52 files changed, 621 insertions, 342 deletions
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 3208ce08d66d..e2ce4a9c1c92 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -244,6 +244,17 @@ config ACPI_IBM_DOCK
          If you are not sure, say N here.
+config ACPI_IBM_BAY
+        bool "Legacy Removable Bay Support"
+        depends on ACPI_IBM
+        default y
+        ---help---
+          Allows the ibm_acpi driver to handle removable bays.  It will allow
+          disabling the device in the bay, and also generate notifications when
+          the bay lever is ejected or inserted.
+          If you are not sure, say Y here.
 config ACPI_TOSHIBA
        tristate "Toshiba Laptop Extras"
        depends on X86
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index ab6888373795..a802962ff2b4 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -100,6 +100,7 @@ static struct acpi_ec {
        unsigned long global_lock;
        struct mutex lock;
        atomic_t query_pending;
+        atomic_t event_count;
        atomic_t leaving_burst; /* 0 : No, 1 : Yes, 2: abort */
        wait_queue_head_t wait;
 } *ec_ecdt;
@@ -131,10 +132,12 @@ static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data)
        outb(data, ec->data_addr);
 }
-static inline int acpi_ec_check_status(struct acpi_ec *ec, enum ec_event event)
+static inline int acpi_ec_check_status(struct acpi_ec *ec, enum ec_event event,
+                                       unsigned old_count)
 {
        u8 status = acpi_ec_read_status(ec);
+        if (old_count == atomic_read(&ec->event_count))
+                return 0;
        if (event == ACPI_EC_EVENT_OBF_1) {
                if (status & ACPI_EC_FLAG_OBF)
                        return 1;
@@ -146,19 +149,19 @@ static inline int acpi_ec_check_status(struct acpi_ec *ec, enum ec_event event)
        return 0;
 }
-static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event)
+static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event, unsigned count)
 {
        if (acpi_ec_mode == EC_POLL) {
                unsigned long delay = jiffies + msecs_to_jiffies(ACPI_EC_DELAY);
                while (time_before(jiffies, delay)) {
-                        if (acpi_ec_check_status(ec, event))
+                        if (acpi_ec_check_status(ec, event, 0))
                                return 0;
                }
        } else {
                if (wait_event_timeout(ec->wait,
-                                       acpi_ec_check_status(ec, event),
+                                       acpi_ec_check_status(ec, event, count),
                                       msecs_to_jiffies(ACPI_EC_DELAY)) ||
-                    acpi_ec_check_status(ec, event)) {
+                    acpi_ec_check_status(ec, event, 0)) {
                        return 0;
                } else {
                        printk(KERN_ERR PREFIX "acpi_ec_wait timeout,"
@@ -225,21 +228,22 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, u8 command,
                                        u8 * rdata, unsigned rdata_len)
 {
        int result = 0;
+        unsigned count = atomic_read(&ec->event_count);
        acpi_ec_write_cmd(ec, command);
        for (; wdata_len > 0; --wdata_len) {
-                result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
+                result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, count);
                if (result) {
                        printk(KERN_ERR PREFIX
                               "write_cmd timeout, command = %d\n", command);
                        goto end;
                }
+                count = atomic_read(&ec->event_count);
                acpi_ec_write_data(ec, *(wdata++));
        }
        if (!rdata_len) {
-                result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
+                result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, count);
                if (result) {
                        printk(KERN_ERR PREFIX
                               "finish-write timeout, command = %d\n", command);
@@ -250,13 +254,13 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, u8 command,
        }
        for (; rdata_len > 0; --rdata_len) {
-                result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1);
+                result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1, count);
                if (result) {
                        printk(KERN_ERR PREFIX "read timeout, command = %d\n",
                               command);
                        goto end;
                }
+                count = atomic_read(&ec->event_count);
                *(rdata++) = acpi_ec_read_data(ec);
        }
      end:
@@ -288,7 +292,7 @@ static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
        /* Make sure GPE is enabled before doing transaction */
        acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
+        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0, 0);
        if (status) {
                printk(KERN_DEBUG PREFIX
                       "input buffer is not empty, aborting transaction\n");
@@ -369,8 +373,8 @@ int ec_write(u8 addr, u8 val)
 EXPORT_SYMBOL(ec_write);
 int ec_transaction(u8 command,
-                          const u8 * wdata, unsigned wdata_len,
+                   const u8 * wdata, unsigned wdata_len,
-                          u8 * rdata, unsigned rdata_len)
+                   u8 * rdata, unsigned rdata_len)
 {
        struct acpi_ec *ec;
@@ -435,7 +439,7 @@ static u32 acpi_ec_gpe_handler(void *data)
        acpi_status status = AE_OK;
        u8 value;
        struct acpi_ec *ec = (struct acpi_ec *)data;
+        atomic_inc(&ec->event_count);
        if (acpi_ec_mode == EC_INTR) {
                wake_up(&ec->wait);
        }
@@ -633,6 +637,7 @@ static int acpi_ec_add(struct acpi_device *device)
        ec->uid = -1;
        mutex_init(&ec->lock);
        atomic_set(&ec->query_pending, 0);
+        atomic_set(&ec->event_count, 1);
        if (acpi_ec_mode == EC_INTR) {
                atomic_set(&ec->leaving_burst, 1);
                init_waitqueue_head(&ec->wait);
@@ -807,6 +812,7 @@ acpi_fake_ecdt_callback(acpi_handle handle,
        acpi_status status;
        mutex_init(&ec_ecdt->lock);
+        atomic_set(&ec_ecdt->event_count, 1);
        if (acpi_ec_mode == EC_INTR) {
                init_waitqueue_head(&ec_ecdt->wait);
        }
@@ -888,6 +894,7 @@ static int __init acpi_ec_get_real_ecdt(void)
                return -ENOMEM;
        mutex_init(&ec_ecdt->lock);
+        atomic_set(&ec_ecdt->event_count, 1);
        if (acpi_ec_mode == EC_INTR) {
                init_waitqueue_head(&ec_ecdt->wait);
        }
@@ -1016,8 +1023,7 @@ static int __init acpi_ec_set_intr_mode(char *str)
                acpi_ec_mode = EC_POLL;
        }
        acpi_ec_driver.ops.add = acpi_ec_add;
-        printk(KERN_NOTICE PREFIX "%s mode.\n",
+        printk(KERN_NOTICE PREFIX "%s mode.\n", intr ? "interrupt" : "polling");
-                          intr ? "interrupt" : "polling");
        return 1;
 }
diff --git a/drivers/acpi/events/evmisc.c b/drivers/acpi/events/evmisc.c
index d572700197f3..8dcade63b04b 100644
--- a/drivers/acpi/events/evmisc.c
+++ b/drivers/acpi/events/evmisc.c
@@ -423,6 +423,8 @@ static acpi_status acpi_ev_remove_global_lock_handler(void)
 * the global lock appear as a standard mutex on the OS side.
 *
 *****************************************************************************/
+static acpi_thread_id acpi_ev_global_lock_thread_id;
+static int acpi_ev_global_lock_acquired;
 acpi_status acpi_ev_acquire_global_lock(u16 timeout)
 {
@@ -435,11 +437,24 @@ acpi_status acpi_ev_acquire_global_lock(u16 timeout)
         * Only one thread can acquire the GL at a time, the global_lock_mutex
         * enforces this. This interface releases the interpreter if we must wait.
         */
-        status = acpi_ex_system_wait_mutex(acpi_gbl_global_lock_mutex, timeout);
+        status = acpi_ex_system_wait_mutex(acpi_gbl_global_lock_mutex, 0);
+        if (status == AE_TIME) {
+                if (acpi_ev_global_lock_thread_id == acpi_os_get_thread_id()) {
+                        acpi_ev_global_lock_acquired++;
+                        return AE_OK;
+                }
+        }
+        if (ACPI_FAILURE(status)) {
+                status = acpi_ex_system_wait_mutex(acpi_gbl_global_lock_mutex, timeout);
+        }
        if (ACPI_FAILURE(status)) {
                return_ACPI_STATUS(status);
        }
+        acpi_ev_global_lock_thread_id = acpi_os_get_thread_id();
+        acpi_ev_global_lock_acquired++;
        /*
         * Make sure that a global lock actually exists. If not, just treat
         * the lock as a standard mutex.
@@ -506,6 +521,11 @@ acpi_status acpi_ev_release_global_lock(void)
                return_ACPI_STATUS(AE_NOT_ACQUIRED);
        }
+        acpi_ev_global_lock_acquired--;
+        if (acpi_ev_global_lock_acquired > 0) {
+                return AE_OK;
+        }
        if (acpi_gbl_global_lock_present) {
                /* Allow any thread to release the lock */
@@ -529,7 +549,8 @@ acpi_status acpi_ev_release_global_lock(void)
        acpi_gbl_global_lock_acquired = FALSE;
        /* Release the local GL mutex */
+        acpi_ev_global_lock_thread_id = 0;
+        acpi_ev_global_lock_acquired = 0;
        acpi_os_release_mutex(acpi_gbl_global_lock_mutex);
        return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/ibm_acpi.c b/drivers/acpi/ibm_acpi.c
index 4cc534e36e81..36901362fd24 100644
--- a/drivers/acpi/ibm_acpi.c
+++ b/drivers/acpi/ibm_acpi.c
@@ -86,6 +86,7 @@
 #include <linux/proc_fs.h>
 #include <linux/backlight.h>
+#include <linux/fb.h>
 #include <asm/uaccess.h>
 #include <linux/dmi.h>
@@ -157,6 +158,7 @@ IBM_HANDLE(dock, root, "\\_SB.GDCK",	/* X30, X31, X40 */
           "\\_SB.PCI.ISA.SLCE",        /* 570 */
    );                          /* A21e,G4x,R30,R31,R32,R40,R40e,R50e */
 #endif
+#ifdef CONFIG_ACPI_IBM_BAY
 IBM_HANDLE(bay, root, "\\_SB.PCI.IDE.SECN.MAST",        /* 570 */
           "\\_SB.PCI0.IDE0.IDES.IDSM", /* 600e/x, 770e, 770x */
           "\\_SB.PCI0.SATA.SCND.MSTR", /* T60, X60, Z60 */ 
@@ -174,6 +176,7 @@ IBM_HANDLE(bay2, root, "\\_SB.PCI0.IDE0.PRIM.SLAV",	/* A3x, R32 */
 IBM_HANDLE(bay2_ej, bay2, "_EJ3",       /* 600e/x, 770e, A3x */
           "_EJ0",              /* 770x */
    );                          /* all others */
+#endif /* CONFIG_ACPI_IBM_BAY */
 /* don't list other alternatives as we install a notify handler on the 570 */
 IBM_HANDLE(pci, root, "\\_SB.PCI");     /* 570 */
@@ -1044,6 +1047,7 @@ static int light_write(char *buf)
        return 0;
 }
+#if defined(CONFIG_ACPI_IBM_DOCK) || defined(CONFIG_ACPI_IBM_BAY)
 static int _sta(acpi_handle handle)
 {
        int status;
@@ -1053,6 +1057,7 @@ static int _sta(acpi_handle handle)
        return status;
 }
+#endif
 #ifdef CONFIG_ACPI_IBM_DOCK
 #define dock_docked() (_sta(dock_handle) & 1)
@@ -1119,6 +1124,7 @@ static void dock_notify(struct ibm_struct *ibm, u32 event)
 }
 #endif
+#ifdef CONFIG_ACPI_IBM_BAY
 static int bay_status_supported;
 static int bay_status2_supported;
 static int bay_eject_supported;
@@ -1194,6 +1200,7 @@ static void bay_notify(struct ibm_struct *ibm, u32 event)
 {
        acpi_bus_generate_event(ibm->device, event, 0);
 }
+#endif /* CONFIG_ACPI_IBM_BAY */
 static int cmos_read(char *p)
 {
@@ -1701,7 +1708,10 @@ static int brightness_write(char *buf)
 static int brightness_update_status(struct backlight_device *bd)
 {
-        return brightness_set(bd->props.brightness);
+        return brightness_set(
+                (bd->props.fb_blank == FB_BLANK_UNBLANK &&
+                 bd->props.power == FB_BLANK_UNBLANK) ?
