fwh + le32_to_cpu(fwh->ext_fw_offset);
-        fwe->extfw_size = le32_to_cpu(fwh->ext_fw_len);
+static void at76_rx_mgmt_deauth(struct at76_priv *priv,
+                                struct at76_rx_buffer *buf)
+{
+        struct ieee80211_disassoc *resp =
+            (struct ieee80211_disassoc *)buf->packet;
+        struct ieee80211_hdr_3addr *mgmt = &resp->header;
+
+        at76_dbg(DBG_RX_MGMT | DBG_PROGRESS,
+                 "%s: rx DeAuth bssid %s reason 0x%04x destination %s",
+                 priv->netdev->name, mac2str(mgmt->addr3),
+                 le16_to_cpu(resp->reason), mac2str(mgmt->addr1));
+
+        if (priv->mac_state != MAC_AUTH && priv->mac_state != MAC_ASSOC
+            && priv->mac_state != MAC_CONNECTED) {
+                printk(KERN_INFO "%s: DeAuth in state %s ignored\n",
+                       priv->netdev->name, mac_states[priv->mac_state]);
+                return;
+        }
 
-        fwe->loaded = 1;
+        BUG_ON(!priv->curr_bss);
 
-        dev_printk(KERN_DEBUG, &udev->dev,
-                   "using firmware %s (version %d.%d.%d-%d)\n",
-                   fwe->fwname, fwh->major, fwh->minor, fwh->patch, fwh->build);
+        /* Not our BSSID, ignore */
+        if (compare_ether_addr(mgmt->addr3, priv->curr_bss->bssid))
+                return;
 
-        at76_dbg(DBG_DEVSTART, "board %u, int %d:%d, ext %d:%d", board_type,
-                 le32_to_cpu(fwh->int_fw_offset), le32_to_cpu(fwh->int_fw_len),
-                 le32_to_cpu(fwh->ext_fw_offset), le32_to_cpu(fwh->ext_fw_len));
-        at76_dbg(DBG_DEVSTART, "firmware id %s", str);
+        /* Not for our STA and not broadcast, ignore */
+        if (compare_ether_addr(priv->netdev->dev_addr, mgmt->addr1)
+            && !is_broadcast_ether_addr(mgmt->addr1))
+                return;
 
-exit:
-        mutex_unlock(&fw_mutex);
+        if (priv->mac_state == MAC_CONNECTED)
+                at76_iwevent_bss_disconnect(priv->netdev);
 
-        if (fwe->loaded)
-                return fwe;
-        else
-                return NULL;
+        at76_set_mac_state(priv, MAC_JOINING);
+        schedule_work(&priv->work_join);
+        cancel_delayed_work(&priv->dwork_get_scan);
+        cancel_delayed_work(&priv->dwork_beacon);
+        cancel_delayed_work(&priv->dwork_auth);
+        cancel_delayed_work(&priv->dwork_assoc);
 }
 
-static void at76_mac80211_tx_callback(struct urb *urb)
+static void at76_rx_mgmt_beacon(struct at76_priv *priv,
+                                struct at76_rx_buffer *buf)
 {
-        struct at76_priv *priv = urb->context;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(priv->tx_skb);
+        int varpar_len;
+        /* beacon content */
+        struct ieee80211_beacon *bdata = (struct ieee80211_beacon *)buf->packet;
+        struct ieee80211_hdr_3addr *mgmt = &bdata->header;
+
+        struct list_head *lptr;
+        struct bss_info *match; /* entry matching addr3 with its bssid */
+        int new_entry = 0;
+        int len;
+        struct ieee80211_info_element *ie;
+        int have_ssid = 0;
+        int have_rates = 0;
+        int have_channel = 0;
+        int keep_going = 1;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+        if (priv->mac_state == MAC_CONNECTED) {
+                /* in state MAC_CONNECTED we use the mgmt_timer to control
+                   the beacon of the BSS */
+                BUG_ON(!priv->curr_bss);
+
+                if (!compare_ether_addr(priv->curr_bss->bssid, mgmt->addr3)) {
+                        /* We got our AP's beacon, defer the timeout handler.
+                           Kill pending work first, as schedule_delayed_work()
+                           won't do it. */
+                        cancel_delayed_work(&priv->dwork_beacon);
+                        schedule_delayed_work(&priv->dwork_beacon,
+                                              BEACON_TIMEOUT);
+                        priv->curr_bss->rssi = buf->rssi;
+                        priv->beacons_received++;
+                        goto exit;
+                }
+        }
 
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
+        /* look if we have this BSS already in the list */
+        match = NULL;
 
-        switch (urb->status) {
-        case 0:
-                /* success */
-                /* FIXME:
-                 * is the frame really ACKed when tx_callback is called ? */
-                info->flags |= IEEE80211_TX_STAT_ACK;
-                break;
-        case -ENOENT:
-        case -ECONNRESET:
-                /* fail, urb has been unlinked */
-                /* FIXME: add error message */
-                break;
-        default:
-                at76_dbg(DBG_URB, "%s - nonzero tx status received: %d",
-                         __func__, urb->status);
-                break;
+        if (!list_empty(&priv->bss_list)) {
+                list_for_each(lptr, &priv->bss_list) {
+                        struct bss_info *bss_ptr =
+                            list_entry(lptr, struct bss_info, list);
+                        if (!compare_ether_addr(bss_ptr->bssid, mgmt->addr3)) {
+                                match = bss_ptr;
+                                break;
+                        }
+                }
         }
 
-        memset(&info->status, 0, sizeof(info->status));
+        if (!match) {
+                /* BSS not in the list - append it */
+                match = kzalloc(sizeof(struct bss_info), GFP_ATOMIC);
+                if (!match) {
+                        at76_dbg(DBG_BSS_TABLE,
+                                 "%s: cannot kmalloc new bss info (%zd byte)",
+                                 priv->netdev->name, sizeof(struct bss_info));
+                        goto exit;
+                }
+                new_entry = 1;
+                list_add_tail(&match->list, &priv->bss_list);
+        }
 
-        ieee80211_tx_status_irqsafe(priv->hw, priv->tx_skb);
+        match->capa = le16_to_cpu(bdata->capability);
+        match->beacon_interval = le16_to_cpu(bdata->beacon_interval);
+        match->rssi = buf->rssi;
+        match->link_qual = buf->link_quality;
+        match->noise_level = buf->noise_level;
+        memcpy(match->bssid, mgmt->addr3, ETH_ALEN);
+        at76_dbg(DBG_RX_BEACON, "%s: bssid %s", priv->netdev->name,
+                 mac2str(match->bssid));
+
+        ie = bdata->info_element;
+
+        /* length of var length beacon parameters */
+        varpar_len = min_t(int, le16_to_cpu(buf->wlength) -
+                           sizeof(struct ieee80211_beacon),
+                           BEACON_MAX_DATA_LENGTH);
+
+        /* This routine steps through the bdata->data array to get
+         * some useful information about the access point.
+         * Currently, this implementation supports receipt of: SSID,
+         * supported transfer rates and channel, in any order, with some
+         * tolerance for intermittent unknown codes (although this
+         * functionality may not be necessary as the useful information will
+         * usually arrive in consecutively, but there have been some
+         * reports of some of the useful information fields arriving in a
+         * different order).
+         * It does not support any more IE types although MFIE_TYPE_TIM may
+         * be supported (on my AP at least).
+         * The bdata->data array is about 1500 bytes long but only ~36 of those
+         * bytes are useful, hence the have_ssid etc optimizations. */
+
+        while (keep_going &&
+               ((&ie->data[ie->len] - (u8 *)bdata->info_element) <=
+                varpar_len)) {
+
+                switch (ie->id) {
+
+                case MFIE_TYPE_SSID:
+                        if (have_ssid)
+                                break;
 
-        priv->tx_skb = NULL;
+                        len = min_t(int, IW_ESSID_MAX_SIZE, ie->len);
 
-        ieee80211_wake_queues(priv->hw);
-}
+                        /* we copy only if this is a new entry,
+                           or the incoming SSID is not a hidden SSID. This
+                           will protect us from overwriting a real SSID read
+                           in a ProbeResponse with a hidden one from a
+                           following beacon. */
+                        if (!new_entry && at76_is_hidden_ssid(ie->data, len)) {
+                                have_ssid = 1;
+                                break;
+                        }
 
-static int at76_mac80211_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
-{
-        struct at76_priv *priv = hw->priv;
-        struct at76_tx_buffer *tx_buffer = priv->bulk_out_buffer;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int padding, submit_len, ret;
+                        match->ssid_len = len;
+                        memcpy(match->ssid, ie->data, len);
+                        at76_dbg(DBG_RX_BEACON, "%s: SSID - %.*s",
+                                 priv->netdev->name, len, match->ssid);
+                        have_ssid = 1;
+                        break;
 
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
+                case MFIE_TYPE_RATES:
+                        if (have_rates)
+                                break;
 
-        if (priv->tx_urb->status == -EINPROGRESS) {
-                printk(KERN_ERR "%s: %s called while tx urb is pending\n",
-                       wiphy_name(priv->hw->wiphy), __func__);
-                return NETDEV_TX_BUSY;
-        }
+                        match->rates_len =
+                            min_t(int, sizeof(match->rates), ie->len);
+                        memcpy(match->rates, ie->data, match->rates_len);
+                        have_rates = 1;
+                        at76_dbg(DBG_RX_BEACON, "%s: SUPPORTED RATES %s",
+                                 priv->netdev->name,
+                                 hex2str(ie->data, ie->len));
+                        break;
 
-        ieee80211_stop_queues(hw);
+                case MFIE_TYPE_DS_SET:
+                        if (have_channel)
+                                break;
 
-        at76_ledtrig_tx_activity();     /* tell ledtrigger we send a packet */
+                        match->channel = ie->data[0];
+                        have_channel = 1;
+                        at76_dbg(DBG_RX_BEACON, "%s: CHANNEL - %d",
+                                 priv->netdev->name, match->channel);
+                        break;
 
-        WARN_ON(priv->tx_skb != NULL);
+                case MFIE_TYPE_CF_SET:
+                case MFIE_TYPE_TIM:
+                case MFIE_TYPE_IBSS_SET:
+                default:
+                        at76_dbg(DBG_RX_BEACON, "%s: beacon IE id %d len %d %s",
+                                 priv->netdev->name, ie->id, ie->len,
+                                 hex2str(ie->data, ie->len));
+                        break;
+                }
 
-        priv->tx_skb = skb;
-        padding = at76_calc_padding(skb->len);
-        submit_len = AT76_TX_HDRLEN + skb->len + padding;
+                /* advance to the next informational element */
+                next_ie(&ie);
 
-        /* setup 'Atmel' header */
-        memset(tx_buffer, 0, sizeof(*tx_buffer));
-        tx_buffer->padding = padding;
-        tx_buffer->wlength = cpu_to_le16(skb->len);
-        tx_buffer->tx_rate = ieee80211_get_tx_rate(hw, info)->hw_value;
-        if (FIRMWARE_IS_WPA(priv->fw_version) && info->control.hw_key) {
-                tx_buffer->key_id = (info->control.hw_key->keyidx);
-                tx_buffer->cipher_type =
-                        priv->keys[info->control.hw_key->keyidx].cipher;
-                tx_buffer->cipher_length =
-                        priv->keys[info->control.hw_key->keyidx].keylen;
-                tx_buffer->reserved = 0;
-        } else {
-                tx_buffer->key_id = 0;
-                tx_buffer->cipher_type = 0;
-                tx_buffer->cipher_length = 0;
-                tx_buffer->reserved = 0;
-        };
-        /* memset(tx_buffer->reserved, 0, sizeof(tx_buffer->reserved)); */
-        memcpy(tx_buffer->packet, skb->data, skb->len);
+                /* Optimization: after all, the bdata->data array is
+                 * varpar_len bytes long, whereas we get all of the useful
+                 * information after only ~36 bytes, this saves us a lot of
+                 * time (and trouble as the remaining portion of the array
+                 * could be full of junk)
+                 * Comment this out if you want to see what other information
+                 * comes from the AP - although little of it may be useful */
+        }
 
-        at76_dbg(DBG_TX_DATA, "%s tx: wlen 0x%x pad 0x%x rate %d hdr",
-                 wiphy_name(priv->hw->wiphy), le16_to_cpu(tx_buffer->wlength),
-                 tx_buffer->padding, tx_buffer->tx_rate);
+        at76_dbg(DBG_RX_BEACON, "%s: Finished processing beacon data",
+                 priv->netdev->name);
 
-        /* send stuff */
-        at76_dbg_dump(DBG_TX_DATA_CONTENT, tx_buffer, submit_len,
-                      "%s(): tx_buffer %d bytes:", __func__, submit_len);
-        usb_fill_bulk_urb(priv->tx_urb, priv->udev, priv->tx_pipe, tx_buffer,
-                          submit_len, at76_mac80211_tx_callback, priv);
-        ret = usb_submit_urb(priv->tx_urb, GFP_ATOMIC);
-        if (ret) {
-                printk(KERN_ERR "%s: error in tx submit urb: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                if (ret == -EINVAL)
-                        printk(KERN_ERR
-                               "%s: -EINVAL: tx urb %p hcpriv %p complete %p\n",
-                               wiphy_name(priv->hw->wiphy), priv->tx_urb,
-                               priv->tx_urb->hcpriv, priv->tx_urb->complete);
-        }
+        match->last_rx = jiffies;       /* record last rx of beacon */
 
-        return 0;
+exit:
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
 }
 
-static int at76_mac80211_start(struct ieee80211_hw *hw)
+/* Calculate the link level from a given rx_buffer */
+static void at76_calc_level(struct at76_priv *priv, struct at76_rx_buffer *buf,
+                            struct iw_quality *qual)
 {
-        struct at76_priv *priv = hw->priv;
-        int ret;
-
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
+        /* just a guess for now, might be different for other chips */
+        int max_rssi = 42;
 
-        mutex_lock(&priv->mtx);
-
-        ret = at76_submit_rx_urb(priv);
-        if (ret < 0) {
-                printk(KERN_ERR "%s: open: submit_rx_urb failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                goto error;
-        }
+        qual->level = (buf->rssi * 100 / max_rssi);
+        if (qual->level > 100)
+                qual->level = 100;
+        qual->updated |= IW_QUAL_LEVEL_UPDATED;
+}
 
-        at76_startup_device(priv);
+/* Calculate the link quality from a given rx_buffer */
+static void at76_calc_qual(struct at76_priv *priv, struct at76_rx_buffer *buf,
+                           struct iw_quality *qual)
+{
+        if (at76_is_intersil(priv->board_type))
+                qual->qual = buf->link_quality;
+        else {
+                unsigned long elapsed;
 
-        at76_start_monitor(priv);
+                /* Update qual at most once a second */
+                elapsed = jiffies - priv->beacons_last_qual;
+                if (elapsed < 1 * HZ)
+                        return;
 
-error:
-        mutex_unlock(&priv->mtx);
+                qual->qual = qual->level * priv->beacons_received *
+                    msecs_to_jiffies(priv->beacon_period) / elapsed;
 
-        return 0;
+                priv->beacons_last_qual = jiffies;
+                priv->beacons_received = 0;
+        }
+        qual->qual = (qual->qual > 100) ? 100 : qual->qual;
+        qual->updated |= IW_QUAL_QUAL_UPDATED;
 }
 
-static void at76_mac80211_stop(struct ieee80211_hw *hw)
+/* Calculate the noise quality from a given rx_buffer */
+static void at76_calc_noise(struct at76_priv *priv, struct at76_rx_buffer *buf,
+                            struct iw_quality *qual)
 {
-        struct at76_priv *priv = hw->priv;
-
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
-
-        mutex_lock(&priv->mtx);
+        qual->noise = 0;
+        qual->updated |= IW_QUAL_NOISE_INVALID;
+}
 
-        if (!priv->device_unplugged) {
-                /* We are called by "ifconfig ethX down", not because the
-                 * device is not available anymore. */
-                if (at76_set_radio(priv, 0) == 1)
-                        at76_wait_completion(priv, CMD_RADIO_ON);
+static void at76_update_wstats(struct at76_priv *priv,
+                               struct at76_rx_buffer *buf)
+{
+        struct iw_quality *qual = &priv->wstats.qual;
 
-                /* We unlink rx_urb because at76_open() re-submits it.
-                 * If unplugged, at76_delete_device() takes care of it. */
-                usb_kill_urb(priv->rx_urb);
+        if (buf->rssi && priv->mac_state == MAC_CONNECTED) {
+                qual->updated = 0;
+                at76_calc_level(priv, buf, qual);
+                at76_calc_qual(priv, buf, qual);
+                at76_calc_noise(priv, buf, qual);
+        } else {
+                qual->qual = 0;
+                qual->level = 0;
+                qual->noise = 0;
+                qual->updated = IW_QUAL_ALL_INVALID;
         }
-
-        mutex_unlock(&priv->mtx);
 }
 
-static int at76_add_interface(struct ieee80211_hw *hw,
-                              struct ieee80211_if_init_conf *conf)
+static void at76_rx_mgmt(struct at76_priv *priv, struct at76_rx_buffer *buf)
 {
-        struct at76_priv *priv = hw->priv;
-        int ret = 0;
+        struct ieee80211_hdr_3addr *mgmt =
+            (struct ieee80211_hdr_3addr *)buf->packet;
+        u16 framectl = le16_to_cpu(mgmt->frame_ctl);
+
+        /* update wstats */
+        if (priv->mac_state != MAC_INIT && priv->mac_state != MAC_SCANNING) {
+                /* jal: this is a dirty hack needed by Tim in ad-hoc mode */
+                /* Data packets always seem to have a 0 link level, so we
+                   only read link quality info from management packets.
+                   Atmel driver actually averages the present, and previous
+                   values, we just present the raw value at the moment - TJS */
+                if (priv->iw_mode == IW_MODE_ADHOC
+                    || (priv->curr_bss
+                        && !compare_ether_addr(mgmt->addr3,
+                                               priv->curr_bss->bssid)))
+                        at76_update_wstats(priv, buf);
+        }
 
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
+        at76_dbg(DBG_RX_MGMT_CONTENT, "%s rx mgmt framectl 0x%x %s",
+                 priv->netdev->name, framectl,
+                 hex2str(mgmt, le16_to_cpu(buf->wlength)));
 
-        mutex_lock(&priv->mtx);
+        switch (framectl & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_BEACON:
+        case IEEE80211_STYPE_PROBE_RESP:
+                at76_rx_mgmt_beacon(priv, buf);
+                break;
+
+        case IEEE80211_STYPE_ASSOC_RESP:
+                at76_rx_mgmt_assoc(priv, buf);
+                break;
 
-        switch (conf->type) {
-        case NL80211_IFTYPE_STATION:
-                priv->iw_mode = IW_MODE_INFRA;
+        case IEEE80211_STYPE_DISASSOC:
+                at76_rx_mgmt_disassoc(priv, buf);
                 break;
+
+        case IEEE80211_STYPE_AUTH:
+                at76_rx_mgmt_auth(priv, buf);
+                break;
+
+        case IEEE80211_STYPE_DEAUTH:
+                at76_rx_mgmt_deauth(priv, buf);
+                break;
+
         default:
-                ret = -EOPNOTSUPP;
-                goto exit;
+                printk(KERN_DEBUG "%s: ignoring frame with framectl 0x%04x\n",
+                       priv->netdev->name, framectl);
         }
 
-exit:
-        mutex_unlock(&priv->mtx);
-
-        return ret;
+        return;
 }
 
-static void at76_remove_interface(struct ieee80211_hw *hw,
-                                  struct ieee80211_if_init_conf *conf)
+/* Convert the 802.11 header into an ethernet-style header, make skb
+ * ready for consumption by netif_rx() */
+static void at76_ieee80211_to_eth(struct sk_buff *skb, int iw_mode)
 {
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
-}
+        struct ieee80211_hdr_3addr *i802_11_hdr;
+        struct ethhdr *eth_hdr_p;
+        u8 *src_addr;
+        u8 *dest_addr;
 
-static int at76_join(struct at76_priv *priv)
-{
-        struct at76_req_join join;
-        int ret;
+        i802_11_hdr = (struct ieee80211_hdr_3addr *)skb->data;
 
-        memset(&join, 0, sizeof(struct at76_req_join));
-        memcpy(join.essid, priv->essid, priv->essid_size);
-        join.essid_size = priv->essid_size;
-        memcpy(join.bssid, priv->bssid, ETH_ALEN);
-        join.bss_type = INFRASTRUCTURE_MODE;
-        join.channel = priv->channel;
-        join.timeout = cpu_to_le16(2000);
+        /* That would be the ethernet header if the hardware converted
+         * the frame for us.  Make sure the source and the destination
+         * match the 802.11 header.  Which hardware does it? */
+        eth_hdr_p = (struct ethhdr *)skb_pull(skb, IEEE80211_3ADDR_LEN);
 
-        at76_dbg(DBG_MAC80211, "%s: sending CMD_JOIN", __func__);
-        ret = at76_set_card_command(priv->udev, CMD_JOIN, &join,
-                                    sizeof(struct at76_req_join));
+        dest_addr = i802_11_hdr->addr1;
+        if (iw_mode == IW_MODE_ADHOC)
+                src_addr = i802_11_hdr->addr2;
+        else
+                src_addr = i802_11_hdr->addr3;
 
-        if (ret < 0) {
-                printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                return 0;
-        }
+        if (!compare_ether_addr(eth_hdr_p->h_source, src_addr) &&
+            !compare_ether_addr(eth_hdr_p->h_dest, dest_addr))
+                /* Yes, we already have an ethernet header */
+                skb_reset_mac_header(skb);
+        else {
+                u16 len;
+
+                /* Need to build an ethernet header */
+                if (!memcmp(skb->data, snapsig, sizeof(snapsig))) {
+                        /* SNAP frame - decapsulate, keep proto */
+                        skb_push(skb, offsetof(struct ethhdr, h_proto) -
+                                 sizeof(rfc1042sig));
+                        len = 0;
+                } else {
+                        /* 802.3 frame, proto is length */
+                        len = skb->len;
+                        skb_push(skb, ETH_HLEN);
+                }
 
-        ret = at76_wait_completion(priv, CMD_JOIN);
-        at76_dbg(DBG_MAC80211, "%s: CMD_JOIN returned: 0x%02x", __func__, ret);
-        if (ret != CMD_STATUS_COMPLETE) {
-                printk(KERN_ERR "%s: at76_wait_completion failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                return 0;
+                skb_reset_mac_header(skb);
+                eth_hdr_p = eth_hdr(skb);
+                /* This needs to be done in this order (eth_hdr_p->h_dest may
+                 * overlap src_addr) */
+                memcpy(eth_hdr_p->h_source, src_addr, ETH_ALEN);
+                memcpy(eth_hdr_p->h_dest, dest_addr, ETH_ALEN);
+                if (len)
+                        eth_hdr_p->h_proto = htons(len);
         }
 
-        at76_set_tkip_bssid(priv, priv->bssid);
-        at76_set_pm_mode(priv);
-
-        return 0;
+        skb->protocol = eth_type_trans(skb, skb->dev);
 }
 
-static void at76_dwork_hw_scan(struct work_struct *work)
+/* Check for fragmented data in priv->rx_skb. If the packet was no fragment
+   or it was the last of a fragment set a skb containing the whole packet
+   is returned for further processing. Otherwise we get NULL and are
+   done and the packet is either stored inside the fragment buffer
+   or thrown away.  Every returned skb starts with the ieee802_11 header
+   and contains _no_ FCS at the end */
+static struct sk_buff *at76_check_for_rx_frags(struct at76_priv *priv)
 {
-        struct at76_priv *priv = container_of(work, struct at76_priv,
-                                              dwork_hw_scan.work);
-        int ret;
+        struct sk_buff *skb = priv->rx_skb;
+        struct at76_rx_buffer *buf = (struct at76_rx_buffer *)skb->data;
+        struct ieee80211_hdr_3addr *i802_11_hdr =
+            (struct ieee80211_hdr_3addr *)buf->packet;
+        /* seq_ctrl, fragment_number, sequence number of new packet */
+        u16 sctl = le16_to_cpu(i802_11_hdr->seq_ctl);
+        u16 fragnr = sctl & 0xf;
+        u16 seqnr = sctl >> 4;
+        u16 frame_ctl = le16_to_cpu(i802_11_hdr->frame_ctl);
 
-        ret = at76_get_cmd_status(priv->udev, CMD_SCAN);
-        at76_dbg(DBG_MAC80211, "%s: CMD_SCAN status 0x%02x", __func__, ret);
+        /* Length including the IEEE802.11 header, but without the trailing
+         * FCS and without the Atmel Rx header */
+        int length = le16_to_cpu(buf->wlength) - IEEE80211_FCS_LEN;
 
-        /* FIXME: add maximum time for scan to complete */
+        /* where does the data payload start in skb->data ? */
+        u8 *data = i802_11_hdr->payload;
 
-        if (ret != CMD_STATUS_COMPLETE) {
-                queue_delayed_work(priv->hw->workqueue, &priv->dwork_hw_scan,
-                                   SCAN_POLL_INTERVAL);
-                goto exit;
+        /* length of payload, excl. the trailing FCS */
+        int data_len = length - IEEE80211_3ADDR_LEN;
+
+        int i;
+        struct rx_data_buf *bptr, *optr;
+        unsigned long oldest = ~0UL;
+
+        at76_dbg(DBG_RX_FRAGS,
+                 "%s: rx data frame_ctl %04x addr2 %s seq/frag %d/%d "
+                 "length %d data %d: %s ...", priv->netdev->name, frame_ctl,
+                 mac2str(i802_11_hdr->addr2), seqnr, fragnr, length, data_len,
+                 hex2str(data, 32));
+
+        at76_dbg(DBG_RX_FRAGS_SKB, "%s: incoming skb: head %p data %p "
+                 "tail %p end %p len %d", priv->netdev->name, skb->head,
+                 skb->data, skb_tail_pointer(skb), skb_end_pointer(skb),
+                 skb->len);
+
+        if (data_len < 0) {
+                /* make sure data starts in the buffer */
+                printk(KERN_INFO "%s: data frame too short\n",
+                       priv->netdev->name);
+                return NULL;
         }
 
-        ieee80211_scan_completed(priv->hw);
+        WARN_ON(length <= AT76_RX_HDRLEN);
+        if (length <= AT76_RX_HDRLEN)
+                return NULL;
 
-        if (is_valid_ether_addr(priv->bssid)) {
-                ieee80211_wake_queues(priv->hw);
-                at76_join(priv);
+        /* remove the at76_rx_buffer header - we don't need it anymore */
+        /* we need the IEEE802.11 header (for the addresses) if this packet
+           is the first of a chain */
+        skb_pull(skb, AT76_RX_HDRLEN);
+
+        /* remove FCS at end */
+        skb_trim(skb, length);
+
+        at76_dbg(DBG_RX_FRAGS_SKB, "%s: trimmed skb: head %p data %p tail %p "
+                 "end %p len %d data %p data_len %d", priv->netdev->name,
+                 skb->head, skb->data, skb_tail_pointer(skb),
+                 skb_end_pointer(skb), skb->len, data, data_len);
+
+        if (fragnr == 0 && !(frame_ctl & IEEE80211_FCTL_MOREFRAGS)) {
+                /* unfragmented packet received */
+                /* Use a new skb for the next receive */
+                priv->rx_skb = NULL;
+                at76_dbg(DBG_RX_FRAGS, "%s: unfragmented", priv->netdev->name);
+                return skb;
         }
 
-        ieee80211_wake_queues(priv->hw);
+        /* look if we've got a chain for the sender address.
+           afterwards optr points to first free or the oldest entry,
+           or, if i < NR_RX_DATA_BUF, bptr points to the entry for the
+           sender address */
+        /* determining the oldest entry doesn't cope with jiffies wrapping
+           but I don't care to delete a young entry at these rare moments ... */
+
+        bptr = priv->rx_data;
+        optr = NULL;
+        for (i = 0; i < NR_RX_DATA_BUF; i++, bptr++) {
+                if (!bptr->skb) {
+                        optr = bptr;
+                        oldest = 0UL;
+                        continue;
+                }
 
-exit:
-        return;
-}
+                if (!compare_ether_addr(i802_11_hdr->addr2, bptr->sender))
+                        break;
 
-static int at76_hw_scan(struct ieee80211_hw *hw, u8 *ssid, size_t len)
-{
-        struct at76_priv *priv = hw->priv;
-        struct at76_req_scan scan;
-        int ret;
+                if (!optr) {
+                        optr = bptr;
+                        oldest = bptr->last_rx;
+                } else if (bptr->last_rx < oldest)
+                        optr = bptr;
+        }
 
-        at76_dbg(DBG_MAC80211, "%s():", __func__);
-        at76_dbg_dump(DBG_MAC80211, ssid, len, "ssid %zd bytes:", len);
+        if (i < NR_RX_DATA_BUF) {
+
+                at76_dbg(DBG_RX_FRAGS, "%s: %d. cacheentry (seq/frag = %d/%d) "
+                         "matched sender addr",
+                         priv->netdev->name, i, bptr->seqnr, bptr->fragnr);
+
+                /* bptr points to an entry for the sender address */
+                if (bptr->seqnr == seqnr) {
+                        int left;
+                        /* the fragment has the current sequence number */
+                        if (((bptr->fragnr + 1) & 0xf) != fragnr) {
+                                /* wrong fragment number -> ignore it */
+                                /* is & 0xf necessary above ??? */
+                                at76_dbg(DBG_RX_FRAGS,
+                                         "%s: frag nr mismatch: %d + 1 != %d",
+                                         priv->netdev->name, bptr->fragnr,
+                                         fragnr);
+                                return NULL;
+                        }
+                        bptr->last_rx = jiffies;
+                        /* the next following fragment number ->
+                           add the data at the end */
+
+                        /* for test only ??? */
+                        left = skb_tailroom(bptr->skb);
+                        if (left < data_len)
+                                printk(KERN_INFO
+                                       "%s: only %d byte free (need %d)\n",
+                                       priv->netdev->name, left, data_len);
+                        else
+                                memcpy(skb_put(bptr->skb, data_len), data,
+                                       data_len);
+
+                        bptr->fragnr = fragnr;
+                        if (frame_ctl & IEEE80211_FCTL_MOREFRAGS)
+                                return NULL;
+
+                        /* this was the last fragment - send it */
+                        skb = bptr->skb;
+                        bptr->skb = NULL;       /* free the entry */
+                        at76_dbg(DBG_RX_FRAGS, "%s: last frag of seq %d",
+                                 priv->netdev->name, seqnr);
+                        return skb;
+                }
 
-        mutex_lock(&priv->mtx);
+                /* got another sequence number */
+                if (fragnr == 0) {
+                        /* it's the start of a new chain - replace the
+                           old one by this */
+                        /* bptr->sender has the correct value already */
+                        at76_dbg(DBG_RX_FRAGS,
+                                 "%s: start of new seq %d, removing old seq %d",
+                                 priv->netdev->name, seqnr, bptr->seqnr);
+                        bptr->seqnr = seqnr;
+                        bptr->fragnr = 0;
+                        bptr->last_rx = jiffies;
+                        /* swap bptr->skb and priv->rx_skb */
+                        skb = bptr->skb;
+                        bptr->skb = priv->rx_skb;
+                        priv->rx_skb = skb;
+                } else {
+                        /* it from the middle of a new chain ->
+                           delete the old entry and skip the new one */
+                        at76_dbg(DBG_RX_FRAGS,
+                                 "%s: middle of new seq %d (%d) "
+                                 "removing old seq %d",
+                                 priv->netdev->name, seqnr, fragnr,
+                                 bptr->seqnr);
+                        dev_kfree_skb(bptr->skb);
+                        bptr->skb = NULL;
+                }
+                return NULL;
+        }
 
-        ieee80211_stop_queues(hw);
+        /* if we didn't find a chain for the sender address, optr
+           points either to the first free or the oldest entry */
 
-        memset(&scan, 0, sizeof(struct at76_req_scan));
-        memset(scan.bssid, 0xFF, ETH_ALEN);
-        scan.scan_type = SCAN_TYPE_ACTIVE;
-        if (priv->essid_size > 0) {
-                memcpy(scan.essid, ssid, len);
-                scan.essid_size = len;
+        if (fragnr != 0) {
+                /* this is not the begin of a fragment chain ... */
+                at76_dbg(DBG_RX_FRAGS,
+                         "%s: no chain for non-first fragment (%d)",
+                         priv->netdev->name, fragnr);
+                return NULL;
         }
-        scan.min_channel_time = cpu_to_le16(priv->scan_min_time);
-        scan.max_channel_time = cpu_to_le16(priv->scan_max_time);
-        scan.probe_delay = cpu_to_le16(priv->scan_min_time * 1000);
-        scan.international_scan = 0;
 
-        at76_dbg(DBG_MAC80211, "%s: sending CMD_SCAN", __func__);
-        ret = at76_set_card_command(priv->udev, CMD_SCAN, &scan, sizeof(scan));
+        BUG_ON(!optr);
+        if (optr->skb) {
+                /* swap the skb's */
+                skb = optr->skb;
+                optr->skb = priv->rx_skb;
+                priv->rx_skb = skb;
 
-        if (ret < 0) {
-                err("CMD_SCAN failed: %d", ret);
-                goto exit;
-        }
+                at76_dbg(DBG_RX_FRAGS,
+                         "%s: free old contents: sender %s seq/frag %d/%d",
+                         priv->netdev->name, mac2str(optr->sender),
+                         optr->seqnr, optr->fragnr);
 
-        queue_delayed_work(priv->hw->workqueue, &priv->dwork_hw_scan,
-                           SCAN_POLL_INTERVAL);
+        } else {
+                /* take the skb from priv->rx_skb */
+                optr->skb = priv->rx_skb;
+                /* let at76_submit_rx_urb() allocate a new skb */
+                priv->rx_skb = NULL;
 
-exit:
-        mutex_unlock(&priv->mtx);
+                at76_dbg(DBG_RX_FRAGS, "%s: use a free entry",
+                         priv->netdev->name);
+        }
+        memcpy(optr->sender, i802_11_hdr->addr2, ETH_ALEN);
+        optr->seqnr = seqnr;
+        optr->fragnr = 0;
+        optr->last_rx = jiffies;
 
-        return 0;
+        return NULL;
 }
 
-static int at76_config(struct ieee80211_hw *hw, u32 changed)
+/* Rx interrupt: we expect the complete data buffer in priv->rx_skb */
+static void at76_rx_data(struct at76_priv *priv)
 {
-        struct at76_priv *priv = hw->priv;
-        struct ieee80211_conf *conf = &hw->conf;
+        struct net_device *netdev = priv->netdev;
+        struct net_device_stats *stats = &priv->stats;
+        struct sk_buff *skb = priv->rx_skb;
+        struct at76_rx_buffer *buf = (struct at76_rx_buffer *)skb->data;
+        struct ieee80211_hdr_3addr *i802_11_hdr;
+        int length = le16_to_cpu(buf->wlength);
 
-        at76_dbg(DBG_MAC80211, "%s(): channel %d radio %d",
-                 __func__, conf->channel->hw_value, conf->radio_enabled);
-        at76_dbg_dump(DBG_MAC80211, priv->essid, priv->essid_size, "ssid:");
-        at76_dbg_dump(DBG_MAC80211, priv->bssid, ETH_ALEN, "bssid:");
+        at76_dbg(DBG_RX_DATA, "%s received data packet: %s", netdev->name,
+                 hex2str(skb->data, AT76_RX_HDRLEN));
 
-        mutex_lock(&priv->mtx);
+        at76_dbg(DBG_RX_DATA_CONTENT, "rx packet: %s",
+                 hex2str(skb->data + AT76_RX_HDRLEN, length));
 
-        priv->channel = conf->channel->hw_value;
+        skb = at76_check_for_rx_frags(priv);
+        if (!skb)
+                return;
 
-        if (is_valid_ether_addr(priv->bssid)) {
-                at76_join(priv);
-                ieee80211_wake_queues(priv->hw);
-        } else {
-                ieee80211_stop_queues(priv->hw);
-                at76_start_monitor(priv);
-        };
+        /* Atmel header and the FCS are already removed */
+        i802_11_hdr = (struct ieee80211_hdr_3addr *)skb->data;
 
-        mutex_unlock(&priv->mtx);
+        skb->dev = netdev;
+        skb->ip_summed = CHECKSUM_NONE; /* TODO: should check CRC */
 
-        return 0;
-}
+        if (is_broadcast_ether_addr(i802_11_hdr->addr1)) {
+                if (!compare_ether_addr(i802_11_hdr->addr1, netdev->broadcast))
+                        skb->pkt_type = PACKET_BROADCAST;
+                else
+                        skb->pkt_type = PACKET_MULTICAST;
+        } else if (compare_ether_addr(i802_11_hdr->addr1, netdev->dev_addr))
+                skb->pkt_type = PACKET_OTHERHOST;
 
-static int at76_config_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_vif *vif,
-                                 struct ieee80211_if_conf *conf)
-{
-        struct at76_priv *priv = hw->priv;
+        at76_ieee80211_to_eth(skb, priv->iw_mode);
 
-        at76_dbg_dump(DBG_MAC80211, conf->bssid, ETH_ALEN, "bssid:");
+        netdev->last_rx = jiffies;
+        netif_rx(skb);
+        stats->rx_packets++;
+        stats->rx_bytes += length;
 
-        mutex_lock(&priv->mtx);
+        return;
+}
 
-        memcpy(priv->bssid, conf->bssid, ETH_ALEN);
-//      memcpy(priv->essid, conf->ssid, conf->ssid_len);
-//      priv->essid_size = conf->ssid_len;
+static void at76_rx_monitor_mode(struct at76_priv *priv)
+{
+        struct at76_rx_radiotap *rt;
+        u8 *payload;
+        int skblen;
+        struct net_device *netdev = priv->netdev;
+        struct at76_rx_buffer *buf =
+            (struct at76_rx_buffer *)priv->rx_skb->data;
+        /* length including the IEEE802.11 header and the trailing FCS,
+           but not at76_rx_buffer */
+        int length = le16_to_cpu(buf->wlength);
+        struct sk_buff *skb = priv->rx_skb;
+        struct net_device_stats *stats = &priv->stats;
 
-        if (is_valid_ether_addr(priv->bssid)) {
-                /* mac80211 is joining a bss */
-                ieee80211_wake_queues(priv->hw);
-                at76_join(priv);
-        } else
-                ieee80211_stop_queues(priv->hw);
+        if (length < IEEE80211_FCS_LEN) {
+                /* buffer contains no data */
+                at76_dbg(DBG_MONITOR_MODE,
+                         "%s: MONITOR MODE: rx skb without data",
+                         priv->netdev->name);
+                return;
+        }
 
-        mutex_unlock(&priv->mtx);
+        skblen = sizeof(struct at76_rx_radiotap) + length;
 
-        return 0;
+        skb = dev_alloc_skb(skblen);
+        if (!skb) {
+                printk(KERN_ERR "%s: MONITOR MODE: dev_alloc_skb for radiotap "
+                       "header returned NULL\n", priv->netdev->name);
+                return;
+        }
+
+        skb_put(skb, skblen);
+
+        rt = (struct at76_rx_radiotap *)skb->data;
+        payload = skb->data + sizeof(struct at76_rx_radiotap);
+
+        rt->rt_hdr.it_version = 0;
+        rt->rt_hdr.it_pad = 0;
+        rt->rt_hdr.it_len = cpu_to_le16(sizeof(struct at76_rx_radiotap));
+        rt->rt_hdr.it_present = cpu_to_le32(AT76_RX_RADIOTAP_PRESENT);
+
+        rt->rt_tsft = cpu_to_le64(le32_to_cpu(buf->rx_time));
+        rt->rt_rate = hw_rates[buf->rx_rate] & (~0x80);
+        rt->rt_signal = buf->rssi;
+        rt->rt_noise = buf->noise_level;
+        rt->rt_flags = IEEE80211_RADIOTAP_F_FCS;
+        if (buf->fragmentation)
+                rt->rt_flags |= IEEE80211_RADIOTAP_F_FRAG;
+
+        memcpy(payload, buf->packet, length);
+        skb->dev = netdev;
+        skb->ip_summed = CHECKSUM_NONE;
+        skb_reset_mac_header(skb);
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_802_2);
+
+        netdev->last_rx = jiffies;
+        netif_rx(skb);
+        stats->rx_packets++;
+        stats->rx_bytes += length;
 }
 
-/* must be atomic */
-static void at76_configure_filter(struct ieee80211_hw *hw,
-                                  unsigned int changed_flags,
-                                  unsigned int *total_flags, int mc_count,
-                                  struct dev_addr_list *mc_list)
+/* Check if we spy on the sender address in buf and update stats */
+static void at76_iwspy_update(struct at76_priv *priv,
+                              struct at76_rx_buffer *buf)
 {
-        struct at76_priv *priv = hw->priv;
-        int flags;
-
-        at76_dbg(DBG_MAC80211, "%s(): changed_flags=0x%08x "
-                 "total_flags=0x%08x mc_count=%d",
-                 __func__, changed_flags, *total_flags, mc_count);
+        struct ieee80211_hdr_3addr *hdr =
+            (struct ieee80211_hdr_3addr *)buf->packet;
+        struct iw_quality qual;
 
-        flags = changed_flags & AT76_SUPPORTED_FILTERS;
-        *total_flags = AT76_SUPPORTED_FILTERS;
+        /* We can only set the level here */
+        qual.updated = IW_QUAL_QUAL_INVALID | IW_QUAL_NOISE_INVALID;
+        qual.level = 0;
+        qual.noise = 0;
+        at76_calc_level(priv, buf, &qual);
 
-        /* FIXME: access to priv->promisc should be protected with
-         * priv->mtx, but it's impossible because this function needs to be
-         * atomic */
+        spin_lock_bh(&priv->spy_spinlock);
 
-        if (flags && !priv->promisc) {
-                /* mac80211 wants us to enable promiscuous mode */
-                priv->promisc = 1;
-        } else if (!flags && priv->promisc) {
-                /* we need to disable promiscuous mode */
-                priv->promisc = 0;
-        } else
-                return;
+        if (priv->spy_data.spy_number > 0)
+                wireless_spy_update(priv->netdev, hdr->addr2, &qual);
 
-        queue_work(hw->workqueue, &priv->work_set_promisc);
+        spin_unlock_bh(&priv->spy_spinlock);
 }
 
-static int at76_set_key_oldfw(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                        const u8 *local_address, const u8 *address,
-                        struct ieee80211_key_conf *key)
+static void at76_rx_tasklet(unsigned long param)
 {
-        struct at76_priv *priv = hw->priv;
-
-        int i;
-
-        at76_dbg(DBG_MAC80211, "%s(): cmd %d key->alg %d key->keyidx %d "
-                 "key->keylen %d",
-                 __func__, cmd, key->alg, key->keyidx, key->keylen);
+        struct urb *urb = (struct urb *)param;
+        struct at76_priv *priv = urb->context;
+        struct net_device *netdev = priv->netdev;
+        struct at76_rx_buffer *buf;
+        struct ieee80211_hdr_3addr *i802_11_hdr;
+        u16 frame_ctl;
 
-        if (key->alg != ALG_WEP)
-                return -EOPNOTSUPP;
+        if (priv->device_unplugged) {
+                at76_dbg(DBG_DEVSTART, "device unplugged");
+                if (urb)
+                        at76_dbg(DBG_DEVSTART, "urb status %d", urb->status);
+                return;
+        }
 
-        key->hw_key_idx = key->keyidx;
+        if (!priv->rx_skb || !netdev || !priv->rx_skb->data)
+                return;
 
-        mutex_lock(&priv->mtx);
+        buf = (struct at76_rx_buffer *)priv->rx_skb->data;
 
-        switch (cmd) {
-        case SET_KEY:
-                memcpy(priv->wep_keys[key->keyidx], key->key, key->keylen);
-                priv->wep_keys_len[key->keyidx] = key->keylen;
+        i802_11_hdr = (struct ieee80211_hdr_3addr *)buf->packet;
 
-                /* FIXME: find out how to do this properly */
-                priv->wep_key_id = key->keyidx;
+        frame_ctl = le16_to_cpu(i802_11_hdr->frame_ctl);
 
-                break;
-        case DISABLE_KEY:
-        default:
-                priv->wep_keys_len[key->keyidx] = 0;
-                break;
+        if (urb->status != 0) {
+                if (urb->status != -ENOENT && urb->status != -ECONNRESET)
+                        at76_dbg(DBG_URB,
+                                 "%s %s: - nonzero Rx bulk status received: %d",
+                                 __func__, netdev->name, urb->status);
+                return;
         }
 
