46 files changed, 386 insertions, 294 deletions
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index d3f0a62efcc1..ee68ac54c0d4 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -138,7 +138,7 @@ static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
        {
        set_no_mwait, "Extensa 5220", {
        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
-        DMI_MATCH(DMI_SYS_VENDOR, "ACER"),
+        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
        DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
        DMI_MATCH(DMI_BOARD_NAME, "Columbia") }, NULL},
        {},
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1838aa3d24fe..7ce1ac4baa6d 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -407,7 +407,7 @@ struct entropy_store {
        /* read-write data: */
        spinlock_t lock;
        unsigned add_ptr;
-        int entropy_count;
+        int entropy_count;      /* Must at no time exceed ->POOLBITS! */
        int input_rotate;
 };
@@ -520,6 +520,7 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
 static void credit_entropy_bits(struct entropy_store *r, int nbits)
 {
        unsigned long flags;
+        int entropy_count;
        if (!nbits)
                return;
@@ -527,20 +528,20 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits)
        spin_lock_irqsave(&r->lock, flags);
        DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
-        r->entropy_count += nbits;
+        entropy_count = r->entropy_count;
-        if (r->entropy_count < 0) {
+        entropy_count += nbits;
+        if (entropy_count < 0) {
                DEBUG_ENT("negative entropy/overflow\n");
-                r->entropy_count = 0;
+                entropy_count = 0;
-        } else if (r->entropy_count > r->poolinfo->POOLBITS)
+        } else if (entropy_count > r->poolinfo->POOLBITS)
-                r->entropy_count = r->poolinfo->POOLBITS;
+                entropy_count = r->poolinfo->POOLBITS;
+        r->entropy_count = entropy_count;
        /* should we wake readers? */
-        if (r == &input_pool &&
+        if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
-            r->entropy_count >= random_read_wakeup_thresh) {
                wake_up_interruptible(&random_read_wait);
                kill_fasync(&fasync, SIGIO, POLL_IN);
        }
        spin_unlock_irqrestore(&r->lock, flags);
 }
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index 8024e3bfd877..b91ef63126ed 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -669,8 +669,7 @@ static int __init ibft_register_kobjects(struct ibft_table_header *header,
        control = (void *)header + sizeof(*header);
        end = (void *)control + control->hdr.length;
-        eot_offset = (void *)header + header->length -
+        eot_offset = (void *)header + header->length - (void *)control;
-                     (void *)control - sizeof(*header);
        rc = ibft_verify_hdr("control", (struct ibft_hdr *)control, id_control,
                             sizeof(*control));
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 3331f88dcfb6..248ab4a7d39f 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -223,7 +223,7 @@ static int radeon_do_wait_for_fifo(drm_radeon_private_t * dev_priv, int entries)
                        return 0;
                DRM_UDELAY(1);
        }
-        DRM_INFO("wait for fifo failed status : 0x%08X 0x%08X\n",
+        DRM_DEBUG("wait for fifo failed status : 0x%08X 0x%08X\n",
                 RADEON_READ(RADEON_RBBM_STATUS),
                 RADEON_READ(R300_VAP_CNTL_STATUS));
@@ -252,7 +252,7 @@ static int radeon_do_wait_for_idle(drm_radeon_private_t * dev_priv)
                }
                DRM_UDELAY(1);
        }
-        DRM_INFO("wait idle failed status : 0x%08X 0x%08X\n",
+        DRM_DEBUG("wait idle failed status : 0x%08X 0x%08X\n",
                 RADEON_READ(RADEON_RBBM_STATUS),
                 RADEON_READ(R300_VAP_CNTL_STATUS));
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index a34758d29516..fc735ab08ff4 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -242,7 +242,7 @@ config BLK_DEV_IDEFLOPPY
          module will be called ide-floppy.
 config BLK_DEV_IDESCSI
-        tristate "SCSI emulation support"
+        tristate "SCSI emulation support (DEPRECATED)"
        depends on SCSI
        select IDE_ATAPI
        ---help---
@@ -255,20 +255,6 @@ config BLK_DEV_IDESCSI
          and will allow you to use a SCSI device driver instead of a native
          ATAPI driver.
-          This is useful if you have an ATAPI device for which no native
-          driver has been written (for example, an ATAPI PD-CD drive);
-          you can then use this emulation together with an appropriate SCSI
-          device driver. In order to do this, say Y here and to "SCSI support"
-          and "SCSI generic support", below. You must then provide the kernel
-          command line "hdx=ide-scsi" (try "man bootparam" or see the
-          documentation of your boot loader (lilo or loadlin) about how to
-          pass options to the kernel at boot time) for devices if you want the
-          native EIDE sub-drivers to skip over the native support, so that
-          this SCSI emulation can be used instead.
-          Note that this option does NOT allow you to attach SCSI devices to a
-          box that doesn't have a SCSI host adapter installed.
          If both this SCSI emulation and native ATAPI support are compiled
          into the kernel, the native support will be used.
diff --git a/drivers/ide/arm/palm_bk3710.c b/drivers/ide/arm/palm_bk3710.c
index f788fa5a977b..4fd91dcf1dc2 100644
--- a/drivers/ide/arm/palm_bk3710.c
+++ b/drivers/ide/arm/palm_bk3710.c
@@ -343,11 +343,10 @@ static struct ide_port_info __devinitdata palm_bk3710_port_info = {
        .mwdma_mask             = ATA_MWDMA2,
 };
-static int __devinit palm_bk3710_probe(struct platform_device *pdev)
+static int __init palm_bk3710_probe(struct platform_device *pdev)
 {
        struct clk *clk;
        struct resource *mem, *irq;
-        struct ide_host *host;
        unsigned long base, rate;
        int i, rc;
        hw_regs_t hw, *hws[] = { &hw, NULL, NULL, NULL };
@@ -390,6 +389,7 @@ static int __devinit palm_bk3710_probe(struct platform_device *pdev)
                hw.io_ports_array[i] = base + IDE_PALM_ATA_PRI_REG_OFFSET + i;
        hw.io_ports.ctl_addr = base + IDE_PALM_ATA_PRI_CTL_OFFSET;
        hw.irq = irq->start;
+        hw.dev = &pdev->dev;
        hw.chipset = ide_palm3710;
        palm_bk3710_port_info.udma_mask = rate < 100000000 ? ATA_UDMA4 :
@@ -413,13 +413,11 @@ static struct platform_driver platform_bk_driver = {
                .name = "palm_bk3710",
                .owner = THIS_MODULE,
        },
-        .probe = palm_bk3710_probe,
-        .remove = NULL,
 };
 static int __init palm_bk3710_init(void)
 {
-        return platform_driver_register(&platform_bk_driver);
+        return platform_driver_probe(&platform_bk_driver, palm_bk3710_probe);
 }
 module_init(palm_bk3710_init);
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 49a8c589e346..f1489999cf91 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -1933,6 +1933,7 @@ static void ide_cd_remove(ide_drive_t *drive)
        ide_proc_unregister_driver(drive, info->driver);
+        blk_unregister_filter(info->disk);
        del_gendisk(info->disk);
        ide_cd_put(info);
@@ -2158,6 +2159,7 @@ static int ide_cd_probe(ide_drive_t *drive)
        g->fops = &idecd_ops;
        g->flags |= GENHD_FL_REMOVABLE;
        add_disk(g);
+        blk_register_filter(g);
        return 0;
 out_free_cd:
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index 68b9cf0138b0..07ef88bd109b 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -445,20 +445,6 @@ static void idedisk_check_hpa(ide_drive_t *drive)
        }
 }
-/*
- * Compute drive->capacity, the full capacity of the drive
- * Called with drive->id != NULL.
- *
- * To compute capacity, this uses either of
- *
- *    1. CHS value set by user       (whatever user sets will be trusted)
- *    2. LBA value from target drive (require new ATA feature)
- *    3. LBA value from system BIOS  (new one is OK, old one may break)
- *    4. CHS value from system BIOS  (traditional style)
- *
- * in above order (i.e., if value of higher priority is available,
- * reset will be ignored).
- */
 static void init_idedisk_capacity(ide_drive_t *drive)
 {
        struct hd_driveid *id = drive->id;
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 7e65bad522cb..ac89a5deaca2 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -238,15 +238,47 @@ static struct page *read_sb_page(mddev_t *mddev, long offset, unsigned long inde
 }
+static mdk_rdev_t *next_active_rdev(mdk_rdev_t *rdev, mddev_t *mddev)
+{
+        /* Iterate the disks of an mddev, using rcu to protect access to the
+         * linked list, and raising the refcount of devices we return to ensure
+         * they don't disappear while in use.
+         * As devices are only added or removed when raid_disk is < 0 and
+         * nr_pending is 0 and In_sync is clear, the entries we return will
+         * still be in the same position on the list when we re-enter
+         * list_for_each_continue_rcu.