+                                bd->props.brightness : 0);
 }
 static struct backlight_ops ibm_backlight_data = {
@@ -1711,6 +1721,12 @@ static struct backlight_ops ibm_backlight_data = {
 static int brightness_init(void)
 {
+        int b;
+        b = brightness_get(NULL);
+        if (b < 0)
+                return b;
        ibm_backlight_device = backlight_device_register("ibm", NULL, NULL,
                                                         &ibm_backlight_data);
        if (IS_ERR(ibm_backlight_device)) {
@@ -1718,7 +1734,9 @@ static int brightness_init(void)
                return PTR_ERR(ibm_backlight_device);
        }
-        ibm_backlight_device->props.max_brightness = 7;
+        ibm_backlight_device->props.max_brightness = 7;
+        ibm_backlight_device->props.brightness = b;
+        backlight_update_status(ibm_backlight_device);
        return 0;
 }
@@ -2353,6 +2371,7 @@ static struct ibm_struct ibms[] = {
         .type = ACPI_SYSTEM_NOTIFY,
         },
 #endif
+#ifdef CONFIG_ACPI_IBM_BAY
        {
         .name = "bay",
         .init = bay_init,
@@ -2362,6 +2381,7 @@ static struct ibm_struct ibms[] = {
         .handle = &bay_handle,
         .type = ACPI_SYSTEM_NOTIFY,
         },
+#endif /* CONFIG_ACPI_IBM_BAY */
        {
         .name = "cmos",
         .read = cmos_read,
@@ -2647,7 +2667,9 @@ IBM_PARAM(light);
 #ifdef CONFIG_ACPI_IBM_DOCK
 IBM_PARAM(dock);
 #endif
+#ifdef CONFIG_ACPI_IBM_BAY
 IBM_PARAM(bay);
+#endif /* CONFIG_ACPI_IBM_BAY */
 IBM_PARAM(cmos);
 IBM_PARAM(led);
 IBM_PARAM(beep);
@@ -2723,12 +2745,14 @@ static int __init acpi_ibm_init(void)
        IBM_HANDLE_INIT(dock);
 #endif
        IBM_HANDLE_INIT(pci);
+#ifdef CONFIG_ACPI_IBM_BAY
        IBM_HANDLE_INIT(bay);
        if (bay_handle)
                IBM_HANDLE_INIT(bay_ej);
        IBM_HANDLE_INIT(bay2);
        if (bay2_handle)
                IBM_HANDLE_INIT(bay2_ej);
+#endif /* CONFIG_ACPI_IBM_BAY */
        IBM_HANDLE_INIT(beep);
        IBM_HANDLE_INIT(ecrd);
        IBM_HANDLE_INIT(ecwr);
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index ccecfe0d695c..4ffecd179702 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -436,8 +436,6 @@ int acpi_power_transition(struct acpi_device *device, int state)
        cl = &device->power.states[device->power.state].resources;
        tl = &device->power.states[state].resources;
-        device->power.state = ACPI_STATE_UNKNOWN;
        if (!cl->count && !tl->count) {
                result = -ENODEV;
                goto end;
@@ -468,12 +466,15 @@ int acpi_power_transition(struct acpi_device *device, int state)
                        goto end;
        }
-        /* We shouldn't change the state till all above operations succeed */
+     end:
-        device->power.state = state;
+        if (result) {
-      end:
+                device->power.state = ACPI_STATE_UNKNOWN;
-        if (result)
                printk(KERN_WARNING PREFIX "Transitioning device [%s] to D%d\n",
                              device->pnp.bus_id, state);
+        } else {
+        /* We shouldn't change the state till all above operations succeed */
+                device->power.state = state;
+        }
        return result;
 }
diff --git a/drivers/acpi/resources/rscreate.c b/drivers/acpi/resources/rscreate.c
index 1358c06a969c..cc48ab05676c 100644
--- a/drivers/acpi/resources/rscreate.c
+++ b/drivers/acpi/resources/rscreate.c
@@ -191,6 +191,9 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
        user_prt = ACPI_CAST_PTR(struct acpi_pci_routing_table, buffer);
        for (index = 0; index < number_of_elements; index++) {
+                int source_name_index = 2;
+                int source_index_index = 3;
                /*
                 * Point user_prt past this current structure
                 *
@@ -261,10 +264,28 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
                }
                /*
+                 * If BIOS erroneously reversed the _PRT source_name and source_index,
+                 * then reverse them back.
+                 */
+                if (ACPI_GET_OBJECT_TYPE (sub_object_list[3]) != ACPI_TYPE_INTEGER) {
+                        if (acpi_gbl_enable_interpreter_slack) {
+                                source_name_index = 3;
+                                source_index_index = 2;
+                                printk(KERN_WARNING "ACPI: Handling Garbled _PRT entry\n");
+                        } else {
+                                ACPI_ERROR((AE_INFO,
+                                        "(PRT[%X].source_index) Need Integer, found %s",
+                                        index,
+                                        acpi_ut_get_object_type_name(sub_object_list[3])));
+                                return_ACPI_STATUS(AE_BAD_DATA);
+                        }
+                }
+                /*
                 * 3) Third subobject: Dereference the PRT.source_name
                 * The name may be unresolved (slack mode), so allow a null object
                 */
-                obj_desc = sub_object_list[2];
+                obj_desc = sub_object_list[source_name_index];
                if (obj_desc) {
                        switch (ACPI_GET_OBJECT_TYPE(obj_desc)) {
                        case ACPI_TYPE_LOCAL_REFERENCE:
@@ -339,7 +360,7 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
                /* 4) Fourth subobject: Dereference the PRT.source_index */
-                obj_desc = sub_object_list[3];
+                obj_desc = sub_object_list[source_index_index];
                if (ACPI_GET_OBJECT_TYPE(obj_desc) == ACPI_TYPE_INTEGER) {
                        user_prt->source_index = (u32) obj_desc->integer.value;
                } else {
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index dc42ba1b46f7..b952c584338f 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -93,7 +93,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "ata_piix"
-#define DRV_VERSION     "2.10"
+#define DRV_VERSION     "2.10ac1"
 enum {
        PIIX_IOCFG              = 0x54, /* IDE I/O configuration register */
@@ -667,14 +667,9 @@ static int ich_pata_prereset(struct ata_port *ap)
 {
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
-        if (!pci_test_config_bits(pdev, &piix_enable_bits[ap->port_no])) {
+        if (!pci_test_config_bits(pdev, &piix_enable_bits[ap->port_no]))
-                ata_port_printk(ap, KERN_INFO, "port disabled. ignoring.\n");
+                return -ENOENT;
-                ap->eh_context.i.action &= ~ATA_EH_RESET_MASK;
-                return 0;
-        }
        ich_pata_cbl_detect(ap);
        return ata_std_prereset(ap);
 }
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index d14a48e75f1b..c428a56e6f31 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -34,6 +34,13 @@ struct taskfile_array {
        u8      tfa[REGS_PER_GTF];      /* regs. 0x1f1 - 0x1f7 */
 };
+/*
+ *      Helper - belongs in the PCI layer somewhere eventually
+ */
+static int is_pci_dev(struct device *dev)
+{
+        return (dev->bus == &pci_bus_type);
+}
 /**
 * sata_get_dev_handle - finds acpi_handle and PCI device.function
@@ -53,6 +60,9 @@ static int sata_get_dev_handle(struct device *dev, acpi_handle *handle,
        struct pci_dev  *pci_dev;
        acpi_integer    addr;
+        if (!is_pci_dev(dev))
+                return -ENODEV;
        pci_dev = to_pci_dev(dev);      /* NOTE: PCI-specific */
        /* Please refer to the ACPI spec for the syntax of _ADR. */
        addr = (PCI_SLOT(pci_dev->devfn) << 16) | PCI_FUNC(pci_dev->devfn);
@@ -84,7 +94,12 @@ static int pata_get_dev_handle(struct device *dev, acpi_handle *handle,
        acpi_status status;
        struct acpi_device_info *dinfo = NULL;
        int ret = -ENODEV;
-        struct pci_dev *pdev = to_pci_dev(dev);
+        struct pci_dev *pdev;
+        if (!is_pci_dev(dev))
+                return -ENODEV;
+        pdev = to_pci_dev(dev);
        bus = pdev->bus->number;
        devnum = PCI_SLOT(pdev->devfn);
@@ -561,6 +576,13 @@ int ata_acpi_exec_tfs(struct ata_port *ap)
        if (noacpi)
                return 0;
+        /*
+         * TBD - implement PATA support.  For now,
+         * we should not run GTF on PATA devices since some
+         * PATA require execution of GTM/STM before GTF.
+         */
+        if (!(ap->cbl == ATA_CBL_SATA))
+                return 0;
        for (ix = 0; ix < ATA_MAX_DEVICES; ix++) {
                if (!ata_dev_enabled(&ap->device[ix]))
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index dc362fa01ca4..3c1f8830ac8b 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3455,7 +3455,8 @@ static void ata_dev_xfermask(struct ata_device *dev)
                               "device is on DMA blacklist, disabling DMA\n");
        }
-        if ((host->flags & ATA_HOST_SIMPLEX) && host->simplex_claimed != ap) {
+        if ((host->flags & ATA_HOST_SIMPLEX) &&
+            host->simplex_claimed && host->simplex_claimed != ap) {
                xfer_mask &= ~(ATA_MASK_MWDMA | ATA_MASK_UDMA);
                ata_dev_printk(dev, KERN_WARNING, "simplex DMA is claimed by "
                               "other device, disabling DMA\n");
@@ -5684,18 +5685,22 @@ static void ata_host_release(struct device *gendev, void *res)
        for (i = 0; i < host->n_ports; i++) {
                struct ata_port *ap = host->ports[i];
-                if (!ap)
+                if (ap && ap->ops->port_stop)
-                        continue;
-                if (ap->ops->port_stop)
                        ap->ops->port_stop(ap);
-                scsi_host_put(ap->scsi_host);
        }
        if (host->ops->host_stop)
                host->ops->host_stop(host);
+        for (i = 0; i < host->n_ports; i++) {
+                struct ata_port *ap = host->ports[i];
+                if (ap)
+                        scsi_host_put(ap->scsi_host);
+                host->ports[i] = NULL;
+        }
        dev_set_drvdata(gendev, NULL);
 }
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 388d07fab5f7..9d9670a9b117 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -874,8 +874,14 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
                        if (status & (NV_ADMA_STAT_DONE |
                                      NV_ADMA_STAT_CPBERR)) {
-                                u32 check_commands = notifier | notifier_error;
+                                u32 check_commands;
                                int pos, error = 0;
+                                if(ata_tag_valid(ap->active_tag))
+                                        check_commands = 1 << ap->active_tag;
+                                else
+                                        check_commands = ap->sactive;
                                /** Check CPBs for completed commands */
                                while ((pos = ffs(check_commands)) && !error) {
                                        pos--;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index cf2a398aaaa1..89ebe3682726 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -787,6 +787,13 @@ void device_del(struct device * dev)
        device_remove_attrs(dev);
        bus_remove_device(dev);
+        /*
+         * Some platform devices are driven without driver attached
+         * and managed resources may have been acquired.  Make sure
+         * all resources are released.
+         */
+        devres_release_all(dev);
        /* Notify the platform of the removal, in case they
         * need to do anything...
