186 files changed, 3368 insertions, 645 deletions

diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 5d1d07645132..e8cd652d2017 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1206,9 +1206,9 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
         
  out_unmap_both:
         pci_set_drvdata(dev, NULL);
-        pci_iounmap(dev, card->config_regs);
- out_unmap_config:
         pci_iounmap(dev, card->buffers);
+ out_unmap_config:
+        pci_iounmap(dev, card->config_regs);
  out_release_regions:
         pci_release_regions(dev);
  out:
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index e086fbbbe853..8db9089127c5 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -1177,7 +1177,8 @@ static bool DAC960_V1_EnableMemoryMailboxInterface(DAC960_Controller_T
   int TimeoutCounter;
   int i;
 
-  
+  memset(&CommandMailbox, 0, sizeof(DAC960_V1_CommandMailbox_T));
+
   if (pci_set_dma_mask(Controller->PCIDevice, DMA_BIT_MASK(32)))
         return DAC960_Failure(Controller, "DMA mask out of range");
   Controller->BounceBufferLimit = DMA_BIT_MASK(32);
@@ -4627,7 +4628,8 @@ static void DAC960_V2_ProcessCompletedCommand(DAC960_Command_T *Command)
   DAC960_Controller_T *Controller = Command->Controller;
   DAC960_CommandType_T CommandType = Command->CommandType;
   DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
-  DAC960_V2_IOCTL_Opcode_T CommandOpcode = CommandMailbox->Common.IOCTL_Opcode;
+  DAC960_V2_IOCTL_Opcode_T IOCTLOpcode = CommandMailbox->Common.IOCTL_Opcode;
+  DAC960_V2_CommandOpcode_T CommandOpcode = CommandMailbox->SCSI_10.CommandOpcode;
   DAC960_V2_CommandStatus_T CommandStatus = Command->V2.CommandStatus;
 
   if (CommandType == DAC960_ReadCommand ||
@@ -4699,7 +4701,7 @@ static void DAC960_V2_ProcessCompletedCommand(DAC960_Command_T *Command)
     {
       if (Controller->ShutdownMonitoringTimer)
               return;
-      if (CommandOpcode == DAC960_V2_GetControllerInfo)
+      if (IOCTLOpcode == DAC960_V2_GetControllerInfo)
         {
           DAC960_V2_ControllerInfo_T *NewControllerInfo =
             Controller->V2.NewControllerInformation;
@@ -4719,14 +4721,14 @@ static void DAC960_V2_ProcessCompletedCommand(DAC960_Command_T *Command)
           memcpy(ControllerInfo, NewControllerInfo,
                  sizeof(DAC960_V2_ControllerInfo_T));
         }
-      else if (CommandOpcode == DAC960_V2_GetEvent)
+      else if (IOCTLOpcode == DAC960_V2_GetEvent)
         {
           if (CommandStatus == DAC960_V2_NormalCompletion) {
             DAC960_V2_ReportEvent(Controller, Controller->V2.Event);
           }
           Controller->V2.NextEventSequenceNumber++;
         }
-      else if (CommandOpcode == DAC960_V2_GetPhysicalDeviceInfoValid &&
+      else if (IOCTLOpcode == DAC960_V2_GetPhysicalDeviceInfoValid &&
                CommandStatus == DAC960_V2_NormalCompletion)
         {
           DAC960_V2_PhysicalDeviceInfo_T *NewPhysicalDeviceInfo =
@@ -4915,7 +4917,7 @@ static void DAC960_V2_ProcessCompletedCommand(DAC960_Command_T *Command)
           NewPhysicalDeviceInfo->LogicalUnit++;
           Controller->V2.PhysicalDeviceIndex++;
         }
-      else if (CommandOpcode == DAC960_V2_GetPhysicalDeviceInfoValid)
+      else if (IOCTLOpcode == DAC960_V2_GetPhysicalDeviceInfoValid)
         {
           unsigned int DeviceIndex;
           for (DeviceIndex = Controller->V2.PhysicalDeviceIndex;
@@ -4938,7 +4940,7 @@ static void DAC960_V2_ProcessCompletedCommand(DAC960_Command_T *Command)
             }
           Controller->V2.NeedPhysicalDeviceInformation = false;
         }
-      else if (CommandOpcode == DAC960_V2_GetLogicalDeviceInfoValid &&
+      else if (IOCTLOpcode == DAC960_V2_GetLogicalDeviceInfoValid &&
                CommandStatus == DAC960_V2_NormalCompletion)
         {
           DAC960_V2_LogicalDeviceInfo_T *NewLogicalDeviceInfo =
@@ -5065,7 +5067,7 @@ static void DAC960_V2_ProcessCompletedCommand(DAC960_Command_T *Command)
                          [LogicalDeviceNumber] = true;
           NewLogicalDeviceInfo->LogicalDeviceNumber++;
         }
-      else if (CommandOpcode == DAC960_V2_GetLogicalDeviceInfoValid)
+      else if (IOCTLOpcode == DAC960_V2_GetLogicalDeviceInfoValid)
         {
           int LogicalDriveNumber;
           for (LogicalDriveNumber = 0;
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 9baf11e86362..744f078f4dd8 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3832,7 +3832,7 @@ static int __floppy_read_block_0(struct block_device *bdev)
         bio.bi_size = size;
         bio.bi_bdev = bdev;
         bio.bi_sector = 0;
-        bio.bi_flags = BIO_QUIET;
+        bio.bi_flags = (1 << BIO_QUIET);
         init_completion(&complete);
         bio.bi_private = &complete;
         bio.bi_end_io = floppy_rb0_complete;
diff --git a/drivers/block/sx8.c b/drivers/block/sx8.c
index e7472f567c9d..3fb6ab4c8b4e 100644
--- a/drivers/block/sx8.c
+++ b/drivers/block/sx8.c
@@ -1120,7 +1120,7 @@ static inline void carm_handle_resp(struct carm_host *host,
                         break;
                 case MISC_GET_FW_VER: {
                         struct carm_fw_ver *ver = (struct carm_fw_ver *)
-                                mem + sizeof(struct carm_msg_get_fw_ver);
+                                (mem + sizeof(struct carm_msg_get_fw_ver));
                         if (!error) {
                                 host->fw_ver = le32_to_cpu(ver->version);
                                 host->flags |= (ver->features & FL_FW_VER_MASK);
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f00f596c1029..789c9b579aea 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
 
         /* Broadcom BCM20702A0 */
         { USB_DEVICE(0x0a5c, 0x21e3) },
+        { USB_DEVICE(0x0a5c, 0x21f3) },
         { USB_DEVICE(0x413c, 0x8197) },
 
         { }     /* Terminating entry */
@@ -726,9 +727,6 @@ static int btusb_send_frame(struct sk_buff *skb)
                 usb_fill_bulk_urb(urb, data->udev, pipe,
                                 skb->data, skb->len, btusb_tx_complete, skb);
 
-                if (skb->priority >= HCI_PRIO_MAX - 1)
-                        urb->transfer_flags  = URB_ISO_ASAP;
-
                 hdev->stat.acl_tx++;
                 break;
 
diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c
index 597235a2f8f9..0d40cf66b3cc 100644
--- a/drivers/crypto/mv_cesa.c
+++ b/drivers/crypto/mv_cesa.c
@@ -714,6 +714,7 @@ static int mv_hash_final(struct ahash_request *req)
 {
         struct mv_req_hash_ctx *ctx = ahash_request_ctx(req);
 
+        ahash_request_set_crypt(req, NULL, req->result, 0);
         mv_update_hash_req_ctx(ctx, 1, 0);
         return mv_handle_req(&req->base);
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
index d620b0784257..99d5527b2ca6 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -28,6 +28,7 @@
 #include "drmP.h"
 #include "drm_crtc_helper.h"
 
+#include <drm/exynos_drm.h>
 #include "exynos_drm_drv.h"
 #include "exynos_drm_encoder.h"
 
@@ -44,22 +45,25 @@ struct exynos_drm_connector {
 /* convert exynos_video_timings to drm_display_mode */
 static inline void
 convert_to_display_mode(struct drm_display_mode *mode,
-                        struct fb_videomode *timing)
+                        struct exynos_drm_panel_info *panel)
 {
+        struct fb_videomode *timing = &panel->timing;
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         mode->clock = timing->pixclock / 1000;
         mode->vrefresh = timing->refresh;
 
         mode->hdisplay = timing->xres;
-        mode->hsync_start = mode->hdisplay + timing->left_margin;
+        mode->hsync_start = mode->hdisplay + timing->right_margin;
         mode->hsync_end = mode->hsync_start + timing->hsync_len;
-        mode->htotal = mode->hsync_end + timing->right_margin;
+        mode->htotal = mode->hsync_end + timing->left_margin;
 
         mode->vdisplay = timing->yres;
-        mode->vsync_start = mode->vdisplay + timing->upper_margin;
+        mode->vsync_start = mode->vdisplay + timing->lower_margin;
         mode->vsync_end = mode->vsync_start + timing->vsync_len;
-        mode->vtotal = mode->vsync_end + timing->lower_margin;
+        mode->vtotal = mode->vsync_end + timing->upper_margin;
+        mode->width_mm = panel->width_mm;
+        mode->height_mm = panel->height_mm;
 
         if (timing->vmode & FB_VMODE_INTERLACED)
                 mode->flags |= DRM_MODE_FLAG_INTERLACE;
@@ -81,14 +85,14 @@ convert_to_video_timing(struct fb_videomode *timing,
         timing->refresh = drm_mode_vrefresh(mode);
 
         timing->xres = mode->hdisplay;
-        timing->left_margin = mode->hsync_start - mode->hdisplay;
+        timing->right_margin = mode->hsync_start - mode->hdisplay;
         timing->hsync_len = mode->hsync_end - mode->hsync_start;
-        timing->right_margin = mode->htotal - mode->hsync_end;
+        timing->left_margin = mode->htotal - mode->hsync_end;
 
         timing->yres = mode->vdisplay;
-        timing->upper_margin = mode->vsync_start - mode->vdisplay;
+        timing->lower_margin = mode->vsync_start - mode->vdisplay;
         timing->vsync_len = mode->vsync_end - mode->vsync_start;
-        timing->lower_margin = mode->vtotal - mode->vsync_end;
+        timing->upper_margin = mode->vtotal - mode->vsync_end;
 
         if (mode->flags & DRM_MODE_FLAG_INTERLACE)
                 timing->vmode = FB_VMODE_INTERLACED;
@@ -148,16 +152,18 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                 connector->display_info.raw_edid = edid;
         } else {
                 struct drm_display_mode *mode = drm_mode_create(connector->dev);
-                struct fb_videomode *timing;
+                struct exynos_drm_panel_info *panel;
 
-                if (display_ops->get_timing)
-                        timing = display_ops->get_timing(manager->dev);
+                if (display_ops->get_panel)
+                        panel = display_ops->get_panel(manager->dev);
                 else {
                         drm_mode_destroy(connector->dev, mode);
                         return 0;
                 }
 
-                convert_to_display_mode(mode, timing);
+                convert_to_display_mode(mode, panel);
+                connector->display_info.width_mm = mode->width_mm;
+                connector->display_info.height_mm = mode->height_mm;
 
                 mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
                 drm_mode_set_name(mode);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 58820ebd3558..09cc13f791b3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -246,7 +246,7 @@ static struct platform_driver exynos_drm_platform_driver = {
         .remove         = __devexit_p(exynos_drm_platform_remove),
         .driver         = {
                 .owner  = THIS_MODULE,
-                .name   = DRIVER_NAME,
+                .name   = "exynos-drm",
         },
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index e685e1e33055..13540de90bfc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -136,7 +136,7 @@ struct exynos_drm_overlay {
  * @type: one of EXYNOS_DISPLAY_TYPE_LCD and HDMI.
  * @is_connected: check for that display is connected or not.
  * @get_edid: get edid modes from display driver.
- * @get_timing: get timing object from display driver.
+ * @get_panel: get panel object from display driver.
  * @check_timing: check if timing is valid or not.
  * @power_on: display device on or off.
  */
@@ -145,7 +145,7 @@ struct exynos_drm_display_ops {
         bool (*is_connected)(struct device *dev);
         int (*get_edid)(struct device *dev, struct drm_connector *connector,
                                 u8 *edid, int len);
-        void *(*get_timing)(struct device *dev);
+        void *(*get_panel)(struct device *dev);
         int (*check_timing)(struct device *dev, void *timing);
         int (*power_on)(struct device *dev, int mode);
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index 3508700e529b..54f8f074822f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -46,39 +46,13 @@ struct exynos_drm_fbdev {
         struct exynos_drm_gem_obj       *exynos_gem_obj;
 };
 
-static int exynos_drm_fbdev_set_par(struct fb_info *info)
-{
-        struct fb_var_screeninfo *var = &info->var;
-
-        switch (var->bits_per_pixel) {
-        case 32:
-        case 24:
-        case 18:
-        case 16:
-        case 12:
-                info->fix.visual = FB_VISUAL_TRUECOLOR;
-                break;
-        case 1:
-                info->fix.visual = FB_VISUAL_MONO01;
-                break;
-        default:
-                info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-                break;
-        }
-
-        info->fix.line_length = (var->xres_virtual * var->bits_per_pixel) / 8;
-
-        return drm_fb_helper_set_par(info);
-}
-
-
 static struct fb_ops exynos_drm_fb_ops = {
         .owner          = THIS_MODULE,
         .fb_fillrect    = cfb_fillrect,
         .fb_copyarea    = cfb_copyarea,
         .fb_imageblit   = cfb_imageblit,
         .fb_check_var   = drm_fb_helper_check_var,
-        .fb_set_par     = exynos_drm_fbdev_set_par,
+        .fb_set_par     = drm_fb_helper_set_par,
         .fb_blank       = drm_fb_helper_blank,
         .fb_pan_display = drm_fb_helper_pan_display,
         .fb_setcmap     = drm_fb_helper_setcmap,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 0dbb32bb18a3..56458eea0501 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -89,7 +89,7 @@ struct fimd_context {
         bool                            suspended;
         struct mutex                    lock;
 
-        struct fb_videomode             *timing;
+        struct exynos_drm_panel_info *panel;
 };
 
 static bool fimd_display_is_connected(struct device *dev)
@@ -101,13 +101,13 @@ static bool fimd_display_is_connected(struct device *dev)
         return true;
 }
 
-static void *fimd_get_timing(struct device *dev)
+static void *fimd_get_panel(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        return ctx->timing;
+        return ctx->panel;
 }
 
 static int fimd_check_timing(struct device *dev, void *timing)
@@ -131,7 +131,7 @@ static int fimd_display_power_on(struct device *dev, int mode)
 static struct exynos_drm_display_ops fimd_display_ops = {
         .type = EXYNOS_DISPLAY_TYPE_LCD,
         .is_connected = fimd_display_is_connected,
-        .get_timing = fimd_get_timing,
+        .get_panel = fimd_get_panel,
         .check_timing = fimd_check_timing,
         .power_on = fimd_display_power_on,
 };
@@ -193,7 +193,8 @@ static void fimd_apply(struct device *subdrv_dev)
 static void fimd_commit(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
-        struct fb_videomode *timing = ctx->timing;
+        struct exynos_drm_panel_info *panel = ctx->panel;
+        struct fb_videomode *timing = &panel->timing;
         u32 val;
 
         if (ctx->suspended)
@@ -786,7 +787,7 @@ static int __devinit fimd_probe(struct platform_device *pdev)
         struct fimd_context *ctx;
         struct exynos_drm_subdrv *subdrv;
         struct exynos_drm_fimd_pdata *pdata;
-        struct fb_videomode *timing;
+        struct exynos_drm_panel_info *panel;
         struct resource *res;
         int win;
         int ret = -EINVAL;
@@ -799,9 +800,9 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        timing = &pdata->timing;
-        if (!timing) {
-                dev_err(dev, "timing is null.\n");
+        panel = &pdata->panel;
+        if (!panel) {
+                dev_err(dev, "panel is null.\n");
                 return -EINVAL;
         }
 
@@ -816,8 +817,6 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 goto err_clk_get;
         }
 
-        clk_enable(ctx->bus_clk);
-
         ctx->lcd_clk = clk_get(dev, "sclk_fimd");
         if (IS_ERR(ctx->lcd_clk)) {
                 dev_err(dev, "failed to get lcd clock\n");
@@ -825,8 +824,6 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 goto err_bus_clk;
         }
 
-        clk_enable(ctx->lcd_clk);
-
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!res) {
                 dev_err(dev, "failed to find registers\n");
@@ -863,16 +860,10 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 goto err_req_irq;
         }
 
-        ctx->clkdiv = fimd_calc_clkdiv(ctx, timing);
         ctx->vidcon0 = pdata->vidcon0;
         ctx->vidcon1 = pdata->vidcon1;
         ctx->default_win = pdata->default_win;
-        ctx->timing = timing;
-
-        timing->pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
-
-        DRM_DEBUG_KMS("pixel clock = %d, clkdiv = %d\n",
-                        timing->pixclock, ctx->clkdiv);
+        ctx->panel = panel;
 
         subdrv = &ctx->subdrv;
 
@@ -888,10 +879,15 @@ static int __devinit fimd_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, ctx);
 
-        pm_runtime_set_active(dev);
         pm_runtime_enable(dev);
         pm_runtime_get_sync(dev);
 
+        ctx->clkdiv = fimd_calc_clkdiv(ctx, &panel->timing);
+        panel->timing.pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
+
+        DRM_DEBUG_KMS("pixel clock = %d, clkdiv = %d\n",
+                        panel->timing.pixclock, ctx->clkdiv);
+
         for (win = 0; win < WINDOWS_NR; win++)
                 fimd_clear_win(ctx, win);
 
diff --git a/drivers/gpu/drm/gma500/cdv_device.c b/drivers/gpu/drm/gma500/cdv_device.c
index 4a5b099c3bc5..53404af2e748 100644
--- a/drivers/gpu/drm/gma500/cdv_device.c
+++ b/drivers/gpu/drm/gma500/cdv_device.c
@@ -321,6 +321,8 @@ static int cdv_chip_setup(struct drm_device *dev)
         cdv_get_core_freq(dev);
         gma_intel_opregion_init(dev);
         psb_intel_init_bios(dev);
+        REG_WRITE(PORT_HOTPLUG_EN, 0);
+        REG_WRITE(PORT_HOTPLUG_STAT, REG_READ(PORT_HOTPLUG_STAT));
         return 0;
 }
 
diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
index 830dfdd6bf15..be616735ec91 100644
--- a/drivers/gpu/drm/gma500/framebuffer.c
+++ b/drivers/gpu/drm/gma500/framebuffer.c
@@ -247,7 +247,6 @@ static struct fb_ops psbfb_roll_ops = {
         .fb_imageblit = cfb_imageblit,
         .fb_pan_display = psbfb_pan,
         .fb_mmap = psbfb_mmap,
-        .fb_sync = psbfb_sync,
         .fb_ioctl = psbfb_ioctl,
 };
 
diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c
index 5d5330f667f1..aff194fbe9f3 100644
--- a/drivers/gpu/drm/gma500/gtt.c
+++ b/drivers/gpu/drm/gma500/gtt.c
@@ -446,10 +446,9 @@ int psb_gtt_init(struct drm_device *dev, int resume)
         pg->gtt_start = pci_resource_start(dev->pdev, PSB_GTT_RESOURCE);
         gtt_pages = pci_resource_len(dev->pdev, PSB_GTT_RESOURCE)
                                                                 >> PAGE_SHIFT;
-        /* Some CDV firmware doesn't report this currently. In which case the
-           system has 64 gtt pages */
+        /* CDV doesn't report this. In which case the system has 64 gtt pages */
         if (pg->gtt_start == 0 || gtt_pages == 0) {
-                dev_err(dev->dev, "GTT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GTT PCI BAR not initialized.\n");
                 gtt_pages = 64;
                 pg->gtt_start = dev_priv->pge_ctl;
         }
@@ -461,10 +460,10 @@ int psb_gtt_init(struct drm_device *dev, int resume)
 
         if (pg->gatt_pages == 0 || pg->gatt_start == 0) {
                 static struct resource fudge;   /* Preferably peppermint */
-                /* This can occur on CDV SDV systems. Fudge it in this case.
+                /* This can occur on CDV systems. Fudge it in this case.
                    We really don't care what imaginary space is being allocated
                    at this point */
-                dev_err(dev->dev, "GATT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GATT PCI BAR not initialized.\n");
                 pg->gatt_start = 0x40000000;
                 pg->gatt_pages = (128 * 1024 * 1024) >> PAGE_SHIFT;
                 /* This is a little confusing but in fact the GTT is providing
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 03c53fcf8653..558ac716a328 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2689,7 +2689,7 @@
 #define   DVS_FORMAT_RGBX888    (2<<25)
 #define   DVS_FORMAT_RGBX161616 (3<<25)
 #define   DVS_SOURCE_KEY        (1<<22)
-#define   DVS_RGB_ORDER_RGBX    (1<<20)
+#define   DVS_RGB_ORDER_XBGR    (1<<20)
 #define   DVS_YUV_BYTE_ORDER_MASK (3<<16)
 #define   DVS_YUV_ORDER_YUYV    (0<<16)
 #define   DVS_YUV_ORDER_UYVY    (1<<16)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index f425b23e3803..397087cf689e 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4680,8 +4680,17 @@ sandybridge_compute_sprite_srwm(struct drm_device *dev, int plane,
 
         crtc = intel_get_crtc_for_plane(dev, plane);
         clock = crtc->mode.clock;
+        if (!clock) {
+                *sprite_wm = 0;
+                return false;
+        }
 
         line_time_us = (sprite_width * 1000) / clock;
+        if (!line_time_us) {
+                *sprite_wm = 0;
+                return false;
+        }
+
         line_count = (latency_ns / line_time_us + 1000) / 1000;
         line_size = sprite_width * pixel_size;
 
@@ -6175,7 +6184,7 @@ void intel_crtc_load_lut(struct drm_crtc *crtc)
         int i;
 
         /* The clocks have to be on to load the palette. */
-        if (!crtc->enabled)
+        if (!crtc->enabled || !intel_crtc->active)
                 return;
 
         /* use legacy palette for Ironlake */
@@ -6561,7 +6570,7 @@ intel_framebuffer_create_for_mode(struct drm_device *dev,
         mode_cmd.height = mode->vdisplay;
         mode_cmd.pitches[0] = intel_framebuffer_pitch_for_width(mode_cmd.width,
                                                                 bpp);
-        mode_cmd.pixel_format = 0;
+        mode_cmd.pixel_format = drm_mode_legacy_fb_format(bpp, depth);
 
         return intel_framebuffer_create(dev, &mode_cmd, obj);
 }
@@ -7819,6 +7828,7 @@ int intel_framebuffer_init(struct drm_device *dev,
         case DRM_FORMAT_RGB332:
         case DRM_FORMAT_RGB565:
         case DRM_FORMAT_XRGB8888:
+        case DRM_FORMAT_XBGR8888:
         case DRM_FORMAT_ARGB8888:
         case DRM_FORMAT_XRGB2101010:
         case DRM_FORMAT_ARGB2101010:
@@ -8185,7 +8195,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
 
         if (intel_enable_rc6(dev_priv->dev))
                 rc6_mask = GEN6_RC_CTL_RC6_ENABLE |
-                        (IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0;
+                        ((IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0);
 
         I915_WRITE(GEN6_RC_CONTROL,
                    rc6_mask |
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 1ab842c6032e..536191540b03 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -301,7 +301,7 @@ static int init_ring_common(struct intel_ring_buffer *ring)
 
         I915_WRITE_CTL(ring,
                         ((ring->size - PAGE_SIZE) & RING_NR_PAGES)
-                        | RING_REPORT_64K | RING_VALID);
+                        | RING_VALID);
 
         /* If the head is still not zero, the ring is dead */
         if ((I915_READ_CTL(ring) & RING_VALID) == 0 ||
@@ -1132,18 +1132,6 @@ int intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n)
         struct drm_device *dev = ring->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         unsigned long end;
-        u32 head;
-
-        /* If the reported head position has wrapped or hasn't advanced,
-         * fallback to the slow and accurate path.
-         */
-        head = intel_read_status_page(ring, 4);
-        if (head > ring->head) {
-                ring->head = head;
-                ring->space = ring_space(ring);
-                if (ring->space >= n)
-                        return 0;
-        }
 
         trace_i915_ring_wait_begin(ring);
         if (drm_core_check_feature(dev, DRIVER_GEM))
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 2288abf88cce..a0835040c86b 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -225,16 +225,16 @@ snb_update_plane(struct drm_plane *plane, struct drm_framebuffer *fb,
 
         /* Mask out pixel format bits in case we change it */
         dvscntr &= ~DVS_PIXFORMAT_MASK;
-        dvscntr &= ~DVS_RGB_ORDER_RGBX;
+        dvscntr &= ~DVS_RGB_ORDER_XBGR;
         dvscntr &= ~DVS_YUV_BYTE_ORDER_MASK;
 
         switch (fb->pixel_format) {
         case DRM_FORMAT_XBGR8888:
-                dvscntr |= DVS_FORMAT_RGBX888;
+                dvscntr |= DVS_FORMAT_RGBX888 | DVS_RGB_ORDER_XBGR;
                 pixel_size = 4;
                 break;
         case DRM_FORMAT_XRGB8888:
-                dvscntr |= DVS_FORMAT_RGBX888 | DVS_RGB_ORDER_RGBX;
+                dvscntr |= DVS_FORMAT_RGBX888;
                 pixel_size = 4;
                 break;
         case DRM_FORMAT_YUYV:
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index fbcd84803b60..17ca72ce3027 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2362,6 +2362,9 @@ void r600_semaphore_ring_emit(struct radeon_device *rdev,
         uint64_t addr = semaphore->gpu_addr;
         unsigned sel = emit_wait ? PACKET3_SEM_SEL_WAIT : PACKET3_SEM_SEL_SIGNAL;
 
+        if (rdev->family < CHIP_CAYMAN)
+                sel |= PACKET3_SEM_WAIT_ON_SIGNAL;
+
         radeon_ring_write(ring, PACKET3(PACKET3_MEM_SEMAPHORE, 1));
         radeon_ring_write(ring, addr & 0xffffffff);
         radeon_ring_write(ring, (upper_32_bits(addr) & 0xff) | sel);
diff --git a/drivers/gpu/drm/radeon/r600_blit_shaders.c b/drivers/gpu/drm/radeon/r600_blit_shaders.c
index 2d1f6c5ee2a7..73e2c7c6edbc 100644
--- a/drivers/gpu/drm/radeon/r600_blit_shaders.c
+++ b/drivers/gpu/drm/radeon/r600_blit_shaders.c
@@ -314,6 +314,10 @@ const u32 r6xx_default_state[] =
         0x00000000, /* VGT_VTX_CNT_EN */
 
         0xc0016900,
+        0x000000d4,
+        0x00000000, /* SX_MISC */
+
+        0xc0016900,
         0x000002c8,
         0x00000000, /* VGT_STRMOUT_BUFFER_EN */
 
@@ -626,6 +630,10 @@ const u32 r7xx_default_state[] =
         0x00000000, /* VGT_VTX_CNT_EN */
 
         0xc0016900,
+        0x000000d4,
+        0x00000000, /* SX_MISC */
+
+        0xc0016900,
         0x000002c8,
         0x00000000, /* VGT_STRMOUT_BUFFER_EN */
 
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 38ce5d0427e3..387fcc9f03ef 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1304,6 +1304,7 @@ static int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 idx,
         h0 = G_038004_TEX_HEIGHT(word1) + 1;
         d0 = G_038004_TEX_DEPTH(word1);
         nfaces = 1;
+        array = 0;
         switch (G_038000_DIM(word0)) {
         case V_038000_SQ_TEX_DIM_1D:
         case V_038000_SQ_TEX_DIM_2D:
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index 3ee1fd7ef394..9b23670716f1 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -831,6 +831,7 @@
 #define PACKET3_STRMOUT_BUFFER_UPDATE                   0x34
 #define PACKET3_INDIRECT_BUFFER_MP                      0x38
 #define PACKET3_MEM_SEMAPHORE                           0x39
+#              define PACKET3_SEM_WAIT_ON_SIGNAL    (0x1 << 12)
 #              define PACKET3_SEM_SEL_SIGNAL        (0x6 << 29)
 #              define PACKET3_SEM_SEL_WAIT          (0x7 << 29)
 #define PACKET3_MPEG_INDEX                              0x3A
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index e7cb3ab09243..8c9a8115b632 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1057,7 +1057,7 @@ static int radeon_dvi_mode_valid(struct drm_connector *connector,
                     (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B))
                         return MODE_OK;
                 else if (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_A) {
-                        if (ASIC_IS_DCE3(rdev)) {
+                        if (0) {
                                 /* HDMI 1.3+ supports max clock of 340 Mhz */
                                 if (mode->clock > 340000)
                                         return MODE_CLOCK_HIGH;
@@ -1117,13 +1117,23 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
             (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)) {
                 struct drm_display_mode *mode;
 
-                if (!radeon_dig_connector->edp_on)
-                        atombios_set_edp_panel_power(connector,
-                                                     ATOM_TRANSMITTER_ACTION_POWER_ON);
-                ret = radeon_ddc_get_modes(radeon_connector);
-                if (!radeon_dig_connector->edp_on)
-                        atombios_set_edp_panel_power(connector,
-                                                     ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+                        if (!radeon_dig_connector->edp_on)
+                                atombios_set_edp_panel_power(connector,
+                                                             ATOM_TRANSMITTER_ACTION_POWER_ON);
+                        ret = radeon_ddc_get_modes(radeon_connector);
+                        if (!radeon_dig_connector->edp_on)
+                                atombios_set_edp_panel_power(connector,
+                                                             ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                } else {
+                        /* need to setup ddc on the bridge */
+                        if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) !=
+                            ENCODER_OBJECT_ID_NONE) {
+                                if (encoder)
+                                        radeon_atom_ext_encoder_setup_ddc(encoder);
+                        }
+                        ret = radeon_ddc_get_modes(radeon_connector);
+                }
 
                 if (ret > 0) {
                         if (encoder) {
@@ -1134,7 +1144,6 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
                         return ret;
                 }
 
-                encoder = radeon_best_single_encoder(connector);
                 if (!encoder)
                         return 0;
 
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 8c49fef1ce78..3d314338d843 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1078,15 +1078,21 @@ static const struct drm_framebuffer_funcs radeon_fb_funcs = {
         .create_handle = radeon_user_framebuffer_create_handle,
 };
 
-void
+int
 radeon_framebuffer_init(struct drm_device *dev,
                         struct radeon_framebuffer *rfb,
                         struct drm_mode_fb_cmd2 *mode_cmd,
                         struct drm_gem_object *obj)
 {
+        int ret;
         rfb->obj = obj;
-        drm_framebuffer_init(dev, &rfb->base, &radeon_fb_funcs);
+        ret = drm_framebuffer_init(dev, &rfb->base, &radeon_fb_funcs);
+        if (ret) {
+                rfb->obj = NULL;
+                return ret;
+        }
         drm_helper_mode_fill_fb_struct(&rfb->base, mode_cmd);
+        return 0;
 }
 
 static struct drm_framebuffer *
@@ -1096,6 +1102,7 @@ radeon_user_framebuffer_create(struct drm_device *dev,
 {
         struct drm_gem_object *obj;
         struct radeon_framebuffer *radeon_fb;
+        int ret;
 
         obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handles[0]);
         if (obj ==  NULL) {
@@ -1108,7 +1115,12 @@ radeon_user_framebuffer_create(struct drm_device *dev,
         if (radeon_fb == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
+        ret = radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
+        if (ret) {
+                kfree(radeon_fb);
+                drm_gem_object_unreference_unlocked(obj);
+                return NULL;
+        }
 
         return &radeon_fb->base;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 9419c51bcf50..26e92708d114 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -307,8 +307,6 @@ void radeon_panel_mode_fixup(struct drm_encoder *encoder,
 bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
                                     u32 pixel_clock)
 {
-        struct drm_device *dev = encoder->dev;
-        struct radeon_device *rdev = dev->dev_private;
         struct drm_connector *connector;
         struct radeon_connector *radeon_connector;
         struct radeon_connector_atom_dig *dig_connector;
@@ -326,7 +324,7 @@ bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
         case DRM_MODE_CONNECTOR_HDMIB:
                 if (radeon_connector->use_digital) {
                         /* HDMI 1.3 supports up to 340 Mhz over single link */
-                        if (ASIC_IS_DCE3(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
+                        if (0 && drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                 if (pixel_clock > 340000)
                                         return true;
                                 else
@@ -348,7 +346,7 @@ bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
                         return false;
                 else {
                         /* HDMI 1.3 supports up to 340 Mhz over single link */
-                        if (ASIC_IS_DCE3(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
+                        if (0 && drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                 if (pixel_clock > 340000)
                                         return true;
                                 else
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index cf2bf35b56b8..195471cf65d3 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -209,6 +209,11 @@ static int radeonfb_create(struct radeon_fbdev *rfbdev,
                                                           sizes->surface_depth);
 
         ret = radeonfb_create_pinned_object(rfbdev, &mode_cmd, &gobj);
+        if (ret) {
+                DRM_ERROR("failed to create fbcon object %d\n", ret);
+                return ret;
+        }
+
         rbo = gem_to_radeon_bo(gobj);
 
         /* okay we have an object now allocate the framebuffer */
@@ -220,7 +225,11 @@ static int radeonfb_create(struct radeon_fbdev *rfbdev,
 
         info->par = rfbdev;
 
-        radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
+        ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
+        if (ret) {
+                DRM_ERROR("failed to initalise framebuffer %d\n", ret);
+                goto out_unref;
+        }
 
         fb = &rfbdev->rfb.base;
 
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 010dad8b66ae..c58a036233fb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -597,13 +597,13 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
         if (bo_va == NULL)
                 return 0;
 
-        list_del(&bo_va->bo_list);
         mutex_lock(&vm->mutex);
         radeon_mutex_lock(&rdev->cs_mutex);
         radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
         radeon_mutex_unlock(&rdev->cs_mutex);
         list_del(&bo_va->vm_list);
         mutex_unlock(&vm->mutex);
+        list_del(&bo_va->bo_list);
 
         kfree(bo_va);
         return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 4330e3253573..8a85598fb242 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -649,7 +649,7 @@ extern void radeon_crtc_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                      u16 blue, int regno);
 extern void radeon_crtc_fb_gamma_get(struct drm_crtc *crtc, u16 *red, u16 *green,
                                      u16 *blue, int regno);
-void radeon_framebuffer_init(struct drm_device *dev,
+int radeon_framebuffer_init(struct drm_device *dev,
                              struct radeon_framebuffer *rfb,
                              struct drm_mode_fb_cmd2 *mode_cmd,
                              struct drm_gem_object *obj);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b8574cddd953..63552e30d0c3 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -59,6 +59,9 @@
 #define USB_VENDOR_ID_AIRCABLE          0x16CA
 #define USB_DEVICE_ID_AIRCABLE1         0x1502
 
+#define USB_VENDOR_ID_AIREN             0x1a2c
+#define USB_DEVICE_ID_AIREN_SLIMPLUS    0x0002
+
 #define USB_VENDOR_ID_ALCOR             0x058f
 #define USB_DEVICE_ID_ALCOR_USBRS232    0x9720
 
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 9333d692a786..627850a54d34 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -986,8 +986,13 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
                 return;
         }
 
-        /* Ignore out-of-range values as per HID specification, section 5.10 */
-        if (value < field->logical_minimum || value > field->logical_maximum) {
+        /*
+         * Ignore out-of-range values as per HID specification,
+         * section 5.10 and 6.2.25
+         */
+        if ((field->flags & HID_MAIN_ITEM_VARIABLE) &&
+            (value < field->logical_minimum ||
+             value > field->logical_maximum)) {
                 dbg_hid("Ignoring out-of-range value %x\n", value);
                 return;
         }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index c831af937481..57d4e1e1df48 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -54,6 +54,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT },
 
+        { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 02260406b9e4..dad895fec62a 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -497,8 +497,9 @@ config SENSORS_JC42
           If you say yes here, you get support for JEDEC JC42.4 compliant
           temperature sensors, which are used on many DDR3 memory modules for
           mobile devices and servers.  Support will include, but not be limited
-          to, ADT7408, CAT34TS02, CAT6095, MAX6604, MCP9805, MCP98242, MCP98243,
-          MCP9843, SE97, SE98, STTS424(E), TSE2002B3, and TS3000B3.
+          to, ADT7408, AT30TS00, CAT34TS02, CAT6095, MAX6604, MCP9804, MCP9805,
+          MCP98242, MCP98243, MCP9843, SE97, SE98, STTS424(E), STTS2002,
+          STTS3000, TSE2002B3, TSE2002GB2, TS3000B3, and TS3000GB2.
 