+         */
+        struct list_head *pos;
+        rcu_read_lock();
+        if (rdev == NULL)
+                /* start at the beginning */
+                pos = &mddev->disks;
+        else {
+                /* release the previous rdev and start from there. */
+                rdev_dec_pending(rdev, mddev);
+                pos = &rdev->same_set;
+        }
+        list_for_each_continue_rcu(pos, &mddev->disks) {
+                rdev = list_entry(pos, mdk_rdev_t, same_set);
+                if (rdev->raid_disk >= 0 &&
+                    test_bit(In_sync, &rdev->flags) &&
+                    !test_bit(Faulty, &rdev->flags)) {
+                        /* this is a usable devices */
+                        atomic_inc(&rdev->nr_pending);
+                        rcu_read_unlock();
+                        return rdev;
+                }
+        }
+        rcu_read_unlock();
+        return NULL;
+}
 static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
 {
-        mdk_rdev_t *rdev;
+        mdk_rdev_t *rdev = NULL;
        mddev_t *mddev = bitmap->mddev;
-        rcu_read_lock();
+        while ((rdev = next_active_rdev(rdev, mddev)) != NULL) {
-        rdev_for_each_rcu(rdev, mddev)
-                if (test_bit(In_sync, &rdev->flags)
-                    && !test_bit(Faulty, &rdev->flags)) {
                        int size = PAGE_SIZE;
                        if (page->index == bitmap->file_pages-1)
                                size = roundup(bitmap->last_page_size,
@@ -281,8 +313,7 @@ static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
                                       + page->index * (PAGE_SIZE/512),
                                       size,
                                       page);
-                }
+        }
-        rcu_read_unlock();
        if (wait)
                md_super_wait(mddev);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8cfadc5bd2ba..4790c83d78d0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3841,8 +3841,6 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                del_timer_sync(&mddev->safemode_timer);
-                invalidate_partition(disk, 0);
                switch(mode) {
                case 1: /* readonly */
                        err  = -ENXIO;
diff --git a/drivers/misc/acer-wmi.c b/drivers/misc/acer-wmi.c
index c6c77a505ec1..d8b0d326e452 100644
--- a/drivers/misc/acer-wmi.c
+++ b/drivers/misc/acer-wmi.c
@@ -1189,7 +1189,7 @@ static int create_debugfs(void)
        return 0;
 error_debugfs:
-                remove_debugfs();
+        remove_debugfs();
        return -ENOMEM;
 }
@@ -1272,6 +1272,7 @@ error_platform_register:
 static void __exit acer_wmi_exit(void)
 {
        remove_sysfs(acer_platform_device);
+        remove_debugfs();
        platform_device_del(acer_platform_device);
        platform_driver_unregister(&acer_platform_driver);
diff --git a/drivers/misc/hp-wmi.c b/drivers/misc/hp-wmi.c
index 1dbcbcb323a2..6d407c2a4f91 100644
--- a/drivers/misc/hp-wmi.c
+++ b/drivers/misc/hp-wmi.c
@@ -49,6 +49,7 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
 #define HPWMI_ALS_QUERY 0x3
 #define HPWMI_DOCK_QUERY 0x4
 #define HPWMI_WIRELESS_QUERY 0x5
+#define HPWMI_HOTKEY_QUERY 0xc
 static int __init hp_wmi_bios_setup(struct platform_device *device);
 static int __exit hp_wmi_bios_remove(struct platform_device *device);
@@ -69,7 +70,7 @@ struct bios_return {
 struct key_entry {
        char type;              /* See KE_* below */
-        u8 code;
+        u16 code;
        u16 keycode;
 };
@@ -79,7 +80,9 @@ static struct key_entry hp_wmi_keymap[] = {
        {KE_SW, 0x01, SW_DOCK},
        {KE_KEY, 0x02, KEY_BRIGHTNESSUP},
        {KE_KEY, 0x03, KEY_BRIGHTNESSDOWN},
-        {KE_KEY, 0x04, KEY_HELP},
+        {KE_KEY, 0x20e6, KEY_PROG1},
+        {KE_KEY, 0x2142, KEY_MEDIA},
+        {KE_KEY, 0x231b, KEY_HELP},
        {KE_END, 0}
 };
@@ -177,9 +180,9 @@ static int hp_wmi_wifi_state(void)
        int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
        if (wireless & 0x100)
-                return 1;
+                return RFKILL_STATE_UNBLOCKED;
        else
-                return 0;
+                return RFKILL_STATE_SOFT_BLOCKED;
 }
 static int hp_wmi_bluetooth_state(void)
@@ -187,9 +190,9 @@ static int hp_wmi_bluetooth_state(void)
        int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
        if (wireless & 0x10000)
-                return 1;
+                return RFKILL_STATE_UNBLOCKED;
        else
-                return 0;
+                return RFKILL_STATE_SOFT_BLOCKED;
 }
 static int hp_wmi_wwan_state(void)
@@ -197,9 +200,9 @@ static int hp_wmi_wwan_state(void)
        int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
        if (wireless & 0x1000000)
-                return 1;
+                return RFKILL_STATE_UNBLOCKED;
        else
-                return 0;
+                return RFKILL_STATE_SOFT_BLOCKED;
 }
 static ssize_t show_display(struct device *dev, struct device_attribute *attr,
@@ -318,6 +321,9 @@ void hp_wmi_notify(u32 value, void *context)
        if (obj && obj->type == ACPI_TYPE_BUFFER && obj->buffer.length == 8) {
                int eventcode = *((u8 *) obj->buffer.pointer);
+                if (eventcode == 0x4)
+                        eventcode = hp_wmi_perform_query(HPWMI_HOTKEY_QUERY, 0,
+                                                         0);
                key = hp_wmi_get_entry_by_scancode(eventcode);
                if (key) {
                        switch (key->type) {
@@ -338,12 +344,14 @@ void hp_wmi_notify(u32 value, void *context)
                        }
                } else if (eventcode == 0x5) {
                        if (wifi_rfkill)
-                                wifi_rfkill->state = hp_wmi_wifi_state();
+                                rfkill_force_state(wifi_rfkill,
+                                                   hp_wmi_wifi_state());
                        if (bluetooth_rfkill)
-                                bluetooth_rfkill->state =
+                                rfkill_force_state(bluetooth_rfkill,
-                                    hp_wmi_bluetooth_state();
+                                                   hp_wmi_bluetooth_state());
                        if (wwan_rfkill)
-                                wwan_rfkill->state = hp_wmi_wwan_state();
+                                rfkill_force_state(wwan_rfkill,
+                                                   hp_wmi_wwan_state());
                } else
                        printk(KERN_INFO "HP WMI: Unknown key pressed - %x\n",
                               eventcode);
@@ -398,6 +406,7 @@ static void cleanup_sysfs(struct platform_device *device)
 static int __init hp_wmi_bios_setup(struct platform_device *device)
 {
        int err;
+        int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
        err = device_create_file(&device->dev, &dev_attr_display);
        if (err)
@@ -412,28 +421,33 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
        if (err)
                goto add_sysfs_error;
-        wifi_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WLAN);
+        if (wireless & 0x1) {
-        wifi_rfkill->name = "hp-wifi";
+                wifi_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WLAN);
-        wifi_rfkill->state = hp_wmi_wifi_state();
+                wifi_rfkill->name = "hp-wifi";
-        wifi_rfkill->toggle_radio = hp_wmi_wifi_set;
+                wifi_rfkill->state = hp_wmi_wifi_state();
-        wifi_rfkill->user_claim_unsupported = 1;
+                wifi_rfkill->toggle_radio = hp_wmi_wifi_set;
+                wifi_rfkill->user_claim_unsupported = 1;
-        bluetooth_rfkill = rfkill_allocate(&device->dev,
+                rfkill_register(wifi_rfkill);
-                                           RFKILL_TYPE_BLUETOOTH);
+        }
-        bluetooth_rfkill->name = "hp-bluetooth";
-        bluetooth_rfkill->state = hp_wmi_bluetooth_state();
+        if (wireless & 0x2) {
-        bluetooth_rfkill->toggle_radio = hp_wmi_bluetooth_set;
+                bluetooth_rfkill = rfkill_allocate(&device->dev,
-        bluetooth_rfkill->user_claim_unsupported = 1;
+                                                   RFKILL_TYPE_BLUETOOTH);
+                bluetooth_rfkill->name = "hp-bluetooth";
-        wwan_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WIMAX);
+                bluetooth_rfkill->state = hp_wmi_bluetooth_state();
-        wwan_rfkill->name = "hp-wwan";
+                bluetooth_rfkill->toggle_radio = hp_wmi_bluetooth_set;
-        wwan_rfkill->state = hp_wmi_wwan_state();
+                bluetooth_rfkill->user_claim_unsupported = 1;
-        wwan_rfkill->toggle_radio = hp_wmi_wwan_set;
+                rfkill_register(bluetooth_rfkill);
-        wwan_rfkill->user_claim_unsupported = 1;
+        }
-        rfkill_register(wifi_rfkill);
+        if (wireless & 0x4) {
-        rfkill_register(bluetooth_rfkill);
+                wwan_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WWAN);
-        rfkill_register(wwan_rfkill);
+                wwan_rfkill->name = "hp-wwan";
+                wwan_rfkill->state = hp_wmi_wwan_state();
+                wwan_rfkill->toggle_radio = hp_wmi_wwan_set;
+                wwan_rfkill->user_claim_unsupported = 1;
+                rfkill_register(wwan_rfkill);
+        }
        return 0;
 add_sysfs_error:
@@ -445,9 +459,12 @@ static int __exit hp_wmi_bios_remove(struct platform_device *device)
 {
        cleanup_sysfs(device);
-        rfkill_unregister(wifi_rfkill);
+        if (wifi_rfkill)
-        rfkill_unregister(bluetooth_rfkill);
+                rfkill_unregister(wifi_rfkill);
-        rfkill_unregister(wwan_rfkill);
+        if (bluetooth_rfkill)
+                rfkill_unregister(bluetooth_rfkill);
+        if (wwan_rfkill)
+                rfkill_unregister(wwan_rfkill);
        return 0;
 }
diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
index 6915f40ac8ab..1f8b5b36222c 100644
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -621,12 +621,21 @@ static void at91_mci_send_command(struct at91mci_host *host, struct mmc_command