-        priv->wep_enabled = 0;
+        at76_dbg(DBG_RX_ATMEL_HDR,
+                 "%s: rx frame: rate %d rssi %d noise %d link %d %s",
+                 priv->netdev->name, buf->rx_rate, buf->rssi, buf->noise_level,
+                 buf->link_quality, hex2str(i802_11_hdr, 48));
+        if (priv->iw_mode == IW_MODE_MONITOR) {
+                at76_rx_monitor_mode(priv);
+                goto exit;
+        }
 
-        for (i = 0; i < WEP_KEYS; i++) {
-                if (priv->wep_keys_len[i] != 0)
-                        priv->wep_enabled = 1;
+        /* there is a new bssid around, accept it: */
+        if (buf->newbss && priv->iw_mode == IW_MODE_ADHOC) {
+                at76_dbg(DBG_PROGRESS, "%s: rx newbss", netdev->name);
+                schedule_work(&priv->work_new_bss);
         }
 
-        at76_startup_device(priv);
+        switch (frame_ctl & IEEE80211_FCTL_FTYPE) {
+        case IEEE80211_FTYPE_DATA:
+                at76_rx_data(priv);
+                break;
 
-        mutex_unlock(&priv->mtx);
+        case IEEE80211_FTYPE_MGMT:
+                /* jal: TODO: find out if we can update iwspy also on
+                   other frames than management (might depend on the
+                   radio chip / firmware version !) */
 
-        return 0;
-}
+                at76_iwspy_update(priv, buf);
 
-static int at76_set_key_newfw(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                        const u8 *local_address, const u8 *address,
-                        struct ieee80211_key_conf *key)
-{
-        struct at76_priv *priv = hw->priv;
-        int ret = -EOPNOTSUPP;
-
-        at76_dbg(DBG_MAC80211, "%s(): cmd %d key->alg %d key->keyidx %d "
-                 "key->keylen %d",
-                 __func__, cmd, key->alg, key->keyidx, key->keylen);
+                at76_rx_mgmt(priv, buf);
+                break;
 
-        mutex_lock(&priv->mtx);
+        case IEEE80211_FTYPE_CTL:
+                at76_dbg(DBG_RX_CTRL, "%s: ignored ctrl frame: %04x",
+                         priv->netdev->name, frame_ctl);
+                break;
 
-        priv->mib_buf.type = MIB_MAC_ENCRYPTION;
+        default:
+                printk(KERN_DEBUG "%s: ignoring frame with framectl 0x%04x\n",
+                       priv->netdev->name, frame_ctl);
+        }
+exit:
+        at76_submit_rx_urb(priv);
+}
 
-        if (cmd == DISABLE_KEY) {
-                priv->mib_buf.size = CIPHER_KEY_LEN;
-                priv->mib_buf.index = offsetof(struct mib_mac_encryption,
-                                cipher_default_keyvalue[key->keyidx]);
-                memset(priv->mib_buf.data.data, 0, CIPHER_KEY_LEN);
-                if (at76_set_mib(priv, &priv->mib_buf) != CMD_STATUS_COMPLETE)
-                        ret = -EOPNOTSUPP; /* -EIO would be probably better */
-                else {
+/* Load firmware into kernel memory and parse it */
+static struct fwentry *at76_load_firmware(struct usb_device *udev,
+                                          enum board_type board_type)
+{
+        int ret;
+        char *str;
+        struct at76_fw_header *fwh;
+        struct fwentry *fwe = &firmwares[board_type];
 
-                        priv->keys[key->keyidx].cipher = CIPHER_NONE;
-                        priv->keys[key->keyidx].keylen = 0;
-                };
-                if (priv->default_group_key == key->keyidx)
-                        priv->default_group_key = 0xff;
+        mutex_lock(&fw_mutex);
 
-                if (priv->default_pairwise_key == key->keyidx)
-                        priv->default_pairwise_key = 0xff;
-                /* If default pairwise key is removed, fall back to
-                 * group key? */
-                ret = 0;
+        if (fwe->loaded) {
+                at76_dbg(DBG_FW, "re-using previously loaded fw");
                 goto exit;
-        };
-
-        if (cmd == SET_KEY) {
-                /* store key into MIB */
-                priv->mib_buf.size = CIPHER_KEY_LEN;
-                priv->mib_buf.index = offsetof(struct mib_mac_encryption,
-                                cipher_default_keyvalue[key->keyidx]);
-                memset(priv->mib_buf.data.data, 0, CIPHER_KEY_LEN);
-                memcpy(priv->mib_buf.data.data, key->key, key->keylen);
-
-                switch (key->alg) {
-                case ALG_WEP:
-                        if (key->keylen == 5) {
-                                priv->keys[key->keyidx].cipher =
-                                        CIPHER_WEP64;
-                                priv->keys[key->keyidx].keylen = 8;
-                        } else if (key->keylen == 13) {
-                                priv->keys[key->keyidx].cipher =
-                                        CIPHER_WEP128;
-                                /* Firmware needs this */
-                                priv->keys[key->keyidx].keylen = 8;
-                        } else {
-                                ret = -EOPNOTSUPP;
-                                goto exit;
-                        };
-                        break;
-                case ALG_TKIP:
-                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                        priv->keys[key->keyidx].cipher = CIPHER_TKIP;
-                        priv->keys[key->keyidx].keylen = 12;
-                        break;
+        }
 
-                case ALG_CCMP:
-                        if (!at76_is_505a(priv->board_type)) {
-                                ret = -EOPNOTSUPP;
-                                goto exit;
-                        };
-                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                        priv->keys[key->keyidx].cipher = CIPHER_CCMP;
-                        priv->keys[key->keyidx].keylen = 16;
-                        break;
+        at76_dbg(DBG_FW, "downloading firmware %s", fwe->fwname);
+        ret = request_firmware(&fwe->fw, fwe->fwname, &udev->dev);
+        if (ret < 0) {
+                dev_printk(KERN_ERR, &udev->dev, "firmware %s not found!\n",
+                           fwe->fwname);
+                dev_printk(KERN_ERR, &udev->dev,
+                           "you may need to download the firmware from "
+                           "http://developer.berlios.de/projects/at76c503a/");
+                goto exit;
+        }
 
-                default:
-                        ret = -EOPNOTSUPP;
-                        goto exit;
-                };
-
-                priv->mib_buf.data.data[38] = priv->keys[key->keyidx].cipher;
-                priv->mib_buf.data.data[39] = 1; /* Taken from atmelwlandriver,
-                                                    not documented */
-
-                if (is_valid_ether_addr(address))
-                        /* Pairwise key */
-                        priv->mib_buf.data.data[39] |= (KEY_PAIRWISE | KEY_TX);
-                else if (is_broadcast_ether_addr(address))
-                        /* Group key */
-                        priv->mib_buf.data.data[39] |= (KEY_TX);
-                else    /* Key used only for transmission ??? */
-                        priv->mib_buf.data.data[39] |= (KEY_TX);
-
-                if (at76_set_mib(priv, &priv->mib_buf) !=
-                                CMD_STATUS_COMPLETE) {
-                        ret = -EOPNOTSUPP; /* -EIO would be probably better */
-                        goto exit;
-                };
+        at76_dbg(DBG_FW, "got it.");
+        fwh = (struct at76_fw_header *)(fwe->fw->data);
 
-                if ((key->alg == ALG_TKIP) || (key->alg == ALG_CCMP))
-                        at76_reset_rsc(priv);
+        if (fwe->fw->size <= sizeof(*fwh)) {
+                dev_printk(KERN_ERR, &udev->dev,
+                           "firmware is too short (0x%zx)\n", fwe->fw->size);
+                goto exit;
+        }
 
-                key->hw_key_idx = key->keyidx;
+        /* CRC currently not checked */
+        fwe->board_type = le32_to_cpu(fwh->board_type);
+        if (fwe->board_type != board_type) {
+                dev_printk(KERN_ERR, &udev->dev,
+                           "board type mismatch, requested %u, got %u\n",
+                           board_type, fwe->board_type);
+                goto exit;
+        }
 
-                /* Set up default keys */
-                if (is_broadcast_ether_addr(address))
-                        priv->default_group_key = key->keyidx;
-                if (is_valid_ether_addr(address))
-                        priv->default_pairwise_key = key->keyidx;
+        fwe->fw_version.major = fwh->major;
+        fwe->fw_version.minor = fwh->minor;
+        fwe->fw_version.patch = fwh->patch;
+        fwe->fw_version.build = fwh->build;
 
-                /* Set up encryption MIBs */
+        str = (char *)fwh + le32_to_cpu(fwh->str_offset);
+        fwe->intfw = (u8 *)fwh + le32_to_cpu(fwh->int_fw_offset);
+        fwe->intfw_size = le32_to_cpu(fwh->int_fw_len);
+        fwe->extfw = (u8 *)fwh + le32_to_cpu(fwh->ext_fw_offset);
+        fwe->extfw_size = le32_to_cpu(fwh->ext_fw_len);
 
-                /* first block of settings */
-                priv->mib_buf.size = 3;
-                priv->mib_buf.index = offsetof(struct mib_mac_encryption,
-                                privacy_invoked);
-                priv->mib_buf.data.data[0] = 1; /* privacy_invoked */
-                priv->mib_buf.data.data[1] = priv->default_pairwise_key;
-                priv->mib_buf.data.data[2] = priv->default_group_key;
+        fwe->loaded = 1;
 
-                ret = at76_set_mib(priv, &priv->mib_buf);
-                if (ret != CMD_STATUS_COMPLETE)
-                        goto exit;
+        dev_printk(KERN_DEBUG, &udev->dev,
+                   "using firmware %s (version %d.%d.%d-%d)\n",
+                   fwe->fwname, fwh->major, fwh->minor, fwh->patch, fwh->build);
 
-                /* second block of settings */
-                priv->mib_buf.size = 3;
-                priv->mib_buf.index = offsetof(struct mib_mac_encryption,
-                                exclude_unencrypted);
-                priv->mib_buf.data.data[0] = 1; /* exclude_unencrypted */
-                priv->mib_buf.data.data[1] = 0; /* wep_encryption_type */
-                priv->mib_buf.data.data[2] = 0; /* ckip_key_permutation */
+        at76_dbg(DBG_DEVSTART, "board %u, int %d:%d, ext %d:%d", board_type,
+                 le32_to_cpu(fwh->int_fw_offset), le32_to_cpu(fwh->int_fw_len),
+                 le32_to_cpu(fwh->ext_fw_offset), le32_to_cpu(fwh->ext_fw_len));
+        at76_dbg(DBG_DEVSTART, "firmware id %s", str);
 
-                ret = at76_set_mib(priv, &priv->mib_buf);
-                if (ret != CMD_STATUS_COMPLETE)
-                        goto exit;
-                ret = 0;
-        };
 exit:
-        at76_dump_mib_mac_encryption(priv);
-        mutex_unlock(&priv->mtx);
-        return ret;
-}
-
-static int at76_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                        const u8 *local_address, const u8 *address,
-                        struct ieee80211_key_conf *key)
-{
-        struct at76_priv *priv = hw->priv;
-
-        at76_dbg(DBG_MAC80211, "%s(): cmd %d key->alg %d key->keyidx %d "
-                 "key->keylen %d",
-                 __func__, cmd, key->alg, key->keyidx, key->keylen);
+        mutex_unlock(&fw_mutex);
 
-        if (FIRMWARE_IS_WPA(priv->fw_version))
-                return at76_set_key_newfw(hw, cmd, local_address, address, key);
+        if (fwe->loaded)
+                return fwe;
         else
-                return at76_set_key_oldfw(hw, cmd, local_address, address, key);
-
+                return NULL;
 }
 
-static const struct ieee80211_ops at76_ops = {
-        .tx = at76_mac80211_tx,
-        .add_interface = at76_add_interface,
-        .remove_interface = at76_remove_interface,
-        .config = at76_config,
-        .config_interface = at76_config_interface,
-        .configure_filter = at76_configure_filter,
-        .start = at76_mac80211_start,
-        .stop = at76_mac80211_stop,
-        .hw_scan = at76_hw_scan,
-        .set_key = at76_set_key,
-};
-
 /* Allocate network device and initialize private data */
 static struct at76_priv *at76_alloc_new_device(struct usb_device *udev)
 {
-        struct ieee80211_hw *hw;
+        struct net_device *netdev;
         struct at76_priv *priv;
+        int i;
 
-        hw = ieee80211_alloc_hw(sizeof(struct at76_priv), &at76_ops);
-        if (!hw) {
-                printk(KERN_ERR DRIVER_NAME ": could not register"
-                       " ieee80211_hw\n");
+        /* allocate memory for our device state and initialize it */
+        netdev = alloc_etherdev(sizeof(struct at76_priv));
+        if (!netdev) {
+                dev_printk(KERN_ERR, &udev->dev, "out of memory\n");
                 return NULL;
         }
 
-        priv = hw->priv;
-        priv->hw = hw;
+        priv = netdev_priv(netdev);
 
         priv->udev = udev;
+        priv->netdev = netdev;
 
         mutex_init(&priv->mtx);
+        INIT_WORK(&priv->work_assoc_done, at76_work_assoc_done);
+        INIT_WORK(&priv->work_join, at76_work_join);
+        INIT_WORK(&priv->work_new_bss, at76_work_new_bss);
+        INIT_WORK(&priv->work_start_scan, at76_work_start_scan);
         INIT_WORK(&priv->work_set_promisc, at76_work_set_promisc);
         INIT_WORK(&priv->work_submit_rx, at76_work_submit_rx);
-        INIT_DELAYED_WORK(&priv->dwork_hw_scan, at76_dwork_hw_scan);
+        INIT_DELAYED_WORK(&priv->dwork_restart, at76_dwork_restart);
+        INIT_DELAYED_WORK(&priv->dwork_get_scan, at76_dwork_get_scan);
+        INIT_DELAYED_WORK(&priv->dwork_beacon, at76_dwork_beacon);
+        INIT_DELAYED_WORK(&priv->dwork_auth, at76_dwork_auth);
+        INIT_DELAYED_WORK(&priv->dwork_assoc, at76_dwork_assoc);
+
+        spin_lock_init(&priv->mgmt_spinlock);
+        priv->next_mgmt_bulk = NULL;
+        priv->mac_state = MAC_INIT;
+
+        /* initialize empty BSS list */
+        priv->curr_bss = NULL;
+        INIT_LIST_HEAD(&priv->bss_list);
+        spin_lock_init(&priv->bss_list_spinlock);
+
+        init_timer(&priv->bss_list_timer);
+        priv->bss_list_timer.data = (unsigned long)priv;
+        priv->bss_list_timer.function = at76_bss_list_timeout;
+
+        spin_lock_init(&priv->spy_spinlock);
+
+        /* mark all rx data entries as unused */
+        for (i = 0; i < NR_RX_DATA_BUF; i++)
+                priv->rx_data[i].skb = NULL;
 
         priv->rx_tasklet.func = at76_rx_tasklet;
         priv->rx_tasklet.data = 0;
@@ -2371,9 +5197,6 @@ static struct at76_priv *at76_alloc_new_device(struct usb_device *udev)
         priv->pm_mode = AT76_PM_OFF;
         priv->pm_period = 0;
 
-        /* unit us */
-        priv->hw->channel_change_time = 100000;
-
         return priv;
 }
 
@@ -2436,42 +5259,11 @@ static int at76_alloc_urbs(struct at76_priv *priv,
         return 0;
 }
 
-static struct ieee80211_rate at76_rates[] = {
-        { .bitrate = 10, .hw_value = TX_RATE_1MBIT, },
-        { .bitrate = 20, .hw_value = TX_RATE_2MBIT, },
-        { .bitrate = 55, .hw_value = TX_RATE_5_5MBIT, },
-        { .bitrate = 110, .hw_value = TX_RATE_11MBIT, },
-};
-
-static struct ieee80211_channel at76_channels[] = {
-        { .center_freq = 2412, .hw_value = 1 },
-        { .center_freq = 2417, .hw_value = 2 },
-        { .center_freq = 2422, .hw_value = 3 },
-        { .center_freq = 2427, .hw_value = 4 },
-        { .center_freq = 2432, .hw_value = 5 },
-        { .center_freq = 2437, .hw_value = 6 },
-        { .center_freq = 2442, .hw_value = 7 },
-        { .center_freq = 2447, .hw_value = 8 },
-        { .center_freq = 2452, .hw_value = 9 },
-        { .center_freq = 2457, .hw_value = 10 },
-        { .center_freq = 2462, .hw_value = 11 },
-        { .center_freq = 2467, .hw_value = 12 },
-        { .center_freq = 2472, .hw_value = 13 },
-        { .center_freq = 2484, .hw_value = 14 }
-};
-
-static struct ieee80211_supported_band at76_supported_band = {
-        .channels = at76_channels,
-        .n_channels = ARRAY_SIZE(at76_channels),
-        .bitrates = at76_rates,
-        .n_bitrates = ARRAY_SIZE(at76_rates),
-};
-
 /* Register network device and initialize the hardware */
 static int at76_init_new_device(struct at76_priv *priv,
                                 struct usb_interface *interface)
 {
-        struct device *dev = &interface->dev;
+        struct net_device *netdev = priv->netdev;
         int ret;
 
         /* set up the endpoint information */
@@ -2487,11 +5279,14 @@ static int at76_init_new_device(struct at76_priv *priv,
         /* MAC address */
         ret = at76_get_hw_config(priv);
         if (ret < 0) {
-                dev_err(dev, "cannot get MAC address\n");
+                dev_printk(KERN_ERR, &interface->dev,
+                           "cannot get MAC address\n");
                 goto exit;
         }
 
         priv->domain = at76_get_reg_domain(priv->regulatory_domain);
+        /* init. netdev->dev_addr */
+        memcpy(netdev->dev_addr, priv->mac_addr, ETH_ALEN);
 
         priv->channel = DEF_CHANNEL;
         priv->iw_mode = IW_MODE_INFRA;
@@ -2501,54 +5296,47 @@ static int at76_init_new_device(struct at76_priv *priv,
         priv->txrate = TX_RATE_AUTO;
         priv->preamble_type = PREAMBLE_TYPE_LONG;
         priv->beacon_period = 100;
+        priv->beacons_last_qual = jiffies;
         priv->auth_mode = WLAN_AUTH_OPEN;
         priv->scan_min_time = DEF_SCAN_MIN_TIME;
         priv->scan_max_time = DEF_SCAN_MAX_TIME;
         priv->scan_mode = SCAN_TYPE_ACTIVE;
-        priv->default_pairwise_key = 0xff;
-        priv->default_group_key = 0xff;
-
-        /* mac80211 initialisation */
-        priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &at76_supported_band;
 
-        if (FIRMWARE_IS_WPA(priv->fw_version) &&
-                (at76_is_503rfmd(priv->board_type) ||
-                 at76_is_505(priv->board_type)))
-                priv->hw->flags = IEEE80211_HW_SIGNAL_UNSPEC;
-        else
-                priv->hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                                  IEEE80211_HW_SIGNAL_UNSPEC;
-
-        priv->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
-
-        SET_IEEE80211_DEV(priv->hw, &interface->dev);
-        SET_IEEE80211_PERM_ADDR(priv->hw, priv->mac_addr);
-
-        ret = ieee80211_register_hw(priv->hw);
+        netdev->flags &= ~IFF_MULTICAST;        /* not yet or never */
+        netdev->open = at76_open;
+        netdev->stop = at76_stop;
+        netdev->get_stats = at76_get_stats;
+        netdev->ethtool_ops = &at76_ethtool_ops;
+
+        /* Add pointers to enable iwspy support. */
+        priv->wireless_data.spy_data = &priv->spy_data;
+        netdev->wireless_data = &priv->wireless_data;
+
+        netdev->hard_start_xmit = at76_tx;
+        netdev->tx_timeout = at76_tx_timeout;
+        netdev->watchdog_timeo = 2 * HZ;
+        netdev->wireless_handlers = &at76_handler_def;
+        netdev->set_multicast_list = at76_set_multicast;
+        netdev->set_mac_address = at76_set_mac_address;
+        dev_alloc_name(netdev, "wlan%d");
+
+        ret = register_netdev(priv->netdev);
         if (ret) {
-                dev_err(dev, "cannot register mac80211 hw (status %d)!\n", ret);
+                dev_printk(KERN_ERR, &interface->dev,
+                           "cannot register netdevice (status %d)!\n", ret);
                 goto exit;
         }
+        priv->netdev_registered = 1;
 
-        priv->mac80211_registered = 1;
+        printk(KERN_INFO "%s: USB %s, MAC %s, firmware %d.%d.%d-%d\n",
+               netdev->name, dev_name(&interface->dev), mac2str(priv->mac_addr),
+               priv->fw_version.major, priv->fw_version.minor,
+               priv->fw_version.patch, priv->fw_version.build);
+        printk(KERN_INFO "%s: regulatory domain 0x%02x: %s\n", netdev->name,
+               priv->regulatory_domain, priv->domain->name);
 
-        dev_info(dev, "%s: USB %s, MAC %s, firmware %d.%d.%d-%d\n",
-                 wiphy_name(priv->hw->wiphy),
-                 dev_name(&interface->dev), mac2str(priv->mac_addr),
-                 priv->fw_version.major, priv->fw_version.minor,
-                 priv->fw_version.patch, priv->fw_version.build);
-        dev_info(dev, "%s: regulatory domain 0x%02x: %s\n",
-                 wiphy_name(priv->hw->wiphy),
-                 priv->regulatory_domain, priv->domain->name);
-        dev_info(dev, "%s: WPA support: ", wiphy_name(priv->hw->wiphy));
-        if (!FIRMWARE_IS_WPA(priv->fw_version))
-                printk("none\n");
-        else {
-                if (!at76_is_505a(priv->board_type))
-                        printk("TKIP\n");
-                else
-                        printk("TKIP, AES/CCMP\n");
-        };
+        /* we let this timer run the whole time this driver instance lives */
+        mod_timer(&priv->bss_list_timer, jiffies + BSS_LIST_TIMEOUT);
 
 exit:
         return ret;
@@ -2556,13 +5344,15 @@ exit:
 
 static void at76_delete_device(struct at76_priv *priv)
 {
+        int i;
+
         at76_dbg(DBG_PROC_ENTRY, "%s: ENTER", __func__);
 
         /* The device is gone, don't bother turning it off */
         priv->device_unplugged = 1;
 
-        if (priv->mac80211_registered)
-                ieee80211_unregister_hw(priv->hw);
+        if (priv->netdev_registered)
+                unregister_netdev(priv->netdev);
 
         /* assuming we used keventd, it must quiesce too */
         flush_scheduled_work();
@@ -2583,11 +5373,25 @@ static void at76_delete_device(struct at76_priv *priv)
         if (priv->rx_skb)
                 kfree_skb(priv->rx_skb);
 
+        at76_free_bss_list(priv);
+        del_timer_sync(&priv->bss_list_timer);
+        cancel_delayed_work(&priv->dwork_get_scan);
+        cancel_delayed_work(&priv->dwork_beacon);
+        cancel_delayed_work(&priv->dwork_auth);
+        cancel_delayed_work(&priv->dwork_assoc);
+
+        if (priv->mac_state == MAC_CONNECTED)
+                at76_iwevent_bss_disconnect(priv->netdev);
+
+        for (i = 0; i < NR_RX_DATA_BUF; i++)
+                if (priv->rx_data[i].skb) {
+                        dev_kfree_skb(priv->rx_data[i].skb);
+                        priv->rx_data[i].skb = NULL;
+                }
         usb_put_dev(priv->udev);
 
-        at76_dbg(DBG_PROC_ENTRY, "%s: before freeing priv/ieee80211_hw",
-                 __func__);
-        ieee80211_free_hw(priv->hw);
+        at76_dbg(DBG_PROC_ENTRY, "%s: before freeing priv/netdev", __func__);
+        free_netdev(priv->netdev);      /* priv is in netdev */
 
         at76_dbg(DBG_PROC_ENTRY, "%s: EXIT", __func__);
 }
@@ -2621,8 +5425,8 @@ static int at76_probe(struct usb_interface *interface,
            we get 204 with 2.4.23, Fiberline FL-WL240u (505A+RFMD2958) ??? */
 
         if (op_mode == OPMODE_HW_CONFIG_MODE) {
-                dev_err(&interface->dev,
-                        "cannot handle a device in HW_CONFIG_MODE\n");
+                dev_printk(KERN_ERR, &interface->dev,
+                           "cannot handle a device in HW_CONFIG_MODE\n");
                 ret = -EBUSY;
                 goto error;
         }
@@ -2630,12 +5434,13 @@ static int at76_probe(struct usb_interface *interface,
         if (op_mode != OPMODE_NORMAL_NIC_WITH_FLASH
             && op_mode != OPMODE_NORMAL_NIC_WITHOUT_FLASH) {
                 /* download internal firmware part */
-                dev_dbg(&interface->dev, "downloading internal firmware\n");
+                dev_printk(KERN_DEBUG, &interface->dev,
+                           "downloading internal firmware\n");
                 ret = at76_load_internal_fw(udev, fwe);
                 if (ret < 0) {
-                        dev_err(&interface->dev,
-                                "error %d downloading internal firmware\n",
-                                ret);
+                        dev_printk(KERN_ERR, &interface->dev,
+                                   "error %d downloading internal firmware\n",
+                                   ret);
                         goto error;
                 }
                 usb_put_dev(udev);
@@ -2660,7 +5465,8 @@ static int at76_probe(struct usb_interface *interface,
                 need_ext_fw = 1;
 
         if (need_ext_fw) {
-                dev_dbg(&interface->dev, "downloading external firmware\n");
+                dev_printk(KERN_DEBUG, &interface->dev,
+                           "downloading external firmware\n");
 
                 ret = at76_load_external_fw(udev, fwe);
                 if (ret)
@@ -2669,8 +5475,8 @@ static int at76_probe(struct usb_interface *interface,
                 /* Re-check firmware version */
                 ret = at76_get_mib(udev, MIB_FW_VERSION, &fwv, sizeof(fwv));
                 if (ret < 0) {
-                        dev_err(&interface->dev,
-                                "error %d getting firmware version\n", ret);
+                        dev_printk(KERN_ERR, &interface->dev,
+                                   "error %d getting firmware version\n", ret);
                         goto error;
                 }
         }
@@ -2681,6 +5487,7 @@ static int at76_probe(struct usb_interface *interface,
                 goto error;
         }
 
+        SET_NETDEV_DEV(priv->netdev, &interface->dev);
         usb_set_intfdata(interface, priv);
 
         memcpy(&priv->fw_version, &fwv, sizeof(struct mib_fw_version));
@@ -2708,7 +5515,7 @@ static void at76_disconnect(struct usb_interface *interface)
         if (!priv)
                 return;
 
-        printk(KERN_INFO "%s: disconnecting\n", wiphy_name(priv->hw->wiphy));
+        printk(KERN_INFO "%s: disconnecting\n", priv->netdev->name);
         at76_delete_device(priv);
         dev_printk(KERN_INFO, &interface->dev, "disconnected\n");
 }
@@ -2764,8 +5571,5 @@ MODULE_AUTHOR("Alex <alex@foogod.com>");
 MODULE_AUTHOR("Nick Jones");
 MODULE_AUTHOR("Balint Seeber <n0_5p4m_p13453@hotmail.com>");
 MODULE_AUTHOR("Pavel Roskin <proski@gnu.org>");
-MODULE_AUTHOR("Guido Guenther <agx@sigxcpu.org>");
-MODULE_AUTHOR("Kalle Valo <kalle.valo@iki.fi>");
-MODULE_AUTHOR("Milan Plzik <milan.plzik@gmail.com>");
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
diff --git a/drivers/staging/at76_usb/at76_usb.h b/drivers/staging/at76_usb/at76_usb.h
index 8bb352f16d45..b20be9da1fa1 100644
--- a/drivers/staging/at76_usb/at76_usb.h
+++ b/drivers/staging/at76_usb/at76_usb.h
@@ -34,6 +34,23 @@ enum board_type {
         BOARD_505AMX = 8
 };
 
+/* our private ioctl's */
+/* preamble length (0 - long, 1 - short, 2 - auto) */
+#define AT76_SET_SHORT_PREAMBLE         (SIOCIWFIRSTPRIV + 0)
+#define AT76_GET_SHORT_PREAMBLE         (SIOCIWFIRSTPRIV + 1)
+/* which debug channels are enabled */
+#define AT76_SET_DEBUG                  (SIOCIWFIRSTPRIV + 2)
+#define AT76_GET_DEBUG                  (SIOCIWFIRSTPRIV + 3)
+/* power save mode (incl. the Atmel proprietary smart save mode) */
+#define AT76_SET_POWERSAVE_MODE         (SIOCIWFIRSTPRIV + 4)
+#define AT76_GET_POWERSAVE_MODE         (SIOCIWFIRSTPRIV + 5)
+/* min and max channel times for scan */
+#define AT76_SET_SCAN_TIMES             (SIOCIWFIRSTPRIV + 6)
+#define AT76_GET_SCAN_TIMES             (SIOCIWFIRSTPRIV + 7)
+/* scan mode (0 - active, 1 - passive) */
+#define AT76_SET_SCAN_MODE              (SIOCIWFIRSTPRIV + 8)
+#define AT76_GET_SCAN_MODE              (SIOCIWFIRSTPRIV + 9)
+
 #define CMD_STATUS_IDLE                         0x00
 #define CMD_STATUS_COMPLETE                     0x01
 #define CMD_STATUS_UNKNOWN                      0x02
@@ -65,7 +82,6 @@ enum board_type {
 #define MIB_MAC                 0x03
 #define MIB_MAC_MGMT            0x05
 #define MIB_MAC_WEP             0x06
-#define MIB_MAC_ENCRYPTION      0x06
 #define MIB_PHY                 0x07
 #define MIB_FW_VERSION          0x08
 #define MIB_MDOMAIN             0x09
@@ -90,26 +106,6 @@ enum board_type {
 #define AT76_PM_ON              2
 #define AT76_PM_SMART           3
 
-/* cipher values for encryption keys */
-#define CIPHER_NONE             0       /* this value is only guessed */
-#define CIPHER_WEP64            1
-#define CIPHER_TKIP             2
-#define CIPHER_CCMP             3
-#define CIPHER_CCX              4       /* for consistency sake only */
-#define CIPHER_WEP128           5
-
-/* bit flags key types for encryption keys */
-#define KEY_PAIRWISE            2
-#define KEY_TX                  4
-
-#define CIPHER_KEYS             (4)
-#define CIPHER_KEY_LEN          (40)
-
-struct key_config {
-        u8 cipher;
-        u8 keylen;
-};
-
 struct hwcfg_r505 {
         u8 cr39_values[14];
         u8 reserved1[14];
@@ -151,9 +147,6 @@ union at76_hwcfg {
 
 #define WEP_SMALL_KEY_LEN       (40 / 8)
 #define WEP_LARGE_KEY_LEN       (104 / 8)
-#define WEP_KEYS                (4)
-
-
 
 struct at76_card_config {
         u8 exclude_unencrypted;
@@ -168,7 +161,7 @@ struct at76_card_config {
         u8 privacy_invoked;
         u8 wep_default_key_id;  /* 0..3 */
         u8 current_ssid[32];
-        u8 wep_default_key_value[4][WEP_LARGE_KEY_LEN];
+        u8 wep_default_key_value[4][WEP_KEY_LEN];
         u8 ssid_len;
         u8 short_preamble;
         __le16 beacon_period;
@@ -193,7 +186,7 @@ struct at76_rx_buffer {
         u8 link_quality;
         u8 noise_level;
         __le32 rx_time;
-        u8 packet[IEEE80211_MAX_FRAG_THRESHOLD];
+        u8 packet[IEEE80211_FRAME_LEN + IEEE80211_FCS_LEN];
 } __attribute__((packed));
 
 /* Length of Atmel-specific Tx header before 802.11 frame */
@@ -203,11 +196,8 @@ struct at76_tx_buffer {
         __le16 wlength;
         u8 tx_rate;
         u8 padding;
-        u8 key_id;
-        u8 cipher_type;
-        u8 cipher_length;
-        u8 reserved;
-        u8 packet[IEEE80211_MAX_FRAG_THRESHOLD];
+        u8 reserved[4];
+        u8 packet[IEEE80211_FRAME_LEN + IEEE80211_FCS_LEN];
 } __attribute__((packed));
 
 /* defines for scan_type below */
@@ -254,7 +244,6 @@ struct set_mib_buffer {
                 u8 byte;
                 __le16 word;
                 u8 addr[ETH_ALEN];
-                u8 data[256];   /* we need more space for mib_mac_encryption */
         } data;
 } __attribute__((packed));
 
@@ -328,24 +317,10 @@ struct mib_mac_wep {
         u8 exclude_unencrypted;
         __le32 wep_icv_error_count;
         __le32 wep_excluded_count;
-        u8 wep_default_keyvalue[WEP_KEYS][WEP_LARGE_KEY_LEN];
+        u8 wep_default_keyvalue[WEP_KEYS][WEP_KEY_LEN];
         u8 encryption_level;    /* 1 for 40bit, 2 for 104bit encryption */
 } __attribute__((packed));
 
-struct mib_mac_encryption {
-        u8 cipher_default_keyvalue[CIPHER_KEYS][CIPHER_KEY_LEN];
-        u8 tkip_bssid[6];
-        u8 privacy_invoked;
-        u8 cipher_default_key_id;
-        u8 cipher_default_group_key_id;
-        u8 exclude_unencrypted;
-        u8 wep_encryption_type;
-        u8 ckip_key_permutation;        /* bool */
-        __le32 wep_icv_error_count;
-        __le32 wep_excluded_count;
-        u8 key_rsc[CIPHER_KEYS][8];
-} __attribute__((packed));
-
 struct mib_phy {
         __le32 ed_threshold;
 
@@ -389,6 +364,16 @@ struct at76_fw_header {
         __le32 ext_fw_len;      /* external firmware image length */
 } __attribute__((packed));
 
+enum mac_state {
+        MAC_INIT,
+        MAC_SCANNING,
+        MAC_AUTH,
+        MAC_ASSOC,
+        MAC_JOINING,
+        MAC_CONNECTED,
+        MAC_OWN_IBSS
+};
+
 /* a description of a regulatory domain and the allowed channels */
 struct reg_domain {
         u16 code;
@@ -396,6 +381,47 @@ struct reg_domain {
         u32 channel_map;        /* if bit N is set, channel (N+1) is allowed */
 };
 
+/* how long do we keep a (I)BSS in the bss_list in jiffies
+   this should be long enough for the user to retrieve the table
+   (by iwlist ?) after the device started, because all entries from
+   other channels than the one the device locks on get removed, too */
+#define BSS_LIST_TIMEOUT        (120 * HZ)
+/* struct to store BSS info found during scan */
+#define BSS_LIST_MAX_RATE_LEN   32      /* 32 rates should be enough ... */
+
+struct bss_info {
+        struct list_head list;
+
+        u8 bssid[ETH_ALEN];     /* bssid */
+        u8 ssid[IW_ESSID_MAX_SIZE];     /* essid */
+        u8 ssid_len;            /* length of ssid above */
+        u8 channel;
+        u16 capa;               /* BSS capabilities */
+        u16 beacon_interval;    /* beacon interval, Kus (1024 microseconds) */
+        u8 rates[BSS_LIST_MAX_RATE_LEN];        /* supported rates in units of
+                                                   500 kbps, ORed with 0x80 for
+                                                   basic rates */
+        u8 rates_len;
+
+        /* quality of received beacon */
+        u8 rssi;
+        u8 link_qual;
+        u8 noise_level;
+
+        unsigned long last_rx;  /* time (jiffies) of last beacon received */
+};
+
+/* a rx data buffer to collect rx fragments */
+struct rx_data_buf {
+        u8 sender[ETH_ALEN];    /* sender address */
+        u16 seqnr;              /* sequence number */
+        u16 fragnr;             /* last fragment received */
+        unsigned long last_rx;  /* jiffies of last rx */
+        struct sk_buff *skb;    /* == NULL if entry is free */
+};
+
+#define NR_RX_DATA_BUF          8
+
 /* Data for one loaded firmware file */
 struct fwentry {
         const char *const fwname;
@@ -412,9 +438,11 @@ struct fwentry {
 
 struct at76_priv {
         struct usb_device *udev;        /* USB device pointer */
+        struct net_device *netdev;      /* net device pointer */
+        struct net_device_stats stats;  /* net device stats */
+        struct iw_statistics wstats;    /* wireless stats */
 
         struct sk_buff *rx_skb; /* skbuff for receiving data */
-        struct sk_buff *tx_skb; /* skbuff for transmitting data */
         void *bulk_out_buffer;  /* buffer for sending data */
 
         struct urb *tx_urb;     /* URB for sending data */
@@ -426,17 +454,26 @@ struct at76_priv {
         struct mutex mtx;       /* locks this structure */
 
         /* work queues */
+        struct work_struct work_assoc_done;
+        struct work_struct work_join;
+        struct work_struct work_new_bss;
+        struct work_struct work_start_scan;
         struct work_struct work_set_promisc;
         struct work_struct work_submit_rx;
-        struct delayed_work dwork_hw_scan;
+        struct delayed_work dwork_restart;
+        struct delayed_work dwork_get_scan;
+        struct delayed_work dwork_beacon;
+        struct delayed_work dwork_auth;
+        struct delayed_work dwork_assoc;
 
         struct tasklet_struct rx_tasklet;
 
         /* the WEP stuff */
         int wep_enabled;        /* 1 if WEP is enabled */
         int wep_key_id;         /* key id to be used */
-        u8 wep_keys[WEP_KEYS][WEP_LARGE_KEY_LEN];       /* WEP keys */
-        u8 wep_keys_len[WEP_KEYS];      /* length of WEP keys */
+        u8 wep_keys[WEP_KEYS][WEP_KEY_LEN];     /* the four WEP keys,
+                                                   5 or 13 bytes are used */
+        u8 wep_keys_len[WEP_KEYS];      /* the length of the above keys */
 
         int channel;
         int iw_mode;
@@ -458,13 +495,44 @@ struct at76_priv {
         int scan_mode;          /* SCAN_TYPE_ACTIVE, SCAN_TYPE_PASSIVE */
         int scan_need_any;      /* if set, need to scan for any ESSID */
 
+        /* the list we got from scanning */
+        spinlock_t bss_list_spinlock;   /* protects bss_list operations */
+        struct list_head bss_list;      /* list of BSS we got beacons from */
+        struct timer_list bss_list_timer;       /* timer to purge old entries
+                                                   from bss_list */
+        struct bss_info *curr_bss;      /* current BSS */
         u16 assoc_id;           /* current association ID, if associated */
 
+        u8 wanted_bssid[ETH_ALEN];
+        int wanted_bssid_valid; /* != 0 if wanted_bssid is to be used */
+
+        /* some data for infrastructure mode only */
+        spinlock_t mgmt_spinlock;       /* this spinlock protects access to
+                                           next_mgmt_bulk */
+
+        struct at76_tx_buffer *next_mgmt_bulk;  /* pending management msg to
+                                                   send via bulk out */
+        enum mac_state mac_state;
+        enum {
+                SCAN_IDLE,
+                SCAN_IN_PROGRESS,
+                SCAN_COMPLETED
+        } scan_state;
+        time_t last_scan;
+
+        int retries;            /* remaining retries in case of timeout when
+                                 * sending AuthReq or AssocReq */
         u8 pm_mode;             /* power management mode */
         u32 pm_period;          /* power management period in microseconds */
 
         struct reg_domain const *domain;        /* reg domain description */
 
+        /* iwspy support */
+        spinlock_t spy_spinlock;
+        struct iw_spy_data spy_data;
+
+        struct iw_public_data wireless_data;
+
         /* These fields contain HW config provided by the device (not all of
          * these fields are used by all board types) */
         u8 mac_addr[ETH_ALEN];
@@ -472,6 +540,9 @@ struct at76_priv {
 
         struct at76_card_config card_config;
 
+        /* store rx fragments until complete */
+        struct rx_data_buf rx_data[NR_RX_DATA_BUF];
+
         enum board_type board_type;
         struct mib_fw_version fw_version;
 
@@ -479,20 +550,58 @@ struct at76_priv {
         unsigned int netdev_registered:1;
         struct set_mib_buffer mib_buf;  /* global buffer for set_mib calls */
 
+        /* beacon counting */
         int beacon_period;      /* period of mgmt beacons, Kus */
+        int beacons_received;
+        unsigned long beacons_last_qual;        /* time we restarted counting
+                                                   beacons */
+};
 
-        struct ieee80211_hw *hw;
-        int mac80211_registered;
-
-        struct key_config keys[4];      /* installed key types */
-        u8 default_pairwise_key;
-        u8 default_group_key;
+struct at76_rx_radiotap {
+        struct ieee80211_radiotap_header rt_hdr;
+        __le64 rt_tsft;
+        u8 rt_flags;
+        u8 rt_rate;
+        s8 rt_signal;
+        s8 rt_noise;
 };
 
-#define AT76_SUPPORTED_FILTERS FIF_PROMISC_IN_BSS
+#define AT76_RX_RADIOTAP_PRESENT                  \
+        ((1 << IEEE80211_RADIOTAP_TSFT)         | \
+        (1 << IEEE80211_RADIOTAP_FLAGS)         | \
+        (1 << IEEE80211_RADIOTAP_RATE)          | \
+        (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL)  | \
+        (1 << IEEE80211_RADIOTAP_DB_ANTNOISE))
+
+#define BEACON_MAX_DATA_LENGTH  1500
+
+/* the maximum size of an AssocReq packet */
+#define ASSOCREQ_MAX_SIZE \
+  (AT76_TX_HDRLEN + sizeof(struct ieee80211_assoc_request) + \
+   1 + 1 + IW_ESSID_MAX_SIZE + 1 + 1 + 4)
+
+/* for shared secret auth, add the challenge text size */
+#define AUTH_FRAME_SIZE (AT76_TX_HDRLEN + sizeof(struct ieee80211_auth))
+
+/* Maximal number of AuthReq retries */
+#define AUTH_RETRIES            3
 
+/* Maximal number of AssocReq retries */
+#define ASSOC_RETRIES           3
+
+/* Beacon timeout in managed mode when we are connected */
+#define BEACON_TIMEOUT          (10 * HZ)
+
+/* Timeout for authentication response */
+#define AUTH_TIMEOUT            (1 * HZ)
+
+/* Timeout for association response */
+#define ASSOC_TIMEOUT           (1 * HZ)
+
+/* Polling interval when scan is running */
 #define SCAN_POLL_INTERVAL      (HZ / 4)
 
+/* Command completion timeout */
 #define CMD_COMPLETION_TIMEOUT  (5 * HZ)
 
 #define DEF_RTS_THRESHOLD       1536
@@ -502,6 +611,8 @@ struct at76_priv {
 #define DEF_SCAN_MIN_TIME       10
 #define DEF_SCAN_MAX_TIME       120
 
+#define MAX_RTS_THRESHOLD       (MAX_FRAG_THRESHOLD + 1)
+
 /* the max padding size for tx in bytes (see calc_padding) */
 #define MAX_PADDING_SIZE        53
 
diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
index 5ffe269c2382..ab69c1bf36a8 100644
--- a/drivers/staging/panel/panel.c
+++ b/drivers/staging/panel/panel.c
@@ -622,7 +622,7 @@ static int set_ctrl_bits(void)
 }
 
 /* sets ctrl & data port bits according to current signals values */
-static void set_bits(void)
+static void panel_set_bits(void)
 {
         set_data_bits();
         set_ctrl_bits();
@@ -707,12 +707,12 @@ static void lcd_send_serial(int byte)
          */
         for (bit = 0; bit < 8; bit++) {
                 bits.cl = BIT_CLR;      /* CLK low */
-                set_bits();
+                panel_set_bits();
                 bits.da = byte & 1;
-                set_bits();
+                panel_set_bits();
                 udelay(2);      /* maintain the data during 2 us before CLK up */
                 bits.cl = BIT_SET;      /* CLK high */
-                set_bits();
+                panel_set_bits();
                 udelay(1);      /* maintain the strobe during 1 us */
                 byte >>= 1;
         }
@@ -727,7 +727,7 @@ static void lcd_backlight(int on)
         /* The backlight is activated by seting the AUTOFEED line to +5V  */
         spin_lock(&pprt_lock);
         bits.bl = on;
-        set_bits();
+        panel_set_bits();
         spin_unlock(&pprt_lock);
 }
 