           This driver can also be built as a module.  If so, the module
           will be called jc42.
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index 6bab2001ef3b..6aa5a9fad879 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -178,6 +178,16 @@ static inline void f75375_write16(struct i2c_client *client, u8 reg,
         i2c_smbus_write_byte_data(client, reg + 1, (value & 0xFF));
 }
 
+static void f75375_write_pwm(struct i2c_client *client, int nr)
+{
+        struct f75375_data *data = i2c_get_clientdata(client);
+        if (data->kind == f75387)
+                f75375_write16(client, F75375_REG_FAN_EXP(nr), data->pwm[nr]);
+        else
+                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
+                              data->pwm[nr]);
+}
+
 static struct f75375_data *f75375_update_device(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
@@ -254,6 +264,36 @@ static inline u16 rpm_to_reg(int rpm)
         return 1500000 / rpm;
 }
 
+static bool duty_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        case 2: /* Auto, speed mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        default:
+                BUG();
+        }
+}
+
+static bool auto_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        case 2: /* Auto, speed mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        default:
+                BUG();
+        }
+}
+
 static ssize_t set_fan_min(struct device *dev, struct device_attribute *attr,
                 const char *buf, size_t count)
 {
@@ -287,6 +327,11 @@ static ssize_t set_fan_target(struct device *dev, struct device_attribute *attr,
         if (err < 0)
                 return err;
 
+        if (auto_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+        if (data->kind == f75387 && duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+
         mutex_lock(&data->update_lock);
         data->fan_target[nr] = rpm_to_reg(val);
         f75375_write16(client, F75375_REG_FAN_EXP(nr), data->fan_target[nr]);
@@ -307,9 +352,13 @@ static ssize_t set_pwm(struct device *dev, struct device_attribute *attr,
         if (err < 0)
                 return err;
 
+        if (auto_mode_enabled(data->pwm_enable[nr]) ||
+            !duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+
         mutex_lock(&data->update_lock);
         data->pwm[nr] = SENSORS_LIMIT(val, 0, 255);
-        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr), data->pwm[nr]);
+        f75375_write_pwm(client, nr);
         mutex_unlock(&data->update_lock);
         return count;
 }
@@ -327,11 +376,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
         struct f75375_data *data = i2c_get_clientdata(client);
         u8 fanmode;
 
-        if (val < 0 || val > 3)
+        if (val < 0 || val > 4)
                 return -EINVAL;
 
         fanmode = f75375_read8(client, F75375_REG_FAN_TIMER);
         if (data->kind == f75387) {
+                /* For now, deny dangerous toggling of duty mode */
+                if (duty_mode_enabled(data->pwm_enable[nr]) !=
+                                duty_mode_enabled(val))
+                        return -EOPNOTSUPP;
                 /* clear each fanX_mode bit before setting them properly */
                 fanmode &= ~(1 << F75387_FAN_DUTY_MODE(nr));
                 fanmode &= ~(1 << F75387_FAN_MANU_MODE(nr));
@@ -345,12 +398,14 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                         fanmode  |= (1 << F75387_FAN_MANU_MODE(nr));
                         fanmode  |= (1 << F75387_FAN_DUTY_MODE(nr));
                         break;
-                case 2: /* AUTOMATIC*/
-                        fanmode  |=  (1 << F75387_FAN_DUTY_MODE(nr));
+                case 2: /* Automatic, speed mode */
                         break;
                 case 3: /* fan speed */
                         fanmode |= (1 << F75387_FAN_MANU_MODE(nr));
                         break;
+                case 4: /* Automatic, pwm */
+                        fanmode |= (1 << F75387_FAN_DUTY_MODE(nr));
+                        break;
                 }
         } else {
                 /* clear each fanX_mode bit before setting them properly */
@@ -368,14 +423,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                         break;
                 case 3: /* fan speed */
                         break;
+                case 4: /* Automatic pwm */
+                        return -EINVAL;
                 }
         }
 
         f75375_write8(client, F75375_REG_FAN_TIMER, fanmode);
         data->pwm_enable[nr] = val;
         if (val == 0)
-                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                                data->pwm[nr]);
+                f75375_write_pwm(client, nr);
         return 0;
 }
 
@@ -726,14 +782,17 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
 
                                 manu = ((mode >> F75387_FAN_MANU_MODE(nr)) & 1);
                                 duty = ((mode >> F75387_FAN_DUTY_MODE(nr)) & 1);
-                                if (manu && duty)
-                                        /* speed */
+                                if (!manu && duty)
+                                        /* auto, pwm */
+                                        data->pwm_enable[nr] = 4;
+                                else if (manu && !duty)
+                                        /* manual, speed */
                                         data->pwm_enable[nr] = 3;
-                                else if (!manu && duty)
-                                        /* automatic */
+                                else if (!manu && !duty)
+                                        /* automatic, speed */
                                         data->pwm_enable[nr] = 2;
                                 else
-                                        /* manual */
+                                        /* manual, pwm */
                                         data->pwm_enable[nr] = 1;
                         } else {
                                 if (!(conf & (1 << F75375_FAN_CTRL_LINEAR(nr))))
@@ -758,9 +817,11 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
         set_pwm_enable_direct(client, 0, f75375s_pdata->pwm_enable[0]);
         set_pwm_enable_direct(client, 1, f75375s_pdata->pwm_enable[1]);
         for (nr = 0; nr < 2; nr++) {
+                if (auto_mode_enabled(f75375s_pdata->pwm_enable[nr]) ||
+                    !duty_mode_enabled(f75375s_pdata->pwm_enable[nr]))
+                        continue;
                 data->pwm[nr] = SENSORS_LIMIT(f75375s_pdata->pwm[nr], 0, 255);
-                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                        data->pwm[nr]);
+                f75375_write_pwm(client, nr);
         }
 
 }
@@ -787,7 +848,7 @@ static int f75375_probe(struct i2c_client *client,
         if (err)
                 goto exit_free;
 
-        if (data->kind == f75375) {
+        if (data->kind != f75373) {
                 err = sysfs_chmod_file(&client->dev.kobj,
                         &sensor_dev_attr_pwm1_mode.dev_attr.attr,
                         S_IRUGO | S_IWUSR);
diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
index 28c09eead36b..b927ee5ccdd7 100644
--- a/drivers/hwmon/jc42.c
+++ b/drivers/hwmon/jc42.c
@@ -64,6 +64,7 @@ static const unsigned short normal_i2c[] = {
 
 /* Manufacturer IDs */
 #define ADT_MANID               0x11d4  /* Analog Devices */
+#define ATMEL_MANID             0x001f  /* Atmel */
 #define MAX_MANID               0x004d  /* Maxim */
 #define IDT_MANID               0x00b3  /* IDT */
 #define MCP_MANID               0x0054  /* Microchip */
@@ -77,15 +78,25 @@ static const unsigned short normal_i2c[] = {
 #define ADT7408_DEVID           0x0801
 #define ADT7408_DEVID_MASK      0xffff
 
+/* Atmel */
+#define AT30TS00_DEVID          0x8201
+#define AT30TS00_DEVID_MASK     0xffff
+
 /* IDT */
 #define TS3000B3_DEVID          0x2903  /* Also matches TSE2002B3 */
 #define TS3000B3_DEVID_MASK     0xffff
 
+#define TS3000GB2_DEVID         0x2912  /* Also matches TSE2002GB2 */
+#define TS3000GB2_DEVID_MASK    0xffff
+
 /* Maxim */
 #define MAX6604_DEVID           0x3e00
 #define MAX6604_DEVID_MASK      0xffff
 
 /* Microchip */
+#define MCP9804_DEVID           0x0200
+#define MCP9804_DEVID_MASK      0xfffc
+
 #define MCP98242_DEVID          0x2000
 #define MCP98242_DEVID_MASK     0xfffc
 
@@ -113,6 +124,12 @@ static const unsigned short normal_i2c[] = {
 #define STTS424E_DEVID          0x0000
 #define STTS424E_DEVID_MASK     0xfffe
 
+#define STTS2002_DEVID          0x0300
+#define STTS2002_DEVID_MASK     0xffff
+
+#define STTS3000_DEVID          0x0200
+#define STTS3000_DEVID_MASK     0xffff
+
 static u16 jc42_hysteresis[] = { 0, 1500, 3000, 6000 };
 
 struct jc42_chips {
@@ -123,8 +140,11 @@ struct jc42_chips {
 
 static struct jc42_chips jc42_chips[] = {
         { ADT_MANID, ADT7408_DEVID, ADT7408_DEVID_MASK },
+        { ATMEL_MANID, AT30TS00_DEVID, AT30TS00_DEVID_MASK },
         { IDT_MANID, TS3000B3_DEVID, TS3000B3_DEVID_MASK },
+        { IDT_MANID, TS3000GB2_DEVID, TS3000GB2_DEVID_MASK },
         { MAX_MANID, MAX6604_DEVID, MAX6604_DEVID_MASK },
+        { MCP_MANID, MCP9804_DEVID, MCP9804_DEVID_MASK },
         { MCP_MANID, MCP98242_DEVID, MCP98242_DEVID_MASK },
         { MCP_MANID, MCP98243_DEVID, MCP98243_DEVID_MASK },
         { MCP_MANID, MCP9843_DEVID, MCP9843_DEVID_MASK },
@@ -133,6 +153,8 @@ static struct jc42_chips jc42_chips[] = {
         { NXP_MANID, SE98_DEVID, SE98_DEVID_MASK },
         { STM_MANID, STTS424_DEVID, STTS424_DEVID_MASK },
         { STM_MANID, STTS424E_DEVID, STTS424E_DEVID_MASK },
+        { STM_MANID, STTS2002_DEVID, STTS2002_DEVID_MASK },
+        { STM_MANID, STTS3000_DEVID, STTS3000_DEVID_MASK },
 };
 
 /* Each client has this additional data */
@@ -159,10 +181,12 @@ static struct jc42_data *jc42_update_device(struct device *dev);
 
 static const struct i2c_device_id jc42_id[] = {
         { "adt7408", 0 },
+        { "at30ts00", 0 },
         { "cat94ts02", 0 },
         { "cat6095", 0 },
         { "jc42", 0 },
         { "max6604", 0 },
+        { "mcp9804", 0 },
         { "mcp9805", 0 },
         { "mcp98242", 0 },
         { "mcp98243", 0 },
@@ -171,8 +195,10 @@ static const struct i2c_device_id jc42_id[] = {
         { "se97b", 0 },
         { "se98", 0 },
         { "stts424", 0 },
-        { "tse2002b3", 0 },
-        { "ts3000b3", 0 },
+        { "stts2002", 0 },
+        { "stts3000", 0 },
+        { "tse2002", 0 },
+        { "ts3000", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, jc42_id);
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 00460d8d8423..d89b33967a85 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -54,7 +54,8 @@
                                                    lcrit_alarm, crit_alarm */
 #define PMBUS_IOUT_BOOLEANS_PER_PAGE    3       /* alarm, lcrit_alarm,
                                                    crit_alarm */
-#define PMBUS_POUT_BOOLEANS_PER_PAGE    2       /* alarm, crit_alarm */
+#define PMBUS_POUT_BOOLEANS_PER_PAGE    3       /* cap_alarm, alarm, crit_alarm
+                                                 */
 #define PMBUS_MAX_BOOLEANS_PER_FAN      2       /* alarm, fault */
 #define PMBUS_MAX_BOOLEANS_PER_TEMP     4       /* min_alarm, max_alarm,
                                                    lcrit_alarm, crit_alarm */
diff --git a/drivers/hwmon/pmbus/zl6100.c b/drivers/hwmon/pmbus/zl6100.c
index 48c7b4a716ae..e3e8420b7b81 100644
--- a/drivers/hwmon/pmbus/zl6100.c
+++ b/drivers/hwmon/pmbus/zl6100.c
@@ -33,6 +33,7 @@ enum chips { zl2004, zl2005, zl2006, zl2008, zl2105, zl2106, zl6100, zl6105 };
 struct zl6100_data {
         int id;
         ktime_t access;         /* chip access time */
+        int delay;              /* Delay between chip accesses in uS */
         struct pmbus_driver_info info;
 };
 
@@ -52,10 +53,10 @@ MODULE_PARM_DESC(delay, "Delay between chip accesses in uS");
 /* Some chips need a delay between accesses */
 static inline void zl6100_wait(const struct zl6100_data *data)
 {
-        if (delay) {
+        if (data->delay) {
                 s64 delta = ktime_us_delta(ktime_get(), data->access);
-                if (delta < delay)
-                        udelay(delay - delta);
+                if (delta < data->delay)
+                        udelay(data->delay - delta);
         }
 }
 
@@ -199,16 +200,11 @@ static int zl6100_probe(struct i2c_client *client,
         data->id = mid->driver_data;
 
         /*
-         * ZL2005, ZL2008, ZL2105, and ZL6100 are known to require a wait time
-         * between I2C accesses. ZL2004 and ZL6105 are known to be safe.
-         * Other chips have not yet been tested.
-         *
-         * Only clear the wait time for chips known to be safe. The wait time
-         * can be cleared later for additional chips if tests show that it
-         * is not needed (in other words, better be safe than sorry).
+         * According to information from the chip vendor, all currently
+         * supported chips are known to require a wait time between I2C
+         * accesses.
          */
-        if (data->id == zl2004 || data->id == zl6105)
-                delay = 0;
+        data->delay = delay;
 
         /*
          * Since there was a direct I2C device access above, wait before
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index 5276d1933dbc..a658d62c5e10 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -39,7 +39,7 @@
                                                0x8860 0xa1
     w83627dhg    9      5       4       3      0xa020 0xc1    0x5ca3
     w83627dhg-p  9      5       4       3      0xb070 0xc1    0x5ca3
-    w83627uhg    8      2       2       2      0xa230 0xc1    0x5ca3
+    w83627uhg    8      2       2       3      0xa230 0xc1    0x5ca3
     w83667hg     9      5       3       3      0xa510 0xc1    0x5ca3
     w83667hg-b   9      5       3       4      0xb350 0xc1    0x5ca3
     nct6775f     9      4       3       9      0xb470 0xc1    0x5ca3
@@ -1607,7 +1607,7 @@ store_##reg(struct device *dev, struct device_attribute *attr, \
         val = step_time_to_reg(val, data->pwm_mode[nr]); \
         mutex_lock(&data->update_lock); \
         data->reg[nr] = val; \
-        w83627ehf_write_value(data, W83627EHF_REG_##REG[nr], val); \
+        w83627ehf_write_value(data, data->REG_##REG[nr], val); \
         mutex_unlock(&data->update_lock); \
         return count; \
 } \
@@ -2004,7 +2004,8 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
                 goto exit;
         }
 
-        data = kzalloc(sizeof(struct w83627ehf_data), GFP_KERNEL);
+        data = devm_kzalloc(&pdev->dev, sizeof(struct w83627ehf_data),
+                            GFP_KERNEL);
         if (!data) {
                 err = -ENOMEM;
                 goto exit_release;
@@ -2157,16 +2158,16 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
                 w83627ehf_set_temp_reg_ehf(data, 3);
 
                 /*
-                 * Temperature sources for temp1 and temp2 are selected with
+                 * Temperature sources for temp2 and temp3 are selected with
                  * bank 0, registers 0x49 and 0x4a.
                  */
                 data->temp_src[0] = 0;  /* SYSTIN */
                 reg = w83627ehf_read_value(data, 0x49) & 0x07;
                 /* Adjust to have the same mapping as other source registers */
                 if (reg == 0)
-                        data->temp_src[1]++;
+                        data->temp_src[1] = 1;
                 else if (reg >= 2 && reg <= 5)
-                        data->temp_src[1] += 2;
+                        data->temp_src[1] = reg + 2;
                 else    /* should never happen */
                         data->have_temp &= ~(1 << 1);
                 reg = w83627ehf_read_value(data, 0x4a);
@@ -2493,9 +2494,8 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
 
 exit_remove:
         w83627ehf_device_remove_files(dev);
-        kfree(data);
-        platform_set_drvdata(pdev, NULL);
 exit_release:
+        platform_set_drvdata(pdev, NULL);
         release_region(res->start, IOREGION_LENGTH);
 exit:
         return err;
@@ -2509,7 +2509,6 @@ static int __devexit w83627ehf_remove(struct platform_device *pdev)
         w83627ehf_device_remove_files(&pdev->dev);
         release_region(data->addr, IOREGION_LENGTH);
         platform_set_drvdata(pdev, NULL);
-        kfree(data);
 
         return 0;
 }
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 525c7345fa0b..24f94f4ae395 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -103,8 +103,14 @@ static int sclhi(struct i2c_algo_bit_data *adap)
                  * chips may hold it low ("clock stretching") while they
                  * are processing data internally.
                  */
-                if (time_after(jiffies, start + adap->timeout))
+                if (time_after(jiffies, start + adap->timeout)) {
+                        /* Test one last time, as we may have been preempted
+                         * between last check and timeout test.
+                         */
+                        if (getscl(adap))
+                                break;
                         return -ETIMEDOUT;
+                }
                 cond_resched();
         }
 #ifdef DEBUG
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 7e78f7c87857..3d471d56bf15 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -72,6 +72,7 @@
 
 #define MXS_I2C_QUEUESTAT       (0x70)
 #define MXS_I2C_QUEUESTAT_RD_QUEUE_EMPTY        0x00002000
+#define MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK  0x0000001F
 
 #define MXS_I2C_QUEUECMD        (0x80)
 
@@ -219,14 +220,14 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
         int ret;
         int flags;
 
-        init_completion(&i2c->cmd_complete);
-
         dev_dbg(i2c->dev, "addr: 0x%04x, len: %d, flags: 0x%x, stop: %d\n",
                 msg->addr, msg->len, msg->flags, stop);
 
         if (msg->len == 0)
                 return -EINVAL;
 
+        init_completion(&i2c->cmd_complete);
+
         flags = stop ? MXS_I2C_CTRL0_POST_SEND_STOP : 0;
 
         if (msg->flags & I2C_M_RD)
@@ -286,6 +287,7 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
 {
         struct mxs_i2c_dev *i2c = dev_id;
         u32 stat = readl(i2c->regs + MXS_I2C_CTRL1) & MXS_I2C_IRQ_MASK;
+        bool is_last_cmd;
 
         if (!stat)
                 return IRQ_NONE;
@@ -300,9 +302,14 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
         else
                 i2c->cmd_err = 0;
 
-        complete(&i2c->cmd_complete);
+        is_last_cmd = (readl(i2c->regs + MXS_I2C_QUEUESTAT) &
+                MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK) == 0;
+
+        if (is_last_cmd || i2c->cmd_err)
+                complete(&i2c->cmd_complete);
 
         writel(stat, i2c->regs + MXS_I2C_CTRL1_CLR);
+
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 1e5606185b4f..e9c18939eda7 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1386,8 +1386,10 @@ int i2c_master_send(const struct i2c_client *client, const char *buf, int count)
 
         ret = i2c_transfer(adap, &msg, 1);
 
-        /* If everything went ok (i.e. 1 msg transmitted), return #bytes
-           transmitted, else error code. */
+        /*
+         * If everything went ok (i.e. 1 msg transmitted), return #bytes
+         * transmitted, else error code.
+         */
         return (ret == 1) ? count : ret;
 }
 EXPORT_SYMBOL(i2c_master_send);
@@ -1414,8 +1416,10 @@ int i2c_master_recv(const struct i2c_client *client, char *buf, int count)
 
         ret = i2c_transfer(adap, &msg, 1);
 
-        /* If everything went ok (i.e. 1 msg transmitted), return #bytes
-           transmitted, else error code. */
+        /*
+         * If everything went ok (i.e. 1 msg received), return #bytes received,
+         * else error code.
+         */
         return (ret == 1) ? count : ret;
 }
 EXPORT_SYMBOL(i2c_master_recv);
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index afc166fcc3d9..7df5bfef2624 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -332,7 +332,7 @@ static ssize_t evdev_write(struct file *file, const char __user *buffer,
         struct evdev_client *client = file->private_data;
         struct evdev *evdev = client->evdev;
         struct input_event event;
-        int retval;
+        int retval = 0;
 
         if (count < input_event_size())
                 return -EINVAL;
diff --git a/drivers/input/misc/twl4030-vibra.c b/drivers/input/misc/twl4030-vibra.c
index 37651373a95b..f3bc4189a7ba 100644
--- a/drivers/input/misc/twl4030-vibra.c
+++ b/drivers/input/misc/twl4030-vibra.c
@@ -172,7 +172,7 @@ static void twl4030_vibra_close(struct input_dev *input)
 }
 
 /*** Module ***/
-#if CONFIG_PM
+#if CONFIG_PM_SLEEP
 static int twl4030_vibra_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -189,10 +189,10 @@ static int twl4030_vibra_resume(struct device *dev)
         vibra_disable_leds();
         return 0;
 }
+#endif
 
 static SIMPLE_DEV_PM_OPS(twl4030_vibra_pm_ops,
                          twl4030_vibra_suspend, twl4030_vibra_resume);
-#endif
 
 static int __devinit twl4030_vibra_probe(struct platform_device *pdev)
 {
@@ -273,9 +273,7 @@ static struct platform_driver twl4030_vibra_driver = {
         .driver         = {
                 .name   = "twl4030-vibra",
                 .owner  = THIS_MODULE,
-#ifdef CONFIG_PM
                 .pm     = &twl4030_vibra_pm_ops,
-#endif
         },
 };
 module_platform_driver(twl4030_vibra_driver);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index bd87380bd879..4c6a72d3d48c 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -952,7 +952,9 @@ static const struct alps_model_info *alps_get_model(struct psmouse *psmouse, int
 
         /*
          * First try "E6 report".
-         * ALPS should return 0,0,10 or 0,0,100
+         * ALPS should return 0,0,10 or 0,0,100 if no buttons are pressed.
+         * The bits 0-2 of the first byte will be 1s if some buttons are
+         * pressed.
          */
         param[0] = 0;
         if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES) ||
@@ -968,7 +970,8 @@ static const struct alps_model_info *alps_get_model(struct psmouse *psmouse, int
         psmouse_dbg(psmouse, "E6 report: %2.2x %2.2x %2.2x",
                     param[0], param[1], param[2]);
 
-        if (param[0] != 0 || param[1] != 0 || (param[2] != 10 && param[2] != 100))
+        if ((param[0] & 0xf8) != 0 || param[1] != 0 ||
+            (param[2] != 10 && param[2] != 100))
                 return NULL;
 
         /*
diff --git a/drivers/input/tablet/Kconfig b/drivers/input/tablet/Kconfig
index 58a87755b936..e53f4081a586 100644
--- a/drivers/input/tablet/Kconfig
+++ b/drivers/input/tablet/Kconfig
@@ -77,6 +77,8 @@ config TABLET_USB_WACOM
         tristate "Wacom Intuos/Graphire tablet support (USB)"
         depends on USB_ARCH_HAS_HCD
         select USB
+        select NEW_LEDS
+        select LEDS_CLASS
         help
           Say Y here if you want to use the USB version of the Wacom Intuos
           or Graphire tablet.  Make sure to say Y to "Mouse support"
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 88672ec296c1..cd3ed29e0801 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -926,7 +926,7 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
 {
         struct input_dev *input = wacom->input;
         unsigned char *data = wacom->data;
-        int count = data[1] & 0x03;
+        int count = data[1] & 0x07;
         int i;
 
         if (data[0] != 0x02)
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 6bea6962f8ee..3bd9fff5c589 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -142,4 +142,24 @@ config OMAP_IOMMU_DEBUG
 
          Say N unless you know you need this.
 
+config TEGRA_IOMMU_GART
+        bool "Tegra GART IOMMU Support"
+        depends on ARCH_TEGRA_2x_SOC
+        select IOMMU_API
+        help
+          Enables support for remapping discontiguous physical memory
+          shared with the operating system into contiguous I/O virtual
+          space through the GART (Graphics Address Relocation Table)
+          hardware included on Tegra SoCs.
+
+config TEGRA_IOMMU_SMMU
+        bool "Tegra SMMU IOMMU Support"
+        depends on ARCH_TEGRA_3x_SOC
+        select IOMMU_API
+        help
+          Enables support for remapping discontiguous physical memory
+          shared with the operating system into contiguous I/O virtual
+          space through the SMMU (System Memory Management Unit)
+          hardware included on Tegra SoCs.
+
 endif # IOMMU_SUPPORT
diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
index 0e36b4934aff..7ad7a3bc1242 100644
--- a/drivers/iommu/Makefile
+++ b/drivers/iommu/Makefile
@@ -8,3 +8,5 @@ obj-$(CONFIG_IRQ_REMAP) += intr_remapping.o
 obj-$(CONFIG_OMAP_IOMMU) += omap-iommu.o
 obj-$(CONFIG_OMAP_IOVMM) += omap-iovmm.o
 obj-$(CONFIG_OMAP_IOMMU_DEBUG) += omap-iommu-debug.o
+obj-$(CONFIG_TEGRA_IOMMU_GART) += tegra-gart.o
+obj-$(CONFIG_TEGRA_IOMMU_SMMU) += tegra-smmu.o
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index a051f9a88bd2..c56790375e0f 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -277,7 +277,7 @@ static void iommu_set_exclusion_range(struct amd_iommu *iommu)
 }
 
 /* Programs the physical address of the device table into the IOMMU hardware */
-static void __init iommu_set_device_table(struct amd_iommu *iommu)
+static void iommu_set_device_table(struct amd_iommu *iommu)
 {
         u64 entry;
 
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index 288da5c1499d..103dbd92e256 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -44,7 +44,8 @@ static ssize_t debug_read_ver(struct file *file, char __user *userbuf,
 static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         ssize_t bytes;
 
@@ -67,7 +68,8 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
 static ssize_t debug_read_tlb(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         ssize_t bytes, rest;
 
@@ -97,7 +99,8 @@ static ssize_t debug_write_pagetable(struct file *file,
         struct iotlb_entry e;
         struct cr_regs cr;
         int err;
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char buf[MAXCOLUMN], *p = buf;
 
         count = min(count, sizeof(buf));
@@ -184,7 +187,8 @@ out:
 static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
                                     size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         size_t bytes;
 
@@ -212,7 +216,8 @@ static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
 static ssize_t debug_read_mmap(struct file *file, char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         struct iovm_struct *tmp;
         int uninitialized_var(i);
@@ -254,7 +259,7 @@ static ssize_t debug_read_mmap(struct file *file, char __user *userbuf,
 static ssize_t debug_read_mem(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
         char *p, *buf;
         struct iovm_struct *area;
         ssize_t bytes;
@@ -268,8 +273,8 @@ static ssize_t debug_read_mem(struct file *file, char __user *userbuf,
 
         mutex_lock(&iommu_debug_lock);
 
-        area = omap_find_iovm_area(obj, (u32)ppos);
-        if (IS_ERR(area)) {
+        area = omap_find_iovm_area(dev, (u32)ppos);
+        if (!area) {
                 bytes = -EINVAL;
                 goto err_out;
         }
@@ -287,7 +292,7 @@ err_out:
 static ssize_t debug_write_mem(struct file *file, const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
         struct iovm_struct *area;
         char *p, *buf;
 
@@ -305,8 +310,8 @@ static ssize_t debug_write_mem(struct file *file, const char __user *userbuf,
                 goto err_out;
         }
 
-        area = omap_find_iovm_area(obj, (u32)ppos);
-        if (IS_ERR(area)) {
+        area = omap_find_iovm_area(dev, (u32)ppos);
+        if (!area) {
                 count = -EINVAL;
                 goto err_out;
         }
@@ -350,7 +355,7 @@ DEBUG_FOPS(mem);
         {                                                               \
                 struct dentry *dent;                                    \
                 dent = debugfs_create_file(#attr, mode, parent,         \
-                                           obj, &debug_##attr##_fops);  \
+                                           dev, &debug_##attr##_fops);  \
                 if (!dent)                                              \
                         return -ENOMEM;                                 \
         }
@@ -362,20 +367,29 @@ static int iommu_debug_register(struct device *dev, void *data)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct omap_iommu *obj = platform_get_drvdata(pdev);
+        struct omap_iommu_arch_data *arch_data;
         struct dentry *d, *parent;
 
         if (!obj || !obj->dev)
                 return -EINVAL;
 
+        arch_data = kzalloc(sizeof(*arch_data), GFP_KERNEL);
+        if (!arch_data)
+                return -ENOMEM;
+
+        arch_data->iommu_dev = obj;
+
+        dev->archdata.iommu = arch_data;
+
         d = debugfs_create_dir(obj->name, iommu_debug_root);
         if (!d)
-                return -ENOMEM;
+                goto nomem;
         parent = d;
 
         d = debugfs_create_u8("nr_tlb_entries", 400, parent,
                               (u8 *)&obj->nr_tlb_entries);
         if (!d)
-                return -ENOMEM;
+                goto nomem;
 
         DEBUG_ADD_FILE_RO(ver);
         DEBUG_ADD_FILE_RO(regs);
@@ -385,6 +399,22 @@ static int iommu_debug_register(struct device *dev, void *data)
         DEBUG_ADD_FILE(mem);
 
         return 0;
+
+nomem:
+        kfree(arch_data);
+        return -ENOMEM;
+}
+
+static int iommu_debug_unregister(struct device *dev, void *data)
+{
+        if (!dev->archdata.iommu)
+                return 0;
+
+        kfree(dev->archdata.iommu);
+
+        dev->archdata.iommu = NULL;
+
+        return 0;
 }
 
 static int __init iommu_debug_init(void)
@@ -411,6 +441,7 @@ module_init(iommu_debug_init)
 static void __exit iommu_debugfs_exit(void)
 {
         debugfs_remove_recursive(iommu_debug_root);
+        omap_foreach_iommu_device(NULL, iommu_debug_unregister);
 }
 module_exit(iommu_debugfs_exit)
 