                                if (cpu_is_at91sam9260 () || cpu_is_at91sam9263())
                                        if (host->total_length < 12)
                                                host->total_length = 12;
-                                host->buffer = dma_alloc_coherent(NULL,
-                                                host->total_length,
+                                host->buffer = kmalloc(host->total_length, GFP_KERNEL);
-                                                &host->physical_address, GFP_KERNEL);
+                                if (!host->buffer) {
+                                        pr_debug("Can't alloc tx buffer\n");
+                                        cmd->error = -ENOMEM;
+                                        mmc_request_done(host->mmc, host->request);
+                                        return;
+                                }
                                at91_mci_sg_to_dma(host, data);
+                                host->physical_address = dma_map_single(NULL,
+                                                host->buffer, host->total_length,
+                                                DMA_TO_DEVICE);
                                pr_debug("Transmitting %d bytes\n", host->total_length);
                                at91_mci_write(host, ATMEL_PDC_TPR, host->physical_address);
@@ -694,7 +703,10 @@ static void at91_mci_completed_command(struct at91mci_host *host, unsigned int s
        cmd->resp[3] = at91_mci_read(host, AT91_MCI_RSPR(3));
        if (host->buffer) {
-                dma_free_coherent(NULL, host->total_length, host->buffer, host->physical_address);
+                dma_unmap_single(NULL,
+                                host->physical_address, host->total_length,
+                                DMA_TO_DEVICE);
+                kfree(host->buffer);
                host->buffer = NULL;
        }
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index d2f331876e4c..e00d424e6575 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -410,16 +410,20 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
        case MEMGETREGIONINFO:
        {
-                struct region_info_user ur;
+                uint32_t ur_idx;
+                struct mtd_erase_region_info *kr;
+                struct region_info_user *ur = (struct region_info_user *) argp;
-                if (copy_from_user(&ur, argp, sizeof(struct region_info_user)))
+                if (get_user(ur_idx, &(ur->regionindex)))
                        return -EFAULT;
-                if (ur.regionindex >= mtd->numeraseregions)
+                kr = &(mtd->eraseregions[ur_idx]);
-                        return -EINVAL;
-                if (copy_to_user(argp, &(mtd->eraseregions[ur.regionindex]),
+                if (put_user(kr->offset, &(ur->offset))
-                                sizeof(struct mtd_erase_region_info)))
+                    || put_user(kr->erasesize, &(ur->erasesize))
+                    || put_user(kr->numblocks, &(ur->numblocks)))
                        return -EFAULT;
                break;
        }
diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h
index a14dba1afcc5..fd705d1295a7 100644
--- a/drivers/net/bnx2x.h
+++ b/drivers/net/bnx2x.h
@@ -151,6 +151,8 @@ struct sw_rx_page {
 #define PAGES_PER_SGE_SHIFT             0
 #define PAGES_PER_SGE                   (1 << PAGES_PER_SGE_SHIFT)
+#define BCM_RX_ETH_PAYLOAD_ALIGN        64
 /* SGE ring related macros */
 #define NUM_RX_SGE_PAGES                2
 #define RX_SGE_CNT              (BCM_PAGE_SIZE / sizeof(struct eth_rx_sge))
@@ -750,8 +752,7 @@ struct bnx2x {
        u32                     rx_csum;
        u32                     rx_offset;
-        u32                     rx_buf_use_size;        /* useable size */
+        u32                     rx_buf_size;
-        u32                     rx_buf_size;            /* with alignment */
 #define ETH_OVREHEAD                    (ETH_HLEN + 8)  /* 8 for CRC + VLAN */
 #define ETH_MIN_PACKET_SIZE             60
 #define ETH_MAX_PACKET_SIZE             1500
diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
index 82deea0a63f5..a8eb3c4a47c8 100644
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -59,8 +59,8 @@
 #include "bnx2x.h"
 #include "bnx2x_init.h"
-#define DRV_MODULE_VERSION      "1.45.20"
+#define DRV_MODULE_VERSION      "1.45.21"
-#define DRV_MODULE_RELDATE      "2008/08/25"
+#define DRV_MODULE_RELDATE      "2008/09/03"
 #define BNX2X_BC_VER            0x040200
 /* Time in jiffies before concluding the transmitter is hung */
@@ -1027,7 +1027,7 @@ static inline int bnx2x_alloc_rx_skb(struct bnx2x *bp,
        if (unlikely(skb == NULL))
                return -ENOMEM;
-        mapping = pci_map_single(bp->pdev, skb->data, bp->rx_buf_use_size,
+        mapping = pci_map_single(bp->pdev, skb->data, bp->rx_buf_size,
                                 PCI_DMA_FROMDEVICE);
        if (unlikely(dma_mapping_error(&bp->pdev->dev, mapping))) {
                dev_kfree_skb(skb);
@@ -1169,7 +1169,7 @@ static void bnx2x_tpa_start(struct bnx2x_fastpath *fp, u16 queue,
        /* move empty skb from pool to prod and map it */
        prod_rx_buf->skb = fp->tpa_pool[queue].skb;
        mapping = pci_map_single(bp->pdev, fp->tpa_pool[queue].skb->data,
-                                 bp->rx_buf_use_size, PCI_DMA_FROMDEVICE);
+                                 bp->rx_buf_size, PCI_DMA_FROMDEVICE);
        pci_unmap_addr_set(prod_rx_buf, mapping, mapping);
        /* move partial skb from cons to pool (don't unmap yet) */
@@ -1276,7 +1276,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
           pool entry status to BNX2X_TPA_STOP even if new skb allocation
           fails. */
        pci_unmap_single(bp->pdev, pci_unmap_addr(rx_buf, mapping),
-                         bp->rx_buf_use_size, PCI_DMA_FROMDEVICE);
+                         bp->rx_buf_size, PCI_DMA_FROMDEVICE);
        if (likely(new_skb)) {
                /* fix ip xsum and give it to the stack */
@@ -1520,7 +1520,7 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                        } else if (bnx2x_alloc_rx_skb(bp, fp, bd_prod) == 0) {
                                pci_unmap_single(bp->pdev,
                                        pci_unmap_addr(rx_buf, mapping),
-                                                 bp->rx_buf_use_size,
+                                                 bp->rx_buf_size,
                                                 PCI_DMA_FROMDEVICE);
                                skb_reserve(skb, pad);
                                skb_put(skb, len);
@@ -4229,7 +4229,7 @@ static inline void bnx2x_free_tpa_pool(struct bnx2x *bp,
                if (fp->tpa_state[i] == BNX2X_TPA_START)
                        pci_unmap_single(bp->pdev,
                                         pci_unmap_addr(rx_buf, mapping),
-                                         bp->rx_buf_use_size,
+                                         bp->rx_buf_size,
                                         PCI_DMA_FROMDEVICE);
                dev_kfree_skb(skb);
@@ -4245,15 +4245,14 @@ static void bnx2x_init_rx_rings(struct bnx2x *bp)
        u16 ring_prod, cqe_ring_prod;
        int i, j;
-        bp->rx_buf_use_size = bp->dev->mtu;
+        bp->rx_buf_size = bp->dev->mtu;
-        bp->rx_buf_use_size += bp->rx_offset + ETH_OVREHEAD;
+        bp->rx_buf_size += bp->rx_offset + ETH_OVREHEAD +
-        bp->rx_buf_size = bp->rx_buf_use_size + 64;
+                BCM_RX_ETH_PAYLOAD_ALIGN;
        if (bp->flags & TPA_ENABLE_FLAG) {
                DP(NETIF_MSG_IFUP,
-                   "rx_buf_use_size %d  rx_buf_size %d  effective_mtu %d\n",
+                   "rx_buf_size %d  effective_mtu %d\n",
-                   bp->rx_buf_use_size, bp->rx_buf_size,
+                   bp->rx_buf_size, bp->dev->mtu + ETH_OVREHEAD);
-                   bp->dev->mtu + ETH_OVREHEAD);
                for_each_queue(bp, j) {
                        struct bnx2x_fastpath *fp = &bp->fp[j];
@@ -4462,9 +4461,10 @@ static void bnx2x_init_context(struct bnx2x *bp)
                context->ustorm_st_context.common.status_block_id = sb_id;
                context->ustorm_st_context.common.flags =
                        USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_MC_ALIGNMENT;
-                context->ustorm_st_context.common.mc_alignment_size = 64;
+                context->ustorm_st_context.common.mc_alignment_size =
+                        BCM_RX_ETH_PAYLOAD_ALIGN;
                context->ustorm_st_context.common.bd_buff_size =
-                                                bp->rx_buf_use_size;
+                                                bp->rx_buf_size;
                context->ustorm_st_context.common.bd_page_base_hi =
                                                U64_HI(fp->rx_desc_mapping);
                context->ustorm_st_context.common.bd_page_base_lo =
@@ -4717,7 +4717,7 @@ static void bnx2x_init_internal_func(struct bnx2x *bp)
        }
        /* Init CQ ring mapping and aggregation size */
-        max_agg_size = min((u32)(bp->rx_buf_use_size +
+        max_agg_size = min((u32)(bp->rx_buf_size +
                                 8*BCM_PAGE_SIZE*PAGES_PER_SGE),
                           (u32)0xffff);
        for_each_queue(bp, i) {
@@ -5940,7 +5940,7 @@ static void bnx2x_free_rx_skbs(struct bnx2x *bp)
                        pci_unmap_single(bp->pdev,
                                         pci_unmap_addr(rx_buf, mapping),
-                                         bp->rx_buf_use_size,
+                                         bp->rx_buf_size,
                                         PCI_DMA_FROMDEVICE);
                        rx_buf->skb = NULL;
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 53f41b649f03..a417be7f8be5 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2304,6 +2304,12 @@ static int __devinit ixgbe_set_interrupt_capability(struct ixgbe_adapter
        int vector, v_budget;
        /*
+         * Set the default interrupt throttle rate.