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 8bcde8cde554..b2ceb4aff233 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_USB_MON)		+= mon/
 obj-$(CONFIG_PCI)               += host/
 obj-$(CONFIG_USB_EHCI_HCD)      += host/
 obj-$(CONFIG_USB_ISP116X_HCD)   += host/
+obj-$(CONFIG_USB_ISP1760_HCD)   += host/
 obj-$(CONFIG_USB_OHCI_HCD)      += host/
 obj-$(CONFIG_USB_UHCI_HCD)      += host/
 obj-$(CONFIG_USB_FHCI_HCD)      += host/
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 97ba4a985edc..326dd7f65ee9 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1349,9 +1349,6 @@ static struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
-        { USB_DEVICE(0x0e8d, 0x3329), /* i-blue 747, Qstarz BT-Q1000, Holux M-241 */
-        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
-        },
         { USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index d6c5bcd40064..d701bf4698d2 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -1622,6 +1622,8 @@ static int qe_ep_disable(struct usb_ep *_ep)
         nuke(ep, -ESHUTDOWN);
         ep->desc = NULL;
         ep->stopped = 1;
+        ep->tx_req = NULL;
+        qe_ep_reset(udc, ep->epnum);
         spin_unlock_irqrestore(&udc->lock, flags);
 
         cpm_muram_free(cpm_muram_offset(ep->rxbase));
@@ -1681,14 +1683,11 @@ static void qe_free_request(struct usb_ep *_ep, struct usb_request *_req)
                 kfree(req);
 }
 
-/* queues (submits) an I/O request to an endpoint */
-static int qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
-                                gfp_t gfp_flags)
+static int __qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req)
 {
         struct qe_ep *ep = container_of(_ep, struct qe_ep, ep);
         struct qe_req *req = container_of(_req, struct qe_req, req);
         struct qe_udc *udc;
-        unsigned long flags;
         int reval;
 
         udc = ep->udc;
@@ -1732,7 +1731,7 @@ static int qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
         list_add_tail(&req->queue, &ep->queue);
         dev_vdbg(udc->dev, "gadget have request in %s! %d\n",
                         ep->name, req->req.length);
-        spin_lock_irqsave(&udc->lock, flags);
+
         /* push the request to device */
         if (ep_is_in(ep))
                 reval = ep_req_send(ep, req);
@@ -1748,11 +1747,24 @@ static int qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
         if (ep->dir == USB_DIR_OUT)
                 reval = ep_req_receive(ep, req);
 
-        spin_unlock_irqrestore(&udc->lock, flags);
-
         return 0;
 }
 
+/* queues (submits) an I/O request to an endpoint */
+static int qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
+                       gfp_t gfp_flags)
+{
+        struct qe_ep *ep = container_of(_ep, struct qe_ep, ep);
+        struct qe_udc *udc = ep->udc;
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&udc->lock, flags);
+        ret = __qe_ep_queue(_ep, _req);
+        spin_unlock_irqrestore(&udc->lock, flags);
+        return ret;
+}
+
 /* dequeues (cancels, unlinks) an I/O request from an endpoint */
 static int qe_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 {
@@ -2008,7 +2020,7 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
         udc->ep0_dir = USB_DIR_IN;
 
         /* data phase */
-        status = qe_ep_queue(&ep->ep, &req->req, GFP_ATOMIC);
+        status = __qe_ep_queue(&ep->ep, &req->req);
 
         if (status == 0)
                 return;
@@ -2151,6 +2163,9 @@ static int reset_irq(struct qe_udc *udc)
 {
         unsigned char i;
 
+        if (udc->usb_state == USB_STATE_DEFAULT)
+                return 0;
+
         qe_usb_disable();
         out_8(&udc->usb_regs->usb_usadr, 0);
 
@@ -2442,8 +2457,12 @@ static int __devinit qe_udc_reg_init(struct qe_udc *udc)
         struct usb_ctlr __iomem *qe_usbregs;
         qe_usbregs = udc->usb_regs;
 
-        /* Init the usb register */
+        /* Spec says that we must enable the USB controller to change mode. */
         out_8(&qe_usbregs->usb_usmod, 0x01);
+        /* Mode changed, now disable it, since muram isn't initialized yet. */
+        out_8(&qe_usbregs->usb_usmod, 0x00);
+
+        /* Initialize the rest. */
         out_be16(&qe_usbregs->usb_usbmr, 0);
         out_8(&qe_usbregs->usb_uscom, 0);
         out_be16(&qe_usbregs->usb_usber, USBER_ALL_CLEAR);
@@ -2604,6 +2623,10 @@ static int __devinit qe_udc_probe(struct of_device *ofdev,
                         (unsigned long)udc_controller);
         /* request irq and disable DR  */
         udc_controller->usb_irq = irq_of_parse_and_map(np, 0);
+        if (!udc_controller->usb_irq) {
+                ret = -EINVAL;
+                goto err_noirq;
+        }
 
         ret = request_irq(udc_controller->usb_irq, qe_udc_irq, 0,
                                 driver_name, udc_controller);
@@ -2625,6 +2648,8 @@ static int __devinit qe_udc_probe(struct of_device *ofdev,
 err6:
         free_irq(udc_controller->usb_irq, udc_controller);
 err5:
+        irq_dispose_mapping(udc_controller->usb_irq);
+err_noirq:
         if (udc_controller->nullmap) {
                 dma_unmap_single(udc_controller->gadget.dev.parent,
                         udc_controller->nullp, 256,
@@ -2648,7 +2673,7 @@ err2:
         iounmap(udc_controller->usb_regs);
 err1:
         kfree(udc_controller);
-
+        udc_controller = NULL;
         return ret;
 }
 
@@ -2710,6 +2735,7 @@ static int __devexit qe_udc_remove(struct of_device *ofdev)
         kfree(ep->txframe);
 
         free_irq(udc_controller->usb_irq, udc_controller);
+        irq_dispose_mapping(udc_controller->usb_irq);
 
         tasklet_kill(&udc_controller->rx_tasklet);
 
diff --git a/drivers/usb/serial/aircable.c b/drivers/usb/serial/aircable.c
index 537f953bd7f8..6d106e74265e 100644
--- a/drivers/usb/serial/aircable.c
+++ b/drivers/usb/serial/aircable.c
@@ -621,9 +621,9 @@ static int __init aircable_init(void)
                 goto failed_usb_register;
         return 0;
 
-failed_serial_register:
-        usb_serial_deregister(&aircable_device);
 failed_usb_register:
+        usb_serial_deregister(&aircable_device);
+failed_serial_register:
         return retval;
 }
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 75597337583e..f92f4d773374 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -662,6 +662,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
         { USB_DEVICE(ALTI2_VID, ALTI2_N3_PID) },
         { USB_DEVICE(FTDI_VID, DIEBOLD_BCS_SE923_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_NDI_HUC_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -1064,8 +1065,10 @@ static int set_serial_info(struct tty_struct *tty,
 
         if (!capable(CAP_SYS_ADMIN)) {
                 if (((new_serial.flags & ~ASYNC_USR_MASK) !=
-                     (priv->flags & ~ASYNC_USR_MASK)))
+                     (priv->flags & ~ASYNC_USR_MASK))) {
+                        unlock_kernel();
                         return -EPERM;
+                }
                 priv->flags = ((priv->flags & ~ASYNC_USR_MASK) |
                                (new_serial.flags & ASYNC_USR_MASK));
                 priv->custom_divisor = new_serial.custom_divisor;
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 1b62eff475d2..e300c840f8ca 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -844,6 +844,9 @@
 #define TML_VID                 0x1B91  /* Vendor ID */
 #define TML_USB_SERIAL_PID      0x0064  /* USB - Serial Converter */
 
+/* NDI Polaris System */
+#define FTDI_NDI_HUC_PID        0xDA70
+
 /* Propox devices */
 #define FTDI_PROPOX_JTAGCABLEII_PID     0xD738
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 6c89da9c6fea..bfd0b68ceccd 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -199,14 +199,15 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 #define NOVATELWIRELESS_PRODUCT_MC950D          0x4400
 
 /* FUTURE NOVATEL PRODUCTS */
-#define NOVATELWIRELESS_PRODUCT_EVDO_1          0x6000
-#define NOVATELWIRELESS_PRODUCT_HSPA_1          0x7000
-#define NOVATELWIRELESS_PRODUCT_EMBEDDED_1      0x8000
-#define NOVATELWIRELESS_PRODUCT_GLOBAL_1        0x9000
-#define NOVATELWIRELESS_PRODUCT_EVDO_2          0x6001
-#define NOVATELWIRELESS_PRODUCT_HSPA_2          0x7001
-#define NOVATELWIRELESS_PRODUCT_EMBEDDED_2      0x8001
-#define NOVATELWIRELESS_PRODUCT_GLOBAL_2        0x9001
+#define NOVATELWIRELESS_PRODUCT_EVDO_FULLSPEED  0X6000
+#define NOVATELWIRELESS_PRODUCT_EVDO_HIGHSPEED  0X6001
+#define NOVATELWIRELESS_PRODUCT_HSPA_FULLSPEED  0X7000
+#define NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED  0X7001
+#define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_FULLSPEED 0X8000
+#define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED 0X8001
+#define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0X9000
+#define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0X9001
+#define NOVATELWIRELESS_PRODUCT_GLOBAL          0XA001
 
 /* AMOI PRODUCTS */
 #define AMOI_VENDOR_ID                          0x1614
@@ -216,6 +217,27 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 
 #define DELL_VENDOR_ID                          0x413C
 
+/* Dell modems */
+#define DELL_PRODUCT_5700_MINICARD              0x8114
+#define DELL_PRODUCT_5500_MINICARD              0x8115
+#define DELL_PRODUCT_5505_MINICARD              0x8116
+#define DELL_PRODUCT_5700_EXPRESSCARD           0x8117
+#define DELL_PRODUCT_5510_EXPRESSCARD           0x8118
+
+#define DELL_PRODUCT_5700_MINICARD_SPRINT       0x8128
+#define DELL_PRODUCT_5700_MINICARD_TELUS        0x8129
+
+#define DELL_PRODUCT_5720_MINICARD_VZW          0x8133
+#define DELL_PRODUCT_5720_MINICARD_SPRINT       0x8134
+#define DELL_PRODUCT_5720_MINICARD_TELUS        0x8135
+#define DELL_PRODUCT_5520_MINICARD_CINGULAR     0x8136
+#define DELL_PRODUCT_5520_MINICARD_GENERIC_L    0x8137
+#define DELL_PRODUCT_5520_MINICARD_GENERIC_I    0x8138
+
+#define DELL_PRODUCT_5730_MINICARD_SPRINT       0x8180
+#define DELL_PRODUCT_5730_MINICARD_TELUS        0x8181
+#define DELL_PRODUCT_5730_MINICARD_VZW          0x8182
+
 #define KYOCERA_VENDOR_ID                       0x0c88
 #define KYOCERA_PRODUCT_KPC650                  0x17da
 #define KYOCERA_PRODUCT_KPC680                  0x180a
@@ -274,12 +296,6 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 #define ERICSSON_VENDOR_ID                      0x0bdb
 #define ERICSSON_PRODUCT_F3507G                 0x1900
 
-/* Pantech products */
-#define PANTECH_VENDOR_ID                       0x106c
-#define PANTECH_PRODUCT_PC5740                  0x3701
-#define PANTECH_PRODUCT_PC5750                  0x3702  /* PX-500 */
-#define PANTECH_PRODUCT_UM150                   0x3711
-
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -395,31 +411,37 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EU870D) }, /* Novatel EU850D/EU860D/EU870D */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC950D) }, /* Novatel MC930D/MC950D */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC727) }, /* Novatel MC727/U727/USB727 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_1) }, /* Novatel EVDO product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_1) }, /* Novatel HSPA product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EMBEDDED_1) }, /* Novatel Embedded product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL_1) }, /* Novatel Global product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_2) }, /* Novatel EVDO product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_2) }, /* Novatel HSPA product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EMBEDDED_2) }, /* Novatel Embedded product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL_2) }, /* Novatel Global product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_FULLSPEED) }, /* Novatel EVDO product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_FULLSPEED) }, /* Novatel HSPA product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_FULLSPEED) }, /* Novatel EVDO Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED) }, /* Novatel HSPA Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_HIGHSPEED) }, /* Novatel EVDO product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED) }, /* Novatel HSPA product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED) }, /* Novatel EVDO Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED) }, /* Novatel HSPA Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL) }, /* Novatel Global product */
 
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H02) },
 
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8114) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8115) }, /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8116) }, /* Dell Wireless 5505 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8117) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO ExpressCard == Novatel Merlin XV620 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8118) }, /* Dell Wireless 5510 Mobile Broadband HSDPA ExpressCard == Novatel Merlin XU870 HSDPA/3G */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8128) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite E720 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8129) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite ET620 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8133) }, /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8136) }, /* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8137) }, /* Dell Wireless HSDPA 5520 */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8138) }, /* Dell Wireless 5520 Voda I Mobile Broadband (3G HSDPA) Minicard */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8147) }, /* Dell Wireless 5530 Mobile Broadband (3G HSPA) Mini-Card */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD) },             /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5500_MINICARD) },             /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5505_MINICARD) },             /* Dell Wireless 5505 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_EXPRESSCARD) },          /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO ExpressCard == Novatel Merlin XV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5510_EXPRESSCARD) },          /* Dell Wireless 5510 Mobile Broadband HSDPA ExpressCard == Novatel Merlin XU870 HSDPA/3G */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD_SPRINT) },      /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite E720 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD_TELUS) },       /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite ET620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5720_MINICARD_VZW) },         /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5720_MINICARD_SPRINT) },      /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5720_MINICARD_TELUS) },       /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5520_MINICARD_CINGULAR) },    /* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5520_MINICARD_GENERIC_L) },   /* Dell Wireless HSDPA 5520 */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5520_MINICARD_GENERIC_I) },   /* Dell Wireless 5520 Voda I Mobile Broadband (3G HSDPA) Minicard */
+        { USB_DEVICE(DELL_VENDOR_ID, 0x8147) },                                 /* Dell Wireless 5530 Mobile Broadband (3G HSPA) Mini-Card */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_SPRINT) },      /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_TELUS) },       /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) },         /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },   /* ADU-E100, ADU-310 */
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
@@ -488,9 +510,6 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
         { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) },
-        { USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_PC5740) },
-        { USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_PC5750) },
-        { USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_UM150) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index baf591137b80..2620bf6fe5e1 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -176,7 +176,7 @@ static unsigned int product_5052_count;
 /* the array dimension is the number of default entries plus */
 /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
 /* null entry */
-static struct usb_device_id ti_id_table_3410[7+TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_3410[10+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -185,9 +185,11 @@ static struct usb_device_id ti_id_table_3410[7+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_PRODUCT_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_EDGE_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
 };
 
-static struct usb_device_id ti_id_table_5052[4+TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_BOOT_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
@@ -195,7 +197,7 @@ static struct usb_device_id ti_id_table_5052[4+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
 };
 
-static struct usb_device_id ti_id_table_combined[6+2*TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -208,6 +210,8 @@ static struct usb_device_id ti_id_table_combined[6+2*TI_EXTRA_VID_PID_COUNT+1] =
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
         { }
 };
 
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index b7ea5dbadee5..f323c6025858 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -30,6 +30,8 @@
 #define IBM_VENDOR_ID                   0x04b3
 #define TI_3410_PRODUCT_ID              0x3410
 #define IBM_4543_PRODUCT_ID             0x4543
+#define IBM_454B_PRODUCT_ID             0x454b
+#define IBM_454C_PRODUCT_ID             0x454c
 #define TI_3410_EZ430_ID                0xF430  /* TI ez430 development tool */
 #define TI_5052_BOOT_PRODUCT_ID         0x5052  /* no EEPROM, no firmware */
 #define TI_5152_BOOT_PRODUCT_ID         0x5152  /* no EEPROM, no firmware */
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 2a42b862aa9f..727c506417cc 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -64,6 +64,7 @@
  */
 #define VENDOR_ID_NOKIA         0x0421
 #define VENDOR_ID_NIKON         0x04b0
+#define VENDOR_ID_PENTAX        0x0a17
 #define VENDOR_ID_MOTOROLA      0x22b8
 
 /***********************************************************************
@@ -158,6 +159,7 @@ static int slave_configure(struct scsi_device *sdev)
                 switch (le16_to_cpu(us->pusb_dev->descriptor.idVendor)) {
                 case VENDOR_ID_NOKIA:
                 case VENDOR_ID_NIKON:
+                case VENDOR_ID_PENTAX:
                 case VENDOR_ID_MOTOROLA:
                         if (!(us->fflags & (US_FL_FIX_CAPACITY |
                                         US_FL_CAPACITY_OK)))
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 1d5438e6363b..fb65d221cedf 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -558,32 +558,10 @@ static void last_sector_hacks(struct us_data *us, struct scsi_cmnd *srb)
 
         if (srb->result == SAM_STAT_GOOD && scsi_get_resid(srb) == 0) {
 
-                /* The command succeeded.  If the capacity is odd
-                 * (i.e., if the sector number is even) then the
-                 * "always-even" heuristic would be wrong for this
-                 * device.  Issue a WARN() so that the kerneloops.org
-                 * project will be notified and we will then know to
-                 * mark the device with a CAPACITY_OK flag.  Hopefully
-                 * this will occur for only a few devices.
-                 *
-                 * Use the sign of us->last_sector_hacks to tell whether
-                 * the warning has already been issued; we don't need
-                 * more than one warning per device.
+                /* The command succeeded.  We know this device doesn't
+                 * have the last-sector bug, so stop checking it.
                  */
-                if (!(sector & 1) && us->use_last_sector_hacks > 0) {
-                        unsigned vid = le16_to_cpu(
-                                        us->pusb_dev->descriptor.idVendor);
-                        unsigned pid = le16_to_cpu(
-                                        us->pusb_dev->descriptor.idProduct);
-                        unsigned rev = le16_to_cpu(
-                                        us->pusb_dev->descriptor.bcdDevice);
-
-                        WARN(1, "%s: Successful last sector success at %u, "
-                                        "device %04x:%04x:%04x\n",
-                                        sdkp->disk->disk_name, sector,
-                                        vid, pid, rev);
-                        us->use_last_sector_hacks = -1;
-                }
+                us->use_last_sector_hacks = 0;
 
         } else {
                 /* The command failed.  Allow up to 3 retries in case this
@@ -599,14 +577,6 @@ static void last_sector_hacks(struct us_data *us, struct scsi_cmnd *srb)
                 srb->result = SAM_STAT_CHECK_CONDITION;
                 memcpy(srb->sense_buffer, record_not_found,
                                 sizeof(record_not_found));
-
-                /* In theory we might want to issue a WARN() here if the
-                 * capacity is even, since it could indicate the device
-                 * has the READ CAPACITY bug _and_ the real capacity is
-                 * odd.  But it could also indicate that the device
-                 * simply can't access its last sector, a failure mode
-                 * which is surprisingly common.  So no warning.
-                 */
         }
 
  done:
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 69269f739563..50dc33a6065b 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1214,7 +1214,7 @@ UNUSUAL_DEV(  0x07c4, 0xa400, 0x0000, 0xffff,
                 "Datafab",
                 "KECF-USB",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_FIX_INQUIRY ),
+                US_FL_FIX_INQUIRY | US_FL_FIX_CAPACITY ),
 
 /* Reported by Rauch Wolke <rauchwolke@gmx.net> */
 UNUSUAL_DEV(  0x07c4, 0xa4a5, 0x0000, 0xffff,
@@ -1354,21 +1354,6 @@ UNUSUAL_DEV( 0x0a17, 0x0004, 0x1000, 0x1000,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY ),
 
-
-/* Submitted by Per Winkvist <per.winkvist@uk.com> */
-UNUSUAL_DEV( 0x0a17, 0x006, 0x0000, 0xffff,
-                "Pentax",
-                "Optio S/S4",
-                US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_FIX_INQUIRY ),
-
-/* Reported by Jaak Ristioja <Ristioja@gmail.com> */
-UNUSUAL_DEV( 0x0a17, 0x006e, 0x0100, 0x0100,
-                "Pentax",
-                "K10D",
-                US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_FIX_CAPACITY ),
-
 /* These are virtual windows driver CDs, which the zd1211rw driver
  * automatically converts into WLAN devices. */
 UNUSUAL_DEV( 0x0ace, 0x2011, 0x0101, 0x0101,
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index f0267706cb45..bf0af660df8a 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1054,9 +1054,10 @@ config FB_RIVA_BACKLIGHT
 
 config FB_I810
         tristate "Intel 810/815 support (EXPERIMENTAL)"
-        depends on FB && EXPERIMENTAL && PCI && X86_32
+        depends on EXPERIMENTAL && PCI && X86_32
         select AGP
         select AGP_INTEL
+        select FB
         select FB_MODE_HELPERS
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
@@ -1119,7 +1120,8 @@ config FB_CARILLO_RANCH
 
 config FB_INTEL
         tristate "Intel 830M/845G/852GM/855GM/865G/915G/945G/945GM/965G/965GM support (EXPERIMENTAL)"
-        depends on FB && EXPERIMENTAL && PCI && X86
+        depends on EXPERIMENTAL && PCI && X86
+        select FB
         select AGP
         select AGP_INTEL
         select FB_MODE_HELPERS
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index db16112cf197..e6e299feb51b 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1475,7 +1475,7 @@ static int aty128fb_set_par(struct fb_info *info)
         aty128_set_pll(&par->pll, par);
         aty128_set_fifo(&par->fifo_reg, par);
 
-        config = aty_ld_le32(CONFIG_CNTL) & ~3;
+        config = aty_ld_le32(CNFG_CNTL) & ~3;
 
 #if defined(__BIG_ENDIAN)
         if (par->crtc.bpp == 32)
@@ -1484,7 +1484,7 @@ static int aty128fb_set_par(struct fb_info *info)
                 config |= 1;    /* make aperture do 16 bit swapping */
 #endif
 
-        aty_st_le32(CONFIG_CNTL, config);
+        aty_st_le32(CNFG_CNTL, config);
         aty_st_8(CRTC_EXT_CNTL + 1, 0); /* turn the video back on */
 
         info->fix.line_length = (par->crtc.vxres * par->crtc.bpp) >> 3;
@@ -1875,7 +1875,7 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
         u32 dac;
 
         /* Get the chip revision */
-        chip_rev = (aty_ld_le32(CONFIG_CNTL) >> 16) & 0x1F;
+        chip_rev = (aty_ld_le32(CNFG_CNTL) >> 16) & 0x1F;
 
         strcpy(video_card, "Rage128 XX ");
         video_card[8] = ent->device >> 8;
@@ -2057,7 +2057,7 @@ static int __devinit aty128_probe(struct pci_dev *pdev, const struct pci_device_
 
         /* Grab memory size from the card */
         // How does this relate to the resource length from the PCI hardware?
-        par->vram_size = aty_ld_le32(CONFIG_MEMSIZE) & 0x03FFFFFF;
+        par->vram_size = aty_ld_le32(CNFG_MEMSIZE) & 0x03FFFFFF;
 
         /* Virtualize the framebuffer */
         info->screen_base = ioremap(fb_addr, par->vram_size);
@@ -2374,6 +2374,8 @@ static void aty128_set_suspend(struct aty128fb_par *par, int suspend)
         /* Set the chip into the appropriate suspend mode (we use D2,
          * D3 would require a complete re-initialisation of the chip,
          * including PCI config registers, clocks, AGP configuration, ...)
+         *
+         * For resume, the core will have already brought us back to D0
          */
         if (suspend) {
                 /* Make sure CRTC2 is reset. Remove that the day we decide to
@@ -2391,17 +2393,9 @@ static void aty128_set_suspend(struct aty128fb_par *par, int suspend)
                 aty_st_le32(BUS_CNTL1, 0x00000010);
                 aty_st_le32(MEM_POWER_MISC, 0x0c830000);
                 mdelay(100);
-                pci_read_config_word(pdev, par->pm_reg+PCI_PM_CTRL, &pwr_command);
+
                 /* Switch PCI power management to D2 */
-                pci_write_config_word(pdev, par->pm_reg+PCI_PM_CTRL,
-                        (pwr_command & ~PCI_PM_CTRL_STATE_MASK) | 2);
-                pci_read_config_word(pdev, par->pm_reg+PCI_PM_CTRL, &pwr_command);
-        } else {
-                /* Switch back PCI power management to D0 */
-                mdelay(100);
-                pci_write_config_word(pdev, par->pm_reg+PCI_PM_CTRL, 0);
-                pci_read_config_word(pdev, par->pm_reg+PCI_PM_CTRL, &pwr_command);
-                mdelay(100);
+                pci_set_power_state(pdev, PCI_D2);
         }
 }
 
@@ -2410,6 +2404,12 @@ static int aty128_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         struct fb_info *info = pci_get_drvdata(pdev);
         struct aty128fb_par *par = info->par;
 
+        /* Because we may change PCI D state ourselves, we need to
+         * first save the config space content so the core can
+         * restore it properly on resume.
+         */
+        pci_save_state(pdev);
+
         /* We don't do anything but D2, for now we return 0, but
          * we may want to change that. How do we know if the BIOS
          * can properly take care of D3 ? Also, with swsusp, we
@@ -2476,6 +2476,11 @@ static int aty128_do_resume(struct pci_dev *pdev)
         if (pdev->dev.power.power_state.event == PM_EVENT_ON)
                 return 0;
 
+        /* PCI state will have been restored by the core, so
+         * we should be in D0 now with our config space fully
+         * restored
+         */
+
         /* Wakeup chip */
         aty128_set_suspend(par, 0);
         par->asleep = 0;
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index cc6b470073da..1207c208a30b 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -135,7 +135,7 @@
 #if defined(CONFIG_PM) || defined(CONFIG_PMAC_BACKLIGHT) || \
 defined (CONFIG_FB_ATY_GENERIC_LCD) || defined(CONFIG_FB_ATY_BACKLIGHT)
 static const u32 lt_lcd_regs[] = {
-        CONFIG_PANEL_LG,
+        CNFG_PANEL_LG,
         LCD_GEN_CNTL_LG,
         DSTN_CONTROL_LG,
         HFB_PITCH_ADDR_LG,
@@ -446,7 +446,7 @@ static int __devinit correct_chipset(struct atyfb_par *par)
         par->pll_limits.ecp_max = aty_chips[i].ecp_max;
         par->features = aty_chips[i].features;
 
-        chip_id = aty_ld_le32(CONFIG_CHIP_ID, par);
+        chip_id = aty_ld_le32(CNFG_CHIP_ID, par);
         type = chip_id & CFG_CHIP_TYPE;
         rev = (chip_id & CFG_CHIP_REV) >> 24;
 
@@ -629,7 +629,7 @@ static void aty_get_crtc(const struct atyfb_par *par, struct crtc *crtc)
                     crtc->lcd_index = aty_ld_le32(LCD_INDEX, par);
                     aty_st_le32(LCD_INDEX, crtc->lcd_index, par);
                 }
-                crtc->lcd_config_panel = aty_ld_lcd(CONFIG_PANEL, par);
+                crtc->lcd_config_panel = aty_ld_lcd(CNFG_PANEL, par);
                 crtc->lcd_gen_cntl = aty_ld_lcd(LCD_GEN_CNTL, par);
 
 
@@ -676,7 +676,7 @@ static void aty_set_crtc(const struct atyfb_par *par, const struct crtc *crtc)
                 aty_st_le32(CRTC_GEN_CNTL, crtc->gen_cntl & ~(CRTC_EXT_DISP_EN | CRTC_EN), par);
 
                 /* update non-shadow registers first */
-                aty_st_lcd(CONFIG_PANEL, crtc->lcd_config_panel, par);
+                aty_st_lcd(CNFG_PANEL, crtc->lcd_config_panel, par);
                 aty_st_lcd(LCD_GEN_CNTL, crtc->lcd_gen_cntl &
                         ~(CRTC_RW_SELECT | SHADOW_EN | SHADOW_RW_EN), par);
 
@@ -858,7 +858,7 @@ static int aty_var_to_crtc(const struct fb_info *info,
                 if (!M64_HAS(MOBIL_BUS))
                         crtc->lcd_index |= CRTC2_DISPLAY_DIS;
 
-                crtc->lcd_config_panel = aty_ld_lcd(CONFIG_PANEL, par) | 0x4000;
+                crtc->lcd_config_panel = aty_ld_lcd(CNFG_PANEL, par) | 0x4000;
                 crtc->lcd_gen_cntl = aty_ld_lcd(LCD_GEN_CNTL, par) & ~CRTC_RW_SELECT;
 
                 crtc->lcd_gen_cntl &=
@@ -1978,7 +1978,7 @@ static int aty_power_mgmt(int sleep, struct atyfb_par *par)
 
         return timeout ? 0 : -EIO;
 }
-#endif
+#endif /* CONFIG_PPC_PMAC */
 
 static int atyfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 {
@@ -2002,9 +2002,15 @@ static int atyfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         par->asleep = 1;
         par->lock_blank = 1;
 
+        /* Because we may change PCI D state ourselves, we need to
+         * first save the config space content so the core can
+         * restore it properly on resume.
+         */
+        pci_save_state(pdev);
+
 #ifdef CONFIG_PPC_PMAC
         /* Set chip to "suspend" mode */
-        if (aty_power_mgmt(1, par)) {
+        if (machine_is(powermac) && aty_power_mgmt(1, par)) {
                 par->asleep = 0;
                 par->lock_blank = 0;
                 atyfb_blank(FB_BLANK_UNBLANK, info);
@@ -2047,11 +2053,15 @@ static int atyfb_pci_resume(struct pci_dev *pdev)
 
         acquire_console_sem();
 
+        /* PCI state will have been restored by the core, so
+         * we should be in D0 now with our config space fully
+         * restored
+         */
+
 #ifdef CONFIG_PPC_PMAC
-        if (pdev->dev.power.power_state.event == 2)
+        if (machine_is(powermac) &&
+            pdev->dev.power.power_state.event == PM_EVENT_SUSPEND)
                 aty_power_mgmt(0, par);
-#else
-        pci_set_power_state(pdev, PCI_D0);
 #endif
 
         aty_resume_chip(info);
@@ -2254,7 +2264,7 @@ static int __devinit aty_init(struct fb_info *info)
         if (!M64_HAS(INTEGRATED)) {
                 u32 stat0;
                 u8 dac_type, dac_subtype, clk_type;
-                stat0 = aty_ld_le32(CONFIG_STAT0, par);
+                stat0 = aty_ld_le32(CNFG_STAT0, par);
                 par->bus_type = (stat0 >> 0) & 0x07;
                 par->ram_type = (stat0 >> 3) & 0x07;
                 ramname = aty_gx_ram[par->ram_type];
@@ -2324,7 +2334,7 @@ static int __devinit aty_init(struct fb_info *info)
                 par->dac_ops = &aty_dac_ct;
                 par->pll_ops = &aty_pll_ct;
                 par->bus_type = PCI;
-                par->ram_type = (aty_ld_le32(CONFIG_STAT0, par) & 0x07);
+                par->ram_type = (aty_ld_le32(CNFG_STAT0, par) & 0x07);
                 ramname = aty_ct_ram[par->ram_type];
                 /* for many chips, the mclk is 67 MHz for SDRAM, 63 MHz otherwise */
                 if (par->pll_limits.mclk == 67 && par->ram_type < SDRAM)
@@ -2433,7 +2443,7 @@ static int __devinit aty_init(struct fb_info *info)
                 }
 
         if (M64_HAS(MAGIC_VRAM_SIZE)) {
-                if (aty_ld_le32(CONFIG_STAT1, par) & 0x40000000)
+                if (aty_ld_le32(CNFG_STAT1, par) & 0x40000000)
                         info->fix.smem_len += 0x400000;
         }
 
@@ -2946,7 +2956,7 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
                  * Fix PROMs idea of MEM_CNTL settings...
                  */
                 mem = aty_ld_le32(MEM_CNTL, par);
-                chip_id = aty_ld_le32(CONFIG_CHIP_ID, par);
+                chip_id = aty_ld_le32(CNFG_CHIP_ID, par);
                 if (((chip_id & CFG_CHIP_TYPE) == VT_CHIP_ID) && !((chip_id >> 24) & 1)) {
                         switch (mem & 0x0f) {
                         case 3:
@@ -2964,7 +2974,7 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
                         default:
                                 break;
                         }
-                        if ((aty_ld_le32(CONFIG_STAT0, par) & 7) >= SDRAM)
+                        if ((aty_ld_le32(CNFG_STAT0, par) & 7) >= SDRAM)
                                 mem &= ~(0x00700000);
                 }
                 mem &= ~(0xcf80e000);   /* Turn off all undocumented bits. */
@@ -3572,7 +3582,7 @@ static int __init atyfb_atari_probe(void)
                 }
 
                 /* Fake pci_id for correct_chipset() */
-                switch (aty_ld_le32(CONFIG_CHIP_ID, par) & CFG_CHIP_TYPE) {
+                switch (aty_ld_le32(CNFG_CHIP_ID, par) & CFG_CHIP_TYPE) {
                 case 0x00d7:
                         par->pci_id = PCI_CHIP_MACH64GX;
                         break;
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index d0f1a7fc2c9d..16bb7e3c0310 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -1936,8 +1936,8 @@ static void fixup_memory_mappings(struct radeonfb_info *rinfo)
         OUTREG(CRTC_GEN_CNTL, save_crtc_gen_cntl | CRTC_DISP_REQ_EN_B);
         mdelay(100);
 
-        aper_base = INREG(CONFIG_APER_0_BASE);
-        aper_size = INREG(CONFIG_APER_SIZE);
+        aper_base = INREG(CNFG_APER_0_BASE);
+        aper_size = INREG(CNFG_APER_SIZE);
 
 #ifdef SET_MC_FB_FROM_APERTURE
         /* Set framebuffer to be at the same address as set in PCI BAR */
@@ -2024,11 +2024,11 @@ static void radeon_identify_vram(struct radeonfb_info *rinfo)
                      ~CRTC_H_CUTOFF_ACTIVE_EN);
           }
         } else {
-          tmp = INREG(CONFIG_MEMSIZE);
+          tmp = INREG(CNFG_MEMSIZE);
         }
 
         /* mem size is bits [28:0], mask off the rest */
-        rinfo->video_ram = tmp & CONFIG_MEMSIZE_MASK;
+        rinfo->video_ram = tmp & CNFG_MEMSIZE_MASK;
 
         /*
          * Hack to get around some busted production M6's
@@ -2228,7 +2228,7 @@ static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
          */
         rinfo->errata = 0;
         if (rinfo->family == CHIP_FAMILY_R300 &&
-            (INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK)
+            (INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK)
             == CFG_ATI_REV_A11)
                 rinfo->errata |= CHIP_ERRATA_R300_CG;
 
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index 675abdafc2d8..ca5f0dc28546 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -333,7 +333,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
         if (!rinfo->has_CRTC2) {
                 tmp = INPLL(pllSCLK_CNTL);
 
-                if ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) > CFG_ATI_REV_A13)
+                if ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) > CFG_ATI_REV_A13)
                     tmp &= ~(SCLK_CNTL__FORCE_CP        | SCLK_CNTL__FORCE_RB);
                 tmp &= ~(SCLK_CNTL__FORCE_HDP           | SCLK_CNTL__FORCE_DISP1 |
                          SCLK_CNTL__FORCE_TOP           | SCLK_CNTL__FORCE_SE   |
@@ -468,9 +468,9 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
 
         /*RAGE_6::A11 A12 A12N1 A13, RV250::A11 A12, R300*/
         if ((rinfo->family == CHIP_FAMILY_RV250 &&
-             ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) ||
+             ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) ||
             ((rinfo->family == CHIP_FAMILY_RV100) &&
-             ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) <= CFG_ATI_REV_A13))) {
+             ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) <= CFG_ATI_REV_A13))) {
                 tmp |= SCLK_CNTL__FORCE_CP;
                 tmp |= SCLK_CNTL__FORCE_VIP;
         }
@@ -486,7 +486,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
                 /* RV200::A11 A12 RV250::A11 A12 */
                 if (((rinfo->family == CHIP_FAMILY_RV200) ||
                      (rinfo->family == CHIP_FAMILY_RV250)) &&
-                    ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13))
+                    ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13))
                         tmp |= SCLK_MORE_CNTL__FORCEON;
 
                 OUTPLL(pllSCLK_MORE_CNTL, tmp);
@@ -497,7 +497,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
         /* RV200::A11 A12, RV250::A11 A12 */
         if (((rinfo->family == CHIP_FAMILY_RV200) ||
              (rinfo->family == CHIP_FAMILY_RV250)) &&
-            ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) {
+            ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) {
                 tmp = INPLL(pllPLL_PWRMGT_CNTL);
                 tmp |= PLL_PWRMGT_CNTL__TCL_BYPASS_DISABLE;
                 OUTPLL(pllPLL_PWRMGT_CNTL, tmp);
@@ -702,7 +702,7 @@ static void radeon_pm_restore_regs(struct radeonfb_info *rinfo)
         OUTREG(DISPLAY_BASE_ADDR, rinfo->save_regs[31]);
         OUTREG(MC_AGP_LOCATION, rinfo->save_regs[32]);
         OUTREG(CRTC2_DISPLAY_BASE_ADDR, rinfo->save_regs[33]);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
 
         OUTREG(DISP_MISC_CNTL, rinfo->save_regs[9]);
         OUTREG(DISP_PWR_MAN, rinfo->save_regs[10]);
@@ -1723,7 +1723,7 @@ static void radeon_reinitialize_M10(struct radeonfb_info *rinfo)
         OUTREG(CRTC2_DISPLAY_BASE_ADDR, rinfo->save_regs[33]);
         OUTREG(MC_FB_LOCATION, rinfo->save_regs[30]);
         OUTREG(OV0_BASE_ADDR, rinfo->save_regs[80]);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
         OUTREG(BUS_CNTL, rinfo->save_regs[36]);
         OUTREG(BUS_CNTL1, rinfo->save_regs[14]);
         OUTREG(MPP_TB_CONFIG, rinfo->save_regs[37]);
@@ -1961,7 +1961,7 @@ static void radeon_pm_m9p_reconfigure_mc(struct radeonfb_info *rinfo)
         OUTMC(rinfo, ixMC_CHP_IO_CNTL_B1, rinfo->save_regs[68] /*0x141555ff*/);
         OUTMC(rinfo, ixMC_IMP_CNTL_0, rinfo->save_regs[71] /*0x00009249*/);
         OUTREG(MC_IND_INDEX, 0);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
 
         mdelay(20);
 }
@@ -2361,7 +2361,7 @@ static void radeon_reinitialize_QW(struct radeonfb_info *rinfo)
         OUTMC(rinfo, ixMC_IMP_CNTL_0, 0x00009249);
         OUTREG(MC_IND_INDEX, 0);
 
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
 
         radeon_pm_full_reset_sdram(rinfo);
 
@@ -2509,9 +2509,7 @@ static void radeon_reinitialize_QW(struct radeonfb_info *rinfo)
 
 static void radeon_set_suspend(struct radeonfb_info *rinfo, int suspend)
 {
-        u16 pwr_cmd;
         u32 tmp;
-        int i;
 
         if (!rinfo->pm_reg)
                 return;
@@ -2557,32 +2555,14 @@ static void radeon_set_suspend(struct radeonfb_info *rinfo, int suspend)
                         }
                 }
 
-                for (i = 0; i < 64; ++i)
-                        pci_read_config_dword(rinfo->pdev, i * 4,
-                                              &rinfo->cfg_save[i]);
-
                 /* Switch PCI power management to D2. */
                 pci_disable_device(rinfo->pdev);
-                for (;;) {
-                        pci_read_config_word(
-                                rinfo->pdev, rinfo->pm_reg+PCI_PM_CTRL,
-                                &pwr_cmd);
-                        if (pwr_cmd & 2)
-                                break;                  
-                        pci_write_config_word(
-                                rinfo->pdev, rinfo->pm_reg+PCI_PM_CTRL,
-                                (pwr_cmd & ~PCI_PM_CTRL_STATE_MASK) | 2);
-                        mdelay(500);
-                }
+                pci_save_state(rinfo->pdev);
+                pci_set_power_state(rinfo->pdev, PCI_D2);
         } else {
                 printk(KERN_DEBUG "radeonfb (%s): switching to D0 state...\n",
                        pci_name(rinfo->pdev));
 
-                /* Switch back PCI powermanagment to D0 */
-                mdelay(200);
-                pci_write_config_word(rinfo->pdev, rinfo->pm_reg+PCI_PM_CTRL, 0);
-                mdelay(500);
-
                 if (rinfo->family <= CHIP_FAMILY_RV250) {
                         /* Reset the SDRAM controller  */
                         radeon_pm_full_reset_sdram(rinfo);
@@ -2598,37 +2578,10 @@ static void radeon_set_suspend(struct radeonfb_info *rinfo, int suspend)
         }
 }
 
-static int radeon_restore_pci_cfg(struct radeonfb_info *rinfo)
-{
-        int i;
-        static u32 radeon_cfg_after_resume[64];
-
-        for (i = 0; i < 64; ++i)
-                pci_read_config_dword(rinfo->pdev, i * 4,
-                                      &radeon_cfg_after_resume[i]);
-
-        if (radeon_cfg_after_resume[PCI_BASE_ADDRESS_0/4]
-            == rinfo->cfg_save[PCI_BASE_ADDRESS_0/4])
-                return 0;       /* assume everything is ok */
-
-        for (i = PCI_BASE_ADDRESS_0/4; i < 64; ++i) {
-                if (radeon_cfg_after_resume[i] != rinfo->cfg_save[i])
-                        pci_write_config_dword(rinfo->pdev, i * 4,
-                                               rinfo->cfg_save[i]);
-        }
-        pci_write_config_word(rinfo->pdev, PCI_CACHE_LINE_SIZE,
-                              rinfo->cfg_save[PCI_CACHE_LINE_SIZE/4]);
-        pci_write_config_word(rinfo->pdev, PCI_COMMAND,
-                              rinfo->cfg_save[PCI_COMMAND/4]);
-        return 1;
-}
-
-
 int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
 {
         struct fb_info *info = pci_get_drvdata(pdev);
         struct radeonfb_info *rinfo = info->par;
-        int i;
 
         if (mesg.event == pdev->dev.power.power_state.event)
                 return 0;
@@ -2674,6 +2627,11 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
         pmac_suspend_agp_for_card(pdev);
 #endif /* CONFIG_PPC_PMAC */
 
+        /* It's unclear whether or when the generic code will do that, so let's
+         * do it ourselves. We save state before we do any power management
+         */
+        pci_save_state(pdev);
+
         /* If we support wakeup from poweroff, we save all regs we can including cfg
          * space
          */
@@ -2698,9 +2656,6 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
                         mdelay(20);
                         OUTREG(LVDS_GEN_CNTL, INREG(LVDS_GEN_CNTL) & ~(LVDS_DIGON));
                 }
-                // FIXME: Use PCI layer
-                for (i = 0; i < 64; ++i)
-                        pci_read_config_dword(pdev, i * 4, &rinfo->cfg_save[i]);
                 pci_disable_device(pdev);
         }
         /* If we support D2, we go to it (should be fixed later with a flag forcing
@@ -2717,6 +2672,13 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
         return 0;
 }
 
+static int radeon_check_power_loss(struct radeonfb_info *rinfo)
+{
+        return rinfo->save_regs[4] != INPLL(CLK_PIN_CNTL) ||
+               rinfo->save_regs[2] != INPLL(MCLK_CNTL) ||
+               rinfo->save_regs[3] != INPLL(SCLK_CNTL);
+}
+
 int radeonfb_pci_resume(struct pci_dev *pdev)
 {
         struct fb_info *info = pci_get_drvdata(pdev);
@@ -2735,20 +2697,13 @@ int radeonfb_pci_resume(struct pci_dev *pdev)
         printk(KERN_DEBUG "radeonfb (%s): resuming from state: %d...\n",
                pci_name(pdev), pdev->dev.power.power_state.event);
 