         */
diff --git a/drivers/char/ds1286.c b/drivers/char/ds1286.c
index 6d58b0370802..59146e3365ba 100644
--- a/drivers/char/ds1286.c
+++ b/drivers/char/ds1286.c
@@ -197,6 +197,7 @@ static int ds1286_ioctl(struct inode *inode, struct file *file,
                hrs = alm_tm.tm_hour;
                min = alm_tm.tm_min;
+                sec = alm_tm.tm_sec;
                if (hrs >= 24)
                        hrs = 0xff;
@@ -204,9 +205,11 @@ static int ds1286_ioctl(struct inode *inode, struct file *file,
                if (min >= 60)
                        min = 0xff;
-                BIN_TO_BCD(sec);
+                if (sec != 0)
-                BIN_TO_BCD(min);
+                        return -EINVAL;
-                BIN_TO_BCD(hrs);
+                min = BIN2BCD(min);
+                min = BIN2BCD(hrs);
                spin_lock(&ds1286_lock);
                rtc_write(hrs, RTC_HOURS_ALARM);
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index a44db75bc25b..a905f7820331 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -128,7 +128,7 @@ EXPORT_SYMBOL_GPL(cn_netlink_send);
 */
 static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), void *data)
 {
-        struct cn_callback_entry *__cbq;
+        struct cn_callback_entry *__cbq, *__new_cbq;
        struct cn_dev *dev = &cdev;
        int err = -ENODEV;
@@ -148,27 +148,27 @@ static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), v
                        } else {
                                struct cn_callback_data *d;
                                
-                                __cbq = kzalloc(sizeof(*__cbq), GFP_ATOMIC);
+                                err = -ENOMEM;
-                                if (__cbq) {
+                                __new_cbq = kzalloc(sizeof(struct cn_callback_entry), GFP_ATOMIC);
-                                        d = &__cbq->data;
+                                if (__new_cbq) {
+                                        d = &__new_cbq->data;
                                        d->callback_priv = msg;
                                        d->callback = __cbq->data.callback;
                                        d->ddata = data;
                                        d->destruct_data = destruct_data;
-                                        d->free = __cbq;
+                                        d->free = __new_cbq;
-                                        INIT_WORK(&__cbq->work,
+                                        INIT_WORK(&__new_cbq->work,
                                                        &cn_queue_wrapper);
-                                        
                                        if (queue_work(dev->cbdev->cn_queue,
-                                                    &__cbq->work))
+                                                    &__new_cbq->work))
                                                err = 0;
                                        else {
-                                                kfree(__cbq);
+                                                kfree(__new_cbq);
                                                err = -EINVAL;
                                        }
-                                } else
+                                }
-                                        err = -ENOMEM;
                        }
                        break;
                }
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index d441815a3e0c..fde92ce45153 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1821,7 +1821,7 @@ static int cma_alloc_port(struct idr *ps, struct rdma_id_private *id_priv,
        struct rdma_bind_list *bind_list;
        int port, ret;
-        bind_list = kmalloc(sizeof *bind_list, GFP_KERNEL);
+        bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL);
        if (!bind_list)
                return -ENOMEM;
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index b516b93b8550..c859134c1daa 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -266,7 +266,7 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
        mutex_lock(&ctx->file->mut);
        if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) {
                if (!ctx->backlog) {
-                        ret = -EDQUOT;
+                        ret = -ENOMEM;
                        kfree(uevent);
                        goto out;
                }
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index d737c738d876..818cf1aee8c7 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -36,6 +36,7 @@
 #include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/pci.h>
+#include <linux/dma-mapping.h>
 #include "cxio_resource.h"
 #include "cxio_hal.h"
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index b21fde8b659d..d0ed1d35ca3e 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -305,8 +305,7 @@ static int status2errno(int status)
 */
 static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp)
 {
-        if (skb) {
+        if (skb && !skb_is_nonlinear(skb) && !skb_cloned(skb)) {
-                BUG_ON(skb_cloned(skb));
                skb_trim(skb, 0);
                skb_get(skb);
        } else {
@@ -1415,6 +1414,7 @@ static int peer_close(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                wake_up(&ep->com.waitq);
                break;
        case FPDU_MODE:
+                start_ep_timer(ep);
                __state_set(&ep->com, CLOSING);
                attrs.next_state = IWCH_QP_STATE_CLOSING;
                iwch_modify_qp(ep->com.qp->rhp, ep->com.qp,
@@ -1425,7 +1425,6 @@ static int peer_close(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                disconnect = 0;
                break;
        case CLOSING:
-                start_ep_timer(ep);
                __state_set(&ep->com, MORIBUND);
                disconnect = 0;
                break;
@@ -1487,8 +1486,10 @@ static int peer_abort(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
        case CONNECTING:
                break;
        case MPA_REQ_WAIT:
+                stop_ep_timer(ep);
                break;
        case MPA_REQ_SENT:
+                stop_ep_timer(ep);
                connect_reply_upcall(ep, -ECONNRESET);
                break;
        case MPA_REP_SENT:
@@ -1507,9 +1508,10 @@ static int peer_abort(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                get_ep(&ep->com);
                break;
        case MORIBUND:
+        case CLOSING:
                stop_ep_timer(ep);
+                /*FALLTHROUGH*/
        case FPDU_MODE:
-        case CLOSING:
                if (ep->com.cm_id && ep->com.qp) {
                        attrs.next_state = IWCH_QP_STATE_ERROR;
                        ret = iwch_modify_qp(ep->com.qp->rhp,
@@ -1570,7 +1572,6 @@ static int close_con_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
        spin_lock_irqsave(&ep->com.lock, flags);
        switch (ep->com.state) {
        case CLOSING:
-                start_ep_timer(ep);
                __state_set(&ep->com, MORIBUND);
                break;
        case MORIBUND:
@@ -1586,6 +1587,8 @@ static int close_con_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                __state_set(&ep->com, DEAD);
                release = 1;
                break;
+        case ABORTING:
+                break;
        case DEAD:
        default:
                BUG_ON(1);
@@ -1659,6 +1662,7 @@ static void ep_timeout(unsigned long arg)
                break;
        case MPA_REQ_WAIT:
                break;
+        case CLOSING:
        case MORIBUND:
                if (ep->com.cm_id && ep->com.qp) {
                        attrs.next_state = IWCH_QP_STATE_ERROR;
@@ -1687,12 +1691,11 @@ int iwch_reject_cr(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
                return -ECONNRESET;
        }
        BUG_ON(state_read(&ep->com) != MPA_REQ_RCVD);
-        state_set(&ep->com, CLOSING);
        if (mpa_rev == 0)
                abort_connection(ep, NULL, GFP_KERNEL);
        else {
                err = send_mpa_reject(ep, pdata, pdata_len);
-                err = send_halfclose(ep, GFP_KERNEL);
+                err = iwch_ep_disconnect(ep, 0, GFP_KERNEL);
        }
        return 0;
 }
@@ -1957,11 +1960,11 @@ int iwch_ep_disconnect(struct iwch_ep *ep, int abrupt, gfp_t gfp)
        case MPA_REQ_RCVD:
        case MPA_REP_SENT:
        case FPDU_MODE:
+                start_ep_timer(ep);
                ep->com.state = CLOSING;
                close = 1;
                break;
        case CLOSING:
-                start_ep_timer(ep);
                ep->com.state = MORIBUND;
                close = 1;
                break;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_ev.c b/drivers/infiniband/hw/cxgb3/iwch_ev.c
index 54362afbf72f..b40676662a8a 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_ev.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_ev.c
@@ -47,12 +47,6 @@ static void post_qp_event(struct iwch_dev *rnicp, struct iwch_cq *chp,
        struct iwch_qp_attributes attrs;
        struct iwch_qp *qhp;
-        printk(KERN_ERR "%s - AE qpid 0x%x opcode %d status 0x%x "
-               "type %d wrid.hi 0x%x wrid.lo 0x%x \n", __FUNCTION__,
-               CQE_QPID(rsp_msg->cqe), CQE_OPCODE(rsp_msg->cqe),
-               CQE_STATUS(rsp_msg->cqe), CQE_TYPE(rsp_msg->cqe),
-               CQE_WRID_HI(rsp_msg->cqe), CQE_WRID_LOW(rsp_msg->cqe));
        spin_lock(&rnicp->lock);
        qhp = get_qhp(rnicp, CQE_QPID(rsp_msg->cqe));
@@ -73,6 +67,12 @@ static void post_qp_event(struct iwch_dev *rnicp, struct iwch_cq *chp,
                return;
        }
+        printk(KERN_ERR "%s - AE qpid 0x%x opcode %d status 0x%x "
+               "type %d wrid.hi 0x%x wrid.lo 0x%x \n", __FUNCTION__,
+               CQE_QPID(rsp_msg->cqe), CQE_OPCODE(rsp_msg->cqe),
+               CQE_STATUS(rsp_msg->cqe), CQE_TYPE(rsp_msg->cqe),
+               CQE_WRID_HI(rsp_msg->cqe), CQE_WRID_LOW(rsp_msg->cqe));
        atomic_inc(&qhp->refcnt);
        spin_unlock(&rnicp->lock);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index 9947a144a929..f2774ae906bf 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -331,6 +331,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
        int ret = 0;
        struct iwch_mm_entry *mm;
        struct iwch_ucontext *ucontext;
+        u64 addr;
        PDBG("%s pgoff 0x%lx key 0x%x len %d\n", __FUNCTION__, vma->vm_pgoff,
             key, len);
@@ -345,10 +346,11 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
        mm = remove_mmap(ucontext, key, len);
        if (!mm)
                return -EINVAL;
+        addr = mm->addr;
        kfree(mm);
-        if ((mm->addr >= rdev_p->rnic_info.udbell_physbase) &&
+        if ((addr >= rdev_p->rnic_info.udbell_physbase) &&
-            (mm->addr < (rdev_p->rnic_info.udbell_physbase +
+            (addr < (rdev_p->rnic_info.udbell_physbase +
                       rdev_p->rnic_info.udbell_len))) {
                /*
@@ -362,7 +364,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
                vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
                vma->vm_flags &= ~VM_MAYREAD;
                ret = io_remap_pfn_range(vma, vma->vm_start,
-                                         mm->addr >> PAGE_SHIFT,
+                                         addr >> PAGE_SHIFT,
                                         len, vma->vm_page_prot);
        } else {
@@ -370,7 +372,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
                 * Map WQ or CQ contig dma memory...
                 */
                ret = remap_pfn_range(vma, vma->vm_start,
-                                      mm->addr >> PAGE_SHIFT,
+                                      addr >> PAGE_SHIFT,
                                      len, vma->vm_page_prot);
        }
@@ -463,9 +465,6 @@ static struct ib_mr *iwch_register_phys_mem(struct ib_pd *pd,
        php = to_iwch_pd(pd);
        rhp = php->rhp;
-        acc = iwch_convert_access(acc);
        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
        if (!mhp)
                return ERR_PTR(-ENOMEM);
@@ -491,12 +490,7 @@ static struct ib_mr *iwch_register_phys_mem(struct ib_pd *pd,
        mhp->attr.pdid = php->pdid;
        mhp->attr.zbva = 0;
-        /* NOTE: TPT perms are backwards from BIND WR perms! */
+        mhp->attr.perms = iwch_ib_to_tpt_access(acc);
-        mhp->attr.perms = (acc & 0x1) << 3;
-        mhp->attr.perms |= (acc & 0x2) << 1;
-        mhp->attr.perms |= (acc & 0x4) >> 1;
-        mhp->attr.perms |= (acc & 0x8) >> 3;
        mhp->attr.va_fbo = *iova_start;
        mhp->attr.page_size = shift - 12;
@@ -525,7 +519,6 @@ static int iwch_reregister_phys_mem(struct ib_mr *mr,
        struct iwch_mr mh, *mhp;
        struct iwch_pd *php;
        struct iwch_dev *rhp;
-        int new_acc;
        __be64 *page_list = NULL;
        int shift = 0;
        u64 total_size;
@@ -546,14 +539,12 @@ static int iwch_reregister_phys_mem(struct ib_mr *mr,
        if (rhp != php->rhp)
                return -EINVAL;
-        new_acc = mhp->attr.perms;
        memcpy(&mh, mhp, sizeof *mhp);
        if (mr_rereg_mask & IB_MR_REREG_PD)
                php = to_iwch_pd(pd);
        if (mr_rereg_mask & IB_MR_REREG_ACCESS)
-                mh.attr.perms = iwch_convert_access(acc);
+                mh.attr.perms = iwch_ib_to_tpt_access(acc);
        if (mr_rereg_mask & IB_MR_REREG_TRANS)
                ret = build_phys_page_list(buffer_list, num_phys_buf,