+         */
+        adapter->rx_eitr = (1000000 / IXGBE_DEFAULT_ITR_RX_USECS);
+        adapter->tx_eitr = (1000000 / IXGBE_DEFAULT_ITR_TX_USECS);
+        /*
         * It's easy to be greedy for MSI-X vectors, but it really
         * doesn't do us much good if we have a lot more vectors
         * than CPU's.  So let's be conservative and only ask for
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 32bb47adbe39..008fd6618a5f 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -359,16 +359,6 @@ static void netxen_pcie_strap_init(struct netxen_adapter *adapter)
        int i, pos;
        struct pci_dev *pdev;
-        pdev = pci_get_device(0x1166, 0x0140, NULL);
-        if (pdev) {
-                pci_dev_put(pdev);
-                adapter->hw_read_wx(adapter,
-                        NETXEN_PCIE_REG(PCIE_TGT_SPLIT_CHICKEN), &chicken, 4);
-                chicken |= 0x4000;
-                adapter->hw_write_wx(adapter,
-                        NETXEN_PCIE_REG(PCIE_TGT_SPLIT_CHICKEN), &chicken, 4);
-        }
        pdev = adapter->pdev;
        adapter->hw_read_wx(adapter,
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 3f682d49a4e6..52bf11b73c6e 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -784,6 +784,7 @@ static struct pcmcia_device_id axnet_ids[] = {
        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega FEther PCC-TXD", 0x5261440f, 0x436768c5),
        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega FEtherII PCC-TXD", 0x5261440f, 0x730df72e),
        PCMCIA_DEVICE_PROD_ID12("Dynalink", "L100C16", 0x55632fd5, 0x66bc2a90),
+        PCMCIA_DEVICE_PROD_ID12("IO DATA", "ETXPCM", 0x547e66dc, 0x233adac2),
        PCMCIA_DEVICE_PROD_ID12("Linksys", "EtherFast 10/100 PC Card (PCMPC100 V3)", 0x0733cc81, 0x232019a8),
        PCMCIA_DEVICE_PROD_ID12("MELCO", "LPC3-TX", 0x481e0094, 0xf91af609),
        PCMCIA_DEVICE_PROD_ID12("PCMCIA", "100BASE", 0x281f1c5d, 0x7c2add04),
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 2d4c4ad89b8d..ebc1ae6bcbe5 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1626,6 +1626,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-TD", 0x5261440f, 0xc49bd73d),
        PCMCIA_DEVICE_PROD_ID12("Corega K.K.", "corega EtherII PCC-TD", 0xd4fdcbd8, 0xc49bd73d),
        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega Ether PCC-T", 0x5261440f, 0x6705fcaa),
+        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega Ether PCC-TD", 0x5261440f, 0x47d5ca83),
        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega FastEther PCC-TX", 0x5261440f, 0x485e85d9),
        PCMCIA_DEVICE_PROD_ID12("Corega,K.K.", "Ethernet LAN Card", 0x110d26d9, 0x9fd2f0a2),
        PCMCIA_DEVICE_PROD_ID12("corega,K.K.", "Ethernet LAN Card", 0x9791a90e, 0x9fd2f0a2),
@@ -1737,7 +1738,6 @@ static struct pcmcia_device_id pcnet_ids[] = {
        PCMCIA_DEVICE_PROD_ID1("CyQ've 10 Base-T LAN CARD", 0x94faf360),
        PCMCIA_DEVICE_PROD_ID1("EP-210 PCMCIA LAN CARD.", 0x8850b4de),
        PCMCIA_DEVICE_PROD_ID1("ETHER-C16", 0x06a8514f),
-        PCMCIA_DEVICE_PROD_ID1("IC-CARD", 0x60cb09a6),
        PCMCIA_DEVICE_PROD_ID1("NE2000 Compatible", 0x75b8ad5a),
        PCMCIA_DEVICE_PROD_ID2("EN-6200P2", 0xa996d078),
        /* too generic! */
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index a84ba487c713..8c19307e5040 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -117,7 +117,7 @@ static void ctrl_callback(struct urb *urb)
        case -ENOENT:
                break;
        default:
-                if (netif_msg_drv(pegasus))
+                if (netif_msg_drv(pegasus) && printk_ratelimit())
                        dev_dbg(&pegasus->intf->dev, "%s, status %d\n",
                                __FUNCTION__, urb->status);
        }
@@ -166,7 +166,7 @@ static int get_registers(pegasus_t * pegasus, __u16 indx, __u16 size,
                set_current_state(TASK_RUNNING);
                if (ret == -ENODEV)
                        netif_device_detach(pegasus->net);
-                if (netif_msg_drv(pegasus))
+                if (netif_msg_drv(pegasus) && printk_ratelimit())
                        dev_err(&pegasus->intf->dev, "%s, status %d\n",
                                        __FUNCTION__, ret);
                goto out;
@@ -275,7 +275,7 @@ static int set_register(pegasus_t * pegasus, __u16 indx, __u8 data)
        if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC))) {
                if (ret == -ENODEV)
                        netif_device_detach(pegasus->net);
-                if (netif_msg_drv(pegasus))
+                if (netif_msg_drv(pegasus) && printk_ratelimit())
                        dev_err(&pegasus->intf->dev, "%s, status %d\n",
                                        __FUNCTION__, ret);
                goto out;
@@ -1209,8 +1209,7 @@ static void pegasus_set_multicast(struct net_device *net)
                pegasus->eth_regs[EthCtrl2] |= RX_PROMISCUOUS;
                if (netif_msg_link(pegasus))
                        pr_info("%s: Promiscuous mode enabled.\n", net->name);
-        } else if (net->mc_count ||
+        } else if (net->mc_count || (net->flags & IFF_ALLMULTI)) {
-                   (net->flags & IFF_ALLMULTI)) {
                pegasus->eth_regs[EthCtrl0] |= RX_MULTICAST;
                pegasus->eth_regs[EthCtrl2] &= ~RX_PROMISCUOUS;
                if (netif_msg_link(pegasus))
@@ -1220,6 +1219,8 @@ static void pegasus_set_multicast(struct net_device *net)
                pegasus->eth_regs[EthCtrl2] &= ~RX_PROMISCUOUS;
        }
+        pegasus->ctrl_urb->status = 0;
        pegasus->flags |= ETH_REGS_CHANGE;
        ctrl_callback(pegasus->ctrl_urb);
 }
diff --git a/drivers/net/wireless/ath9k/hw.c b/drivers/net/wireless/ath9k/hw.c
index a17eb130f574..6dbfed0b4149 100644
--- a/drivers/net/wireless/ath9k/hw.c
+++ b/drivers/net/wireless/ath9k/hw.c
@@ -7285,15 +7285,15 @@ ath9k_hw_set_keycache_entry(struct ath_hal *ah, u16 entry,
                }
                break;
        case ATH9K_CIPHER_WEP:
-                if (k->kv_len < 40 / NBBY) {
+                if (k->kv_len < LEN_WEP40) {
                        DPRINTF(ah->ah_sc, ATH_DBG_KEYCACHE,
                                 "%s: WEP key length %u too small\n",
                                 __func__, k->kv_len);
                        return false;
                }
-                if (k->kv_len <= 40 / NBBY)
+                if (k->kv_len <= LEN_WEP40)
                        keyType = AR_KEYTABLE_TYPE_40;
-                else if (k->kv_len <= 104 / NBBY)
+                else if (k->kv_len <= LEN_WEP104)
                        keyType = AR_KEYTABLE_TYPE_104;
                else
                        keyType = AR_KEYTABLE_TYPE_128;
@@ -7313,7 +7313,7 @@ ath9k_hw_set_keycache_entry(struct ath_hal *ah, u16 entry,
        key2 = get_unaligned_le32(k->kv_val + 6) ^ xorMask;
        key3 = (get_unaligned_le16(k->kv_val + 10) ^ xorMask) & 0xffff;
        key4 = get_unaligned_le32(k->kv_val + 12) ^ xorMask;
-        if (k->kv_len <= 104 / NBBY)
+        if (k->kv_len <= LEN_WEP104)
                key4 &= 0xff;
        if (keyType == AR_KEYTABLE_TYPE_TKIP && ATH9K_IS_MIC_ENABLED(ah)) {
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 2888778040e4..c5107f269f24 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -206,7 +206,8 @@ static int ath_key_config(struct ath_softc *sc,
        if (!ret)
                return -EIO;
-        sc->sc_keytype = hk.kv_type;
+        if (mac)
+                sc->sc_keytype = hk.kv_type;
        return 0;
 }
@@ -756,7 +757,8 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
                        key->hw_key_idx = key->keyidx;
                        /* push IV and Michael MIC generation to stack */
                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                        if (key->alg == ALG_TKIP)
+                                key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
                }
                break;
        case DISABLE_KEY:
@@ -1065,8 +1067,16 @@ void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                tx_info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
                tx_status->flags &= ~ATH_TX_BAR;
        }
-        if (tx_status->flags)
-                tx_info->status.excessive_retries = 1;
+        if (tx_status->flags & (ATH_TX_ERROR | ATH_TX_XRETRY)) {
+                if (!(tx_info->flags & IEEE80211_TX_CTL_NO_ACK)) {
+                        /* Frame was not ACKed, but an ACK was expected */