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index d8edd979d01b..6899dcd02dfa 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1223,7 +1223,8 @@ static int __init omap_iommu_init(void)
 
         return platform_driver_register(&omap_iommu_driver);
 }
-module_init(omap_iommu_init);
+/* must be ready before omap3isp is probed */
+subsys_initcall(omap_iommu_init);
 
 static void __exit omap_iommu_exit(void)
 {
diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
new file mode 100644
index 000000000000..779306ee7b16
--- /dev/null
+++ b/drivers/iommu/tegra-gart.c
@@ -0,0 +1,451 @@
+/*
+ * IOMMU API for GART in Tegra20
+ *
+ * Copyright (c) 2010-2012, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#define pr_fmt(fmt)     "%s(): " fmt, __func__
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/mm.h>
+#include <linux/list.h>
+#include <linux/device.h>
+#include <linux/io.h>
+#include <linux/iommu.h>
+
+#include <asm/cacheflush.h>
+
+/* bitmap of the page sizes currently supported */
+#define GART_IOMMU_PGSIZES      (SZ_4K)
+
+#define GART_CONFIG             0x24
+#define GART_ENTRY_ADDR         0x28
+#define GART_ENTRY_DATA         0x2c
+#define GART_ENTRY_PHYS_ADDR_VALID      (1 << 31)
+
+#define GART_PAGE_SHIFT         12
+#define GART_PAGE_SIZE          (1 << GART_PAGE_SHIFT)
+#define GART_PAGE_MASK                                          \
+        (~(GART_PAGE_SIZE - 1) & ~GART_ENTRY_PHYS_ADDR_VALID)
+
+struct gart_client {
+        struct device           *dev;
+        struct list_head        list;
+};
+
+struct gart_device {
+        void __iomem            *regs;
+        u32                     *savedata;
+        u32                     page_count;     /* total remappable size */
+        dma_addr_t              iovmm_base;     /* offset to vmm_area */
+        spinlock_t              pte_lock;       /* for pagetable */
+        struct list_head        client;
+        spinlock_t              client_lock;    /* for client list */
+        struct device           *dev;
+};
+
+static struct gart_device *gart_handle; /* unique for a system */
+
+#define GART_PTE(_pfn)                                          \
+        (GART_ENTRY_PHYS_ADDR_VALID | ((_pfn) << PAGE_SHIFT))
+
+/*
+ * Any interaction between any block on PPSB and a block on APB or AHB
+ * must have these read-back to ensure the APB/AHB bus transaction is
+ * complete before initiating activity on the PPSB block.
+ */
+#define FLUSH_GART_REGS(gart)   ((void)readl((gart)->regs + GART_CONFIG))
+
+#define for_each_gart_pte(gart, iova)                                   \
+        for (iova = gart->iovmm_base;                                   \
+             iova < gart->iovmm_base + GART_PAGE_SIZE * gart->page_count; \
+             iova += GART_PAGE_SIZE)
+
+static inline void gart_set_pte(struct gart_device *gart,
+                                unsigned long offs, u32 pte)
+{
+        writel(offs, gart->regs + GART_ENTRY_ADDR);
+        writel(pte, gart->regs + GART_ENTRY_DATA);
+
+        dev_dbg(gart->dev, "%s %08lx:%08x\n",
+                 pte ? "map" : "unmap", offs, pte & GART_PAGE_MASK);
+}
+
+static inline unsigned long gart_read_pte(struct gart_device *gart,
+                                          unsigned long offs)
+{
+        unsigned long pte;
+
+        writel(offs, gart->regs + GART_ENTRY_ADDR);
+        pte = readl(gart->regs + GART_ENTRY_DATA);
+
+        return pte;
+}
+
+static void do_gart_setup(struct gart_device *gart, const u32 *data)
+{
+        unsigned long iova;
+
+        for_each_gart_pte(gart, iova)
+                gart_set_pte(gart, iova, data ? *(data++) : 0);
+
+        writel(1, gart->regs + GART_CONFIG);
+        FLUSH_GART_REGS(gart);
+}
+
+#ifdef DEBUG
+static void gart_dump_table(struct gart_device *gart)
+{
+        unsigned long iova;
+        unsigned long flags;
+
+        spin_lock_irqsave(&gart->pte_lock, flags);
+        for_each_gart_pte(gart, iova) {
+                unsigned long pte;
+
+                pte = gart_read_pte(gart, iova);
+
+                dev_dbg(gart->dev, "%s %08lx:%08lx\n",
+                        (GART_ENTRY_PHYS_ADDR_VALID & pte) ? "v" : " ",
+                        iova, pte & GART_PAGE_MASK);
+        }
+        spin_unlock_irqrestore(&gart->pte_lock, flags);
+}
+#else
+static inline void gart_dump_table(struct gart_device *gart)
+{
+}
+#endif
+
+static inline bool gart_iova_range_valid(struct gart_device *gart,
+                                         unsigned long iova, size_t bytes)
+{
+        unsigned long iova_start, iova_end, gart_start, gart_end;
+
+        iova_start = iova;
+        iova_end = iova_start + bytes - 1;
+        gart_start = gart->iovmm_base;
+        gart_end = gart_start + gart->page_count * GART_PAGE_SIZE - 1;
+
+        if (iova_start < gart_start)
+                return false;
+        if (iova_end > gart_end)
+                return false;
+        return true;
+}
+
+static int gart_iommu_attach_dev(struct iommu_domain *domain,
+                                 struct device *dev)
+{
+        struct gart_device *gart;
+        struct gart_client *client, *c;
+        int err = 0;
+
+        gart = dev_get_drvdata(dev->parent);
+        if (!gart)
+                return -EINVAL;
+        domain->priv = gart;
+
+        client = devm_kzalloc(gart->dev, sizeof(*c), GFP_KERNEL);
+        if (!client)
+                return -ENOMEM;
+        client->dev = dev;
+
+        spin_lock(&gart->client_lock);
+        list_for_each_entry(c, &gart->client, list) {
+                if (c->dev == dev) {
+                        dev_err(gart->dev,
+                                "%s is already attached\n", dev_name(dev));
+                        err = -EINVAL;
+                        goto fail;
+                }
+        }
+        list_add(&client->list, &gart->client);
+        spin_unlock(&gart->client_lock);
+        dev_dbg(gart->dev, "Attached %s\n", dev_name(dev));
+        return 0;
+
+fail:
+        devm_kfree(gart->dev, client);
+        spin_unlock(&gart->client_lock);
+        return err;
+}
+
+static void gart_iommu_detach_dev(struct iommu_domain *domain,
+                                  struct device *dev)
+{
+        struct gart_device *gart = domain->priv;
+        struct gart_client *c;
+
+        spin_lock(&gart->client_lock);
+
+        list_for_each_entry(c, &gart->client, list) {
+                if (c->dev == dev) {
+                        list_del(&c->list);
+                        devm_kfree(gart->dev, c);
+                        dev_dbg(gart->dev, "Detached %s\n", dev_name(dev));
+                        goto out;
+                }
+        }
+        dev_err(gart->dev, "Couldn't find\n");
+out:
+        spin_unlock(&gart->client_lock);
+}
+
+static int gart_iommu_domain_init(struct iommu_domain *domain)
+{
+        return 0;
+}
+
+static void gart_iommu_domain_destroy(struct iommu_domain *domain)
+{
+        struct gart_device *gart = domain->priv;
+
+        if (!gart)
+                return;
+
+        spin_lock(&gart->client_lock);
+        if (!list_empty(&gart->client)) {
+                struct gart_client *c;
+
+                list_for_each_entry(c, &gart->client, list)
+                        gart_iommu_detach_dev(domain, c->dev);
+        }
+        spin_unlock(&gart->client_lock);
+        domain->priv = NULL;
+}
+
+static int gart_iommu_map(struct iommu_domain *domain, unsigned long iova,
+                          phys_addr_t pa, size_t bytes, int prot)
+{
+        struct gart_device *gart = domain->priv;
+        unsigned long flags;
+        unsigned long pfn;
+
+        if (!gart_iova_range_valid(gart, iova, bytes))
+                return -EINVAL;
+
+        spin_lock_irqsave(&gart->pte_lock, flags);
+        pfn = __phys_to_pfn(pa);
+        if (!pfn_valid(pfn)) {
+                dev_err(gart->dev, "Invalid page: %08x\n", pa);
+                spin_unlock_irqrestore(&gart->pte_lock, flags);
+                return -EINVAL;
+        }
+        gart_set_pte(gart, iova, GART_PTE(pfn));
+        FLUSH_GART_REGS(gart);
+        spin_unlock_irqrestore(&gart->pte_lock, flags);
+        return 0;
+}
+
+static size_t gart_iommu_unmap(struct iommu_domain *domain, unsigned long iova,
+                               size_t bytes)
+{
+        struct gart_device *gart = domain->priv;
+        unsigned long flags;
+
+        if (!gart_iova_range_valid(gart, iova, bytes))
+                return 0;
+
+        spin_lock_irqsave(&gart->pte_lock, flags);
+        gart_set_pte(gart, iova, 0);
+        FLUSH_GART_REGS(gart);
+        spin_unlock_irqrestore(&gart->pte_lock, flags);
+        return 0;
+}
+
+static phys_addr_t gart_iommu_iova_to_phys(struct iommu_domain *domain,
+                                           unsigned long iova)
+{
+        struct gart_device *gart = domain->priv;
+        unsigned long pte;
+        phys_addr_t pa;
+        unsigned long flags;
+
+        if (!gart_iova_range_valid(gart, iova, 0))
+                return -EINVAL;
+
+        spin_lock_irqsave(&gart->pte_lock, flags);
+        pte = gart_read_pte(gart, iova);
+        spin_unlock_irqrestore(&gart->pte_lock, flags);
+
+        pa = (pte & GART_PAGE_MASK);
+        if (!pfn_valid(__phys_to_pfn(pa))) {
+                dev_err(gart->dev, "No entry for %08lx:%08x\n", iova, pa);
+                gart_dump_table(gart);
+                return -EINVAL;
+        }
+        return pa;
+}
+
+static int gart_iommu_domain_has_cap(struct iommu_domain *domain,
+                                     unsigned long cap)
+{
+        return 0;
+}
+
+static struct iommu_ops gart_iommu_ops = {
+        .domain_init    = gart_iommu_domain_init,
+        .domain_destroy = gart_iommu_domain_destroy,
+        .attach_dev     = gart_iommu_attach_dev,
+        .detach_dev     = gart_iommu_detach_dev,
+        .map            = gart_iommu_map,
+        .unmap          = gart_iommu_unmap,
+        .iova_to_phys   = gart_iommu_iova_to_phys,
+        .domain_has_cap = gart_iommu_domain_has_cap,
+        .pgsize_bitmap  = GART_IOMMU_PGSIZES,
+};
+
+static int tegra_gart_suspend(struct device *dev)
+{
+        struct gart_device *gart = dev_get_drvdata(dev);
+        unsigned long iova;
+        u32 *data = gart->savedata;
+        unsigned long flags;
+
+        spin_lock_irqsave(&gart->pte_lock, flags);
+        for_each_gart_pte(gart, iova)
+                *(data++) = gart_read_pte(gart, iova);
+        spin_unlock_irqrestore(&gart->pte_lock, flags);
+        return 0;
+}
+
+static int tegra_gart_resume(struct device *dev)
+{
+        struct gart_device *gart = dev_get_drvdata(dev);
+        unsigned long flags;
+
+        spin_lock_irqsave(&gart->pte_lock, flags);
+        do_gart_setup(gart, gart->savedata);
+        spin_unlock_irqrestore(&gart->pte_lock, flags);
+        return 0;
+}
+
+static int tegra_gart_probe(struct platform_device *pdev)
+{
+        struct gart_device *gart;
+        struct resource *res, *res_remap;
+        void __iomem *gart_regs;
+        int err;
+        struct device *dev = &pdev->dev;
+
+        if (gart_handle)
+                return -EIO;
+
+        BUILD_BUG_ON(PAGE_SHIFT != GART_PAGE_SHIFT);
+
+        /* the GART memory aperture is required */
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        res_remap = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        if (!res || !res_remap) {
+                dev_err(dev, "GART memory aperture expected\n");
+                return -ENXIO;
+        }
+
+        gart = devm_kzalloc(dev, sizeof(*gart), GFP_KERNEL);
+        if (!gart) {
+                dev_err(dev, "failed to allocate gart_device\n");
+                return -ENOMEM;
+        }
+
+        gart_regs = devm_ioremap(dev, res->start, resource_size(res));
+        if (!gart_regs) {
+                dev_err(dev, "failed to remap GART registers\n");
+                err = -ENXIO;
+                goto fail;
+        }
+
+        gart->dev = &pdev->dev;
+        spin_lock_init(&gart->pte_lock);
+        spin_lock_init(&gart->client_lock);
+        INIT_LIST_HEAD(&gart->client);
+        gart->regs = gart_regs;
+        gart->iovmm_base = (dma_addr_t)res_remap->start;
+        gart->page_count = (resource_size(res_remap) >> GART_PAGE_SHIFT);
+
+        gart->savedata = vmalloc(sizeof(u32) * gart->page_count);
+        if (!gart->savedata) {
+                dev_err(dev, "failed to allocate context save area\n");
+                err = -ENOMEM;
+                goto fail;
+        }
+
+        platform_set_drvdata(pdev, gart);
+        do_gart_setup(gart, NULL);
+
+        gart_handle = gart;
+        return 0;
+
+fail:
+        if (gart_regs)
+                devm_iounmap(dev, gart_regs);
+        if (gart && gart->savedata)
+                vfree(gart->savedata);
+        devm_kfree(dev, gart);
+        return err;
+}
+
+static int tegra_gart_remove(struct platform_device *pdev)
+{
+        struct gart_device *gart = platform_get_drvdata(pdev);
+        struct device *dev = gart->dev;
+
+        writel(0, gart->regs + GART_CONFIG);
+        if (gart->savedata)
+                vfree(gart->savedata);
+        if (gart->regs)
+                devm_iounmap(dev, gart->regs);
+        devm_kfree(dev, gart);
+        gart_handle = NULL;
+        return 0;
+}
+
+const struct dev_pm_ops tegra_gart_pm_ops = {
+        .suspend        = tegra_gart_suspend,
+        .resume         = tegra_gart_resume,
+};
+
+static struct platform_driver tegra_gart_driver = {
+        .probe          = tegra_gart_probe,
+        .remove         = tegra_gart_remove,
+        .driver = {
+                .owner  = THIS_MODULE,
+                .name   = "tegra-gart",
+                .pm     = &tegra_gart_pm_ops,
+        },
+};
+
+static int __devinit tegra_gart_init(void)
+{
+        bus_set_iommu(&platform_bus_type, &gart_iommu_ops);
+        return platform_driver_register(&tegra_gart_driver);
+}
+
+static void __exit tegra_gart_exit(void)
+{
+        platform_driver_unregister(&tegra_gart_driver);
+}
+
+subsys_initcall(tegra_gart_init);
+module_exit(tegra_gart_exit);
+
+MODULE_DESCRIPTION("IOMMU API for GART in Tegra20");
+MODULE_AUTHOR("Hiroshi DOYU <hdoyu@nvidia.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
new file mode 100644
index 000000000000..eb93c821f592
--- /dev/null
+++ b/drivers/iommu/tegra-smmu.c
@@ -0,0 +1,1034 @@
+/*
+ * IOMMU API for SMMU in Tegra30
+ *
+ * Copyright (c) 2011-2012, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#define pr_fmt(fmt)     "%s(): " fmt, __func__
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/device.h>
+#include <linux/sched.h>
+#include <linux/iommu.h>
+#include <linux/io.h>
+
+#include <asm/page.h>
+#include <asm/cacheflush.h>
+
+#include <mach/iomap.h>
+#include <mach/smmu.h>
+
+/* bitmap of the page sizes currently supported */
+#define SMMU_IOMMU_PGSIZES      (SZ_4K)
+
+#define SMMU_CONFIG                             0x10
+#define SMMU_CONFIG_DISABLE                     0
+#define SMMU_CONFIG_ENABLE                      1
+
+#define SMMU_TLB_CONFIG                         0x14
+#define SMMU_TLB_CONFIG_STATS__MASK             (1 << 31)
+#define SMMU_TLB_CONFIG_STATS__ENABLE           (1 << 31)
+#define SMMU_TLB_CONFIG_HIT_UNDER_MISS__ENABLE  (1 << 29)
+#define SMMU_TLB_CONFIG_ACTIVE_LINES__VALUE     0x10
+#define SMMU_TLB_CONFIG_RESET_VAL               0x20000010
+
+#define SMMU_PTC_CONFIG                         0x18
+#define SMMU_PTC_CONFIG_STATS__MASK             (1 << 31)
+#define SMMU_PTC_CONFIG_STATS__ENABLE           (1 << 31)
+#define SMMU_PTC_CONFIG_CACHE__ENABLE           (1 << 29)
+#define SMMU_PTC_CONFIG_INDEX_MAP__PATTERN      0x3f
+#define SMMU_PTC_CONFIG_RESET_VAL               0x2000003f
+
+#define SMMU_PTB_ASID                           0x1c
+#define SMMU_PTB_ASID_CURRENT_SHIFT             0
+
+#define SMMU_PTB_DATA                           0x20
+#define SMMU_PTB_DATA_RESET_VAL                 0
+#define SMMU_PTB_DATA_ASID_NONSECURE_SHIFT      29
+#define SMMU_PTB_DATA_ASID_WRITABLE_SHIFT       30
+#define SMMU_PTB_DATA_ASID_READABLE_SHIFT       31
+
+#define SMMU_TLB_FLUSH                          0x30
+#define SMMU_TLB_FLUSH_VA_MATCH_ALL             0
+#define SMMU_TLB_FLUSH_VA_MATCH_SECTION         2
+#define SMMU_TLB_FLUSH_VA_MATCH_GROUP           3
+#define SMMU_TLB_FLUSH_ASID_SHIFT               29
+#define SMMU_TLB_FLUSH_ASID_MATCH_DISABLE       0
+#define SMMU_TLB_FLUSH_ASID_MATCH_ENABLE        1
+#define SMMU_TLB_FLUSH_ASID_MATCH_SHIFT         31
+
+#define SMMU_PTC_FLUSH                          0x34
+#define SMMU_PTC_FLUSH_TYPE_ALL                 0
+#define SMMU_PTC_FLUSH_TYPE_ADR                 1
+#define SMMU_PTC_FLUSH_ADR_SHIFT                4
+
+#define SMMU_ASID_SECURITY                      0x38
+
+#define SMMU_STATS_TLB_HIT_COUNT                0x1f0
+#define SMMU_STATS_TLB_MISS_COUNT               0x1f4
+#define SMMU_STATS_PTC_HIT_COUNT                0x1f8
+#define SMMU_STATS_PTC_MISS_COUNT               0x1fc
+
+#define SMMU_TRANSLATION_ENABLE_0               0x228
+#define SMMU_TRANSLATION_ENABLE_1               0x22c
+#define SMMU_TRANSLATION_ENABLE_2               0x230
+
+#define SMMU_AFI_ASID   0x238   /* PCIE */
+#define SMMU_AVPC_ASID  0x23c   /* AVP */
+#define SMMU_DC_ASID    0x240   /* Display controller */
+#define SMMU_DCB_ASID   0x244   /* Display controller B */
+#define SMMU_EPP_ASID   0x248   /* Encoder pre-processor */
+#define SMMU_G2_ASID    0x24c   /* 2D engine */
+#define SMMU_HC_ASID    0x250   /* Host1x */
+#define SMMU_HDA_ASID   0x254   /* High-def audio */
+#define SMMU_ISP_ASID   0x258   /* Image signal processor */
+#define SMMU_MPE_ASID   0x264   /* MPEG encoder */
+#define SMMU_NV_ASID    0x268   /* (3D) */
+#define SMMU_NV2_ASID   0x26c   /* (3D) */
+#define SMMU_PPCS_ASID  0x270   /* AHB */
+#define SMMU_SATA_ASID  0x278   /* SATA */
+#define SMMU_VDE_ASID   0x27c   /* Video decoder */
+#define SMMU_VI_ASID    0x280   /* Video input */
+
+#define SMMU_PDE_NEXT_SHIFT             28
+
+/* AHB Arbiter Registers */
+#define AHB_XBAR_CTRL                           0xe0
+#define AHB_XBAR_CTRL_SMMU_INIT_DONE_DONE       1
+#define AHB_XBAR_CTRL_SMMU_INIT_DONE_SHIFT      17
+
+#define SMMU_NUM_ASIDS                          4
+#define SMMU_TLB_FLUSH_VA_SECTION__MASK         0xffc00000
+#define SMMU_TLB_FLUSH_VA_SECTION__SHIFT        12 /* right shift */
+#define SMMU_TLB_FLUSH_VA_GROUP__MASK           0xffffc000
+#define SMMU_TLB_FLUSH_VA_GROUP__SHIFT          12 /* right shift */
+#define SMMU_TLB_FLUSH_VA(iova, which)  \
+        ((((iova) & SMMU_TLB_FLUSH_VA_##which##__MASK) >> \
+                SMMU_TLB_FLUSH_VA_##which##__SHIFT) |   \
+        SMMU_TLB_FLUSH_VA_MATCH_##which)
+#define SMMU_PTB_ASID_CUR(n)    \
+                ((n) << SMMU_PTB_ASID_CURRENT_SHIFT)
+#define SMMU_TLB_FLUSH_ASID_MATCH_disable               \
+                (SMMU_TLB_FLUSH_ASID_MATCH_DISABLE <<   \
+                        SMMU_TLB_FLUSH_ASID_MATCH_SHIFT)
+#define SMMU_TLB_FLUSH_ASID_MATCH__ENABLE               \
+                (SMMU_TLB_FLUSH_ASID_MATCH_ENABLE <<    \
+                        SMMU_TLB_FLUSH_ASID_MATCH_SHIFT)
+
+#define SMMU_PAGE_SHIFT 12
+#define SMMU_PAGE_SIZE  (1 << SMMU_PAGE_SHIFT)
+
+#define SMMU_PDIR_COUNT 1024
+#define SMMU_PDIR_SIZE  (sizeof(unsigned long) * SMMU_PDIR_COUNT)
+#define SMMU_PTBL_COUNT 1024
+#define SMMU_PTBL_SIZE  (sizeof(unsigned long) * SMMU_PTBL_COUNT)
+#define SMMU_PDIR_SHIFT 12
+#define SMMU_PDE_SHIFT  12
+#define SMMU_PTE_SHIFT  12
+#define SMMU_PFN_MASK   0x000fffff
+
+#define SMMU_ADDR_TO_PFN(addr)  ((addr) >> 12)
+#define SMMU_ADDR_TO_PDN(addr)  ((addr) >> 22)
+#define SMMU_PDN_TO_ADDR(addr)  ((pdn) << 22)
+
+#define _READABLE       (1 << SMMU_PTB_DATA_ASID_READABLE_SHIFT)
+#define _WRITABLE       (1 << SMMU_PTB_DATA_ASID_WRITABLE_SHIFT)
+#define _NONSECURE      (1 << SMMU_PTB_DATA_ASID_NONSECURE_SHIFT)
+#define _PDE_NEXT       (1 << SMMU_PDE_NEXT_SHIFT)
+#define _MASK_ATTR      (_READABLE | _WRITABLE | _NONSECURE)
+
+#define _PDIR_ATTR      (_READABLE | _WRITABLE | _NONSECURE)
+
+#define _PDE_ATTR       (_READABLE | _WRITABLE | _NONSECURE)
+#define _PDE_ATTR_N     (_PDE_ATTR | _PDE_NEXT)
+#define _PDE_VACANT(pdn)        (((pdn) << 10) | _PDE_ATTR)
+
+#define _PTE_ATTR       (_READABLE | _WRITABLE | _NONSECURE)
+#define _PTE_VACANT(addr)       (((addr) >> SMMU_PAGE_SHIFT) | _PTE_ATTR)
+
+#define SMMU_MK_PDIR(page, attr)        \
+                ((page_to_phys(page) >> SMMU_PDIR_SHIFT) | (attr))
+#define SMMU_MK_PDE(page, attr)         \
+                (unsigned long)((page_to_phys(page) >> SMMU_PDE_SHIFT) | (attr))
+#define SMMU_EX_PTBL_PAGE(pde)          \
+                pfn_to_page((unsigned long)(pde) & SMMU_PFN_MASK)
+#define SMMU_PFN_TO_PTE(pfn, attr)      (unsigned long)((pfn) | (attr))
+
+#define SMMU_ASID_ENABLE(asid)  ((asid) | (1 << 31))
+#define SMMU_ASID_DISABLE       0
+#define SMMU_ASID_ASID(n)       ((n) & ~SMMU_ASID_ENABLE(0))
+
+#define smmu_client_enable_hwgrp(c, m)  smmu_client_set_hwgrp(c, m, 1)
+#define smmu_client_disable_hwgrp(c)    smmu_client_set_hwgrp(c, 0, 0)
+#define __smmu_client_enable_hwgrp(c, m) __smmu_client_set_hwgrp(c, m, 1)
+#define __smmu_client_disable_hwgrp(c)  __smmu_client_set_hwgrp(c, 0, 0)
+
+#define HWGRP_INIT(client) [HWGRP_##client] = SMMU_##client##_ASID
+
+static const u32 smmu_hwgrp_asid_reg[] = {
+        HWGRP_INIT(AFI),
+        HWGRP_INIT(AVPC),
+        HWGRP_INIT(DC),
+        HWGRP_INIT(DCB),
+        HWGRP_INIT(EPP),
+        HWGRP_INIT(G2),
+        HWGRP_INIT(HC),
+        HWGRP_INIT(HDA),
+        HWGRP_INIT(ISP),
+        HWGRP_INIT(MPE),
+        HWGRP_INIT(NV),
+        HWGRP_INIT(NV2),
+        HWGRP_INIT(PPCS),
+        HWGRP_INIT(SATA),
+        HWGRP_INIT(VDE),
+        HWGRP_INIT(VI),
+};
+#define HWGRP_ASID_REG(x) (smmu_hwgrp_asid_reg[x])
+
+/*
+ * Per client for address space
+ */
+struct smmu_client {
+        struct device           *dev;
+        struct list_head        list;
+        struct smmu_as          *as;
+        u32                     hwgrp;
+};
+
+/*
+ * Per address space
+ */
+struct smmu_as {
+        struct smmu_device      *smmu;  /* back pointer to container */
+        unsigned int            asid;
+        spinlock_t              lock;   /* for pagetable */
+        struct page             *pdir_page;
+        unsigned long           pdir_attr;
+        unsigned long           pde_attr;
+        unsigned long           pte_attr;
+        unsigned int            *pte_count;
+
+        struct list_head        client;
+        spinlock_t              client_lock; /* for client list */
+};
+
+/*
+ * Per SMMU device - IOMMU device
+ */
+struct smmu_device {
+        void __iomem    *regs, *regs_ahbarb;
+        unsigned long   iovmm_base;     /* remappable base address */
+        unsigned long   page_count;     /* total remappable size */
+        spinlock_t      lock;
+        char            *name;
+        struct device   *dev;
+        int             num_as;
+        struct smmu_as  *as;            /* Run-time allocated array */
+        struct page *avp_vector_page;   /* dummy page shared by all AS's */
+
+        /*
+         * Register image savers for suspend/resume
+         */
+        unsigned long translation_enable_0;
+        unsigned long translation_enable_1;
+        unsigned long translation_enable_2;
+        unsigned long asid_security;
+};
+
+static struct smmu_device *smmu_handle; /* unique for a system */
+
+/*
+ *      SMMU/AHB register accessors
+ */
+static inline u32 smmu_read(struct smmu_device *smmu, size_t offs)
+{
+        return readl(smmu->regs + offs);
+}
+static inline void smmu_write(struct smmu_device *smmu, u32 val, size_t offs)
+{
+        writel(val, smmu->regs + offs);
+}
+
+static inline u32 ahb_read(struct smmu_device *smmu, size_t offs)
+{
+        return readl(smmu->regs_ahbarb + offs);
+}
+static inline void ahb_write(struct smmu_device *smmu, u32 val, size_t offs)
+{
+        writel(val, smmu->regs_ahbarb + offs);
+}
+
+#define VA_PAGE_TO_PA(va, page) \
+        (page_to_phys(page) + ((unsigned long)(va) & ~PAGE_MASK))
+
+#define FLUSH_CPU_DCACHE(va, page, size)        \
+        do {    \
+                unsigned long _pa_ = VA_PAGE_TO_PA(va, page);           \
+                __cpuc_flush_dcache_area((void *)(va), (size_t)(size)); \
+                outer_flush_range(_pa_, _pa_+(size_t)(size));           \
+        } while (0)
+
+/*
+ * Any interaction between any block on PPSB and a block on APB or AHB
+ * must have these read-back barriers to ensure the APB/AHB bus
+ * transaction is complete before initiating activity on the PPSB
+ * block.
+ */
+#define FLUSH_SMMU_REGS(smmu)   smmu_read(smmu, SMMU_CONFIG)
+
+#define smmu_client_hwgrp(c) (u32)((c)->dev->platform_data)
+
+static int __smmu_client_set_hwgrp(struct smmu_client *c,
+                                   unsigned long map, int on)
+{
+        int i;
+        struct smmu_as *as = c->as;
+        u32 val, offs, mask = SMMU_ASID_ENABLE(as->asid);
+        struct smmu_device *smmu = as->smmu;
+
+        WARN_ON(!on && map);
+        if (on && !map)
+                return -EINVAL;
+        if (!on)
+                map = smmu_client_hwgrp(c);
+
+        for_each_set_bit(i, &map, HWGRP_COUNT) {
+                offs = HWGRP_ASID_REG(i);
+                val = smmu_read(smmu, offs);
+                if (on) {
+                        if (WARN_ON(val & mask))
+                                goto err_hw_busy;
+                        val |= mask;
+                } else {
+                        WARN_ON((val & mask) == mask);
+                        val &= ~mask;
+                }
+                smmu_write(smmu, val, offs);
+        }
+        FLUSH_SMMU_REGS(smmu);
+        c->hwgrp = map;
+        return 0;
+
+err_hw_busy:
+        for_each_set_bit(i, &map, HWGRP_COUNT) {
+                offs = HWGRP_ASID_REG(i);
+                val = smmu_read(smmu, offs);
+                val &= ~mask;
+                smmu_write(smmu, val, offs);
+        }
+        return -EBUSY;
+}
+
+static int smmu_client_set_hwgrp(struct smmu_client *c, u32 map, int on)
+{
+        u32 val;
+        unsigned long flags;
+        struct smmu_as *as = c->as;
+        struct smmu_device *smmu = as->smmu;
+
+        spin_lock_irqsave(&smmu->lock, flags);
+        val = __smmu_client_set_hwgrp(c, map, on);
+        spin_unlock_irqrestore(&smmu->lock, flags);
+        return val;
+}
+
+/*
+ * Flush all TLB entries and all PTC entries
+ * Caller must lock smmu
+ */
+static void smmu_flush_regs(struct smmu_device *smmu, int enable)
+{
+        u32 val;
+
+        smmu_write(smmu, SMMU_PTC_FLUSH_TYPE_ALL, SMMU_PTC_FLUSH);
+        FLUSH_SMMU_REGS(smmu);
+        val = SMMU_TLB_FLUSH_VA_MATCH_ALL |
+                SMMU_TLB_FLUSH_ASID_MATCH_disable;
+        smmu_write(smmu, val, SMMU_TLB_FLUSH);
+
+        if (enable)
+                smmu_write(smmu, SMMU_CONFIG_ENABLE, SMMU_CONFIG);
+        FLUSH_SMMU_REGS(smmu);
+}
+
+static void smmu_setup_regs(struct smmu_device *smmu)
+{
+        int i;
+        u32 val;
+
+        for (i = 0; i < smmu->num_as; i++) {
+                struct smmu_as *as = &smmu->as[i];
+                struct smmu_client *c;
+
+                smmu_write(smmu, SMMU_PTB_ASID_CUR(as->asid), SMMU_PTB_ASID);
+                val = as->pdir_page ?
+                        SMMU_MK_PDIR(as->pdir_page, as->pdir_attr) :
+                        SMMU_PTB_DATA_RESET_VAL;
+                smmu_write(smmu, val, SMMU_PTB_DATA);
+
+                list_for_each_entry(c, &as->client, list)
+                        __smmu_client_set_hwgrp(c, c->hwgrp, 1);
+        }
+
+        smmu_write(smmu, smmu->translation_enable_0, SMMU_TRANSLATION_ENABLE_0);
+        smmu_write(smmu, smmu->translation_enable_1, SMMU_TRANSLATION_ENABLE_1);
+        smmu_write(smmu, smmu->translation_enable_2, SMMU_TRANSLATION_ENABLE_2);
+        smmu_write(smmu, smmu->asid_security, SMMU_ASID_SECURITY);
+        smmu_write(smmu, SMMU_TLB_CONFIG_RESET_VAL, SMMU_TLB_CONFIG);
+        smmu_write(smmu, SMMU_PTC_CONFIG_RESET_VAL, SMMU_PTC_CONFIG);
+
+        smmu_flush_regs(smmu, 1);
+
+        val = ahb_read(smmu, AHB_XBAR_CTRL);
+        val |= AHB_XBAR_CTRL_SMMU_INIT_DONE_DONE <<
+                AHB_XBAR_CTRL_SMMU_INIT_DONE_SHIFT;
+        ahb_write(smmu, val, AHB_XBAR_CTRL);
+}
+
+static void flush_ptc_and_tlb(struct smmu_device *smmu,
+                      struct smmu_as *as, dma_addr_t iova,
+                      unsigned long *pte, struct page *page, int is_pde)
+{
+        u32 val;
+        unsigned long tlb_flush_va = is_pde
+                ?  SMMU_TLB_FLUSH_VA(iova, SECTION)
+                :  SMMU_TLB_FLUSH_VA(iova, GROUP);
+
+        val = SMMU_PTC_FLUSH_TYPE_ADR | VA_PAGE_TO_PA(pte, page);
+        smmu_write(smmu, val, SMMU_PTC_FLUSH);
+        FLUSH_SMMU_REGS(smmu);
+        val = tlb_flush_va |
+                SMMU_TLB_FLUSH_ASID_MATCH__ENABLE |
+                (as->asid << SMMU_TLB_FLUSH_ASID_SHIFT);
+        smmu_write(smmu, val, SMMU_TLB_FLUSH);
+        FLUSH_SMMU_REGS(smmu);
+}
+
+static void free_ptbl(struct smmu_as *as, dma_addr_t iova)
+{
+        unsigned long pdn = SMMU_ADDR_TO_PDN(iova);
+        unsigned long *pdir = (unsigned long *)page_address(as->pdir_page);
+
+        if (pdir[pdn] != _PDE_VACANT(pdn)) {
+                dev_dbg(as->smmu->dev, "pdn: %lx\n", pdn);
+
+                ClearPageReserved(SMMU_EX_PTBL_PAGE(pdir[pdn]));
+                __free_page(SMMU_EX_PTBL_PAGE(pdir[pdn]));
+                pdir[pdn] = _PDE_VACANT(pdn);
+                FLUSH_CPU_DCACHE(&pdir[pdn], as->pdir_page, sizeof pdir[pdn]);
+                flush_ptc_and_tlb(as->smmu, as, iova, &pdir[pdn],
+                                  as->pdir_page, 1);
+        }
+}
+
+static void free_pdir(struct smmu_as *as)
+{
+        unsigned addr;
+        int count;
+        struct device *dev = as->smmu->dev;
+
+        if (!as->pdir_page)
+                return;
+
+        addr = as->smmu->iovmm_base;
+        count = as->smmu->page_count;
+        while (count-- > 0) {
+                free_ptbl(as, addr);
+                addr += SMMU_PAGE_SIZE * SMMU_PTBL_COUNT;
+        }
+        ClearPageReserved(as->pdir_page);
+        __free_page(as->pdir_page);
+        as->pdir_page = NULL;
+        devm_kfree(dev, as->pte_count);
+        as->pte_count = NULL;
+}
+
+/*
+ * Maps PTBL for given iova and returns the PTE address
+ * Caller must unmap the mapped PTBL returned in *ptbl_page_p
+ */
+static unsigned long *locate_pte(struct smmu_as *as,
+                                 dma_addr_t iova, bool allocate,
+                                 struct page **ptbl_page_p,
+                                 unsigned int **count)
+{
+        unsigned long ptn = SMMU_ADDR_TO_PFN(iova);
+        unsigned long pdn = SMMU_ADDR_TO_PDN(iova);
+        unsigned long *pdir = page_address(as->pdir_page);
+        unsigned long *ptbl;
+
+        if (pdir[pdn] != _PDE_VACANT(pdn)) {
+                /* Mapped entry table already exists */
+                *ptbl_page_p = SMMU_EX_PTBL_PAGE(pdir[pdn]);
+                ptbl = page_address(*ptbl_page_p);
+        } else if (!allocate) {
+                return NULL;
+        } else {
+                int pn;
+                unsigned long addr = SMMU_PDN_TO_ADDR(pdn);
+
+                /* Vacant - allocate a new page table */
+                dev_dbg(as->smmu->dev, "New PTBL pdn: %lx\n", pdn);
+
+                *ptbl_page_p = alloc_page(GFP_ATOMIC);
+                if (!*ptbl_page_p) {
+                        dev_err(as->smmu->dev,
+                                "failed to allocate smmu_device page table\n");
+                        return NULL;
+                }
+                SetPageReserved(*ptbl_page_p);
+                ptbl = (unsigned long *)page_address(*ptbl_page_p);
+                for (pn = 0; pn < SMMU_PTBL_COUNT;
+                     pn++, addr += SMMU_PAGE_SIZE) {
+                        ptbl[pn] = _PTE_VACANT(addr);
+                }
+                FLUSH_CPU_DCACHE(ptbl, *ptbl_page_p, SMMU_PTBL_SIZE);
+                pdir[pdn] = SMMU_MK_PDE(*ptbl_page_p,
+                                        as->pde_attr | _PDE_NEXT);
+                FLUSH_CPU_DCACHE(&pdir[pdn], as->pdir_page, sizeof pdir[pdn]);
+                flush_ptc_and_tlb(as->smmu, as, iova, &pdir[pdn],
+                                  as->pdir_page, 1);
+        }
+        *count = &as->pte_count[pdn];
+
+        return &ptbl[ptn % SMMU_PTBL_COUNT];
+}
+
+#ifdef CONFIG_SMMU_SIG_DEBUG
+static void put_signature(struct smmu_as *as,
+                          dma_addr_t iova, unsigned long pfn)
+{
+        struct page *page;
+        unsigned long *vaddr;
+
+        page = pfn_to_page(pfn);
+        vaddr = page_address(page);
+        if (!vaddr)
+                return;
+
+        vaddr[0] = iova;
+        vaddr[1] = pfn << PAGE_SHIFT;
+        FLUSH_CPU_DCACHE(vaddr, page, sizeof(vaddr[0]) * 2);
+}
+#else
+static inline void put_signature(struct smmu_as *as,
+                                 unsigned long addr, unsigned long pfn)
+{
+}
+#endif
+
+/*
+ * Caller must lock/unlock as
+ */
+static int alloc_pdir(struct smmu_as *as)
+{
+        unsigned long *pdir;
+        int pdn;
+        u32 val;
+        struct smmu_device *smmu = as->smmu;
+
+        if (as->pdir_page)
+                return 0;
+
+        as->pte_count = devm_kzalloc(smmu->dev,
+                     sizeof(as->pte_count[0]) * SMMU_PDIR_COUNT, GFP_KERNEL);
+        if (!as->pte_count) {
+                dev_err(smmu->dev,
+                        "failed to allocate smmu_device PTE cunters\n");
+                return -ENOMEM;
+        }
+        as->pdir_page = alloc_page(GFP_KERNEL | __GFP_DMA);
+        if (!as->pdir_page) {
+                dev_err(smmu->dev,
+                        "failed to allocate smmu_device page directory\n");
+                devm_kfree(smmu->dev, as->pte_count);
+                as->pte_count = NULL;
+                return -ENOMEM;
+        }
+        SetPageReserved(as->pdir_page);
+        pdir = page_address(as->pdir_page);
+
+        for (pdn = 0; pdn < SMMU_PDIR_COUNT; pdn++)
+                pdir[pdn] = _PDE_VACANT(pdn);
+        FLUSH_CPU_DCACHE(pdir, as->pdir_page, SMMU_PDIR_SIZE);
+        val = SMMU_PTC_FLUSH_TYPE_ADR | VA_PAGE_TO_PA(pdir, as->pdir_page);
+        smmu_write(smmu, val, SMMU_PTC_FLUSH);
+        FLUSH_SMMU_REGS(as->smmu);
+        val = SMMU_TLB_FLUSH_VA_MATCH_ALL |
+                SMMU_TLB_FLUSH_ASID_MATCH__ENABLE |
+                (as->asid << SMMU_TLB_FLUSH_ASID_SHIFT);
+        smmu_write(smmu, val, SMMU_TLB_FLUSH);
+        FLUSH_SMMU_REGS(as->smmu);
+
+        return 0;
+}
+
+static void __smmu_iommu_unmap(struct smmu_as *as, dma_addr_t iova)
+{
+        unsigned long *pte;
+        struct page *page;
+        unsigned int *count;
+
+        pte = locate_pte(as, iova, false, &page, &count);
+        if (WARN_ON(!pte))
+                return;
+
+        if (WARN_ON(*pte == _PTE_VACANT(iova)))
+                return;
+
+        *pte = _PTE_VACANT(iova);
+        FLUSH_CPU_DCACHE(pte, page, sizeof(*pte));
+        flush_ptc_and_tlb(as->smmu, as, iova, pte, page, 0);
+        if (!--(*count)) {
+                free_ptbl(as, iova);
+                smmu_flush_regs(as->smmu, 0);
+        }
+}
+
+static void __smmu_iommu_map_pfn(struct smmu_as *as, dma_addr_t iova,
+                                 unsigned long pfn)
+{
+        struct smmu_device *smmu = as->smmu;
+        unsigned long *pte;
+        unsigned int *count;
+        struct page *page;
+
+        pte = locate_pte(as, iova, true, &page, &count);
+        if (WARN_ON(!pte))
+                return;
+
+        if (*pte == _PTE_VACANT(iova))
+                (*count)++;
+        *pte = SMMU_PFN_TO_PTE(pfn, as->pte_attr);
+        if (unlikely((*pte == _PTE_VACANT(iova))))
+                (*count)--;
+        FLUSH_CPU_DCACHE(pte, page, sizeof(*pte));
+        flush_ptc_and_tlb(smmu, as, iova, pte, page, 0);
+        put_signature(as, iova, pfn);
+}
+
+static int smmu_iommu_map(struct iommu_domain *domain, unsigned long iova,
+                          phys_addr_t pa, size_t bytes, int prot)
+{
+        struct smmu_as *as = domain->priv;
+        unsigned long pfn = __phys_to_pfn(pa);
+        unsigned long flags;
+
+        dev_dbg(as->smmu->dev, "[%d] %08lx:%08x\n", as->asid, iova, pa);
+
+        if (!pfn_valid(pfn))
+                return -ENOMEM;
+
+        spin_lock_irqsave(&as->lock, flags);
+        __smmu_iommu_map_pfn(as, iova, pfn);
+        spin_unlock_irqrestore(&as->lock, flags);
+        return 0;
+}
+
+static size_t smmu_iommu_unmap(struct iommu_domain *domain, unsigned long iova,
+                               size_t bytes)
+{
+        struct smmu_as *as = domain->priv;
+        unsigned long flags;
+
+        dev_dbg(as->smmu->dev, "[%d] %08lx\n", as->asid, iova);
+
+        spin_lock_irqsave(&as->lock, flags);
+        __smmu_iommu_unmap(as, iova);
+        spin_unlock_irqrestore(&as->lock, flags);
+        return SMMU_PAGE_SIZE;
+}
+
+static phys_addr_t smmu_iommu_iova_to_phys(struct iommu_domain *domain,
+                                           unsigned long iova)
+{
+        struct smmu_as *as = domain->priv;
+        unsigned long *pte;
+        unsigned int *count;
+        struct page *page;
+        unsigned long pfn;
+        unsigned long flags;
+
+        spin_lock_irqsave(&as->lock, flags);
+
+        pte = locate_pte(as, iova, true, &page, &count);
+        pfn = *pte & SMMU_PFN_MASK;
+        WARN_ON(!pfn_valid(pfn));
+        dev_dbg(as->smmu->dev,
+                "iova:%08lx pfn:%08lx asid:%d\n", iova, pfn, as->asid);
+
+        spin_unlock_irqrestore(&as->lock, flags);
+        return PFN_PHYS(pfn);
+}
+
+static int smmu_iommu_domain_has_cap(struct iommu_domain *domain,
+                                     unsigned long cap)
+{
+        return 0;
+}
+
+static int smmu_iommu_attach_dev(struct iommu_domain *domain,
+                                 struct device *dev)
+{
+        struct smmu_as *as = domain->priv;
+        struct smmu_device *smmu = as->smmu;
+        struct smmu_client *client, *c;
+        u32 map;
+        int err;
+
+        client = devm_kzalloc(smmu->dev, sizeof(*c), GFP_KERNEL);
+        if (!client)
+                return -ENOMEM;
+        client->dev = dev;
+        client->as = as;
+        map = (unsigned long)dev->platform_data;
+        if (!map)
+                return -EINVAL;
+
+        err = smmu_client_enable_hwgrp(client, map);
+        if (err)
+                goto err_hwgrp;
+
+        spin_lock(&as->client_lock);
+        list_for_each_entry(c, &as->client, list) {
+                if (c->dev == dev) {
+                        dev_err(smmu->dev,
+                                "%s is already attached\n", dev_name(c->dev));
+                        err = -EINVAL;
+                        goto err_client;
+                }
+        }
+        list_add(&client->list, &as->client);
+        spin_unlock(&as->client_lock);
+
+        /*
+         * Reserve "page zero" for AVP vectors using a common dummy
+         * page.
+         */
+        if (map & HWG_AVPC) {
+                struct page *page;
+
+                page = as->smmu->avp_vector_page;
+                __smmu_iommu_map_pfn(as, 0, page_to_pfn(page));
+
+                pr_info("Reserve \"page zero\" for AVP vectors using a common dummy\n");
+        }
+
+        dev_dbg(smmu->dev, "%s is attached\n", dev_name(c->dev));
+        return 0;
+
+err_client:
+        smmu_client_disable_hwgrp(client);
+        spin_unlock(&as->client_lock);
+err_hwgrp:
+        devm_kfree(smmu->dev, client);
+        return err;
+}
+
+static void smmu_iommu_detach_dev(struct iommu_domain *domain,
+                                  struct device *dev)
+{
+        struct smmu_as *as = domain->priv;
+        struct smmu_device *smmu = as->smmu;
+        struct smmu_client *c;
+
+        spin_lock(&as->client_lock);
+
+        list_for_each_entry(c, &as->client, list) {
+                if (c->dev == dev) {
+                        smmu_client_disable_hwgrp(c);
+                        list_del(&c->list);
+                        devm_kfree(smmu->dev, c);
+                        c->as = NULL;
+                        dev_dbg(smmu->dev,
+                                "%s is detached\n", dev_name(c->dev));
+                        goto out;
+                }
+        }
+        dev_err(smmu->dev, "Couldn't find %s\n", dev_name(c->dev));
+out:
+        spin_unlock(&as->client_lock);
+}
+
+static int smmu_iommu_domain_init(struct iommu_domain *domain)
+{
+        int i;
+        unsigned long flags;
+        struct smmu_as *as;
+        struct smmu_device *smmu = smmu_handle;
+
+        /* Look for a free AS with lock held */
+        for  (i = 0; i < smmu->num_as; i++) {
+                struct smmu_as *tmp = &smmu->as[i];
+
+                spin_lock_irqsave(&tmp->lock, flags);
+                if (!tmp->pdir_page) {
+                        as = tmp;
+                        goto found;
+                }
+                spin_unlock_irqrestore(&tmp->lock, flags);
+        }
+        dev_err(smmu->dev, "no free AS\n");
+        return -ENODEV;
+
+found:
+        if (alloc_pdir(as) < 0)
+                goto err_alloc_pdir;
+
+        spin_lock(&smmu->lock);
+
+        /* Update PDIR register */
+        smmu_write(smmu, SMMU_PTB_ASID_CUR(as->asid), SMMU_PTB_ASID);
+        smmu_write(smmu,
+                   SMMU_MK_PDIR(as->pdir_page, as->pdir_attr), SMMU_PTB_DATA);
+        FLUSH_SMMU_REGS(smmu);
+
+        spin_unlock(&smmu->lock);
+
+        spin_unlock_irqrestore(&as->lock, flags);
+        domain->priv = as;
+
+        dev_dbg(smmu->dev, "smmu_as@%p\n", as);
+        return 0;
+
+err_alloc_pdir:
+        spin_unlock_irqrestore(&as->lock, flags);
+        return -ENODEV;
+}
+
+static void smmu_iommu_domain_destroy(struct iommu_domain *domain)
+{
+        struct smmu_as *as = domain->priv;
+        struct smmu_device *smmu = as->smmu;
+        unsigned long flags;
+
+        spin_lock_irqsave(&as->lock, flags);
+
+        if (as->pdir_page) {
+                spin_lock(&smmu->lock);
+                smmu_write(smmu, SMMU_PTB_ASID_CUR(as->asid), SMMU_PTB_ASID);
+                smmu_write(smmu, SMMU_PTB_DATA_RESET_VAL, SMMU_PTB_DATA);
+                FLUSH_SMMU_REGS(smmu);
+                spin_unlock(&smmu->lock);
+
+                free_pdir(as);
+        }
+
+        if (!list_empty(&as->client)) {
+                struct smmu_client *c;
+
+                list_for_each_entry(c, &as->client, list)
+                        smmu_iommu_detach_dev(domain, c->dev);
+        }
+
+        spin_unlock_irqrestore(&as->lock, flags);
+
+        domain->priv = NULL;
+        dev_dbg(smmu->dev, "smmu_as@%p\n", as);
+}
+
+static struct iommu_ops smmu_iommu_ops = {
+        .domain_init    = smmu_iommu_domain_init,
+        .domain_destroy = smmu_iommu_domain_destroy,
+        .attach_dev     = smmu_iommu_attach_dev,
+        .detach_dev     = smmu_iommu_detach_dev,
+        .map            = smmu_iommu_map,
+        .unmap          = smmu_iommu_unmap,
+        .iova_to_phys   = smmu_iommu_iova_to_phys,
+        .domain_has_cap = smmu_iommu_domain_has_cap,
+        .pgsize_bitmap  = SMMU_IOMMU_PGSIZES,
+};
+
+static int tegra_smmu_suspend(struct device *dev)
+{
+        struct smmu_device *smmu = dev_get_drvdata(dev);
+
+        smmu->translation_enable_0 = smmu_read(smmu, SMMU_TRANSLATION_ENABLE_0);
+        smmu->translation_enable_1 = smmu_read(smmu, SMMU_TRANSLATION_ENABLE_1);
+        smmu->translation_enable_2 = smmu_read(smmu, SMMU_TRANSLATION_ENABLE_2);
+        smmu->asid_security = smmu_read(smmu, SMMU_ASID_SECURITY);
+        return 0;
+}
+
+static int tegra_smmu_resume(struct device *dev)
+{
+        struct smmu_device *smmu = dev_get_drvdata(dev);
+        unsigned long flags;
+
+        spin_lock_irqsave(&smmu->lock, flags);
+        smmu_setup_regs(smmu);
+        spin_unlock_irqrestore(&smmu->lock, flags);
+        return 0;
+}
+
+static int tegra_smmu_probe(struct platform_device *pdev)
+{
+        struct smmu_device *smmu;
+        struct resource *regs, *regs2, *window;
+        struct device *dev = &pdev->dev;
+        int i, err = 0;
+
+        if (smmu_handle)
+                return -EIO;
+
+        BUILD_BUG_ON(PAGE_SHIFT != SMMU_PAGE_SHIFT);
+
+        regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        regs2 = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        window = platform_get_resource(pdev, IORESOURCE_MEM, 2);
+        if (!regs || !regs2 || !window) {
+                dev_err(dev, "No SMMU resources\n");
+                return -ENODEV;
+        }
+
+        smmu = devm_kzalloc(dev, sizeof(*smmu), GFP_KERNEL);
+        if (!smmu) {
+                dev_err(dev, "failed to allocate smmu_device\n");
+                return -ENOMEM;
+        }
+
+        smmu->dev = dev;
+        smmu->num_as = SMMU_NUM_ASIDS;
+        smmu->iovmm_base = (unsigned long)window->start;
+        smmu->page_count = resource_size(window) >> SMMU_PAGE_SHIFT;
+        smmu->regs = devm_ioremap(dev, regs->start, resource_size(regs));
+        smmu->regs_ahbarb = devm_ioremap(dev, regs2->start,
+                                         resource_size(regs2));
+        if (!smmu->regs || !smmu->regs_ahbarb) {
+                dev_err(dev, "failed to remap SMMU registers\n");
+                err = -ENXIO;
+                goto fail;
+        }
+
+        smmu->translation_enable_0 = ~0;
+        smmu->translation_enable_1 = ~0;
+        smmu->translation_enable_2 = ~0;
+        smmu->asid_security = 0;
+
+        smmu->as = devm_kzalloc(dev,
+                        sizeof(smmu->as[0]) * smmu->num_as, GFP_KERNEL);
+        if (!smmu->as) {
+                dev_err(dev, "failed to allocate smmu_as\n");
+                err = -ENOMEM;
+                goto fail;
+        }
+
+        for (i = 0; i < smmu->num_as; i++) {
+                struct smmu_as *as = &smmu->as[i];
+
+                as->smmu = smmu;
+                as->asid = i;
+                as->pdir_attr = _PDIR_ATTR;
+                as->pde_attr = _PDE_ATTR;
+                as->pte_attr = _PTE_ATTR;
+
+                spin_lock_init(&as->lock);
+                INIT_LIST_HEAD(&as->client);
+        }
+        spin_lock_init(&smmu->lock);
+        smmu_setup_regs(smmu);
+        platform_set_drvdata(pdev, smmu);
+
+        smmu->avp_vector_page = alloc_page(GFP_KERNEL);
+        if (!smmu->avp_vector_page)
+                goto fail;
+
+        smmu_handle = smmu;
+        return 0;
+
+fail:
+        if (smmu->avp_vector_page)
+                __free_page(smmu->avp_vector_page);
+        if (smmu->regs)
+                devm_iounmap(dev, smmu->regs);
+        if (smmu->regs_ahbarb)
+                devm_iounmap(dev, smmu->regs_ahbarb);
+        if (smmu && smmu->as) {
+                for (i = 0; i < smmu->num_as; i++) {
+                        if (smmu->as[i].pdir_page) {
+                                ClearPageReserved(smmu->as[i].pdir_page);
+                                __free_page(smmu->as[i].pdir_page);
+                        }
+                }
+                devm_kfree(dev, smmu->as);
+        }
+        devm_kfree(dev, smmu);
+        return err;
+}
+
+static int tegra_smmu_remove(struct platform_device *pdev)
+{
+        struct smmu_device *smmu = platform_get_drvdata(pdev);
+        struct device *dev = smmu->dev;
+
+        smmu_write(smmu, SMMU_CONFIG_DISABLE, SMMU_CONFIG);
+        platform_set_drvdata(pdev, NULL);
+        if (smmu->as) {
+                int i;
+
+                for (i = 0; i < smmu->num_as; i++)
+                        free_pdir(&smmu->as[i]);
+                devm_kfree(dev, smmu->as);
+        }
+        if (smmu->avp_vector_page)
+                __free_page(smmu->avp_vector_page);
+        if (smmu->regs)
+                devm_iounmap(dev, smmu->regs);
+        if (smmu->regs_ahbarb)
+                devm_iounmap(dev, smmu->regs_ahbarb);
+        devm_kfree(dev, smmu);
+        smmu_handle = NULL;
+        return 0;
+}
+
+const struct dev_pm_ops tegra_smmu_pm_ops = {
+        .suspend        = tegra_smmu_suspend,
+        .resume         = tegra_smmu_resume,
+};
+
+static struct platform_driver tegra_smmu_driver = {
+        .probe          = tegra_smmu_probe,
+        .remove         = tegra_smmu_remove,
+        .driver = {
+                .owner  = THIS_MODULE,
+                .name   = "tegra-smmu",
+                .pm     = &tegra_smmu_pm_ops,
+        },
+};
+
+static int __devinit tegra_smmu_init(void)
+{
+        bus_set_iommu(&platform_bus_type, &smmu_iommu_ops);
+        return platform_driver_register(&tegra_smmu_driver);
+}
+
+static void __exit tegra_smmu_exit(void)
+{
+        platform_driver_unregister(&tegra_smmu_driver);
+}
+
+subsys_initcall(tegra_smmu_init);
+module_exit(tegra_smmu_exit);
+
+MODULE_DESCRIPTION("IOMMU API for SMMU in Tegra30");
+MODULE_AUTHOR("Hiroshi DOYU <hdoyu@nvidia.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
index 9fb18c147825..b280c433e4a0 100644
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -323,7 +323,7 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio,
          * Corrupt successful READs while in down state.
          * If flags were specified, only corrupt those that match.
          */
-        if (!error && bio_submitted_while_down &&
+        if (fc->corrupt_bio_byte && !error && bio_submitted_while_down &&
             (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) &&
             all_corrupt_bio_flags_match(bio, fc))
                 corrupt_bio_data(bio, fc);
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index ad2eba40e319..ea5dd289fe2a 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -296,6 +296,8 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
         unsigned offset;
         unsigned num_bvecs;
         sector_t remaining = where->count;
+        struct request_queue *q = bdev_get_queue(where->bdev);
+        sector_t discard_sectors;
 