-
-        if (pci_enable_device(pdev)) {
-                rc = -ENODEV;
-                printk(KERN_ERR "radeonfb (%s): can't enable PCI device !\n",
-                       pci_name(pdev));
-                goto bail;
-        }
-        pci_set_master(pdev);
-
+        /* PCI state will have been restored by the core, so
+         * we should be in D0 now with our config space fully
+         * restored
+         */
         if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) {
-                /* Wakeup chip. Check from config space if we were powered off
-                 * (todo: additionally, check CLK_PIN_CNTL too)
-                 */
-                if ((rinfo->pm_mode & radeon_pm_off) && radeon_restore_pci_cfg(rinfo)) {
+                /* Wakeup chip */
+                if ((rinfo->pm_mode & radeon_pm_off) && radeon_check_power_loss(rinfo)) {
                         if (rinfo->reinit_func != NULL)
                                 rinfo->reinit_func(rinfo);
                         else {
diff --git a/drivers/video/aty/radeonfb.h b/drivers/video/aty/radeonfb.h
index 3ea1b00fdd22..7351e66c7f54 100644
--- a/drivers/video/aty/radeonfb.h
+++ b/drivers/video/aty/radeonfb.h
@@ -361,8 +361,6 @@ struct radeonfb_info {
 #ifdef CONFIG_FB_RADEON_I2C
         struct radeon_i2c_chan  i2c[4];
 #endif
-
-        u32                     cfg_save[64];
 };
 
 
diff --git a/drivers/video/backlight/Makefile b/drivers/video/backlight/Makefile
index 363b3cb2f01b..63d759498165 100644
--- a/drivers/video/backlight/Makefile
+++ b/drivers/video/backlight/Makefile
@@ -18,7 +18,7 @@ obj-$(CONFIG_BACKLIGHT_OMAP1)	+= omap1_bl.o
 obj-$(CONFIG_BACKLIGHT_PROGEAR) += progear_bl.o
 obj-$(CONFIG_BACKLIGHT_CARILLO_RANCH) += cr_bllcd.o
 obj-$(CONFIG_BACKLIGHT_PWM)     += pwm_bl.o
-obj-$(CONFIG_BACKLIGHT_DA903X)  += da903x.o
+obj-$(CONFIG_BACKLIGHT_DA903X)  += da903x_bl.o
 obj-$(CONFIG_BACKLIGHT_MBP_NVIDIA) += mbp_nvidia_bl.o
 obj-$(CONFIG_BACKLIGHT_TOSA)    += tosa_bl.o
 obj-$(CONFIG_BACKLIGHT_SAHARA)  += kb3886_bl.o
diff --git a/drivers/video/backlight/da903x.c b/drivers/video/backlight/da903x_bl.c
index 93bb4340cc64..93bb4340cc64 100644
--- a/drivers/video/backlight/da903x.c
+++ b/drivers/video/backlight/da903x_bl.c
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
index 91b78e691505..f53b9f1d6aba 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbcmap.c
@@ -250,10 +250,6 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
         int rc, size = cmap->len * sizeof(u16);
         struct fb_cmap umap;
 
-        if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
-                                !info->fbops->fb_setcmap))
-                return -EINVAL;
-
         memset(&umap, 0, sizeof(struct fb_cmap));
         rc = fb_alloc_cmap(&umap, cmap->len, cmap->transp != NULL);
         if (rc)
@@ -262,11 +258,23 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
             copy_from_user(umap.green, cmap->green, size) ||
             copy_from_user(umap.blue, cmap->blue, size) ||
             (cmap->transp && copy_from_user(umap.transp, cmap->transp, size))) {
-                fb_dealloc_cmap(&umap);
-                return -EFAULT;
+                rc = -EFAULT;
+                goto out;
         }
         umap.start = cmap->start;
+        if (!lock_fb_info(info)) {
+                rc = -ENODEV;
+                goto out;
+        }
+        if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
+                                !info->fbops->fb_setcmap)) {
+                rc = -EINVAL;
+                goto out1;
+        }
         rc = fb_set_cmap(&umap, info);
+out1:
+        unlock_fb_info(info);
+out:
         fb_dealloc_cmap(&umap);
         return rc;
 }
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 756efeb91abc..cfd9dce1ce0b 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1013,132 +1013,139 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
         struct fb_var_screeninfo var;
         struct fb_fix_screeninfo fix;
         struct fb_con2fbmap con2fb;
+        struct fb_cmap cmap_from;
         struct fb_cmap_user cmap;
         struct fb_event event;
         void __user *argp = (void __user *)arg;
         long ret = 0;
 
-        fb = info->fbops;
-        if (!fb)
-                return -ENODEV;
-
         switch (cmd) {
         case FBIOGET_VSCREENINFO:
-                ret = copy_to_user(argp, &info->var,
-                                    sizeof(var)) ? -EFAULT : 0;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                var = info->var;
+                unlock_fb_info(info);
+
+                ret = copy_to_user(argp, &var, sizeof(var)) ? -EFAULT : 0;
                 break;
         case FBIOPUT_VSCREENINFO:
-                if (copy_from_user(&var, argp, sizeof(var))) {
-                        ret =  -EFAULT;
-                        break;
-                }
+                if (copy_from_user(&var, argp, sizeof(var)))
+                        return -EFAULT;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
                 acquire_console_sem();
                 info->flags |= FBINFO_MISC_USEREVENT;
                 ret = fb_set_var(info, &var);
                 info->flags &= ~FBINFO_MISC_USEREVENT;
                 release_console_sem();
-                if (ret == 0 && copy_to_user(argp, &var, sizeof(var)))
+                unlock_fb_info(info);
+                if (!ret && copy_to_user(argp, &var, sizeof(var)))
                         ret = -EFAULT;
                 break;
         case FBIOGET_FSCREENINFO:
-                ret = copy_to_user(argp, &info->fix,
-                                    sizeof(fix)) ? -EFAULT : 0;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                fix = info->fix;
+                unlock_fb_info(info);
+
+                ret = copy_to_user(argp, &fix, sizeof(fix)) ? -EFAULT : 0;
                 break;
         case FBIOPUTCMAP:
                 if (copy_from_user(&cmap, argp, sizeof(cmap)))
-                        ret = -EFAULT;
-                else
-                        ret = fb_set_user_cmap(&cmap, info);
+                        return -EFAULT;
+                ret = fb_set_user_cmap(&cmap, info);
                 break;
         case FBIOGETCMAP:
                 if (copy_from_user(&cmap, argp, sizeof(cmap)))
-                        ret = -EFAULT;
-                else
-                        ret = fb_cmap_to_user(&info->cmap, &cmap);
+                        return -EFAULT;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                cmap_from = info->cmap;
+                unlock_fb_info(info);
+                ret = fb_cmap_to_user(&cmap_from, &cmap);
                 break;
         case FBIOPAN_DISPLAY:
-                if (copy_from_user(&var, argp, sizeof(var))) {
-                        ret = -EFAULT;
-                        break;
-                }
+                if (copy_from_user(&var, argp, sizeof(var)))
+                        return -EFAULT;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
                 acquire_console_sem();
                 ret = fb_pan_display(info, &var);
                 release_console_sem();
+                unlock_fb_info(info);
                 if (ret == 0 && copy_to_user(argp, &var, sizeof(var)))
-                        ret = -EFAULT;
+                        return -EFAULT;
                 break;
         case FBIO_CURSOR:
                 ret = -EINVAL;
                 break;
         case FBIOGET_CON2FBMAP:
                 if (copy_from_user(&con2fb, argp, sizeof(con2fb)))
-                        ret = -EFAULT;
-                else if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
-                        ret = -EINVAL;
-                else {
-                        con2fb.framebuffer = -1;
-                        event.info = info;
-                        event.data = &con2fb;
-                        fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP,
-                                                                &event);
-                        ret = copy_to_user(argp, &con2fb,
-                                    sizeof(con2fb)) ? -EFAULT : 0;
-                }
+                        return -EFAULT;
+                if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
+                        return -EINVAL;
+                con2fb.framebuffer = -1;
+                event.data = &con2fb;
+
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                event.info = info;
+                fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP, &event);
+                unlock_fb_info(info);
+
+                ret = copy_to_user(argp, &con2fb, sizeof(con2fb)) ? -EFAULT : 0;
                 break;
         case FBIOPUT_CON2FBMAP:
-                if (copy_from_user(&con2fb, argp, sizeof(con2fb))) {
-                        ret = -EFAULT;
-                        break;
-                }
-                if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES) {
-                        ret = -EINVAL;
-                        break;
-                }
-                if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX) {
-                        ret = -EINVAL;
-                        break;
-                }
+                if (copy_from_user(&con2fb, argp, sizeof(con2fb)))
+                        return -EFAULT;
+                if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
+                        return -EINVAL;
+                if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
+                        return -EINVAL;
                 if (!registered_fb[con2fb.framebuffer])
                         request_module("fb%d", con2fb.framebuffer);
                 if (!registered_fb[con2fb.framebuffer]) {
                         ret = -EINVAL;
                         break;
                 }
-                event.info = info;
                 event.data = &con2fb;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                event.info = info;
                 ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP,
                                               &event);
+                unlock_fb_info(info);
                 break;
         case FBIOBLANK:
+                if (!lock_fb_info(info))
+                        return -ENODEV;
                 acquire_console_sem();
                 info->flags |= FBINFO_MISC_USEREVENT;
                 ret = fb_blank(info, arg);
                 info->flags &= ~FBINFO_MISC_USEREVENT;
                 release_console_sem();
-                break;;
+                unlock_fb_info(info);
+                break;
         default:
-                if (fb->fb_ioctl == NULL)
-                        ret = -ENOTTY;
-                else
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                fb = info->fbops;
+                if (fb->fb_ioctl)
                         ret = fb->fb_ioctl(info, cmd, arg);
+                else
+                        ret = -ENOTTY;
+                unlock_fb_info(info);
         }
         return ret;
 }
 
 static long fb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-__acquires(&info->lock)
-__releases(&info->lock)
 {
         struct inode *inode = file->f_path.dentry->d_inode;
         int fbidx = iminor(inode);
-        struct fb_info *info;
-        long ret;
+        struct fb_info *info = registered_fb[fbidx];
 
-        info = registered_fb[fbidx];
-        mutex_lock(&info->lock);
-        ret = do_fb_ioctl(info, cmd, arg);
-        mutex_unlock(&info->lock);
-        return ret;
+        return do_fb_ioctl(info, cmd, arg);
 }
 
 #ifdef CONFIG_COMPAT
@@ -1257,8 +1264,6 @@ static int fb_get_fscreeninfo(struct fb_info *info, unsigned int cmd,
 
 static long fb_compat_ioctl(struct file *file, unsigned int cmd,
                             unsigned long arg)
-__acquires(&info->lock)
-__releases(&info->lock)
 {
         struct inode *inode = file->f_path.dentry->d_inode;
         int fbidx = iminor(inode);
@@ -1266,7 +1271,6 @@ __releases(&info->lock)
         struct fb_ops *fb = info->fbops;
         long ret = -ENOIOCTLCMD;
 
-        mutex_lock(&info->lock);
         switch(cmd) {
         case FBIOGET_VSCREENINFO:
         case FBIOPUT_VSCREENINFO:
@@ -1292,7 +1296,6 @@ __releases(&info->lock)
                         ret = fb->fb_compat_ioctl(info, cmd, arg);
                 break;
         }
-        mutex_unlock(&info->lock);
         return ret;
 }
 #endif
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index e3ff2b9e602f..33b7235f853b 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1208,9 +1208,11 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
          * check for an ELF header.  If we find one, dump the first page to
          * aid in determining what was mapped here.
          */
-        if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
+        if (FILTER(ELF_HEADERS) &&
+            vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
                 u32 __user *header = (u32 __user *) vma->vm_start;
                 u32 word;
+                mm_segment_t fs = get_fs();
                 /*
                  * Doing it this way gets the constant folded by GCC.
                  */
@@ -1223,7 +1225,15 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
                 magic.elfmag[EI_MAG1] = ELFMAG1;
                 magic.elfmag[EI_MAG2] = ELFMAG2;
                 magic.elfmag[EI_MAG3] = ELFMAG3;
-                if (get_user(word, header) == 0 && word == magic.cmp)
+                /*
+                 * Switch to the user "segment" for get_user(),
+                 * then put back what elf_core_dump() had in place.
+                 */
+                set_fs(USER_DS);
+                if (unlikely(get_user(word, header)))
+                        word = 0;
+                set_fs(fs);
+                if (word == magic.cmp)
                         return PAGE_SIZE;
         }
 
diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig
index f8fcf999ea1b..7bb3c020e570 100644
--- a/fs/btrfs/Kconfig
+++ b/fs/btrfs/Kconfig
@@ -16,3 +16,16 @@ config BTRFS_FS
           module will be called btrfs.
 
           If unsure, say N.
+
+config BTRFS_FS_POSIX_ACL
+        bool "Btrfs POSIX Access Control Lists"
+        depends on BTRFS_FS
+        select FS_POSIX_ACL
+        help
+          POSIX Access Control Lists (ACLs) support permissions for users and
+          groups beyond the owner/group/world scheme.
+
+          To learn more about Access Control Lists, visit the POSIX ACLs for
+          Linux website <http://acl.bestbits.at/>.
+
+          If you don't know what Access Control Lists are, say N
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 8e2fec05dbe0..c84ca1f5259a 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -16,11 +16,11 @@
  * Boston, MA 021110-1307, USA.
  */
 
-#include <linux/version.h>
 #include <linux/kthread.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
-# include <linux/freezer.h>
+#include <linux/freezer.h>
+#include <linux/ftrace.h>
 #include "async-thread.h"
 
 #define WORK_QUEUED_BIT 0
@@ -143,6 +143,7 @@ static int worker_loop(void *arg)
         struct btrfs_work *work;
         do {
                 spin_lock_irq(&worker->lock);
+again_locked:
                 while (!list_empty(&worker->pending)) {
                         cur = worker->pending.next;
                         work = list_entry(cur, struct btrfs_work, list);
@@ -165,14 +166,50 @@ static int worker_loop(void *arg)
                         check_idle_worker(worker);
 
                 }
-                worker->working = 0;
                 if (freezing(current)) {
+                        worker->working = 0;
+                        spin_unlock_irq(&worker->lock);
                         refrigerator();
                 } else {
-                        set_current_state(TASK_INTERRUPTIBLE);
                         spin_unlock_irq(&worker->lock);
-                        if (!kthread_should_stop())
+                        if (!kthread_should_stop()) {
+                                cpu_relax();
+                                /*
+                                 * we've dropped the lock, did someone else
+                                 * jump_in?
+                                 */
+                                smp_mb();
+                                if (!list_empty(&worker->pending))
+                                        continue;
+
+                                /*
+                                 * this short schedule allows more work to
+                                 * come in without the queue functions
+                                 * needing to go through wake_up_process()
+                                 *
+                                 * worker->working is still 1, so nobody
+                                 * is going to try and wake us up
+                                 */
+                                schedule_timeout(1);
+                                smp_mb();
+                                if (!list_empty(&worker->pending))
+                                        continue;
+
+                                /* still no more work?, sleep for real */
+                                spin_lock_irq(&worker->lock);
+                                set_current_state(TASK_INTERRUPTIBLE);
+                                if (!list_empty(&worker->pending))
+                                        goto again_locked;
+
+                                /*
+                                 * this makes sure we get a wakeup when someone
+                                 * adds something new to the queue
+                                 */
+                                worker->working = 0;
+                                spin_unlock_irq(&worker->lock);
+
                                 schedule();
+                        }
                         __set_current_state(TASK_RUNNING);
                 }
         } while (!kthread_should_stop());
@@ -350,13 +387,14 @@ int btrfs_requeue_work(struct btrfs_work *work)
 {
         struct btrfs_worker_thread *worker = work->worker;
         unsigned long flags;
+        int wake = 0;
 
         if (test_and_set_bit(WORK_QUEUED_BIT, &work->flags))
                 goto out;
 
         spin_lock_irqsave(&worker->lock, flags);
-        atomic_inc(&worker->num_pending);
         list_add_tail(&work->list, &worker->pending);
+        atomic_inc(&worker->num_pending);
 
         /* by definition we're busy, take ourselves off the idle
          * list
@@ -368,10 +406,16 @@ int btrfs_requeue_work(struct btrfs_work *work)
                                &worker->workers->worker_list);
                 spin_unlock_irqrestore(&worker->workers->lock, flags);
         }
+        if (!worker->working) {
+                wake = 1;
+                worker->working = 1;
+        }
 
         spin_unlock_irqrestore(&worker->lock, flags);
-
+        if (wake)
+                wake_up_process(worker->task);
 out:
+
         return 0;
 }
 
@@ -398,9 +442,10 @@ int btrfs_queue_worker(struct btrfs_workers *workers, struct btrfs_work *work)
         }
 
         spin_lock_irqsave(&worker->lock, flags);
+
+        list_add_tail(&work->list, &worker->pending);
         atomic_inc(&worker->num_pending);
         check_busy_worker(worker);
-        list_add_tail(&work->list, &worker->pending);
 
         /*
          * avoid calling into wake_up_process if this thread has already
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index ee848d8585d9..ab07627084f1 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -32,7 +32,6 @@
 #include <linux/swap.h>
 #include <linux/writeback.h>
 #include <linux/bit_spinlock.h>
-#include <linux/version.h>
 #include <linux/pagevec.h>
 #include "compat.h"
 #include "ctree.h"
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 9e46c0776816..35443cc4b9a9 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -54,6 +54,31 @@ struct btrfs_path *btrfs_alloc_path(void)
         return path;
 }
 
+/*
+ * set all locked nodes in the path to blocking locks.  This should
+ * be done before scheduling
+ */
+noinline void btrfs_set_path_blocking(struct btrfs_path *p)
+{
+        int i;
+        for (i = 0; i < BTRFS_MAX_LEVEL; i++) {
+                if (p->nodes[i] && p->locks[i])
+                        btrfs_set_lock_blocking(p->nodes[i]);
+        }
+}
+
+/*
+ * reset all the locked nodes in the patch to spinning locks.
+ */
+noinline void btrfs_clear_path_blocking(struct btrfs_path *p)
+{
+        int i;
+        for (i = 0; i < BTRFS_MAX_LEVEL; i++) {
+                if (p->nodes[i] && p->locks[i])
+                        btrfs_clear_lock_blocking(p->nodes[i]);
+        }
+}
+
 /* this also releases the path */
 void btrfs_free_path(struct btrfs_path *p)
 {
@@ -272,6 +297,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
         if (IS_ERR(cow))
                 return PTR_ERR(cow);
 
+        /* cow is set to blocking by btrfs_init_new_buffer */
+
         copy_extent_buffer(cow, buf, 0, 0, cow->len);
         btrfs_set_header_bytenr(cow, cow->start);
         btrfs_set_header_generation(cow, trans->transid);
@@ -388,17 +415,20 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans,
                 WARN_ON(1);
         }
 
-        spin_lock(&root->fs_info->hash_lock);
         if (btrfs_header_generation(buf) == trans->transid &&
             btrfs_header_owner(buf) == root->root_key.objectid &&
             !btrfs_header_flag(buf, BTRFS_HEADER_FLAG_WRITTEN)) {
                 *cow_ret = buf;
-                spin_unlock(&root->fs_info->hash_lock);
                 WARN_ON(prealloc_dest);
                 return 0;
         }
-        spin_unlock(&root->fs_info->hash_lock);
+
         search_start = buf->start & ~((u64)(1024 * 1024 * 1024) - 1);
+
+        if (parent)
+                btrfs_set_lock_blocking(parent);
+        btrfs_set_lock_blocking(buf);
+
         ret = __btrfs_cow_block(trans, root, buf, parent,
                                  parent_slot, cow_ret, search_start, 0,
                                  prealloc_dest);
@@ -504,6 +534,8 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
         if (parent_nritems == 1)
                 return 0;
 
+        btrfs_set_lock_blocking(parent);
+
         for (i = start_slot; i < end_slot; i++) {
                 int close = 1;
 
@@ -564,6 +596,7 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
                         search_start = last_block;
 
                 btrfs_tree_lock(cur);
+                btrfs_set_lock_blocking(cur);
                 err = __btrfs_cow_block(trans, root, cur, parent, i,
                                         &cur, search_start,
                                         min(16 * blocksize,
@@ -862,6 +895,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                 return 0;
 
         mid = path->nodes[level];
+
         WARN_ON(!path->locks[level]);
         WARN_ON(btrfs_header_generation(mid) != trans->transid);
 
@@ -884,6 +918,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                 /* promote the child to a root */
                 child = read_node_slot(root, mid, 0);
                 btrfs_tree_lock(child);
+                btrfs_set_lock_blocking(child);
                 BUG_ON(!child);
                 ret = btrfs_cow_block(trans, root, child, mid, 0, &child, 0);
                 BUG_ON(ret);
@@ -900,6 +935,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
 
                 add_root_to_dirty_list(root);
                 btrfs_tree_unlock(child);
+
                 path->locks[level] = 0;
                 path->nodes[level] = NULL;
                 clean_tree_block(trans, root, mid);
@@ -924,6 +960,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
         left = read_node_slot(root, parent, pslot - 1);
         if (left) {
                 btrfs_tree_lock(left);
+                btrfs_set_lock_blocking(left);
                 wret = btrfs_cow_block(trans, root, left,
                                        parent, pslot - 1, &left, 0);
                 if (wret) {
@@ -934,6 +971,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
         right = read_node_slot(root, parent, pslot + 1);
         if (right) {
                 btrfs_tree_lock(right);
+                btrfs_set_lock_blocking(right);
                 wret = btrfs_cow_block(trans, root, right,
                                        parent, pslot + 1, &right, 0);
                 if (wret) {
@@ -1109,6 +1147,8 @@ static noinline int push_nodes_for_insert(struct btrfs_trans_handle *trans,
                 u32 left_nr;
 
                 btrfs_tree_lock(left);
+                btrfs_set_lock_blocking(left);
+
                 left_nr = btrfs_header_nritems(left);
                 if (left_nr >= BTRFS_NODEPTRS_PER_BLOCK(root) - 1) {
                         wret = 1;
@@ -1155,7 +1195,10 @@ static noinline int push_nodes_for_insert(struct btrfs_trans_handle *trans,
          */
         if (right) {
                 u32 right_nr;
+
                 btrfs_tree_lock(right);
+                btrfs_set_lock_blocking(right);
+
                 right_nr = btrfs_header_nritems(right);
                 if (right_nr >= BTRFS_NODEPTRS_PER_BLOCK(root) - 1) {
                         wret = 1;
@@ -1210,8 +1253,7 @@ static noinline void reada_for_search(struct btrfs_root *root,
         struct btrfs_disk_key disk_key;
         u32 nritems;
         u64 search;
-        u64 lowest_read;
-        u64 highest_read;
+        u64 target;
         u64 nread = 0;
         int direction = path->reada;
         struct extent_buffer *eb;
@@ -1235,8 +1277,7 @@ static noinline void reada_for_search(struct btrfs_root *root,
                 return;
         }
 
-        highest_read = search;
-        lowest_read = search;
+        target = search;
 
         nritems = btrfs_header_nritems(node);
         nr = slot;
@@ -1256,27 +1297,80 @@ static noinline void reada_for_search(struct btrfs_root *root,
                                 break;
                 }
                 search = btrfs_node_blockptr(node, nr);
-                if ((search >= lowest_read && search <= highest_read) ||
-                    (search < lowest_read && lowest_read - search <= 16384) ||
-                    (search > highest_read && search - highest_read <= 16384)) {
+                if ((search <= target && target - search <= 65536) ||
+                    (search > target && search - target <= 65536)) {
                         readahead_tree_block(root, search, blocksize,
                                      btrfs_node_ptr_generation(node, nr));
                         nread += blocksize;
                 }
                 nscan++;
-                if (path->reada < 2 && (nread > (64 * 1024) || nscan > 32))
+                if ((nread > 65536 || nscan > 32))
                         break;
+        }
+}
 
-                if (nread > (256 * 1024) || nscan > 128)
-                        break;
+/*
+ * returns -EAGAIN if it had to drop the path, or zero if everything was in
+ * cache
+ */
+static noinline int reada_for_balance(struct btrfs_root *root,
+                                      struct btrfs_path *path, int level)
+{
+        int slot;
+        int nritems;
+        struct extent_buffer *parent;
+        struct extent_buffer *eb;
+        u64 gen;
+        u64 block1 = 0;
+        u64 block2 = 0;
+        int ret = 0;
+        int blocksize;
 
-                if (search < lowest_read)
-                        lowest_read = search;
-                if (search > highest_read)
-                        highest_read = search;
+        parent = path->nodes[level - 1];
+        if (!parent)
+                return 0;
+
+        nritems = btrfs_header_nritems(parent);
+        slot = path->slots[level];
+        blocksize = btrfs_level_size(root, level);
+
+        if (slot > 0) {
+                block1 = btrfs_node_blockptr(parent, slot - 1);
+                gen = btrfs_node_ptr_generation(parent, slot - 1);
+                eb = btrfs_find_tree_block(root, block1, blocksize);
+                if (eb && btrfs_buffer_uptodate(eb, gen))
+                        block1 = 0;
+                free_extent_buffer(eb);
+        }
+        if (slot < nritems) {
+                block2 = btrfs_node_blockptr(parent, slot + 1);
+                gen = btrfs_node_ptr_generation(parent, slot + 1);
+                eb = btrfs_find_tree_block(root, block2, blocksize);
+                if (eb && btrfs_buffer_uptodate(eb, gen))
+                        block2 = 0;
+                free_extent_buffer(eb);
+        }
+        if (block1 || block2) {
+                ret = -EAGAIN;
+                btrfs_release_path(root, path);
+                if (block1)
+                        readahead_tree_block(root, block1, blocksize, 0);
+                if (block2)
+                        readahead_tree_block(root, block2, blocksize, 0);
+
+                if (block1) {
+                        eb = read_tree_block(root, block1, blocksize, 0);
+                        free_extent_buffer(eb);
+                }
+                if (block1) {
+                        eb = read_tree_block(root, block2, blocksize, 0);
+                        free_extent_buffer(eb);
+                }
         }
+        return ret;
 }
 
+
 /*
  * when we walk down the tree, it is usually safe to unlock the higher layers
  * in the tree.  The exceptions are when our path goes through slot 0, because
@@ -1328,6 +1422,32 @@ static noinline void unlock_up(struct btrfs_path *path, int level,
 }
 
 /*
+ * This releases any locks held in the path starting at level and
+ * going all the way up to the root.
+ *
+ * btrfs_search_slot will keep the lock held on higher nodes in a few
+ * corner cases, such as COW of the block at slot zero in the node.  This
+ * ignores those rules, and it should only be called when there are no
+ * more updates to be done higher up in the tree.
+ */
+noinline void btrfs_unlock_up_safe(struct btrfs_path *path, int level)
+{
+        int i;
+
+        if (path->keep_locks || path->lowest_level)
+                return;
+
+        for (i = level; i < BTRFS_MAX_LEVEL; i++) {
+                if (!path->nodes[i])
+                        continue;
+                if (!path->locks[i])
+                        continue;
+                btrfs_tree_unlock(path->nodes[i]);
+                path->locks[i] = 0;
+        }
+}
+
+/*
  * look for key in the tree.  path is filled in with nodes along the way
  * if key is found, we return zero and you can find the item in the leaf
  * level of the path (level 0)
@@ -1387,32 +1507,30 @@ again:
                         int wret;
 
                         /* is a cow on this block not required */
-                        spin_lock(&root->fs_info->hash_lock);
                         if (btrfs_header_generation(b) == trans->transid &&
                             btrfs_header_owner(b) == root->root_key.objectid &&
                             !btrfs_header_flag(b, BTRFS_HEADER_FLAG_WRITTEN)) {
-                                spin_unlock(&root->fs_info->hash_lock);
                                 goto cow_done;
                         }
-                        spin_unlock(&root->fs_info->hash_lock);
 
                         /* ok, we have to cow, is our old prealloc the right
                          * size?
                          */
                         if (prealloc_block.objectid &&
                             prealloc_block.offset != b->len) {
+                                btrfs_release_path(root, p);
                                 btrfs_free_reserved_extent(root,
                                            prealloc_block.objectid,
                                            prealloc_block.offset);
                                 prealloc_block.objectid = 0;
+                                goto again;
                         }
 
                         /*
                          * for higher level blocks, try not to allocate blocks
                          * with the block and the parent locks held.
                          */
-                        if (level > 1 && !prealloc_block.objectid &&
-                            btrfs_path_lock_waiting(p, level)) {
+                        if (level > 0 && !prealloc_block.objectid) {
                                 u32 size = b->len;
                                 u64 hint = b->start;
 
@@ -1425,6 +1543,8 @@ again:
                                 goto again;
                         }
 
+                        btrfs_set_path_blocking(p);
+
                         wret = btrfs_cow_block(trans, root, b,
                                                p->nodes[level + 1],
                                                p->slots[level + 1],
@@ -1446,6 +1566,22 @@ cow_done:
                 if (!p->skip_locking)
                         p->locks[level] = 1;
 
+                btrfs_clear_path_blocking(p);
+
+                /*
+                 * we have a lock on b and as long as we aren't changing
+                 * the tree, there is no way to for the items in b to change.
+                 * It is safe to drop the lock on our parent before we
+                 * go through the expensive btree search on b.
+                 *
+                 * If cow is true, then we might be changing slot zero,
+                 * which may require changing the parent.  So, we can't
+                 * drop the lock until after we know which slot we're
+                 * operating on.
+                 */
+                if (!cow)
+                        btrfs_unlock_up_safe(p, level + 1);
+
                 ret = check_block(root, p, level);
                 if (ret) {
                         ret = -1;
@@ -1453,6 +1589,7 @@ cow_done:
                 }
 
                 ret = bin_search(b, key, level, &slot);
+
                 if (level != 0) {
                         if (ret && slot > 0)
                                 slot -= 1;
@@ -1460,7 +1597,16 @@ cow_done:
                         if ((p->search_for_split || ins_len > 0) &&
                             btrfs_header_nritems(b) >=
                             BTRFS_NODEPTRS_PER_BLOCK(root) - 3) {
-                                int sret = split_node(trans, root, p, level);
+                                int sret;
+
+                                sret = reada_for_balance(root, p, level);
+                                if (sret)
+                                        goto again;
+
+                                btrfs_set_path_blocking(p);
+                                sret = split_node(trans, root, p, level);
+                                btrfs_clear_path_blocking(p);
+
                                 BUG_ON(sret > 0);
                                 if (sret) {
                                         ret = sret;
@@ -1468,9 +1614,19 @@ cow_done:
                                 }
                                 b = p->nodes[level];
                                 slot = p->slots[level];
-                        } else if (ins_len < 0) {
-                                int sret = balance_level(trans, root, p,
-                                                         level);
+                        } else if (ins_len < 0 &&
+                                   btrfs_header_nritems(b) <
+                                   BTRFS_NODEPTRS_PER_BLOCK(root) / 4) {
+                                int sret;
+
+                                sret = reada_for_balance(root, p, level);
+                                if (sret)
+                                        goto again;
+
+                                btrfs_set_path_blocking(p);
+                                sret = balance_level(trans, root, p, level);
+                                btrfs_clear_path_blocking(p);
+
                                 if (sret) {
                                         ret = sret;
                                         goto done;
@@ -1504,7 +1660,7 @@ cow_done:
                                  * of the btree by dropping locks before
                                  * we read.
                                  */
-                                if (level > 1) {
+                                if (level > 0) {
                                         btrfs_release_path(NULL, p);
                                         if (tmp)
                                                 free_extent_buffer(tmp);
@@ -1519,6 +1675,7 @@ cow_done:
                                                 free_extent_buffer(tmp);
                                         goto again;
                                 } else {
+                                        btrfs_set_path_blocking(p);
                                         if (tmp)
                                                 free_extent_buffer(tmp);
                                         if (should_reada)
@@ -1528,14 +1685,29 @@ cow_done:
                                         b = read_node_slot(root, b, slot);
                                 }
                         }
-                        if (!p->skip_locking)
-                                btrfs_tree_lock(b);
+                        if (!p->skip_locking) {
+                                int lret;
+
+                                btrfs_clear_path_blocking(p);
+                                lret = btrfs_try_spin_lock(b);
+
+                                if (!lret) {
+                                        btrfs_set_path_blocking(p);
+                                        btrfs_tree_lock(b);
+                                        btrfs_clear_path_blocking(p);
+                                }
+                        }
                 } else {
                         p->slots[level] = slot;
                         if (ins_len > 0 &&
                             btrfs_leaf_free_space(root, b) < ins_len) {
-                                int sret = split_leaf(trans, root, key,
+                                int sret;
+
+                                btrfs_set_path_blocking(p);
+                                sret = split_leaf(trans, root, key,
                                                       p, ins_len, ret == 0);
+                                btrfs_clear_path_blocking(p);
+
                                 BUG_ON(sret > 0);
                                 if (sret) {
                                         ret = sret;
@@ -1549,12 +1721,16 @@ cow_done:
         }
         ret = 1;
 done:
+        /*
+         * we don't really know what they plan on doing with the path
+         * from here on, so for now just mark it as blocking
+         */
+        btrfs_set_path_blocking(p);
         if (prealloc_block.objectid) {
                 btrfs_free_reserved_extent(root,
                            prealloc_block.objectid,
                            prealloc_block.offset);
         }
-
         return ret;
 }
 
@@ -1578,6 +1754,8 @@ int btrfs_merge_path(struct btrfs_trans_handle *trans,
         ret = btrfs_cow_block(trans, root, eb, NULL, 0, &eb, 0);
         BUG_ON(ret);
 
+        btrfs_set_lock_blocking(eb);
+
         parent = eb;
         while (1) {
                 level = btrfs_header_level(parent);
@@ -1602,6 +1780,7 @@ int btrfs_merge_path(struct btrfs_trans_handle *trans,
                         eb = read_tree_block(root, bytenr, blocksize,
                                              generation);
                         btrfs_tree_lock(eb);
+                        btrfs_set_lock_blocking(eb);
                 }
 
                 /*
@@ -1626,6 +1805,7 @@ int btrfs_merge_path(struct btrfs_trans_handle *trans,
                                 eb = read_tree_block(root, bytenr, blocksize,
                                                 generation);
                                 btrfs_tree_lock(eb);
+                                btrfs_set_lock_blocking(eb);
                         }
 
                         ret = btrfs_cow_block(trans, root, eb, parent, slot,
@@ -2172,6 +2352,8 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
 
         right = read_node_slot(root, upper, slot + 1);
         btrfs_tree_lock(right);
+        btrfs_set_lock_blocking(right);
+
         free_space = btrfs_leaf_free_space(root, right);
         if (free_space < data_size)
                 goto out_unlock;
@@ -2367,6 +2549,8 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
 
         left = read_node_slot(root, path->nodes[1], slot - 1);
         btrfs_tree_lock(left);
+        btrfs_set_lock_blocking(left);
+
         free_space = btrfs_leaf_free_space(root, left);
         if (free_space < data_size) {
                 ret = 1;
@@ -2825,6 +3009,12 @@ int btrfs_split_item(struct btrfs_trans_handle *trans,
         path->keep_locks = 0;
         BUG_ON(ret);
 
+        /*
+         * make sure any changes to the path from split_leaf leave it
+         * in a blocking state
+         */
+        btrfs_set_path_blocking(path);
+
         leaf = path->nodes[0];
         BUG_ON(btrfs_leaf_free_space(root, leaf) < sizeof(struct btrfs_item));
 
@@ -3354,6 +3544,7 @@ int btrfs_insert_empty_items(struct btrfs_trans_handle *trans,
                 BUG();
         }
 out:
+        btrfs_unlock_up_safe(path, 1);
         return ret;
 }
 
@@ -3441,15 +3632,22 @@ noinline int btrfs_del_leaf(struct btrfs_trans_handle *trans,
 {
         int ret;
         u64 root_gen = btrfs_header_generation(path->nodes[1]);
+        u64 parent_start = path->nodes[1]->start;
+        u64 parent_owner = btrfs_header_owner(path->nodes[1]);
 
         ret = del_ptr(trans, root, path, 1, path->slots[1]);
         if (ret)
                 return ret;
 
+        /*
+         * btrfs_free_extent is expensive, we want to make sure we
+         * aren't holding any locks when we call it
+         */
+        btrfs_unlock_up_safe(path, 0);
+
         ret = btrfs_free_extent(trans, root, bytenr,
                                 btrfs_level_size(root, 0),
-                                path->nodes[1]->start,
-                                btrfs_header_owner(path->nodes[1]),
+                                parent_start, parent_owner,
                                 root_gen, 0, 1);
         return ret;
 }
@@ -3721,12 +3919,14 @@ find_next_key:
                  */
                 if (slot >= nritems) {
                         path->slots[level] = slot;
+                        btrfs_set_path_blocking(path);
                         sret = btrfs_find_next_key(root, path, min_key, level,
                                                   cache_only, min_trans);
                         if (sret == 0) {
                                 btrfs_release_path(root, path);
                                 goto again;
                         } else {
+                                btrfs_clear_path_blocking(path);
                                 goto out;
                         }
                 }
@@ -3738,16 +3938,20 @@ find_next_key:
                         unlock_up(path, level, 1);
                         goto out;
                 }
+                btrfs_set_path_blocking(path);
                 cur = read_node_slot(root, cur, slot);
 
                 btrfs_tree_lock(cur);
+
                 path->locks[level - 1] = 1;
                 path->nodes[level - 1] = cur;
                 unlock_up(path, level, 1);
+                btrfs_clear_path_blocking(path);
         }
 out:
         if (ret == 0)
                 memcpy(min_key, &found_key, sizeof(found_key));
+        btrfs_set_path_blocking(path);
         return ret;
 }
 
@@ -3843,6 +4047,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
         if (ret < 0)
                 return ret;
 
+        btrfs_set_path_blocking(path);
         nritems = btrfs_header_nritems(path->nodes[0]);
         /*
          * by releasing the path above we dropped all our locks.  A balance
@@ -3873,6 +4078,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                         free_extent_buffer(next);
                 }
 
+                /* the path was set to blocking above */
                 if (level == 1 && (path->locks[1] || path->skip_locking) &&
                     path->reada)
                         reada_for_search(root, path, level, slot, 0);
@@ -3881,6 +4087,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                 if (!path->skip_locking) {
                         WARN_ON(!btrfs_tree_locked(c));
                         btrfs_tree_lock(next);
+                        btrfs_set_lock_blocking(next);
                 }
                 break;
         }
@@ -3897,12 +4104,15 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                         path->locks[level] = 1;
                 if (!level)
                         break;
+
+                btrfs_set_path_blocking(path);
                 if (level == 1 && path->locks[1] && path->reada)
                         reada_for_search(root, path, level, slot, 0);
                 next = read_node_slot(root, next, 0);
                 if (!path->skip_locking) {
                         WARN_ON(!btrfs_tree_locked(path->nodes[level]));
                         btrfs_tree_lock(next);
+                        btrfs_set_lock_blocking(next);
                 }
         }
 done:
@@ -3927,6 +4137,7 @@ int btrfs_previous_item(struct btrfs_root *root,
 
         while (1) {
                 if (path->slots[0] == 0) {
+                        btrfs_set_path_blocking(path);
                         ret = btrfs_prev_leaf(root, path);
                         if (ret != 0)
                                 return ret;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index eee060f88113..531db112c8bd 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -454,17 +454,11 @@ struct btrfs_timespec {
         __le32 nsec;
 } __attribute__ ((__packed__));
 
-typedef enum {
+enum btrfs_compression_type {
         BTRFS_COMPRESS_NONE = 0,
         BTRFS_COMPRESS_ZLIB = 1,
         BTRFS_COMPRESS_LAST = 2,
-} btrfs_compression_type;
-
-/* we don't understand any encryption methods right now */
-typedef enum {
-        BTRFS_ENCRYPTION_NONE = 0,
-        BTRFS_ENCRYPTION_LAST = 1,
-} btrfs_encryption_type;
+};
 
 struct btrfs_inode_item {
         /* nfs style generation number */
@@ -701,9 +695,7 @@ struct btrfs_fs_info {
         struct btrfs_transaction *running_transaction;
         wait_queue_head_t transaction_throttle;
         wait_queue_head_t transaction_wait;
-
         wait_queue_head_t async_submit_wait;
-        wait_queue_head_t tree_log_wait;
 
         struct btrfs_super_block super_copy;
         struct btrfs_super_block super_for_commit;
@@ -711,7 +703,6 @@ struct btrfs_fs_info {
         struct super_block *sb;
         struct inode *btree_inode;
         struct backing_dev_info bdi;
-        spinlock_t hash_lock;
         struct mutex trans_mutex;
         struct mutex tree_log_mutex;
         struct mutex transaction_kthread_mutex;
@@ -730,10 +721,6 @@ struct btrfs_fs_info {
         atomic_t async_submit_draining;
         atomic_t nr_async_bios;
         atomic_t async_delalloc_pages;
-        atomic_t tree_log_writers;
-        atomic_t tree_log_commit;
-        unsigned long tree_log_batch;
-        u64 tree_log_transid;
 
         /*
          * this is used by the balancing code to wait for all the pending
@@ -833,7 +820,14 @@ struct btrfs_root {
         struct kobject root_kobj;
         struct completion kobj_unregister;
         struct mutex objectid_mutex;
+
         struct mutex log_mutex;
+        wait_queue_head_t log_writer_wait;
+        wait_queue_head_t log_commit_wait[2];
+        atomic_t log_writers;
+        atomic_t log_commit[2];
+        unsigned long log_transid;
+        unsigned long log_batch;
 
         u64 objectid;
         u64 last_trans;
@@ -1841,6 +1835,10 @@ void btrfs_release_path(struct btrfs_root *root, struct btrfs_path *p);
 struct btrfs_path *btrfs_alloc_path(void);
 void btrfs_free_path(struct btrfs_path *p);
 void btrfs_init_path(struct btrfs_path *p);
+void btrfs_set_path_blocking(struct btrfs_path *p);
+void btrfs_clear_path_blocking(struct btrfs_path *p);
+void btrfs_unlock_up_safe(struct btrfs_path *p, int level);
+
 int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                    struct btrfs_path *path, int slot, int nr);
 int btrfs_del_leaf(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 81a313874ae5..5aebddd71193 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -16,7 +16,6 @@
  * Boston, MA 021110-1307, USA.
  */
 
-#include <linux/version.h>
 #include <linux/fs.h>
 #include <linux/blkdev.h>
 #include <linux/scatterlist.h>
@@ -800,7 +799,7 @@ struct extent_buffer *read_tree_block(struct btrfs_root *root, u64 bytenr,
         ret = btree_read_extent_buffer_pages(root, buf, 0, parent_transid);
 
         if (ret == 0)
-                buf->flags |= EXTENT_UPTODATE;
+                set_bit(EXTENT_BUFFER_UPTODATE, &buf->bflags);
         else
                 WARN_ON(1);
         return buf;
@@ -814,6 +813,10 @@ int clean_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         if (btrfs_header_generation(buf) ==
             root->fs_info->running_transaction->transid) {
                 WARN_ON(!btrfs_tree_locked(buf));
+
+                /* ugh, clear_extent_buffer_dirty can be expensive */
+                btrfs_set_lock_blocking(buf);
+
                 clear_extent_buffer_dirty(&BTRFS_I(btree_inode)->io_tree,
                                           buf);
         }
@@ -850,6 +853,14 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
         spin_lock_init(&root->list_lock);
         mutex_init(&root->objectid_mutex);
         mutex_init(&root->log_mutex);
+        init_waitqueue_head(&root->log_writer_wait);
+        init_waitqueue_head(&root->log_commit_wait[0]);
+        init_waitqueue_head(&root->log_commit_wait[1]);
+        atomic_set(&root->log_commit[0], 0);
+        atomic_set(&root->log_commit[1], 0);
+        atomic_set(&root->log_writers, 0);
+        root->log_batch = 0;
+        root->log_transid = 0;
         extent_io_tree_init(&root->dirty_log_pages,
                              fs_info->btree_inode->i_mapping, GFP_NOFS);
 
@@ -934,15 +945,16 @@ int btrfs_free_log_root_tree(struct btrfs_trans_handle *trans,
         return 0;
 }
 
-int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
-                             struct btrfs_fs_info *fs_info)
+static struct btrfs_root *alloc_log_tree(struct btrfs_trans_handle *trans,
+                                         struct btrfs_fs_info *fs_info)
 {
         struct btrfs_root *root;
         struct btrfs_root *tree_root = fs_info->tree_root;
+        struct extent_buffer *leaf;
 
         root = kzalloc(sizeof(*root), GFP_NOFS);
         if (!root)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         __setup_root(tree_root->nodesize, tree_root->leafsize,
                      tree_root->sectorsize, tree_root->stripesize,
@@ -951,12 +963,23 @@ int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
         root->root_key.objectid = BTRFS_TREE_LOG_OBJECTID;
         root->root_key.type = BTRFS_ROOT_ITEM_KEY;
         root->root_key.offset = BTRFS_TREE_LOG_OBJECTID;
+        /*
+         * log trees do not get reference counted because they go away
+         * before a real commit is actually done.  They do store pointers
+         * to file data extents, and those reference counts still get
+         * updated (along with back refs to the log tree).
+         */
         root->ref_cows = 0;
 
-        root->node = btrfs_alloc_free_block(trans, root, root->leafsize,
-                                            0, BTRFS_TREE_LOG_OBJECTID,
-                                            trans->transid, 0, 0, 0);
+        leaf = btrfs_alloc_free_block(trans, root, root->leafsize,
+                                      0, BTRFS_TREE_LOG_OBJECTID,
+                                      trans->transid, 0, 0, 0);
+        if (IS_ERR(leaf)) {
+                kfree(root);
+                return ERR_CAST(leaf);
+        }
 