+                        tx_info->status.excessive_retries = 1;
+                }
+        } else {
+                /* Frame was ACKed */
+                tx_info->flags |= IEEE80211_TX_STAT_ACK;
+        }
        tx_info->status.retry_count = tx_status->retries;
diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
index 2fe806175c01..20ddb7acdb94 100644
--- a/drivers/net/wireless/ath9k/recv.c
+++ b/drivers/net/wireless/ath9k/recv.c
@@ -360,8 +360,9 @@ static void ath_rx_flush_tid(struct ath_softc *sc,
        struct ath_arx_tid *rxtid, int drop)
 {
        struct ath_rxbuf *rxbuf;
+        unsigned long flag;
-        spin_lock_bh(&rxtid->tidlock);
+        spin_lock_irqsave(&rxtid->tidlock, flag);
        while (rxtid->baw_head != rxtid->baw_tail) {
                rxbuf = rxtid->rxbuf + rxtid->baw_head;
                if (!rxbuf->rx_wbuf) {
@@ -382,7 +383,7 @@ static void ath_rx_flush_tid(struct ath_softc *sc,
                INCR(rxtid->baw_head, ATH_TID_MAX_BUFS);
                INCR(rxtid->seq_next, IEEE80211_SEQ_MAX);
        }
-        spin_unlock_bh(&rxtid->tidlock);
+        spin_unlock_irqrestore(&rxtid->tidlock, flag);
 }
 static struct sk_buff *ath_rxbuf_alloc(struct ath_softc *sc,
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index 157f830ee6b8..550129f717e2 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -357,9 +357,9 @@ static int ath_tx_prepare(struct ath_softc *sc,
        txctl->flags = ATH9K_TXDESC_CLRDMASK;    /* needed for crypto errors */
        if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
-                tx_info->flags |= ATH9K_TXDESC_NOACK;
+                txctl->flags |= ATH9K_TXDESC_NOACK;
        if (tx_info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
-                tx_info->flags |= ATH9K_TXDESC_RTSENA;
+                txctl->flags |= ATH9K_TXDESC_RTSENA;
        /*
         * Setup for rate calculations.
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index e2581229d8b2..23fed3298962 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -474,8 +474,8 @@ static void iwl4965_apm_stop(struct iwl_priv *priv)
        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
        udelay(10);
+        /* clear "init complete"  move adapter D0A* --> D0U state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
        spin_unlock_irqrestore(&priv->lock, flags);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index cbc01a00eaf4..b08036a9d894 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -145,7 +145,8 @@ static void iwl5000_apm_stop(struct iwl_priv *priv)
        udelay(10);
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+        /* clear "init complete"  move adapter D0A* --> D0U state */
+        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
        spin_unlock_irqrestore(&priv->lock, flags);
 }
@@ -577,14 +578,11 @@ static int iwl5000_load_section(struct iwl_priv *priv,
                FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
                phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
-        /* FIME: write the MSB of the phy_addr in CTRL1
-         * iwl_write_direct32(priv,
-                IWL_FH_TFDIB_CTRL1_REG(IWL_FH_SRVC_CHNL),
-                ((phy_addr & MSB_MSK)
-                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_count);
-         */
        iwl_write_direct32(priv,
-                FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL), byte_cnt);
+                FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
+                (iwl_get_dma_hi_address(phy_addr)
+                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
        iwl_write_direct32(priv,
                FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 754fef5b592f..90a2b6dee7c0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -1153,7 +1153,8 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
            !sta->ht_info.ht_supported)
                return -1;
-        if (priv->current_ht_config.tx_mimo_ps_mode == IWL_MIMO_PS_STATIC)
+        if (((sta->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS) >> 2)
+                                                == IWL_MIMO_PS_STATIC)
                return -1;
        /* Need both Tx chains/antennas to support MIMO */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 061ffba9c884..e01f048a02dd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -181,14 +181,14 @@ static int iwl4965_check_rxon_cmd(struct iwl_rxon_cmd *rxon)
 }
 /**
- * iwl4965_full_rxon_required - check if full RXON (vs RXON_ASSOC) cmd is needed
+ * iwl_full_rxon_required - check if full RXON (vs RXON_ASSOC) cmd is needed
 * @priv: staging_rxon is compared to active_rxon
 *
 * If the RXON structure is changing enough to require a new tune,
 * or is clearing the RXON_FILTER_ASSOC_MSK, then return 1 to indicate that
 * a new tune (full RXON command, rather than RXON_ASSOC cmd) is required.
 */
-static int iwl4965_full_rxon_required(struct iwl_priv *priv)
+static int iwl_full_rxon_required(struct iwl_priv *priv)
 {
        /* These items are only settable from the full RXON command */
@@ -207,7 +207,6 @@ static int iwl4965_full_rxon_required(struct iwl_priv *priv)
             priv->active_rxon.ofdm_ht_single_stream_basic_rates) ||
            (priv->staging_rxon.ofdm_ht_dual_stream_basic_rates !=
             priv->active_rxon.ofdm_ht_dual_stream_basic_rates) ||
-            (priv->staging_rxon.rx_chain != priv->active_rxon.rx_chain) ||
            (priv->staging_rxon.assoc_id != priv->active_rxon.assoc_id))
                return 1;
@@ -263,7 +262,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv)
        /* If we don't need to send a full RXON, we can use
         * iwl4965_rxon_assoc_cmd which is used to reconfigure filter
         * and other flags for the current radio configuration. */
-        if (!iwl4965_full_rxon_required(priv)) {
+        if (!iwl_full_rxon_required(priv)) {
                ret = iwl_send_rxon_assoc(priv);
                if (ret) {
                        IWL_ERROR("Error setting RXON_ASSOC (%d)\n", ret);
@@ -587,8 +586,6 @@ static void iwl4965_ht_conf(struct iwl_priv *priv,
                iwl_conf->supported_chan_width = 0;
        }
-        iwl_conf->tx_mimo_ps_mode =
-                (u8)((ht_conf->cap & IEEE80211_HT_CAP_MIMO_PS) >> 2);
        memcpy(iwl_conf->supp_mcs_set, ht_conf->supp_mcs_set, 16);
        iwl_conf->control_channel = ht_bss_conf->primary_channel;
@@ -2190,7 +2187,10 @@ static void __iwl4965_down(struct iwl_priv *priv)
        udelay(5);
        /* FIXME: apm_ops.suspend(priv) */
-        priv->cfg->ops->lib->apm_ops.reset(priv);
+        if (exit_pending || test_bit(STATUS_IN_SUSPEND, &priv->status))
+                priv->cfg->ops->lib->apm_ops.stop(priv);
+        else
+                priv->cfg->ops->lib->apm_ops.reset(priv);
        priv->cfg->ops->lib->free_shared_mem(priv);
 exit:
@@ -2602,6 +2602,7 @@ static int iwl4965_mac_start(struct ieee80211_hw *hw)
 {
        struct iwl_priv *priv = hw->priv;
        int ret;
+        u16 pci_cmd;
        IWL_DEBUG_MAC80211("enter\n");
@@ -2612,6 +2613,13 @@ static int iwl4965_mac_start(struct ieee80211_hw *hw)
        pci_restore_state(priv->pci_dev);
        pci_enable_msi(priv->pci_dev);
+        /* enable interrupts if needed: hw bug w/a */
+        pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
+        if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
+                pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
+                pci_write_config_word(priv->pci_dev, PCI_COMMAND, pci_cmd);
+        }
        ret = request_irq(priv->pci_dev->irq, iwl4965_isr, IRQF_SHARED,
                          DRV_NAME, priv);
        if (ret) {
@@ -3580,7 +3588,7 @@ static int iwl4965_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *sk
        priv->assoc_id = 0;
        timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
-        priv->timestamp = le64_to_cpu(timestamp) +  (priv->beacon_int * 1000);
+        priv->timestamp = le64_to_cpu(timestamp);
        IWL_DEBUG_MAC80211("leave\n");
        spin_unlock_irqrestore(&priv->lock, flags);
@@ -4364,15 +4372,18 @@ static void __devexit iwl4965_pci_remove(struct pci_dev *pdev)
        iwl_dbgfs_unregister(priv);
        sysfs_remove_group(&pdev->dev.kobj, &iwl4965_attribute_group);
+        /* ieee80211_unregister_hw call wil cause iwl4965_mac_stop to
+         * to be called and iwl4965_down since we are removing the device
+         * we need to set STATUS_EXIT_PENDING bit.