         /*
          * where->count may be zero if rw holds a flush and we need to
@@ -305,9 +307,12 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                 /*
                  * Allocate a suitably sized-bio.
                  */
-                num_bvecs = dm_sector_div_up(remaining,
-                                             (PAGE_SIZE >> SECTOR_SHIFT));
-                num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev), num_bvecs);
+                if (rw & REQ_DISCARD)
+                        num_bvecs = 1;
+                else
+                        num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev),
+                                          dm_sector_div_up(remaining, (PAGE_SIZE >> SECTOR_SHIFT)));
+
                 bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
                 bio->bi_sector = where->sector + (where->count - remaining);
                 bio->bi_bdev = where->bdev;
@@ -315,10 +320,14 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                 bio->bi_destructor = dm_bio_destructor;
                 store_io_and_region_in_bio(bio, io, region);
 
-                /*
-                 * Try and add as many pages as possible.
-                 */
-                while (remaining) {
+                if (rw & REQ_DISCARD) {
+                        discard_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
+                        bio->bi_size = discard_sectors << SECTOR_SHIFT;
+                        remaining -= discard_sectors;
+                } else while (remaining) {
+                        /*
+                         * Try and add as many pages as possible.
+                         */
                         dp->get_page(dp, &page, &len, &offset);
                         len = min(len, to_bytes(remaining));
                         if (!bio_add_page(bio, page, len, offset))
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 31c2dc25886d..1ce84ed0b765 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1437,7 +1437,7 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
 
         if (!argc) {
                 DMWARN("Empty message received.");
-                goto out;
+                goto out_argv;
         }
 
         table = dm_get_live_table(md);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 86cb7e5d83d5..787022c18187 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -668,7 +668,14 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev)
                 return ret;
 
         sb = page_address(rdev->sb_page);
-        if (sb->magic != cpu_to_le32(DM_RAID_MAGIC)) {
+
+        /*
+         * Two cases that we want to write new superblocks and rebuild:
+         * 1) New device (no matching magic number)
+         * 2) Device specified for rebuild (!In_sync w/ offset == 0)
+         */
+        if ((sb->magic != cpu_to_le32(DM_RAID_MAGIC)) ||
+            (!test_bit(In_sync, &rdev->flags) && !rdev->recovery_offset)) {
                 super_sync(rdev->mddev, rdev);
 
                 set_bit(FirstUse, &rdev->flags);
@@ -745,11 +752,8 @@ static int super_init_validation(struct mddev *mddev, struct md_rdev *rdev)
          */
         rdev_for_each(r, t, mddev) {
                 if (!test_bit(In_sync, &r->flags)) {
-                        if (!test_bit(FirstUse, &r->flags))
-                                DMERR("Superblock area of "
-                                      "rebuild device %d should have been "
-                                      "cleared.", r->raid_disk);
-                        set_bit(FirstUse, &r->flags);
+                        DMINFO("Device %d specified for rebuild: "
+                               "Clearing superblock", r->raid_disk);
                         rebuilds++;
                 } else if (test_bit(FirstUse, &r->flags))
                         new_devs++;
@@ -971,6 +975,7 @@ static int raid_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         INIT_WORK(&rs->md.event_work, do_table_event);
         ti->private = rs;
+        ti->num_flush_requests = 1;
 
         mutex_lock(&rs->md.reconfig_mutex);
         ret = md_run(&rs->md);
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 59c4f0446ffa..237571af77fd 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -385,6 +385,7 @@ static int init_pmd(struct dm_pool_metadata *pmd,
                 data_sm = dm_sm_disk_create(tm, nr_blocks);
                 if (IS_ERR(data_sm)) {
                         DMERR("sm_disk_create failed");
+                        dm_tm_unlock(tm, sblock);
                         r = PTR_ERR(data_sm);
                         goto bad;
                 }
@@ -789,6 +790,11 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd)
         return 0;
 }
 
+/*
+ * __open_device: Returns @td corresponding to device with id @dev,
+ * creating it if @create is set and incrementing @td->open_count.
+ * On failure, @td is undefined.
+ */
 static int __open_device(struct dm_pool_metadata *pmd,
                          dm_thin_id dev, int create,
                          struct dm_thin_device **td)
@@ -799,10 +805,16 @@ static int __open_device(struct dm_pool_metadata *pmd,
         struct disk_device_details details_le;
 
         /*
-         * Check the device isn't already open.
+         * If the device is already open, return it.
          */
         list_for_each_entry(td2, &pmd->thin_devices, list)
                 if (td2->id == dev) {
+                        /*
+                         * May not create an already-open device.
+                         */
+                        if (create)
+                                return -EEXIST;
+
                         td2->open_count++;
                         *td = td2;
                         return 0;
@@ -817,6 +829,9 @@ static int __open_device(struct dm_pool_metadata *pmd,
                 if (r != -ENODATA || !create)
                         return r;
 
+                /*
+                 * Create new device.
+                 */
                 changed = 1;
                 details_le.mapped_blocks = 0;
                 details_le.transaction_id = cpu_to_le64(pmd->trans_id);
@@ -882,12 +897,10 @@ static int __create_thin(struct dm_pool_metadata *pmd,
 
         r = __open_device(pmd, dev, 1, &td);
         if (r) {
-                __close_device(td);
                 dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
                 dm_btree_del(&pmd->bl_info, dev_root);
                 return r;
         }
-        td->changed = 1;
         __close_device(td);
 
         return r;
@@ -967,14 +980,14 @@ static int __create_snap(struct dm_pool_metadata *pmd,
                 goto bad;
 
         r = __set_snapshot_details(pmd, td, origin, pmd->time);
+        __close_device(td);
+
         if (r)
                 goto bad;
 
-        __close_device(td);
         return 0;
 
 bad:
-        __close_device(td);
         dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
         dm_btree_remove(&pmd->details_info, pmd->details_root,
                         &key, &pmd->details_root);
@@ -1211,6 +1224,8 @@ static int __remove(struct dm_thin_device *td, dm_block_t block)
         if (r)
                 return r;
 
+        td->mapped_blocks--;
+        td->changed = 1;
         pmd->need_commit = 1;
 
         return 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a368db2431a5..a0b225eb4ac4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -624,7 +624,7 @@ int md_raid1_congested(struct mddev *mddev, int bits)
                 return 1;
 
         rcu_read_lock();
-        for (i = 0; i < conf->raid_disks; i++) {
+        for (i = 0; i < conf->raid_disks * 2; i++) {
                 struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev);
                 if (rdev && !test_bit(Faulty, &rdev->flags)) {
                         struct request_queue *q = bdev_get_queue(rdev->bdev);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 6e8aa213f0d5..58c44d6453a0 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -67,6 +67,7 @@ static int max_queued_requests = 1024;
 
 static void allow_barrier(struct r10conf *conf);
 static void lower_barrier(struct r10conf *conf);
+static int enough(struct r10conf *conf, int ignore);
 
 static void * r10bio_pool_alloc(gfp_t gfp_flags, void *data)
 {
@@ -347,6 +348,19 @@ static void raid10_end_read_request(struct bio *bio, int error)
                  * wait for the 'master' bio.
                  */
                 set_bit(R10BIO_Uptodate, &r10_bio->state);
+        } else {
+                /* If all other devices that store this block have
+                 * failed, we want to return the error upwards rather
+                 * than fail the last device.  Here we redefine
+                 * "uptodate" to mean "Don't want to retry"
+                 */
+                unsigned long flags;
+                spin_lock_irqsave(&conf->device_lock, flags);
+                if (!enough(conf, rdev->raid_disk))
+                        uptodate = 1;
+                spin_unlock_irqrestore(&conf->device_lock, flags);
+        }
+        if (uptodate) {
                 raid_end_bio_io(r10_bio);
                 rdev_dec_pending(rdev, conf->mddev);
         } else {
@@ -2052,6 +2066,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                        "md/raid10:%s: %s: Failing raid device\n",
                        mdname(mddev), b);
                 md_error(mddev, conf->mirrors[d].rdev);
+                r10_bio->devs[r10_bio->read_slot].bio = IO_BLOCKED;
                 return;
         }
 
@@ -2105,8 +2120,11 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                                     rdev,
                                     r10_bio->devs[r10_bio->read_slot].addr
                                     + sect,
-                                    s, 0))
+                                    s, 0)) {
                                 md_error(mddev, rdev);
+                                r10_bio->devs[r10_bio->read_slot].bio
+                                        = IO_BLOCKED;
+                        }
                         break;
                 }
 
@@ -2299,17 +2317,20 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio)
          * This is all done synchronously while the array is
          * frozen.
          */
+        bio = r10_bio->devs[slot].bio;
+        bdevname(bio->bi_bdev, b);
+        bio_put(bio);
+        r10_bio->devs[slot].bio = NULL;
+
         if (mddev->ro == 0) {
                 freeze_array(conf);
                 fix_read_error(conf, mddev, r10_bio);
                 unfreeze_array(conf);
-        }
+        } else
+                r10_bio->devs[slot].bio = IO_BLOCKED;
+
         rdev_dec_pending(rdev, mddev);
 
-        bio = r10_bio->devs[slot].bio;
-        bdevname(bio->bi_bdev, b);
-        r10_bio->devs[slot].bio =
-                mddev->ro ? IO_BLOCKED : NULL;
 read_more:
         rdev = read_balance(conf, r10_bio, &max_sectors);
         if (rdev == NULL) {
@@ -2318,13 +2339,10 @@ read_more:
                        mdname(mddev), b,
                        (unsigned long long)r10_bio->sector);
                 raid_end_bio_io(r10_bio);
-                bio_put(bio);
                 return;
         }
 
         do_sync = (r10_bio->master_bio->bi_rw & REQ_SYNC);
-        if (bio)
-                bio_put(bio);
         slot = r10_bio->read_slot;
         printk_ratelimited(
                 KERN_ERR
@@ -2360,7 +2378,6 @@ read_more:
                         mbio->bi_phys_segments++;
                 spin_unlock_irq(&conf->device_lock);
                 generic_make_request(bio);
-                bio = NULL;
 
                 r10_bio = mempool_alloc(conf->r10bio_pool,
                                         GFP_NOIO);
@@ -3243,7 +3260,6 @@ static int run(struct mddev *mddev)
                         disk->rdev = rdev;
                 }
 
-                disk->rdev = rdev;
                 disk_stack_limits(mddev->gendisk, rdev->bdev,
                                   rdev->data_offset << 9);
                 /* as we don't honour merge_bvec_fn, we must never risk
diff --git a/drivers/media/dvb/siano/smsdvb.c b/drivers/media/dvb/siano/smsdvb.c
index 654685c9303e..aa77e54a8fae 100644
--- a/drivers/media/dvb/siano/smsdvb.c
+++ b/drivers/media/dvb/siano/smsdvb.c
@@ -49,9 +49,6 @@ struct smsdvb_client_t {
 
         struct completion       tune_done;
 
-        /* todo: save freq/band instead whole struct */
-        struct dtv_frontend_properties fe_params;
-
         struct SMSHOSTLIB_STATISTICS_DVB_S sms_stat_dvb;
         int event_fe_state;
         int event_unc_state;
@@ -744,12 +741,124 @@ static int smsdvb_get_frontend(struct dvb_frontend *fe)
         struct dtv_frontend_properties *fep = &fe->dtv_property_cache;
         struct smsdvb_client_t *client =
                 container_of(fe, struct smsdvb_client_t, frontend);
+        struct smscore_device_t *coredev = client->coredev;
+        struct TRANSMISSION_STATISTICS_S *td =
+                &client->sms_stat_dvb.TransmissionData;
 
-        sms_debug("");
+        switch (smscore_get_device_mode(coredev)) {
+        case DEVICE_MODE_DVBT:
+        case DEVICE_MODE_DVBT_BDA:
+                fep->frequency = td->Frequency;
+
+                switch (td->Bandwidth) {
+                case 6:
+                        fep->bandwidth_hz = 6000000;
+                        break;
+                case 7:
+                        fep->bandwidth_hz = 7000000;
+                        break;
+                case 8:
+                        fep->bandwidth_hz = 8000000;
+                        break;
+                }
+
+                switch (td->TransmissionMode) {
+                case 2:
+                        fep->transmission_mode = TRANSMISSION_MODE_2K;
+                        break;
+                case 8:
+                        fep->transmission_mode = TRANSMISSION_MODE_8K;
+                }
+
+                switch (td->GuardInterval) {
+                case 0:
+                        fep->guard_interval = GUARD_INTERVAL_1_32;
+                        break;
+                case 1:
+                        fep->guard_interval = GUARD_INTERVAL_1_16;
+                        break;
+                case 2:
+                        fep->guard_interval = GUARD_INTERVAL_1_8;
+                        break;
+                case 3:
+                        fep->guard_interval = GUARD_INTERVAL_1_4;
+                        break;
+                }
+
+                switch (td->CodeRate) {
+                case 0:
+                        fep->code_rate_HP = FEC_1_2;
+                        break;
+                case 1:
+                        fep->code_rate_HP = FEC_2_3;
+                        break;
+                case 2:
+                        fep->code_rate_HP = FEC_3_4;
+                        break;
+                case 3:
+                        fep->code_rate_HP = FEC_5_6;
+                        break;
+                case 4:
+                        fep->code_rate_HP = FEC_7_8;
+                        break;
+                }
+
+                switch (td->LPCodeRate) {
+                case 0:
+                        fep->code_rate_LP = FEC_1_2;
+                        break;
+                case 1:
+                        fep->code_rate_LP = FEC_2_3;
+                        break;
+                case 2:
+                        fep->code_rate_LP = FEC_3_4;
+                        break;
+                case 3:
+                        fep->code_rate_LP = FEC_5_6;
+                        break;
+                case 4:
+                        fep->code_rate_LP = FEC_7_8;
+                        break;
+                }
+
+                switch (td->Constellation) {
+                case 0:
+                        fep->modulation = QPSK;
+                        break;
+                case 1:
+                        fep->modulation = QAM_16;
+                        break;
+                case 2:
+                        fep->modulation = QAM_64;
+                        break;
+                }
+
+                switch (td->Hierarchy) {
+                case 0:
+                        fep->hierarchy = HIERARCHY_NONE;
+                        break;
+                case 1:
+                        fep->hierarchy = HIERARCHY_1;
+                        break;
+                case 2:
+                        fep->hierarchy = HIERARCHY_2;
+                        break;
+                case 3:
+                        fep->hierarchy = HIERARCHY_4;
+                        break;
+                }
 