+        root->node = leaf;
         btrfs_set_header_nritems(root->node, 0);
         btrfs_set_header_level(root->node, 0);
         btrfs_set_header_bytenr(root->node, root->node->start);
@@ -968,7 +991,48 @@ int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
                             BTRFS_FSID_SIZE);
         btrfs_mark_buffer_dirty(root->node);
         btrfs_tree_unlock(root->node);
-        fs_info->log_root_tree = root;
+        return root;
+}
+
+int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
+                             struct btrfs_fs_info *fs_info)
+{
+        struct btrfs_root *log_root;
+
+        log_root = alloc_log_tree(trans, fs_info);
+        if (IS_ERR(log_root))
+                return PTR_ERR(log_root);
+        WARN_ON(fs_info->log_root_tree);
+        fs_info->log_root_tree = log_root;
+        return 0;
+}
+
+int btrfs_add_log_tree(struct btrfs_trans_handle *trans,
+                       struct btrfs_root *root)
+{
+        struct btrfs_root *log_root;
+        struct btrfs_inode_item *inode_item;
+
+        log_root = alloc_log_tree(trans, root->fs_info);
+        if (IS_ERR(log_root))
+                return PTR_ERR(log_root);
+
+        log_root->last_trans = trans->transid;
+        log_root->root_key.offset = root->root_key.objectid;
+
+        inode_item = &log_root->root_item.inode;
+        inode_item->generation = cpu_to_le64(1);
+        inode_item->size = cpu_to_le64(3);
+        inode_item->nlink = cpu_to_le32(1);
+        inode_item->nbytes = cpu_to_le64(root->leafsize);
+        inode_item->mode = cpu_to_le32(S_IFDIR | 0755);
+
+        btrfs_set_root_bytenr(&log_root->root_item, log_root->node->start);
+        btrfs_set_root_generation(&log_root->root_item, trans->transid);
+
+        WARN_ON(root->log_root);
+        root->log_root = log_root;
+        root->log_transid = 0;
         return 0;
 }
 
@@ -1136,7 +1200,6 @@ static int btrfs_congested_fn(void *congested_data, int bdi_bits)
 {
         struct btrfs_fs_info *info = (struct btrfs_fs_info *)congested_data;
         int ret = 0;
-        struct list_head *cur;
         struct btrfs_device *device;
         struct backing_dev_info *bdi;
 #if 0
@@ -1144,8 +1207,7 @@ static int btrfs_congested_fn(void *congested_data, int bdi_bits)
             btrfs_congested_async(info, 0))
                 return 1;
 #endif
-        list_for_each(cur, &info->fs_devices->devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, &info->fs_devices->devices, dev_list) {
                 if (!device->bdev)
                         continue;
                 bdi = blk_get_backing_dev_info(device->bdev);
@@ -1163,13 +1225,11 @@ static int btrfs_congested_fn(void *congested_data, int bdi_bits)
  */
 static void __unplug_io_fn(struct backing_dev_info *bdi, struct page *page)
 {
-        struct list_head *cur;
         struct btrfs_device *device;
         struct btrfs_fs_info *info;
 
         info = (struct btrfs_fs_info *)bdi->unplug_io_data;
-        list_for_each(cur, &info->fs_devices->devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, &info->fs_devices->devices, dev_list) {
                 if (!device->bdev)
                         continue;
 
@@ -1447,7 +1507,6 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         INIT_LIST_HEAD(&fs_info->dead_roots);
         INIT_LIST_HEAD(&fs_info->hashers);
         INIT_LIST_HEAD(&fs_info->delalloc_inodes);
-        spin_lock_init(&fs_info->hash_lock);
         spin_lock_init(&fs_info->delalloc_lock);
         spin_lock_init(&fs_info->new_trans_lock);
         spin_lock_init(&fs_info->ref_cache_lock);
@@ -1535,10 +1594,6 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         init_waitqueue_head(&fs_info->transaction_throttle);
         init_waitqueue_head(&fs_info->transaction_wait);
         init_waitqueue_head(&fs_info->async_submit_wait);
-        init_waitqueue_head(&fs_info->tree_log_wait);
-        atomic_set(&fs_info->tree_log_commit, 0);
-        atomic_set(&fs_info->tree_log_writers, 0);
-        fs_info->tree_log_transid = 0;
 
         __setup_root(4096, 4096, 4096, 4096, tree_root,
                      fs_info, BTRFS_ROOT_TREE_OBJECTID);
@@ -1627,6 +1682,8 @@ struct btrfs_root *open_ctree(struct super_block *sb,
          * low idle thresh
          */
         fs_info->endio_workers.idle_thresh = 4;
+        fs_info->endio_meta_workers.idle_thresh = 4;
+
         fs_info->endio_write_workers.idle_thresh = 64;
         fs_info->endio_meta_write_workers.idle_thresh = 64;
 
@@ -1740,13 +1797,13 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         fs_info->system_alloc_profile = fs_info->metadata_alloc_profile;
         fs_info->cleaner_kthread = kthread_run(cleaner_kthread, tree_root,
                                                "btrfs-cleaner");
-        if (!fs_info->cleaner_kthread)
+        if (IS_ERR(fs_info->cleaner_kthread))
                 goto fail_csum_root;
 
         fs_info->transaction_kthread = kthread_run(transaction_kthread,
                                                    tree_root,
                                                    "btrfs-transaction");
-        if (!fs_info->transaction_kthread)
+        if (IS_ERR(fs_info->transaction_kthread))
                 goto fail_cleaner;
 
         if (btrfs_super_log_root(disk_super) != 0) {
@@ -1828,13 +1885,14 @@ fail_sb_buffer:
 fail_iput:
         invalidate_inode_pages2(fs_info->btree_inode->i_mapping);
         iput(fs_info->btree_inode);
-fail:
+
         btrfs_close_devices(fs_info->fs_devices);
         btrfs_mapping_tree_free(&fs_info->mapping_tree);
+        bdi_destroy(&fs_info->bdi);
 
+fail:
         kfree(extent_root);
         kfree(tree_root);
-        bdi_destroy(&fs_info->bdi);
         kfree(fs_info);
         kfree(chunk_root);
         kfree(dev_root);
@@ -1995,7 +2053,6 @@ static int write_dev_supers(struct btrfs_device *device,
 
 int write_all_supers(struct btrfs_root *root, int max_mirrors)
 {
-        struct list_head *cur;
         struct list_head *head = &root->fs_info->fs_devices->devices;
         struct btrfs_device *dev;
         struct btrfs_super_block *sb;
@@ -2011,8 +2068,7 @@ int write_all_supers(struct btrfs_root *root, int max_mirrors)
 
         sb = &root->fs_info->super_for_commit;
         dev_item = &sb->dev_item;
-        list_for_each(cur, head) {
-                dev = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(dev, head, dev_list) {
                 if (!dev->bdev) {
                         total_errors++;
                         continue;
@@ -2045,8 +2101,7 @@ int write_all_supers(struct btrfs_root *root, int max_mirrors)
         }
 
         total_errors = 0;
-        list_for_each(cur, head) {
-                dev = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(dev, head, dev_list) {
                 if (!dev->bdev)
                         continue;
                 if (!dev->in_fs_metadata || !dev->writeable)
@@ -2260,6 +2315,8 @@ void btrfs_mark_buffer_dirty(struct extent_buffer *buf)
         u64 transid = btrfs_header_generation(buf);
         struct inode *btree_inode = root->fs_info->btree_inode;
 
+        btrfs_set_lock_blocking(buf);
+
         WARN_ON(!btrfs_tree_locked(buf));
         if (transid != root->fs_info->generation) {
                 printk(KERN_CRIT "btrfs transid mismatch buffer %llu, "
@@ -2302,14 +2359,13 @@ int btrfs_read_buffer(struct extent_buffer *buf, u64 parent_transid)
         int ret;
         ret = btree_read_extent_buffer_pages(root, buf, 0, parent_transid);
         if (ret == 0)
-                buf->flags |= EXTENT_UPTODATE;
+                set_bit(EXTENT_BUFFER_UPTODATE, &buf->bflags);
         return ret;
 }
 
 int btree_lock_page_hook(struct page *page)
 {
         struct inode *inode = page->mapping->host;
-        struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
         struct extent_buffer *eb;
         unsigned long len;
@@ -2324,9 +2380,7 @@ int btree_lock_page_hook(struct page *page)
                 goto out;
 
         btrfs_tree_lock(eb);
-        spin_lock(&root->fs_info->hash_lock);
         btrfs_set_header_flag(eb, BTRFS_HEADER_FLAG_WRITTEN);
-        spin_unlock(&root->fs_info->hash_lock);
         btrfs_tree_unlock(eb);
         free_extent_buffer(eb);
 out:
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index c0ff404c31b7..494a56eb2986 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -98,5 +98,7 @@ int btrfs_free_log_root_tree(struct btrfs_trans_handle *trans,
                              struct btrfs_fs_info *fs_info);
 int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
                              struct btrfs_fs_info *fs_info);
+int btrfs_add_log_tree(struct btrfs_trans_handle *trans,
+                       struct btrfs_root *root);
 int btree_lock_page_hook(struct page *page);
 #endif
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 293da650873f..7527523c2d2d 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -19,7 +19,7 @@
 #include <linux/pagemap.h>
 #include <linux/writeback.h>
 #include <linux/blkdev.h>
-#include <linux/version.h>
+#include <linux/sort.h>
 #include "compat.h"
 #include "hash.h"
 #include "crc32c.h"
@@ -30,7 +30,6 @@
 #include "volumes.h"
 #include "locking.h"
 #include "ref-cache.h"
-#include "compat.h"
 
 #define PENDING_EXTENT_INSERT 0
 #define PENDING_EXTENT_DELETE 1
@@ -326,10 +325,8 @@ static struct btrfs_space_info *__find_space_info(struct btrfs_fs_info *info,
                                                   u64 flags)
 {
         struct list_head *head = &info->space_info;
-        struct list_head *cur;
         struct btrfs_space_info *found;
-        list_for_each(cur, head) {
-                found = list_entry(cur, struct btrfs_space_info, list);
+        list_for_each_entry(found, head, list) {
                 if (found->flags == flags)
                         return found;
         }
@@ -1525,15 +1522,55 @@ out:
         return ret;
 }
 
-int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
-                  struct extent_buffer *orig_buf, struct extent_buffer *buf,
-                  u32 *nr_extents)
+/* when a block goes through cow, we update the reference counts of
+ * everything that block points to.  The internal pointers of the block
+ * can be in just about any order, and it is likely to have clusters of
+ * things that are close together and clusters of things that are not.
+ *
+ * To help reduce the seeks that come with updating all of these reference
+ * counts, sort them by byte number before actual updates are done.
+ *
+ * struct refsort is used to match byte number to slot in the btree block.
+ * we sort based on the byte number and then use the slot to actually
+ * find the item.
+ *
+ * struct refsort is smaller than strcut btrfs_item and smaller than
+ * struct btrfs_key_ptr.  Since we're currently limited to the page size
+ * for a btree block, there's no way for a kmalloc of refsorts for a
+ * single node to be bigger than a page.
+ */
+struct refsort {
+        u64 bytenr;
+        u32 slot;
+};
+
+/*
+ * for passing into sort()
+ */
+static int refsort_cmp(const void *a_void, const void *b_void)
+{
+        const struct refsort *a = a_void;
+        const struct refsort *b = b_void;
+
+        if (a->bytenr < b->bytenr)
+                return -1;
+        if (a->bytenr > b->bytenr)
+                return 1;
+        return 0;
+}
+
+
+noinline int btrfs_inc_ref(struct btrfs_trans_handle *trans,
+                           struct btrfs_root *root,
+                           struct extent_buffer *orig_buf,
+                           struct extent_buffer *buf, u32 *nr_extents)
 {
         u64 bytenr;
         u64 ref_root;
         u64 orig_root;
         u64 ref_generation;
         u64 orig_generation;
+        struct refsort *sorted;
         u32 nritems;
         u32 nr_file_extents = 0;
         struct btrfs_key key;
@@ -1542,6 +1579,8 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         int level;
         int ret = 0;
         int faili = 0;
+        int refi = 0;
+        int slot;
         int (*process_func)(struct btrfs_trans_handle *, struct btrfs_root *,
                             u64, u64, u64, u64, u64, u64, u64, u64);
 
@@ -1553,6 +1592,9 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         nritems = btrfs_header_nritems(buf);
         level = btrfs_header_level(buf);
 
+        sorted = kmalloc(sizeof(struct refsort) * nritems, GFP_NOFS);
+        BUG_ON(!sorted);
+
         if (root->ref_cows) {
                 process_func = __btrfs_inc_extent_ref;
         } else {
@@ -1565,6 +1607,11 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                 process_func = __btrfs_update_extent_ref;
         }
 
+        /*
+         * we make two passes through the items.  In the first pass we
+         * only record the byte number and slot.  Then we sort based on
+         * byte number and do the actual work based on the sorted results
+         */
         for (i = 0; i < nritems; i++) {
                 cond_resched();
                 if (level == 0) {
@@ -1581,6 +1628,32 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                                 continue;
 
                         nr_file_extents++;
+                        sorted[refi].bytenr = bytenr;
+                        sorted[refi].slot = i;
+                        refi++;
+                } else {
+                        bytenr = btrfs_node_blockptr(buf, i);
+                        sorted[refi].bytenr = bytenr;
+                        sorted[refi].slot = i;
+                        refi++;
+                }
+        }
+        /*
+         * if refi == 0, we didn't actually put anything into the sorted
+         * array and we're done
+         */
+        if (refi == 0)
+                goto out;
+
+        sort(sorted, refi, sizeof(struct refsort), refsort_cmp, NULL);
+
+        for (i = 0; i < refi; i++) {
+                cond_resched();
+                slot = sorted[i].slot;
+                bytenr = sorted[i].bytenr;
+
+                if (level == 0) {
+                        btrfs_item_key_to_cpu(buf, &key, slot);
 
                         ret = process_func(trans, root, bytenr,
                                            orig_buf->start, buf->start,
@@ -1589,25 +1662,25 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                                            key.objectid);
 
                         if (ret) {
-                                faili = i;
+                                faili = slot;
                                 WARN_ON(1);
                                 goto fail;
                         }
                 } else {
-                        bytenr = btrfs_node_blockptr(buf, i);
                         ret = process_func(trans, root, bytenr,
                                            orig_buf->start, buf->start,
                                            orig_root, ref_root,
                                            orig_generation, ref_generation,
                                            level - 1);
                         if (ret) {
-                                faili = i;
+                                faili = slot;
                                 WARN_ON(1);
                                 goto fail;
                         }
                 }
         }
 out:
+        kfree(sorted);
         if (nr_extents) {
                 if (level == 0)
                         *nr_extents = nr_file_extents;
@@ -1616,6 +1689,7 @@ out:
         }
         return 0;
 fail:
+        kfree(sorted);
         WARN_ON(1);
         return ret;
 }
@@ -2159,7 +2233,8 @@ again:
                 ret = find_first_extent_bit(&info->extent_ins, search, &start,
                                             &end, EXTENT_WRITEBACK);
                 if (ret) {
-                        if (skipped && all && !num_inserts) {
+                        if (skipped && all && !num_inserts &&
+                            list_empty(&update_list)) {
                                 skipped = 0;
                                 search = 0;
                                 continue;
@@ -2547,6 +2622,7 @@ again:
                 if (ret) {
                         if (all && skipped && !nr) {
                                 search = 0;
+                                skipped = 0;
                                 continue;
                         }
                         mutex_unlock(&info->extent_ins_mutex);
@@ -2700,13 +2776,9 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans,
         /* if metadata always pin */
         if (owner_objectid < BTRFS_FIRST_FREE_OBJECTID) {
                 if (root->root_key.objectid == BTRFS_TREE_LOG_OBJECTID) {
-                        struct btrfs_block_group_cache *cache;
-
-                        /* btrfs_free_reserved_extent */
-                        cache = btrfs_lookup_block_group(root->fs_info, bytenr);
-                        BUG_ON(!cache);
-                        btrfs_add_free_space(cache, bytenr, num_bytes);
-                        put_block_group(cache);
+                        mutex_lock(&root->fs_info->pinned_mutex);
+                        btrfs_update_pinned_extents(root, bytenr, num_bytes, 1);
+                        mutex_unlock(&root->fs_info->pinned_mutex);
                         update_reserved_extents(root, bytenr, num_bytes, 0);
                         return 0;
                 }
@@ -3014,7 +3086,6 @@ loop_check:
 static void dump_space_info(struct btrfs_space_info *info, u64 bytes)
 {
         struct btrfs_block_group_cache *cache;
-        struct list_head *l;
 
         printk(KERN_INFO "space_info has %llu free, is %sfull\n",
                (unsigned long long)(info->total_bytes - info->bytes_used -
@@ -3022,8 +3093,7 @@ static void dump_space_info(struct btrfs_space_info *info, u64 bytes)
                (info->full) ? "" : "not ");
 
         down_read(&info->groups_sem);
-        list_for_each(l, &info->block_groups) {
-                cache = list_entry(l, struct btrfs_block_group_cache, list);
+        list_for_each_entry(cache, &info->block_groups, list) {
                 spin_lock(&cache->lock);
                 printk(KERN_INFO "block group %llu has %llu bytes, %llu used "
                        "%llu pinned %llu reserved\n",
@@ -3342,7 +3412,10 @@ struct extent_buffer *btrfs_init_new_buffer(struct btrfs_trans_handle *trans,
         btrfs_set_header_generation(buf, trans->transid);
         btrfs_tree_lock(buf);
         clean_tree_block(trans, root, buf);
+
+        btrfs_set_lock_blocking(buf);
         btrfs_set_buffer_uptodate(buf);
+
         if (root->root_key.objectid == BTRFS_TREE_LOG_OBJECTID) {
                 set_extent_dirty(&root->dirty_log_pages, buf->start,
                          buf->start + buf->len - 1, GFP_NOFS);
@@ -3351,6 +3424,7 @@ struct extent_buffer *btrfs_init_new_buffer(struct btrfs_trans_handle *trans,
                          buf->start + buf->len - 1, GFP_NOFS);
         }
         trans->blocks_used++;
+        /* this returns a buffer locked for blocking */
         return buf;
 }
 
@@ -3388,36 +3462,73 @@ int btrfs_drop_leaf_ref(struct btrfs_trans_handle *trans,
 {
         u64 leaf_owner;
         u64 leaf_generation;
+        struct refsort *sorted;
         struct btrfs_key key;
         struct btrfs_file_extent_item *fi;
         int i;
         int nritems;
         int ret;
+        int refi = 0;
+        int slot;
 
         BUG_ON(!btrfs_is_leaf(leaf));
         nritems = btrfs_header_nritems(leaf);
         leaf_owner = btrfs_header_owner(leaf);
         leaf_generation = btrfs_header_generation(leaf);
 
+        sorted = kmalloc(sizeof(*sorted) * nritems, GFP_NOFS);
+        /* we do this loop twice.  The first time we build a list
+         * of the extents we have a reference on, then we sort the list
+         * by bytenr.  The second time around we actually do the
+         * extent freeing.
+         */
         for (i = 0; i < nritems; i++) {
                 u64 disk_bytenr;
                 cond_resched();
 
                 btrfs_item_key_to_cpu(leaf, &key, i);
+
+                /* only extents have references, skip everything else */
                 if (btrfs_key_type(&key) != BTRFS_EXTENT_DATA_KEY)
                         continue;
+
                 fi = btrfs_item_ptr(leaf, i, struct btrfs_file_extent_item);
+
+                /* inline extents live in the btree, they don't have refs */
                 if (btrfs_file_extent_type(leaf, fi) ==
                     BTRFS_FILE_EXTENT_INLINE)
                         continue;
-                /*
-                 * FIXME make sure to insert a trans record that
-                 * repeats the snapshot del on crash
-                 */
+
                 disk_bytenr = btrfs_file_extent_disk_bytenr(leaf, fi);
+
+                /* holes don't have refs */
                 if (disk_bytenr == 0)
                         continue;
 
+                sorted[refi].bytenr = disk_bytenr;
+                sorted[refi].slot = i;
+                refi++;
+        }
+
+        if (refi == 0)
+                goto out;
+
+        sort(sorted, refi, sizeof(struct refsort), refsort_cmp, NULL);
+
+        for (i = 0; i < refi; i++) {
+                u64 disk_bytenr;
+
+                disk_bytenr = sorted[i].bytenr;
+                slot = sorted[i].slot;
+
+                cond_resched();
+
+                btrfs_item_key_to_cpu(leaf, &key, slot);
+                if (btrfs_key_type(&key) != BTRFS_EXTENT_DATA_KEY)
+                        continue;
+
+                fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);
+
                 ret = __btrfs_free_extent(trans, root, disk_bytenr,
                                 btrfs_file_extent_disk_num_bytes(leaf, fi),
                                 leaf->start, leaf_owner, leaf_generation,
@@ -3428,6 +3539,8 @@ int btrfs_drop_leaf_ref(struct btrfs_trans_handle *trans,
                 wake_up(&root->fs_info->transaction_throttle);
                 cond_resched();
         }
+out:
+        kfree(sorted);
         return 0;
 }
 
@@ -3437,9 +3550,25 @@ static noinline int cache_drop_leaf_ref(struct btrfs_trans_handle *trans,
 {
         int i;
         int ret;
-        struct btrfs_extent_info *info = ref->extents;
+        struct btrfs_extent_info *info;
+        struct refsort *sorted;
+
+        if (ref->nritems == 0)
+                return 0;
 
+        sorted = kmalloc(sizeof(*sorted) * ref->nritems, GFP_NOFS);
         for (i = 0; i < ref->nritems; i++) {
+                sorted[i].bytenr = ref->extents[i].bytenr;
+                sorted[i].slot = i;
+        }
+        sort(sorted, ref->nritems, sizeof(struct refsort), refsort_cmp, NULL);
+
+        /*
+         * the items in the ref were sorted when the ref was inserted
+         * into the ref cache, so this is already in order
+         */
+        for (i = 0; i < ref->nritems; i++) {
+                info = ref->extents + sorted[i].slot;
                 ret = __btrfs_free_extent(trans, root, info->bytenr,
                                           info->num_bytes, ref->bytenr,
                                           ref->owner, ref->generation,
@@ -3453,6 +3582,7 @@ static noinline int cache_drop_leaf_ref(struct btrfs_trans_handle *trans,
                 info++;
         }
 
+        kfree(sorted);
         return 0;
 }
 
@@ -3497,6 +3627,152 @@ static int drop_snap_lookup_refcount(struct btrfs_root *root, u64 start,
 }
 
 /*
+ * this is used while deleting old snapshots, and it drops the refs
+ * on a whole subtree starting from a level 1 node.
+ *
+ * The idea is to sort all the leaf pointers, and then drop the
+ * ref on all the leaves in order.  Most of the time the leaves
+ * will have ref cache entries, so no leaf IOs will be required to
+ * find the extents they have references on.
+ *
+ * For each leaf, any references it has are also dropped in order
+ *
+ * This ends up dropping the references in something close to optimal
+ * order for reading and modifying the extent allocation tree.
+ */
+static noinline int drop_level_one_refs(struct btrfs_trans_handle *trans,
+                                        struct btrfs_root *root,
+                                        struct btrfs_path *path)
+{
+        u64 bytenr;
+        u64 root_owner;
+        u64 root_gen;
+        struct extent_buffer *eb = path->nodes[1];
+        struct extent_buffer *leaf;
+        struct btrfs_leaf_ref *ref;
+        struct refsort *sorted = NULL;
+        int nritems = btrfs_header_nritems(eb);
+        int ret;
+        int i;
+        int refi = 0;
+        int slot = path->slots[1];
+        u32 blocksize = btrfs_level_size(root, 0);
+        u32 refs;
+
+        if (nritems == 0)
+                goto out;
+
+        root_owner = btrfs_header_owner(eb);
+        root_gen = btrfs_header_generation(eb);
+        sorted = kmalloc(sizeof(*sorted) * nritems, GFP_NOFS);
+
+        /*
+         * step one, sort all the leaf pointers so we don't scribble
+         * randomly into the extent allocation tree
+         */
+        for (i = slot; i < nritems; i++) {
+                sorted[refi].bytenr = btrfs_node_blockptr(eb, i);
+                sorted[refi].slot = i;
+                refi++;
+        }
+
+        /*
+         * nritems won't be zero, but if we're picking up drop_snapshot
+         * after a crash, slot might be > 0, so double check things
+         * just in case.
+         */
+        if (refi == 0)
+                goto out;
+
+        sort(sorted, refi, sizeof(struct refsort), refsort_cmp, NULL);
+
+        /*
+         * the first loop frees everything the leaves point to
+         */
+        for (i = 0; i < refi; i++) {
+                u64 ptr_gen;
+
+                bytenr = sorted[i].bytenr;
+
+                /*
+                 * check the reference count on this leaf.  If it is > 1
+                 * we just decrement it below and don't update any
+                 * of the refs the leaf points to.
+                 */
+                ret = drop_snap_lookup_refcount(root, bytenr, blocksize, &refs);
+                BUG_ON(ret);
+                if (refs != 1)
+                        continue;
+
+                ptr_gen = btrfs_node_ptr_generation(eb, sorted[i].slot);
+
+                /*
+                 * the leaf only had one reference, which means the
+                 * only thing pointing to this leaf is the snapshot
+                 * we're deleting.  It isn't possible for the reference
+                 * count to increase again later
+                 *
+                 * The reference cache is checked for the leaf,
+                 * and if found we'll be able to drop any refs held by
+                 * the leaf without needing to read it in.
+                 */
+                ref = btrfs_lookup_leaf_ref(root, bytenr);
+                if (ref && ref->generation != ptr_gen) {
+                        btrfs_free_leaf_ref(root, ref);
+                        ref = NULL;
+                }
+                if (ref) {
+                        ret = cache_drop_leaf_ref(trans, root, ref);
+                        BUG_ON(ret);
+                        btrfs_remove_leaf_ref(root, ref);
+                        btrfs_free_leaf_ref(root, ref);
+                } else {
+                        /*
+                         * the leaf wasn't in the reference cache, so
+                         * we have to read it.
+                         */
+                        leaf = read_tree_block(root, bytenr, blocksize,
+                                               ptr_gen);
+                        ret = btrfs_drop_leaf_ref(trans, root, leaf);
+                        BUG_ON(ret);
+                        free_extent_buffer(leaf);
+                }
+                atomic_inc(&root->fs_info->throttle_gen);
+                wake_up(&root->fs_info->transaction_throttle);
+                cond_resched();
+        }
+
+        /*
+         * run through the loop again to free the refs on the leaves.
+         * This is faster than doing it in the loop above because
+         * the leaves are likely to be clustered together.  We end up
+         * working in nice chunks on the extent allocation tree.
+         */
+        for (i = 0; i < refi; i++) {
+                bytenr = sorted[i].bytenr;
+                ret = __btrfs_free_extent(trans, root, bytenr,
+                                        blocksize, eb->start,
+                                        root_owner, root_gen, 0, 1);
+                BUG_ON(ret);
+
+                atomic_inc(&root->fs_info->throttle_gen);
+                wake_up(&root->fs_info->transaction_throttle);
+                cond_resched();
+        }
+out:
+        kfree(sorted);
+
+        /*
+         * update the path to show we've processed the entire level 1
+         * node.  This will get saved into the root's drop_snapshot_progress
+         * field so these drops are not repeated again if this transaction
+         * commits.
+         */
+        path->slots[1] = nritems;
+        return 0;
+}
+
+/*
  * helper function for drop_snapshot, this walks down the tree dropping ref
  * counts as it goes.
  */
@@ -3511,7 +3787,6 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
         struct extent_buffer *next;
         struct extent_buffer *cur;
         struct extent_buffer *parent;
-        struct btrfs_leaf_ref *ref;
         u32 blocksize;
         int ret;
         u32 refs;
@@ -3538,17 +3813,46 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
                 if (path->slots[*level] >=
                     btrfs_header_nritems(cur))
                         break;
+
+                /* the new code goes down to level 1 and does all the
+                 * leaves pointed to that node in bulk.  So, this check
+                 * for level 0 will always be false.
+                 *
+                 * But, the disk format allows the drop_snapshot_progress
+                 * field in the root to leave things in a state where
+                 * a leaf will need cleaning up here.  If someone crashes
+                 * with the old code and then boots with the new code,
+                 * we might find a leaf here.
+                 */
                 if (*level == 0) {
                         ret = btrfs_drop_leaf_ref(trans, root, cur);
                         BUG_ON(ret);
                         break;
                 }
+
+                /*
+                 * once we get to level one, process the whole node
+                 * at once, including everything below it.
+                 */
+                if (*level == 1) {
+                        ret = drop_level_one_refs(trans, root, path);
+                        BUG_ON(ret);
+                        break;
+                }
+
                 bytenr = btrfs_node_blockptr(cur, path->slots[*level]);
                 ptr_gen = btrfs_node_ptr_generation(cur, path->slots[*level]);
                 blocksize = btrfs_level_size(root, *level - 1);
 
                 ret = drop_snap_lookup_refcount(root, bytenr, blocksize, &refs);
                 BUG_ON(ret);
+
+                /*
+                 * if there is more than one reference, we don't need
+                 * to read that node to drop any references it has.  We
+                 * just drop the ref we hold on that node and move on to the
+                 * next slot in this level.
+                 */
                 if (refs != 1) {
                         parent = path->nodes[*level];
                         root_owner = btrfs_header_owner(parent);
@@ -3567,46 +3871,12 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
 
                         continue;
                 }
+
                 /*
-                 * at this point, we have a single ref, and since the
-                 * only place referencing this extent is a dead root
-                 * the reference count should never go higher.
-                 * So, we don't need to check it again
+                 * we need to keep freeing things in the next level down.
+                 * read the block and loop around to process it
                  */
-                if (*level == 1) {
-                        ref = btrfs_lookup_leaf_ref(root, bytenr);
-                        if (ref && ref->generation != ptr_gen) {
-                                btrfs_free_leaf_ref(root, ref);
-                                ref = NULL;
-                        }
-                        if (ref) {
-                                ret = cache_drop_leaf_ref(trans, root, ref);
-                                BUG_ON(ret);
-                                btrfs_remove_leaf_ref(root, ref);
-                                btrfs_free_leaf_ref(root, ref);
-                                *level = 0;
-                                break;
-                        }
-                }
-                next = btrfs_find_tree_block(root, bytenr, blocksize);
-                if (!next || !btrfs_buffer_uptodate(next, ptr_gen)) {
-                        free_extent_buffer(next);
-
-                        next = read_tree_block(root, bytenr, blocksize,
-                                               ptr_gen);
-                        cond_resched();
-#if 0
-                        /*
-                         * this is a debugging check and can go away
-                         * the ref should never go all the way down to 1
-                         * at this point
-                         */
-                        ret = lookup_extent_ref(NULL, root, bytenr, blocksize,
-                                                &refs);
-                        BUG_ON(ret);
-                        WARN_ON(refs != 1);
-#endif
-                }
+                next = read_tree_block(root, bytenr, blocksize, ptr_gen);
                 WARN_ON(*level <= 0);
                 if (path->nodes[*level-1])
                         free_extent_buffer(path->nodes[*level-1]);
@@ -3631,11 +3901,16 @@ out:
         root_owner = btrfs_header_owner(parent);
         root_gen = btrfs_header_generation(parent);
 
+        /*
+         * cleanup and free the reference on the last node
+         * we processed
+         */
         ret = __btrfs_free_extent(trans, root, bytenr, blocksize,
                                   parent->start, root_owner, root_gen,
                                   *level, 1);
         free_extent_buffer(path->nodes[*level]);
         path->nodes[*level] = NULL;
+
         *level += 1;
         BUG_ON(ret);
 
@@ -3687,6 +3962,7 @@ static noinline int walk_down_subtree(struct btrfs_trans_handle *trans,
 
                 next = read_tree_block(root, bytenr, blocksize, ptr_gen);
                 btrfs_tree_lock(next);
+                btrfs_set_lock_blocking(next);
 
                 ret = btrfs_lookup_extent_ref(trans, root, bytenr, blocksize,
                                               &refs);
@@ -3754,6 +4030,13 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
                 if (slot < btrfs_header_nritems(path->nodes[i]) - 1) {
                         struct extent_buffer *node;
                         struct btrfs_disk_key disk_key;
+
+                        /*
+                         * there is more work to do in this level.
+                         * Update the drop_progress marker to reflect
+                         * the work we've done so far, and then bump
+                         * the slot number
+                         */
                         node = path->nodes[i];
                         path->slots[i]++;
                         *level = i;
@@ -3765,6 +4048,11 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
                         return 0;
                 } else {
                         struct extent_buffer *parent;
+
+                        /*
+                         * this whole node is done, free our reference
+                         * on it and go up one level
+                         */
                         if (path->nodes[*level] == root->node)
                                 parent = path->nodes[*level];
                         else
@@ -4444,7 +4732,7 @@ static noinline int replace_one_extent(struct btrfs_trans_handle *trans,
         u64 lock_end = 0;
         u64 num_bytes;
         u64 ext_offset;
-        u64 first_pos;
+        u64 search_end = (u64)-1;
         u32 nritems;
         int nr_scaned = 0;
         int extent_locked = 0;
@@ -4452,7 +4740,6 @@ static noinline int replace_one_extent(struct btrfs_trans_handle *trans,
         int ret;
 
         memcpy(&key, leaf_key, sizeof(key));
-        first_pos = INT_LIMIT(loff_t) - extent_key->offset;
         if (ref_path->owner_objectid != BTRFS_MULTIPLE_OBJECTIDS) {
                 if (key.objectid < ref_path->owner_objectid ||
                     (key.objectid == ref_path->owner_objectid &&
@@ -4501,7 +4788,7 @@ next:
                         if ((key.objectid > ref_path->owner_objectid) ||
                             (key.objectid == ref_path->owner_objectid &&
                              key.type > BTRFS_EXTENT_DATA_KEY) ||
-                            (key.offset >= first_pos + extent_key->offset))
+                            key.offset >= search_end)
                                 break;
                 }
 
@@ -4534,8 +4821,10 @@ next:
                 num_bytes = btrfs_file_extent_num_bytes(leaf, fi);
                 ext_offset = btrfs_file_extent_offset(leaf, fi);
 
-                if (first_pos > key.offset - ext_offset)
-                        first_pos = key.offset - ext_offset;
+                if (search_end == (u64)-1) {
+                        search_end = key.offset - ext_offset +
+                                btrfs_file_extent_ram_bytes(leaf, fi);
+                }
 
                 if (!extent_locked) {
                         lock_start = key.offset;
@@ -4724,7 +5013,7 @@ next:
                 }
 skip:
                 if (ref_path->owner_objectid != BTRFS_MULTIPLE_OBJECTIDS &&
-                    key.offset >= first_pos + extent_key->offset)
+                    key.offset >= search_end)
                         break;
 
                 cond_resched();
@@ -4778,6 +5067,7 @@ int btrfs_reloc_tree_cache_ref(struct btrfs_trans_handle *trans,
                 ref->bytenr = buf->start;
                 ref->owner = btrfs_header_owner(buf);
                 ref->generation = btrfs_header_generation(buf);
+
                 ret = btrfs_add_leaf_ref(root, ref, 0);
                 WARN_ON(ret);
                 btrfs_free_leaf_ref(root, ref);
@@ -5957,9 +6247,11 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         path = btrfs_alloc_path();
         BUG_ON(!path);
 
-        btrfs_remove_free_space_cache(block_group);
+        spin_lock(&root->fs_info->block_group_cache_lock);
         rb_erase(&block_group->cache_node,
                  &root->fs_info->block_group_cache_tree);
+        spin_unlock(&root->fs_info->block_group_cache_lock);
+        btrfs_remove_free_space_cache(block_group);
         down_write(&block_group->space_info->groups_sem);
         list_del(&block_group->list);
         up_write(&block_group->space_info->groups_sem);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index e086d407f1fa..37d43b516b79 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -9,7 +9,6 @@
 #include <linux/spinlock.h>
 #include <linux/blkdev.h>
 #include <linux/swap.h>
-#include <linux/version.h>
 #include <linux/writeback.h>
 #include <linux/pagevec.h>
 #include "extent_io.h"
@@ -31,7 +30,7 @@ static LIST_HEAD(buffers);
 static LIST_HEAD(states);
 
 #define LEAK_DEBUG 0
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
 static DEFINE_SPINLOCK(leak_lock);
 #endif
 
@@ -120,7 +119,7 @@ void extent_io_tree_init(struct extent_io_tree *tree,
 static struct extent_state *alloc_extent_state(gfp_t mask)
 {
         struct extent_state *state;
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
         unsigned long flags;
 #endif
 
@@ -130,7 +129,7 @@ static struct extent_state *alloc_extent_state(gfp_t mask)
         state->state = 0;
         state->private = 0;
         state->tree = NULL;
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
         spin_lock_irqsave(&leak_lock, flags);
         list_add(&state->leak_list, &states);
         spin_unlock_irqrestore(&leak_lock, flags);
@@ -145,11 +144,11 @@ static void free_extent_state(struct extent_state *state)
         if (!state)
                 return;
         if (atomic_dec_and_test(&state->refs)) {
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
                 unsigned long flags;
 #endif
                 WARN_ON(state->tree);
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
                 spin_lock_irqsave(&leak_lock, flags);
                 list_del(&state->leak_list);
                 spin_unlock_irqrestore(&leak_lock, flags);
@@ -2378,11 +2377,6 @@ static int extent_write_cache_pages(struct extent_io_tree *tree,
         int scanned = 0;
         int range_whole = 0;
 
-        if (wbc->nonblocking && bdi_write_congested(bdi)) {
-                wbc->encountered_congestion = 1;
-                return 0;
-        }
-
         pagevec_init(&pvec, 0);
         if (wbc->range_cyclic) {
                 index = mapping->writeback_index; /* Start from prev offset */
@@ -2855,6 +2849,98 @@ out:
         return sector;
 }
 
+int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+                __u64 start, __u64 len, get_extent_t *get_extent)
+{
+        int ret;
+        u64 off = start;
+        u64 max = start + len;
+        u32 flags = 0;
+        u64 disko = 0;
+        struct extent_map *em = NULL;
+        int end = 0;
+        u64 em_start = 0, em_len = 0;
+        unsigned long emflags;
+        ret = 0;
+
+        if (len == 0)
+                return -EINVAL;
+
+        lock_extent(&BTRFS_I(inode)->io_tree, start, start + len,
+                GFP_NOFS);
+        em = get_extent(inode, NULL, 0, off, max - off, 0);
+        if (!em)
+                goto out;
+        if (IS_ERR(em)) {
+                ret = PTR_ERR(em);
+                goto out;
+        }
+        while (!end) {
+                off = em->start + em->len;
+                if (off >= max)
+                        end = 1;
+
+                em_start = em->start;
+                em_len = em->len;
+
+                disko = 0;
+                flags = 0;
+
+                switch (em->block_start) {
+                case EXTENT_MAP_LAST_BYTE:
+                        end = 1;
+                        flags |= FIEMAP_EXTENT_LAST;
+                        break;
+                case EXTENT_MAP_HOLE:
+                        flags |= FIEMAP_EXTENT_UNWRITTEN;
+                        break;
+                case EXTENT_MAP_INLINE:
+                        flags |= (FIEMAP_EXTENT_DATA_INLINE |
+                                  FIEMAP_EXTENT_NOT_ALIGNED);
+                        break;
+                case EXTENT_MAP_DELALLOC:
+                        flags |= (FIEMAP_EXTENT_DELALLOC |
+                                  FIEMAP_EXTENT_UNKNOWN);
+                        break;
+                default:
+                        disko = em->block_start;
+                        break;
+                }
+                if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags))
+                        flags |= FIEMAP_EXTENT_ENCODED;
+
+                emflags = em->flags;
+                free_extent_map(em);
+                em = NULL;
+
+                if (!end) {
+                        em = get_extent(inode, NULL, 0, off, max - off, 0);
+                        if (!em)
+                                goto out;
+                        if (IS_ERR(em)) {
+                                ret = PTR_ERR(em);
+                                goto out;
+                        }
+                        emflags = em->flags;
+                }
+                if (test_bit(EXTENT_FLAG_VACANCY, &emflags)) {
+                        flags |= FIEMAP_EXTENT_LAST;
+                        end = 1;
+                }
+
+                ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
+                                        em_len, flags);
+                if (ret)
+                        goto out_free;
+        }
+out_free:
+        free_extent_map(em);
+out:
+        unlock_extent(&BTRFS_I(inode)->io_tree, start, start + len,
+                        GFP_NOFS);
+        return ret;
+}
+
 static inline struct page *extent_buffer_page(struct extent_buffer *eb,
                                               unsigned long i)
 {
@@ -2892,15 +2978,17 @@ static struct extent_buffer *__alloc_extent_buffer(struct extent_io_tree *tree,
                                                    gfp_t mask)
 {
         struct extent_buffer *eb = NULL;
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
         unsigned long flags;
 #endif
 
         eb = kmem_cache_zalloc(extent_buffer_cache, mask);
         eb->start = start;
         eb->len = len;
-        mutex_init(&eb->mutex);
-#ifdef LEAK_DEBUG
+        spin_lock_init(&eb->lock);
+        init_waitqueue_head(&eb->lock_wq);
+
+#if LEAK_DEBUG
         spin_lock_irqsave(&leak_lock, flags);
         list_add(&eb->leak_list, &buffers);
         spin_unlock_irqrestore(&leak_lock, flags);
@@ -2912,7 +3000,7 @@ static struct extent_buffer *__alloc_extent_buffer(struct extent_io_tree *tree,
 
 static void __free_extent_buffer(struct extent_buffer *eb)
 {
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
         unsigned long flags;
         spin_lock_irqsave(&leak_lock, flags);
         list_del(&eb->leak_list);
@@ -2980,8 +3068,7 @@ struct extent_buffer *alloc_extent_buffer(struct extent_io_tree *tree,
                 unlock_page(p);
         }
         if (uptodate)
-                eb->flags |= EXTENT_UPTODATE;
-        eb->flags |= EXTENT_BUFFER_FILLED;
+                set_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
 
         spin_lock(&tree->buffer_lock);
         exists = buffer_tree_insert(tree, start, &eb->rb_node);
@@ -3135,7 +3222,7 @@ int clear_extent_buffer_uptodate(struct extent_io_tree *tree,
         unsigned long num_pages;
 
         num_pages = num_extent_pages(eb->start, eb->len);
-        eb->flags &= ~EXTENT_UPTODATE;
+        clear_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
 
         clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
                               GFP_NOFS);
@@ -3206,7 +3293,7 @@ int extent_buffer_uptodate(struct extent_io_tree *tree,
         struct page *page;
         int pg_uptodate = 1;
 
-        if (eb->flags & EXTENT_UPTODATE)
+        if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags))
                 return 1;
 
         ret = test_range_bit(tree, eb->start, eb->start + eb->len - 1,
@@ -3242,7 +3329,7 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
         struct bio *bio = NULL;
         unsigned long bio_flags = 0;
 
-        if (eb->flags & EXTENT_UPTODATE)
+        if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags))
                 return 0;
 
         if (test_range_bit(tree, eb->start, eb->start + eb->len - 1,
@@ -3273,7 +3360,7 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
         }
         if (all_uptodate) {
                 if (start_i == 0)
-                        eb->flags |= EXTENT_UPTODATE;
+                        set_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
                 goto unlock_exit;
         }
 
@@ -3309,7 +3396,7 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
         }
 
         if (!ret)
-                eb->flags |= EXTENT_UPTODATE;
+                set_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
         return ret;
 
 unlock_exit:
@@ -3406,7 +3493,6 @@ int map_extent_buffer(struct extent_buffer *eb, unsigned long start,
                 unmap_extent_buffer(eb, eb->map_token, km);
                 eb->map_token = NULL;
                 save = 1;
-                WARN_ON(!mutex_is_locked(&eb->mutex));
         }
         err = map_private_extent_buffer(eb, start, min_len, token, map,
                                        map_start, map_len, km);
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index c5b483a79137..1f9df88afbf6 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -22,6 +22,10 @@
 /* flags for bio submission */
 #define EXTENT_BIO_COMPRESSED 1
 