+         */
+        set_bit(STATUS_EXIT_PENDING, &priv->status);
        if (priv->mac80211_registered) {
                ieee80211_unregister_hw(priv->hw);
                priv->mac80211_registered = 0;
+        } else {
+                iwl4965_down(priv);
        }
-        set_bit(STATUS_EXIT_PENDING, &priv->status);
-        iwl4965_down(priv);
        /* make sure we flush any pending irq or
         * tasklet for the driver
         */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index c72f72579bea..80f2f84defa8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -592,12 +592,11 @@ static void iwlcore_free_geos(struct iwl_priv *priv)
        clear_bit(STATUS_GEO_CONFIGURED, &priv->status);
 }
-static u8 is_single_rx_stream(struct iwl_priv *priv)
+static bool is_single_rx_stream(struct iwl_priv *priv)
 {
        return !priv->current_ht_config.is_ht ||
               ((priv->current_ht_config.supp_mcs_set[1] == 0) &&
-                (priv->current_ht_config.supp_mcs_set[2] == 0)) ||
+                (priv->current_ht_config.supp_mcs_set[2] == 0));
-               priv->ps_mode == IWL_MIMO_PS_STATIC;
 }
 static u8 iwl_is_channel_extension(struct iwl_priv *priv,
@@ -704,33 +703,39 @@ EXPORT_SYMBOL(iwl_set_rxon_ht);
 * MIMO (dual stream) requires at least 2, but works better with 3.
 * This does not determine *which* chains to use, just how many.
 */
-static int iwlcore_get_rx_chain_counter(struct iwl_priv *priv,
+static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
-                                        u8 *idle_state, u8 *rx_state)
 {
-        u8 is_single = is_single_rx_stream(priv);
+        bool is_single = is_single_rx_stream(priv);
-        u8 is_cam = test_bit(STATUS_POWER_PMI, &priv->status) ? 0 : 1;
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
        /* # of Rx chains to use when expecting MIMO. */
        if (is_single || (!is_cam && (priv->ps_mode == IWL_MIMO_PS_STATIC)))
-                *rx_state = 2;
+                return 2;
        else
-                *rx_state = 3;
+                return 3;
+}
+static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
+{
+        int idle_cnt;
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
        /* # Rx chains when idling and maybe trying to save power */
        switch (priv->ps_mode) {
        case IWL_MIMO_PS_STATIC:
        case IWL_MIMO_PS_DYNAMIC:
-                *idle_state = (is_cam) ? 2 : 1;
+                idle_cnt = (is_cam) ? 2 : 1;
                break;
        case IWL_MIMO_PS_NONE:
-                *idle_state = (is_cam) ? *rx_state : 1;
+                idle_cnt = (is_cam) ? active_cnt : 1;
                break;
+        case IWL_MIMO_PS_INVALID:
        default:
-                *idle_state = 1;
+                IWL_ERROR("invalide mimo ps mode %d\n", priv->ps_mode);
+                WARN_ON(1);
+                idle_cnt = -1;
                break;
        }
+        return idle_cnt;
-        return 0;
 }
 /**
@@ -741,34 +746,44 @@ static int iwlcore_get_rx_chain_counter(struct iwl_priv *priv,
 */
 void iwl_set_rxon_chain(struct iwl_priv *priv)
 {
-        u8 is_single = is_single_rx_stream(priv);
+        bool is_single = is_single_rx_stream(priv);
-        u8 idle_state, rx_state;
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
+        u8 idle_rx_cnt, active_rx_cnt;
-        priv->staging_rxon.rx_chain = 0;
+        u16 rx_chain;
-        rx_state = idle_state = 3;
        /* Tell uCode which antennas are actually connected.
         * Before first association, we assume all antennas are connected.
         * Just after first association, iwl_chain_noise_calibration()
         *    checks which antennas actually *are* connected. */
-        priv->staging_rxon.rx_chain |=
+        rx_chain = priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
-                    cpu_to_le16(priv->hw_params.valid_rx_ant <<
-                                                 RXON_RX_CHAIN_VALID_POS);
        /* How many receivers should we use? */
-        iwlcore_get_rx_chain_counter(priv, &idle_state, &rx_state);
+        active_rx_cnt = iwl_get_active_rx_chain_count(priv);
-        priv->staging_rxon.rx_chain |=
+        idle_rx_cnt = iwl_get_idle_rx_chain_count(priv, active_rx_cnt);
-                cpu_to_le16(rx_state << RXON_RX_CHAIN_MIMO_CNT_POS);
-        priv->staging_rxon.rx_chain |=
+        /* correct rx chain count accoridng hw settings */
-                cpu_to_le16(idle_state << RXON_RX_CHAIN_CNT_POS);
+        if (priv->hw_params.rx_chains_num < active_rx_cnt)
+                active_rx_cnt = priv->hw_params.rx_chains_num;
-        if (!is_single && (rx_state >= 2) &&
-            !test_bit(STATUS_POWER_PMI, &priv->status))
+        if (priv->hw_params.rx_chains_num < idle_rx_cnt)
+                idle_rx_cnt = priv->hw_params.rx_chains_num;
+        rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
+        rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
+        priv->staging_rxon.rx_chain = cpu_to_le16(rx_chain);
+        if (!is_single && (active_rx_cnt >= 2) && is_cam)
                priv->staging_rxon.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
        else
                priv->staging_rxon.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
-        IWL_DEBUG_ASSOC("rx chain %X\n", priv->staging_rxon.rx_chain);
+        IWL_DEBUG_ASSOC("rx_chain=0x%Xi active=%d idle=%d\n",
+                        priv->staging_rxon.rx_chain,
+                        active_rx_cnt, idle_rx_cnt);
+        WARN_ON(active_rx_cnt == 0 || idle_rx_cnt == 0 ||
+                active_rx_cnt < idle_rx_cnt);
 }
 EXPORT_SYMBOL(iwl_set_rxon_chain);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index c19db438306c..cdfb343c7ec6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -412,7 +412,6 @@ struct iwl_ht_info {
        /* self configuration data */
        u8 is_ht;
        u8 supported_chan_width;
-        u16 tx_mimo_ps_mode;
        u8 is_green_field;
        u8 sgf;                 /* HT_SHORT_GI_* short guard interval */
        u8 max_amsdu_size;
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 944642450d3d..cd11c0ca2991 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -287,6 +287,7 @@
 #define FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE       (0x01000000)
+#define FH_MEM_TFDIB_REG1_ADDR_BITSHIFT 28
 /**
 * Transmit DMA Channel Control/Status Registers (TCSR)
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index f3f6ea49fdd2..e81bfc42a7cb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -1173,7 +1173,10 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
        rx_status.antenna = 0;
        rx_status.flag = 0;
-        rx_status.flag |= RX_FLAG_TSFT;
+        /* TSF isn't reliable. In order to allow smooth user experience,
+         * this W/A doesn't propagate it to the mac80211 */
+        /*rx_status.flag |= RX_FLAG_TSFT;*/
        if ((unlikely(rx_start->cfg_phy_cnt > 20))) {
                IWL_DEBUG_DROP("dsp size out of range [0,20]: %d/n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9bb6adb28b73..6c8ac3a87d54 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -421,7 +421,7 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
                else
                        scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
-                if ((scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) && n_probes)
+                if (n_probes)
                        scan_ch->type |= IWL_SCAN_PROBE_MASK(n_probes);
                scan_ch->active_dwell = cpu_to_le16(active_dwell);
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index d82823b5c8ab..78b1a7a4ca40 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -402,12 +402,11 @@ static int iwl_hw_tx_queue_init(struct iwl_priv *priv,
 /**
 * iwl_tx_queue_init - Allocate and initialize one tx/cmd queue
 */
-static int iwl_tx_queue_init(struct iwl_priv *priv,
+static int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
-                             struct iwl_tx_queue *txq,
                             int slots_num, u32 txq_id)
 {
        int i, len;
-        int rc = 0;
+        int ret;
        /*
         * Alloc buffer array for commands (Tx or other types of commands).