-        /* todo: */
-        memcpy(fep, &client->fe_params,
-               sizeof(struct dtv_frontend_properties));
+                fep->inversion = INVERSION_AUTO;
+                break;
+        case DEVICE_MODE_ISDBT:
+        case DEVICE_MODE_ISDBT_BDA:
+                fep->frequency = td->Frequency;
+                fep->bandwidth_hz = 6000000;
+                /* todo: retrive the other parameters */
+                break;
+        default:
+                return -EINVAL;
+        }
 
         return 0;
 }
@@ -872,11 +981,11 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
         switch (smscore_get_device_mode(coredev)) {
         case DEVICE_MODE_DVBT:
         case DEVICE_MODE_DVBT_BDA:
-                smsdvb_fe_ops.delsys[0] = SYS_DVBT;
+                client->frontend.ops.delsys[0] = SYS_DVBT;
                 break;
         case DEVICE_MODE_ISDBT:
         case DEVICE_MODE_ISDBT_BDA:
-                smsdvb_fe_ops.delsys[0] = SYS_ISDBT;
+                client->frontend.ops.delsys[0] = SYS_ISDBT;
                 break;
         }
 
diff --git a/drivers/media/video/davinci/isif.c b/drivers/media/video/davinci/isif.c
index 1e63852374be..5278fe7d6d0c 100644
--- a/drivers/media/video/davinci/isif.c
+++ b/drivers/media/video/davinci/isif.c
@@ -34,6 +34,7 @@
 #include <linux/videodev2.h>
 #include <linux/clk.h>
 #include <linux/err.h>
+#include <linux/module.h>
 
 #include <mach/mux.h>
 
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index c7e69b8f81c9..4a44f9a1bae0 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -611,9 +611,11 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
         delta_stc = buf->pts - (1UL << 31);
         x1 = first->dev_stc - delta_stc;
         x2 = last->dev_stc - delta_stc;
+        if (x1 == x2)
+                goto done;
+
         y1 = (first->dev_sof + 2048) << 16;
         y2 = (last->dev_sof + 2048) << 16;
-
         if (y2 < y1)
                 y2 += 2048 << 16;
 
@@ -631,14 +633,16 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
                   x1, x2, y1, y2, clock->sof_offset);
 
         /* Second step, SOF to host clock conversion. */
-        ts = timespec_sub(last->host_ts, first->host_ts);
         x1 = (uvc_video_clock_host_sof(first) + 2048) << 16;
         x2 = (uvc_video_clock_host_sof(last) + 2048) << 16;
-        y1 = NSEC_PER_SEC;
-        y2 = (ts.tv_sec + 1) * NSEC_PER_SEC + ts.tv_nsec;
-
         if (x2 < x1)
                 x2 += 2048 << 16;
+        if (x1 == x2)
+                goto done;
+
+        ts = timespec_sub(last->host_ts, first->host_ts);
+        y1 = NSEC_PER_SEC;
+        y2 = (ts.tv_sec + 1) * NSEC_PER_SEC + ts.tv_nsec;
 
         /* Interpolated and host SOF timestamps can wrap around at slightly
          * different times. Handle this by adding or removing 2048 to or from
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 53e2a80f42fa..d295941c9a3d 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -956,11 +956,12 @@ int __devinit ab8500_init(struct ab8500 *ab8500)
         return ret;
 
 out_freeirq:
-        if (ab8500->irq_base) {
+        if (ab8500->irq_base)
                 free_irq(ab8500->irq, ab8500);
 out_removeirq:
+        if (ab8500->irq_base)
                 ab8500_irq_remove(ab8500);
-        }
+
         return ret;
 }
 
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 0f5922812bff..411f523d4878 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -123,7 +123,7 @@ static int mfd_add_device(struct device *parent, int id,
                 }
 
                 if (!cell->ignore_resource_conflicts) {
-                        ret = acpi_check_resource_conflict(res);
+                        ret = acpi_check_resource_conflict(&res[r]);
                         if (ret)
                                 goto fail_res;
                 }
diff --git a/drivers/mfd/s5m-core.c b/drivers/mfd/s5m-core.c
index e075c113eec6..caadabeed8e9 100644
--- a/drivers/mfd/s5m-core.c
+++ b/drivers/mfd/s5m-core.c
@@ -105,7 +105,7 @@ static int s5m87xx_i2c_probe(struct i2c_client *i2c,
         s5m87xx->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
         i2c_set_clientdata(s5m87xx->rtc, s5m87xx);
 
-        if (pdata->cfg_pmic_irq)
+        if (pdata && pdata->cfg_pmic_irq)
                 pdata->cfg_pmic_irq();
 
         s5m_irq_init(s5m87xx);
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index 01cf5012a08f..4392f6bca156 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -168,7 +168,7 @@ static int tps65910_i2c_probe(struct i2c_client *i2c,
                 goto err;
 
         init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
 
         tps65910_gpio_init(tps65910, pmic_plat_data->gpio_base);
 
diff --git a/drivers/mfd/tps65912-core.c b/drivers/mfd/tps65912-core.c
index 5fec23a9ac03..74fd8cb5f372 100644
--- a/drivers/mfd/tps65912-core.c
+++ b/drivers/mfd/tps65912-core.c
@@ -151,7 +151,7 @@ int tps65912_device_init(struct tps65912 *tps65912)
                 goto err;
 
         init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
         ret = tps65912_irq_init(tps65912, init_data->irq, init_data);
         if (ret < 0)
                 goto err;
diff --git a/drivers/mfd/wm8350-irq.c b/drivers/mfd/wm8350-irq.c
index 8a1fafd0bf7d..9fd01bf63c51 100644
--- a/drivers/mfd/wm8350-irq.c
+++ b/drivers/mfd/wm8350-irq.c
@@ -496,7 +496,6 @@ int wm8350_irq_init(struct wm8350 *wm8350, int irq,
 
         mutex_init(&wm8350->irq_lock);
         wm8350->chip_irq = irq;
-        wm8350->irq_base = pdata->irq_base;
 
         if (pdata && pdata->irq_base > 0)
                 irq_base = pdata->irq_base;
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index f117e7fb9321..a04b3c108c8c 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -256,6 +256,20 @@ static int wm8994_suspend(struct device *dev)
                 break;
         }
 
+        switch (wm8994->type) {
+        case WM1811:
+                ret = wm8994_reg_read(wm8994, WM8994_ANTIPOP_2);
+                if (ret < 0) {
+                        dev_err(dev, "Failed to read jackdet: %d\n", ret);
+                } else if (ret & WM1811_JACKDET_MODE_MASK) {
+                        dev_dbg(dev, "CODEC still active, ignoring suspend\n");
+                        return 0;
+                }
+                break;
+        default:
+                break;
+        }
+
         /* Disable LDO pulldowns while the device is suspended if we
          * don't know that something will be driving them. */
         if (!wm8994->ldo_ena_always_driven)
diff --git a/drivers/mfd/wm8994-regmap.c b/drivers/mfd/wm8994-regmap.c
index c598ae69b8ff..bc0c5096539a 100644
--- a/drivers/mfd/wm8994-regmap.c
+++ b/drivers/mfd/wm8994-regmap.c
@@ -806,6 +806,7 @@ static bool wm1811_readable_register(struct device *dev, unsigned int reg)
         case WM8994_DC_SERVO_2:
         case WM8994_DC_SERVO_READBACK:
         case WM8994_DC_SERVO_4:
+        case WM8994_DC_SERVO_4E:
         case WM8994_ANALOGUE_HP_1:
         case WM8958_MIC_DETECT_1:
         case WM8958_MIC_DETECT_2:
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index 19fc7c1cb428..f428d86bfc10 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -984,9 +984,9 @@ static int __init c2port_init(void)
                 " - (C) 2007 Rodolfo Giometti\n");
 
         c2port_class = class_create(THIS_MODULE, "c2port");
-        if (!c2port_class) {
+        if (IS_ERR(c2port_class)) {
                 printk(KERN_ERR "c2port: failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(c2port_class);
         }
         c2port_class->dev_attrs = c2port_attrs;
 
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 690255c7d4dc..132378b89d76 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2068,6 +2068,9 @@ static int mmc_rescan_try_freq(struct mmc_host *host, unsigned freq)
          */
         mmc_hw_reset_for_init(host);
 
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         /*
          * sdio_reset sends CMD52 to reset card.  Since we do not know
          * if the card is being re-initialized, just send it.  CMD52
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 30055f2b0d44..c3704e293a7b 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -238,10 +238,10 @@ static inline void mmc_host_clk_init(struct mmc_host *host)
         /* Hold MCI clock for 8 cycles by default */
         host->clk_delay = 8;
         /*
-         * Default clock gating delay is 200ms.
+         * Default clock gating delay is 0ms to avoid wasting power.
          * This value can be tuned by writing into sysfs entry.
          */
-        host->clkgate_delay = 200;
+        host->clkgate_delay = 0;
         host->clk_gated = false;
         INIT_DELAYED_WORK(&host->clk_gate_work, mmc_host_clk_gate_work);
         spin_lock_init(&host->clk_lock);
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index a48066344fa8..2b9ed1401dc4 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -816,6 +816,9 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
         if (!mmc_host_is_spi(host))
                 mmc_set_bus_mode(host, MMC_BUSMODE_OPENDRAIN);
 
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         /*
          * Since we're changing the OCR value, we seem to
          * need to tell some cards to go back to the idle
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 5017f9354ce2..c272c6868ecf 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -911,6 +911,9 @@ static int mmc_sd_init_card(struct mmc_host *host, u32 ocr,
         BUG_ON(!host);
         WARN_ON(!host->claimed);
 
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         err = mmc_sd_get_cid(host, ocr, cid, &rocr);
         if (err)
                 return err;
@@ -1156,11 +1159,6 @@ int mmc_attach_sd(struct mmc_host *host)
         BUG_ON(!host);
         WARN_ON(!host->claimed);
 
-        /* Make sure we are at 3.3V signalling voltage */
-        err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, false);
-        if (err)
-                return err;
-
         /* Disable preset value enable if already set since last time */
         if (host->ops->enable_preset_value) {
                 mmc_host_clk_hold(host);
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 12cde6ee17f5..2c7c83f832d2 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -585,6 +585,9 @@ static int mmc_sdio_init_card(struct mmc_host *host, u32 ocr,
          * Inform the card of the voltage
          */
         if (!powered_resume) {
+                /* The initialization should be done at 3.3 V I/O voltage. */
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
                 err = mmc_send_io_op_cond(host, host->ocr, &ocr);
                 if (err)
                         goto err;
@@ -996,6 +999,11 @@ static int mmc_sdio_power_restore(struct mmc_host *host)
          * With these steps taken, mmc_select_voltage() is also required to
          * restore the correct voltage setting of the card.
          */
+
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        if (!mmc_card_keep_power(host))
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         sdio_reset(host);
         mmc_go_idle(host);
         mmc_send_if_cond(host, host->ocr_avail);
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 6985cdb0bb26..e4449a54ae8f 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1948,12 +1948,12 @@ static bool atmci_filter(struct dma_chan *chan, void *slave)
         }
 }
 
-static void atmci_configure_dma(struct atmel_mci *host)
+static bool atmci_configure_dma(struct atmel_mci *host)
 {
         struct mci_platform_data        *pdata;
 
         if (host == NULL)
-                return;
+                return false;
 
         pdata = host->pdev->dev.platform_data;
 
@@ -1970,12 +1970,15 @@ static void atmci_configure_dma(struct atmel_mci *host)
                 host->dma.chan =
                         dma_request_channel(mask, atmci_filter, pdata->dma_slave);
         }
-        if (!host->dma.chan)
-                dev_notice(&host->pdev->dev, "DMA not available, using PIO\n");
-        else
+        if (!host->dma.chan) {
+                dev_warn(&host->pdev->dev, "no DMA channel available\n");
+                return false;
+        } else {
                 dev_info(&host->pdev->dev,
                                         "Using %s for DMA transfers\n",
                                         dma_chan_name(host->dma.chan));
+                return true;
+        }
 }
 
 static inline unsigned int atmci_get_version(struct atmel_mci *host)
@@ -2085,8 +2088,7 @@ static int __init atmci_probe(struct platform_device *pdev)
 
         /* Get MCI capabilities and set operations according to it */
         atmci_get_cap(host);
-        if (host->caps.has_dma) {
-                dev_info(&pdev->dev, "using DMA\n");
+        if (host->caps.has_dma && atmci_configure_dma(host)) {
                 host->prepare_data = &atmci_prepare_data_dma;
                 host->submit_data = &atmci_submit_data_dma;
                 host->stop_transfer = &atmci_stop_transfer_dma;
@@ -2096,15 +2098,12 @@ static int __init atmci_probe(struct platform_device *pdev)
                 host->submit_data = &atmci_submit_data_pdc;
                 host->stop_transfer = &atmci_stop_transfer_pdc;
         } else {
-                dev_info(&pdev->dev, "no DMA, no PDC\n");
+                dev_info(&pdev->dev, "using PIO\n");
                 host->prepare_data = &atmci_prepare_data;
                 host->submit_data = &atmci_submit_data;
                 host->stop_transfer = &atmci_stop_transfer;
         }
 
-        if (host->caps.has_dma)
-                atmci_configure_dma(host);
-
         platform_set_drvdata(pdev, host);
 
         /* We need at least one slot to succeed */
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 0d955ffaf44e..11e589cd8233 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -1271,12 +1271,13 @@ static int __devinit mmci_probe(struct amba_device *dev,
         /*
          * Block size can be up to 2048 bytes, but must be a power of two.
          */
-        mmc->max_blk_size = 2048;
+        mmc->max_blk_size = 1 << 11;
 
         /*
-         * No limit on the number of blocks transferred.
+         * Limit the number of blocks transferred so that we don't overflow
+         * the maximum request size.
          */
-        mmc->max_blk_count = mmc->max_req_size;
+        mmc->max_blk_count = mmc->max_req_size >> 11;
 
         spin_lock_init(&host->lock);
 
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d601e41af282..0be4e2013632 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -269,8 +269,9 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
                 imx_data->scratchpad = val;
                 return;
         case SDHCI_COMMAND:
-                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION)
-                        && (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
+                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION ||
+                     host->cmd->opcode == MMC_SET_BLOCK_COUNT) &&
+                    (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
                         val |= SDHCI_CMD_ABORTCMD;
 
                 if (is_imx6q_usdhc(imx_data)) {
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index 0a4fc62a381d..c998e1afebc6 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -978,7 +978,7 @@ static void cfhsi_setup(struct net_device *dev)
         dev->netdev_ops = &cfhsi_ops;
         dev->type = ARPHRD_CAIF;
         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
-        dev->mtu = CFHSI_MAX_PAYLOAD_SZ;
+        dev->mtu = CFHSI_MAX_CAIF_FRAME_SZ;
         dev->tx_queue_len = 0;
         dev->destructor = free_netdev;
         skb_queue_head_init(&cfhsi->qhead);
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 04a3f1b756a8..192b0d118df4 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -95,11 +95,16 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
         spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
 }
 
+static int sja1000_is_absent(struct sja1000_priv *priv)
+{
+        return (priv->read_reg(priv, REG_MOD) == 0xFF);
+}
+
 static int sja1000_probe_chip(struct net_device *dev)
 {
         struct sja1000_priv *priv = netdev_priv(dev);
 
-        if (priv->reg_base && (priv->read_reg(priv, 0) == 0xFF)) {
+        if (priv->reg_base && sja1000_is_absent(priv)) {
                 printk(KERN_INFO "%s: probing @0x%lX failed\n",
                        DRV_NAME, dev->base_addr);
                 return 0;
@@ -493,6 +498,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
         while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
                 n++;
                 status = priv->read_reg(priv, REG_SR);
+                /* check for absent controller due to hw unplug */
+                if (status == 0xFF && sja1000_is_absent(priv))
+                        return IRQ_NONE;
 
                 if (isrc & IRQ_WUI)
                         dev_warn(dev->dev.parent, "wakeup interrupt\n");
@@ -509,6 +517,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                         while (status & SR_RBS) {
                                 sja1000_rx(dev);
                                 status = priv->read_reg(priv, REG_SR);
+                                /* check for absent controller */
+                                if (status == 0xFF && sja1000_is_absent(priv))
+                                        return IRQ_NONE;
                         }
                 }
                 if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index b8591246eb4c..47a9bb2c813c 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1710,7 +1710,7 @@ static irqreturn_t atl1c_intr(int irq, void *data)
                                         "atl1c hardware error (status = 0x%x)\n",
                                         status & ISR_ERROR);
                         /* reset MAC */
-                        adapter->work_event |= ATL1C_WORK_EVENT_RESET;
+                        set_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event);
                         schedule_work(&adapter->common_task);
                         return IRQ_HANDLED;
                 }
@@ -2244,10 +2244,6 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb,
                         dev_info(&adapter->pdev->dev, "tx locked\n");
                 return NETDEV_TX_LOCKED;
         }
-        if (skb->mark == 0x01)
-                type = atl1c_trans_high;
-        else
-                type = atl1c_trans_normal;
 
         if (atl1c_tpd_avail(adapter, type) < tpd_req) {
                 /* no enough descriptor, just stop queue */
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 3fb66d09ece5..cab87456a34a 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2339,7 +2339,7 @@ static inline int __init b44_pci_init(void)
         return err;
 }
 
-static inline void __exit b44_pci_exit(void)
+static inline void b44_pci_exit(void)
 {
 #ifdef CONFIG_B44_PCI
         ssb_pcihost_unregister(&b44_pci_driver);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 7aee46983be4..99389c8dda21 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1934,7 +1934,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
         }
 
         if (bp->port.pmf)
-                bnx2x_update_drv_flags(bp, DRV_FLAGS_DCB_CONFIGURED, 0);
+                bnx2x_update_drv_flags(bp, 1 << DRV_FLAGS_DCB_CONFIGURED, 0);
         else
                 bnx2x__link_status_update(bp);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index bf27c54ff2e0..4f40f7d7d8c6 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -1179,10 +1179,16 @@ static inline int bnx2x_alloc_rx_bds(struct bnx2x_fastpath *fp,
  */
 static inline u8 bnx2x_stats_id(struct bnx2x_fastpath *fp)
 {
-        if (!CHIP_IS_E1x(fp->bp))
+        struct bnx2x *bp = fp->bp;
+        if (!CHIP_IS_E1x(bp)) {
+#ifdef BCM_CNIC
+                /* there are special statistics counters for FCoE 136..140 */
+                if (IS_FCOE_FP(fp))
+                        return bp->cnic_base_cl_id + (bp->pf_num >> 1);
+#endif
                 return fp->cl_id;
-        else
-                return fp->cl_id + BP_PORT(fp->bp) * FP_SB_MAX_E1x;
+        }
+        return fp->cl_id + BP_PORT(bp) * FP_SB_MAX_E1x;
 }
 
 static inline void bnx2x_init_vlan_mac_fp_objs(struct bnx2x_fastpath *fp,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index 5051cf3deb20..6d82ade4c31c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -735,7 +735,9 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
                                                  bp->dcbx_error);
 
                         /* mark DCBX result for PMF migration */
-                        bnx2x_update_drv_flags(bp, DRV_FLAGS_DCB_CONFIGURED, 1);
+                        bnx2x_update_drv_flags(bp,
+                                               1 << DRV_FLAGS_DCB_CONFIGURED,
+                                               1);
 #ifdef BCM_DCBNL
                         /*
                          * Add new app tlvs to dcbnl
@@ -1020,7 +1022,7 @@ void bnx2x_dcbx_init(struct bnx2x *bp)
                 DP(NETIF_MSG_LINK, "dcbx_lldp_params_offset 0x%x\n",
                    dcbx_lldp_params_offset);
 
-                bnx2x_update_drv_flags(bp, DRV_FLAGS_DCB_CONFIGURED, 0);
+                bnx2x_update_drv_flags(bp, 1 << DRV_FLAGS_DCB_CONFIGURED, 0);
 
                 if (SHMEM_LLDP_DCBX_PARAMS_NONE != dcbx_lldp_params_offset) {
                         bnx2x_dcbx_admin_mib_updated_params(bp,
@@ -1857,7 +1859,7 @@ void bnx2x_dcbx_pmf_update(struct bnx2x *bp)
          * read it from shmem and update bp and netdev accordingly
          */
         if (SHMEM2_HAS(bp, drv_flags) &&
-           GET_FLAGS(SHMEM2_RD(bp, drv_flags), DRV_FLAGS_DCB_CONFIGURED)) {
+           GET_FLAGS(SHMEM2_RD(bp, drv_flags), 1 << DRV_FLAGS_DCB_CONFIGURED)) {
                 /* Read neg results if dcbx is in the FW */
                 if (bnx2x_dcbx_read_shmem_neg_results(bp))
                         return;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 254521319150..b69f8762b339 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -10824,38 +10824,36 @@ do {									\
 
 int bnx2x_init_firmware(struct bnx2x *bp)
 {
+        const char *fw_file_name;
         struct bnx2x_fw_file_hdr *fw_hdr;
         int rc;
 
+        if (bp->firmware)
+                return 0;
 
-        if (!bp->firmware) {
-                const char *fw_file_name;
-
-                if (CHIP_IS_E1(bp))
-                        fw_file_name = FW_FILE_NAME_E1;
-                else if (CHIP_IS_E1H(bp))
-                        fw_file_name = FW_FILE_NAME_E1H;
-                else if (!CHIP_IS_E1x(bp))
-                        fw_file_name = FW_FILE_NAME_E2;
-                else {
-                        BNX2X_ERR("Unsupported chip revision\n");
-                        return -EINVAL;
-                }
-                BNX2X_DEV_INFO("Loading %s\n", fw_file_name);
+        if (CHIP_IS_E1(bp))
+                fw_file_name = FW_FILE_NAME_E1;
+        else if (CHIP_IS_E1H(bp))
+                fw_file_name = FW_FILE_NAME_E1H;
+        else if (!CHIP_IS_E1x(bp))
+                fw_file_name = FW_FILE_NAME_E2;
+        else {
+                BNX2X_ERR("Unsupported chip revision\n");
+                return -EINVAL;
+        }
+        BNX2X_DEV_INFO("Loading %s\n", fw_file_name);
 
-                rc = request_firmware(&bp->firmware, fw_file_name,
-                                      &bp->pdev->dev);
-                if (rc) {
-                        BNX2X_ERR("Can't load firmware file %s\n",
-                                  fw_file_name);
-                        goto request_firmware_exit;
-                }
+        rc = request_firmware(&bp->firmware, fw_file_name, &bp->pdev->dev);
+        if (rc) {
+                BNX2X_ERR("Can't load firmware file %s\n",
+                          fw_file_name);
+                goto request_firmware_exit;
+        }
 
-                rc = bnx2x_check_firmware(bp);
-                if (rc) {
-                        BNX2X_ERR("Corrupt firmware file %s\n", fw_file_name);
-                        goto request_firmware_exit;
-                }
+        rc = bnx2x_check_firmware(bp);
+        if (rc) {
+                BNX2X_ERR("Corrupt firmware file %s\n", fw_file_name);
+                goto request_firmware_exit;
         }
 
         fw_hdr = (struct bnx2x_fw_file_hdr *)bp->firmware->data;
@@ -10901,6 +10899,7 @@ init_ops_alloc_err:
         kfree(bp->init_data);
 request_firmware_exit:
         release_firmware(bp->firmware);
+        bp->firmware = NULL;
 
         return rc;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index cb6339c35571..94110e9ce51d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -5601,7 +5601,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp,
 
         /* Fill the ramrod data with provided parameters */
         rdata->function_mode = cpu_to_le16(start_params->mf_mode);
-        rdata->sd_vlan_tag   = start_params->sd_vlan_tag;
+        rdata->sd_vlan_tag   = cpu_to_le16(start_params->sd_vlan_tag);
         rdata->path_id       = BP_PATH(bp);
         rdata->network_cos_mode = start_params->network_cos_mode;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 1adef266fcd5..a766b25eec5f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -554,23 +554,11 @@ static void bnx2x_bmac_stats_update(struct bnx2x *bp)
                 UPDATE_STAT64(tx_stat_gtufl, tx_stat_mac_ufl);
 
                 /* collect PFC stats */
-                DIFF_64(diff.hi, new->tx_stat_gtpp_hi,
-                        pstats->pfc_frames_tx_hi,
-                        diff.lo, new->tx_stat_gtpp_lo,
-                        pstats->pfc_frames_tx_lo);
                 pstats->pfc_frames_tx_hi = new->tx_stat_gtpp_hi;
                 pstats->pfc_frames_tx_lo = new->tx_stat_gtpp_lo;
-                ADD_64(pstats->pfc_frames_tx_hi, diff.hi,
-                        pstats->pfc_frames_tx_lo, diff.lo);
 
-                DIFF_64(diff.hi, new->rx_stat_grpp_hi,
-                        pstats->pfc_frames_rx_hi,
-                        diff.lo, new->rx_stat_grpp_lo,
-                        pstats->pfc_frames_rx_lo);
                 pstats->pfc_frames_rx_hi = new->rx_stat_grpp_hi;
                 pstats->pfc_frames_rx_lo = new->rx_stat_grpp_lo;
-                ADD_64(pstats->pfc_frames_rx_hi, diff.hi,
-                        pstats->pfc_frames_rx_lo, diff.lo);
         }
 
         estats->pause_frames_received_hi =
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index dd3a0a232ea0..818a573669e6 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -3584,7 +3584,11 @@ static int cnic_get_v6_route(struct sockaddr_in6 *dst_addr,
                 fl6.flowi6_oif = dst_addr->sin6_scope_id;
 
         *dst = ip6_route_output(&init_net, NULL, &fl6);
-        if (*dst)
+        if ((*dst)->error) {
+                dst_release(*dst);
+                *dst = NULL;
+                return -ENETUNREACH;
+        } else
                 return 0;
 #endif
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a1f2e0fed78b..35c2a202d67a 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -5352,7 +5352,7 @@ static void tg3_tx(struct tg3_napi *tnapi)
                 }
         }
 
-        netdev_completed_queue(tp->dev, pkts_compl, bytes_compl);
+        netdev_tx_completed_queue(txq, pkts_compl, bytes_compl);
 
         tnapi->tx_cons = sw_idx;
 
@@ -6793,7 +6793,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         skb_tx_timestamp(skb);
-        netdev_sent_queue(tp->dev, skb->len);
+        netdev_tx_sent_queue(txq, skb->len);
 
         /* Packets are ready, update Tx producer idx local and on card. */
         tw32_tx_mbox(tnapi->prodmbox, entry);
@@ -7275,8 +7275,8 @@ static void tg3_free_rings(struct tg3 *tp)
 
                         dev_kfree_skb_any(skb);
                 }
+                netdev_tx_reset_queue(netdev_get_tx_queue(tp->dev, j));
         }
-        netdev_reset_queue(tp->dev);
 }
 
 /* Initialize tx/rx rings for packet processing.
@@ -7886,10 +7886,8 @@ static int tg3_chip_reset(struct tg3 *tp)
         return 0;
 }
 
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *,
-                                                 struct rtnl_link_stats64 *);
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *,
-                                                struct tg3_ethtool_stats *);
+static void tg3_get_nstats(struct tg3 *, struct rtnl_link_stats64 *);
+static void tg3_get_estats(struct tg3 *, struct tg3_ethtool_stats *);
 
 /* tp->lock is held. */
 static int tg3_halt(struct tg3 *tp, int kind, int silent)
@@ -7910,7 +7908,7 @@ static int tg3_halt(struct tg3 *tp, int kind, int silent)
 
         if (tp->hw_stats) {
                 /* Save the stats across chip resets... */
-                tg3_get_stats64(tp->dev, &tp->net_stats_prev),
+                tg3_get_nstats(tp, &tp->net_stats_prev),
                 tg3_get_estats(tp, &tp->estats_prev);
 
                 /* And make sure the next sample is new data */
@@ -9847,7 +9845,7 @@ static inline u64 get_stat64(tg3_stat64_t *val)
        return ((u64)val->high << 32) | ((u64)val->low);
 }
 
-static u64 calc_crc_errors(struct tg3 *tp)
+static u64 tg3_calc_crc_errors(struct tg3 *tp)
 {
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
@@ -9856,14 +9854,12 @@ static u64 calc_crc_errors(struct tg3 *tp)
              GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
                 u32 val;
 
-                spin_lock_bh(&tp->lock);
                 if (!tg3_readphy(tp, MII_TG3_TEST1, &val)) {
                         tg3_writephy(tp, MII_TG3_TEST1,
                                      val | MII_TG3_TEST1_CRC_EN);
                         tg3_readphy(tp, MII_TG3_RXR_COUNTERS, &val);
                 } else
                         val = 0;
-                spin_unlock_bh(&tp->lock);
 
                 tp->phy_crc_errors += val;
 
@@ -9877,14 +9873,13 @@ static u64 calc_crc_errors(struct tg3 *tp)
         estats->member =        old_estats->member + \
                                 get_stat64(&hw_stats->member)
 
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
-                                               struct tg3_ethtool_stats *estats)
+static void tg3_get_estats(struct tg3 *tp, struct tg3_ethtool_stats *estats)
 {
         struct tg3_ethtool_stats *old_estats = &tp->estats_prev;
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
         if (!hw_stats)
-                return old_estats;
+                return;
 
         ESTAT_ADD(rx_octets);
         ESTAT_ADD(rx_fragments);
@@ -9963,20 +9958,13 @@ static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
         ESTAT_ADD(nic_tx_threshold_hit);
 
         ESTAT_ADD(mbuf_lwm_thresh_hit);
-
-        return estats;
 }
 
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
-                                                 struct rtnl_link_stats64 *stats)
+static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats)
 {
-        struct tg3 *tp = netdev_priv(dev);
         struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev;
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
-        if (!hw_stats)
-                return old_stats;
-
         stats->rx_packets = old_stats->rx_packets +
                 get_stat64(&hw_stats->rx_ucast_packets) +
                 get_stat64(&hw_stats->rx_mcast_packets) +
@@ -10019,15 +10007,13 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
                 get_stat64(&hw_stats->tx_carrier_sense_errors);
 
         stats->rx_crc_errors = old_stats->rx_crc_errors +
-                calc_crc_errors(tp);
+                tg3_calc_crc_errors(tp);
 
         stats->rx_missed_errors = old_stats->rx_missed_errors +
                 get_stat64(&hw_stats->rx_discards);
 
         stats->rx_dropped = tp->rx_dropped;
         stats->tx_dropped = tp->tx_dropped;
-
-        return stats;
 }
 
 static inline u32 calc_crc(unsigned char *buf, int len)
@@ -15409,6 +15395,21 @@ static void __devinit tg3_init_coal(struct tg3 *tp)
         }
 }
 
+static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *stats)
+{
+        struct tg3 *tp = netdev_priv(dev);
+
+        if (!tp->hw_stats)
+                return &tp->net_stats_prev;
+
+        spin_lock_bh(&tp->lock);
+        tg3_get_nstats(tp, stats);
+        spin_unlock_bh(&tp->lock);
+
+        return stats;
+}
+
 static const struct net_device_ops tg3_netdev_ops = {
         .ndo_open               = tg3_open,
         .ndo_stop               = tg3_close,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e83d12c7bf20..9d76e59d9526 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -196,6 +196,8 @@ static DEFINE_PCI_DEVICE_TABLE(cxgb4_pci_tbl) = {
         CH_DEVICE(0x4408, 4),
         CH_DEVICE(0x4409, 4),
         CH_DEVICE(0x440a, 4),
+        CH_DEVICE(0x440d, 4),
+        CH_DEVICE(0x440e, 4),
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index e53365a71484..d963c1d57f71 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2892,6 +2892,8 @@ static struct pci_device_id cxgb4vf_pci_tbl[] = {
         CH_DEVICE(0x4808, 0),   /* T420-cx */
         CH_DEVICE(0x4809, 0),   /* T420-bt */
         CH_DEVICE(0x480a, 0),   /* T404-bt */
+        CH_DEVICE(0x480d, 0),   /* T480-cr */
+        CH_DEVICE(0x480e, 0),   /* T440-lp-cr */
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
index c2c0680a1146..ac37cacc6136 100644
--- a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
+++ b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
@@ -157,7 +157,7 @@ static inline void cq_enet_rq_desc_dec(struct cq_enet_rq_desc *desc,
                         CQ_ENET_RQ_DESC_FCOE_FC_CRC_OK) ? 1 : 0;
                 *fcoe_enc_error = (desc->flags &
                         CQ_ENET_RQ_DESC_FCOE_ENC_ERROR) ? 1 : 0;
-                *fcoe_eof = (u8)((desc->checksum_fcoe >>
+                *fcoe_eof = (u8)((le16_to_cpu(desc->checksum_fcoe) >>
                         CQ_ENET_RQ_DESC_FCOE_EOF_SHIFT) &
                         CQ_ENET_RQ_DESC_FCOE_EOF_MASK);
                 *checksum = 0;
diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index ee93a2087fe6..c52295cd05ef 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -94,7 +94,7 @@ struct enic {
         u32 rx_coalesce_usecs;
         u32 tx_coalesce_usecs;
 #ifdef CONFIG_PCI_IOV
-        u32 num_vfs;
+        u16 num_vfs;
 #endif
         struct enic_port_profile *pp;
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index ab3f67f980d8..0e4edd3b6bee 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2370,7 +2370,7 @@ static int __devinit enic_probe(struct pci_dev *pdev,
         pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_SRIOV);
         if (pos) {
                 pci_read_config_word(pdev, pos + PCI_SRIOV_TOTAL_VF,
-                        (u16 *)&enic->num_vfs);
+                        &enic->num_vfs);
                 if (enic->num_vfs) {
                         err = pci_enable_sriov(pdev, enic->num_vfs);
                         if (err) {
diff --git a/drivers/net/ethernet/cisco/enic/enic_pp.c b/drivers/net/ethernet/cisco/enic/enic_pp.c
index 22bf03a1829e..c347b6236f8f 100644
--- a/drivers/net/ethernet/cisco/enic/enic_pp.c
+++ b/drivers/net/ethernet/cisco/enic/enic_pp.c
@@ -72,7 +72,7 @@ static int enic_set_port_profile(struct enic *enic, int vf)
         struct enic_port_profile *pp;
         struct vic_provinfo *vp;
         const u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
-        const u16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
+        const __be16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
         char uuid_str[38];
         char client_mac_str[18];
         u8 *client_mac;
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 5d5fb2627184..e6893cdfd13b 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -336,7 +336,9 @@ static struct rtnl_link_stats64 *ehea_get_stats64(struct net_device *dev,
         stats->tx_bytes = tx_bytes;
         stats->rx_packets = rx_packets;
 