                                           iova_start,
@@ -568,7 +559,7 @@ static int iwch_reregister_phys_mem(struct ib_mr *mr,
        if (mr_rereg_mask & IB_MR_REREG_PD)
                mhp->attr.pdid = php->pdid;
        if (mr_rereg_mask & IB_MR_REREG_ACCESS)
-                mhp->attr.perms = acc;
+                mhp->attr.perms = iwch_ib_to_tpt_access(acc);
        if (mr_rereg_mask & IB_MR_REREG_TRANS) {
                mhp->attr.zbva = 0;
                mhp->attr.va_fbo = *iova_start;
@@ -613,8 +604,6 @@ static struct ib_mr *iwch_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
                goto err;
        }
-        acc = iwch_convert_access(acc);
        i = n = 0;
        list_for_each_entry(chunk, &region->chunk_list, list)
@@ -630,10 +619,7 @@ static struct ib_mr *iwch_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
        mhp->rhp = rhp;
        mhp->attr.pdid = php->pdid;
        mhp->attr.zbva = 0;
-        mhp->attr.perms = (acc & 0x1) << 3;
+        mhp->attr.perms = iwch_ib_to_tpt_access(acc);
-        mhp->attr.perms |= (acc & 0x2) << 1;
-        mhp->attr.perms |= (acc & 0x4) >> 1;
-        mhp->attr.perms |= (acc & 0x8) >> 3;
        mhp->attr.va_fbo = region->virt_base;
        mhp->attr.page_size = shift - 12;
        mhp->attr.len = (u32) region->length;
@@ -736,10 +722,8 @@ static int iwch_destroy_qp(struct ib_qp *ib_qp)
        qhp = to_iwch_qp(ib_qp);
        rhp = qhp->rhp;
-        if (qhp->attr.state == IWCH_QP_STATE_RTS) {
+        attrs.next_state = IWCH_QP_STATE_ERROR;
-                attrs.next_state = IWCH_QP_STATE_ERROR;
+        iwch_modify_qp(rhp, qhp, IWCH_QP_ATTR_NEXT_STATE, &attrs, 0);
-                iwch_modify_qp(rhp, qhp, IWCH_QP_ATTR_NEXT_STATE, &attrs, 0);
-        }
        wait_event(qhp->wait, !qhp->ep);
        remove_handle(rhp, &rhp->qpidr, qhp->wq.qpid);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.h b/drivers/infiniband/hw/cxgb3/iwch_provider.h
index de0fe1b93a0c..93bcc56756bd 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.h
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.h
@@ -286,27 +286,20 @@ static inline int iwch_convert_state(enum ib_qp_state ib_state)
        }
 }
-enum iwch_mem_perms {
+static inline u32 iwch_ib_to_tpt_access(int acc)
-        IWCH_MEM_ACCESS_LOCAL_READ = 1 << 0,
-        IWCH_MEM_ACCESS_LOCAL_WRITE = 1 << 1,
-        IWCH_MEM_ACCESS_REMOTE_READ = 1 << 2,
-        IWCH_MEM_ACCESS_REMOTE_WRITE = 1 << 3,
-        IWCH_MEM_ACCESS_ATOMICS = 1 << 4,
-        IWCH_MEM_ACCESS_BINDING = 1 << 5,
-        IWCH_MEM_ACCESS_LOCAL =
-            (IWCH_MEM_ACCESS_LOCAL_READ | IWCH_MEM_ACCESS_LOCAL_WRITE),
-        IWCH_MEM_ACCESS_REMOTE =
-            (IWCH_MEM_ACCESS_REMOTE_WRITE | IWCH_MEM_ACCESS_REMOTE_READ)
-            /* cannot go beyond 1 << 31 */
-} __attribute__ ((packed));
-static inline u32 iwch_convert_access(int acc)
 {
-        return (acc & IB_ACCESS_REMOTE_WRITE ? IWCH_MEM_ACCESS_REMOTE_WRITE : 0)
+        return (acc & IB_ACCESS_REMOTE_WRITE ? TPT_REMOTE_WRITE : 0) |
-            | (acc & IB_ACCESS_REMOTE_READ ? IWCH_MEM_ACCESS_REMOTE_READ : 0) |
+               (acc & IB_ACCESS_REMOTE_READ ? TPT_REMOTE_READ : 0) |
-            (acc & IB_ACCESS_LOCAL_WRITE ? IWCH_MEM_ACCESS_LOCAL_WRITE : 0) |
+               (acc & IB_ACCESS_LOCAL_WRITE ? TPT_LOCAL_WRITE : 0) |
-            (acc & IB_ACCESS_MW_BIND ? IWCH_MEM_ACCESS_BINDING : 0) |
+               TPT_LOCAL_READ;
-            IWCH_MEM_ACCESS_LOCAL_READ;
+}
+static inline u32 iwch_ib_to_mwbind_access(int acc)
+{
+        return (acc & IB_ACCESS_REMOTE_WRITE ? T3_MEM_ACCESS_REM_WRITE : 0) |
+               (acc & IB_ACCESS_REMOTE_READ ? T3_MEM_ACCESS_REM_READ : 0) |
+               (acc & IB_ACCESS_LOCAL_WRITE ? T3_MEM_ACCESS_LOCAL_WRITE : 0) |
+               T3_MEM_ACCESS_LOCAL_READ;
 }
 enum iwch_mmid_state {
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index 9ea00cc4a5f8..0a472c9b44db 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -439,7 +439,7 @@ int iwch_bind_mw(struct ib_qp *qp,
        wqe->bind.type = T3_VA_BASED_TO;
        /* TBD: check perms */
-        wqe->bind.perms = iwch_convert_access(mw_bind->mw_access_flags);
+        wqe->bind.perms = iwch_ib_to_mwbind_access(mw_bind->mw_access_flags);
        wqe->bind.mr_stag = cpu_to_be32(mw_bind->mr->lkey);
        wqe->bind.mw_stag = cpu_to_be32(mw->rkey);
        wqe->bind.mw_len = cpu_to_be32(mw_bind->length);
diff --git a/drivers/infiniband/hw/ehca/ehca_classes.h b/drivers/infiniband/hw/ehca/ehca_classes.h
index 40404c9e2817..82ded44c6cee 100644
--- a/drivers/infiniband/hw/ehca/ehca_classes.h
+++ b/drivers/infiniband/hw/ehca/ehca_classes.h
@@ -52,6 +52,8 @@ struct ehca_mw;
 struct ehca_pd;
 struct ehca_av;
+#include <linux/wait.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_user_verbs.h>
@@ -153,7 +155,9 @@ struct ehca_cq {
        spinlock_t cb_lock;
        struct hlist_head qp_hashtab[QP_HASHTAB_LEN];
        struct list_head entry;
-        u32 nr_callbacks;
+        u32 nr_callbacks; /* #events assigned to cpu by scaling code */
+        u32 nr_events;    /* #events seen */
+        wait_queue_head_t wait_completion;
        spinlock_t task_lock;
        u32 ownpid;
        /* mmap counter for resources mapped into user space */
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c
index 6ebfa27e4e16..e2cdc1a16fe9 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -146,6 +146,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe,
        spin_lock_init(&my_cq->spinlock);
        spin_lock_init(&my_cq->cb_lock);
        spin_lock_init(&my_cq->task_lock);
+        init_waitqueue_head(&my_cq->wait_completion);
        my_cq->ownpid = current->tgid;
        cq = &my_cq->ib_cq;
@@ -302,6 +303,16 @@ create_cq_exit1:
        return cq;
 }
+static int get_cq_nr_events(struct ehca_cq *my_cq)
+{
+        int ret;
+        unsigned long flags;
+        spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+        ret = my_cq->nr_events;
+        spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
+        return ret;
+}
 int ehca_destroy_cq(struct ib_cq *cq)
 {
        u64 h_ret;
@@ -329,10 +340,11 @@ int ehca_destroy_cq(struct ib_cq *cq)
        }
        spin_lock_irqsave(&ehca_cq_idr_lock, flags);
-        while (my_cq->nr_callbacks) {
+        while (my_cq->nr_events) {
                spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
-                yield();
+                wait_event(my_cq->wait_completion, !get_cq_nr_events(my_cq));
                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+                /* recheck nr_events to assure no cqe has just arrived */
        }
        idr_remove(&ehca_cq_idr, my_cq->token);
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 3ec53c687d08..20f36bf8b2b6 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -404,10 +404,11 @@ static inline void process_eqe(struct ehca_shca *shca, struct ehca_eqe *eqe)
        u32 token;
        unsigned long flags;
        struct ehca_cq *cq;
        eqe_value = eqe->entry;
        ehca_dbg(&shca->ib_device, "eqe_value=%lx", eqe_value);
        if (EHCA_BMASK_GET(EQE_COMPLETION_EVENT, eqe_value)) {
-                ehca_dbg(&shca->ib_device, "... completion event");
+                ehca_dbg(&shca->ib_device, "Got completion event");
                token = EHCA_BMASK_GET(EQE_CQ_TOKEN, eqe_value);
                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
                cq = idr_find(&ehca_cq_idr, token);
@@ -419,16 +420,20 @@ static inline void process_eqe(struct ehca_shca *shca, struct ehca_eqe *eqe)
                        return;
                }
                reset_eq_pending(cq);
-                if (ehca_scaling_code) {
+                cq->nr_events++;
+                spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
+                if (ehca_scaling_code)
                        queue_comp_task(cq);
-                        spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
+                else {
-                } else {
-                        spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
                        comp_event_callback(cq);
+                        spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+                        cq->nr_events--;
+                        if (!cq->nr_events)
+                                wake_up(&cq->wait_completion);
+                        spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
                }
        } else {
-                ehca_dbg(&shca->ib_device,
+                ehca_dbg(&shca->ib_device, "Got non completion event");
-                         "Got non completion event");
                parse_identifier(shca, eqe_value);
        }
 }
@@ -478,6 +483,7 @@ void ehca_process_eq(struct ehca_shca *shca, int is_irq)
                                         "token=%x", token);
                                continue;
                        }
+                        eqe_cache[eqe_cnt].cq->nr_events++;
                        spin_unlock(&ehca_cq_idr_lock);
                } else
                        eqe_cache[eqe_cnt].cq = NULL;
@@ -504,12 +510,18 @@ void ehca_process_eq(struct ehca_shca *shca, int is_irq)
        /* call completion handler for cached eqes */
        for (i = 0; i < eqe_cnt; i++)
                if (eq->eqe_cache[i].cq) {
-                        if (ehca_scaling_code) {
+                        if (ehca_scaling_code)
-                                spin_lock(&ehca_cq_idr_lock);
                                queue_comp_task(eq->eqe_cache[i].cq);
-                                spin_unlock(&ehca_cq_idr_lock);
+                        else {
-                        } else
+                                struct ehca_cq *cq = eq->eqe_cache[i].cq;
-                                comp_event_callback(eq->eqe_cache[i].cq);
+                                comp_event_callback(cq);
+                                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+                                cq->nr_events--;
+                                if (!cq->nr_events)
+                                        wake_up(&cq->wait_completion);
+                                spin_unlock_irqrestore(&ehca_cq_idr_lock,
+                                                       flags);
+                        }
                } else {
                        ehca_dbg(&shca->ib_device, "Got non completion event");
                        parse_identifier(shca, eq->eqe_cache[i].eqe->entry);
@@ -523,7 +535,6 @@ void ehca_process_eq(struct ehca_shca *shca, int is_irq)
                if (!eqe)
                        break;
                process_eqe(shca, eqe);
-                eqe_cnt++;
        } while (1);
 unlock_irq_spinlock:
@@ -567,8 +578,7 @@ static void __queue_comp_task(struct ehca_cq *__cq,
                list_add_tail(&__cq->entry, &cct->cq_list);
                cct->cq_jobs++;
                wake_up(&cct->wait_queue);
-        }
+        } else
-        else
                __cq->nr_callbacks++;
        spin_unlock(&__cq->task_lock);
@@ -577,18 +587,21 @@ static void __queue_comp_task(struct ehca_cq *__cq,
 static void queue_comp_task(struct ehca_cq *__cq)
 {
-        int cpu;
        int cpu_id;
        struct ehca_cpu_comp_task *cct;
+        int cq_jobs;
+        unsigned long flags;
-        cpu = get_cpu();
        cpu_id = find_next_online_cpu(pool);
        BUG_ON(!cpu_online(cpu_id));
        cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu_id);
        BUG_ON(!cct);
-        if (cct->cq_jobs > 0) {
+        spin_lock_irqsave(&cct->task_lock, flags);
+        cq_jobs = cct->cq_jobs;
+        spin_unlock_irqrestore(&cct->task_lock, flags);
+        if (cq_jobs > 0) {
                cpu_id = find_next_online_cpu(pool);
                cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu_id);
                BUG_ON(!cct);
@@ -608,11 +621,17 @@ static void run_comp_task(struct ehca_cpu_comp_task* cct)
                cq = list_entry(cct->cq_list.next, struct ehca_cq, entry);
                spin_unlock_irqrestore(&cct->task_lock, flags);
                comp_event_callback(cq);
-                spin_lock_irqsave(&cct->task_lock, flags);
+                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+                cq->nr_events--;
+                if (!cq->nr_events)
+                        wake_up(&cq->wait_completion);
+                spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
+                spin_lock_irqsave(&cct->task_lock, flags);
                spin_lock(&cq->task_lock);
                cq->nr_callbacks--;
-                if (cq->nr_callbacks == 0) {
+                if (!cq->nr_callbacks) {
                        list_del_init(cct->cq_list.next);
                        cct->cq_jobs--;
                }
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index c1835121a822..059da9628bb5 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -52,7 +52,7 @@
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Christoph Raisch <raisch@de.ibm.com>");
 MODULE_DESCRIPTION("IBM eServer HCA InfiniBand Device Driver");
-MODULE_VERSION("SVNEHCA_0021");
+MODULE_VERSION("SVNEHCA_0022");
 int ehca_open_aqp1     = 0;
 int ehca_debug_level   = 0;
@@ -810,7 +810,7 @@ int __init ehca_module_init(void)
        int ret;
        printk(KERN_INFO "eHCA Infiniband Device Driver "
-               "(Rel.: SVNEHCA_0021)\n");