@@ -426,19 +425,16 @@ static int iwl_tx_queue_init(struct iwl_priv *priv,
                                continue;
                }
-                txq->cmd[i] = kmalloc(len, GFP_KERNEL | GFP_DMA);
+                txq->cmd[i] = kmalloc(len, GFP_KERNEL);
                if (!txq->cmd[i])
-                        return -ENOMEM;
+                        goto err;
        }
        /* Alloc driver data array and TFD circular buffer */
-        rc = iwl_tx_queue_alloc(priv, txq, txq_id);
+        ret = iwl_tx_queue_alloc(priv, txq, txq_id);
-        if (rc) {
+        if (ret)
-                for (i = 0; i < slots_num; i++)
+                goto err;
-                        kfree(txq->cmd[i]);
-                return -ENOMEM;
-        }
        txq->need_update = 0;
        /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
@@ -452,6 +448,17 @@ static int iwl_tx_queue_init(struct iwl_priv *priv,
        iwl_hw_tx_queue_init(priv, txq);
        return 0;
+err:
+        for (i = 0; i < slots_num; i++) {
+                kfree(txq->cmd[i]);
+                txq->cmd[i] = NULL;
+        }
+        if (txq_id == IWL_CMD_QUEUE_NUM) {
+                kfree(txq->cmd[slots_num]);
+                txq->cmd[slots_num] = NULL;
+        }
+        return -ENOMEM;
 }
 /**
 * iwl_hw_txq_ctx_free - Free TXQ Context
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index 04d7a251e3f0..8941919001bb 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -595,7 +595,7 @@ static int if_cs_prog_helper(struct if_cs_card *card)
                if (ret < 0) {
                        lbs_pr_err("can't download helper at 0x%x, ret %d\n",
                                sent, ret);
-                        goto done;
+                        goto err_release;
                }
                if (count == 0)
@@ -604,9 +604,8 @@ static int if_cs_prog_helper(struct if_cs_card *card)
                sent += count;
        }
+err_release:
        release_firmware(fw);
-        ret = 0;
 done:
        lbs_deb_leave_args(LBS_DEB_CS, "ret %d", ret);
        return ret;
@@ -676,14 +675,8 @@ static int if_cs_prog_real(struct if_cs_card *card)
        }
        ret = if_cs_poll_while_fw_download(card, IF_CS_SCRATCH, 0x5a);
-        if (ret < 0) {
+        if (ret < 0)
                lbs_pr_err("firmware download failed\n");
-                goto err_release;
-        }
-        ret = 0;
-        goto done;
 err_release:
        release_firmware(fw);
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 1ebcafe7ca5f..36c004e15602 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -1970,6 +1970,9 @@ __orinoco_set_multicast_list(struct net_device *dev)
                        priv->promiscuous = promisc;
        }
+        /* If we're not in promiscuous mode, then we need to set the
+         * group address if either we want to multicast, or if we were
+         * multicasting and want to stop */
        if (! promisc && (mc_count || priv->mc_count) ) {
                struct dev_mc_list *p = dev->mc_list;
                struct hermes_multicast mclist;
@@ -1989,9 +1992,10 @@ __orinoco_set_multicast_list(struct net_device *dev)
                        printk(KERN_WARNING "%s: Multicast list is "
                               "longer than mc_count\n", dev->name);
-                err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFGROUPADDRESSES,
+                err = hermes_write_ltv(hw, USER_BAP,
-                                       HERMES_BYTES_TO_RECLEN(priv->mc_count * ETH_ALEN),
+                                   HERMES_RID_CNFGROUPADDRESSES,
-                                       &mclist);
+                                   HERMES_BYTES_TO_RECLEN(mc_count * ETH_ALEN),
+                                   &mclist);
                if (err)
                        printk(KERN_ERR "%s: Error %d setting multicast list.\n",
                               dev->name, err);
diff --git a/drivers/net/wireless/rt2x00/rt2x00reg.h b/drivers/net/wireless/rt2x00/rt2x00reg.h
index 7e88ce5651b9..2ea7866abd5d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00reg.h
+++ b/drivers/net/wireless/rt2x00/rt2x00reg.h
@@ -136,7 +136,7 @@ struct rt2x00_field32 {
 */
 #define is_power_of_two(x)      ( !((x) & ((x)-1)) )
 #define low_bit_mask(x)         ( ((x)-1) & ~(x) )
-#define is_valid_mask(x)        is_power_of_two(1 + (x) + low_bit_mask(x))
+#define is_valid_mask(x)        is_power_of_two(1LU + (x) + low_bit_mask(x))
 /*
 * Macro's to find first set bit in a variable.
@@ -173,8 +173,7 @@ struct rt2x00_field32 {
 * does not exceed the given typelimit.
 */
 #define FIELD_CHECK(__mask, __type)                     \
-        BUILD_BUG_ON(!__builtin_constant_p(__mask) ||   \
+        BUILD_BUG_ON(!(__mask) ||                       \
-                     !(__mask) ||                       \
                     !is_valid_mask(__mask) ||          \
                     (__mask) != (__type)(__mask))      \
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index 6ea349aba3ba..b184367637d0 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -800,7 +800,6 @@ static void __exit cmos_do_remove(struct device *dev)
 static int cmos_suspend(struct device *dev, pm_message_t mesg)
 {
        struct cmos_rtc *cmos = dev_get_drvdata(dev);
-        int             do_wake = device_may_wakeup(dev);
        unsigned char   tmp;
        /* only the alarm might be a wakeup event source */
@@ -809,7 +808,7 @@ static int cmos_suspend(struct device *dev, pm_message_t mesg)
        if (tmp & (RTC_PIE|RTC_AIE|RTC_UIE)) {
                unsigned char   mask;
-                if (do_wake)
+                if (device_may_wakeup(dev))
                        mask = RTC_IRQMASK & ~RTC_AIE;
                else
                        mask = RTC_IRQMASK;
@@ -837,6 +836,17 @@ static int cmos_suspend(struct device *dev, pm_message_t mesg)
        return 0;
 }
+/* We want RTC alarms to wake us from e.g. ACPI G2/S5 "soft off", even
+ * after a detour through G3 "mechanical off", although the ACPI spec
+ * says wakeup should only work from G1/S4 "hibernate".  To most users,
+ * distinctions between S4 and S5 are pointless.  So when the hardware
+ * allows, don't draw that distinction.
+ */
+static inline int cmos_poweroff(struct device *dev)
+{
+        return cmos_suspend(dev, PMSG_HIBERNATE);
+}
 static int cmos_resume(struct device *dev)
 {
        struct cmos_rtc *cmos = dev_get_drvdata(dev);
@@ -884,6 +894,12 @@ static int cmos_resume(struct device *dev)
 #else
 #define cmos_suspend    NULL
 #define cmos_resume     NULL
+static inline int cmos_poweroff(struct device *dev)
+{
+        return -ENOSYS;
+}
 #endif
 /*----------------------------------------------------------------*/
@@ -903,10 +919,6 @@ static int cmos_resume(struct device *dev)
 static int __devinit
 cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
 {
-        /* REVISIT paranoia argues for a shutdown notifier, since PNP
-         * drivers can't provide shutdown() methods to disable IRQs.
-         * Or better yet, fix PNP to allow those methods...
-         */
        if (pnp_port_start(pnp,0) == 0x70 && !pnp_irq_valid(pnp,0))
                /* Some machines contain a PNP entry for the RTC, but
                 * don't define the IRQ. It should always be safe to
@@ -942,6 +954,13 @@ static int cmos_pnp_resume(struct pnp_dev *pnp)
 #define cmos_pnp_resume         NULL
 #endif
+static void cmos_pnp_shutdown(struct device *pdev)
+{
+        if (system_state == SYSTEM_POWER_OFF && !cmos_poweroff(pdev))
+                return;
+        cmos_do_shutdown();
+}
 static const struct pnp_device_id rtc_ids[] = {
        { .id = "PNP0b00", },
@@ -961,6 +980,10 @@ static struct pnp_driver cmos_pnp_driver = {
        .flags          = PNP_DRIVER_RES_DO_NOT_CHANGE,
        .suspend        = cmos_pnp_suspend,
        .resume         = cmos_pnp_resume,
+        .driver         = {
+                .name     = (char *)driver_name,
+                .shutdown = cmos_pnp_shutdown,
+        }
 };
 #endif  /* CONFIG_PNP */
@@ -986,6 +1009,9 @@ static int __exit cmos_platform_remove(struct platform_device *pdev)
 static void cmos_platform_shutdown(struct platform_device *pdev)
 {
+        if (system_state == SYSTEM_POWER_OFF && !cmos_poweroff(&pdev->dev))
+                return;
        cmos_do_shutdown();
 }
diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c
index 9f996ec881ce..dd70bf73ce9d 100644
--- a/drivers/rtc/rtc-lib.c
+++ b/drivers/rtc/rtc-lib.c
@@ -51,10 +51,11 @@ EXPORT_SYMBOL(rtc_year_days);
 */
 void rtc_time_to_tm(unsigned long time, struct rtc_time *tm)
 {
-        unsigned int days, month, year;
+        unsigned int month, year;
+        int days;
        days = time / 86400;
-        time -= days * 86400;
+        time -= (unsigned int) days * 86400;
        /* day of the week, 1970-01-01 was a Thursday */
        tm->tm_wday = (days + 4) % 7;
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e5e7d7856454..2a2bc89aba83 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1875,6 +1875,7 @@ static int sd_probe(struct device *dev)
        dev_set_drvdata(dev, sdkp);
        add_disk(gd);
+        blk_register_filter(gd);
        sd_dif_config_host(sdkp);
        sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
@@ -1908,6 +1909,7 @@ static int sd_remove(struct device *dev)
        struct scsi_disk *sdkp = dev_get_drvdata(dev);
        device_del(&sdkp->dev);
+        blk_unregister_filter(sdkp->disk);
        del_gendisk(sdkp->disk);
        sd_shutdown(dev);
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 27f5bfd1def3..3292965bfd84 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -656,6 +656,7 @@ static int sr_probe(struct device *dev)
        dev_set_drvdata(dev, cd);
        disk->flags |= GENHD_FL_REMOVABLE;
        add_disk(disk);
+        blk_register_filter(disk);
        sdev_printk(KERN_DEBUG, sdev,
                    "Attached scsi CD-ROM %s\n", cd->cdi.name);
@@ -894,6 +895,7 @@ static int sr_remove(struct device *dev)
 {
        struct scsi_cd *cd = dev_get_drvdata(dev);
+        blk_unregister_filter(cd->disk);
        del_gendisk(cd->disk);
        mutex_lock(&sr_ref_mutex);
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 342e12fb1c25..9ccc563d8730 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -1908,15 +1908,23 @@ static int serial8250_startup(struct uart_port *port)
                 * kick the UART on a regular basis.