+/* these are bit numbers for test/set bit */
+#define EXTENT_BUFFER_UPTODATE 0
+#define EXTENT_BUFFER_BLOCKING 1
+
 /*
  * page->private values.  Every page that is controlled by the extent
  * map has page->private set to one.
@@ -95,11 +99,19 @@ struct extent_buffer {
         unsigned long map_start;
         unsigned long map_len;
         struct page *first_page;
+        unsigned long bflags;
         atomic_t refs;
-        int flags;
         struct list_head leak_list;
         struct rb_node rb_node;
-        struct mutex mutex;
+
+        /* the spinlock is used to protect most operations */
+        spinlock_t lock;
+
+        /*
+         * when we keep the lock held while blocking, waiters go onto
+         * the wq
+         */
+        wait_queue_head_t lock_wq;
 };
 
 struct extent_map_tree;
@@ -193,6 +205,8 @@ int extent_commit_write(struct extent_io_tree *tree,
                         unsigned from, unsigned to);
 sector_t extent_bmap(struct address_space *mapping, sector_t iblock,
                 get_extent_t *get_extent);
+int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+                __u64 start, __u64 len, get_extent_t *get_extent);
 int set_range_dirty(struct extent_io_tree *tree, u64 start, u64 end);
 int set_state_private(struct extent_io_tree *tree, u64 start, u64 private);
 int get_state_private(struct extent_io_tree *tree, u64 start, u64 *private);
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 4a83e33ada32..50da69da20ce 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -3,7 +3,6 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
-#include <linux/version.h>
 #include <linux/hardirq.h>
 #include "extent_map.h"
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 90268334145e..3e8023efaff7 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -29,7 +29,6 @@
 #include <linux/writeback.h>
 #include <linux/statfs.h>
 #include <linux/compat.h>
-#include <linux/version.h>
 #include "ctree.h"
 #include "disk-io.h"
 #include "transaction.h"
@@ -1215,10 +1214,10 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
         }
         mutex_unlock(&root->fs_info->trans_mutex);
 
-        root->fs_info->tree_log_batch++;
+        root->log_batch++;
         filemap_fdatawrite(inode->i_mapping);
         btrfs_wait_ordered_range(inode, 0, (u64)-1);
-        root->fs_info->tree_log_batch++;
+        root->log_batch++;
 
         /*
          * ok we haven't committed the transaction yet, lets do a commit
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 8adfe059ab41..8f0706210a47 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -34,7 +34,6 @@
 #include <linux/statfs.h>
 #include <linux/compat.h>
 #include <linux/bit_spinlock.h>
-#include <linux/version.h>
 #include <linux/xattr.h>
 #include <linux/posix_acl.h>
 #include <linux/falloc.h>
@@ -51,6 +50,7 @@
 #include "tree-log.h"
 #include "ref-cache.h"
 #include "compression.h"
+#include "locking.h"
 
 struct btrfs_iget_args {
         u64 ino;
@@ -91,6 +91,16 @@ static noinline int cow_file_range(struct inode *inode,
                                    u64 start, u64 end, int *page_started,
                                    unsigned long *nr_written, int unlock);
 
+static int btrfs_init_inode_security(struct inode *inode,  struct inode *dir)
+{
+        int err;
+
+        err = btrfs_init_acl(inode, dir);
+        if (!err)
+                err = btrfs_xattr_security_init(inode, dir);
+        return err;
+}
+
 /*
  * a very lame attempt at stopping writes when the FS is 85% full.  There
  * are countless ways this is incorrect, but it is better than nothing.
@@ -350,6 +360,19 @@ again:
         nr_pages = (end >> PAGE_CACHE_SHIFT) - (start >> PAGE_CACHE_SHIFT) + 1;
         nr_pages = min(nr_pages, (128 * 1024UL) / PAGE_CACHE_SIZE);
 
+        /*
+         * we don't want to send crud past the end of i_size through
+         * compression, that's just a waste of CPU time.  So, if the
+         * end of the file is before the start of our current
+         * requested range of bytes, we bail out to the uncompressed
+         * cleanup code that can deal with all of this.
+         *
+         * It isn't really the fastest way to fix things, but this is a
+         * very uncommon corner.
+         */
+        if (actual_end <= start)
+                goto cleanup_and_bail_uncompressed;
+
         total_compressed = actual_end - start;
 
         /* we want to make sure that amount of ram required to uncompress
@@ -494,6 +517,7 @@ again:
                         goto again;
                 }
         } else {
+cleanup_and_bail_uncompressed:
                 /*
                  * No compression, but we still need to write the pages in
                  * the file we've been given so far.  redirty the locked
@@ -1324,12 +1348,11 @@ static noinline int add_pending_csums(struct btrfs_trans_handle *trans,
                              struct inode *inode, u64 file_offset,
                              struct list_head *list)
 {
-        struct list_head *cur;
         struct btrfs_ordered_sum *sum;
 
         btrfs_set_trans_block_group(trans, inode);
-        list_for_each(cur, list) {
-                sum = list_entry(cur, struct btrfs_ordered_sum, list);
+
+        list_for_each_entry(sum, list, list) {
                 btrfs_csum_file_blocks(trans,
                        BTRFS_I(inode)->root->fs_info->csum_root, sum);
         }
@@ -2013,6 +2036,7 @@ void btrfs_read_locked_inode(struct inode *inode)
         BTRFS_I(inode)->flags = btrfs_inode_flags(leaf, inode_item);
 
         alloc_group_block = btrfs_inode_block_group(leaf, inode_item);
+
         BTRFS_I(inode)->block_group = btrfs_find_block_group(root, 0,
                                                 alloc_group_block, 0);
         btrfs_free_path(path);
@@ -2039,6 +2063,7 @@ void btrfs_read_locked_inode(struct inode *inode)
                 inode->i_mapping->backing_dev_info = &root->fs_info->bdi;
                 break;
         default:
+                inode->i_op = &btrfs_special_inode_operations;
                 init_special_inode(inode, inode->i_mode, rdev);
                 break;
         }
@@ -2108,6 +2133,7 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans,
                 goto failed;
         }
 
+        btrfs_unlock_up_safe(path, 1);
         leaf = path->nodes[0];
         inode_item = btrfs_item_ptr(leaf, path->slots[0],
                                   struct btrfs_inode_item);
@@ -2429,6 +2455,8 @@ next_node:
                         ref->generation = leaf_gen;
                         ref->nritems = 0;
 
+                        btrfs_sort_leaf_ref(ref);
+
                         ret = btrfs_add_leaf_ref(root, ref, 0);
                         WARN_ON(ret);
                         btrfs_free_leaf_ref(root, ref);
@@ -2476,7 +2504,7 @@ noinline int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
         struct btrfs_path *path;
         struct btrfs_key key;
         struct btrfs_key found_key;
-        u32 found_type;
+        u32 found_type = (u8)-1;
         struct extent_buffer *leaf;
         struct btrfs_file_extent_item *fi;
         u64 extent_start = 0;
@@ -2663,6 +2691,8 @@ next:
                         if (pending_del_nr)
                                 goto del_pending;
                         btrfs_release_path(root, path);
+                        if (found_type == BTRFS_INODE_ITEM_KEY)
+                                break;
                         goto search_again;
                 }
 
@@ -2679,6 +2709,8 @@ del_pending:
                         BUG_ON(ret);
                         pending_del_nr = 0;
                         btrfs_release_path(root, path);
+                        if (found_type == BTRFS_INODE_ITEM_KEY)
+                                break;
                         goto search_again;
                 }
         }
@@ -3265,7 +3297,7 @@ skip:
 
         /* Reached end of directory/root. Bump pos past the last item. */
         if (key_type == BTRFS_DIR_INDEX_KEY)
-                filp->f_pos = INT_LIMIT(typeof(filp->f_pos));
+                filp->f_pos = INT_LIMIT(off_t);
         else
                 filp->f_pos++;
 nopos:
@@ -3458,7 +3490,14 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
                 root->highest_inode = objectid;
 
         inode->i_uid = current_fsuid();
-        inode->i_gid = current_fsgid();
+
+        if (dir && (dir->i_mode & S_ISGID)) {
+                inode->i_gid = dir->i_gid;
+                if (S_ISDIR(mode))
+                        mode |= S_ISGID;
+        } else
+                inode->i_gid = current_fsgid();
+
         inode->i_mode = mode;
         inode->i_ino = objectid;
         inode_set_bytes(inode, 0);
@@ -3586,7 +3625,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
         if (IS_ERR(inode))
                 goto out_unlock;
 
-        err = btrfs_init_acl(inode, dir);
+        err = btrfs_init_inode_security(inode, dir);
         if (err) {
                 drop_inode = 1;
                 goto out_unlock;
@@ -3649,7 +3688,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
         if (IS_ERR(inode))
                 goto out_unlock;
 
-        err = btrfs_init_acl(inode, dir);
+        err = btrfs_init_inode_security(inode, dir);
         if (err) {
                 drop_inode = 1;
                 goto out_unlock;
@@ -3772,7 +3811,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 
         drop_on_err = 1;
 
-        err = btrfs_init_acl(inode, dir);
+        err = btrfs_init_inode_security(inode, dir);
         if (err)
                 goto out_fail;
 
@@ -4158,9 +4197,10 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
         return -EINVAL;
 }
 
-static sector_t btrfs_bmap(struct address_space *mapping, sector_t iblock)
+static int btrfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+                __u64 start, __u64 len)
 {
-        return extent_bmap(mapping, iblock, btrfs_get_extent);
+        return extent_fiemap(inode, fieinfo, start, len, btrfs_get_extent);
 }
 
 int btrfs_readpage(struct file *file, struct page *page)
@@ -4733,7 +4773,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
         if (IS_ERR(inode))
                 goto out_unlock;
 
-        err = btrfs_init_acl(inode, dir);
+        err = btrfs_init_inode_security(inode, dir);
         if (err) {
                 drop_inode = 1;
                 goto out_unlock;
@@ -4987,13 +5027,24 @@ static struct extent_io_ops btrfs_extent_io_ops = {
         .clear_bit_hook = btrfs_clear_bit_hook,
 };
 
+/*
+ * btrfs doesn't support the bmap operation because swapfiles
+ * use bmap to make a mapping of extents in the file.  They assume
+ * these extents won't change over the life of the file and they
+ * use the bmap result to do IO directly to the drive.
+ *
+ * the btrfs bmap call would return logical addresses that aren't
+ * suitable for IO and they also will change frequently as COW
+ * operations happen.  So, swapfile + btrfs == corruption.
+ *
+ * For now we're avoiding this by dropping bmap.
+ */
 static struct address_space_operations btrfs_aops = {
         .readpage       = btrfs_readpage,
         .writepage      = btrfs_writepage,
         .writepages     = btrfs_writepages,
         .readpages      = btrfs_readpages,
         .sync_page      = block_sync_page,
-        .bmap           = btrfs_bmap,
         .direct_IO      = btrfs_direct_IO,
         .invalidatepage = btrfs_invalidatepage,
         .releasepage    = btrfs_releasepage,
@@ -5017,6 +5068,7 @@ static struct inode_operations btrfs_file_inode_operations = {
         .removexattr    = btrfs_removexattr,
         .permission     = btrfs_permission,
         .fallocate      = btrfs_fallocate,
+        .fiemap         = btrfs_fiemap,
 };
 static struct inode_operations btrfs_special_inode_operations = {
         .getattr        = btrfs_getattr,
@@ -5032,4 +5084,8 @@ static struct inode_operations btrfs_symlink_inode_operations = {
         .follow_link    = page_follow_link_light,
         .put_link       = page_put_link,
         .permission     = btrfs_permission,
+        .setxattr       = btrfs_setxattr,
+        .getxattr       = btrfs_getxattr,
+        .listxattr      = btrfs_listxattr,
+        .removexattr    = btrfs_removexattr,
 };
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index c2aa33e3feb5..988fdc8b49eb 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -38,7 +38,6 @@
 #include <linux/compat.h>
 #include <linux/bit_spinlock.h>
 #include <linux/security.h>
-#include <linux/version.h>
 #include <linux/xattr.h>
 #include <linux/vmalloc.h>
 #include "compat.h"
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index 39bae7761db6..9ebe9385129b 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -26,63 +26,213 @@
 #include "locking.h"
 
 /*
- * locks the per buffer mutex in an extent buffer.  This uses adaptive locks
- * and the spin is not tuned very extensively.  The spinning does make a big
- * difference in almost every workload, but spinning for the right amount of
- * time needs some help.
- *
- * In general, we want to spin as long as the lock holder is doing btree
- * searches, and we should give up if they are in more expensive code.
+ * btrfs_header_level() isn't free, so don't call it when lockdep isn't
+ * on
  */
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+static inline void spin_nested(struct extent_buffer *eb)
+{
+        spin_lock_nested(&eb->lock, BTRFS_MAX_LEVEL - btrfs_header_level(eb));
+}
+#else
+static inline void spin_nested(struct extent_buffer *eb)
+{
+        spin_lock(&eb->lock);
+}
+#endif
 
-int btrfs_tree_lock(struct extent_buffer *eb)
+/*
+ * Setting a lock to blocking will drop the spinlock and set the
+ * flag that forces other procs who want the lock to wait.  After
+ * this you can safely schedule with the lock held.
+ */
+void btrfs_set_lock_blocking(struct extent_buffer *eb)
 {
-        int i;
+        if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags)) {
+                set_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags);
+                spin_unlock(&eb->lock);
+        }
+        /* exit with the spin lock released and the bit set */
+}
 
-        if (mutex_trylock(&eb->mutex))
-                return 0;
+/*
+ * clearing the blocking flag will take the spinlock again.
+ * After this you can't safely schedule
+ */
+void btrfs_clear_lock_blocking(struct extent_buffer *eb)
+{
+        if (test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags)) {
+                spin_nested(eb);
+                clear_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags);
+                smp_mb__after_clear_bit();
+        }
+        /* exit with the spin lock held */
+}
+
+/*
+ * unfortunately, many of the places that currently set a lock to blocking
+ * don't end up blocking for every long, and often they don't block
+ * at all.  For a dbench 50 run, if we don't spin one the blocking bit
+ * at all, the context switch rate can jump up to 400,000/sec or more.
+ *
+ * So, we're still stuck with this crummy spin on the blocking bit,
+ * at least until the most common causes of the short blocks
+ * can be dealt with.
+ */
+static int btrfs_spin_on_block(struct extent_buffer *eb)
+{
+        int i;
         for (i = 0; i < 512; i++) {
                 cpu_relax();
-                if (mutex_trylock(&eb->mutex))
-                        return 0;
+                if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                        return 1;
+                if (need_resched())
+                        break;
         }
-        cpu_relax();
-        mutex_lock_nested(&eb->mutex, BTRFS_MAX_LEVEL - btrfs_header_level(eb));
         return 0;
 }
 
-int btrfs_try_tree_lock(struct extent_buffer *eb)
+/*
+ * This is somewhat different from trylock.  It will take the
+ * spinlock but if it finds the lock is set to blocking, it will
+ * return without the lock held.
+ *
+ * returns 1 if it was able to take the lock and zero otherwise
+ *
+ * After this call, scheduling is not safe without first calling
+ * btrfs_set_lock_blocking()
+ */
+int btrfs_try_spin_lock(struct extent_buffer *eb)
 {
-        return mutex_trylock(&eb->mutex);
+        int i;
+
+        spin_nested(eb);
+        if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                return 1;
+        spin_unlock(&eb->lock);
+
+        /* spin for a bit on the BLOCKING flag */
+        for (i = 0; i < 2; i++) {
+                if (!btrfs_spin_on_block(eb))
+                        break;
+
+                spin_nested(eb);
+                if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                        return 1;
+                spin_unlock(&eb->lock);
+        }
+        return 0;
 }
 
-int btrfs_tree_unlock(struct extent_buffer *eb)
+/*
+ * the autoremove wake function will return 0 if it tried to wake up
+ * a process that was already awake, which means that process won't
+ * count as an exclusive wakeup.  The waitq code will continue waking
+ * procs until it finds one that was actually sleeping.
+ *
+ * For btrfs, this isn't quite what we want.  We want a single proc
+ * to be notified that the lock is ready for taking.  If that proc
+ * already happen to be awake, great, it will loop around and try for
+ * the lock.
+ *
+ * So, btrfs_wake_function always returns 1, even when the proc that we
+ * tried to wake up was already awake.
+ */
+static int btrfs_wake_function(wait_queue_t *wait, unsigned mode,
+                               int sync, void *key)
 {
-        mutex_unlock(&eb->mutex);
-        return 0;
+        autoremove_wake_function(wait, mode, sync, key);
+        return 1;
 }
 
-int btrfs_tree_locked(struct extent_buffer *eb)
+/*
+ * returns with the extent buffer spinlocked.
+ *
+ * This will spin and/or wait as required to take the lock, and then
+ * return with the spinlock held.
+ *
+ * After this call, scheduling is not safe without first calling
+ * btrfs_set_lock_blocking()
+ */
+int btrfs_tree_lock(struct extent_buffer *eb)
 {
-        return mutex_is_locked(&eb->mutex);
+        DEFINE_WAIT(wait);
+        wait.func = btrfs_wake_function;
+
+        while(1) {
+                spin_nested(eb);
+
+                /* nobody is blocking, exit with the spinlock held */
+                if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                        return 0;
+
+                /*
+                 * we have the spinlock, but the real owner is blocking.
+                 * wait for them
+                 */
+                spin_unlock(&eb->lock);
+
+                /*
+                 * spin for a bit, and if the blocking flag goes away,
+                 * loop around
+                 */
+                if (btrfs_spin_on_block(eb))
+                        continue;
+
+                prepare_to_wait_exclusive(&eb->lock_wq, &wait,
+                                          TASK_UNINTERRUPTIBLE);
+
+                if (test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                        schedule();
+
+                finish_wait(&eb->lock_wq, &wait);
+        }
+        return 0;
 }
 
 /*
- * btrfs_search_slot uses this to decide if it should drop its locks
- * before doing something expensive like allocating free blocks for cow.
+ * Very quick trylock, this does not spin or schedule.  It returns
+ * 1 with the spinlock held if it was able to take the lock, or it
+ * returns zero if it was unable to take the lock.
+ *
+ * After this call, scheduling is not safe without first calling
+ * btrfs_set_lock_blocking()
  */
-int btrfs_path_lock_waiting(struct btrfs_path *path, int level)
+int btrfs_try_tree_lock(struct extent_buffer *eb)
 {
-        int i;
-        struct extent_buffer *eb;
-        for (i = level; i <= level + 1 && i < BTRFS_MAX_LEVEL; i++) {
-                eb = path->nodes[i];
-                if (!eb)
-                        break;
-                smp_mb();
-                if (!list_empty(&eb->mutex.wait_list))
-                        return 1;
+        if (spin_trylock(&eb->lock)) {
+                if (test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags)) {
+                        /*
+                         * we've got the spinlock, but the real owner is
+                         * blocking.  Drop the spinlock and return failure
+                         */
+                        spin_unlock(&eb->lock);
+                        return 0;
+                }
+                return 1;
         }
+        /* someone else has the spinlock giveup */
         return 0;
 }
 
+int btrfs_tree_unlock(struct extent_buffer *eb)
+{
+        /*
+         * if we were a blocking owner, we don't have the spinlock held
+         * just clear the bit and look for waiters
+         */
+        if (test_and_clear_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                smp_mb__after_clear_bit();
+        else
+                spin_unlock(&eb->lock);
+
+        if (waitqueue_active(&eb->lock_wq))
+                wake_up(&eb->lock_wq);
+        return 0;
+}
+
+int btrfs_tree_locked(struct extent_buffer *eb)
+{
+        return test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags) ||
+                        spin_is_locked(&eb->lock);
+}
diff --git a/fs/btrfs/locking.h b/fs/btrfs/locking.h
index bc1faef12519..6bb0afbff928 100644
--- a/fs/btrfs/locking.h
+++ b/fs/btrfs/locking.h
@@ -22,6 +22,10 @@
 int btrfs_tree_lock(struct extent_buffer *eb);
 int btrfs_tree_unlock(struct extent_buffer *eb);
 int btrfs_tree_locked(struct extent_buffer *eb);
+
 int btrfs_try_tree_lock(struct extent_buffer *eb);
-int btrfs_path_lock_waiting(struct btrfs_path *path, int level);
+int btrfs_try_spin_lock(struct extent_buffer *eb);
+
+void btrfs_set_lock_blocking(struct extent_buffer *eb);
+void btrfs_clear_lock_blocking(struct extent_buffer *eb);
 #endif
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index a20940170274..77c2411a5f0f 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -613,7 +613,6 @@ int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr,
         struct btrfs_sector_sum *sector_sums;
         struct btrfs_ordered_extent *ordered;
         struct btrfs_ordered_inode_tree *tree = &BTRFS_I(inode)->ordered_tree;
-        struct list_head *cur;
         unsigned long num_sectors;
         unsigned long i;
         u32 sectorsize = BTRFS_I(inode)->root->sectorsize;
@@ -624,8 +623,7 @@ int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr,
                 return 1;
 
         mutex_lock(&tree->mutex);
-        list_for_each_prev(cur, &ordered->list) {
-                ordered_sum = list_entry(cur, struct btrfs_ordered_sum, list);
+        list_for_each_entry_reverse(ordered_sum, &ordered->list, list) {
                 if (disk_bytenr >= ordered_sum->bytenr) {
                         num_sectors = ordered_sum->len / sectorsize;
                         sector_sums = ordered_sum->sums;
diff --git a/fs/btrfs/ref-cache.c b/fs/btrfs/ref-cache.c
index 6f0acc4c9eab..d0cc62bccb94 100644
--- a/fs/btrfs/ref-cache.c
+++ b/fs/btrfs/ref-cache.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/sort.h>
 #include "ctree.h"
 #include "ref-cache.h"
 #include "transaction.h"
diff --git a/fs/btrfs/ref-cache.h b/fs/btrfs/ref-cache.h
index 16f3183d7c59..bc283ad2db73 100644
--- a/fs/btrfs/ref-cache.h
+++ b/fs/btrfs/ref-cache.h
@@ -73,5 +73,4 @@ int btrfs_add_leaf_ref(struct btrfs_root *root, struct btrfs_leaf_ref *ref,
 int btrfs_remove_leaf_refs(struct btrfs_root *root, u64 max_root_gen,
                            int shared);
 int btrfs_remove_leaf_ref(struct btrfs_root *root, struct btrfs_leaf_ref *ref);
-
 #endif
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index db9fb3bc1e33..f3fd7e2cbc38 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -37,7 +37,6 @@
 #include <linux/ctype.h>
 #include <linux/namei.h>
 #include <linux/miscdevice.h>
-#include <linux/version.h>
 #include <linux/magic.h>
 #include "compat.h"
 #include "ctree.h"
@@ -583,17 +582,18 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
         struct btrfs_ioctl_vol_args *vol;
         struct btrfs_fs_devices *fs_devices;
         int ret = -ENOTTY;
-        int len;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
         vol = kmalloc(sizeof(*vol), GFP_KERNEL);
+        if (!vol)
+                return -ENOMEM;
+
         if (copy_from_user(vol, (void __user *)arg, sizeof(*vol))) {
                 ret = -EFAULT;
                 goto out;
         }
-        len = strnlen(vol->name, BTRFS_PATH_NAME_MAX);
 
         switch (cmd) {
         case BTRFS_IOC_SCAN_DEV:
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 8a08f9443340..919172de5c9a 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -852,11 +852,9 @@ static noinline int create_pending_snapshots(struct btrfs_trans_handle *trans,
 {
         struct btrfs_pending_snapshot *pending;
         struct list_head *head = &trans->transaction->pending_snapshots;
-        struct list_head *cur;
         int ret;
 
-        list_for_each(cur, head) {
-                pending = list_entry(cur, struct btrfs_pending_snapshot, list);
+        list_for_each_entry(pending, head, list) {
                 ret = create_pending_snapshot(trans, fs_info, pending);
                 BUG_ON(ret);
         }
diff --git a/fs/btrfs/tree-defrag.c b/fs/btrfs/tree-defrag.c
index 3e8358c36165..98d25fa4570e 100644
--- a/fs/btrfs/tree-defrag.c
+++ b/fs/btrfs/tree-defrag.c
@@ -74,6 +74,7 @@ int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
                 u32 nritems;
 
                 root_node = btrfs_lock_root_node(root);
+                btrfs_set_lock_blocking(root_node);
                 nritems = btrfs_header_nritems(root_node);
                 root->defrag_max.objectid = 0;
                 /* from above we know this is not a leaf */
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index d81cda2e077c..20794290256b 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -78,104 +78,6 @@ static int link_to_fixup_dir(struct btrfs_trans_handle *trans,
  */
 
 /*
- * btrfs_add_log_tree adds a new per-subvolume log tree into the
- * tree of log tree roots.  This must be called with a tree log transaction
- * running (see start_log_trans).
- */
-static int btrfs_add_log_tree(struct btrfs_trans_handle *trans,
-                      struct btrfs_root *root)
-{
-        struct btrfs_key key;
-        struct btrfs_root_item root_item;
-        struct btrfs_inode_item *inode_item;
-        struct extent_buffer *leaf;
-        struct btrfs_root *new_root = root;
-        int ret;
-        u64 objectid = root->root_key.objectid;
-
-        leaf = btrfs_alloc_free_block(trans, root, root->leafsize, 0,
-                                      BTRFS_TREE_LOG_OBJECTID,
-                                      trans->transid, 0, 0, 0);
-        if (IS_ERR(leaf)) {
-                ret = PTR_ERR(leaf);
-                return ret;
-        }
-
-        btrfs_set_header_nritems(leaf, 0);
-        btrfs_set_header_level(leaf, 0);
-        btrfs_set_header_bytenr(leaf, leaf->start);
-        btrfs_set_header_generation(leaf, trans->transid);
-        btrfs_set_header_owner(leaf, BTRFS_TREE_LOG_OBJECTID);
-
-        write_extent_buffer(leaf, root->fs_info->fsid,
-                            (unsigned long)btrfs_header_fsid(leaf),
-                            BTRFS_FSID_SIZE);
-        btrfs_mark_buffer_dirty(leaf);
-
-        inode_item = &root_item.inode;
-        memset(inode_item, 0, sizeof(*inode_item));
-        inode_item->generation = cpu_to_le64(1);
-        inode_item->size = cpu_to_le64(3);
-        inode_item->nlink = cpu_to_le32(1);
-        inode_item->nbytes = cpu_to_le64(root->leafsize);
-        inode_item->mode = cpu_to_le32(S_IFDIR | 0755);
-
-        btrfs_set_root_bytenr(&root_item, leaf->start);
-        btrfs_set_root_generation(&root_item, trans->transid);
-        btrfs_set_root_level(&root_item, 0);
-        btrfs_set_root_refs(&root_item, 0);
-        btrfs_set_root_used(&root_item, 0);
-
-        memset(&root_item.drop_progress, 0, sizeof(root_item.drop_progress));
-        root_item.drop_level = 0;
-
-        btrfs_tree_unlock(leaf);
-        free_extent_buffer(leaf);
-        leaf = NULL;
-
-        btrfs_set_root_dirid(&root_item, 0);
-
-        key.objectid = BTRFS_TREE_LOG_OBJECTID;
-        key.offset = objectid;
-        btrfs_set_key_type(&key, BTRFS_ROOT_ITEM_KEY);
-        ret = btrfs_insert_root(trans, root->fs_info->log_root_tree, &key,
-                                &root_item);
-        if (ret)
-                goto fail;
-
-        new_root = btrfs_read_fs_root_no_radix(root->fs_info->log_root_tree,
-                                               &key);
-        BUG_ON(!new_root);
-
-        WARN_ON(root->log_root);
-        root->log_root = new_root;
-
-        /*
-         * log trees do not get reference counted because they go away
-         * before a real commit is actually done.  They do store pointers
-         * to file data extents, and those reference counts still get
-         * updated (along with back refs to the log tree).
-         */
-        new_root->ref_cows = 0;
-        new_root->last_trans = trans->transid;
-
-        /*
-         * we need to make sure the root block for this new tree
-         * is marked as dirty in the dirty_log_pages tree.  This
-         * is how it gets flushed down to disk at tree log commit time.
-         *
-         * the tree logging mutex keeps others from coming in and changing
-         * the new_root->node, so we can safely access it here
-         */
-        set_extent_dirty(&new_root->dirty_log_pages, new_root->node->start,
-                         new_root->node->start + new_root->node->len - 1,
-                         GFP_NOFS);
-
-fail:
-        return ret;
-}
-
-/*
  * start a sub transaction and setup the log tree
  * this increments the log tree writer count to make the people
  * syncing the tree wait for us to finish
@@ -184,6 +86,14 @@ static int start_log_trans(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root)
 {
         int ret;
+
+        mutex_lock(&root->log_mutex);
+        if (root->log_root) {
+                root->log_batch++;
+                atomic_inc(&root->log_writers);
+                mutex_unlock(&root->log_mutex);
+                return 0;
+        }
         mutex_lock(&root->fs_info->tree_log_mutex);
         if (!root->fs_info->log_root_tree) {
                 ret = btrfs_init_log_root_tree(trans, root->fs_info);
@@ -193,9 +103,10 @@ static int start_log_trans(struct btrfs_trans_handle *trans,
                 ret = btrfs_add_log_tree(trans, root);
                 BUG_ON(ret);
         }
-        atomic_inc(&root->fs_info->tree_log_writers);
-        root->fs_info->tree_log_batch++;
         mutex_unlock(&root->fs_info->tree_log_mutex);
+        root->log_batch++;
+        atomic_inc(&root->log_writers);
+        mutex_unlock(&root->log_mutex);
         return 0;
 }
 
@@ -212,13 +123,12 @@ static int join_running_log_trans(struct btrfs_root *root)
         if (!root->log_root)
                 return -ENOENT;
 
-        mutex_lock(&root->fs_info->tree_log_mutex);
+        mutex_lock(&root->log_mutex);
         if (root->log_root) {
                 ret = 0;
-                atomic_inc(&root->fs_info->tree_log_writers);
-                root->fs_info->tree_log_batch++;
+                atomic_inc(&root->log_writers);
         }
-        mutex_unlock(&root->fs_info->tree_log_mutex);
+        mutex_unlock(&root->log_mutex);
         return ret;
 }
 
@@ -228,10 +138,11 @@ static int join_running_log_trans(struct btrfs_root *root)
  */
 static int end_log_trans(struct btrfs_root *root)
 {
-        atomic_dec(&root->fs_info->tree_log_writers);
-        smp_mb();
-        if (waitqueue_active(&root->fs_info->tree_log_wait))
-                wake_up(&root->fs_info->tree_log_wait);
+        if (atomic_dec_and_test(&root->log_writers)) {
+                smp_mb();
+                if (waitqueue_active(&root->log_writer_wait))
+                        wake_up(&root->log_writer_wait);
+        }
         return 0;
 }
 
@@ -1704,6 +1615,7 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
 
                                 btrfs_tree_lock(next);
                                 clean_tree_block(trans, root, next);
+                                btrfs_set_lock_blocking(next);
                                 btrfs_wait_tree_block_writeback(next);
                                 btrfs_tree_unlock(next);
 
@@ -1750,6 +1662,7 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
                 next = path->nodes[*level];
                 btrfs_tree_lock(next);
                 clean_tree_block(trans, root, next);
+                btrfs_set_lock_blocking(next);
                 btrfs_wait_tree_block_writeback(next);
                 btrfs_tree_unlock(next);
 
@@ -1807,6 +1720,7 @@ static noinline int walk_up_log_tree(struct btrfs_trans_handle *trans,
 
                                 btrfs_tree_lock(next);
                                 clean_tree_block(trans, root, next);
+                                btrfs_set_lock_blocking(next);
                                 btrfs_wait_tree_block_writeback(next);
                                 btrfs_tree_unlock(next);
 
@@ -1879,6 +1793,7 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
 
                         btrfs_tree_lock(next);
                         clean_tree_block(trans, log, next);
+                        btrfs_set_lock_blocking(next);
                         btrfs_wait_tree_block_writeback(next);
                         btrfs_tree_unlock(next);
 
@@ -1902,26 +1817,65 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
                 }
         }
         btrfs_free_path(path);
-        if (wc->free)
-                free_extent_buffer(log->node);
         return ret;
 }
 
-static int wait_log_commit(struct btrfs_root *log)
+/*
+ * helper function to update the item for a given subvolumes log root
+ * in the tree of log roots
+ */
+static int update_log_root(struct btrfs_trans_handle *trans,
+                           struct btrfs_root *log)
+{
+        int ret;
+
+        if (log->log_transid == 1) {
+                /* insert root item on the first sync */
+                ret = btrfs_insert_root(trans, log->fs_info->log_root_tree,
+                                &log->root_key, &log->root_item);
+        } else {
+                ret = btrfs_update_root(trans, log->fs_info->log_root_tree,
+                                &log->root_key, &log->root_item);
+        }
+        return ret;
+}
+
+static int wait_log_commit(struct btrfs_root *root, unsigned long transid)
 {
         DEFINE_WAIT(wait);
-        u64 transid = log->fs_info->tree_log_transid;
+        int index = transid % 2;
 
+        /*
+         * we only allow two pending log transactions at a time,
+         * so we know that if ours is more than 2 older than the
+         * current transaction, we're done
+         */
         do {
-                prepare_to_wait(&log->fs_info->tree_log_wait, &wait,
-                                TASK_UNINTERRUPTIBLE);
-                mutex_unlock(&log->fs_info->tree_log_mutex);
-                if (atomic_read(&log->fs_info->tree_log_commit))
+                prepare_to_wait(&root->log_commit_wait[index],
+                                &wait, TASK_UNINTERRUPTIBLE);
+                mutex_unlock(&root->log_mutex);
+                if (root->log_transid < transid + 2 &&
+                    atomic_read(&root->log_commit[index]))
                         schedule();
-                finish_wait(&log->fs_info->tree_log_wait, &wait);
-                mutex_lock(&log->fs_info->tree_log_mutex);
-        } while (transid == log->fs_info->tree_log_transid &&
-                atomic_read(&log->fs_info->tree_log_commit));
+                finish_wait(&root->log_commit_wait[index], &wait);
+                mutex_lock(&root->log_mutex);
+        } while (root->log_transid < transid + 2 &&
+                 atomic_read(&root->log_commit[index]));
+        return 0;
+}
+
+static int wait_for_writer(struct btrfs_root *root)
+{
+        DEFINE_WAIT(wait);
+        while (atomic_read(&root->log_writers)) {
+                prepare_to_wait(&root->log_writer_wait,
+                                &wait, TASK_UNINTERRUPTIBLE);
+                mutex_unlock(&root->log_mutex);
+                if (atomic_read(&root->log_writers))
+                        schedule();
+                mutex_lock(&root->log_mutex);
+                finish_wait(&root->log_writer_wait, &wait);
+        }
         return 0;
 }
 
@@ -1933,57 +1887,114 @@ static int wait_log_commit(struct btrfs_root *log)
 int btrfs_sync_log(struct btrfs_trans_handle *trans,
                    struct btrfs_root *root)
 {
+        int index1;
+        int index2;
         int ret;
-        unsigned long batch;
         struct btrfs_root *log = root->log_root;
+        struct btrfs_root *log_root_tree = root->fs_info->log_root_tree;
 
-        mutex_lock(&log->fs_info->tree_log_mutex);
-        if (atomic_read(&log->fs_info->tree_log_commit)) {
-                wait_log_commit(log);
-                goto out;
+        mutex_lock(&root->log_mutex);
+        index1 = root->log_transid % 2;
+        if (atomic_read(&root->log_commit[index1])) {
+                wait_log_commit(root, root->log_transid);
+                mutex_unlock(&root->log_mutex);
+                return 0;
         }
-        atomic_set(&log->fs_info->tree_log_commit, 1);
+        atomic_set(&root->log_commit[index1], 1);
+
+        /* wait for previous tree log sync to complete */
+        if (atomic_read(&root->log_commit[(index1 + 1) % 2]))
+                wait_log_commit(root, root->log_transid - 1);
 
         while (1) {
-                batch = log->fs_info->tree_log_batch;
-                mutex_unlock(&log->fs_info->tree_log_mutex);
+                unsigned long batch = root->log_batch;
+                mutex_unlock(&root->log_mutex);
                 schedule_timeout_uninterruptible(1);
-                mutex_lock(&log->fs_info->tree_log_mutex);
-
-                while (atomic_read(&log->fs_info->tree_log_writers)) {
-                        DEFINE_WAIT(wait);
-                        prepare_to_wait(&log->fs_info->tree_log_wait, &wait,
-                                        TASK_UNINTERRUPTIBLE);
-                        mutex_unlock(&log->fs_info->tree_log_mutex);
-                        if (atomic_read(&log->fs_info->tree_log_writers))
-                                schedule();
-                        mutex_lock(&log->fs_info->tree_log_mutex);
-                        finish_wait(&log->fs_info->tree_log_wait, &wait);
-                }
-                if (batch == log->fs_info->tree_log_batch)
+                mutex_lock(&root->log_mutex);
+                wait_for_writer(root);
+                if (batch == root->log_batch)
                         break;
         }
 
         ret = btrfs_write_and_wait_marked_extents(log, &log->dirty_log_pages);
         BUG_ON(ret);
-        ret = btrfs_write_and_wait_marked_extents(root->fs_info->log_root_tree,
-                               &root->fs_info->log_root_tree->dirty_log_pages);
+
+        btrfs_set_root_bytenr(&log->root_item, log->node->start);
+        btrfs_set_root_generation(&log->root_item, trans->transid);
+        btrfs_set_root_level(&log->root_item, btrfs_header_level(log->node));
+
+        root->log_batch = 0;
+        root->log_transid++;
+        log->log_transid = root->log_transid;
+        smp_mb();
+        /*
+         * log tree has been flushed to disk, new modifications of
+         * the log will be written to new positions. so it's safe to
+         * allow log writers to go in.
+         */
+        mutex_unlock(&root->log_mutex);
+
+        mutex_lock(&log_root_tree->log_mutex);
+        log_root_tree->log_batch++;
+        atomic_inc(&log_root_tree->log_writers);
+        mutex_unlock(&log_root_tree->log_mutex);
+
+        ret = update_log_root(trans, log);
+        BUG_ON(ret);
+
+        mutex_lock(&log_root_tree->log_mutex);
+        if (atomic_dec_and_test(&log_root_tree->log_writers)) {
+                smp_mb();
+                if (waitqueue_active(&log_root_tree->log_writer_wait))
+                        wake_up(&log_root_tree->log_writer_wait);
+        }
+
+        index2 = log_root_tree->log_transid % 2;
+        if (atomic_read(&log_root_tree->log_commit[index2])) {
+                wait_log_commit(log_root_tree, log_root_tree->log_transid);
+                mutex_unlock(&log_root_tree->log_mutex);
+                goto out;
+        }
+        atomic_set(&log_root_tree->log_commit[index2], 1);
+
+        if (atomic_read(&log_root_tree->log_commit[(index2 + 1) % 2]))
+                wait_log_commit(log_root_tree, log_root_tree->log_transid - 1);
+
+        wait_for_writer(log_root_tree);
+
+        ret = btrfs_write_and_wait_marked_extents(log_root_tree,
+                                &log_root_tree->dirty_log_pages);
         BUG_ON(ret);
 
         btrfs_set_super_log_root(&root->fs_info->super_for_commit,
-                                 log->fs_info->log_root_tree->node->start);
+                                log_root_tree->node->start);
         btrfs_set_super_log_root_level(&root->fs_info->super_for_commit,
-                       btrfs_header_level(log->fs_info->log_root_tree->node));
+                                btrfs_header_level(log_root_tree->node));
+
+        log_root_tree->log_batch = 0;
+        log_root_tree->log_transid++;
+        smp_mb();
+
+        mutex_unlock(&log_root_tree->log_mutex);
+
+        /*
+         * nobody else is going to jump in and write the the ctree
+         * super here because the log_commit atomic below is protecting
+         * us.  We must be called with a transaction handle pinning
+         * the running transaction open, so a full commit can't hop
+         * in and cause problems either.
+         */
+        write_ctree_super(trans, root->fs_info->tree_root, 2);
 
-        write_ctree_super(trans, log->fs_info->tree_root, 2);
-        log->fs_info->tree_log_transid++;
-        log->fs_info->tree_log_batch = 0;
-        atomic_set(&log->fs_info->tree_log_commit, 0);
+        atomic_set(&log_root_tree->log_commit[index2], 0);
         smp_mb();
-        if (waitqueue_active(&log->fs_info->tree_log_wait))
-                wake_up(&log->fs_info->tree_log_wait);
+        if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
+                wake_up(&log_root_tree->log_commit_wait[index2]);
 out:
-        mutex_unlock(&log->fs_info->tree_log_mutex);
+        atomic_set(&root->log_commit[index1], 0);
+        smp_mb();
+        if (waitqueue_active(&root->log_commit_wait[index1]))
+                wake_up(&root->log_commit_wait[index1]);
         return 0;
 }
 
@@ -2019,38 +2030,18 @@ int btrfs_free_log(struct btrfs_trans_handle *trans, struct btrfs_root *root)
                                    start, end, GFP_NOFS);
         }
 
-        log = root->log_root;
-        ret = btrfs_del_root(trans, root->fs_info->log_root_tree,
-                             &log->root_key);
-        BUG_ON(ret);
+        if (log->log_transid > 0) {
+                ret = btrfs_del_root(trans, root->fs_info->log_root_tree,
+                                     &log->root_key);
+                BUG_ON(ret);
+        }
         root->log_root = NULL;
-        kfree(root->log_root);
+        free_extent_buffer(log->node);
+        kfree(log);
         return 0;
 }
 
 /*
- * helper function to update the item for a given subvolumes log root
- * in the tree of log roots
- */
-static int update_log_root(struct btrfs_trans_handle *trans,
-                           struct btrfs_root *log)
-{
-        u64 bytenr = btrfs_root_bytenr(&log->root_item);
-        int ret;
-
-        if (log->node->start == bytenr)
-                return 0;
-
-        btrfs_set_root_bytenr(&log->root_item, log->node->start);
-        btrfs_set_root_generation(&log->root_item, trans->transid);
-        btrfs_set_root_level(&log->root_item, btrfs_header_level(log->node));
-        ret = btrfs_update_root(trans, log->fs_info->log_root_tree,
-                                &log->root_key, &log->root_item);
-        BUG_ON(ret);
-        return ret;
-}
-
-/*
  * If both a file and directory are logged, and unlinks or renames are
  * mixed in, we have a few interesting corners:
  *
@@ -2711,11 +2702,6 @@ next_slot:
 
         btrfs_free_path(path);
         btrfs_free_path(dst_path);
-
-        mutex_lock(&root->fs_info->tree_log_mutex);
-        ret = update_log_root(trans, log);
-        BUG_ON(ret);
-        mutex_unlock(&root->fs_info->tree_log_mutex);
 out:
         return 0;
 }
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 3451e1cca2b5..bcd14ebccae1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -20,7 +20,6 @@
 #include <linux/buffer_head.h>
 #include <linux/blkdev.h>
 #include <linux/random.h>
-#include <linux/version.h>
 #include <asm/div64.h>
 #include "compat.h"
 #include "ctree.h"
@@ -104,10 +103,8 @@ static noinline struct btrfs_device *__find_device(struct list_head *head,
                                                    u64 devid, u8 *uuid)
 {
         struct btrfs_device *dev;
-        struct list_head *cur;
 
-        list_for_each(cur, head) {
-                dev = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(dev, head, dev_list) {
                 if (dev->devid == devid &&
                     (!uuid || !memcmp(dev->uuid, uuid, BTRFS_UUID_SIZE))) {
                         return dev;
@@ -118,11 +115,9 @@ static noinline struct btrfs_device *__find_device(struct list_head *head,
 
 static noinline struct btrfs_fs_devices *find_fsid(u8 *fsid)
 {
-        struct list_head *cur;
         struct btrfs_fs_devices *fs_devices;
 
-        list_for_each(cur, &fs_uuids) {
-                fs_devices = list_entry(cur, struct btrfs_fs_devices, list);
+        list_for_each_entry(fs_devices, &fs_uuids, list) {
                 if (memcmp(fsid, fs_devices->fsid, BTRFS_FSID_SIZE) == 0)
                         return fs_devices;
         }
@@ -159,6 +154,7 @@ static noinline int run_scheduled_bios(struct btrfs_device *device)
 loop:
         spin_lock(&device->io_lock);
 
+loop_lock:
         /* take all the bios off the list at once and process them
          * later on (without the lock held).  But, remember the
          * tail and other pointers so the bios can be properly reinserted
@@ -208,7 +204,7 @@ loop:
                  * is now congested.  Back off and let other work structs
                  * run instead
                  */
-                if (pending && bdi_write_congested(bdi) &&
+                if (pending && bdi_write_congested(bdi) && num_run > 16 &&
                     fs_info->fs_devices->open_devices > 1) {
                         struct bio *old_head;
 
@@ -220,7 +216,8 @@ loop:
                                 tail->bi_next = old_head;
                         else
                                 device->pending_bio_tail = tail;
-                        device->running_pending = 0;
+
+                        device->running_pending = 1;
 