+               "(Rel.: SVNEHCA_0022)\n");
        idr_init(&ehca_qp_idr);
        idr_init(&ehca_cq_idr);
        spin_lock_init(&ehca_qp_idr_lock);
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 71dc84bd4254..1c6b63aca268 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1088,21 +1088,21 @@ static void mthca_unmap_memfree(struct mthca_dev *dev,
 static int mthca_alloc_memfree(struct mthca_dev *dev,
                               struct mthca_qp *qp)
 {
-        int ret = 0;
        if (mthca_is_memfree(dev)) {
                qp->rq.db_index = mthca_alloc_db(dev, MTHCA_DB_TYPE_RQ,
                                                 qp->qpn, &qp->rq.db);
                if (qp->rq.db_index < 0)
-                        return ret;
+                        return -ENOMEM;
                qp->sq.db_index = mthca_alloc_db(dev, MTHCA_DB_TYPE_SQ,
                                                 qp->qpn, &qp->sq.db);
-                if (qp->sq.db_index < 0)
+                if (qp->sq.db_index < 0) {
                        mthca_free_db(dev, MTHCA_DB_TYPE_RQ, qp->rq.db_index);
+                        return -ENOMEM;
+                }
        }
-        return ret;
+        return 0;
 }
 static void mthca_free_memfree(struct mthca_dev *dev,
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index bb2e3d5eee20..56c87a81bb67 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -407,6 +407,10 @@ static int ipoib_mcast_join_complete(int status,
                        queue_delayed_work(ipoib_workqueue,
                                           &priv->mcast_task, 0);
                mutex_unlock(&mcast_mutex);
+                if (mcast == priv->broadcast)
+                        netif_carrier_on(dev);
                return 0;
        }
@@ -594,7 +598,6 @@ void ipoib_mcast_join_task(struct work_struct *work)
        ipoib_dbg_mcast(priv, "successfully joined all multicast groups\n");
        clear_bit(IPOIB_MCAST_RUN, &priv->flags);
-        netif_carrier_on(dev);
 }
 int ipoib_mcast_start_thread(struct net_device *dev)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index 3cb551b88756..7f3ec205e35f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -259,12 +259,13 @@ void ipoib_event(struct ib_event_handler *handler,
        struct ipoib_dev_priv *priv =
                container_of(handler, struct ipoib_dev_priv, event_handler);
-        if (record->event == IB_EVENT_PORT_ERR    ||
+        if ((record->event == IB_EVENT_PORT_ERR    ||
-            record->event == IB_EVENT_PKEY_CHANGE ||
+             record->event == IB_EVENT_PKEY_CHANGE ||
-            record->event == IB_EVENT_PORT_ACTIVE ||
+             record->event == IB_EVENT_PORT_ACTIVE ||
-            record->event == IB_EVENT_LID_CHANGE  ||
+             record->event == IB_EVENT_LID_CHANGE  ||
-            record->event == IB_EVENT_SM_CHANGE   ||
+             record->event == IB_EVENT_SM_CHANGE   ||
-            record->event == IB_EVENT_CLIENT_REREGISTER) {
+             record->event == IB_EVENT_CLIENT_REREGISTER) &&
+            record->element.port_num == priv->port) {
                ipoib_dbg(priv, "Port state change event\n");
                queue_work(ipoib_workqueue, &priv->flush_task);
        }
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index ec195a36e8f6..db9cca3b65e0 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -553,7 +553,8 @@ static int __devinit i8042_check_aux(void)
 */
        param = 0x5a;
-        if (i8042_command(&param, I8042_CMD_AUX_LOOP) || param != 0x5a) {
+        retval = i8042_command(&param, I8042_CMD_AUX_LOOP);
+        if (retval || param != 0x5a) {
 /*
 * External connection test - filters out AT-soldered PS/2 i8042's
@@ -567,7 +568,12 @@ static int __devinit i8042_check_aux(void)
                    (param && param != 0xfa && param != 0xff))
                        return -1;
-                aux_loop_broken = 1;
+/*
+ * If AUX_LOOP completed without error but returned unexpected data
+ * mark it as broken
+ */
+                if (!retval)
+                        aux_loop_broken = 1;
        }
 /*
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index e3acd398fb37..1f6445840461 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -359,6 +359,8 @@ struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
                cfi->chips[i].word_write_time = 1<<cfi->cfiq->WordWriteTimeoutTyp;
                cfi->chips[i].buffer_write_time = 1<<cfi->cfiq->BufWriteTimeoutTyp;
                cfi->chips[i].erase_time = 1<<cfi->cfiq->BlockEraseTimeoutTyp;
+                cfi->chips[i].ref_point_counter = 0;
+                init_waitqueue_head(&(cfi->chips[i].wq));
        }
        map->fldrv = &cfi_amdstd_chipdrv;
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 69d49e0250a9..b344ff858b2d 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -158,6 +158,8 @@ struct mtd_info *cfi_cmdset_0020(struct map_info *map, int primary)
                cfi->chips[i].word_write_time = 128;
                cfi->chips[i].buffer_write_time = 128;
                cfi->chips[i].erase_time = 1024;
+                cfi->chips[i].ref_point_counter = 0;
+                init_waitqueue_head(&(cfi->chips[i].wq));
        }
        return cfi_staa_setup(map);
diff --git a/drivers/mtd/maps/dilnetpc.c b/drivers/mtd/maps/dilnetpc.c
index b1104fe1f207..1c3b34ad7325 100644
--- a/drivers/mtd/maps/dilnetpc.c
+++ b/drivers/mtd/maps/dilnetpc.c
@@ -402,8 +402,8 @@ static int __init init_dnpc(void)
                        ++higlvl_partition_info[i].name;
        }
-        printk(KERN_NOTICE "DIL/Net %s flash: 0x%lx at 0x%lx\n",
+        printk(KERN_NOTICE "DIL/Net %s flash: 0x%lx at 0x%llx\n",
-                is_dnp ? "DNPC" : "ADNP", dnpc_map.size, dnpc_map.phys);
+                is_dnp ? "DNPC" : "ADNP", dnpc_map.size, (unsigned long long)dnpc_map.phys);
        dnpc_map.virt = ioremap_nocache(dnpc_map.phys, dnpc_map.size);
diff --git a/drivers/mtd/maps/esb2rom.c b/drivers/mtd/maps/esb2rom.c
index 0bc013fd66a3..aa64a4752781 100644
--- a/drivers/mtd/maps/esb2rom.c
+++ b/drivers/mtd/maps/esb2rom.c
@@ -30,7 +30,7 @@
 #define ROM_PROBE_STEP_SIZE (64*1024) /* 64KiB */
-#define BIOS_CNTL       0xDC
+#define BIOS_CNTL               0xDC
 #define BIOS_LOCK_ENABLE        0x02
 #define BIOS_WRITE_ENABLE       0x01
@@ -145,7 +145,7 @@ static void esb2rom_cleanup(struct esb2rom_window *window)
 }
 static int __devinit esb2rom_init_one(struct pci_dev *pdev,
-                                const struct pci_device_id *ent)
+                                      const struct pci_device_id *ent)
 {
        static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL };
        struct esb2rom_window *window = &esb2rom_window;
@@ -185,7 +185,7 @@ static int __devinit esb2rom_init_one(struct pci_dev *pdev,
        /* Find a region continuous to the end of the ROM window  */
        window->phys = 0;
        pci_read_config_word(pdev, FWH_DEC_EN1, &word);
-        printk(KERN_DEBUG "pci_read_config_byte : %x\n", word);
+        printk(KERN_DEBUG "pci_read_config_word : %x\n", word);
        if ((word & FWH_8MiB) == FWH_8MiB)
                window->phys = 0xff400000;
@@ -212,6 +212,11 @@ static int __devinit esb2rom_init_one(struct pci_dev *pdev,
        else if ((word & FWH_0_5MiB) == FWH_0_5MiB)
                window->phys = 0xfff80000;
+        if (window->phys == 0) {
+                printk(KERN_ERR MOD_NAME ": Rom window is closed\n");
+                goto out;
+        }
        /* reserved  0x0020 and 0x0010 */
        window->phys -= 0x400000UL;
        window->size = (0xffffffffUL - window->phys) + 1UL;
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 880580c44e01..41844ea02462 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -727,6 +727,7 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
        concat->mtd.erasesize = subdev[0]->erasesize;
        concat->mtd.writesize = subdev[0]->writesize;
        concat->mtd.oobsize = subdev[0]->oobsize;
+        concat->mtd.oobavail = subdev[0]->oobavail;
        if (subdev[0]->writev)
                concat->mtd.writev = concat_writev;
        if (subdev[0]->read_oob)
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 633def3fb087..1af989023c66 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -200,6 +200,11 @@ static int part_erase (struct mtd_info *mtd, struct erase_info *instr)
                return -EINVAL;
        instr->addr += part->offset;
        ret = part->master->erase(part->master, instr);
+        if (ret) {
+                if (instr->fail_addr != 0xffffffff)
+                        instr->fail_addr -= part->offset;
+                instr->addr -= part->offset;
+        }
        return ret;
 }
@@ -338,6 +343,7 @@ int add_mtd_partitions(struct mtd_info *master,
                slave->mtd.size = parts[i].size;
                slave->mtd.writesize = master->writesize;
                slave->mtd.oobsize = master->oobsize;
+                slave->mtd.oobavail = master->oobavail;
                slave->mtd.subpage_sft = master->subpage_sft;
                slave->mtd.name = parts[i].name;
@@ -559,4 +565,3 @@ EXPORT_SYMBOL_GPL(deregister_mtd_parser);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Nicolas Pitre <nico@cam.org>");
 MODULE_DESCRIPTION("Generic support for partitioning of MTD devices");
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 12608c13cce5..595208f965a5 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -114,7 +114,7 @@ module_param(no_autopart, int, 0);
 static int show_firmware_partition = 0;
 module_param(show_firmware_partition, int, 0);
-#ifdef MTD_NAND_DISKONCHIP_BBTWRITE
+#ifdef CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE
 static int inftl_bbt_write = 1;
 #else
 static int inftl_bbt_write = 0;
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index acaf97bc80d1..6af37b8cff65 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2524,6 +2524,7 @@ int nand_scan_tail(struct mtd_info *mtd)
        for (i = 0; chip->ecc.layout->oobfree[i].length; i++)
                chip->ecc.layout->oobavail +=
                        chip->ecc.layout->oobfree[i].length;
+        mtd->oobavail = chip->ecc.layout->oobavail;
        /*
         * Set the number of read / write steps for one page depending on ECC
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 7f1cb6e5dccb..9e14a26ca4e8 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -4,6 +4,11 @@
 *  Copyright (C) 2005-2007 Samsung Electronics
 *  Kyungmin Park <kyungmin.park@samsung.com>
 *
+ *  Credits:
+ *      Adrian Hunter <ext-adrian.hunter@nokia.com>:
+ *      auto-placement support, read-while load support, various fixes
+ *      Copyright (C) Nokia Corporation, 2007
+ *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
@@ -831,7 +836,7 @@ static int onenand_transfer_auto_oob(struct mtd_info *mtd, uint8_t *buf, int col
        int readcol = column;
        int readend = column + thislen;
        int lastgap = 0;
-        uint8_t *oob_buf = this->page_buf + mtd->writesize;
+        uint8_t *oob_buf = this->oob_buf;
        for (free = this->ecclayout->oobfree; free->length; ++free) {
                if (readcol >= lastgap)
@@ -849,7 +854,8 @@ static int onenand_transfer_auto_oob(struct mtd_info *mtd, uint8_t *buf, int col
                        int n = ed - st;
                        memcpy(buf, oob_buf + st, n);
                        buf += n;
-                }
+                } else
+                        break;
        }
        return 0;
 }
@@ -947,9 +953,9 @@ static int onenand_do_read_oob(struct mtd_info *mtd, loff_t from, size_t len,
 /**
 * onenand_read_oob - [MTD Interface] NAND write data and/or out-of-band
- * @mtd:        MTD device structure
+ * @param mtd:          MTD device structure
- * @from:       offset to read from
+ * @param from:         offset to read from
- * @ops:        oob operation description structure
+ * @param ops:          oob operation description structure
 */
 static int onenand_read_oob(struct mtd_info *mtd, loff_t from,
                            struct mtd_oob_ops *ops)
@@ -1017,7 +1023,7 @@ static int onenand_bbt_wait(struct mtd_info *mtd, int state)
 * onenand_bbt_read_oob - [MTD Interface] OneNAND read out-of-band for bbt scan
 * @param mtd           MTD device structure
 * @param from          offset to read from
- * @param @ops          oob operation description structure
+ * @param ops           oob operation description structure
 *
 * OneNAND read out-of-band data from the spare area for bbt scan
 */
@@ -1093,7 +1099,7 @@ int onenand_bbt_read_oob(struct mtd_info *mtd, loff_t from,
 static int onenand_verify_oob(struct mtd_info *mtd, const u_char *buf, loff_t to)
 {
        struct onenand_chip *this = mtd->priv;
-        char *readp = this->page_buf + mtd->writesize;
+        char oobbuf[64];
        int status, i;
        this->command(mtd, ONENAND_CMD_READOOB, to, mtd->oobsize);
@@ -1102,9 +1108,9 @@ static int onenand_verify_oob(struct mtd_info *mtd, const u_char *buf, loff_t to
        if (status)
                return status;
-        this->read_bufferram(mtd, ONENAND_SPARERAM, readp, 0, mtd->oobsize);
+        this->read_bufferram(mtd, ONENAND_SPARERAM, oobbuf, 0, mtd->oobsize);
-        for(i = 0; i < mtd->oobsize; i++)
+        for (i = 0; i < mtd->oobsize; i++)
-                if (buf[i] != 0xFF && buf[i] != readp[i])
+                if (buf[i] != 0xFF && buf[i] != oobbuf[i])
                        return -EBADMSG;
        return 0;