-        return &port->stats;
+        stats->multicast = port->stats.multicast;
+        stats->rx_errors = port->stats.rx_errors;
+        return stats;
 }
 
 static void ehea_update_stats(struct work_struct *work)
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 27d651a80f3f..55cbf65512c3 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -2328,19 +2328,11 @@ jme_change_mtu(struct net_device *netdev, int new_mtu)
                 ((new_mtu) < IPV6_MIN_MTU))
                 return -EINVAL;
 
-        if (new_mtu > 4000) {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_64QW;
-                jme_restart_rx_engine(jme);
-        } else {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_128QW;
-                jme_restart_rx_engine(jme);
-        }
 
         netdev->mtu = new_mtu;
         netdev_update_features(netdev);
 
+        jme_restart_rx_engine(jme);
         jme_reset_link(jme);
 
         return 0;
diff --git a/drivers/net/ethernet/jme.h b/drivers/net/ethernet/jme.h
index 4304072bd3c5..3efc897c9913 100644
--- a/drivers/net/ethernet/jme.h
+++ b/drivers/net/ethernet/jme.h
@@ -730,7 +730,7 @@ enum jme_rxcs_values {
         RXCS_RETRYCNT_60        = 0x00000F00,
 
         RXCS_DEFAULT            = RXCS_FIFOTHTP_128T |
-                                  RXCS_FIFOTHNP_128QW |
+                                  RXCS_FIFOTHNP_16QW |
                                   RXCS_DMAREQSZ_128B |
                                   RXCS_RETRYGAP_256ns |
                                   RXCS_RETRYCNT_32,
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 8fa41f3082cf..9129ace02560 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1036,7 +1036,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
         struct mlx4_priv *priv = mlx4_priv(dev);
         int vec = 0, err = 0, i;
 
-        spin_lock(&priv->msix_ctl.pool_lock);
+        mutex_lock(&priv->msix_ctl.pool_lock);
         for (i = 0; !vec && i < dev->caps.comp_pool; i++) {
                 if (~priv->msix_ctl.pool_bm & 1ULL << i) {
                         priv->msix_ctl.pool_bm |= 1ULL << i;
@@ -1058,7 +1058,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
                         eq_set_ci(&priv->eq_table.eq[vec], 1);
                 }
         }
-        spin_unlock(&priv->msix_ctl.pool_lock);
+        mutex_unlock(&priv->msix_ctl.pool_lock);
 
         if (vec) {
                 *vector = vec;
@@ -1079,13 +1079,13 @@ void mlx4_release_eq(struct mlx4_dev *dev, int vec)
         if (likely(i >= 0)) {
                 /*sanity check , making sure were not trying to free irq's
                   Belonging to a legacy EQ*/
-                spin_lock(&priv->msix_ctl.pool_lock);
+                mutex_lock(&priv->msix_ctl.pool_lock);
                 if (priv->msix_ctl.pool_bm & 1ULL << i) {
                         free_irq(priv->eq_table.eq[vec].irq,
                                  &priv->eq_table.eq[vec]);
                         priv->msix_ctl.pool_bm &= ~(1ULL << i);
                 }
-                spin_unlock(&priv->msix_ctl.pool_lock);
+                mutex_unlock(&priv->msix_ctl.pool_lock);
         }
 
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 678558b502fc..d498f049c74e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -531,15 +531,14 @@ int mlx4_change_port_types(struct mlx4_dev *dev,
         for (port = 0; port <  dev->caps.num_ports; port++) {
                 /* Change the port type only if the new type is different
                  * from the current, and not set to Auto */
-                if (port_types[port] != dev->caps.port_type[port + 1]) {
+                if (port_types[port] != dev->caps.port_type[port + 1])
                         change = 1;
-                        dev->caps.port_type[port + 1] = port_types[port];
-                }
         }
         if (change) {
                 mlx4_unregister_device(dev);
                 for (port = 1; port <= dev->caps.num_ports; port++) {
                         mlx4_CLOSE_PORT(dev, port);
+                        dev->caps.port_type[port] = port_types[port - 1];
                         err = mlx4_SET_PORT(dev, port);
                         if (err) {
                                 mlx4_err(dev, "Failed to set port %d, "
@@ -986,6 +985,9 @@ static int map_bf_area(struct mlx4_dev *dev)
         resource_size_t bf_len;
         int err = 0;
 
+        if (!dev->caps.bf_reg_size)
+                return -ENXIO;
+
         bf_start = pci_resource_start(dev->pdev, 2) +
                         (dev->caps.num_uars << PAGE_SHIFT);
         bf_len = pci_resource_len(dev->pdev, 2) -
@@ -1825,7 +1827,7 @@ slave_start:
                 goto err_master_mfunc;
 
         priv->msix_ctl.pool_bm = 0;
-        spin_lock_init(&priv->msix_ctl.pool_lock);
+        mutex_init(&priv->msix_ctl.pool_lock);
 
         mlx4_enable_msi_x(dev);
         if ((mlx4_is_mfunc(dev)) &&
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index c92269f8c057..28f8251561f4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -697,7 +697,7 @@ struct mlx4_sense {
 
 struct mlx4_msix_ctl {
         u64             pool_bm;
-        spinlock_t      pool_lock;
+        struct mutex    pool_lock;
 };
 
 struct mlx4_steer {
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 738f950a1ce5..fb2b36759cbf 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -151,11 +151,6 @@ static int __mlx4_qp_modify(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
                 context->log_page_size   = mtt->page_shift - MLX4_ICM_PAGE_SHIFT;
         }
 
-        port = ((context->pri_path.sched_queue >> 6) & 1) + 1;
-        if (dev->caps.port_type[port] == MLX4_PORT_TYPE_ETH)
-                context->pri_path.sched_queue = (context->pri_path.sched_queue &
-                                                0xc3);
-
         *(__be32 *) mailbox->buf = cpu_to_be32(optpar);
         memcpy(mailbox->buf + 8, context, sizeof *context);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index bfdb7af19e49..8752e6e08169 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -2255,8 +2255,7 @@ int mlx4_MODIFY_CQ_wrapper(struct mlx4_dev *dev, int slave,
 
         if (vhcr->op_modifier == 0) {
                 err = handle_resize(dev, slave, vhcr, inbox, outbox, cmd, cq);
-                if (err)
-                        goto ex_put;
+                goto ex_put;
         }
 
         err = mlx4_DMA_wrapper(dev, slave, vhcr, inbox, outbox, cmd);
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index 231176fcd2ba..2784bc706f1e 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -1545,7 +1545,7 @@ static int __devinit ks8851_probe(struct platform_device *pdev)
 
         netdev->irq = platform_get_irq(pdev, 0);
 
-        if (netdev->irq < 0) {
+        if ((int)netdev->irq < 0) {
                 err = netdev->irq;
                 goto err_get_irq;
         }
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
index 9cb5f912e489..29e23bec809c 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
@@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
                         pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
                         hw->phy.autoneg_advertised = opt.def;
                 } else {
-                        hw->phy.autoneg_advertised = AutoNeg;
-                        pch_gbe_validate_option(
-                                (int *)(&hw->phy.autoneg_advertised),
-                                &opt, adapter);
+                        int tmp = AutoNeg;
+
+                        pch_gbe_validate_option(&tmp, &opt, adapter);
+                        hw->phy.autoneg_advertised = tmp;
                 }
         }
 
@@ -495,9 +495,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                         .arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
                                          .p = fc_list } }
                 };
-                hw->mac.fc = FlowControl;
-                pch_gbe_validate_option((int *)(&hw->mac.fc),
-                                                &opt, adapter);
+                int tmp = FlowControl;
+
+                pch_gbe_validate_option(&tmp, &opt, adapter);
+                hw->mac.fc = tmp;
         }
 
         pch_gbe_check_copper_options(adapter);
diff --git a/drivers/net/ethernet/packetengines/Kconfig b/drivers/net/ethernet/packetengines/Kconfig
index b97132d9dff0..8f29feb35548 100644
--- a/drivers/net/ethernet/packetengines/Kconfig
+++ b/drivers/net/ethernet/packetengines/Kconfig
@@ -4,6 +4,7 @@
 
 config NET_PACKET_ENGINE
         bool "Packet Engine devices"
+        default y
         depends on PCI
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index 7931531c3a40..e61560e16385 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -3017,7 +3017,6 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 (void __iomem *)port_regs;
         u32 delay = 10;
         int status = 0;
-        unsigned long hw_flags = 0;
 
         if (ql_mii_setup(qdev))
                 return -1;
@@ -3228,9 +3227,9 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 value = ql_read_page0_reg(qdev, &port_regs->portStatus);
                 if (value & PORT_STATUS_IC)
                         break;
-                spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
+                spin_unlock_irq(&qdev->hw_lock);
                 msleep(500);
-                spin_lock_irqsave(&qdev->hw_lock, hw_flags);
+                spin_lock_irq(&qdev->hw_lock);
         } while (--delay);
 
         if (delay == 0) {
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 7a0c800b50ad..bbacb3741ec0 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3781,12 +3781,20 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
 
 static void rtl_hw_jumbo_enable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
         rtl_generic_op(tp, tp->jumbo_ops.enable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void rtl_hw_jumbo_disable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
         rtl_generic_op(tp, tp->jumbo_ops.disable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
@@ -6186,6 +6194,9 @@ static void rtl_shutdown(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct rtl8169_private *tp = netdev_priv(dev);
+        struct device *d = &pdev->dev;
+
+        pm_runtime_get_sync(d);
 
         rtl8169_net_suspend(dev);
 
@@ -6207,6 +6218,8 @@ static void rtl_shutdown(struct pci_dev *pdev)
                 pci_wake_from_d3(pdev, true);
                 pci_set_power_state(pdev, PCI_D3hot);
         }
+
+        pm_runtime_put_noidle(d);
 }
 
 static struct pci_driver rtl8169_pci_driver = {
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index aca349861767..fc52fca74193 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -156,11 +156,10 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue *rx_queue)
                 if (unlikely(!skb))
                         return -ENOMEM;
 
-                /* Adjust the SKB for padding and checksum */
+                /* Adjust the SKB for padding */
                 skb_reserve(skb, NET_IP_ALIGN);
                 rx_buf->len = skb_len - NET_IP_ALIGN;
                 rx_buf->is_page = false;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                 rx_buf->dma_addr = pci_map_single(efx->pci_dev,
                                                   skb->data, rx_buf->len,
@@ -496,6 +495,7 @@ static void efx_rx_packet_gro(struct efx_channel *channel,
 
                 EFX_BUG_ON_PARANOID(!checksummed);
                 rx_buf->u.skb = NULL;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                 gro_result = napi_gro_receive(napi, skb);
         }
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 4fa0bcb25dfc..4b2f54565f64 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1009,7 +1009,7 @@ static void emac_rx_handler(void *token, int len, int status)
         int                     ret;
 
         /* free and bail if we are shutting down */
-        if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) {
+        if (unlikely(!netif_running(ndev))) {
                 dev_kfree_skb_any(skb);
                 return;
         }
@@ -1038,7 +1038,9 @@ static void emac_rx_handler(void *token, int len, int status)
 recycle:
         ret = cpdma_chan_submit(priv->rxchan, skb, skb->data,
                         skb_tailroom(skb), GFP_KERNEL);
-        if (WARN_ON(ret < 0))
+
+        WARN_ON(ret == -ENOMEM);
+        if (unlikely(ret < 0))
                 dev_kfree_skb_any(skb);
 }
 
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 466c58a7353d..610860f28968 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -166,7 +166,7 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net)
 
                 dev_kfree_skb(skb);
                 net->stats.tx_dropped++;
-                return NETDEV_TX_BUSY;
+                return NETDEV_TX_OK;
         }
 
         packet->extension = (void *)(unsigned long)packet +
@@ -226,7 +226,7 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net)
                 dev_kfree_skb_any(skb);
         }
 
-        return ret ? NETDEV_TX_BUSY : NETDEV_TX_OK;
+        return NETDEV_TX_OK;
 }
 
 /*
@@ -313,7 +313,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
 static void netvsc_get_drvinfo(struct net_device *net,
                                struct ethtool_drvinfo *info)
 {
-        strcpy(info->driver, "hv_netvsc");
+        strcpy(info->driver, KBUILD_MODNAME);
         strcpy(info->version, HV_DRV_VERSION);
         strcpy(info->fw_version, "N/A");
 }
@@ -485,7 +485,7 @@ MODULE_DEVICE_TABLE(vmbus, id_table);
 
 /* The one and only one */
 static struct  hv_driver netvsc_drv = {
-        .name = "netvsc",
+        .name = KBUILD_MODNAME,
         .id_table = id_table,
         .probe = netvsc_probe,
         .remove = netvsc_remove,
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index c81f136ae670..0856e1b7a849 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -30,16 +30,16 @@
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 
-MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IC1001 PHY drivers");
+MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IP101G/IC1001 PHY drivers");
 MODULE_AUTHOR("Michael Barkowski");
 MODULE_LICENSE("GPL");
 
-/* IP101A/IP1001 */
-#define IP10XX_SPEC_CTRL_STATUS         16  /* Spec. Control Register */
-#define IP1001_SPEC_CTRL_STATUS_2       20  /* IP1001 Spec. Control Reg 2 */
-#define IP1001_PHASE_SEL_MASK           3 /* IP1001 RX/TXPHASE_SEL */
-#define IP1001_APS_ON                   11  /* IP1001 APS Mode  bit */
-#define IP101A_APS_ON                   2   /* IP101A APS Mode bit */
+/* IP101A/G - IP1001 */
+#define IP10XX_SPEC_CTRL_STATUS         16      /* Spec. Control Register */
+#define IP1001_SPEC_CTRL_STATUS_2       20      /* IP1001 Spec. Control Reg 2 */
+#define IP1001_PHASE_SEL_MASK           3       /* IP1001 RX/TXPHASE_SEL */
+#define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
+#define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
 
 static int ip175c_config_init(struct phy_device *phydev)
 {
@@ -98,20 +98,24 @@ static int ip175c_config_init(struct phy_device *phydev)
 
 static int ip1xx_reset(struct phy_device *phydev)
 {
-        int err, bmcr;
+        int bmcr;
 
         /* Software Reset PHY */
         bmcr = phy_read(phydev, MII_BMCR);
+        if (bmcr < 0)
+                return bmcr;
         bmcr |= BMCR_RESET;
-        err = phy_write(phydev, MII_BMCR, bmcr);
-        if (err < 0)
-                return err;
+        bmcr = phy_write(phydev, MII_BMCR, bmcr);
+        if (bmcr < 0)
+                return bmcr;
 
         do {
                 bmcr = phy_read(phydev, MII_BMCR);
+                if (bmcr < 0)
+                        return bmcr;
         } while (bmcr & BMCR_RESET);
 
-        return err;
+        return 0;
 }
 
 static int ip1001_config_init(struct phy_device *phydev)
@@ -124,7 +128,10 @@ static int ip1001_config_init(struct phy_device *phydev)
 
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP1001_SPEC_CTRL_STATUS_2);
+        if (c < 0)
+                return c;
         c |= IP1001_APS_ON;
+        c = phy_write(phydev, IP1001_SPEC_CTRL_STATUS_2, c);
         if (c < 0)
                 return c;
 
@@ -132,14 +139,19 @@ static int ip1001_config_init(struct phy_device *phydev)
                 /* Additional delay (2ns) used to adjust RX clock phase
                  * at RGMII interface */
                 c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
+                if (c < 0)
+                        return c;
+
                 c |= IP1001_PHASE_SEL_MASK;
                 c = phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
+                if (c < 0)
+                        return c;
         }
 
-        return c;
+        return 0;
 }
 
-static int ip101a_config_init(struct phy_device *phydev)
+static int ip101a_g_config_init(struct phy_device *phydev)
 {
         int c;
 
@@ -149,7 +161,7 @@ static int ip101a_config_init(struct phy_device *phydev)
 
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
-        c |= IP101A_APS_ON;
+        c |= IP101A_G_APS_ON;
         return c;
 }
 
@@ -191,6 +203,7 @@ static struct phy_driver ip1001_driver = {
         .phy_id_mask    = 0x0ffffff0,
         .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
+        .flags          = PHY_HAS_INTERRUPT,
         .config_init    = &ip1001_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
@@ -199,13 +212,14 @@ static struct phy_driver ip1001_driver = {
         .driver         = { .owner = THIS_MODULE,},
 };
 
-static struct phy_driver ip101a_driver = {
+static struct phy_driver ip101a_g_driver = {
         .phy_id         = 0x02430c54,
-        .name           = "ICPlus IP101A",
+        .name           = "ICPlus IP101A/G",
         .phy_id_mask    = 0x0ffffff0,
         .features       = PHY_BASIC_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
-        .config_init    = &ip101a_config_init,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &ip101a_g_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
         .suspend        = genphy_suspend,
@@ -221,7 +235,7 @@ static int __init icplus_init(void)
         if (ret < 0)
                 return -ENODEV;
 
-        ret = phy_driver_register(&ip101a_driver);
+        ret = phy_driver_register(&ip101a_g_driver);
         if (ret < 0)
                 return -ENODEV;
 
@@ -231,7 +245,7 @@ static int __init icplus_init(void)
 static void __exit icplus_exit(void)
 {
         phy_driver_unregister(&ip1001_driver);
-        phy_driver_unregister(&ip101a_driver);
+        phy_driver_unregister(&ip101a_g_driver);
         phy_driver_unregister(&ip175c_driver);
 }
 
@@ -241,6 +255,7 @@ module_exit(icplus_exit);
 static struct mdio_device_id __maybe_unused icplus_tbl[] = {
         { 0x02430d80, 0x0ffffff0 },
         { 0x02430d90, 0x0ffffff0 },
+        { 0x02430c54, 0x0ffffff0 },
         { }
 };
 
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index edfa15d2e795..486b4048850d 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2024,14 +2024,22 @@ ppp_mp_reconstruct(struct ppp *ppp)
                         continue;
                 }
                 if (PPP_MP_CB(p)->sequence != seq) {
+                        u32 oldseq;
                         /* Fragment `seq' is missing.  If it is after
                            minseq, it might arrive later, so stop here. */
                         if (seq_after(seq, minseq))
                                 break;
                         /* Fragment `seq' is lost, keep going. */
                         lost = 1;
+                        oldseq = seq;
                         seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?
                                 minseq + 1: PPP_MP_CB(p)->sequence;
+
+                        if (ppp->debug & 1)
+                                netdev_printk(KERN_DEBUG, ppp->dev,
+                                              "lost frag %u..%u\n",
+                                              oldseq, seq-1);
+
                         goto again;
                 }
 
@@ -2076,6 +2084,10 @@ ppp_mp_reconstruct(struct ppp *ppp)
                         struct sk_buff *tmp2;
 
                         skb_queue_reverse_walk_from_safe(list, p, tmp2) {
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
                                 __skb_unlink(p, list);
                                 kfree_skb(p);
                         }
@@ -2091,6 +2103,17 @@ ppp_mp_reconstruct(struct ppp *ppp)
                 /* If we have discarded any fragments,
                    signal a receive error. */
                 if (PPP_MP_CB(head)->sequence != ppp->nextseq) {
+                        skb_queue_walk_safe(list, p, tmp) {
+                                if (p == head)
+                                        break;
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
+                                __skb_unlink(p, list);
+                                kfree_skb(p);
+                        }
+
                         if (ppp->debug & 1)
                                 netdev_printk(KERN_DEBUG, ppp->dev,
                                               "  missed pkts %u..%u\n",
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 93c5d72711b0..2d7601dd6660 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -359,7 +359,7 @@ static void tun_free_netdev(struct net_device *dev)
 {
         struct tun_struct *tun = netdev_priv(dev);
 
-        sock_put(tun->socket.sk);
+        sk_release_kernel(tun->socket.sk);
 }
 
 /* Net device open. */
@@ -980,10 +980,18 @@ static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
         return ret;
 }
 
+static int tun_release(struct socket *sock)
+{
+        if (sock->sk)
+                sock_put(sock->sk);
+        return 0;
+}
+
 /* Ops structure to mimic raw sockets with tun */
 static const struct proto_ops tun_socket_ops = {
         .sendmsg = tun_sendmsg,
         .recvmsg = tun_recvmsg,
+        .release = tun_release,
 };
 
 static struct proto tun_proto = {
@@ -1110,10 +1118,11 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
 
                 err = -ENOMEM;
-                sk = sk_alloc(net, AF_UNSPEC, GFP_KERNEL, &tun_proto);
+                sk = sk_alloc(&init_net, AF_UNSPEC, GFP_KERNEL, &tun_proto);
                 if (!sk)
                         goto err_free_dev;
 
+                sk_change_net(sk, net);
                 tun->socket.wq = &tun->wq;
                 init_waitqueue_head(&tun->wq.wait);
                 tun->socket.ops = &tun_socket_ops;
@@ -1174,7 +1183,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
         return 0;
 
  err_free_sk:
-        sock_put(sk);
+        tun_free_netdev(dev);
  err_free_dev:
         free_netdev(dev);
  failed:
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 8e84f5bdd6ca..d6da5eed5453 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1599,6 +1599,10 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x6189, 0x182d),
         .driver_info =  (unsigned long) &ax8817x_info,
 }, {
+        // Sitecom LN-031 "USB 2.0 10/100/1000 Ethernet adapter"
+        USB_DEVICE (0x0df6, 0x0056),
+        .driver_info =  (unsigned long) &ax88178_info,
+}, {
         // corega FEther USB2-TX
         USB_DEVICE (0x07aa, 0x0017),
         .driver_info =  (unsigned long) &ax8817x_info,
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 41a61efc331e..90a30026a931 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -573,6 +573,13 @@ static const struct usb_device_id	products [] = {
         .driver_info = 0,
 },
 
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info            = 0,
+},
+
 /*
  * WHITELIST!!!
  *
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 304fe78ff60e..e1324b4a0f66 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1632,7 +1632,7 @@ static int hso_get_count(struct tty_struct *tty,
         struct hso_serial *serial = get_serial_by_tty(tty);
         struct hso_tiocmget  *tiocmget = serial->tiocmget;
 
-        memset(&icount, 0, sizeof(struct serial_icounter_struct));
+        memset(icount, 0, sizeof(struct serial_icounter_struct));
 
         if (!tiocmget)
                  return -ENOENT;
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index fae0fbd8bc88..59681f01a54e 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -328,13 +328,13 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
         unsigned long           lockflags;
         size_t                  size = dev->rx_urb_size;
 
-        if ((skb = alloc_skb (size + NET_IP_ALIGN, flags)) == NULL) {
+        skb = __netdev_alloc_skb_ip_align(dev->net, size, flags);
+        if (!skb) {
                 netif_dbg(dev, rx_err, dev->net, "no rx skb\n");
                 usbnet_defer_kevent (dev, EVENT_RX_MEMORY);
                 usb_free_urb (urb);
                 return -ENOMEM;
         }
-        skb_reserve (skb, NET_IP_ALIGN);
 
         entry = (struct skb_data *) skb->cb;
         entry->urb = urb;
@@ -589,6 +589,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
                 entry = (struct skb_data *) skb->cb;
                 urb = entry->urb;
 
+                spin_unlock_irqrestore(&q->lock, flags);
                 // during some PM-driven resume scenarios,
                 // these (async) unlinks complete immediately
                 retval = usb_unlink_urb (urb);
@@ -596,6 +597,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
                         netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
                 else
                         count++;
+                spin_lock_irqsave(&q->lock, flags);
         }
         spin_unlock_irqrestore (&q->lock, flags);
         return count;
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index f701d4127087..c3197ce0e2ad 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -316,6 +316,11 @@ static const struct usb_device_id	products [] = {
         ZAURUS_MASTER_INTERFACE,
         .driver_info = ZAURUS_PXA_INFO,
 }, {
+        /* C-750/C-760/C-860/SL-C3000 PDA in MDLM mode */
+        USB_DEVICE_AND_INTERFACE_INFO(0x04DD, 0x9031, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+}, {
         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
                  | USB_DEVICE_ID_MATCH_DEVICE,
         .idVendor               = 0x04DD,
@@ -349,6 +354,13 @@ static const struct usb_device_id	products [] = {
         ZAURUS_MASTER_INTERFACE,
         .driver_info = OLYMPUS_MXL_INFO,
 },
+
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+},
         { },            // END
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index de7fc345148a..756c0f5565a5 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -830,21 +830,16 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                                         ctx->l4_hdr_size = ((struct tcphdr *)
                                            skb_transport_header(skb))->doff * 4;
                                 else if (iph->protocol == IPPROTO_UDP)
-                                        /*
-                                         * Use tcp header size so that bytes to
-                                         * be copied are more than required by
-                                         * the device.
-                                         */
                                         ctx->l4_hdr_size =
-                                                        sizeof(struct tcphdr);
+                                                        sizeof(struct udphdr);
                                 else
                                         ctx->l4_hdr_size = 0;
                         } else {
                                 /* for simplicity, don't copy L4 headers */
                                 ctx->l4_hdr_size = 0;
                         }
-                        ctx->copy_size = ctx->eth_ip_hdr_size +
-                                         ctx->l4_hdr_size;
+                        ctx->copy_size = min(ctx->eth_ip_hdr_size +
+                                         ctx->l4_hdr_size, skb->len);
                 } else {
                         ctx->eth_ip_hdr_size = 0;
                         ctx->l4_hdr_size = 0;
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index ed54797db191..fc46a81ad538 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -70,10 +70,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.1.18.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.1.29.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01011200
+#define VMXNET3_DRIVER_VERSION_NUM      0x01011D00
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wimax/i2400m/netdev.c b/drivers/net/wimax/i2400m/netdev.c
index 64a110604ad3..63e4b709efa9 100644
--- a/drivers/net/wimax/i2400m/netdev.c
+++ b/drivers/net/wimax/i2400m/netdev.c
@@ -367,38 +367,28 @@ netdev_tx_t i2400m_hard_start_xmit(struct sk_buff *skb,
 {
         struct i2400m *i2400m = net_dev_to_i2400m(net_dev);
         struct device *dev = i2400m_dev(i2400m);
-        int result;
+        int result = -1;
 
         d_fnstart(3, dev, "(skb %p net_dev %p)\n", skb, net_dev);
-        if (skb_header_cloned(skb)) {
-                /*
-                 * Make tcpdump/wireshark happy -- if they are
-                 * running, the skb is cloned and we will overwrite
-                 * the mac fields in i2400m_tx_prep_header. Expand
-                 * seems to fix this...
-                 */
-                result = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
-                if (result) {
-                        result = NETDEV_TX_BUSY;
-                        goto error_expand;
-                }
-        }
+
+        if (skb_header_cloned(skb) && 
+            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+                goto drop;
 
         if (i2400m->state == I2400M_SS_IDLE)
                 result = i2400m_net_wake_tx(i2400m, net_dev, skb);
         else
                 result = i2400m_net_tx(i2400m, net_dev, skb);
-        if (result <  0)
+        if (result <  0) {
+drop:
                 net_dev->stats.tx_dropped++;
-        else {
+        } else {
                 net_dev->stats.tx_packets++;
                 net_dev->stats.tx_bytes += skb->len;
         }
-        result = NETDEV_TX_OK;
-error_expand:
-        kfree_skb(skb);
+        dev_kfree_skb(skb);
         d_fnend(3, dev, "(skb %p net_dev %p) = %d\n", skb, net_dev, result);
-        return result;
+        return NETDEV_TX_OK;
 }
 
 
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index f901a17f76ba..86a891f93fc9 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -489,8 +489,6 @@ static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
         ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
-        ATH_ALLOC_BANK(ah->addac5416_21,
-                       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
         ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
 
         return 0;
@@ -519,7 +517,6 @@ static void ar5008_hw_rf_free_ext_banks(struct ath_hw *ah)
         ATH_FREE_BANK(ah->analogBank6Data);
         ATH_FREE_BANK(ah->analogBank6TPCData);
         ATH_FREE_BANK(ah->analogBank7Data);
-        ATH_FREE_BANK(ah->addac5416_21);
         ATH_FREE_BANK(ah->bank6Temp);
 
 #undef ATH_FREE_BANK
@@ -805,27 +802,7 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         if (ah->eep_ops->set_addac)
                 ah->eep_ops->set_addac(ah, chan);
 
-        if (AR_SREV_5416_22_OR_LATER(ah)) {
-                REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
-        } else {
-                struct ar5416IniArray temp;
-                u32 addacSize =
-                        sizeof(u32) * ah->iniAddac.ia_rows *
-                        ah->iniAddac.ia_columns;
-
-                /* For AR5416 2.0/2.1 */
-                memcpy(ah->addac5416_21,
-                       ah->iniAddac.ia_array, addacSize);
-
-                /* override CLKDRV value at [row, column] = [31, 1] */
-                (ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
-
-                temp.ia_array = ah->addac5416_21;
-                temp.ia_columns = ah->iniAddac.ia_columns;
-                temp.ia_rows = ah->iniAddac.ia_rows;
-                REG_WRITE_ARRAY(&temp, 1, regWrites);
-        }
-
+        REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
         REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_INTERNAL_ADDAC);
 
         ENABLE_REGWRITE_BUFFER(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 11f192a1ceb7..d190411ac8f5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -180,6 +180,25 @@ static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
                 INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac,
                                ARRAY_SIZE(ar5416Addac), 2);
         }
+
+        /* iniAddac needs to be modified for these chips */
+        if (AR_SREV_9160(ah) || !AR_SREV_5416_22_OR_LATER(ah)) {
+                struct ar5416IniArray *addac = &ah->iniAddac;
+                u32 size = sizeof(u32) * addac->ia_rows * addac->ia_columns;
+                u32 *data;
+
+                data = kmalloc(size, GFP_KERNEL);
+                if (!data)
+                        return;
+
+                memcpy(data, addac->ia_array, size);
+                addac->ia_array = data;
+
+                if (!AR_SREV_5416_22_OR_LATER(ah)) {
+                        /* override CLKDRV value */
+                        INI_RA(addac, 31,1) = 0;
+                }
+        }
 }
 
 /* Support for Japan ch.14 (2484) spread */
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 6a29004a71b0..c8261d4fc780 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -940,7 +940,6 @@ struct ath_hw {
         u32 *analogBank6Data;
         u32 *analogBank6TPCData;
         u32 *analogBank7Data;
-        u32 *addac5416_21;
         u32 *bank6Temp;
 
         u8 txpower_limit;
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 635b592ad961..a427a16bb739 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1346,7 +1346,7 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
         fc = hdr->frame_control;
         for (i = 0; i < sc->hw->max_rates; i++) {
                 struct ieee80211_tx_rate *rate = &tx_info->status.rates[i];
-                if (!rate->count)
+                if (rate->idx < 0 || !rate->count)
                         break;
 
                 final_ts_idx = i;
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index d19a9ee9d057..bbc813dee983 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -1234,6 +1234,7 @@ static bool carl9170_tx_ps_drop(struct ar9170 *ar, struct sk_buff *skb)
 {
         struct ieee80211_sta *sta;
         struct carl9170_sta_info *sta_info;
+        struct ieee80211_tx_info *tx_info;
 
         rcu_read_lock();
         sta = __carl9170_get_tx_sta(ar, skb);
@@ -1241,16 +1242,18 @@ static bool carl9170_tx_ps_drop(struct ar9170 *ar, struct sk_buff *skb)
                 goto out_rcu;
 
         sta_info = (void *) sta->drv_priv;
-        if (unlikely(sta_info->sleeping)) {
-                struct ieee80211_tx_info *tx_info;
+        tx_info = IEEE80211_SKB_CB(skb);
 
+        if (unlikely(sta_info->sleeping) &&
+            !(tx_info->flags & (IEEE80211_TX_CTL_POLL_RESPONSE |
+                                IEEE80211_TX_CTL_CLEAR_PS_FILT))) {
                 rcu_read_unlock();
 
-                tx_info = IEEE80211_SKB_CB(skb);
                 if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
                         atomic_dec(&ar->tx_ampdu_upload);
 
                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+                carl9170_release_dev_space(ar, skb);
                 carl9170_tx_status(ar, skb, false);
                 return true;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 90911eec0cf5..30b58870b1b6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -1051,17 +1051,13 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                 }
                 /* either retransmit or send bar if ack not recd */
                 if (!ack_recd) {
-                        struct ieee80211_tx_rate *txrate =
-                            tx_info->status.rates;
-                        if (retry && (txrate[0].count < (int)retry_limit)) {
+                        if (retry && (ini->txretry[index] < (int)retry_limit)) {
                                 ini->txretry[index]++;
                                 ini->tx_in_transit--;
                                 /*
                                  * Use high prededence for retransmit to
                                  * give some punch
                                  */
-                                /* brcms_c_txq_enq(wlc, scb, p,
-                                 * BRCMS_PRIO_TO_PREC(tid)); */
                                 brcms_c_txq_enq(wlc, scb, p,
                                                 BRCMS_PRIO_TO_HI_PREC(tid));
                         } else {
@@ -1074,9 +1070,9 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                                     IEEE80211_TX_STAT_AMPDU_NO_BACK;
                                 skb_pull(p, D11_PHY_HDR_LEN);
                                 skb_pull(p, D11_TXH_LEN);
-                                wiphy_err(wiphy, "%s: BA Timeout, seq %d, in_"
-                                        "transit %d\n", "AMPDU status", seq,
-                                        ini->tx_in_transit);
+                                BCMMSG(wiphy,
+                                       "BA Timeout, seq %d, in_transit %d\n",
+                                       seq, ini->tx_in_transit);
                                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
                                                             p);
                         }
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 54b2d391e91a..a7dfba8d164e 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -2475,7 +2475,7 @@ il3945_bg_alive_start(struct work_struct *data)
             container_of(data, struct il_priv, alive_start.work);
 
         mutex_lock(&il->mutex);
-        if (test_bit(S_EXIT_PENDING, &il->status))
+        if (test_bit(S_EXIT_PENDING, &il->status) || il->txq == NULL)
                 goto out;
 
         il3945_alive_start(il);
diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
index 1489b1573a6a..c80eb9b31551 100644
--- a/drivers/net/wireless/iwlegacy/3945.c
+++ b/drivers/net/wireless/iwlegacy/3945.c
@@ -1870,11 +1870,12 @@ il3945_bg_reg_txpower_periodic(struct work_struct *work)
         struct il_priv *il = container_of(work, struct il_priv,
                                           _3945.thermal_periodic.work);
 