                         spin_unlock(&device->io_lock);
                         btrfs_requeue_work(&device->work);
@@ -229,6 +226,11 @@ loop:
         }
         if (again)
                 goto loop;
+
+        spin_lock(&device->io_lock);
+        if (device->pending_bios)
+                goto loop_lock;
+        spin_unlock(&device->io_lock);
 done:
         return 0;
 }
@@ -345,14 +347,11 @@ error:
 
 int btrfs_close_extra_devices(struct btrfs_fs_devices *fs_devices)
 {
-        struct list_head *tmp;
-        struct list_head *cur;
-        struct btrfs_device *device;
+        struct btrfs_device *device, *next;
 
         mutex_lock(&uuid_mutex);
 again:
-        list_for_each_safe(cur, tmp, &fs_devices->devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry_safe(device, next, &fs_devices->devices, dev_list) {
                 if (device->in_fs_metadata)
                         continue;
 
@@ -383,14 +382,12 @@ again:
 
 static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
 {
-        struct list_head *cur;
         struct btrfs_device *device;
 
         if (--fs_devices->opened > 0)
                 return 0;
 
-        list_for_each(cur, &fs_devices->devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, &fs_devices->devices, dev_list) {
                 if (device->bdev) {
                         close_bdev_exclusive(device->bdev, device->mode);
                         fs_devices->open_devices--;
@@ -439,7 +436,6 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
 {
         struct block_device *bdev;
         struct list_head *head = &fs_devices->devices;
-        struct list_head *cur;
         struct btrfs_device *device;
         struct block_device *latest_bdev = NULL;
         struct buffer_head *bh;
@@ -450,8 +446,7 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
         int seeding = 1;
         int ret = 0;
 
-        list_for_each(cur, head) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, head, dev_list) {
                 if (device->bdev)
                         continue;
                 if (!device->name)
@@ -578,7 +573,7 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
                        *(unsigned long long *)disk_super->fsid,
                        *(unsigned long long *)(disk_super->fsid + 8));
         }
-        printk(KERN_INFO "devid %llu transid %llu %s\n",
+        printk(KERN_CONT "devid %llu transid %llu %s\n",
                (unsigned long long)devid, (unsigned long long)transid, path);
         ret = device_list_add(path, disk_super, devid, fs_devices_ret);
 
@@ -1017,14 +1012,12 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
         }
 
         if (strcmp(device_path, "missing") == 0) {
-                struct list_head *cur;
                 struct list_head *devices;
                 struct btrfs_device *tmp;
 
                 device = NULL;
                 devices = &root->fs_info->fs_devices->devices;
-                list_for_each(cur, devices) {
-                        tmp = list_entry(cur, struct btrfs_device, dev_list);
+                list_for_each_entry(tmp, devices, dev_list) {
                         if (tmp->in_fs_metadata && !tmp->bdev) {
                                 device = tmp;
                                 break;
@@ -1280,7 +1273,6 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         struct btrfs_trans_handle *trans;
         struct btrfs_device *device;
         struct block_device *bdev;
-        struct list_head *cur;
         struct list_head *devices;
         struct super_block *sb = root->fs_info->sb;
         u64 total_bytes;
@@ -1304,8 +1296,7 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         mutex_lock(&root->fs_info->volume_mutex);
 
         devices = &root->fs_info->fs_devices->devices;
-        list_for_each(cur, devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, devices, dev_list) {
                 if (device->bdev == bdev) {
                         ret = -EEXIST;
                         goto error;
@@ -1704,7 +1695,6 @@ static u64 div_factor(u64 num, int factor)
 int btrfs_balance(struct btrfs_root *dev_root)
 {
         int ret;
-        struct list_head *cur;
         struct list_head *devices = &dev_root->fs_info->fs_devices->devices;
         struct btrfs_device *device;
         u64 old_size;
@@ -1723,8 +1713,7 @@ int btrfs_balance(struct btrfs_root *dev_root)
         dev_root = dev_root->fs_info->dev_root;
 
         /* step one make some room on all the devices */
-        list_for_each(cur, devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, devices, dev_list) {
                 old_size = device->total_bytes;
                 size_to_free = div_factor(old_size, 1);
                 size_to_free = min(size_to_free, (u64)1 * 1024 * 1024);
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index 7f332e270894..a9d3bf4d2689 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -21,6 +21,7 @@
 #include <linux/slab.h>
 #include <linux/rwsem.h>
 #include <linux/xattr.h>
+#include <linux/security.h>
 #include "ctree.h"
 #include "btrfs_inode.h"
 #include "transaction.h"
@@ -45,9 +46,12 @@ ssize_t __btrfs_getxattr(struct inode *inode, const char *name,
         /* lookup the xattr by name */
         di = btrfs_lookup_xattr(NULL, root, path, inode->i_ino, name,
                                 strlen(name), 0);
-        if (!di || IS_ERR(di)) {
+        if (!di) {
                 ret = -ENODATA;
                 goto out;
+        } else if (IS_ERR(di)) {
+                ret = PTR_ERR(di);
+                goto out;
         }
 
         leaf = path->nodes[0];
@@ -62,6 +66,14 @@ ssize_t __btrfs_getxattr(struct inode *inode, const char *name,
                 ret = -ERANGE;
                 goto out;
         }
+
+        /*
+         * The way things are packed into the leaf is like this
+         * |struct btrfs_dir_item|name|data|
+         * where name is the xattr name, so security.foo, and data is the
+         * content of the xattr.  data_ptr points to the location in memory
+         * where the data starts in the in memory leaf
+         */
         data_ptr = (unsigned long)((char *)(di + 1) +
                                    btrfs_dir_name_len(leaf, di));
         read_extent_buffer(leaf, buffer, data_ptr,
@@ -86,7 +98,7 @@ int __btrfs_setxattr(struct inode *inode, const char *name,
         if (!path)
                 return -ENOMEM;
 
-        trans = btrfs_start_transaction(root, 1);
+        trans = btrfs_join_transaction(root, 1);
         btrfs_set_trans_block_group(trans, inode);
 
         /* first lets see if we already have this xattr */
@@ -176,7 +188,6 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size)
         ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
         if (ret < 0)
                 goto err;
-        ret = 0;
         advance = 0;
         while (1) {
                 leaf = path->nodes[0];
@@ -320,3 +331,34 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
                 return -EOPNOTSUPP;
         return __btrfs_setxattr(dentry->d_inode, name, NULL, 0, XATTR_REPLACE);
 }
+
+int btrfs_xattr_security_init(struct inode *inode, struct inode *dir)
+{
+        int err;
+        size_t len;
+        void *value;
+        char *suffix;
+        char *name;
+
+        err = security_inode_init_security(inode, dir, &suffix, &value, &len);
+        if (err) {
+                if (err == -EOPNOTSUPP)
+                        return 0;
+                return err;
+        }
+
+        name = kmalloc(XATTR_SECURITY_PREFIX_LEN + strlen(suffix) + 1,
+                       GFP_NOFS);
+        if (!name) {
+                err = -ENOMEM;
+        } else {
+                strcpy(name, XATTR_SECURITY_PREFIX);
+                strcpy(name + XATTR_SECURITY_PREFIX_LEN, suffix);
+                err = __btrfs_setxattr(inode, name, value, len, 0);
+                kfree(name);
+        }
+
+        kfree(suffix);
+        kfree(value);
+        return err;
+}
diff --git a/fs/btrfs/xattr.h b/fs/btrfs/xattr.h
index 5b1d08f8e68d..c71e9c3cf3f7 100644
--- a/fs/btrfs/xattr.h
+++ b/fs/btrfs/xattr.h
@@ -36,4 +36,6 @@ extern int btrfs_setxattr(struct dentry *dentry, const char *name,
                 const void *value, size_t size, int flags);
 extern int btrfs_removexattr(struct dentry *dentry, const char *name);
 
+extern int btrfs_xattr_security_init(struct inode *inode, struct inode *dir);
+
 #endif /* __XATTR__ */
diff --git a/fs/buffer.c b/fs/buffer.c
index b58208f1640a..665d446b25bc 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2688,7 +2688,7 @@ int nobh_write_end(struct file *file, struct address_space *mapping,
         struct buffer_head *bh;
         BUG_ON(fsdata != NULL && page_has_buffers(page));
 
-        if (unlikely(copied < len) && !page_has_buffers(page))
+        if (unlikely(copied < len) && head)
                 attach_nobh_buffers(page, head);
         if (page_has_buffers(page))
                 return generic_write_end(file, mapping, pos, len,
diff --git a/fs/compat.c b/fs/compat.c
index 65a070e705ab..d0145ca27572 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1407,7 +1407,7 @@ int compat_do_execve(char * filename,
         bprm->cred = prepare_exec_creds();
         if (!bprm->cred)
                 goto out_unlock;
-        check_unsafe_exec(bprm);
+        check_unsafe_exec(bprm, current->files);
 
         file = open_exec(filename);
         retval = PTR_ERR(file);
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index c8f8d5904f5e..9c6d815dd191 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -785,7 +785,7 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
 
         if (copy_in_user(&sgio->status, &sgio32->status,
                          (4 * sizeof(unsigned char)) +
-                         (2 * sizeof(unsigned (short))) +
+                         (2 * sizeof(unsigned short)) +
                          (3 * sizeof(int))))
                 return -EFAULT;
 
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 9c2358391147..8e93341f3e82 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -553,24 +553,12 @@ static void detach_groups(struct config_group *group)
 
                 child = sd->s_dentry;
 
-                /*
-                 * Note: we hide this from lockdep since we have no way
-                 * to teach lockdep about recursive
-                 * I_MUTEX_PARENT -> I_MUTEX_CHILD patterns along a path
-                 * in an inode tree, which are valid as soon as
-                 * I_MUTEX_PARENT -> I_MUTEX_CHILD is valid from a
-                 * parent inode to one of its children.
-                 */
-                lockdep_off();
                 mutex_lock(&child->d_inode->i_mutex);
-                lockdep_on();
 
                 configfs_detach_group(sd->s_element);
                 child->d_inode->i_flags |= S_DEAD;
 
-                lockdep_off();
                 mutex_unlock(&child->d_inode->i_mutex);
-                lockdep_on();
 
                 d_delete(child);
                 dput(child);
@@ -760,22 +748,11 @@ static int configfs_attach_item(struct config_item *parent_item,
                          * We are going to remove an inode and its dentry but
                          * the VFS may already have hit and used them. Thus,
                          * we must lock them as rmdir() would.
-                         *
-                         * Note: we hide this from lockdep since we have no way
-                         * to teach lockdep about recursive
-                         * I_MUTEX_PARENT -> I_MUTEX_CHILD patterns along a path
-                         * in an inode tree, which are valid as soon as
-                         * I_MUTEX_PARENT -> I_MUTEX_CHILD is valid from a
-                         * parent inode to one of its children.
                          */
-                        lockdep_off();
                         mutex_lock(&dentry->d_inode->i_mutex);
-                        lockdep_on();
                         configfs_remove_dir(item);
                         dentry->d_inode->i_flags |= S_DEAD;
-                        lockdep_off();
                         mutex_unlock(&dentry->d_inode->i_mutex);
-                        lockdep_on();
                         d_delete(dentry);
                 }
         }
@@ -810,25 +787,14 @@ static int configfs_attach_group(struct config_item *parent_item,
                  *
                  * We must also lock the inode to remove it safely in case of
                  * error, as rmdir() would.
-                 *
-                 * Note: we hide this from lockdep since we have no way
-                 * to teach lockdep about recursive
-                 * I_MUTEX_PARENT -> I_MUTEX_CHILD patterns along a path
-                 * in an inode tree, which are valid as soon as
-                 * I_MUTEX_PARENT -> I_MUTEX_CHILD is valid from a
-                 * parent inode to one of its children.
                  */
-                lockdep_off();
                 mutex_lock_nested(&dentry->d_inode->i_mutex, I_MUTEX_CHILD);
-                lockdep_on();
                 ret = populate_groups(to_config_group(item));
                 if (ret) {
                         configfs_detach_item(item);
                         dentry->d_inode->i_flags |= S_DEAD;
                 }
-                lockdep_off();
                 mutex_unlock(&dentry->d_inode->i_mutex);
-                lockdep_on();
                 if (ret)
                         d_delete(dentry);
         }
@@ -990,17 +956,7 @@ static int configfs_depend_prep(struct dentry *origin,
         BUG_ON(!origin || !sd);
 
         /* Lock this guy on the way down */
-        /*
-         * Note: we hide this from lockdep since we have no way
-         * to teach lockdep about recursive
-         * I_MUTEX_PARENT -> I_MUTEX_CHILD patterns along a path
-         * in an inode tree, which are valid as soon as
-         * I_MUTEX_PARENT -> I_MUTEX_CHILD is valid from a
-         * parent inode to one of its children.
-         */
-        lockdep_off();
         mutex_lock(&sd->s_dentry->d_inode->i_mutex);
-        lockdep_on();
         if (sd->s_element == target)  /* Boo-yah */
                 goto out;
 
@@ -1014,9 +970,7 @@ static int configfs_depend_prep(struct dentry *origin,
         }
 
         /* We looped all our children and didn't find target */
-        lockdep_off();
         mutex_unlock(&sd->s_dentry->d_inode->i_mutex);
-        lockdep_on();
         ret = -ENOENT;
 
 out:
@@ -1036,16 +990,11 @@ static void configfs_depend_rollback(struct dentry *origin,
         struct dentry *dentry = item->ci_dentry;
 
         while (dentry != origin) {
-                /* See comments in configfs_depend_prep() */
-                lockdep_off();
                 mutex_unlock(&dentry->d_inode->i_mutex);
-                lockdep_on();
                 dentry = dentry->d_parent;
         }
 
-        lockdep_off();
         mutex_unlock(&origin->d_inode->i_mutex);
-        lockdep_on();
 }
 
 int configfs_depend_item(struct configfs_subsystem *subsys,
@@ -1380,16 +1329,8 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
                         }
 
                         /* Wait until the racing operation terminates */
-                        /*
-                         * Note: we hide this from lockdep since we are locked
-                         * with subclass I_MUTEX_NORMAL from vfs_rmdir() (why
-                         * not I_MUTEX_CHILD?), and I_MUTEX_XATTR or
-                         * I_MUTEX_QUOTA are not relevant for the locked inode.
-                         */
-                        lockdep_off();
                         mutex_lock(wait_mutex);
                         mutex_unlock(wait_mutex);
-                        lockdep_on();
                 }
         } while (ret == -EAGAIN);
 
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index c01e043670e2..f6caeb1d1106 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1716,7 +1716,7 @@ static int ecryptfs_copy_filename(char **copied_name, size_t *copied_name_size,
 {
         int rc = 0;
 
-        (*copied_name) = kmalloc((name_size + 2), GFP_KERNEL);
+        (*copied_name) = kmalloc((name_size + 1), GFP_KERNEL);
         if (!(*copied_name)) {
                 rc = -ENOMEM;
                 goto out;
@@ -1726,7 +1726,7 @@ static int ecryptfs_copy_filename(char **copied_name, size_t *copied_name_size,
                                                  * in printing out the
                                                  * string in debug
                                                  * messages */
-        (*copied_name_size) = (name_size + 1);
+        (*copied_name_size) = name_size;
 out:
         return rc;
 }
diff --git a/fs/exec.c b/fs/exec.c
index 0dd60a01f1b4..929b58004b7e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1049,16 +1049,32 @@ EXPORT_SYMBOL(install_exec_creds);
  * - the caller must hold current->cred_exec_mutex to protect against
  *   PTRACE_ATTACH
  */
-void check_unsafe_exec(struct linux_binprm *bprm)
+void check_unsafe_exec(struct linux_binprm *bprm, struct files_struct *files)
 {
-        struct task_struct *p = current;
+        struct task_struct *p = current, *t;
+        unsigned long flags;
+        unsigned n_fs, n_files, n_sighand;
 
         bprm->unsafe = tracehook_unsafe_exec(p);
 
-        if (atomic_read(&p->fs->count) > 1 ||
-            atomic_read(&p->files->count) > 1 ||
-            atomic_read(&p->sighand->count) > 1)
+        n_fs = 1;
+        n_files = 1;
+        n_sighand = 1;
+        lock_task_sighand(p, &flags);
+        for (t = next_thread(p); t != p; t = next_thread(t)) {
+                if (t->fs == p->fs)
+                        n_fs++;
+                if (t->files == files)
+                        n_files++;
+                n_sighand++;
+        }
+
+        if (atomic_read(&p->fs->count) > n_fs ||
+            atomic_read(&p->files->count) > n_files ||
+            atomic_read(&p->sighand->count) > n_sighand)
                 bprm->unsafe |= LSM_UNSAFE_SHARE;
+
+        unlock_task_sighand(p, &flags);
 }
 
 /* 
@@ -1273,7 +1289,7 @@ int do_execve(char * filename,
         bprm->cred = prepare_exec_creds();
         if (!bprm->cred)
                 goto out_unlock;
-        check_unsafe_exec(bprm);
+        check_unsafe_exec(bprm, displaced);
 
         file = open_exec(filename);
         retval = PTR_ERR(file);
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 6903d37af037..9b800d97a687 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -108,7 +108,8 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
 
         if (hugetlb_reserve_pages(inode,
                                 vma->vm_pgoff >> huge_page_order(h),
-                                len >> huge_page_shift(h), vma))
+                                len >> huge_page_shift(h), vma,
+                                vma->vm_flags))
                 goto out;
 
         ret = 0;
@@ -947,7 +948,7 @@ static int can_do_hugetlb_shm(void)
                         can_do_mlock());
 }
 
-struct file *hugetlb_file_setup(const char *name, size_t size)
+struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag)
 {
         int error = -ENOMEM;
         struct file *file;
@@ -981,7 +982,8 @@ struct file *hugetlb_file_setup(const char *name, size_t size)
 
         error = -ENOMEM;
         if (hugetlb_reserve_pages(inode, 0,
-                        size >> huge_page_shift(hstate_inode(inode)), NULL))
+                        size >> huge_page_shift(hstate_inode(inode)), NULL,
+                        acctflag))
                 goto out_inode;
 
         d_instantiate(dentry, inode);
diff --git a/fs/internal.h b/fs/internal.h
index 53af885f1732..0d8ac497b3d5 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -43,7 +43,7 @@ extern void __init chrdev_init(void);
 /*
  * exec.c
  */
-extern void check_unsafe_exec(struct linux_binprm *);
+extern void check_unsafe_exec(struct linux_binprm *, struct files_struct *);
 
 /*
  * namespace.c
diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index 6063a8e4b9f3..763b78a6e9de 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -427,7 +427,7 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
                         goto out;
                 case -EAGAIN:
                         ret = nlm_lck_denied;
-                        goto out;
+                        break;
                 case FILE_LOCK_DEFERRED:
                         if (wait)
                                 break;
@@ -443,6 +443,10 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
                         goto out;
         }
 
+        ret = nlm_lck_denied;
+        if (!wait)
+                goto out;
+
         ret = nlm_lck_blocked;
 
         /* Append to list of blocked */
diff --git a/fs/seq_file.c b/fs/seq_file.c
index b569ff1c4dc8..5267098532bf 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -54,6 +54,64 @@ int seq_open(struct file *file, const struct seq_operations *op)
 }
 EXPORT_SYMBOL(seq_open);
 
+static int traverse(struct seq_file *m, loff_t offset)
+{
+        loff_t pos = 0, index;
+        int error = 0;
+        void *p;
+
+        m->version = 0;
+        index = 0;
+        m->count = m->from = 0;
+        if (!offset) {
+                m->index = index;
+                return 0;
+        }
+        if (!m->buf) {
+                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
+                if (!m->buf)
+                        return -ENOMEM;
+        }
+        p = m->op->start(m, &index);
+        while (p) {
+                error = PTR_ERR(p);
+                if (IS_ERR(p))
+                        break;
+                error = m->op->show(m, p);
+                if (error < 0)
+                        break;
+                if (unlikely(error)) {
+                        error = 0;
+                        m->count = 0;
+                }
+                if (m->count == m->size)
+                        goto Eoverflow;
+                if (pos + m->count > offset) {
+                        m->from = offset - pos;
+                        m->count -= m->from;
+                        m->index = index;
+                        break;
+                }
+                pos += m->count;
+                m->count = 0;
+                if (pos == offset) {
+                        index++;
+                        m->index = index;
+                        break;
+                }
+                p = m->op->next(m, p, &index);
+        }
+        m->op->stop(m, p);
+        m->index = index;
+        return error;
+
+Eoverflow:
+        m->op->stop(m, p);
+        kfree(m->buf);
+        m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+        return !m->buf ? -ENOMEM : -EAGAIN;
+}
+
 /**
  *      seq_read -      ->read() method for sequential files.
  *      @file: the file to read from
@@ -186,63 +244,6 @@ Efault:
 }
 EXPORT_SYMBOL(seq_read);
 
-static int traverse(struct seq_file *m, loff_t offset)
-{
-        loff_t pos = 0, index;
-        int error = 0;
-        void *p;
-
-        m->version = 0;
-        index = 0;
-        m->count = m->from = 0;
-        if (!offset) {
-                m->index = index;
-                return 0;
-        }
-        if (!m->buf) {
-                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-                if (!m->buf)
-                        return -ENOMEM;
-        }
-        p = m->op->start(m, &index);
-        while (p) {
-                error = PTR_ERR(p);
-                if (IS_ERR(p))
-                        break;
-                error = m->op->show(m, p);
-                if (error < 0)
-                        break;
-                if (unlikely(error)) {
-                        error = 0;
-                        m->count = 0;
-                }
-                if (m->count == m->size)
-                        goto Eoverflow;
-                if (pos + m->count > offset) {
-                        m->from = offset - pos;
-                        m->count -= m->from;
-                        m->index = index;
-                        break;
-                }
-                pos += m->count;
-                m->count = 0;
-                if (pos == offset) {
-                        index++;
-                        m->index = index;
-                        break;
-                }
-                p = m->op->next(m, p, &index);
-        }
-        m->op->stop(m, p);
-        return error;
-
-Eoverflow:
-        m->op->stop(m, p);
-        kfree(m->buf);
-        m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-        return !m->buf ? -ENOMEM : -EAGAIN;
-}
-
 /**
  *      seq_lseek -     ->llseek() method for sequential files.
  *      @file: the file in question
diff --git a/fs/super.c b/fs/super.c
index 645e5403f2a0..61dce001dd57 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -301,7 +301,7 @@ void generic_shutdown_super(struct super_block *sb)
                 /*
                  * wait for asynchronous fs operations to finish before going further
                  */
-                async_synchronize_full_special(&sb->s_async_list);
+                async_synchronize_full_domain(&sb->s_async_list);
 
                 /* bad name - it should be evict_inodes() */
                 invalidate_inodes(sb);
@@ -470,7 +470,7 @@ restart:
                 sb->s_count++;
                 spin_unlock(&sb_lock);
                 down_read(&sb->s_umount);
-                async_synchronize_full_special(&sb->s_async_list);
+                async_synchronize_full_domain(&sb->s_async_list);
                 if (sb->s_root && (wait || sb->s_dirt))
                         sb->s_op->sync_fs(sb, wait);
                 up_read(&sb->s_umount);
diff --git a/include/acpi/pdc_intel.h b/include/acpi/pdc_intel.h
index e72bfdd887f9..552637b0d051 100644
--- a/include/acpi/pdc_intel.h
+++ b/include/acpi/pdc_intel.h
@@ -14,6 +14,7 @@
 #define ACPI_PDC_SMP_T_SWCOORD          (0x0080)
 #define ACPI_PDC_C_C1_FFH               (0x0100)
 #define ACPI_PDC_C_C2C3_FFH             (0x0200)
+#define ACPI_PDC_SMP_P_HWCOORD          (0x0800)
 
 #define ACPI_PDC_EST_CAPABILITY_SMP     (ACPI_PDC_SMP_C1PT | \
                                          ACPI_PDC_C_C1_HALT | \
@@ -22,6 +23,7 @@
 #define ACPI_PDC_EST_CAPABILITY_SWSMP   (ACPI_PDC_SMP_C1PT | \
                                          ACPI_PDC_C_C1_HALT | \
                                          ACPI_PDC_SMP_P_SWCOORD | \
+                                         ACPI_PDC_SMP_P_HWCOORD | \
                                          ACPI_PDC_P_FFH)
 
 #define ACPI_PDC_C_CAPABILITY_SMP       (ACPI_PDC_SMP_C2C3  | \
diff --git a/include/crypto/hash.h b/include/crypto/hash.h
index cd16d6e668ce..d797e119e3d5 100644
--- a/include/crypto/hash.h
+++ b/include/crypto/hash.h
@@ -222,7 +222,7 @@ static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm)
 
 static inline void crypto_free_shash(struct crypto_shash *tfm)
 {
-        crypto_free_tfm(crypto_shash_tfm(tfm));
+        crypto_destroy_tfm(tfm, crypto_shash_tfm(tfm));
 }
 
 static inline unsigned int crypto_shash_alignmask(
diff --git a/include/drm/i915_drm.h b/include/drm/i915_drm.h
index b3bcf72dc656..912cd52db965 100644
--- a/include/drm/i915_drm.h
+++ b/include/drm/i915_drm.h
@@ -261,6 +261,7 @@ typedef struct drm_i915_irq_wait {
 #define I915_PARAM_LAST_DISPATCH         3
 #define I915_PARAM_CHIPSET_ID            4
 #define I915_PARAM_HAS_GEM               5
+#define I915_PARAM_NUM_FENCES_AVAIL      6
 
 typedef struct drm_i915_getparam {
         int param;
@@ -272,6 +273,7 @@ typedef struct drm_i915_getparam {
 #define I915_SETPARAM_USE_MI_BATCHBUFFER_START            1
 #define I915_SETPARAM_TEX_LRU_LOG_GRANULARITY             2
 #define I915_SETPARAM_ALLOW_BATCHBUFFER                   3
+#define I915_SETPARAM_NUM_USED_FENCES                     4
 
 typedef struct drm_i915_setparam {
         int param;
diff --git a/include/linux/async.h b/include/linux/async.h
index c4ecacd0b327..68a9530196f2 100644
--- a/include/linux/async.h
+++ b/include/linux/async.h
@@ -17,9 +17,11 @@ typedef u64 async_cookie_t;
 typedef void (async_func_ptr) (void *data, async_cookie_t cookie);
 
 extern async_cookie_t async_schedule(async_func_ptr *ptr, void *data);
-extern async_cookie_t async_schedule_special(async_func_ptr *ptr, void *data, struct list_head *list);
+extern async_cookie_t async_schedule_domain(async_func_ptr *ptr, void *data,
+                                            struct list_head *list);
 extern void async_synchronize_full(void);
-extern void async_synchronize_full_special(struct list_head *list);
+extern void async_synchronize_full_domain(struct list_head *list);
 extern void async_synchronize_cookie(async_cookie_t cookie);
-extern void async_synchronize_cookie_special(async_cookie_t cookie, struct list_head *list);
+extern void async_synchronize_cookie_domain(async_cookie_t cookie,
+                                            struct list_head *list);
 
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index 3bacd71509fb..1f2e9020acc6 100644
--- a/include/linux/crypto.h
+++ b/include/linux/crypto.h
@@ -552,7 +552,12 @@ struct crypto_tfm *crypto_alloc_tfm(const char *alg_name,
                                     const struct crypto_type *frontend,
                                     u32 type, u32 mask);
 struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask);
-void crypto_free_tfm(struct crypto_tfm *tfm);
+void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm);
+
+static inline void crypto_free_tfm(struct crypto_tfm *tfm)
+{
+        return crypto_destroy_tfm(tfm, tfm);
+}
 
 int alg_test(const char *driver, const char *alg, u32 type, u32 mask);
 
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 3e0f64c335c8..3e68469c1885 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -282,6 +282,18 @@ static inline void dmaengine_put(void)
 }
 #endif
 
+#ifdef CONFIG_NET_DMA
+#define net_dmaengine_get()     dmaengine_get()
+#define net_dmaengine_put()     dmaengine_put()
+#else
+static inline void net_dmaengine_get(void)
+{
+}
+static inline void net_dmaengine_put(void)
+{
+}
+#endif
+
 dma_cookie_t dma_async_memcpy_buf_to_buf(struct dma_chan *chan,
         void *dest, void *src, size_t len);
 dma_cookie_t dma_async_memcpy_buf_to_pg(struct dma_chan *chan,
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 818fe21257e8..31527e17076b 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -960,6 +960,21 @@ extern struct fb_info *registered_fb[FB_MAX];
 extern int num_registered_fb;
 extern struct class *fb_class;
 
+static inline int lock_fb_info(struct fb_info *info)
+{
+        mutex_lock(&info->lock);
+        if (!info->fbops) {
+                mutex_unlock(&info->lock);
+                return 0;
+        }
+        return 1;
+}
+
+static inline void unlock_fb_info(struct fb_info *info)
+{
+        mutex_unlock(&info->lock);
+}
+
 static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch,
                                            u8 *src, u32 s_pitch, u32 height)
 {
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index f1d2fba19ea0..af09660001c7 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -33,7 +33,8 @@ unsigned long hugetlb_total_pages(void);
 int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                         unsigned long address, int write_access);
 int hugetlb_reserve_pages(struct inode *inode, long from, long to,
-                                                struct vm_area_struct *vma);
+                                                struct vm_area_struct *vma,
+                                                int acctflags);
 void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed);
 
 extern unsigned long hugepages_treat_as_movable;
@@ -138,7 +139,7 @@ static inline struct hugetlbfs_sb_info *HUGETLBFS_SB(struct super_block *sb)
 
 extern const struct file_operations hugetlbfs_file_operations;
 extern struct vm_operations_struct hugetlb_vm_ops;
-struct file *hugetlb_file_setup(const char *name, size_t);
+struct file *hugetlb_file_setup(const char *name, size_t, int);
 int hugetlb_get_quota(struct address_space *mapping, long delta);
 void hugetlb_put_quota(struct address_space *mapping, long delta);
 
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 343df9ef2412..7fa371898e3e 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -480,7 +480,8 @@ static inline char *pack_hex_byte(char *buf, u8 byte)
 /*
  * swap - swap value of @a and @b
  */
-#define swap(a, b) ({ typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; })
+#define swap(a, b) \
+        do { typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; } while (0)
 
 /**
  * container_of - cast a member of a structure out to the containing structure
diff --git a/include/linux/mm.h b/include/linux/mm.h
index e8ddc98b8405..323561582c10 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1129,8 +1129,7 @@ extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         unsigned long flag, unsigned long pgoff);
 extern unsigned long mmap_region(struct file *file, unsigned long addr,
         unsigned long len, unsigned long flags,
-        unsigned int vm_flags, unsigned long pgoff,
-        int accountable);
+        unsigned int vm_flags, unsigned long pgoff);
 
 static inline unsigned long do_mmap(struct file *file, unsigned long addr,
         unsigned long len, unsigned long prot,
diff --git a/include/linux/module.h b/include/linux/module.h
index f3b8329eb5b8..145a75528cc1 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -407,7 +407,6 @@ static inline local_t *__module_ref_addr(struct module *mod, int cpu)
 static inline void __module_get(struct module *module)
 {
         if (module) {
-                BUG_ON(module_refcount(module) == 0);
                 local_inc(__module_ref_addr(module, get_cpu()));
                 put_cpu();
         }
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 48890cf3f96e..7bd624bfdcfd 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -684,7 +684,7 @@ int pci_enable_rom(struct pci_dev *pdev);
 void pci_disable_rom(struct pci_dev *pdev);
 void __iomem __must_check *pci_map_rom(struct pci_dev *pdev, size_t *size);
 void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom);
-size_t pci_get_rom_size(void __iomem *rom, size_t size);
+size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size);
 
 /* Power management related routines */
 int pci_save_state(struct pci_dev *dev);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 5a7c76388731..2127e959e0f4 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -443,6 +443,7 @@ struct pacct_struct {
  * @utime:              time spent in user mode, in &cputime_t units
  * @stime:              time spent in kernel mode, in &cputime_t units
  * @sum_exec_runtime:   total time spent on the CPU, in nanoseconds
+ * @lock:               lock for fields in this struct
  *
  * This structure groups together three kinds of CPU time that are
  * tracked for threads and thread groups.  Most things considering
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index e0c0fccced46..a0c66a2e00ad 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -124,7 +124,12 @@ do {								\
 #ifdef CONFIG_GENERIC_LOCKBREAK
 #define spin_is_contended(lock) ((lock)->break_lock)
 #else
+
+#ifdef __raw_spin_is_contended
 #define spin_is_contended(lock) __raw_spin_is_contended(&(lock)->raw_lock)
+#else
+#define spin_is_contended(lock) (((void)(lock), 0))
+#endif /*__raw_spin_is_contended*/
 #endif
 
 /**
diff --git a/include/linux/wait.h b/include/linux/wait.h
index ef609f842fac..a210ede73b56 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -132,6 +132,8 @@ static inline void __remove_wait_queue(wait_queue_head_t *head,
         list_del(&old->task_list);
 }
 
+void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
+                        int nr_exclusive, int sync, void *key);
 void __wake_up(wait_queue_head_t *q, unsigned int mode, int nr, void *key);
 extern void __wake_up_locked(wait_queue_head_t *q, unsigned int mode);
 extern void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr);
@@ -333,16 +335,19 @@ do {									\
         for (;;) {                                                      \
                 prepare_to_wait_exclusive(&wq, &__wait,                 \
                                         TASK_INTERRUPTIBLE);            \
-                if (condition)                                          \
+                if (condition) {                                        \
+                        finish_wait(&wq, &__wait);                      \
                         break;                                          \
+                }                                                       \
                 if (!signal_pending(current)) {                         \
                         schedule();                                     \
                         continue;                                       \
                 }                                                       \
                 ret = -ERESTARTSYS;                                     \
+                abort_exclusive_wait(&wq, &__wait,                      \
+                                TASK_INTERRUPTIBLE, NULL);              \
                 break;                                                  \
         }                                                               \
-        finish_wait(&wq, &__wait);                                      \
 } while (0)
 
 #define wait_event_interruptible_exclusive(wq, condition)               \
@@ -431,6 +436,8 @@ extern long interruptible_sleep_on_timeout(wait_queue_head_t *q,
 void prepare_to_wait(wait_queue_head_t *q, wait_queue_t *wait, int state);
 void prepare_to_wait_exclusive(wait_queue_head_t *q, wait_queue_t *wait, int state);
 void finish_wait(wait_queue_head_t *q, wait_queue_t *wait);
+void abort_exclusive_wait(wait_queue_head_t *q, wait_queue_t *wait,
+                        unsigned int mode, void *key);
 int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
 int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
 
diff --git a/include/video/aty128.h b/include/video/aty128.h
index 7079beb005e8..51ac69f05bdc 100644
--- a/include/video/aty128.h
+++ b/include/video/aty128.h
@@ -21,9 +21,9 @@
 #define I2C_CNTL_1                              0x0094
 #define PALETTE_INDEX                           0x00b0
 #define PALETTE_DATA                            0x00b4
-#define CONFIG_CNTL                             0x00e0
+#define CNFG_CNTL                               0x00e0
 #define GEN_RESET_CNTL                          0x00f0
-#define CONFIG_MEMSIZE                          0x00f8
+#define CNFG_MEMSIZE                            0x00f8
 #define MEM_CNTL                                0x0140
 #define MEM_POWER_MISC                          0x015c
 #define AGP_BASE                                0x0170
diff --git a/include/video/mach64.h b/include/video/mach64.h
index a8332e528ec1..89e91c0cb737 100644
--- a/include/video/mach64.h
+++ b/include/video/mach64.h
@@ -103,7 +103,7 @@
 #define CUR_HORZ_VERT_OFF       0x0070  /* Dword offset 0_1C */
 #define CUR2_HORZ_VERT_OFF      0x0070  /* Dword offset 0_1C */
 
-#define CONFIG_PANEL_LG         0x0074  /* Dword offset 0_1D (LG) */
+#define CNFG_PANEL_LG           0x0074  /* Dword offset 0_1D (LG) */
 
 /* General I/O Control */
 #define GP_IO                   0x0078  /* Dword offset 0_1E */
@@ -146,8 +146,8 @@
 #define CLOCK_SEL_CNTL          0x0090  /* Dword offset 0_24 */
 
 /* Configuration */
-#define CONFIG_STAT1            0x0094  /* Dword offset 0_25 */
-#define CONFIG_STAT2            0x0098  /* Dword offset 0_26 */
+#define CNFG_STAT1              0x0094  /* Dword offset 0_25 */
+#define CNFG_STAT2              0x0098  /* Dword offset 0_26 */
 
 /* Bus Control */
 #define BUS_CNTL                0x00A0  /* Dword offset 0_28 */
@@ -190,9 +190,9 @@
 #define POWER_MANAGEMENT_LG     0x00D8  /* Dword offset 0_36 (LG) */
 
 /* Configuration */
-#define CONFIG_CNTL             0x00DC  /* Dword offset 0_37 (CT, ET, VT) */
-#define CONFIG_CHIP_ID          0x00E0  /* Dword offset 0_38 */
-#define CONFIG_STAT0            0x00E4  /* Dword offset 0_39 */
+#define CNFG_CNTL               0x00DC  /* Dword offset 0_37 (CT, ET, VT) */
+#define CNFG_CHIP_ID            0x00E0  /* Dword offset 0_38 */
+#define CNFG_STAT0              0x00E4  /* Dword offset 0_39 */
 
 /* Test and Debug */
 #define CRC_SIG                 0x00E8  /* Dword offset 0_3A */
@@ -851,17 +851,17 @@
 #define PLL_YCLK_CNTL           0x29
 #define PM_DYN_CLK_CNTL         0x2A
 
-/* CONFIG_CNTL register constants */
+/* CNFG_CNTL register constants */
 #define APERTURE_4M_ENABLE      1
 #define APERTURE_8M_ENABLE      2
 #define VGA_APERTURE_ENABLE     4
 
-/* CONFIG_STAT0 register constants (GX, CX) */
+/* CNFG_STAT0 register constants (GX, CX) */
 #define CFG_BUS_TYPE            0x00000007
 #define CFG_MEM_TYPE            0x00000038
 #define CFG_INIT_DAC_TYPE       0x00000e00
 
-/* CONFIG_STAT0 register constants (CT, ET, VT) */
+/* CNFG_STAT0 register constants (CT, ET, VT) */
 #define CFG_MEM_TYPE_xT         0x00000007
 
 #define ISA                     0
@@ -942,7 +942,7 @@
 #define PCI_ATI_VENDOR_ID       0x1002
 
 
-/* CONFIG_CHIP_ID register constants */
+/* CNFG_CHIP_ID register constants */
 #define CFG_CHIP_TYPE           0x0000FFFF
 #define CFG_CHIP_CLASS          0x00FF0000
 #define CFG_CHIP_REV            0xFF000000
@@ -951,7 +951,7 @@
 #define CFG_CHIP_MINOR          0xC0000000
 
 
-/* Chip IDs read from CONFIG_CHIP_ID */
+/* Chip IDs read from CNFG_CHIP_ID */
 
 /* mach64GX family */
 #define GX_CHIP_ID      0xD7    /* mach64GX (ATI888GX00) */
@@ -1254,7 +1254,7 @@
 #define CRTC2_DISPLAY_DIS       0x00000400
 
 /* LCD register indices */
-#define CONFIG_PANEL            0x00
+#define CNFG_PANEL              0x00
 #define LCD_GEN_CNTL            0x01
 #define DSTN_CONTROL            0x02
 #define HFB_PITCH_ADDR          0x03
diff --git a/include/video/radeon.h b/include/video/radeon.h
index 1cd09cc5b169..e072b16b39ab 100644
--- a/include/video/radeon.h
+++ b/include/video/radeon.h
@@ -11,13 +11,13 @@
 #define HI_STAT                                0x004C  
 #define BUS_CNTL1                              0x0034
 #define I2C_CNTL_1                             0x0094  
-#define CONFIG_CNTL                            0x00E0  
-#define CONFIG_MEMSIZE                         0x00F8  
-#define CONFIG_APER_0_BASE                     0x0100  
-#define CONFIG_APER_1_BASE                     0x0104  
-#define CONFIG_APER_SIZE                       0x0108  
-#define CONFIG_REG_1_BASE                      0x010C  
-#define CONFIG_REG_APER_SIZE                   0x0110  
+#define CNFG_CNTL                              0x00E0
+#define CNFG_MEMSIZE                           0x00F8
+#define CNFG_APER_0_BASE                       0x0100
+#define CNFG_APER_1_BASE                       0x0104
+#define CNFG_APER_SIZE                         0x0108
+#define CNFG_REG_1_BASE                        0x010C
+#define CNFG_REG_APER_SIZE                     0x0110
 #define PAD_AGPINPUT_DELAY                     0x0164  
 #define PAD_CTLR_STRENGTH                      0x0168  
 #define PAD_CTLR_UPDATE                        0x016C
@@ -509,7 +509,7 @@
 /* CLOCK_CNTL_INDEX bit constants */
 #define PLL_WR_EN                                  0x00000080
 
-/* CONFIG_CNTL bit constants */
+/* CNFG_CNTL bit constants */
 #define CFG_VGA_RAM_EN                             0x00000100
 #define CFG_ATI_REV_ID_MASK                        (0xf << 16)
 #define CFG_ATI_REV_A11                            (0 << 16)
@@ -980,7 +980,7 @@
 
 /* masks */
 
-#define CONFIG_MEMSIZE_MASK             0x1f000000
+#define CNFG_MEMSIZE_MASK               0x1f000000
 #define MEM_CFG_TYPE                    0x40000000
 #define DST_OFFSET_MASK                 0x003fffff
 #define DST_PITCH_MASK                  0x3fc00000
diff --git a/ipc/shm.c b/ipc/shm.c
index c0a021f7f41a..05d51d2a792c 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -340,6 +340,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
         struct file * file;
         char name[13];
         int id;
+        int acctflag = 0;
 
         if (size < SHMMIN || size > ns->shm_ctlmax)
                 return -EINVAL;
@@ -364,11 +365,12 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
 
         sprintf (name, "SYSV%08x", key);
         if (shmflg & SHM_HUGETLB) {
-                /* hugetlb_file_setup takes care of mlock user accounting */
-                file = hugetlb_file_setup(name, size);
+                /* hugetlb_file_setup applies strict accounting */
+                if (shmflg & SHM_NORESERVE)
+                        acctflag = VM_NORESERVE;
+                file = hugetlb_file_setup(name, size, acctflag);
                 shp->mlock_user = current_user();
         } else {
-                int acctflag = 0;
                 /*
                  * Do not allow no accounting for OVERCOMMIT_NEVER, even
                  * if it's asked for.
@@ -565,11 +567,15 @@ static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
                         struct hstate *h = hstate_file(shp->shm_file);
                         *rss += pages_per_huge_page(h) * mapping->nrpages;
                 } else {
+#ifdef CONFIG_SHMEM
                         struct shmem_inode_info *info = SHMEM_I(inode);
                         spin_lock(&info->lock);
                         *rss += inode->i_mapping->nrpages;
                         *swp += info->swapped;
                         spin_unlock(&info->lock);
+#else
+                        *rss += inode->i_mapping->nrpages;
+#endif
                 }
 
                 total++;
diff --git a/kernel/async.c b/kernel/async.c
index 608b32b42812..f565891f2c9b 100644
--- a/kernel/async.c
+++ b/kernel/async.c
@@ -54,6 +54,7 @@ asynchronous and synchronous parts of the kernel.
 #include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/kthread.h>
+#include <linux/delay.h>
 #include <asm/atomic.h>
 
 static async_cookie_t next_cookie = 1;
@@ -132,21 +133,23 @@ static void run_one_entry(void)
         entry = list_first_entry(&async_pending, struct async_entry, list);
 
         /* 2) move it to the running queue */
-        list_del(&entry->list);
-        list_add_tail(&entry->list, &async_running);
+        list_move_tail(&entry->list, entry->running);
         spin_unlock_irqrestore(&async_lock, flags);
 
         /* 3) run it (and print duration)*/
         if (initcall_debug && system_state == SYSTEM_BOOTING) {
-                printk("calling  %lli_%pF @ %i\n", entry->cookie, entry->func, task_pid_nr(current));
+                printk("calling  %lli_%pF @ %i\n", (long long)entry->cookie,
+                        entry->func, task_pid_nr(current));
                 calltime = ktime_get();
         }
         entry->func(entry->data, entry->cookie);
         if (initcall_debug && system_state == SYSTEM_BOOTING) {
                 rettime = ktime_get();
                 delta = ktime_sub(rettime, calltime);
-                printk("initcall %lli_%pF returned 0 after %lld usecs\n", entry->cookie,
-                        entry->func, ktime_to_ns(delta) >> 10);
+                printk("initcall %lli_%pF returned 0 after %lld usecs\n",
+                        (long long)entry->cookie,
+                        entry->func,
+                        (long long)ktime_to_ns(delta) >> 10);
         }
 