@@ -1290,7 +1296,8 @@ static int onenand_fill_auto_oob(struct mtd_info *mtd, u_char *oob_buf,
                        int n = ed - st;
                        memcpy(oob_buf + st, buf, n);
                        buf += n;
-                }
+                } else
+                        break;
        }
        return 0;
 }
@@ -1312,6 +1319,7 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
        struct onenand_chip *this = mtd->priv;
        int column, ret = 0, oobsize;
        int written = 0;
+        u_char *oobbuf;
        DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_oob: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
@@ -1331,7 +1339,7 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
        }
        /* For compatibility with NAND: Do not allow write past end of page */
-        if (column + len > oobsize) {
+        if (unlikely(column + len > oobsize)) {
                printk(KERN_ERR "onenand_write_oob: "
                      "Attempt to write past end of page\n");
                return -EINVAL;
@@ -1348,6 +1356,8 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
        /* Grab the lock and see if the device is available */
        onenand_get_device(mtd, FL_WRITING);
+        oobbuf = this->oob_buf;
        /* Loop until all data write */
        while (written < len) {
                int thislen = min_t(int, oobsize, len - written);
@@ -1358,12 +1368,12 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
                /* We send data to spare ram with oobsize
                 * to prevent byte access */
-                memset(this->page_buf, 0xff, mtd->oobsize);
+                memset(oobbuf, 0xff, mtd->oobsize);
                if (mode == MTD_OOB_AUTO)
-                        onenand_fill_auto_oob(mtd, this->page_buf, buf, column, thislen);
+                        onenand_fill_auto_oob(mtd, oobbuf, buf, column, thislen);
                else
-                        memcpy(this->page_buf + column, buf, thislen);
+                        memcpy(oobbuf + column, buf, thislen);
-                this->write_bufferram(mtd, ONENAND_SPARERAM, this->page_buf, 0, mtd->oobsize);
+                this->write_bufferram(mtd, ONENAND_SPARERAM, oobbuf, 0, mtd->oobsize);
                this->command(mtd, ONENAND_CMD_PROGOOB, to, mtd->oobsize);
@@ -1375,7 +1385,7 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
                        break;
                }
-                ret = onenand_verify_oob(mtd, this->page_buf, to);
+                ret = onenand_verify_oob(mtd, oobbuf, to);
                if (ret) {
                        printk(KERN_ERR "onenand_write_oob: verify failed %d\n", ret);
                        break;
@@ -1400,9 +1410,9 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
 /**
 * onenand_write_oob - [MTD Interface] NAND write data and/or out-of-band
- * @mtd:        MTD device structure
+ * @param mtd:          MTD device structure
- * @from:       offset to read from
+ * @param to:           offset to write
- * @ops:        oob operation description structure
+ * @param ops:          oob operation description structure
 */
 static int onenand_write_oob(struct mtd_info *mtd, loff_t to,
                             struct mtd_oob_ops *ops)
@@ -1616,6 +1626,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs)
 * @param mtd           MTD device structure
 * @param ofs           offset relative to mtd start
 * @param len           number of bytes to lock or unlock
+ * @param cmd           lock or unlock command
 *
 * Lock or unlock one or more blocks
 */
@@ -2117,10 +2128,11 @@ static void onenand_check_features(struct mtd_info *mtd)
 }
 /**
- * onenand_print_device_info - Print device ID
+ * onenand_print_device_info - Print device & version ID
 * @param device        device ID
+ * @param version       version ID
 *
- * Print device ID
+ * Print device & version ID
 */
 static void onenand_print_device_info(int device, int version)
 {
@@ -2320,15 +2332,25 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
        /* Allocate buffers, if necessary */
        if (!this->page_buf) {
-                size_t len;
+                this->page_buf = kzalloc(mtd->writesize, GFP_KERNEL);
-                len = mtd->writesize + mtd->oobsize;
-                this->page_buf = kmalloc(len, GFP_KERNEL);
                if (!this->page_buf) {
                        printk(KERN_ERR "onenand_scan(): Can't allocate page_buf\n");
                        return -ENOMEM;
                }
                this->options |= ONENAND_PAGEBUF_ALLOC;
        }
+        if (!this->oob_buf) {
+                this->oob_buf = kzalloc(mtd->oobsize, GFP_KERNEL);
+                if (!this->oob_buf) {
+                        printk(KERN_ERR "onenand_scan(): Can't allocate oob_buf\n");
+                        if (this->options & ONENAND_PAGEBUF_ALLOC) {
+                                this->options &= ~ONENAND_PAGEBUF_ALLOC;
+                                kfree(this->page_buf);
+                        }
+                        return -ENOMEM;
+                }
+                this->options |= ONENAND_OOBBUF_ALLOC;
+        }
        this->state = FL_READY;
        init_waitqueue_head(&this->wq);
@@ -2367,6 +2389,7 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
        for (i = 0; this->ecclayout->oobfree[i].length; i++)
                this->ecclayout->oobavail +=
                        this->ecclayout->oobfree[i].length;
+        mtd->oobavail = this->ecclayout->oobavail;
        mtd->ecclayout = this->ecclayout;
@@ -2424,9 +2447,11 @@ void onenand_release(struct mtd_info *mtd)
                kfree(bbm->bbt);
                kfree(this->bbm);
        }
-        /* Buffer allocated by onenand_scan */
+        /* Buffers allocated by onenand_scan */
        if (this->options & ONENAND_PAGEBUF_ALLOC)
                kfree(this->page_buf);
+        if (this->options & ONENAND_OOBBUF_ALLOC)
+                kfree(this->oob_buf);
 }
 EXPORT_SYMBOL_GPL(onenand_scan);
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 72995777f809..b406ecfa7268 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -858,19 +858,7 @@ static struct eisa_device_id vortex_eisa_ids[] = {
 };
 MODULE_DEVICE_TABLE(eisa, vortex_eisa_ids);
-static int vortex_eisa_probe(struct device *device);
+static int __init vortex_eisa_probe(struct device *device)
-static int vortex_eisa_remove(struct device *device);
-static struct eisa_driver vortex_eisa_driver = {
-        .id_table = vortex_eisa_ids,
-        .driver   = {
-                .name    = "3c59x",
-                .probe   = vortex_eisa_probe,
-                .remove  = vortex_eisa_remove
-        }
-};
-static int vortex_eisa_probe(struct device *device)
 {
        void __iomem *ioaddr;
        struct eisa_device *edev;
@@ -893,7 +881,7 @@ static int vortex_eisa_probe(struct device *device)
        return 0;
 }
-static int vortex_eisa_remove(struct device *device)
+static int __devexit vortex_eisa_remove(struct device *device)
 {
        struct eisa_device *edev;
        struct net_device *dev;
@@ -918,7 +906,17 @@ static int vortex_eisa_remove(struct device *device)
        free_netdev(dev);
        return 0;
 }
-#endif
+static struct eisa_driver vortex_eisa_driver = {
+        .id_table = vortex_eisa_ids,
+        .driver   = {
+                .name    = "3c59x",
+                .probe   = vortex_eisa_probe,
+                .remove  = __devexit_p(vortex_eisa_remove)
+        }
+};
+#endif /* CONFIG_EISA */
 /* returns count found (>= 0), or negative on error */
 static int __init vortex_eisa_init(void)
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 9ba21e0f27c5..1ee27c360a4b 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -787,6 +787,12 @@ static int mv643xx_eth_open(struct net_device *dev)
        unsigned int size;
        int err;
+        /* Clear any pending ethernet port interrupts */
+        mv_write(MV643XX_ETH_INTERRUPT_CAUSE_REG(port_num), 0);
+        mv_write(MV643XX_ETH_INTERRUPT_CAUSE_EXTEND_REG(port_num), 0);
+        /* wait for previous write to complete */
+        mv_read (MV643XX_ETH_INTERRUPT_CAUSE_EXTEND_REG(port_num));
        err = request_irq(dev->irq, mv643xx_eth_int_handler,
                        IRQF_SHARED | IRQF_SAMPLE_RANDOM, dev->name, dev);
        if (err) {
@@ -875,10 +881,6 @@ static int mv643xx_eth_open(struct net_device *dev)
        mv643xx_eth_rx_refill_descs(dev);       /* Fill RX ring with skb's */
-        /* Clear any pending ethernet port interrupts */
-        mv_write(MV643XX_ETH_INTERRUPT_CAUSE_REG(port_num), 0);
-        mv_write(MV643XX_ETH_INTERRUPT_CAUSE_EXTEND_REG(port_num), 0);
        eth_port_start(dev);
        /* Interrupt Coalescing */
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index b05dc6ed7fb7..ac02b3b60f92 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -181,6 +181,7 @@ struct myri10ge_priv {
        int intr_coal_delay;
        __be32 __iomem *intr_coal_delay_ptr;
        int mtrr;
+        int wc_enabled;
        int wake_queue;
        int stop_queue;
        int down_cnt;
@@ -717,6 +718,8 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
        int status;
        size_t bytes;
        u32 len;
+        struct page *dmatest_page;
+        dma_addr_t dmatest_bus;
        /* try to send a reset command to the card to see if it
         * is alive */
@@ -726,6 +729,11 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
                dev_err(&mgp->pdev->dev, "failed reset\n");
                return -ENXIO;
        }
+        dmatest_page = alloc_page(GFP_KERNEL);
+        if (!dmatest_page)
+                return -ENOMEM;
+        dmatest_bus = pci_map_page(mgp->pdev, dmatest_page, 0, PAGE_SIZE,
+                                   DMA_BIDIRECTIONAL);
        /* Now exchange information about interrupts  */
@@ -764,8 +772,8 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
        len = mgp->tx.boundary;
-        cmd.data0 = MYRI10GE_LOWPART_TO_U32(mgp->rx_done.bus);
+        cmd.data0 = MYRI10GE_LOWPART_TO_U32(dmatest_bus);
-        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(mgp->rx_done.bus);
+        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(dmatest_bus);
        cmd.data2 = len * 0x10000;
        status = myri10ge_send_cmd(mgp, MXGEFW_DMA_TEST, &cmd, 0);
        if (status == 0)
@@ -774,8 +782,8 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
        else
                dev_warn(&mgp->pdev->dev, "DMA read benchmark failed: %d\n",
                         status);
-        cmd.data0 = MYRI10GE_LOWPART_TO_U32(mgp->rx_done.bus);
+        cmd.data0 = MYRI10GE_LOWPART_TO_U32(dmatest_bus);
-        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(mgp->rx_done.bus);
+        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(dmatest_bus);
        cmd.data2 = len * 0x1;
        status = myri10ge_send_cmd(mgp, MXGEFW_DMA_TEST, &cmd, 0);
        if (status == 0)
@@ -785,8 +793,8 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
                dev_warn(&mgp->pdev->dev, "DMA write benchmark failed: %d\n",
                         status);
-        cmd.data0 = MYRI10GE_LOWPART_TO_U32(mgp->rx_done.bus);
+        cmd.data0 = MYRI10GE_LOWPART_TO_U32(dmatest_bus);
-        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(mgp->rx_done.bus);
+        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(dmatest_bus);
        cmd.data2 = len * 0x10001;
        status = myri10ge_send_cmd(mgp, MXGEFW_DMA_TEST, &cmd, 0);
        if (status == 0)
@@ -796,6 +804,9 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
                dev_warn(&mgp->pdev->dev,
                         "DMA read/write benchmark failed: %d\n", status);
+        pci_unmap_page(mgp->pdev, dmatest_bus, PAGE_SIZE, DMA_BIDIRECTIONAL);
+        put_page(dmatest_page);
        memset(mgp->rx_done.entry, 0, bytes);
        /* reset mcp/driver shared state back to 0 */
@@ -1375,7 +1386,7 @@ myri10ge_get_ethtool_stats(struct net_device *netdev,
                data[i] = ((unsigned long *)&mgp->stats)[i];
        data[i++] = (unsigned int)mgp->tx.boundary;
-        data[i++] = (unsigned int)(mgp->mtrr >= 0);
+        data[i++] = (unsigned int)mgp->wc_enabled;
        data[i++] = (unsigned int)mgp->pdev->irq;
        data[i++] = (unsigned int)mgp->msi_enabled;
        data[i++] = (unsigned int)mgp->read_dma;
@@ -1456,6 +1467,8 @@ static int myri10ge_allocate_rings(struct net_device *dev)
        status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
        tx_ring_size = cmd.data0;
        status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_RX_RING_SIZE, &cmd, 0);
+        if (status != 0)
+                return status;
        rx_ring_size = cmd.data0;
        tx_ring_entries = tx_ring_size / sizeof(struct mcp_kreq_ether_send);
@@ -1463,6 +1476,8 @@ static int myri10ge_allocate_rings(struct net_device *dev)
        mgp->tx.mask = tx_ring_entries - 1;
        mgp->rx_small.mask = mgp->rx_big.mask = rx_ring_entries - 1;
+        status = -ENOMEM;
        /* allocate the host shadow rings */
        bytes = 8 + (MYRI10GE_MAX_SEND_DESC_TSO + 4)
@@ -1735,7 +1750,7 @@ static int myri10ge_open(struct net_device *dev)
                goto abort_with_irq;
        }
-        if (myri10ge_wcfifo && mgp->mtrr >= 0) {
+        if (myri10ge_wcfifo && mgp->wc_enabled) {
                mgp->tx.wc_fifo = (u8 __iomem *) mgp->sram + MXGEFW_ETH_SEND_4;
                mgp->rx_small.wc_fifo =