-        if (test_bit(S_EXIT_PENDING, &il->status))
-                return;
-
         mutex_lock(&il->mutex);
+        if (test_bit(S_EXIT_PENDING, &il->status) || il->txq == NULL)
+                goto out;
+
         il3945_reg_txpower_periodic(il);
+out:
         mutex_unlock(&il->mutex);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 64cf439035c3..ca78e91de86c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1240,7 +1240,7 @@ int iwlagn_suspend(struct iwl_priv *priv,
                                 .flags = CMD_SYNC,
                                 .data[0] = key_data.rsc_tsc,
                                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
-                                .len[0] = sizeof(key_data.rsc_tsc),
+                                .len[0] = sizeof(*key_data.rsc_tsc),
                         };
 
                         ret = iwl_trans_send_cmd(trans(priv), &rsc_tsc_cmd);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index 7353826095f1..e483cfa8d14e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1187,6 +1187,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
         unsigned long flags;
         struct iwl_addsta_cmd sta_cmd;
         u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
+        __le16 key_flags;
 
         /* if station isn't there, neither is the key */
         if (sta_id == IWL_INVALID_STATION)
@@ -1212,7 +1213,14 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 IWL_ERR(priv, "offset %d not used in uCode key table.\n",
                         keyconf->hw_key_idx);
 
-        sta_cmd.key.key_flags = STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
+        key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags |= STA_KEY_FLG_MAP_KEY_MSK | STA_KEY_FLG_NO_ENC |
+                     STA_KEY_FLG_INVALID;
+
+        if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                key_flags |= STA_KEY_MULTICAST_MSK;
+
+        sta_cmd.key.key_flags = key_flags;
         sta_cmd.key.key_offset = WEP_INVALID_OFFSET;
         sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
         sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index c3b6c4652cd6..2210a0f9af2d 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -841,7 +841,13 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
                 ret = mwifiex_set_rf_channel(priv, channel,
                                                 priv->adapter->channel_type);
 
-        ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);  /* Disable keys */
+        /* As this is new association, clear locally stored
+         * keys and security related flags */
+        priv->sec_info.wpa_enabled = false;
+        priv->sec_info.wpa2_enabled = false;
+        priv->wep_key_curr_index = 0;
+        priv->sec_info.encryption_mode = 0;
+        ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);
 
         if (mode == NL80211_IFTYPE_ADHOC) {
                 /* "privacy" is set only for ad-hoc mode */
@@ -886,6 +892,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
                         dev_dbg(priv->adapter->dev,
                                 "info: setting wep encryption"
                                 " with key len %d\n", sme->key_len);
+                        priv->wep_key_curr_index = sme->key_idx;
                         ret = mwifiex_set_encode(priv, sme->key, sme->key_len,
                                                         sme->key_idx, 0);
                 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index c3e1aa7c1a80..fd356b7c0476 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -426,10 +426,14 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         /*
          * If the data queue was below the threshold before the txdone
          * handler we must make sure the packet queue in the mac80211 stack
-         * is reenabled when the txdone handler has finished.
+         * is reenabled when the txdone handler has finished. This has to be
+         * serialized with rt2x00mac_tx(), otherwise we can wake up queue
+         * before it was stopped.
          */
+        spin_lock_bh(&entry->queue->tx_lock);
         if (!rt2x00queue_threshold(entry->queue))
                 rt2x00queue_unpause_queue(entry->queue);
+        spin_unlock_bh(&entry->queue->tx_lock);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_txdone);
 
@@ -1220,7 +1224,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
                 cancel_work_sync(&rt2x00dev->rxdone_work);
                 cancel_work_sync(&rt2x00dev->txdone_work);
         }
-        destroy_workqueue(rt2x00dev->workqueue);
+        if (rt2x00dev->workqueue)
+                destroy_workqueue(rt2x00dev->workqueue);
 
         /*
          * Free the tx status fifo.
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index ede3c58e6783..2df2eb6d3e06 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -152,13 +152,22 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
                 goto exit_fail;
 
+        /*
+         * Pausing queue has to be serialized with rt2x00lib_txdone(). Note
+         * we should not use spin_lock_bh variant as bottom halve was already
+         * disabled before ieee80211_xmit() call.
+         */
+        spin_lock(&queue->tx_lock);
         if (rt2x00queue_threshold(queue))
                 rt2x00queue_pause_queue(queue);
+        spin_unlock(&queue->tx_lock);
 
         return;
 
  exit_fail:
+        spin_lock(&queue->tx_lock);
         rt2x00queue_pause_queue(queue);
+        spin_unlock(&queue->tx_lock);
  exit_free_skb:
         ieee80211_free_txskb(hw, skb);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 5adfb3eab9cd..9b1b2b7a7807 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -619,6 +619,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
         else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags))
                 rt2x00queue_align_frame(skb);
 
+        /*
+         * That function must be called with bh disabled.
+         */
         spin_lock(&queue->tx_lock);
 
         if (unlikely(rt2x00queue_full(queue))) {
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index ea2bd1be2640..91a375fb6ae6 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -23,7 +23,6 @@
 #include <asm/machdep.h>
 #endif /* CONFIG_PPC */
 
-#include <asm/setup.h>
 #include <asm/page.h>
 
 char *of_fdt_get_string(struct boot_param_header *blob, u32 offset)
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 980c079e4443..483c0adcad87 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -182,7 +182,7 @@ struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
         if (!phy_id || sz < sizeof(*phy_id))
                 return NULL;
 
-        sprintf(bus_id, PHY_ID_FMT, "0", be32_to_cpu(phy_id[0]));
+        sprintf(bus_id, PHY_ID_FMT, "fixed-0", be32_to_cpu(phy_id[0]));
 
         phy = phy_connect(dev, bus_id, hndlr, 0, iface);
         return IS_ERR(phy) ? NULL : phy;
diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index a9c46cc2db37..8c33491b21fe 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -1,3 +1,5 @@
+#include <linux/prefetch.h>
+
 /**
  * iommu_fill_pdir - Insert coalesced scatter/gather chunks into the I/O Pdir.
  * @ioc: The I/O Controller.
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 1cfbf228fbb1..24f049e73952 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -500,6 +500,9 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
         int pos;
         u32 reg32;
 
+        if (aspm_disabled)
+                return 0;
+
         /*
          * Some functions in a slot might not all be PCIe functions,
          * very strange. Disable ASPM for the whole slot
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index a87e2728b2c3..64d433ec4fc6 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -328,21 +328,15 @@ static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
                         goto err1;
         }
 
-        if (ret) {
-                while (--i >= 0)
-                        soc_pcmcia_remove_one(&sinfo->skt[i]);
-                kfree(sinfo);
-                clk_put(clk);
-        } else {
-                pxa2xx_configure_sockets(&dev->dev);
-                dev_set_drvdata(&dev->dev, sinfo);
-        }
+        pxa2xx_configure_sockets(&dev->dev);
+        dev_set_drvdata(&dev->dev, sinfo);
 
         return 0;
 
 err1:
         while (--i >= 0)
                 soc_pcmcia_remove_one(&sinfo->skt[i]);
+        clk_put(clk);
         kfree(sinfo);
 err0:
         return ret;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index f995e6e2f78c..15dbd8cc445f 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -143,6 +143,30 @@ config FUJITSU_LAPTOP_DEBUG
 
           If you are not sure, say N here.
 
+config FUJITSU_TABLET
+       tristate "Fujitsu Tablet Extras"
+       depends on ACPI
+       depends on INPUT
+       ---help---
+         This is a driver for tablets built by Fujitsu:
+
+           * Lifebook P1510/P1610/P1620/Txxxx
+           * Stylistic ST5xxx
+           * Possibly other Fujitsu tablet models
+
+         It adds support for the panel buttons, docking station detection,
+         tablet/notebook mode detection for convertible and
+         orientation detection for docked slates.
+
+         If you have a Fujitsu convertible or slate, say Y or M here.
+
+config AMILO_RFKILL
+        tristate "Fujitsu-Siemens Amilo rfkill support"
+        depends on RFKILL
+        ---help---
+          This is a driver for enabling wifi on some Fujitsu-Siemens Amilo
+          laptops.
+
 config TC1100_WMI
         tristate "HP Compaq TC1100 Tablet WMI Extras (EXPERIMENTAL)"
         depends on !X86_64
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index 293a320d9faa..d328f21e9fdd 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -17,12 +17,14 @@ obj-$(CONFIG_ACER_WMI)		+= acer-wmi.o
 obj-$(CONFIG_ACERHDF)           += acerhdf.o
 obj-$(CONFIG_HP_ACCEL)          += hp_accel.o
 obj-$(CONFIG_HP_WMI)            += hp-wmi.o
+obj-$(CONFIG_AMILO_RFKILL)      += amilo-rfkill.o
 obj-$(CONFIG_TC1100_WMI)        += tc1100-wmi.o
 obj-$(CONFIG_SONY_LAPTOP)       += sony-laptop.o
 obj-$(CONFIG_IDEAPAD_LAPTOP)    += ideapad-laptop.o
 obj-$(CONFIG_THINKPAD_ACPI)     += thinkpad_acpi.o
 obj-$(CONFIG_SENSORS_HDAPS)     += hdaps.o
 obj-$(CONFIG_FUJITSU_LAPTOP)    += fujitsu-laptop.o
+obj-$(CONFIG_FUJITSU_TABLET)    += fujitsu-tablet.o
 obj-$(CONFIG_PANASONIC_LAPTOP)  += panasonic-laptop.o
 obj-$(CONFIG_INTEL_MENLOW)      += intel_menlow.o
 obj-$(CONFIG_ACPI_WMI)          += wmi.o
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index b848277171a4..1e5290b5396d 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -679,6 +679,32 @@ static acpi_status AMW0_find_mailled(void)
         return AE_OK;
 }
 
+static int AMW0_set_cap_acpi_check_device_found;
+
+static acpi_status AMW0_set_cap_acpi_check_device_cb(acpi_handle handle,
+        u32 level, void *context, void **retval)
+{
+        AMW0_set_cap_acpi_check_device_found = 1;
+        return AE_OK;
+}
+
+static const struct acpi_device_id norfkill_ids[] = {
+        { "VPC2004", 0},
+        { "IBM0068", 0},
+        { "LEN0068", 0},
+        { "", 0},
+};
+
+static int AMW0_set_cap_acpi_check_device(void)
+{
+        const struct acpi_device_id *id;
+
+        for (id = norfkill_ids; id->id[0]; id++)
+                acpi_get_devices(id->id, AMW0_set_cap_acpi_check_device_cb,
+                                NULL, NULL);
+        return AMW0_set_cap_acpi_check_device_found;
+}
+
 static acpi_status AMW0_set_capabilities(void)
 {
         struct wmab_args args;
@@ -692,7 +718,9 @@ static acpi_status AMW0_set_capabilities(void)
          * work.
          */
         if (wmi_has_guid(AMW0_GUID2)) {
-                interface->capability |= ACER_CAP_WIRELESS;
+                if ((quirks != &quirk_unknown) ||
+                    !AMW0_set_cap_acpi_check_device())
+                        interface->capability |= ACER_CAP_WIRELESS;
                 return AE_OK;
         }
 
diff --git a/drivers/platform/x86/amilo-rfkill.c b/drivers/platform/x86/amilo-rfkill.c
new file mode 100644
index 000000000000..19170bb7700b
--- /dev/null
+++ b/drivers/platform/x86/amilo-rfkill.c
@@ -0,0 +1,173 @@
+/*
+ * Support for rfkill on some Fujitsu-Siemens Amilo laptops.
+ * Copyright 2011 Ben Hutchings.
+ *
+ * Based in part on the fsam7440 driver, which is:
+ * Copyright 2005 Alejandro Vidal Mata & Javier Vidal Mata.
+ * and on the fsaa1655g driver, which is:
+ * Copyright 2006 Martin Večeřa.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/dmi.h>
+#include <linux/i8042.h>
+#include <linux/io.h>
+#include <linux/moduleparam.h>
+#include <linux/platform_device.h>
+#include <linux/rfkill.h>
+
+/*
+ * These values were obtained from disassembling and debugging the
+ * PM.exe program installed in the Fujitsu-Siemens AMILO A1655G
+ */
+#define A1655_WIFI_COMMAND      0x10C5
+#define A1655_WIFI_ON           0x25
+#define A1655_WIFI_OFF          0x45
+
+static int amilo_a1655_rfkill_set_block(void *data, bool blocked)
+{
+        u8 param = blocked ? A1655_WIFI_OFF : A1655_WIFI_ON;
+        int rc;
+
+        i8042_lock_chip();
+        rc = i8042_command(&param, A1655_WIFI_COMMAND);
+        i8042_unlock_chip();
+        return rc;
+}
+
+static const struct rfkill_ops amilo_a1655_rfkill_ops = {
+        .set_block = amilo_a1655_rfkill_set_block
+};
+
+/*
+ * These values were obtained from disassembling the PM.exe program
+ * installed in the Fujitsu-Siemens AMILO M 7440
+ */
+#define M7440_PORT1             0x118f
+#define M7440_PORT2             0x118e
+#define M7440_RADIO_ON1         0x12
+#define M7440_RADIO_ON2         0x80
+#define M7440_RADIO_OFF1        0x10
+#define M7440_RADIO_OFF2        0x00
+
+static int amilo_m7440_rfkill_set_block(void *data, bool blocked)
+{
+        u8 val1 = blocked ? M7440_RADIO_OFF1 : M7440_RADIO_ON1;
+        u8 val2 = blocked ? M7440_RADIO_OFF2 : M7440_RADIO_ON2;
+
+        outb(val1, M7440_PORT1);
+        outb(val2, M7440_PORT2);
+
+        /* Check whether the state has changed correctly */
+        if (inb(M7440_PORT1) != val1 || inb(M7440_PORT2) != val2)
+                return -EIO;
+
+        return 0;
+}
+
+static const struct rfkill_ops amilo_m7440_rfkill_ops = {
+        .set_block = amilo_m7440_rfkill_set_block
+};
+
+static const struct dmi_system_id __devinitdata amilo_rfkill_id_table[] = {
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_BOARD_NAME, "AMILO A1655"),
+                },
+                .driver_data = (void *)&amilo_a1655_rfkill_ops
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_BOARD_NAME, "AMILO M7440"),
+                },
+                .driver_data = (void *)&amilo_m7440_rfkill_ops
+        },
+        {}
+};
+
+static struct platform_device *amilo_rfkill_pdev;
+static struct rfkill *amilo_rfkill_dev;
+
+static int __devinit amilo_rfkill_probe(struct platform_device *device)
+{
+        const struct dmi_system_id *system_id =
+                dmi_first_match(amilo_rfkill_id_table);
+        int rc;
+
+        amilo_rfkill_dev = rfkill_alloc(KBUILD_MODNAME, &device->dev,
+                                        RFKILL_TYPE_WLAN,
+                                        system_id->driver_data, NULL);
+        if (!amilo_rfkill_dev)
+                return -ENOMEM;
+
+        rc = rfkill_register(amilo_rfkill_dev);
+        if (rc)
+                goto fail;
+
+        return 0;
+
+fail:
+        rfkill_destroy(amilo_rfkill_dev);
+        return rc;
+}
+
+static int amilo_rfkill_remove(struct platform_device *device)
+{
+        rfkill_unregister(amilo_rfkill_dev);
+        rfkill_destroy(amilo_rfkill_dev);
+        return 0;
+}
+
+static struct platform_driver amilo_rfkill_driver = {
+        .driver = {
+                .name   = KBUILD_MODNAME,
+                .owner  = THIS_MODULE,
+        },
+        .probe  = amilo_rfkill_probe,
+        .remove = amilo_rfkill_remove,
+};
+
+static int __init amilo_rfkill_init(void)
+{
+        int rc;
+
+        if (dmi_first_match(amilo_rfkill_id_table) == NULL)
+                return -ENODEV;
+
+        rc = platform_driver_register(&amilo_rfkill_driver);
+        if (rc)
+                return rc;
+
+        amilo_rfkill_pdev = platform_device_register_simple(KBUILD_MODNAME, -1,
+                                                            NULL, 0);
+        if (IS_ERR(amilo_rfkill_pdev)) {
+                rc = PTR_ERR(amilo_rfkill_pdev);
+                goto fail;
+        }
+
+        return 0;
+
+fail:
+        platform_driver_unregister(&amilo_rfkill_driver);
+        return rc;
+}
+
+static void __exit amilo_rfkill_exit(void)
+{
+        platform_device_unregister(amilo_rfkill_pdev);
+        platform_driver_unregister(&amilo_rfkill_driver);
+}
+
+MODULE_AUTHOR("Ben Hutchings <ben@decadent.org.uk>");
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(dmi, amilo_rfkill_id_table);
+
+module_init(amilo_rfkill_init);
+module_exit(amilo_rfkill_exit);
diff --git a/drivers/platform/x86/fujitsu-tablet.c b/drivers/platform/x86/fujitsu-tablet.c
new file mode 100644
index 000000000000..580d80a73c3a
--- /dev/null
+++ b/drivers/platform/x86/fujitsu-tablet.c
@@ -0,0 +1,478 @@
+/*
+ * Copyright (C) 2006-2012 Robert Gerlach <khnz@gmx.de>
+ * Copyright (C) 2005-2006 Jan Rychter <jan@rychter.com>
+ *
+ * You can redistribute and/or modify this program under the terms of the
+ * GNU General Public License version 2 as published by the Free Software
+ * Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General
+ * Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/bitops.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <linux/acpi.h>
+#include <linux/device.h>
+#include <linux/interrupt.h>
+#include <linux/input.h>
+#include <linux/delay.h>
+#include <linux/dmi.h>
+
+#define MODULENAME "fujitsu-tablet"
+
+#define ACPI_FUJITSU_CLASS "fujitsu"
+
+#define INVERT_TABLET_MODE_BIT      0x01
+#define FORCE_TABLET_MODE_IF_UNDOCK 0x02
+
+#define KEYMAP_LEN 16
+
+static const struct acpi_device_id fujitsu_ids[] = {
+        { .id = "FUJ02BD" },
+        { .id = "FUJ02BF" },
+        { .id = "" }
+};
+
+struct fujitsu_config {
+        unsigned short keymap[KEYMAP_LEN];
+        unsigned int quirks;
+};
+
+static unsigned short keymap_Lifebook_Tseries[KEYMAP_LEN] __initconst = {
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_SCROLLDOWN,
+        KEY_SCROLLUP,
+        KEY_DIRECTION,
+        KEY_LEFTCTRL,
+        KEY_BRIGHTNESSUP,
+        KEY_BRIGHTNESSDOWN,
+        KEY_BRIGHTNESS_ZERO,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_LEFTALT
+};
+
+static unsigned short keymap_Lifebook_U810[KEYMAP_LEN] __initconst = {
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_PROG1,
+        KEY_PROG2,
+        KEY_DIRECTION,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_UP,
+        KEY_DOWN,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_LEFTCTRL,
+        KEY_LEFTALT
+};
+
+static unsigned short keymap_Stylistic_Tseries[KEYMAP_LEN] __initconst = {
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_PRINT,
+        KEY_BACKSPACE,
+        KEY_SPACE,
+        KEY_ENTER,
+        KEY_BRIGHTNESSUP,
+        KEY_BRIGHTNESSDOWN,
+        KEY_DOWN,
+        KEY_UP,
+        KEY_SCROLLUP,
+        KEY_SCROLLDOWN,
+        KEY_LEFTCTRL,
+        KEY_LEFTALT
+};
+
+static unsigned short keymap_Stylistic_ST5xxx[KEYMAP_LEN] __initconst = {
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_RESERVED,
+        KEY_MAIL,
+        KEY_DIRECTION,
+        KEY_ESC,
+        KEY_ENTER,
+        KEY_BRIGHTNESSUP,
+        KEY_BRIGHTNESSDOWN,
+        KEY_DOWN,
+        KEY_UP,
+        KEY_SCROLLUP,
+        KEY_SCROLLDOWN,
+        KEY_LEFTCTRL,
+        KEY_LEFTALT
+};
+
+static struct {
+        struct input_dev *idev;
+        struct fujitsu_config config;
+        unsigned long prev_keymask;
+
+        char phys[21];
+
+        int irq;
+        int io_base;
+        int io_length;
+} fujitsu;
+
+static u8 fujitsu_ack(void)
+{
+        return inb(fujitsu.io_base + 2);
+}
+
+static u8 fujitsu_status(void)
+{
+        return inb(fujitsu.io_base + 6);
+}
+
+static u8 fujitsu_read_register(const u8 addr)
+{
+        outb(addr, fujitsu.io_base);
+        return inb(fujitsu.io_base + 4);
+}
+
+static void fujitsu_send_state(void)
+{
+        int state;
+        int dock, tablet_mode;
+
+        state = fujitsu_read_register(0xdd);
+
+        dock = state & 0x02;
+
+        if ((fujitsu.config.quirks & FORCE_TABLET_MODE_IF_UNDOCK) && (!dock)) {
+                tablet_mode = 1;
+        } else{
+                tablet_mode = state & 0x01;
+                if (fujitsu.config.quirks & INVERT_TABLET_MODE_BIT)
+                        tablet_mode = !tablet_mode;
+        }
+
+        input_report_switch(fujitsu.idev, SW_DOCK, dock);
+        input_report_switch(fujitsu.idev, SW_TABLET_MODE, tablet_mode);
+        input_sync(fujitsu.idev);
+}
+
+static void fujitsu_reset(void)
+{
+        int timeout = 50;
+
+        fujitsu_ack();
+
+        while ((fujitsu_status() & 0x02) && (--timeout))
+                msleep(20);
+
+        fujitsu_send_state();
+}
+
+static int __devinit input_fujitsu_setup(struct device *parent,
+                                         const char *name, const char *phys)
+{
+        struct input_dev *idev;
+        int error;
+        int i;
+
+        idev = input_allocate_device();
+        if (!idev)
+                return -ENOMEM;
+
+        idev->dev.parent = parent;
+        idev->phys = phys;
+        idev->name = name;
+        idev->id.bustype = BUS_HOST;
+        idev->id.vendor  = 0x1734;      /* Fujitsu Siemens Computer GmbH */
+        idev->id.product = 0x0001;
+        idev->id.version = 0x0101;
+
+        idev->keycode = fujitsu.config.keymap;
+        idev->keycodesize = sizeof(fujitsu.config.keymap[0]);
+        idev->keycodemax = ARRAY_SIZE(fujitsu.config.keymap);
+
+        __set_bit(EV_REP, idev->evbit);
+
+        for (i = 0; i < ARRAY_SIZE(fujitsu.config.keymap); i++)
+                if (fujitsu.config.keymap[i])
+                        input_set_capability(idev, EV_KEY, fujitsu.config.keymap[i]);
+
+        input_set_capability(idev, EV_MSC, MSC_SCAN);
+
+        input_set_capability(idev, EV_SW, SW_DOCK);
+        input_set_capability(idev, EV_SW, SW_TABLET_MODE);
+
+        input_set_capability(idev, EV_SW, SW_DOCK);
+        input_set_capability(idev, EV_SW, SW_TABLET_MODE);
+
+        error = input_register_device(idev);
+        if (error) {
+                input_free_device(idev);
+                return error;
+        }
+
+        fujitsu.idev = idev;
+        return 0;
+}
+
+static void input_fujitsu_remove(void)
+{
+        input_unregister_device(fujitsu.idev);
+}
+
+static irqreturn_t fujitsu_interrupt(int irq, void *dev_id)
+{
+        unsigned long keymask, changed;
+        unsigned int keycode;
+        int pressed;
+        int i;
+
+        if (unlikely(!(fujitsu_status() & 0x01)))
+                return IRQ_NONE;
+
+        fujitsu_send_state();
+
+        keymask  = fujitsu_read_register(0xde);
+        keymask |= fujitsu_read_register(0xdf) << 8;
+        keymask ^= 0xffff;
+
+        changed = keymask ^ fujitsu.prev_keymask;
+        if (changed) {
+                fujitsu.prev_keymask = keymask;
+
+                for_each_set_bit(i, &changed, KEYMAP_LEN) {
+                        keycode = fujitsu.config.keymap[i];
+                        pressed = keymask & changed & BIT(i);
+
+                        if (pressed)
+                                input_event(fujitsu.idev, EV_MSC, MSC_SCAN, i);
+
+                        input_report_key(fujitsu.idev, keycode, pressed);
+                        input_sync(fujitsu.idev);
+                }
+        }
+
+        fujitsu_ack();
+        return IRQ_HANDLED;
+}
+
+static int __devinit fujitsu_dmi_default(const struct dmi_system_id *dmi)
+{
+        printk(KERN_INFO MODULENAME ": %s\n", dmi->ident);
+        memcpy(fujitsu.config.keymap, dmi->driver_data,
+                        sizeof(fujitsu.config.keymap));
+        return 1;
+}
+
+static int __devinit fujitsu_dmi_stylistic(const struct dmi_system_id *dmi)
+{
+        fujitsu_dmi_default(dmi);
+        fujitsu.config.quirks |= FORCE_TABLET_MODE_IF_UNDOCK;
+        fujitsu.config.quirks |= INVERT_TABLET_MODE_BIT;
+        return 1;
+}
+
+static struct dmi_system_id dmi_ids[] __initconst = {
+        {
+                .callback = fujitsu_dmi_default,
+                .ident = "Fujitsu Siemens P/T Series",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK")
+                },
+                .driver_data = keymap_Lifebook_Tseries
+        },
+        {
+                .callback = fujitsu_dmi_default,
+                .ident = "Fujitsu Lifebook T Series",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook T")
+                },
+                .driver_data = keymap_Lifebook_Tseries
+        },
+        {
+                .callback = fujitsu_dmi_stylistic,
+                .ident = "Fujitsu Siemens Stylistic T Series",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Stylistic T")
+                },
+                .driver_data = keymap_Stylistic_Tseries
+        },
+        {
+                .callback = fujitsu_dmi_default,
+                .ident = "Fujitsu LifeBook U810",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook U810")
+                },
+                .driver_data = keymap_Lifebook_U810
+        },
+        {
+                .callback = fujitsu_dmi_stylistic,
+                .ident = "Fujitsu Siemens Stylistic ST5xxx Series",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "STYLISTIC ST5")
+                },
+                .driver_data = keymap_Stylistic_ST5xxx
+        },
+        {
+                .callback = fujitsu_dmi_stylistic,
+                .ident = "Fujitsu Siemens Stylistic ST5xxx Series",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Stylistic ST5")
+                },
+                .driver_data = keymap_Stylistic_ST5xxx
+        },
+        {
+                .callback = fujitsu_dmi_default,
+                .ident = "Unknown (using defaults)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, ""),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "")
+                },
+                .driver_data = keymap_Lifebook_Tseries
+        },
+        { NULL }
+};
+
+static acpi_status __devinit
+fujitsu_walk_resources(struct acpi_resource *res, void *data)
+{
+        switch (res->type) {
+        case ACPI_RESOURCE_TYPE_IRQ:
+                fujitsu.irq = res->data.irq.interrupts[0];
+                return AE_OK;
+
+        case ACPI_RESOURCE_TYPE_IO:
+                fujitsu.io_base = res->data.io.minimum;
+                fujitsu.io_length = res->data.io.address_length;
+                return AE_OK;
+
+        case ACPI_RESOURCE_TYPE_END_TAG:
+                if (fujitsu.irq && fujitsu.io_base)
+                        return AE_OK;
+                else
+                        return AE_NOT_FOUND;
+
+        default:
+                return AE_ERROR;
+        }
+}
+
+static int __devinit acpi_fujitsu_add(struct acpi_device *adev)
+{
+        acpi_status status;
+        int error;
+
+        if (!adev)
+                return -EINVAL;
+
+        status = acpi_walk_resources(adev->handle, METHOD_NAME__CRS,
+                        fujitsu_walk_resources, NULL);
+        if (ACPI_FAILURE(status) || !fujitsu.irq || !fujitsu.io_base)
+                return -ENODEV;
+
+        sprintf(acpi_device_name(adev), "Fujitsu %s", acpi_device_hid(adev));
+        sprintf(acpi_device_class(adev), "%s", ACPI_FUJITSU_CLASS);
+
+        snprintf(fujitsu.phys, sizeof(fujitsu.phys),
+                        "%s/input0", acpi_device_hid(adev));
+
+        error = input_fujitsu_setup(&adev->dev,
+                acpi_device_name(adev), fujitsu.phys);
+        if (error)
+                return error;
+
+        if (!request_region(fujitsu.io_base, fujitsu.io_length, MODULENAME)) {
+                input_fujitsu_remove();
+                return -EBUSY;
+        }
+
+        fujitsu_reset();
+
+        error = request_irq(fujitsu.irq, fujitsu_interrupt,
+                        IRQF_SHARED, MODULENAME, fujitsu_interrupt);
+        if (error) {
+                release_region(fujitsu.io_base, fujitsu.io_length);
+                input_fujitsu_remove();
+                return error;
+        }
+
+        return 0;
+}
+
+static int __devexit acpi_fujitsu_remove(struct acpi_device *adev, int type)
+{
+        free_irq(fujitsu.irq, fujitsu_interrupt);
+        release_region(fujitsu.io_base, fujitsu.io_length);
+        input_fujitsu_remove();
+        return 0;
+}
+
+static int acpi_fujitsu_resume(struct acpi_device *adev)
+{
+        fujitsu_reset();
+        return 0;
+}
+
+static struct acpi_driver acpi_fujitsu_driver = {
+        .name  = MODULENAME,
+        .class = "hotkey",
+        .ids   = fujitsu_ids,
+        .ops   = {
+                .add    = acpi_fujitsu_add,
+                .remove = acpi_fujitsu_remove,
+                .resume = acpi_fujitsu_resume,
+        }
+};
+
+static int __init fujitsu_module_init(void)
+{
+        int error;
+
+        dmi_check_system(dmi_ids);
+
+        error = acpi_bus_register_driver(&acpi_fujitsu_driver);
+        if (error)
+                return error;
+
+        return 0;
+}
+
+static void __exit fujitsu_module_exit(void)
+{
+        acpi_bus_unregister_driver(&acpi_fujitsu_driver);
+}
+
+module_init(fujitsu_module_init);
+module_exit(fujitsu_module_exit);
+
+MODULE_AUTHOR("Robert Gerlach <khnz@gmx.de>");
+MODULE_DESCRIPTION("Fujitsu tablet pc extras driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("2.4");
+
+MODULE_DEVICE_TABLE(acpi, fujitsu_ids);
diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
index 05be30ee158b..ffff8b4b4949 100644
--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -562,8 +562,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device)
 
         num_sifr = acpi_pcc_get_sqty(device);
 
-        if (num_sifr > 255) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "num_sifr too large"));
+        if (num_sifr < 0 || num_sifr > 255) {
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "num_sifr out of range"));
                 return -ENODEV;
         }
 
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 2baadd21b7a6..98fbe62694d4 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -369,9 +369,9 @@ static int __init pps_init(void)
         int err;
 
         pps_class = class_create(THIS_MODULE, "pps");
-        if (!pps_class) {
+        if (IS_ERR(pps_class)) {
                 pr_err("failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(pps_class);
         }
         pps_class->dev_attrs = pps_attrs;
 
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 691b1ab1a3d0..30d2072f480b 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -410,13 +410,14 @@ static void tsi721_db_dpc(struct work_struct *work)
          */
         mport = priv->mport;
 
-        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE));
-        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE));
+        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE;
+        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE;
 
         while (wr_ptr != rd_ptr) {
                 idb_entry = (u64 *)(priv->idb_base +
                                         (TSI721_IDB_ENTRY_SIZE * rd_ptr));
                 rd_ptr++;
+                rd_ptr %= IDB_QSIZE;
                 idb.msg = *idb_entry;
                 *idb_entry = 0;
 
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index 822e54c394d5..1c226b31af13 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -118,34 +118,34 @@
 
 #define TSI721_IDB_ENTRY_SIZE   64
 
-#define TSI721_IDQ_CTL(x)       (0x20000 + (x) * 1000)
+#define TSI721_IDQ_CTL(x)       (0x20000 + (x) * 0x1000)
 #define TSI721_IDQ_SUSPEND      0x00000002
 #define TSI721_IDQ_INIT         0x00000001
 
-#define TSI721_IDQ_STS(x)       (0x20004 + (x) * 1000)
+#define TSI721_IDQ_STS(x)       (0x20004 + (x) * 0x1000)
 #define TSI721_IDQ_RUN          0x00200000
 
-#define TSI721_IDQ_MASK(x)      (0x20008 + (x) * 1000)
+#define TSI721_IDQ_MASK(x)      (0x20008 + (x) * 0x1000)
 #define TSI721_IDQ_MASK_MASK    0xffff0000
 #define TSI721_IDQ_MASK_PATT    0x0000ffff
 
-#define TSI721_IDQ_RP(x)        (0x2000c + (x) * 1000)
+#define TSI721_IDQ_RP(x)        (0x2000c + (x) * 0x1000)
 #define TSI721_IDQ_RP_PTR       0x0007ffff
 
-#define TSI721_IDQ_WP(x)        (0x20010 + (x) * 1000)
+#define TSI721_IDQ_WP(x)        (0x20010 + (x) * 0x1000)
 #define TSI721_IDQ_WP_PTR       0x0007ffff
 