                 */
                if (!(iir1 & UART_IIR_NO_INT) && (iir & UART_IIR_NO_INT)) {
+                        up->bugs |= UART_BUG_THRE;
                        pr_debug("ttyS%d - using backup timer\n", port->line);
-                        up->timer.function = serial8250_backup_timeout;
-                        up->timer.data = (unsigned long)up;
-                        mod_timer(&up->timer, jiffies +
-                                poll_timeout(up->port.timeout) + HZ / 5);
                }
        }
        /*
+         * The above check will only give an accurate result the first time
+         * the port is opened so this value needs to be preserved.
+         */
+        if (up->bugs & UART_BUG_THRE) {
+                up->timer.function = serial8250_backup_timeout;
+                up->timer.data = (unsigned long)up;
+                mod_timer(&up->timer, jiffies +
+                          poll_timeout(up->port.timeout) + HZ / 5);
+        }
+        /*
         * If the "interrupt" for this port doesn't correspond with any
         * hardware interrupt, we use a timer-based system.  The original
         * driver used to do this with IRQ0.
diff --git a/drivers/serial/8250.h b/drivers/serial/8250.h
index 78c00162b04e..520260326f3d 100644
--- a/drivers/serial/8250.h
+++ b/drivers/serial/8250.h
@@ -47,6 +47,7 @@ struct serial8250_config {
 #define UART_BUG_QUOT   (1 << 0)        /* UART has buggy quot LSB */
 #define UART_BUG_TXEN   (1 << 1)        /* UART has buggy TX IIR status */
 #define UART_BUG_NOMSR  (1 << 2)        /* UART has buggy MSR status bits (Au1x00) */
+#define UART_BUG_THRE   (1 << 3)        /* UART has buggy THRE reassertion */
 #define PROBE_RSA       (1 << 0)
 #define PROBE_ANY       (~0)
diff --git a/drivers/video/cirrusfb.c b/drivers/video/cirrusfb.c
index c14b2435d23e..e729fb279645 100644
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/cirrusfb.c
@@ -628,27 +628,18 @@ static long cirrusfb_get_mclk(long freq, int bpp, long *div)
 static int cirrusfb_check_var(struct fb_var_screeninfo *var,
                              struct fb_info *info)
 {
-        int nom, den;           /* translyting from pixels->bytes */
+        int yres;
-        int yres, i;
+        /* memory size in pixels */
-        static struct { int xres, yres; } modes[] =
+        unsigned pixels = info->screen_size * 8 / var->bits_per_pixel;
-        { { 1600, 1280 },
-          { 1280, 1024 },
-          { 1024, 768 },
-          { 800, 600 },
-          { 640, 480 },
-          { -1, -1 } };
        switch (var->bits_per_pixel) {
        case 1:
-                nom = 4;
+                pixels /= 4;
-                den = 8;
                break;          /* 8 pixel per byte, only 1/4th of mem usable */
        case 8:
        case 16:
        case 24:
        case 32:
-                nom = var->bits_per_pixel / 8;
-                den = 1;
                break;          /* 1 pixel == 1 byte */
        default:
                printk(KERN_ERR "cirrusfb: mode %dx%dx%d rejected..."
@@ -658,43 +649,29 @@ static int cirrusfb_check_var(struct fb_var_screeninfo *var,
                return -EINVAL;
        }
-        if (var->xres * nom / den * var->yres > info->screen_size) {
+        if (var->xres_virtual < var->xres)
-                printk(KERN_ERR "cirrusfb: mode %dx%dx%d rejected..."
+                var->xres_virtual = var->xres;
-                        "resolution too high to fit into video memory!\n",
-                        var->xres, var->yres, var->bits_per_pixel);
-                DPRINTK("EXIT - EINVAL error\n");
-                return -EINVAL;
-        }
        /* use highest possible virtual resolution */
-        if (var->xres_virtual == -1 &&
+        if (var->yres_virtual == -1) {
-            var->yres_virtual == -1) {
+                var->yres_virtual = pixels / var->xres_virtual;
-                printk(KERN_INFO
-                     "cirrusfb: using maximum available virtual resolution\n");
-                for (i = 0; modes[i].xres != -1; i++) {
-                        int size = modes[i].xres * nom / den * modes[i].yres;
-                        if (size < info->screen_size / 2)
-                                break;
-                }
-                if (modes[i].xres == -1) {
-                        printk(KERN_ERR "cirrusfb: could not find a virtual "
-                                "resolution that fits into video memory!!\n");
-                        DPRINTK("EXIT - EINVAL error\n");
-                        return -EINVAL;
-                }
-                var->xres_virtual = modes[i].xres;
-                var->yres_virtual = modes[i].yres;
                printk(KERN_INFO "cirrusfb: virtual resolution set to "
                        "maximum of %dx%d\n", var->xres_virtual,
                        var->yres_virtual);
        }
-        if (var->xres_virtual < var->xres)
-                var->xres_virtual = var->xres;
        if (var->yres_virtual < var->yres)
                var->yres_virtual = var->yres;
+        if (var->xres_virtual * var->yres_virtual > pixels) {
+                printk(KERN_ERR "cirrusfb: mode %dx%dx%d rejected... "
+                      "virtual resolution too high to fit into video memory!\n",
+                        var->xres_virtual, var->yres_virtual,
+                        var->bits_per_pixel);
+                DPRINTK("EXIT - EINVAL error\n");
+                return -EINVAL;
+        }
        if (var->xoffset < 0)
                var->xoffset = 0;
        if (var->yoffset < 0)
diff --git a/drivers/video/tdfxfb.c b/drivers/video/tdfxfb.c
index 77aafcfae037..4599a4385bc9 100644
--- a/drivers/video/tdfxfb.c
+++ b/drivers/video/tdfxfb.c
@@ -95,7 +95,6 @@ static inline int mtrr_del(int reg, unsigned long base,
 #define VOODOO5_MAX_PIXCLOCK 350000
 static struct fb_fix_screeninfo tdfx_fix __devinitdata = {
-        .id =           "3Dfx",
        .type =         FB_TYPE_PACKED_PIXELS,
        .visual =       FB_VISUAL_PSEUDOCOLOR,
        .ypanstep =     1,
@@ -426,7 +425,7 @@ static unsigned long do_lfb_size(struct tdfx_par *par, unsigned short dev_id)
        if (dev_id < PCI_DEVICE_ID_3DFX_VOODOO5) {
                /* Banshee/Voodoo3 */
                chip_size = 2;
-                if (has_sgram && (draminit0 & DRAMINIT0_SGRAM_TYPE))
+                if (has_sgram && !(draminit0 & DRAMINIT0_SGRAM_TYPE))
                        chip_size = 1;
        } else {
                /* Voodoo4/5 */
@@ -1200,15 +1199,15 @@ static int __devinit tdfxfb_probe(struct pci_dev *pdev,
        /* Configure the default fb_fix_screeninfo first */
        switch (pdev->device) {
        case PCI_DEVICE_ID_3DFX_BANSHEE:
-                strcat(tdfx_fix.id, " Banshee");
+                strcpy(tdfx_fix.id, "3Dfx Banshee");
                default_par->max_pixclock = BANSHEE_MAX_PIXCLOCK;
                break;
        case PCI_DEVICE_ID_3DFX_VOODOO3:
-                strcat(tdfx_fix.id, " Voodoo3");
+                strcpy(tdfx_fix.id, "3Dfx Voodoo3");
                default_par->max_pixclock = VOODOO3_MAX_PIXCLOCK;
                break;
        case PCI_DEVICE_ID_3DFX_VOODOO5:
-                strcat(tdfx_fix.id, " Voodoo5");
+                strcpy(tdfx_fix.id, "3Dfx Voodoo5");
                default_par->max_pixclock = VOODOO5_MAX_PIXCLOCK;
                break;
        }