                    (u8 __iomem *) mgp->sram + MXGEFW_ETH_RECV_SMALL;
@@ -2510,6 +2525,12 @@ static void myri10ge_select_firmware(struct myri10ge_priv *mgp)
                                 bridge->vendor, bridge->device);
                        mgp->tx.boundary = 4096;
                        mgp->fw_name = myri10ge_fw_aligned;
+                } else if (bridge &&
+                           bridge->vendor == PCI_VENDOR_ID_SGI &&
+                           bridge->device == 0x4002 /* TIOCE pcie-port */ ) {
+                        /* this pcie bridge does not support 4K rdma request */
+                        mgp->tx.boundary = 2048;
+                        mgp->fw_name = myri10ge_fw_aligned;
                }
        } else {
                if (myri10ge_force_firmware == 1) {
@@ -2830,9 +2851,12 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        mgp->board_span = pci_resource_len(pdev, 0);
        mgp->iomem_base = pci_resource_start(pdev, 0);
        mgp->mtrr = -1;
+        mgp->wc_enabled = 0;
 #ifdef CONFIG_MTRR
        mgp->mtrr = mtrr_add(mgp->iomem_base, mgp->board_span,
                             MTRR_TYPE_WRCOMB, 1);
+        if (mgp->mtrr >= 0)
+                mgp->wc_enabled = 1;
 #endif
        /* Hack.  need to get rid of these magic numbers */
        mgp->sram_size =
@@ -2927,7 +2951,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        dev_info(dev, "%s IRQ %d, tx bndry %d, fw %s, WC %s\n",
                 (mgp->msi_enabled ? "MSI" : "xPIC"),
                 netdev->irq, mgp->tx.boundary, mgp->fw_name,
-                 (mgp->mtrr >= 0 ? "Enabled" : "Disabled"));
+                 (mgp->wc_enabled ? "Enabled" : "Disabled"));
        return 0;
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index a2877f33fa85..1be55702557d 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -228,7 +228,7 @@ int netxen_nic_hw_resources(struct netxen_adapter *adapter)
                            &adapter->ctx_desc_pdev);
        printk("ctx_desc_phys_addr: 0x%llx\n",
-               (u64) adapter->ctx_desc_phys_addr);
+               (unsigned long long) adapter->ctx_desc_phys_addr);
        if (addr == NULL) {
                DPRINTK(ERR, "bad return from pci_alloc_consistent\n");
                err = -ENOMEM;
@@ -247,7 +247,8 @@ int netxen_nic_hw_resources(struct netxen_adapter *adapter)
                            adapter->max_tx_desc_count,
                            (dma_addr_t *) & hw->cmd_desc_phys_addr,
                            &adapter->ahw.cmd_desc_pdev);
-        printk("cmd_desc_phys_addr: 0x%llx\n", (u64) hw->cmd_desc_phys_addr);
+        printk("cmd_desc_phys_addr: 0x%llx\n",
+               (unsigned long long) hw->cmd_desc_phys_addr);
        if (addr == NULL) {
                DPRINTK(ERR, "bad return from pci_alloc_consistent\n");
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 15d954e50cae..521b5f0618a4 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -572,8 +572,8 @@ static void rtl8169_xmii_reset_enable(void __iomem *ioaddr)
 {
        unsigned int val;
-        mdio_write(ioaddr, MII_BMCR, BMCR_RESET);
+        val = mdio_read(ioaddr, MII_BMCR) | BMCR_RESET;
-        val = mdio_read(ioaddr, MII_BMCR);
+        mdio_write(ioaddr, MII_BMCR, val & 0xffff);
 }
 static void rtl8169_check_link_status(struct net_device *dev,
@@ -1368,11 +1368,7 @@ static inline void rtl8169_request_timer(struct net_device *dev)
            (tp->phy_version >= RTL_GIGA_PHY_VER_H))
                return;
-        init_timer(timer);
+        mod_timer(timer, jiffies + RTL8169_PHY_TIMEOUT);
-        timer->expires = jiffies + RTL8169_PHY_TIMEOUT;
-        timer->data = (unsigned long)(dev);
-        timer->function = rtl8169_phy_timer;
-        add_timer(timer);
 }
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -1685,6 +1681,10 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->mmio_addr = ioaddr;
        tp->align = rtl_cfg_info[ent->driver_data].align;
+        init_timer(&tp->timer);
+        tp->timer.data = (unsigned long) dev;
+        tp->timer.function = rtl8169_phy_timer;
        spin_lock_init(&tp->lock);
        rc = register_netdev(dev);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 53839979cfb8..ab0ab92583fe 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -2165,9 +2165,27 @@ force_update:
                        /* fall through */
 #endif
                case OP_RXCHKS:
-                        skb = sky2->rx_ring[sky2->rx_next].skb;
+                        if (!sky2->rx_csum)
-                        skb->ip_summed = CHECKSUM_COMPLETE;
+                                break;
-                        skb->csum = status & 0xffff;
+                        /* Both checksum counters are programmed to start at
+                         * the same offset, so unless there is a problem they
+                         * should match. This failure is an early indication that
+                         * hardware receive checksumming won't work.
+                         */
+                        if (likely(status >> 16 == (status & 0xffff))) {
+                                skb = sky2->rx_ring[sky2->rx_next].skb;
+                                skb->ip_summed = CHECKSUM_COMPLETE;
+                                skb->csum = status & 0xffff;
+                        } else {
+                                printk(KERN_NOTICE PFX "%s: hardware receive "
+                                       "checksum problem (status = %#x)\n",
+                                       dev->name, status);
+                                sky2->rx_csum = 0;
+                                sky2_write32(sky2->hw,
+                                             Q_ADDR(rxqaddr[le->link], Q_CSR),
+                                             BMU_DIS_RX_CHKSUM);
+                        }
                        break;
                case OP_TXINDEXLE:
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 0d97e10ccac5..36202e94ee91 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -186,7 +186,6 @@ static char __devinit *adapter_def(char type)
 #define TRC_INITV 0x02          /*  verbose init trace points     */
 static unsigned char ibmtr_debug_trace = 0;
-static int      ibmtr_probe(struct net_device *dev);
 static int      ibmtr_probe1(struct net_device *dev, int ioaddr);
 static unsigned char get_sram_size(struct tok_info *adapt_info);
 static int      trdev_init(struct net_device *dev);
@@ -335,17 +334,6 @@ static void ibmtr_cleanup_card(struct net_device *dev)
 #endif          
 }
-int ibmtr_probe_card(struct net_device *dev)
-{
-        int err = ibmtr_probe(dev);
-        if (!err) {
-                err = register_netdev(dev);
-                if (err)
-                        ibmtr_cleanup_card(dev);
-        }
-        return err;
-}
 /****************************************************************************
 *      ibmtr_probe():  Routine specified in the network device structure
 *      to probe for an IBM Token Ring Adapter.  Routine outline:
@@ -358,7 +346,7 @@ int ibmtr_probe_card(struct net_device *dev)
 *      which references it.
 ****************************************************************************/
-static int ibmtr_probe(struct net_device *dev)
+static int __init ibmtr_probe(struct net_device *dev)
 {
        int i;
        int base_addr = dev->base_addr;
@@ -378,6 +366,17 @@ static int ibmtr_probe(struct net_device *dev)
        return -ENODEV;
 }
+int __init ibmtr_probe_card(struct net_device *dev)
+{
+        int err = ibmtr_probe(dev);
+        if (!err) {
+                err = register_netdev(dev);
+                if (err)
+                        ibmtr_cleanup_card(dev);
+        }
+        return err;
+}
 /*****************************************************************************/
 static int __devinit ibmtr_probe1(struct net_device *dev, int PIOaddr)
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index ebbda1d8f542..f3a972e74e9a 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -30,8 +30,8 @@
 */
 #define DRV_NAME        "via-rhine"
-#define DRV_VERSION     "1.4.2"
+#define DRV_VERSION     "1.4.3"
-#define DRV_RELDATE     "Sept-11-2006"
+#define DRV_RELDATE     "2007-03-06"
 /* A few user-configurable values.
@@ -105,6 +105,7 @@ static const int multicast_filter_limit = 32;
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
+#include <linux/dmi.h>
 /* These identify the driver base version and may not be removed. */
 static char version[] __devinitdata =
@@ -1995,6 +1996,23 @@ static struct pci_driver rhine_driver = {
        .shutdown =     rhine_shutdown,
 };
+static struct dmi_system_id __initdata rhine_dmi_table[] = {
+        {
+                .ident = "EPIA-M",
+                .matches = {
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Award Software International, Inc."),
+                        DMI_MATCH(DMI_BIOS_VERSION, "6.00 PG"),
+                },
+        },
+        {
+                .ident = "KV7",
+                .matches = {
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+                        DMI_MATCH(DMI_BIOS_VERSION, "6.00 PG"),
+                },
+        },
+        { NULL }
+};
 static int __init rhine_init(void)
 {
@@ -2002,6 +2020,16 @@ static int __init rhine_init(void)
 #ifdef MODULE
        printk(version);
 #endif
+        if (dmi_check_system(rhine_dmi_table)) {
+                /* these BIOSes fail at PXE boot if chip is in D3 */
+                avoid_D3 = 1;
+                printk(KERN_WARNING "%s: Broken BIOS detected, avoid_D3 "
+                                    "enabled.\n",
+                       DRV_NAME);
+        }
+        else if (avoid_D3)
+                printk(KERN_INFO "%s: avoid_D3 set.\n", DRV_NAME);
        return pci_register_driver(&rhine_driver);
 }
diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
index 8dbcf83bb5f3..8b4540bfc1b0 100644
--- a/drivers/net/wan/z85230.c
+++ b/drivers/net/wan/z85230.c
@@ -407,7 +407,7 @@ static void z8530_tx(struct z8530_channel *c)
        while(c->txcount) {
                /* FIFO full ? */
                if(!(read_zsreg(c, R0)&4))
-                        break;
+                        return;
                c->txcount--;
                /*
                 *      Shovel out the byte
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index e594af46ff05..80cb88eb98c6 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -1858,9 +1858,6 @@ static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id)
        spin_lock(&bcm->irq_lock);
-        assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
-        assert(bcm->current_core->id == BCM43xx_COREID_80211);
        reason = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
        if (reason == 0xffffffff) {
                /* irq not for us (shared irq) */
@@ -1871,6 +1868,9 @@ static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id)
        if (!reason)
                goto out;
+        assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
+        assert(bcm->current_core->id == BCM43xx_COREID_80211);
        bcm->dma_reason[0] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA0_REASON)
                             & 0x0001DC00;
        bcm->dma_reason[1] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA1_REASON)
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
index 3a5c9c2b2150..cae89258a640 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
@@ -859,6 +859,11 @@ static void bcm43xx_phy_initb6(struct bcm43xx_private *bcm)
                bcm43xx_radio_write16(bcm, 0x005D, 0x0088);
                bcm43xx_radio_write16(bcm, 0x005E, 0x0088);
                bcm43xx_radio_write16(bcm, 0x007D, 0x0088);
+                bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED,
+                                    BCM43xx_UCODEFLAGS_OFFSET,
+                                    (bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED,
+                                    BCM43xx_UCODEFLAGS_OFFSET)
+                                    | 0x00000200));
        }
        if (radio->revision == 8) {
                bcm43xx_radio_write16(bcm, 0x0051, 0x0000);
@@ -941,7 +946,8 @@ static void bcm43xx_phy_initb6(struct bcm43xx_private *bcm)
        bcm43xx_phy_write(bcm, 0x0038, 0x0668);
        bcm43xx_radio_set_txpower_bg(bcm, 0xFFFF, 0xFFFF, 0xFFFF);
        if (radio->revision <= 5)
-                bcm43xx_phy_write(bcm, 0x005D, bcm43xx_phy_read(bcm, 0x005D) | 0x0003);
+                bcm43xx_phy_write(bcm, 0x005D, (bcm43xx_phy_read(bcm, 0x005D)
+                                  & 0xFF80) | 0x0003);
        if (radio->revision <= 2)
                bcm43xx_radio_write16(bcm, 0x005D, 0x000D);
        
@@ -958,7 +964,7 @@ static void bcm43xx_phy_initb6(struct bcm43xx_private *bcm)
                bcm43xx_phy_write(bcm, 0x0016, 0x0410);
                bcm43xx_phy_write(bcm, 0x0017, 0x0820);
                bcm43xx_phy_write(bcm, 0x0062, 0x0007);
-                (void) bcm43xx_radio_calibrationvalue(bcm);
+                bcm43xx_radio_init2050(bcm);
                bcm43xx_phy_lo_g_measure(bcm);
                if (bcm->sprom.boardflags & BCM43xx_BFL_RSSI) {
                        bcm43xx_calc_nrssi_slope(bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index 7b665e2386a8..d6d9413d7f23 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -105,18 +105,24 @@ static int bcm43xx_wx_set_channelfreq(struct net_device *net_dev,
        struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