-#define TSI721_IDQ_BASEL(x)     (0x20014 + (x) * 1000)
+#define TSI721_IDQ_BASEL(x)     (0x20014 + (x) * 0x1000)
 #define TSI721_IDQ_BASEL_ADDR   0xffffffc0
-#define TSI721_IDQ_BASEU(x)     (0x20018 + (x) * 1000)
-#define TSI721_IDQ_SIZE(x)      (0x2001c + (x) * 1000)
+#define TSI721_IDQ_BASEU(x)     (0x20018 + (x) * 0x1000)
+#define TSI721_IDQ_SIZE(x)      (0x2001c + (x) * 0x1000)
 #define TSI721_IDQ_SIZE_VAL(size)       (__fls(size) - 4)
 #define TSI721_IDQ_SIZE_MIN     512
 #define TSI721_IDQ_SIZE_MAX     (512 * 1024)
 
-#define TSI721_SR_CHINT(x)      (0x20040 + (x) * 1000)
-#define TSI721_SR_CHINTE(x)     (0x20044 + (x) * 1000)
-#define TSI721_SR_CHINTSET(x)   (0x20048 + (x) * 1000)
+#define TSI721_SR_CHINT(x)      (0x20040 + (x) * 0x1000)
+#define TSI721_SR_CHINTE(x)     (0x20044 + (x) * 0x1000)
+#define TSI721_SR_CHINTSET(x)   (0x20048 + (x) * 0x1000)
 #define TSI721_SR_CHINT_ODBOK   0x00000020
 #define TSI721_SR_CHINT_IDBQRCV 0x00000010
 #define TSI721_SR_CHINT_SUSP    0x00000008
@@ -156,7 +156,7 @@
 
 #define TSI721_IBWIN_NUM        8
 
-#define TSI721_IBWINLB(x)       (0x29000 + (x) * 20)
+#define TSI721_IBWINLB(x)       (0x29000 + (x) * 0x20)
 #define TSI721_IBWINLB_BA       0xfffff000
 #define TSI721_IBWINLB_WEN      0x00000001
 
@@ -187,13 +187,13 @@
  */
 #define TSI721_OBWIN_NUM        TSI721_PC2SR_WINS
 
-#define TSI721_OBWINLB(x)       (0x40000 + (x) * 20)
+#define TSI721_OBWINLB(x)       (0x40000 + (x) * 0x20)
 #define TSI721_OBWINLB_BA       0xffff8000
 #define TSI721_OBWINLB_WEN      0x00000001
 
-#define TSI721_OBWINUB(x)       (0x40004 + (x) * 20)
+#define TSI721_OBWINUB(x)       (0x40004 + (x) * 0x20)
 
-#define TSI721_OBWINSZ(x)       (0x40008 + (x) * 20)
+#define TSI721_OBWINSZ(x)       (0x40008 + (x) * 0x20)
 #define TSI721_OBWINSZ_SIZE     0x00001f00
 #define TSI721_OBWIN_SIZE(size) (__fls(size) - 15)
 
diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
index df33530cec4a..28b81ae4cf7f 100644
--- a/drivers/regulator/88pm8607.c
+++ b/drivers/regulator/88pm8607.c
@@ -196,7 +196,7 @@ static const unsigned int LDO12_suspend_table[] = {
 };
 
 static const unsigned int LDO13_table[] = {
-        1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0, 0,
+        1200000, 1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0,
 };
 
 static const unsigned int LDO13_suspend_table[] = {
@@ -389,10 +389,10 @@ static struct pm8607_regulator_info pm8607_regulator_info[] = {
         PM8607_LDO( 7,         LDO7, 0, 3, SUPPLIES_EN12, 1),
         PM8607_LDO( 8,         LDO8, 0, 3, SUPPLIES_EN12, 2),
         PM8607_LDO( 9,         LDO9, 0, 3, SUPPLIES_EN12, 3),
-        PM8607_LDO(10,        LDO10, 0, 3, SUPPLIES_EN12, 4),
+        PM8607_LDO(10,        LDO10, 0, 4, SUPPLIES_EN12, 4),
         PM8607_LDO(12,        LDO12, 0, 4, SUPPLIES_EN12, 5),
         PM8607_LDO(13, VIBRATOR_SET, 1, 3,  VIBRATOR_SET, 0),
-        PM8607_LDO(14,        LDO14, 0, 4, SUPPLIES_EN12, 6),
+        PM8607_LDO(14,        LDO14, 0, 3, SUPPLIES_EN12, 6),
 };
 
 static int __devinit pm8607_regulator_probe(struct platform_device *pdev)
diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
index 3767364452fd..09915e89705d 100644
--- a/drivers/regulator/da9052-regulator.c
+++ b/drivers/regulator/da9052-regulator.c
@@ -226,7 +226,7 @@ static int da9052_regulator_set_voltage_int(struct regulator_dev *rdev,
         if (min_uV < info->min_uV)
                 min_uV = info->min_uV;
 
-        *selector = (min_uV - info->min_uV) / info->step_uV;
+        *selector = DIV_ROUND_UP(min_uV - info->min_uV, info->step_uV);
 
         ret = da9052_list_voltage(rdev, *selector);
         if (ret < 0)
@@ -260,8 +260,8 @@ static int da9052_set_ldo5_6_voltage(struct regulator_dev *rdev,
          * the LDO activate bit to implment the changes on the
          * LDO output.
         */
-        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG, 0,
-                                 info->activate_bit);
+        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG,
+                                 info->activate_bit, info->activate_bit);
 }
 
 static int da9052_set_dcdc_voltage(struct regulator_dev *rdev,
@@ -280,8 +280,8 @@ static int da9052_set_dcdc_voltage(struct regulator_dev *rdev,
          * the DCDC activate bit to implment the changes on the
          * DCDC output.
         */
-        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG, 0,
-                                 info->activate_bit);
+        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG,
+                                 info->activate_bit, info->activate_bit);
 }
 
 static int da9052_get_regulator_voltage_sel(struct regulator_dev *rdev)
@@ -318,10 +318,10 @@ static int da9052_set_buckperi_voltage(struct regulator_dev *rdev, int min_uV,
         if ((regulator->da9052->chip_id == DA9052) &&
             (min_uV >= DA9052_CONST_3uV))
                 *selector = DA9052_BUCK_PERI_REG_MAP_UPTO_3uV +
-                            ((min_uV - DA9052_CONST_3uV) /
-                            (DA9052_BUCK_PERI_3uV_STEP));
+                            DIV_ROUND_UP(min_uV - DA9052_CONST_3uV,
+                                         DA9052_BUCK_PERI_3uV_STEP);
         else
-                *selector = (min_uV - info->min_uV) / info->step_uV;
+                *selector = DIV_ROUND_UP(min_uV - info->min_uV, info->step_uV);
 
         ret = da9052_list_buckperi_voltage(rdev, *selector);
         if (ret < 0)
@@ -400,6 +400,7 @@ static struct regulator_ops da9052_ldo_ops = {
                 .ops = &da9052_ldo5_6_ops,\
                 .type = REGULATOR_VOLTAGE,\
                 .id = _id,\
+                .n_voltages = (max - min) / step + 1, \
                 .owner = THIS_MODULE,\
         },\
         .min_uV = (min) * 1000,\
@@ -417,6 +418,7 @@ static struct regulator_ops da9052_ldo_ops = {
                 .ops = &da9052_ldo_ops,\
                 .type = REGULATOR_VOLTAGE,\
                 .id = _id,\
+                .n_voltages = (max - min) / step + 1, \
                 .owner = THIS_MODULE,\
         },\
         .min_uV = (min) * 1000,\
@@ -434,6 +436,7 @@ static struct regulator_ops da9052_ldo_ops = {
                 .ops = &da9052_dcdc_ops,\
                 .type = REGULATOR_VOLTAGE,\
                 .id = _id,\
+                .n_voltages = (max - min) / step + 1, \
                 .owner = THIS_MODULE,\
         },\
         .min_uV = (min) * 1000,\
@@ -451,6 +454,7 @@ static struct regulator_ops da9052_ldo_ops = {
                 .ops = &da9052_buckperi_ops,\
                 .type = REGULATOR_VOLTAGE,\
                 .id = _id,\
+                .n_voltages = (max - min) / step + 1, \
                 .owner = THIS_MODULE,\
         },\
         .min_uV = (min) * 1000,\
diff --git a/drivers/regulator/tps6524x-regulator.c b/drivers/regulator/tps6524x-regulator.c
index 70b7b1f4f000..2e94686b6fe6 100644
--- a/drivers/regulator/tps6524x-regulator.c
+++ b/drivers/regulator/tps6524x-regulator.c
@@ -481,7 +481,7 @@ static int set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
         if (i >= info->n_voltages)
                 i = info->n_voltages - 1;
 
-        *selector = info->voltages[i];
+        *selector = i;
 
         return write_field(hw, &info->voltage, i);
 }
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index 5c15ba01e9c7..40ecf5165899 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -662,7 +662,7 @@ static int tps65910_set_voltage_dcdc(struct regulator_dev *dev,
                 tps65910_reg_write(pmic, TPS65910_VDD2_OP, vsel);
                 break;
         case TPS65911_REG_VDDCTRL:
-                vsel = selector;
+                vsel = selector + 3;
                 tps65910_reg_write(pmic, TPS65911_VDDCTRL_OP, vsel);
         }
 
diff --git a/drivers/rtc/rtc-r9701.c b/drivers/rtc/rtc-r9701.c
index 9beba49c3c5b..2853c2a6f10f 100644
--- a/drivers/rtc/rtc-r9701.c
+++ b/drivers/rtc/rtc-r9701.c
@@ -125,6 +125,13 @@ static int __devinit r9701_probe(struct spi_device *spi)
         unsigned char tmp;
         int res;
 
+        tmp = R100CNT;
+        res = read_regs(&spi->dev, &tmp, 1);
+        if (res || tmp != 0x20) {
+                dev_err(&spi->dev, "cannot read RTC register\n");
+                return -ENODEV;
+        }
+
         rtc = rtc_device_register("r9701",
                                 &spi->dev, &r9701_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc))
@@ -132,13 +139,6 @@ static int __devinit r9701_probe(struct spi_device *spi)
 
         dev_set_drvdata(&spi->dev, rtc);
 
-        tmp = R100CNT;
-        res = read_regs(&spi->dev, &tmp, 1);
-        if (res || tmp != 0x20) {
-                rtc_device_unregister(rtc);
-                return res;
-        }
-
         return 0;
 }
 
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 70880be26015..2617b1ed4709 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -18,12 +18,12 @@
 #include <linux/hdreg.h>        /* HDIO_GETGEO                      */
 #include <linux/bio.h>
 #include <linux/module.h>
+#include <linux/compat.h>
 #include <linux/init.h>
 
 #include <asm/debug.h>
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
-#include <asm/compat.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/cio.h>
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index f1a2016829fc..792c69e78fe2 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -13,6 +13,7 @@
 #define KMSG_COMPONENT "dasd"
 
 #include <linux/interrupt.h>
+#include <linux/compat.h>
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/blkpg.h>
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index e71298158f9e..911704571b9c 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -11,6 +11,7 @@
 #include <linux/console.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/compat.h>
 #include <linux/module.h>
 #include <linux/list.h>
 #include <linux/slab.h>
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index 75bde6a8b7dc..89c03e6b1c0c 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -13,6 +13,7 @@
 
 #include <linux/fs.h>
 #include <linux/init.h>
+#include <linux/compat.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/slab.h>
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index 0c87b0fc7714..8f9a1a384496 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/slab.h>
+#include <linux/compat.h>
 #include <linux/device.h>
 #include <linux/module.h>
 #include <linux/uaccess.h>
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 3ef8d071c64a..770a740a393c 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -167,7 +167,7 @@ again:
         DBF_ERROR("%4x EQBS ERROR", SCH_NO(q));
         DBF_ERROR("%3d%3d%2d", count, tmp_count, nr);
         q->handler(q->irq_ptr->cdev, QDIO_ERROR_ACTIVATE_CHECK_CONDITION,
-                   0, -1, -1, q->irq_ptr->int_parm);
+                   q->nr, q->first_to_kick, count, q->irq_ptr->int_parm);
         return 0;
 }
 
@@ -215,7 +215,7 @@ again:
         DBF_ERROR("%4x SQBS ERROR", SCH_NO(q));
         DBF_ERROR("%3d%3d%2d", count, tmp_count, nr);
         q->handler(q->irq_ptr->cdev, QDIO_ERROR_ACTIVATE_CHECK_CONDITION,
-                   0, -1, -1, q->irq_ptr->int_parm);
+                   q->nr, q->first_to_kick, count, q->irq_ptr->int_parm);
         return 0;
 }
 
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index 303dde09d294..fab2c2592a97 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -11,6 +11,7 @@
 #define KMSG_COMPONENT "zfcp"
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
+#include <linux/compat.h>
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/miscdevice.h>
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index b31a8e3841d7..d4ed9eb52657 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -69,10 +69,10 @@
 #ifndef SCSI_OSD_MAJOR
 #  define SCSI_OSD_MAJOR 260
 #endif
-#define SCSI_OSD_MAX_MINOR 64
+#define SCSI_OSD_MAX_MINOR MINORMASK
 
 static const char osd_name[] = "osd";
-static const char *osd_version_string = "open-osd 0.2.0";
+static const char *osd_version_string = "open-osd 0.2.1";
 
 MODULE_AUTHOR("Boaz Harrosh <bharrosh@panasas.com>");
 MODULE_DESCRIPTION("open-osd Upper-Layer-Driver osd.ko");
diff --git a/drivers/scsi/sd_dif.c b/drivers/scsi/sd_dif.c
index 0cb39ff21171..f8fb2d691c0a 100644
--- a/drivers/scsi/sd_dif.c
+++ b/drivers/scsi/sd_dif.c
@@ -408,7 +408,7 @@ int sd_dif_prepare(struct request *rq, sector_t hw_sector, unsigned int sector_s
                         kunmap_atomic(sdt, KM_USER0);
                 }
 
-                bio->bi_flags |= BIO_MAPPED_INTEGRITY;
+                bio->bi_flags |= (1 << BIO_MAPPED_INTEGRITY);
         }
 
         return 0;
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 2f9cb43a2398..f37ad2271ad5 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1083,7 +1083,7 @@ err_alloc_rx_sg:
         return -ENOMEM;
 }
 
-static int __init pl022_dma_probe(struct pl022 *pl022)
+static int __devinit pl022_dma_probe(struct pl022 *pl022)
 {
         dma_cap_mask_t mask;
 
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 44262908def5..501b27c18145 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1028,7 +1028,7 @@ done:
                 return iscsit_add_reject_from_cmd(
                                 ISCSI_REASON_BOOKMARK_NO_RESOURCES,
                                 1, 1, buf, cmd);
-        } else if (transport_ret == -EINVAL) {
+        } else if (transport_ret < 0) {
                 /*
                  * Unsupported SAM Opcode.  CHECK_CONDITION will be sent
                  * in iscsit_execute_cmd() during the CmdSN OOO Execution
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index b7c779389eea..63e703bb6ac9 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -117,7 +117,7 @@ static struct t10_pr_registration *core_scsi3_locate_pr_reg(struct se_device *,
                                         struct se_node_acl *, struct se_session *);
 static void core_scsi3_put_pr_reg(struct t10_pr_registration *);
 
-static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
+static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd)
 {
         struct se_session *se_sess = cmd->se_sess;
         struct se_subsystem_dev *su_dev = cmd->se_dev->se_sub_dev;
@@ -127,7 +127,7 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
         int conflict = 0;
 
         if (!crh)
-                return false;
+                return -EINVAL;
 
         pr_reg = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl,
                         se_sess);
@@ -155,16 +155,14 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
                  */
                 if (pr_reg->pr_res_holder) {
                         core_scsi3_put_pr_reg(pr_reg);
-                        *ret = 0;
-                        return false;
+                        return 1;
                 }
                 if ((pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY) ||
                     (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY) ||
                     (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
                     (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) {
                         core_scsi3_put_pr_reg(pr_reg);
-                        *ret = 0;
-                        return true;
+                        return 1;
                 }
                 core_scsi3_put_pr_reg(pr_reg);
                 conflict = 1;
@@ -189,10 +187,10 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret)
                         " while active SPC-3 registrations exist,"
                         " returning RESERVATION_CONFLICT\n");
                 cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
-                return true;
+                return -EBUSY;
         }
 
-        return false;
+        return 0;
 }
 
 int target_scsi2_reservation_release(struct se_task *task)
@@ -201,12 +199,18 @@ int target_scsi2_reservation_release(struct se_task *task)
         struct se_device *dev = cmd->se_dev;
         struct se_session *sess = cmd->se_sess;
         struct se_portal_group *tpg = sess->se_tpg;
-        int ret = 0;
+        int ret = 0, rc;
 
         if (!sess || !tpg)
                 goto out;
-        if (target_check_scsi2_reservation_conflict(cmd, &ret))
+        rc = target_check_scsi2_reservation_conflict(cmd);
+        if (rc == 1)
+                goto out;
+        else if (rc < 0) {
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                ret = -EINVAL;
                 goto out;
+        }
 
         ret = 0;
         spin_lock(&dev->dev_reservation_lock);
@@ -243,7 +247,7 @@ int target_scsi2_reservation_reserve(struct se_task *task)
         struct se_device *dev = cmd->se_dev;
         struct se_session *sess = cmd->se_sess;
         struct se_portal_group *tpg = sess->se_tpg;
-        int ret = 0;
+        int ret = 0, rc;
 
         if ((cmd->t_task_cdb[1] & 0x01) &&
             (cmd->t_task_cdb[1] & 0x02)) {
@@ -259,8 +263,14 @@ int target_scsi2_reservation_reserve(struct se_task *task)
          */
         if (!sess || !tpg)
                 goto out;
-        if (target_check_scsi2_reservation_conflict(cmd, &ret))
+        rc = target_check_scsi2_reservation_conflict(cmd);
+        if (rc == 1)
                 goto out;
+        else if (rc < 0) {
+                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+                ret = -EINVAL;
+                goto out;
+        }
 
         ret = 0;
         spin_lock(&dev->dev_reservation_lock);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 58cea07b12fb..cd5cd95812bb 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2539,6 +2539,7 @@ static int transport_generic_cmd_sequencer(
                                         cmd, cdb, pr_reg_type) != 0) {
                         cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
                         cmd->se_cmd_flags |= SCF_SCSI_RESERVATION_CONFLICT;
+                        cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
                         cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
                         return -EBUSY;
                 }
diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
index b3d17416d86a..830cd62d8492 100644
--- a/drivers/tty/Kconfig
+++ b/drivers/tty/Kconfig
@@ -365,7 +365,7 @@ config PPC_EPAPR_HV_BYTECHAN
 
 config PPC_EARLY_DEBUG_EHV_BC
         bool "Early console (udbg) support for ePAPR hypervisors"
-        depends on PPC_EPAPR_HV_BYTECHAN
+        depends on PPC_EPAPR_HV_BYTECHAN=y
         help
           Select this option to enable early console (a.k.a. "udbg") support
           via an ePAPR byte channel.  You also need to choose the byte channel
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 75085795528e..61b7fd2729cd 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1710,6 +1710,8 @@ static int sci_startup(struct uart_port *port)
 
         dev_dbg(port->dev, "%s(%d)\n", __func__, port->line);
 
+        pm_runtime_put_noidle(port->dev);
+
         sci_port_enable(s);
 
         ret = sci_request_irq(s);
@@ -1737,6 +1739,8 @@ static void sci_shutdown(struct uart_port *port)
         sci_free_irq(s);
 
         sci_port_disable(s);
+
+        pm_runtime_get_noresume(port->dev);
 }
 
 static unsigned int sci_scbrr_calc(unsigned int algo_id, unsigned int bps,
@@ -2075,6 +2079,7 @@ static int __devinit sci_init_single(struct platform_device *dev,
                 sci_init_gpios(sci_port);
 
                 pm_runtime_irq_safe(&dev->dev);
+                pm_runtime_get_noresume(&dev->dev);
                 pm_runtime_enable(&dev->dev);
         }
 
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index c26a82e83f6e..b556a72264d1 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -239,7 +239,7 @@ static void ehci_fsl_setup_phy(struct ehci_hcd *ehci,
         ehci_writel(ehci, portsc, &ehci->regs->port_status[port_offset]);
 }
 
-static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
+static void ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 {
         struct usb_hcd *hcd = ehci_to_hcd(ehci);
         struct fsl_usb2_platform_data *pdata;
@@ -299,19 +299,12 @@ static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 #endif
                 out_be32(non_ehci + FSL_SOC_USB_SICTRL, 0x00000001);
         }
-
-        if (!(in_be32(non_ehci + FSL_SOC_USB_CTRL) & CTRL_PHY_CLK_VALID)) {
-                printk(KERN_WARNING "fsl-ehci: USB PHY clock invalid\n");
-                return -ENODEV;
-        }
-        return 0;
 }
 
 /* called after powerup, by probe or system-pm "wakeup" */
 static int ehci_fsl_reinit(struct ehci_hcd *ehci)
 {
-        if (ehci_fsl_usb_setup(ehci))
-                return -ENODEV;
+        ehci_fsl_usb_setup(ehci);
         ehci_port_power(ehci, 0);
 
         return 0;
diff --git a/drivers/usb/host/ehci-fsl.h b/drivers/usb/host/ehci-fsl.h
index bdf43e2adc51..491806221165 100644
--- a/drivers/usb/host/ehci-fsl.h
+++ b/drivers/usb/host/ehci-fsl.h
@@ -45,6 +45,5 @@
 #define FSL_SOC_USB_PRICTRL     0x40c   /* NOTE: big-endian */
 #define FSL_SOC_USB_SICTRL      0x410   /* NOTE: big-endian */
 #define FSL_SOC_USB_CTRL        0x500   /* NOTE: big-endian */
-#define CTRL_PHY_CLK_VALID      (1 << 17)
 #define SNOOP_SIZE_2GB          0x1e
 #endif                          /* _EHCI_FSL_H */
diff --git a/drivers/video/backlight/s6e63m0.c b/drivers/video/backlight/s6e63m0.c
index e132157d8545..516db703dd24 100644
--- a/drivers/video/backlight/s6e63m0.c
+++ b/drivers/video/backlight/s6e63m0.c
@@ -690,7 +690,7 @@ static ssize_t s6e63m0_sysfs_store_gamma_mode(struct device *dev,
         struct backlight_device *bd = NULL;
         int brightness, rc;
 
-        rc = strict_strtoul(buf, 0, (unsigned long *)&lcd->gamma_mode);
+        rc = kstrtouint(buf, 0, &lcd->gamma_mode);
         if (rc < 0)
                 return rc;
 
diff --git a/drivers/video/omap2/displays/Kconfig b/drivers/video/omap2/displays/Kconfig
index 74d29b552901..408a9927be92 100644
--- a/drivers/video/omap2/displays/Kconfig
+++ b/drivers/video/omap2/displays/Kconfig
@@ -12,7 +12,7 @@ config PANEL_GENERIC_DPI
 
 config PANEL_DVI
         tristate "DVI output"
-        depends on OMAP2_DSS_DPI
+        depends on OMAP2_DSS_DPI && I2C
         help
           Driver for external monitors, connected via DVI. The driver uses i2c
           to read EDID information from the monitor.
diff --git a/drivers/video/omap2/dss/apply.c b/drivers/video/omap2/dss/apply.c
index 052dc874cd3d..87b3e25294cf 100644
--- a/drivers/video/omap2/dss/apply.c
+++ b/drivers/video/omap2/dss/apply.c
@@ -1276,6 +1276,9 @@ int dss_ovl_enable(struct omap_overlay *ovl)
 
         spin_unlock_irqrestore(&data_lock, flags);
 
+        /* wait for overlay to be enabled */
+        wait_pending_extra_info_updates();
+
         mutex_unlock(&apply_lock);
 
         return 0;
@@ -1313,6 +1316,9 @@ int dss_ovl_disable(struct omap_overlay *ovl)
 
         spin_unlock_irqrestore(&data_lock, flags);
 
+        /* wait for the overlay to be disabled */
+        wait_pending_extra_info_updates();
+
         mutex_unlock(&apply_lock);
 
         return 0;
diff --git a/drivers/video/omap2/dss/hdmi.c b/drivers/video/omap2/dss/hdmi.c
index d7aa3b056529..a36b934b2db4 100644
--- a/drivers/video/omap2/dss/hdmi.c
+++ b/drivers/video/omap2/dss/hdmi.c
@@ -165,9 +165,25 @@ static int hdmi_runtime_get(void)
 
         DSSDBG("hdmi_runtime_get\n");
 
+        /*
+         * HACK: Add dss_runtime_get() to ensure DSS clock domain is enabled.
+         * This should be removed later.
+         */
+        r = dss_runtime_get();
+        if (r < 0)
+                goto err_get_dss;
+
         r = pm_runtime_get_sync(&hdmi.pdev->dev);
         WARN_ON(r < 0);
-        return r < 0 ? r : 0;
+        if (r < 0)
+                goto err_get_hdmi;
+
+        return 0;
+
+err_get_hdmi:
+        dss_runtime_put();
+err_get_dss:
+        return r;
 }
 
 static void hdmi_runtime_put(void)
@@ -178,6 +194,12 @@ static void hdmi_runtime_put(void)
 
         r = pm_runtime_put_sync(&hdmi.pdev->dev);
         WARN_ON(r < 0);
+
+        /*
+         * HACK: This is added to complement the dss_runtime_get() call in
+         * hdmi_runtime_get(). This should be removed later.
+         */
+        dss_runtime_put();
 }
 
 int hdmi_init_display(struct omap_dss_device *dssdev)
diff --git a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
index 2d72334ca3da..6847a478b459 100644
--- a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
+++ b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
@@ -479,14 +479,7 @@ int ti_hdmi_4xxx_read_edid(struct hdmi_ip_data *ip_data,
 
 bool ti_hdmi_4xxx_detect(struct hdmi_ip_data *ip_data)
 {
-        int r;
-
-        void __iomem *base = hdmi_core_sys_base(ip_data);
-
-        /* HPD */
-        r = REG_GET(base, HDMI_CORE_SYS_SYS_STAT, 1, 1);
-
-        return r == 1;
+        return gpio_get_value(ip_data->hpd_gpio);
 }
 
 static void hdmi_core_init(struct hdmi_core_video_config *video_cfg,
diff --git a/drivers/video/via/hw.c b/drivers/video/via/hw.c
index d5aaca9cfa7e..8497727d66de 100644
--- a/drivers/video/via/hw.c
+++ b/drivers/video/via/hw.c
@@ -1810,7 +1810,11 @@ static void hw_init(void)
                 break;
         }
 
+        /* magic required on VX900 for correct modesetting on IGA1 */
+        via_write_reg_mask(VIACR, 0x45, 0x00, 0x01);
+
         /* probably this should go to the scaling code one day */
+        via_write_reg_mask(VIACR, 0xFD, 0, 0x80); /* VX900 hw scale on IGA2 */
         viafb_write_regx(scaling_parameters, ARRAY_SIZE(scaling_parameters));
 
         /* Fill VPIT Parameters */
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 95aeedf198f8..958e5129c601 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -367,29 +367,45 @@ static void __devexit virtballoon_remove(struct virtio_device *vdev)
 #ifdef CONFIG_PM
 static int virtballoon_freeze(struct virtio_device *vdev)
 {
+        struct virtio_balloon *vb = vdev->priv;
+
         /*
          * The kthread is already frozen by the PM core before this
          * function is called.
          */
 
+        while (vb->num_pages)
+                leak_balloon(vb, vb->num_pages);
+        update_balloon_size(vb);
+
         /* Ensure we don't get any more requests from the host */
         vdev->config->reset(vdev);
         vdev->config->del_vqs(vdev);
         return 0;
 }
 
+static int restore_common(struct virtio_device *vdev)
+{
+        struct virtio_balloon *vb = vdev->priv;
+        int ret;
+
+        ret = init_vqs(vdev->priv);
+        if (ret)
+                return ret;
+
+        fill_balloon(vb, towards_target(vb));
+        update_balloon_size(vb);
+        return 0;
+}
+
 static int virtballoon_thaw(struct virtio_device *vdev)
 {
-        return init_vqs(vdev->priv);
+        return restore_common(vdev);
 }
 
 static int virtballoon_restore(struct virtio_device *vdev)
 {
         struct virtio_balloon *vb = vdev->priv;
-        struct page *page, *page2;
-
-        /* We're starting from a clean slate */
-        vb->num_pages = 0;
 
         /*
          * If a request wasn't complete at the time of freezing, this
@@ -397,12 +413,7 @@ static int virtballoon_restore(struct virtio_device *vdev)
          */
         vb->need_stats_update = 0;
 
-        /* We don't have these pages in the balloon anymore! */
-        list_for_each_entry_safe(page, page2, &vb->pages, lru) {
-                list_del(&page->lru);
-                totalram_pages++;
-        }
-        return init_vqs(vdev->priv);
+        return restore_common(vdev);
 }
 #endif
 
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 877b107f77a7..df9e8f0e327d 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1098,7 +1098,7 @@ config BOOKE_WDT_DEFAULT_TIMEOUT
           For Freescale Book-E processors, this is a number between 0 and 63.
           For other Book-E processors, this is a number between 0 and 3.
 
-          The value can be overidden by the wdt_period command-line parameter.
+          The value can be overridden by the wdt_period command-line parameter.
 
 # PPC64 Architecture
 
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 337265b47305..7c0fdfca2646 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -198,9 +198,13 @@ static long booke_wdt_ioctl(struct file *file,
                 booke_wdt_period = tmp;
 #endif
                 booke_wdt_set();
-                return 0;
+                /* Fall */
         case WDIOC_GETTIMEOUT:
+#ifdef  CONFIG_FSL_BOOKE
+                return put_user(period_to_sec(booke_wdt_period), p);
+#else
                 return put_user(booke_wdt_period, p);
+#endif
         default:
                 return -ENOTTY;
         }
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 8464ea1c36a1..3c166d3f4e55 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -231,7 +231,7 @@ static int __devinit cru_detect(unsigned long map_entry,
 
         cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
 
-        set_memory_x((unsigned long)bios32_entrypoint, (2 * PAGE_SIZE));
+        set_memory_x((unsigned long)bios32_map, 2);
         asminline_call(&cmn_regs, bios32_entrypoint);
 
         if (cmn_regs.u1.ral != 0) {
@@ -250,7 +250,8 @@ static int __devinit cru_detect(unsigned long map_entry,
                         cru_rom_addr =
                                 ioremap(cru_physical_address, cru_length);
                         if (cru_rom_addr) {
-                                set_memory_x((unsigned long)cru_rom_addr, cru_length);
+                                set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
+                                        (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT);
                                 retval = 0;
                         }
                 }
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 8e210aafdfd0..dfae030a7ef2 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -264,7 +264,7 @@ static int __devinit pnx4008_wdt_probe(struct platform_device *pdev)
         wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (wdt_mem == NULL) {
                 printk(KERN_INFO MODULE_NAME
-                        "failed to get memory region resouce\n");
+                        "failed to get memory region resource\n");
                 return -ENOENT;
         }
 
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 4bc3744e14e4..404172f02c9b 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -312,18 +312,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
         dev = &pdev->dev;
         wdt_dev = &pdev->dev;
 
-        /* get the memory region for the watchdog timer */
-
         wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (wdt_mem == NULL) {
                 dev_err(dev, "no memory resource specified\n");
                 return -ENOENT;
         }
 
+        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (wdt_irq == NULL) {
+                dev_err(dev, "no irq resource specified\n");
+                ret = -ENOENT;
+                goto err;
+        }
+
+        /* get the memory region for the watchdog timer */
+
         size = resource_size(wdt_mem);
         if (!request_mem_region(wdt_mem->start, size, pdev->name)) {
                 dev_err(dev, "failed to get memory region\n");
-                return -EBUSY;
+                ret = -EBUSY;
+                goto err;
         }
 
         wdt_base = ioremap(wdt_mem->start, size);
@@ -335,29 +343,17 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
         DBG("probe: mapped wdt_base=%p\n", wdt_base);
 
-        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (wdt_irq == NULL) {
-                dev_err(dev, "no irq resource specified\n");
-                ret = -ENOENT;
-                goto err_map;
-        }
-
-        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
-        if (ret != 0) {
-                dev_err(dev, "failed to install irq (%d)\n", ret);
-                goto err_map;
-        }
-
         wdt_clock = clk_get(&pdev->dev, "watchdog");
         if (IS_ERR(wdt_clock)) {
                 dev_err(dev, "failed to find watchdog clock source\n");
                 ret = PTR_ERR(wdt_clock);
-                goto err_irq;
+                goto err_map;
         }
 
         clk_enable(wdt_clock);
 
-        if (s3c2410wdt_cpufreq_register() < 0) {
+        ret = s3c2410wdt_cpufreq_register();
+        if (ret < 0) {
                 printk(KERN_ERR PFX "failed to register cpufreq\n");
                 goto err_clk;
         }
@@ -378,12 +374,18 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
                                                         "cannot start\n");
         }
 
+        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
+        if (ret != 0) {
+                dev_err(dev, "failed to install irq (%d)\n", ret);
+                goto err_cpufreq;
+        }
+
         watchdog_set_nowayout(&s3c2410_wdd, nowayout);
 
         ret = watchdog_register_device(&s3c2410_wdd);
         if (ret) {
                 dev_err(dev, "cannot register watchdog (%d)\n", ret);
-                goto err_cpufreq;
+                goto err_irq;
         }
 
         if (tmr_atboot && started == 0) {
@@ -408,23 +410,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
         return 0;
 
+ err_irq:
+        free_irq(wdt_irq->start, pdev);
+
  err_cpufreq:
         s3c2410wdt_cpufreq_deregister();
 
  err_clk:
         clk_disable(wdt_clock);
         clk_put(wdt_clock);
-
- err_irq:
-        free_irq(wdt_irq->start, pdev);
+        wdt_clock = NULL;
 
  err_map:
         iounmap(wdt_base);
 
  err_req:
         release_mem_region(wdt_mem->start, size);
-        wdt_mem = NULL;
 
+ err:
+        wdt_irq = NULL;
+        wdt_mem = NULL;
         return ret;
 }
 
@@ -432,18 +437,18 @@ static int __devexit s3c2410wdt_remove(struct platform_device *dev)
 {
         watchdog_unregister_device(&s3c2410_wdd);
 
+        free_irq(wdt_irq->start, dev);
+
         s3c2410wdt_cpufreq_deregister();
 
         clk_disable(wdt_clock);
         clk_put(wdt_clock);
         wdt_clock = NULL;
 
-        free_irq(wdt_irq->start, dev);
-        wdt_irq = NULL;
-
         iounmap(wdt_base);
 
         release_mem_region(wdt_mem->start, resource_size(wdt_mem));
+        wdt_irq = NULL;
         wdt_mem = NULL;
         return 0;
 }