         /* 4) remove it from the running queue */
@@ -205,18 +208,44 @@ static async_cookie_t __async_schedule(async_func_ptr *ptr, void *data, struct l
         return newcookie;
 }
 
+/**
+ * async_schedule - schedule a function for asynchronous execution
+ * @ptr: function to execute asynchronously
+ * @data: data pointer to pass to the function
+ *
+ * Returns an async_cookie_t that may be used for checkpointing later.
+ * Note: This function may be called from atomic or non-atomic contexts.
+ */
 async_cookie_t async_schedule(async_func_ptr *ptr, void *data)
 {
-        return __async_schedule(ptr, data, &async_pending);
+        return __async_schedule(ptr, data, &async_running);
 }
 EXPORT_SYMBOL_GPL(async_schedule);
 
-async_cookie_t async_schedule_special(async_func_ptr *ptr, void *data, struct list_head *running)
+/**
+ * async_schedule_domain - schedule a function for asynchronous execution within a certain domain
+ * @ptr: function to execute asynchronously
+ * @data: data pointer to pass to the function
+ * @running: running list for the domain
+ *
+ * Returns an async_cookie_t that may be used for checkpointing later.
+ * @running may be used in the async_synchronize_*_domain() functions
+ * to wait within a certain synchronization domain rather than globally.
+ * A synchronization domain is specified via the running queue @running to use.
+ * Note: This function may be called from atomic or non-atomic contexts.
+ */
+async_cookie_t async_schedule_domain(async_func_ptr *ptr, void *data,
+                                     struct list_head *running)
 {
         return __async_schedule(ptr, data, running);
 }
-EXPORT_SYMBOL_GPL(async_schedule_special);
+EXPORT_SYMBOL_GPL(async_schedule_domain);
 
+/**
+ * async_synchronize_full - synchronize all asynchronous function calls
+ *
+ * This function waits until all asynchronous function calls have been done.
+ */
 void async_synchronize_full(void)
 {
         do {
@@ -225,13 +254,30 @@ void async_synchronize_full(void)
 }
 EXPORT_SYMBOL_GPL(async_synchronize_full);
 
-void async_synchronize_full_special(struct list_head *list)
+/**
+ * async_synchronize_full_domain - synchronize all asynchronous function within a certain domain
+ * @list: running list to synchronize on
+ *
+ * This function waits until all asynchronous function calls for the
+ * synchronization domain specified by the running list @list have been done.
+ */
+void async_synchronize_full_domain(struct list_head *list)
 {
-        async_synchronize_cookie_special(next_cookie, list);
+        async_synchronize_cookie_domain(next_cookie, list);
 }
-EXPORT_SYMBOL_GPL(async_synchronize_full_special);
+EXPORT_SYMBOL_GPL(async_synchronize_full_domain);
 
-void async_synchronize_cookie_special(async_cookie_t cookie, struct list_head *running)
+/**
+ * async_synchronize_cookie_domain - synchronize asynchronous function calls within a certain domain with cookie checkpointing
+ * @cookie: async_cookie_t to use as checkpoint
+ * @running: running list to synchronize on
+ *
+ * This function waits until all asynchronous function calls for the
+ * synchronization domain specified by the running list @list submitted
+ * prior to @cookie have been done.
+ */
+void async_synchronize_cookie_domain(async_cookie_t cookie,
+                                     struct list_head *running)
 {
         ktime_t starttime, delta, endtime;
 
@@ -247,14 +293,22 @@ void async_synchronize_cookie_special(async_cookie_t cookie, struct list_head *r
                 delta = ktime_sub(endtime, starttime);
 
                 printk("async_continuing @ %i after %lli usec\n",
-                        task_pid_nr(current), ktime_to_ns(delta) >> 10);
+                        task_pid_nr(current),
+                        (long long)ktime_to_ns(delta) >> 10);
         }
 }
-EXPORT_SYMBOL_GPL(async_synchronize_cookie_special);
+EXPORT_SYMBOL_GPL(async_synchronize_cookie_domain);
 
+/**
+ * async_synchronize_cookie - synchronize asynchronous function calls with cookie checkpointing
+ * @cookie: async_cookie_t to use as checkpoint
+ *
+ * This function waits until all asynchronous function calls prior to @cookie
+ * have been done.
+ */
 void async_synchronize_cookie(async_cookie_t cookie)
 {
-        async_synchronize_cookie_special(cookie, &async_running);
+        async_synchronize_cookie_domain(cookie, &async_running);
 }
 EXPORT_SYMBOL_GPL(async_synchronize_cookie);
 
@@ -315,7 +369,11 @@ static int async_manager_thread(void *unused)
                 ec = atomic_read(&entry_count);
 
                 while (tc < ec && tc < MAX_THREADS) {
-                        kthread_run(async_thread, NULL, "async/%i", tc);
+                        if (IS_ERR(kthread_run(async_thread, NULL, "async/%i",
+                                               tc))) {
+                                msleep(100);
+                                continue;
+                        }
                         atomic_inc(&thread_count);
                         tc++;
                 }
@@ -330,7 +388,9 @@ static int async_manager_thread(void *unused)
 static int __init async_init(void)
 {
         if (async_enabled)
-                kthread_run(async_manager_thread, NULL, "async/mgr");
+                if (IS_ERR(kthread_run(async_manager_thread, NULL,
+                                       "async/mgr")))
+                        async_enabled = 0;
         return 0;
 }
 
diff --git a/kernel/fork.c b/kernel/fork.c
index 242a706e7721..6d5dbb7a13e2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1005,6 +1005,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
          * triggers too late. This doesn't hurt, the check is only there
          * to stop root fork bombs.
          */
+        retval = -EAGAIN;
         if (nr_threads >= max_threads)
                 goto bad_fork_cleanup_count;
 
diff --git a/kernel/irq/numa_migrate.c b/kernel/irq/numa_migrate.c
index ecf765c6a77a..acd88356ac76 100644
--- a/kernel/irq/numa_migrate.c
+++ b/kernel/irq/numa_migrate.c
@@ -71,7 +71,7 @@ static struct irq_desc *__real_move_irq_desc(struct irq_desc *old_desc,
         desc = irq_desc_ptrs[irq];
 
         if (desc && old_desc != desc)
-                        goto out_unlock;
+                goto out_unlock;
 
         node = cpu_to_node(cpu);
         desc = kzalloc_node(sizeof(*desc), GFP_ATOMIC, node);
@@ -84,10 +84,15 @@ static struct irq_desc *__real_move_irq_desc(struct irq_desc *old_desc,
         init_copy_one_irq_desc(irq, old_desc, desc, cpu);
 
         irq_desc_ptrs[irq] = desc;
+        spin_unlock_irqrestore(&sparse_irq_lock, flags);
 
         /* free the old one */
         free_one_irq_desc(old_desc, desc);
+        spin_unlock(&old_desc->lock);
         kfree(old_desc);
+        spin_lock(&desc->lock);
+
+        return desc;
 
 out_unlock:
         spin_unlock_irqrestore(&sparse_irq_lock, flags);
diff --git a/kernel/power/main.c b/kernel/power/main.c
index 239988873971..b4d219016b6c 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -57,16 +57,6 @@ int pm_notifier_call_chain(unsigned long val)
 #ifdef CONFIG_PM_DEBUG
 int pm_test_level = TEST_NONE;
 
-static int suspend_test(int level)
-{
-        if (pm_test_level == level) {
-                printk(KERN_INFO "suspend debug: Waiting for 5 seconds.\n");
-                mdelay(5000);
-                return 1;
-        }
-        return 0;
-}
-
 static const char * const pm_tests[__TEST_AFTER_LAST] = {
         [TEST_NONE] = "none",
         [TEST_CORE] = "core",
@@ -125,14 +115,24 @@ static ssize_t pm_test_store(struct kobject *kobj, struct kobj_attribute *attr,
 }
 
 power_attr(pm_test);
-#else /* !CONFIG_PM_DEBUG */
-static inline int suspend_test(int level) { return 0; }
-#endif /* !CONFIG_PM_DEBUG */
+#endif /* CONFIG_PM_DEBUG */
 
 #endif /* CONFIG_PM_SLEEP */
 
 #ifdef CONFIG_SUSPEND
 
+static int suspend_test(int level)
+{
+#ifdef CONFIG_PM_DEBUG
+        if (pm_test_level == level) {
+                printk(KERN_INFO "suspend debug: Waiting for 5 seconds.\n");
+                mdelay(5000);
+                return 1;
+        }
+#endif /* !CONFIG_PM_DEBUG */
+        return 0;
+}
+
 #ifdef CONFIG_PM_TEST_SUSPEND
 
 /*
diff --git a/kernel/sched.c b/kernel/sched.c
index 242d0d47a70d..8ee437a5ec1d 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4697,8 +4697,8 @@ EXPORT_SYMBOL(default_wake_function);
  * started to run but is not in state TASK_RUNNING. try_to_wake_up() returns
  * zero in this (rare) case, and we handle it by continuing to scan the queue.
  */
-static void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
-                             int nr_exclusive, int sync, void *key)
+void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
+                        int nr_exclusive, int sync, void *key)
 {
         wait_queue_t *curr, *next;
 
diff --git a/kernel/sys.c b/kernel/sys.c
index e7dc0e10a485..f145c415bc16 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1525,22 +1525,14 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
                 return -EINVAL;
         if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
                 return -EFAULT;
+        if (new_rlim.rlim_cur > new_rlim.rlim_max)
+                return -EINVAL;
         old_rlim = current->signal->rlim + resource;
         if ((new_rlim.rlim_max > old_rlim->rlim_max) &&
             !capable(CAP_SYS_RESOURCE))
                 return -EPERM;
-
-        if (resource == RLIMIT_NOFILE) {
-                if (new_rlim.rlim_max == RLIM_INFINITY)
-                        new_rlim.rlim_max = sysctl_nr_open;
-                if (new_rlim.rlim_cur == RLIM_INFINITY)
-                        new_rlim.rlim_cur = sysctl_nr_open;
-                if (new_rlim.rlim_max > sysctl_nr_open)
-                        return -EPERM;
-        }
-
-        if (new_rlim.rlim_cur > new_rlim.rlim_max)
-                return -EINVAL;
+        if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > sysctl_nr_open)
+                return -EPERM;
 
         retval = security_task_setrlimit(resource, &new_rlim);
         if (retval)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 7dcf6e9f2b04..9a236ffe2aa4 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1737,9 +1737,12 @@ static void clear_ftrace_pid(struct pid *pid)
 {
         struct task_struct *p;
 
+        rcu_read_lock();
         do_each_pid_task(pid, PIDTYPE_PID, p) {
                 clear_tsk_trace_trace(p);
         } while_each_pid_task(pid, PIDTYPE_PID, p);
+        rcu_read_unlock();
+
         put_pid(pid);
 }
 
@@ -1747,9 +1750,11 @@ static void set_ftrace_pid(struct pid *pid)
 {
         struct task_struct *p;
 
+        rcu_read_lock();
         do_each_pid_task(pid, PIDTYPE_PID, p) {
                 set_tsk_trace_trace(p);
         } while_each_pid_task(pid, PIDTYPE_PID, p);
+        rcu_read_unlock();
 }
 
 static void clear_ftrace_pid_task(struct pid **pid)
diff --git a/kernel/wait.c b/kernel/wait.c
index cd87131f2fc2..42a2dbc181c8 100644
--- a/kernel/wait.c
+++ b/kernel/wait.c
@@ -91,6 +91,15 @@ prepare_to_wait_exclusive(wait_queue_head_t *q, wait_queue_t *wait, int state)
 }
 EXPORT_SYMBOL(prepare_to_wait_exclusive);
 
+/*
+ * finish_wait - clean up after waiting in a queue
+ * @q: waitqueue waited on
+ * @wait: wait descriptor
+ *
+ * Sets current thread back to running state and removes
+ * the wait descriptor from the given waitqueue if still
+ * queued.
+ */
 void finish_wait(wait_queue_head_t *q, wait_queue_t *wait)
 {
         unsigned long flags;
@@ -117,6 +126,39 @@ void finish_wait(wait_queue_head_t *q, wait_queue_t *wait)
 }
 EXPORT_SYMBOL(finish_wait);
 
+/*
+ * abort_exclusive_wait - abort exclusive waiting in a queue
+ * @q: waitqueue waited on
+ * @wait: wait descriptor
+ * @state: runstate of the waiter to be woken
+ * @key: key to identify a wait bit queue or %NULL
+ *
+ * Sets current thread back to running state and removes
+ * the wait descriptor from the given waitqueue if still
+ * queued.
+ *
+ * Wakes up the next waiter if the caller is concurrently
+ * woken up through the queue.
+ *
+ * This prevents waiter starvation where an exclusive waiter
+ * aborts and is woken up concurrently and noone wakes up
+ * the next waiter.
+ */
+void abort_exclusive_wait(wait_queue_head_t *q, wait_queue_t *wait,
+                        unsigned int mode, void *key)
+{
+        unsigned long flags;
+
+        __set_current_state(TASK_RUNNING);
+        spin_lock_irqsave(&q->lock, flags);
+        if (!list_empty(&wait->task_list))
+                list_del_init(&wait->task_list);
+        else if (waitqueue_active(q))
+                __wake_up_common(q, mode, 1, 0, key);
+        spin_unlock_irqrestore(&q->lock, flags);
+}
+EXPORT_SYMBOL(abort_exclusive_wait);
+
 int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
 {
         int ret = default_wake_function(wait, mode, sync, key);
@@ -177,17 +219,20 @@ int __sched
 __wait_on_bit_lock(wait_queue_head_t *wq, struct wait_bit_queue *q,
                         int (*action)(void *), unsigned mode)
 {
-        int ret = 0;
-
         do {
+                int ret;
+
                 prepare_to_wait_exclusive(wq, &q->wait, mode);
-                if (test_bit(q->key.bit_nr, q->key.flags)) {
-                        if ((ret = (*action)(q->key.flags)))
-                                break;
-                }
+                if (!test_bit(q->key.bit_nr, q->key.flags))
+                        continue;
+                ret = action(q->key.flags);
+                if (!ret)
+                        continue;
+                abort_exclusive_wait(wq, &q->wait, mode, &q->key);
+                return ret;
         } while (test_and_set_bit(q->key.bit_nr, q->key.flags));
         finish_wait(wq, &q->wait);
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL(__wait_on_bit_lock);
 
diff --git a/mm/fremap.c b/mm/fremap.c
index 736ba7f3306a..b6ec85abbb39 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -198,7 +198,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
                         flags &= MAP_NONBLOCK;
                         get_file(file);
                         addr = mmap_region(file, start, size,
-                                        flags, vma->vm_flags, pgoff, 1);
+                                        flags, vma->vm_flags, pgoff);
                         fput(file);
                         if (IS_ERR_VALUE(addr)) {
                                 err = addr;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 618e98304080..207464209546 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2269,14 +2269,12 @@ void hugetlb_change_protection(struct vm_area_struct *vma,
 
 int hugetlb_reserve_pages(struct inode *inode,
                                         long from, long to,
-                                        struct vm_area_struct *vma)
+                                        struct vm_area_struct *vma,
+                                        int acctflag)
 {
-        long ret, chg;
+        long ret = 0, chg;
         struct hstate *h = hstate_inode(inode);
 
-        if (vma && vma->vm_flags & VM_NORESERVE)
-                return 0;
-
         /*
          * Shared mappings base their reservation on the number of pages that
          * are already allocated on behalf of the file. Private mappings need
@@ -2285,22 +2283,25 @@ int hugetlb_reserve_pages(struct inode *inode,
          */
         if (!vma || vma->vm_flags & VM_SHARED)
                 chg = region_chg(&inode->i_mapping->private_list, from, to);
-        else {
-                struct resv_map *resv_map = resv_map_alloc();
-                if (!resv_map)
-                        return -ENOMEM;
-
+        else
                 chg = to - from;
 
-                set_vma_resv_map(vma, resv_map);
-                set_vma_resv_flags(vma, HPAGE_RESV_OWNER);
-        }
-
         if (chg < 0)
                 return chg;
 
         if (hugetlb_get_quota(inode->i_mapping, chg))
                 return -ENOSPC;
+
+        /*
+         * Only apply hugepage reservation if asked. We still have to
+         * take the filesystem quota because it is an upper limit
+         * defined for the mount and not necessarily memory as a whole
+         */
+        if (acctflag & VM_NORESERVE) {
+                reset_vma_resv_huge_pages(vma);
+                return 0;
+        }
+
         ret = hugetlb_acct_memory(h, chg);
         if (ret < 0) {
                 hugetlb_put_quota(inode->i_mapping, chg);
@@ -2308,6 +2309,16 @@ int hugetlb_reserve_pages(struct inode *inode,
         }
         if (!vma || vma->vm_flags & VM_SHARED)
                 region_add(&inode->i_mapping->private_list, from, to);
+        else {
+                struct resv_map *resv_map = resv_map_alloc();
+
+                if (!resv_map)
+                        return -ENOMEM;
+
+                set_vma_resv_map(vma, resv_map);
+                set_vma_resv_flags(vma, HPAGE_RESV_OWNER);
+        }
+
         return 0;
 }
 
diff --git a/mm/memory.c b/mm/memory.c
index 22bfa7a47a0b..baa999e87cd2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1999,7 +1999,7 @@ gotten:
          * Don't let another task, with possibly unlocked vma,
          * keep the mlocked page.
          */
-        if (vma->vm_flags & VM_LOCKED) {
+        if ((vma->vm_flags & VM_LOCKED) && old_page) {
                 lock_page(old_page);    /* for LRU manipulation */
                 clear_page_mlock(old_page);
                 unlock_page(old_page);
diff --git a/mm/mlock.c b/mm/mlock.c
index 028ec482fdd4..037161d61b4e 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -311,7 +311,10 @@ long mlock_vma_pages_range(struct vm_area_struct *vma,
                         is_vm_hugetlb_page(vma) ||
                         vma == get_gate_vma(current))) {
 
-                return __mlock_vma_pages_range(vma, start, end, 1);
+                __mlock_vma_pages_range(vma, start, end, 1);
+
+                /* Hide errors from mmap() and other callers */
+                return 0;
         }
 
         /*
diff --git a/mm/mmap.c b/mm/mmap.c
index 214b6a258eeb..eb1270bebe67 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -918,7 +918,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         struct inode *inode;
         unsigned int vm_flags;
         int error;
-        int accountable = 1;
         unsigned long reqprot = prot;
 
         /*
@@ -1019,8 +1018,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
                                         return -EPERM;
                                 vm_flags &= ~VM_MAYEXEC;
                         }
-                        if (is_file_hugepages(file))
-                                accountable = 0;
 
                         if (!file->f_op || !file->f_op->mmap)
                                 return -ENODEV;
@@ -1053,8 +1050,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         if (error)
                 return error;
 
-        return mmap_region(file, addr, len, flags, vm_flags, pgoff,
-                           accountable);
+        return mmap_region(file, addr, len, flags, vm_flags, pgoff);
 }
 EXPORT_SYMBOL(do_mmap_pgoff);
 
@@ -1092,17 +1088,23 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
 
 /*
  * We account for memory if it's a private writeable mapping,
- * and VM_NORESERVE wasn't set.
+ * not hugepages and VM_NORESERVE wasn't set.
  */
-static inline int accountable_mapping(unsigned int vm_flags)
+static inline int accountable_mapping(struct file *file, unsigned int vm_flags)
 {
+        /*
+         * hugetlb has its own accounting separate from the core VM
+         * VM_HUGETLB may not be set yet so we cannot check for that flag.
+         */
+        if (file && is_file_hugepages(file))
+                return 0;
+
         return (vm_flags & (VM_NORESERVE | VM_SHARED | VM_WRITE)) == VM_WRITE;
 }
 
 unsigned long mmap_region(struct file *file, unsigned long addr,
                           unsigned long len, unsigned long flags,
-                          unsigned int vm_flags, unsigned long pgoff,
-                          int accountable)
+                          unsigned int vm_flags, unsigned long pgoff)
 {
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma, *prev;
@@ -1128,18 +1130,22 @@ munmap_back:
 
         /*
          * Set 'VM_NORESERVE' if we should not account for the
-         * memory use of this mapping. We only honor MAP_NORESERVE
-         * if we're allowed to overcommit memory.
+         * memory use of this mapping.
          */
-        if ((flags & MAP_NORESERVE) && sysctl_overcommit_memory != OVERCOMMIT_NEVER)
-                vm_flags |= VM_NORESERVE;
-        if (!accountable)
-                vm_flags |= VM_NORESERVE;
+        if ((flags & MAP_NORESERVE)) {
+                /* We honor MAP_NORESERVE if allowed to overcommit */
+                if (sysctl_overcommit_memory != OVERCOMMIT_NEVER)
+                        vm_flags |= VM_NORESERVE;
+
+                /* hugetlb applies strict overcommit unless MAP_NORESERVE */
+                if (file && is_file_hugepages(file))
+                        vm_flags |= VM_NORESERVE;
+        }
 
         /*
          * Private writable mapping: check memory availability
          */
-        if (accountable_mapping(vm_flags)) {
+        if (accountable_mapping(file, vm_flags)) {
                 charged = len >> PAGE_SHIFT;
                 if (security_vm_enough_memory(charged))
                         return -ENOMEM;
diff --git a/mm/mprotect.c b/mm/mprotect.c
index abe2694e13f4..258197b76fb4 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -151,10 +151,11 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
         /*
          * If we make a private mapping writable we increase our commit;
          * but (without finer accounting) cannot reduce our commit if we
-         * make it unwritable again.
+         * make it unwritable again. hugetlb mapping were accounted for
+         * even if read-only so there is no need to account for them here
          */
         if (newflags & VM_WRITE) {
-                if (!(oldflags & (VM_ACCOUNT|VM_WRITE|
+                if (!(oldflags & (VM_ACCOUNT|VM_WRITE|VM_HUGETLB|
                                                 VM_SHARED|VM_NORESERVE))) {
                         charged = nrpages;
                         if (security_vm_enough_memory(charged))
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index dcd7666824ba..fc70147c771e 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -29,6 +29,7 @@
 #include <linux/errno.h>
 #include <linux/uaccess.h>
 #include <linux/sched.h>
+#include <linux/types.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include "protocol.h"
@@ -160,29 +161,32 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                         break;
                 case 'w':{
                                 int16_t *val = va_arg(ap, int16_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le16 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                         errcode = -EFAULT;
                                         break;
                                 }
-                                *val = cpu_to_le16(*val);
+                                *val = le16_to_cpu(le_val);
                         }
                         break;
                 case 'd':{
                                 int32_t *val = va_arg(ap, int32_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                         errcode = -EFAULT;
                                         break;
                                 }
-                                *val = cpu_to_le32(*val);
+                                *val = le32_to_cpu(le_val);
                         }
                         break;
                 case 'q':{
                                 int64_t *val = va_arg(ap, int64_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le64 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                         errcode = -EFAULT;
                                         break;
                                 }
-                                *val = cpu_to_le64(*val);
+                                *val = le64_to_cpu(le_val);
                         }
                         break;
                 case 's':{
@@ -362,19 +366,19 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                         }
                         break;
                 case 'w':{
-                                int16_t val = va_arg(ap, int);
+                                __le16 val = cpu_to_le16(va_arg(ap, int));
                                 if (pdu_write(pdu, &val, sizeof(val)))
                                         errcode = -EFAULT;
                         }
                         break;
                 case 'd':{
-                                int32_t val = va_arg(ap, int32_t);
+                                __le32 val = cpu_to_le32(va_arg(ap, int32_t));
                                 if (pdu_write(pdu, &val, sizeof(val)))
                                         errcode = -EFAULT;
                         }
                         break;
                 case 'q':{
-                                int64_t val = va_arg(ap, int64_t);
+                                __le64 val = cpu_to_le64(va_arg(ap, int64_t));
                                 if (pdu_write(pdu, &val, sizeof(val)))
                                         errcode = -EFAULT;
                         }
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index bdd9ccea17ce..d2c27c808d3b 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -67,6 +67,11 @@ static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
 {
         struct net_device *indev;
 
+        if (skb_warn_if_lro(skb)) {
+                kfree_skb(skb);
+                return;
+        }
+
         indev = skb->dev;
         skb->dev = to->dev;
         skb_forward_csum(skb);
@@ -89,7 +94,7 @@ void br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 /* called with rcu_read_lock */
 void br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
 {
-        if (!skb_warn_if_lro(skb) && should_deliver(to, skb)) {
+        if (should_deliver(to, skb)) {
                 __br_forward(to, skb);
                 return;
         }
diff --git a/net/core/dev.c b/net/core/dev.c
index 5379b0c1190a..a17e00662363 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1090,7 +1090,7 @@ int dev_open(struct net_device *dev)
                 /*
                  *      Enable NET_DMA
                  */
-                dmaengine_get();
+                net_dmaengine_get();
 
                 /*
                  *      Initialize multicasting status
@@ -1172,7 +1172,7 @@ int dev_close(struct net_device *dev)
         /*
          *      Shutdown NET_DMA
          */
-        dmaengine_put();
+        net_dmaengine_put();
 
         return 0;
 }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f66c58df8953..278a142d1047 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1994,8 +1994,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                         if (!net_eq(neigh_parms_net(p), net))
                                 continue;
 
-                        if (nidx++ < neigh_skip)
-                                continue;
+                        if (nidx < neigh_skip)
+                                goto next;
 
                         if (neightbl_fill_param_info(skb, tbl, p,
                                                      NETLINK_CB(cb->skb).pid,
@@ -2003,6 +2003,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                                                      RTM_NEWNEIGHTBL,
                                                      NLM_F_MULTI) <= 0)
                                 goto out;
+                next:
+                        nidx++;
                 }
 
                 neigh_skip = 0;
@@ -2082,12 +2084,10 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                 if (h > s_h)
                         s_idx = 0;
                 for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next) {
-                        int lidx;
                         if (dev_net(n->dev) != net)
                                 continue;
-                        lidx = idx++;
-                        if (lidx < s_idx)
-                                continue;
+                        if (idx < s_idx)
+                                goto next;
                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
                                             cb->nlh->nlmsg_seq,
                                             RTM_NEWNEIGH,
@@ -2096,6 +2096,8 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                                 rc = -1;
                                 goto out;
                         }
+                next:
+                        idx++;
                 }
         }
         read_unlock_bh(&tbl->lock);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 557fe16cbfb0..dda42f0bd7a3 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -663,14 +663,10 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         th->urg_ptr             = 0;
 
         /* The urg_mode check is necessary during a below snd_una win probe */
-        if (unlikely(tcp_urg_mode(tp))) {
-                if (between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF)) {
-                        th->urg_ptr = htons(tp->snd_up - tcb->seq);
-                        th->urg = 1;
-                } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
-                        th->urg_ptr = 0xFFFF;
-                        th->urg = 1;
-                }
+        if (unlikely(tcp_urg_mode(tp) &&
+                     between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF))) {
+                th->urg_ptr             = htons(tp->snd_up - tcb->seq);
+                th->urg                 = 1;
         }
 
         tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1ab180bad72a..c47c989cb1fb 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1231,11 +1231,10 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                    int proto)
 {
         struct sock *sk;
-        struct udphdr *uh = udp_hdr(skb);
+        struct udphdr *uh;
         unsigned short ulen;
         struct rtable *rt = (struct rtable*)skb->dst;
-        __be32 saddr = ip_hdr(skb)->saddr;
-        __be32 daddr = ip_hdr(skb)->daddr;
+        __be32 saddr, daddr;
         struct net *net = dev_net(skb->dev);
 
         /*
@@ -1244,6 +1243,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                 goto drop;              /* No space for header. */
 
+        uh   = udp_hdr(skb);
         ulen = ntohs(uh->len);
         if (ulen > skb->len)
                 goto short_packet;
@@ -1258,6 +1258,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (udp4_csum_init(skb, uh, proto))
                 goto csum_error;
 
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
+
         if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                 return __udp4_lib_mcast_deliver(net, skb, uh,
                                 saddr, daddr, udptable);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index c62dd247774f..7712578bdc66 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -323,17 +323,21 @@ static struct ip6_flowlabel *
 fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
           int optlen, int *err_p)
 {
-        struct ip6_flowlabel *fl;
+        struct ip6_flowlabel *fl = NULL;
         int olen;
         int addr_type;
         int err;
 
+        olen = optlen - CMSG_ALIGN(sizeof(*freq));
+        err = -EINVAL;
+        if (olen > 64 * 1024)
+                goto done;
+
         err = -ENOMEM;
         fl = kzalloc(sizeof(*fl), GFP_KERNEL);
         if (fl == NULL)
                 goto done;
 
-        olen = optlen - CMSG_ALIGN(sizeof(*freq));
         if (olen > 0) {
                 struct msghdr msg;
                 struct flowi flowi;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4b15938bef4d..9fb49c3b518a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1105,6 +1105,18 @@ static inline int ip6_ufo_append_data(struct sock *sk,
         return err;
 }
 
+static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
+                                               gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
+
+static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
+                                                gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
+
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
@@ -1130,17 +1142,37 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                  * setup for corking
                  */
                 if (opt) {
-                        if (np->cork.opt == NULL) {
-                                np->cork.opt = kmalloc(opt->tot_len,
-                                                       sk->sk_allocation);
-                                if (unlikely(np->cork.opt == NULL))
-                                        return -ENOBUFS;
-                        } else if (np->cork.opt->tot_len < opt->tot_len) {
-                                printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
+                        if (WARN_ON(np->cork.opt))
                                 return -EINVAL;
-                        }
-                        memcpy(np->cork.opt, opt, opt->tot_len);
-                        inet->cork.flags |= IPCORK_OPT;
+
+                        np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
+                        if (unlikely(np->cork.opt == NULL))
+                                return -ENOBUFS;
+
+                        np->cork.opt->tot_len = opt->tot_len;
+                        np->cork.opt->opt_flen = opt->opt_flen;
+                        np->cork.opt->opt_nflen = opt->opt_nflen;
+
+                        np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst0opt && !np->cork.opt->dst0opt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst1opt && !np->cork.opt->dst1opt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
+                                                           sk->sk_allocation);
+                        if (opt->hopopt && !np->cork.opt->hopopt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
+                                                            sk->sk_allocation);
+                        if (opt->srcrt && !np->cork.opt->srcrt)
+                                return -ENOBUFS;
+
                         /* need source address above miyazawa*/
                 }
                 dst_hold(&rt->u.dst);
@@ -1167,8 +1199,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         } else {
                 rt = (struct rt6_info *)inet->cork.dst;
                 fl = &inet->cork.fl;
-                if (inet->cork.flags & IPCORK_OPT)
-                        opt = np->cork.opt;
+                opt = np->cork.opt;
                 transhdrlen = 0;
                 exthdrlen = 0;
                 mtu = inet->cork.fragsize;
@@ -1407,9 +1438,15 @@ error:
 
 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
 {
-        inet->cork.flags &= ~IPCORK_OPT;
-        kfree(np->cork.opt);
-        np->cork.opt = NULL;
+        if (np->cork.opt) {
+                kfree(np->cork.opt->dst0opt);
+                kfree(np->cork.opt->dst1opt);
+                kfree(np->cork.opt->hopopt);
+                kfree(np->cork.opt->srcrt);
+                kfree(np->cork.opt);
+                np->cork.opt = NULL;
+        }
+
         if (inet->cork.dst) {
                 dst_release(inet->cork.dst);
                 inet->cork.dst = NULL;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 58e2b0d93758..d994c55a5b16 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -249,8 +249,8 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
         }
 
         t = netdev_priv(dev);
-        ip6_tnl_dev_init(dev);
         t->parms = *p;
+        ip6_tnl_dev_init(dev);
 
         if ((err = register_netdevice(dev)) < 0)
                 goto failed_free;
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index c455cf4ee756..c323643ffcf9 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -49,8 +49,19 @@ static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
 static const u_int8_t invmap[] = {
         [ICMPV6_ECHO_REQUEST - 128]     = ICMPV6_ECHO_REPLY + 1,
         [ICMPV6_ECHO_REPLY - 128]       = ICMPV6_ECHO_REQUEST + 1,
-        [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_QUERY + 1,
-        [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_REPLY +1
+        [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_REPLY + 1,
+        [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_QUERY +1
+};
+
+static const u_int8_t noct_valid_new[] = {
+        [ICMPV6_MGM_QUERY - 130] = 1,
+        [ICMPV6_MGM_REPORT -130] = 1,
+        [ICMPV6_MGM_REDUCTION - 130] = 1,
+        [NDISC_ROUTER_SOLICITATION - 130] = 1,
+        [NDISC_ROUTER_ADVERTISEMENT - 130] = 1,
+        [NDISC_NEIGHBOUR_SOLICITATION - 130] = 1,
+        [NDISC_NEIGHBOUR_ADVERTISEMENT - 130] = 1,
+        [ICMPV6_MLD2_REPORT - 130] = 1
 };
 
 static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
@@ -178,6 +189,7 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
 {
         const struct icmp6hdr *icmp6h;
         struct icmp6hdr _ih;
+        int type;
 
         icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
         if (icmp6h == NULL) {
@@ -194,6 +206,15 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
                 return -NF_ACCEPT;
         }
 
+        type = icmp6h->icmp6_type - 130;
+        if (type >= 0 && type < sizeof(noct_valid_new) &&
+            noct_valid_new[type]) {
+                skb->nfct = &nf_conntrack_untracked.ct_general;
+                skb->nfctinfo = IP_CT_NEW;
+                nf_conntrack_get(skb->nfct);
+                return NF_ACCEPT;
+        }
+
         /* is not error message ? */
         if (icmp6h->icmp6_type >= 128)
                 return NF_ACCEPT;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index c32a7e8e3a1b..cb78aa00399e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -434,7 +434,7 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
         } else
                 return NOTIFY_DONE;
 
-        if (!nfnetlink_has_listeners(group))
+        if (!item->report && !nfnetlink_has_listeners(group))
                 return NOTIFY_DONE;
 
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
@@ -1215,6 +1215,16 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                 }
         }
 
+#ifdef CONFIG_NF_NAT_NEEDED
+        if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
+                err = ctnetlink_change_nat_seq_adj(ct, cda);
+                if (err < 0) {
+                        rcu_read_unlock();
+                        goto err;
+                }
+        }
+#endif
+
         if (cda[CTA_PROTOINFO]) {
                 err = ctnetlink_change_protoinfo(ct, cda);
                 if (err < 0) {
@@ -1492,7 +1502,8 @@ static int ctnetlink_expect_event(struct notifier_block *this,
         } else
                 return NOTIFY_DONE;
 
-        if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
+        if (!item->report &&
+            !nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
                 return NOTIFY_DONE;
 
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index e223cb43ae8e..a189ada9128f 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -105,7 +105,7 @@ match_packet(const struct sk_buff *skb,
 
         switch (chunk_match_type) {
         case SCTP_CHUNK_MATCH_ALL:
-                return SCTP_CHUNKMAP_IS_CLEAR(info->chunkmap);
+                return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
         case SCTP_CHUNK_MATCH_ANY:
                 return false;
         case SCTP_CHUNK_MATCH_ONLY:
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d7d2bed7a699..eac5e7bb7365 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -284,13 +284,13 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
                 if (IS_ERR(trans)) {
                         call = ERR_CAST(trans);
                         trans = NULL;
-                        goto out;
+                        goto out_notrans;
                 }
         } else {
                 trans = rx->trans;
                 if (!trans) {
                         call = ERR_PTR(-ENOTCONN);
-                        goto out;
+                        goto out_notrans;
                 }
                 atomic_inc(&trans->usage);
         }
@@ -315,6 +315,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
         rxrpc_put_bundle(trans, bundle);
 out:
         rxrpc_put_transport(trans);
+out_notrans:
         release_sock(&rx->sk);
         _leave(" = %p", call);
         return call;
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index e17836680f49..0a1798eafb0b 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1767,7 +1767,7 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file)
                        AFMT_S8 | AFMT_U16_LE |
                        AFMT_U16_BE |
                         AFMT_S32_LE | AFMT_S32_BE |
-                        AFMT_S24_LE | AFMT_S24_LE |
+                        AFMT_S24_LE | AFMT_S24_BE |
                         AFMT_S24_PACKED;
         params = kmalloc(sizeof(*params), GFP_KERNEL);
         if (!params)
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index b7bba7dc7cf1..0b708134d12f 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -487,7 +487,6 @@ int /*__devinit*/ snd_hda_bus_new(struct snd_card *card,
 {
         struct hda_bus *bus;
         int err;
-        char qname[8];
         static struct snd_device_ops dev_ops = {
                 .dev_register = snd_hda_bus_dev_register,
                 .dev_free = snd_hda_bus_dev_free,
@@ -517,10 +516,12 @@ int /*__devinit*/ snd_hda_bus_new(struct snd_card *card,
         mutex_init(&bus->cmd_mutex);
         INIT_LIST_HEAD(&bus->codec_list);
 
-        snprintf(qname, sizeof(qname), "hda%d", card->number);
-        bus->workq = create_workqueue(qname);
+        snprintf(bus->workq_name, sizeof(bus->workq_name),
+                 "hd-audio%d", card->number);
+        bus->workq = create_singlethread_workqueue(bus->workq_name);
         if (!bus->workq) {
-                snd_printk(KERN_ERR "cannot create workqueue %s\n", qname);
+                snd_printk(KERN_ERR "cannot create workqueue %s\n",
+                           bus->workq_name);
                 kfree(bus);
                 return -ENOMEM;
         }
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 5810ef588402..09a332ada0c6 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -614,6 +614,7 @@ struct hda_bus {
 
         /* unsolicited event queue */
         struct hda_bus_unsolicited *unsol;
+        char workq_name[16];
         struct workqueue_struct *workq; /* common workqueue for codecs */
 
         /* assigned PCMs */
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index 7ca66d654148..144b85276d5a 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -399,7 +399,8 @@ static void print_conn_list(struct snd_info_buffer *buffer,
 {
         int c, curr = -1;
 
-        if (conn_len > 1 && wid_type != AC_WID_AUD_MIX)
+        if (conn_len > 1 && wid_type != AC_WID_AUD_MIX &&
+            wid_type != AC_WID_VOL_KNB)
                 curr = snd_hda_codec_read(codec, nid, 0,
                                           AC_VERB_GET_CONNECT_SEL, 0);
         snd_iprintf(buffer, "  Connection: %d\n", conn_len);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7884a4e07061..ae5c8a0d1479 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1037,6 +1037,7 @@ do_sku:
                 case 0x10ec0267:
                 case 0x10ec0268:
                 case 0x10ec0269:
+                case 0x10ec0272:
                 case 0x10ec0660:
                 case 0x10ec0662:
                 case 0x10ec0663:
@@ -1065,6 +1066,7 @@ do_sku:
                 case 0x10ec0882:
                 case 0x10ec0883:
                 case 0x10ec0885:
+                case 0x10ec0887:
                 case 0x10ec0889:
                         snd_hda_codec_write(codec, 0x20, 0,
                                             AC_VERB_SET_COEF_INDEX, 7);
@@ -7012,6 +7014,7 @@ static int patch_alc882(struct hda_codec *codec)
                         break;
                 case 0x106b1000: /* iMac 24 */
                 case 0x106b2800: /* AppleTV */
+                case 0x106b3e00: /* iMac 24 Aluminium */
                         board_config = ALC885_IMAC24;
                         break;
                 case 0x106b00a1: /* Macbook (might be wrong - PCI SSID?) */
@@ -8514,6 +8517,8 @@ static struct snd_pci_quirk alc883_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1558, 0, "Clevo laptop", ALC883_LAPTOP_EAPD),
         SND_PCI_QUIRK(0x15d9, 0x8780, "Supermicro PDSBA", ALC883_3ST_6ch),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_MEDION),
+        SND_PCI_QUIRK(0x1734, 0x1107, "FSC AMILO Xi2550",
+                      ALC883_FUJITSU_PI2515),
         SND_PCI_QUIRK(0x1734, 0x1108, "Fujitsu AMILO Pi2515", ALC883_FUJITSU_PI2515),
         SND_PCI_QUIRK(0x1734, 0x113d, "Fujitsu AMILO Xa3530",
                 ALC888_FUJITSU_XA3530),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index b787b3cc096f..38428e22428f 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1804,6 +1804,8 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
                       "HP dv4", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30fc,
                       "HP dv7", STAC_HP_M4),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3600,
+                      "HP dv5", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3603,
                       "HP dv5", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x361a,
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 19d3391e229f..e900cdc84849 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -617,7 +617,7 @@ static int snd_intel8x0_ali_codec_semaphore(struct intel8x0 *chip)
         int time = 100;
         if (chip->buggy_semaphore)
                 return 0; /* just ignore ... */
-        while (time-- && (igetdword(chip, ICHREG(ALI_CAS)) & ALI_CAS_SEM_BUSY))
+        while (--time && (igetdword(chip, ICHREG(ALI_CAS)) & ALI_CAS_SEM_BUSY))
                 udelay(1);
         if (! time && ! chip->in_ac97_init)
                 snd_printk(KERN_WARNING "ali_codec_semaphore timeout\n");
diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
index c5d67900d666..ff0054b76502 100644
--- a/sound/soc/atmel/atmel_ssc_dai.c
+++ b/sound/soc/atmel/atmel_ssc_dai.c
@@ -10,7 +10,7 @@
  * Based on at91-ssc.c by
  * Frank Mandarino <fmandarino@endrelia.com>
  * Based on pxa2xx Platform drivers by
- * Liam Girdwood <liam.girdwood@wolfsonmicro.com>
+ * Liam Girdwood <lrg@slimlogic.co.uk>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/sound/soc/atmel/atmel_ssc_dai.h b/sound/soc/atmel/atmel_ssc_dai.h
index a828746e8a2f..391135f9c6c1 100644
--- a/sound/soc/atmel/atmel_ssc_dai.h
+++ b/sound/soc/atmel/atmel_ssc_dai.h
@@ -10,7 +10,7 @@
  * Based on at91-ssc.c by
  * Frank Mandarino <fmandarino@endrelia.com>
  * Based on pxa2xx Platform drivers by
- * Liam Girdwood <liam.girdwood@wolfsonmicro.com>
+ * Liam Girdwood <lrg@slimlogic.co.uk>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
index e3989d406f54..35d99750c383 100644
--- a/sound/soc/codecs/wm8350.c
+++ b/sound/soc/codecs/wm8350.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2007, 2008 Wolfson Microelectronics PLC.
  *
- * Author: Liam Girdwood <lg@opensource.wolfsonmicro.com>
+ * Author: Liam Girdwood <lrg@slimlogic.co.uk>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/sound/soc/codecs/wm8990.c b/sound/soc/codecs/wm8990.c
index 5b5afc144478..1cbb7b9b51ce 100644
--- a/sound/soc/codecs/wm8990.c
+++ b/sound/soc/codecs/wm8990.c
@@ -2,8 +2,7 @@
  * wm8990.c  --  WM8990 ALSA Soc Audio driver
  *
  * Copyright 2008 Wolfson Microelectronics PLC.
- * Author: Liam Girdwood
- *         lg@opensource.wolfsonmicro.com or linux@wolfsonmicro.com
+ * Author: Liam Girdwood <lrg@slimlogic.co.uk>
  *
  *  This program is free software; you can redistribute  it and/or modify it
  *  under  the terms of  the GNU General  Public License as published by the
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index b0362dfd5b71..dd3bb2933762 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -175,9 +175,10 @@ static int omap_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
         struct omap_runtime_data *prtd = runtime->private_data;
+        unsigned long flags;
         int ret = 0;
 
-        spin_lock_irq(&prtd->lock);
+        spin_lock_irqsave(&prtd->lock, flags);
         switch (cmd) {
         case SNDRV_PCM_TRIGGER_START:
         case SNDRV_PCM_TRIGGER_RESUME:
@@ -195,7 +196,7 @@ static int omap_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
         default:
                 ret = -EINVAL;
         }
-        spin_unlock_irq(&prtd->lock);
+        spin_unlock_irqrestore(&prtd->lock, flags);
 
         return ret;
 }
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index c709b9563226..2ab83129d9b0 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -2966,6 +2966,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
                 return -EINVAL;
         }
         alts = &iface->altsetting[fp->altset_idx];
+        fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
         usb_set_interface(chip->dev, fp->iface, 0);
         init_usb_pitch(chip->dev, fp->iface, alts, fp);
         init_usb_sample_rate(chip->dev, fp->iface, alts, fp, fp->rate_max);