        unsigned long flags;
        u8 channel;
+        s8 expon;
        int freq;
        int err = -EINVAL;
        mutex_lock(&bcm->mutex);
        spin_lock_irqsave(&bcm->irq_lock, flags);
-        if ((data->freq.m >= 0) && (data->freq.m <= 1000)) {
+        if ((data->freq.e == 0) &&
+            (data->freq.m >= 0) && (data->freq.m <= 1000)) {
                channel = data->freq.m;
                freq = bcm43xx_channel_to_freq(bcm, channel);
        } else {
-                channel = bcm43xx_freq_to_channel(bcm, data->freq.m);
                freq = data->freq.m;
+                expon = 6 - data->freq.e;
+                while (--expon >= 0)    /* scale down the frequency to MHz */
+                        freq /= 10;
+                assert(freq > 1000);
+                channel = bcm43xx_freq_to_channel(bcm, freq);
        }
        if (!ieee80211_is_valid_channel(bcm->ieee, channel))
                goto out_unlock;
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 7a535542fe92..118ac9779b3c 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -89,6 +89,7 @@ pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res, u32 gsi,
                return;
        res->irq_resource[i].flags = IORESOURCE_IRQ;  // Also clears _UNSET flag
+        res->irq_resource[i].flags |= irq_flags(triggering, polarity);
        irq = acpi_register_gsi(gsi, triggering, polarity);
        if (irq < 0) {
                res->irq_resource[i].flags |= IORESOURCE_DISABLED;
@@ -103,8 +104,52 @@ pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res, u32 gsi,
        pcibios_penalize_isa_irq(irq, 1);
 }
+static int dma_flags(int type, int bus_master, int transfer)
+{
+        int flags = 0;
+        if (bus_master)
+                flags |= IORESOURCE_DMA_MASTER;
+        switch (type) {
+        case ACPI_COMPATIBILITY:
+                flags |= IORESOURCE_DMA_COMPATIBLE;
+                break;
+        case ACPI_TYPE_A:
+                flags |= IORESOURCE_DMA_TYPEA;
+                break;
+        case ACPI_TYPE_B:
+                flags |= IORESOURCE_DMA_TYPEB;
+                break;
+        case ACPI_TYPE_F:
+                flags |= IORESOURCE_DMA_TYPEF;
+                break;
+        default:
+                /* Set a default value ? */
+                flags |= IORESOURCE_DMA_COMPATIBLE;
+                pnp_err("Invalid DMA type");
+        }
+        switch (transfer) {
+        case ACPI_TRANSFER_8:
+                flags |= IORESOURCE_DMA_8BIT;
+                break;
+        case ACPI_TRANSFER_8_16:
+                flags |= IORESOURCE_DMA_8AND16BIT;
+                break;
+        case ACPI_TRANSFER_16:
+                flags |= IORESOURCE_DMA_16BIT;
+                break;
+        default:
+                /* Set a default value ? */
+                flags |= IORESOURCE_DMA_8AND16BIT;
+                pnp_err("Invalid DMA transfer type");
+        }
+        return flags;
+}
 static void
-pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res, u32 dma)
+pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res, u32 dma,
+        int type, int bus_master, int transfer)
 {
        int i = 0;
        while (i < PNP_MAX_DMA &&
@@ -112,6 +157,7 @@ pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res, u32 dma)
                i++;
        if (i < PNP_MAX_DMA) {
                res->dma_resource[i].flags = IORESOURCE_DMA;  // Also clears _UNSET flag
+                res->dma_resource[i].flags |= dma_flags(type, bus_master, transfer);
                if (dma == -1) {
                        res->dma_resource[i].flags |= IORESOURCE_DISABLED;
                        return;
@@ -123,7 +169,7 @@ pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res, u32 dma)
 static void
 pnpacpi_parse_allocated_ioresource(struct pnp_resource_table *res,
-        u64 io, u64 len)
+        u64 io, u64 len, int io_decode)
 {
        int i = 0;
        while (!(res->port_resource[i].flags & IORESOURCE_UNSET) &&
@@ -131,6 +177,8 @@ pnpacpi_parse_allocated_ioresource(struct pnp_resource_table *res,
                i++;
        if (i < PNP_MAX_PORT) {
                res->port_resource[i].flags = IORESOURCE_IO;  // Also clears _UNSET flag
+                if (io_decode == ACPI_DECODE_16)
+                        res->port_resource[i].flags |= PNP_PORT_FLAG_16BITADDR;
                if (len <= 0 || (io + len -1) >= 0x10003) {
                        res->port_resource[i].flags |= IORESOURCE_DISABLED;
                        return;
@@ -142,7 +190,7 @@ pnpacpi_parse_allocated_ioresource(struct pnp_resource_table *res,
 static void
 pnpacpi_parse_allocated_memresource(struct pnp_resource_table *res,
-        u64 mem, u64 len)
+        u64 mem, u64 len, int write_protect)
 {
        int i = 0;
        while (!(res->mem_resource[i].flags & IORESOURCE_UNSET) &&
@@ -154,6 +202,9 @@ pnpacpi_parse_allocated_memresource(struct pnp_resource_table *res,
                        res->mem_resource[i].flags |= IORESOURCE_DISABLED;
                        return;
                }
+                if(write_protect == ACPI_READ_WRITE_MEMORY)
+                        res->mem_resource[i].flags |= IORESOURCE_MEM_WRITEABLE;
                res->mem_resource[i].start = mem;
                res->mem_resource[i].end = mem + len - 1;
        }
@@ -178,10 +229,11 @@ pnpacpi_parse_allocated_address_space(struct pnp_resource_table *res_table,
        if (p->resource_type == ACPI_MEMORY_RANGE)
                pnpacpi_parse_allocated_memresource(res_table,
-                                p->minimum, p->address_length);
+                                p->minimum, p->address_length, p->info.mem.write_protect);
        else if (p->resource_type == ACPI_IO_RANGE)
                pnpacpi_parse_allocated_ioresource(res_table,
-                                p->minimum, p->address_length);
+                                p->minimum, p->address_length,
+                                p->granularity == 0xfff ? ACPI_DECODE_10 : ACPI_DECODE_16);
 }
 static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
@@ -208,13 +260,17 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
        case ACPI_RESOURCE_TYPE_DMA:
                if (res->data.dma.channel_count > 0)
                        pnpacpi_parse_allocated_dmaresource(res_table,
-                                        res->data.dma.channels[0]);
+                                        res->data.dma.channels[0],
+                                        res->data.dma.type,
+                                        res->data.dma.bus_master,
+                                        res->data.dma.transfer);
                break;
        case ACPI_RESOURCE_TYPE_IO:
                pnpacpi_parse_allocated_ioresource(res_table,
                                res->data.io.minimum,
-                                res->data.io.address_length);
+                                res->data.io.address_length,
+                                res->data.io.io_decode);
                break;
        case ACPI_RESOURCE_TYPE_START_DEPENDENT:
@@ -224,7 +280,8 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
        case ACPI_RESOURCE_TYPE_FIXED_IO:
                pnpacpi_parse_allocated_ioresource(res_table,
                                res->data.fixed_io.address,
-                                res->data.fixed_io.address_length);
+                                res->data.fixed_io.address_length,
+                                ACPI_DECODE_10);
                break;
        case ACPI_RESOURCE_TYPE_VENDOR:
@@ -236,17 +293,20 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
        case ACPI_RESOURCE_TYPE_MEMORY24:
                pnpacpi_parse_allocated_memresource(res_table,
                                res->data.memory24.minimum,
-                                res->data.memory24.address_length);
+                                res->data.memory24.address_length,
+                                res->data.memory24.write_protect);
                break;
        case ACPI_RESOURCE_TYPE_MEMORY32:
                pnpacpi_parse_allocated_memresource(res_table,
                                res->data.memory32.minimum,
-                                res->data.memory32.address_length);
+                                res->data.memory32.address_length,
+                                res->data.memory32.write_protect);
                break;
        case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
                pnpacpi_parse_allocated_memresource(res_table,
                                res->data.fixed_memory32.address,
-                                res->data.fixed_memory32.address_length);
+                                res->data.fixed_memory32.address_length,
+                                res->data.fixed_memory32.write_protect);
                break;
        case ACPI_RESOURCE_TYPE_ADDRESS16:
        case ACPI_RESOURCE_TYPE_ADDRESS32:
@@ -304,42 +364,8 @@ static void pnpacpi_parse_dma_option(struct pnp_option *option, struct acpi_reso
        for(i = 0; i < p->channel_count; i++)
                dma->map |= 1 << p->channels[i];
-        dma->flags = 0;
-        if (p->bus_master)
+        dma->flags = dma_flags(p->type, p->bus_master, p->transfer);
-                dma->flags |= IORESOURCE_DMA_MASTER;
-        switch (p->type) {
-        case ACPI_COMPATIBILITY:
-                dma->flags |= IORESOURCE_DMA_COMPATIBLE;
-                break;
-        case ACPI_TYPE_A:
-                dma->flags |= IORESOURCE_DMA_TYPEA;
-                break;
-        case ACPI_TYPE_B:
-                dma->flags |= IORESOURCE_DMA_TYPEB;
-                break;
-        case ACPI_TYPE_F:
-                dma->flags |= IORESOURCE_DMA_TYPEF;
-                break;
-        default:
-                /* Set a default value ? */
-                dma->flags |= IORESOURCE_DMA_COMPATIBLE;
-                pnp_err("Invalid DMA type");
-        }
-        switch (p->transfer) {
-        case ACPI_TRANSFER_8:
-                dma->flags |= IORESOURCE_DMA_8BIT;
-                break;
-        case ACPI_TRANSFER_8_16:
-                dma->flags |= IORESOURCE_DMA_8AND16BIT;
-                break;
-        case ACPI_TRANSFER_16:
-                dma->flags |= IORESOURCE_DMA_16BIT;
-                break;
-        default:
-                /* Set a default value ? */
-                dma->flags |= IORESOURCE_DMA_8AND16BIT;
-                pnp_err("Invalid DMA transfer type");
-        }
        pnp_register_dma_resource(option, dma);
        return;
diff --git a/drivers/serial/sn_console.c b/drivers/serial/sn_console.c
index 253ceb895ca7..a27e9e92cb5e 100644
--- a/drivers/serial/sn_console.c
+++ b/drivers/serial/sn_console.c
@@ -636,25 +636,6 @@ static irqreturn_t sn_sal_interrupt(int irq, void *dev_id)
 }
 /**
- * sn_sal_connect_interrupt - Request interrupt, handled by sn_sal_interrupt
- * @port: Our sn_cons_port (which contains the uart port)
- *
- * returns the console irq if interrupt is successfully registered, else 0
- *
- */
-static int sn_sal_connect_interrupt(struct sn_cons_port *port)
-{
-        if (request_irq(SGI_UART_VECTOR, sn_sal_interrupt,
-                        IRQF_DISABLED | IRQF_SHARED,
-                        "SAL console driver", port) >= 0) {
-                return SGI_UART_VECTOR;
-        }
-        printk(KERN_INFO "sn_console: console proceeding in polled mode\n");
-        return 0;
-}
-/**
 * sn_sal_timer_poll - this function handles polled console mode
 * @data: A pointer to our sn_cons_port (which contains the uart port)
 *
@@ -746,30 +727,31 @@ static void __init sn_sal_switch_to_asynch(struct sn_cons_port *port)
 * mode.  We were previously in asynch/polling mode (using init_timer).
 *
 * We attempt to switch to interrupt mode here by calling
- * sn_sal_connect_interrupt.  If that works out, we enable receive interrupts.
+ * request_irq.  If that works out, we enable receive interrupts.
 */
 static void __init sn_sal_switch_to_interrupts(struct sn_cons_port *port)
 {
-        int irq;
        unsigned long flags;
-        if (!port)
+        if (port) {
-                return;
+                DPRINTF("sn_console: switching to interrupt driven console\n");
-        DPRINTF("sn_console: switching to interrupt driven console\n");
-        spin_lock_irqsave(&port->sc_port.lock, flags);
-        irq = sn_sal_connect_interrupt(port);
+                if (request_irq(SGI_UART_VECTOR, sn_sal_interrupt,
+                                IRQF_DISABLED | IRQF_SHARED,
+                                "SAL console driver", port) >= 0) {
+                        spin_lock_irqsave(&port->sc_port.lock, flags);
+                        port->sc_port.irq = SGI_UART_VECTOR;
+                        port->sc_ops = &intr_ops;
-        if (irq) {
+                        /* turn on receive interrupts */
-                port->sc_port.irq = irq;
+                        ia64_sn_console_intr_enable(SAL_CONSOLE_INTR_RECV);
-                port->sc_ops = &intr_ops;
+                        spin_unlock_irqrestore(&port->sc_port.lock, flags);
+                }
-                /* turn on receive interrupts */
+                else {
-                ia64_sn_console_intr_enable(SAL_CONSOLE_INTR_RECV);
+                        printk(KERN_INFO
+                            "sn_console: console proceeding in polled mode\n");
+                }
        }
-        spin_unlock_irqrestore(&port->sc_port.lock, flags);
 }
 /*